aegis-desktop 1.0.13 → 1.0.14

package/renderer/app.js

@@ -1187,8 +1187,14 @@ function renderUpdateBanner(state) {
     // Download button — `canDownload` is true only when it has an argv to run.
     // The rest (npx, a source checkout) have nothing to install, so the banner
     // names the command instead of offering a button that would do nothing.
+    // `commandIsSentence` is the main process saying this channel has no
+    // command to type — a packaged build, an npx run, a source checkout. Those
+    // get the sentence as written; prefixing "run:" to prose reads as a command
+    // that does not exist.
     text = state.command
-      ? `Update ${version}available — run: ${state.command}`
+      ? (state.commandIsSentence
+        ? `Update ${version}available. ${state.command}`
+        : `Update ${version}available — run: ${state.command}`)
       : `Update ${version}available.`;
     showDownload = !!state.canDownload;
     if (showDownload) text = `Update ${version}available.`;
@@ -3075,6 +3081,13 @@ async function applyWelcomeAiLine() {
     tools: false,
     singlePass: true,
     effort: 'low',
+    // A sentence the user never asked for, asked for on boot while the window
+    // is still painting. If the provider stalls past its budget, main resolves
+    // this with `bestEffortFailed` and logs one classified line instead of
+    // Electron printing "Error occurred in handler for 'model:chat'" plus a
+    // provider stack as the first thing the app says. The catch below already
+    // treats "no answer" as "keep the fact line".
+    bestEffort: true,
   };
   if (modelId) payload.model = modelId;
 
@@ -3723,11 +3736,38 @@ async function spawnPath(card, spec) {
         // one provider call, always.
         singlePass: true,
         sessionId: id,
+        // A discovery path is a background dispatch beside the answer the user
+        // actually waited for. When it stalls, the catch below already renders
+        // "Path unavailable: …" into its own card — that IS the failure UI. So
+        // it is marked best-effort: main resolves a classified payload rather
+        // than rejecting, and the terminal gets one line instead of Electron's
+        // raw "Error occurred in handler for 'model:chat'" stack for a card the
+        // user can already see is stopped.
+        bestEffort: true,
       },
       onDelta
     );
 
     const choice = (data && data.choices && data.choices[0]) || {};
+    // `bestEffort` above means a stalled lane RESOLVES instead of rejecting,
+    // so the throw-handler at the bottom of this function no longer runs for
+    // it. Without this branch a timeout would render as a successful card
+    // reading "(no path found)" — claiming the model looked and found nothing
+    // when in fact it never answered. Say which one happened.
+    if (data && data.bestEffortFailed) {
+      throw new Error(data.message || 'the provider did not answer');
+    }
+    // Same rebuild as the turn path: a card's own stop button aborts this
+    // lane's session, and that abort now resolves instead of rejecting. Left
+    // unhandled it would fall through to the success branch and mark a
+    // cancelled card "done" — claiming a path completed when the user cut it
+    // off. The catch below already renders it stopped.
+    if (data && data.aborted) {
+      const stop = new Error(data.message || 'This operation was aborted');
+      stop.name = 'AbortError';
+      stop.code = 'ABORT_ERR';
+      throw stop;
+    }
     const text =
       (choice.message && choice.message.content) || streamed || '(no path found)';
     renderMessageBody(body, 'assistant', text);
@@ -4336,6 +4376,16 @@ async function loadModels(cls) {
     // which serve Ollama's /api/tags, so the user can still type a model id.
     const needsDaemon = Boolean(data && data.needsDaemon);
     const listed = !(data && data.listed === false);
+    // BYOK's two states the other classes cannot have, both reported by
+    // engine.listModels so this file never has to infer them. `providersFailed`
+    // means the CATALOG CALL failed — distinct from a catalog that answered
+    // with nothing, and distinct from `listed` above (that one is the local
+    // class's tag list). `unmatchedProviders` names declarations in
+    // `models.json` for providers the catalog does not list.
+    const providersFailed = Boolean(data && data.providersFailed);
+    const unmatchedProviders = Array.isArray(data && data.unmatchedProviders)
+      ? data.unmatchedProviders
+      : [];
     // Typed tag: shown only when the picker has nothing to offer, which is
     // precisely the state the transport's own error message names ("pick one
     // from the model list, or type a tag"). When the daemon hands us a list the
@@ -4364,6 +4414,17 @@ async function loadModels(cls) {
       // surface is plain OpenAI-compatible, so a typed tag works.
       hint = 'That address answered but listed no models — not Ollama? ' +
         'Type the model tag in the box above and send.';
+    } else if (cls === 'byok' && providersFailed) {
+      // The catalog call itself failed — offline, a 5xx, a relay hiccup. The
+      // empty picker below would otherwise render as "No models listed.", which
+      // reads as an account with nothing configured and would hide the reason
+      // the user actually needs. Nothing is lost: the saved provider key and
+      // the `models.json` declaration live on disk and come back on Refresh.
+      // Placed BEFORE the empty-list branch because an empty list is the
+      // symptom here, not the state.
+      hint = 'Provider catalog unreachable — your saved keys and declared ' +
+        'models are unaffected. Refresh to try again.' +
+        (data && data.providersError ? ` (${data.providersError})` : '');
     } else if (!list.length) {
       // The Aegis Cloud class offers no model to pin (engine.js's aegis branch
       // omits the aegiscloud ids on purpose), so an empty list there is the
@@ -4411,6 +4472,21 @@ async function loadModels(cls) {
     } else {
       hint = `${list.length} model${list.length === 1 ? '' : 's'} available.`;
     }
+    // Declarations for providers the catalog does not name (typo, or a provider
+    // renamed/dropped server-side) are never turned into a row — `withUserModels`
+    // refuses to fabricate one, because it would 401 on its first turn. Saying
+    // so is the alternative to silence: the model is still in `models.json` and
+    // the user would otherwise just notice it missing. Appended to whatever
+    // state the list is in, including a successful one.
+    //
+    // NOT appended when the catalog itself failed: every declaration is
+    // "unmatched" against a list that never arrived, and naming them as bad
+    // would send the user to fix provider names that are perfectly correct.
+    if (cls === 'byok' && !providersFailed && unmatchedProviders.length) {
+      const names = unmatchedProviders.join(', ');
+      hint = `${hint} Not shown: ${names} — declared in models.json, but not in ` +
+        'the provider catalog. Check the provider name in Settings.';
+    }
     // Display-only: what this model says its own output limit is. It sizes no
     // request — budgetFor() answers that from the Effort rung.
     const ceiling = maxTokensCeiling(modelMeta.get(currentModelId()));
@@ -4791,7 +4867,9 @@ async function loadSettings() {
       text.textContent =
         `BYOK handling fee: ${per1k(fee.in_usd_per_1k)} / 1k in, ` +
         `${per1k(fee.out_usd_per_1k)} / 1k out — billed to your AEGIS account ` +
-        'on top of your own provider bill.';
+        'on top of your own provider bill. This is the published rate, not a ' +
+        'personal quote — Unlimited subscribers pay no handling fee at all, ' +
+        'and neither do users on the free 1-month Unlimited trial.';
       note.appendChild(text);
       els.settingsList.appendChild(note);
     }
@@ -5807,6 +5885,21 @@ async function send() {
       onDelta
     );
 
+    // A stop that crossed IPC arrives as a resolved payload, not a rejection:
+    // main cannot let the abort reject, because `ipcMain.handle` prints every
+    // rejection with a full stack and a user-pressed stop is not a crash (see
+    // the `aborted` note in registerModelIpc). Rebuild the AbortError here so
+    // the catch below runs EXACTLY as it did before — `isCancellation` →
+    // `salvageTurn` → a kept, half-written answer labelled "stopped by you".
+    // Without this the salvaged text would be thrown away and the stop would
+    // read as a completed turn with an empty reply.
+    if (data && data.aborted) {
+      const stop = new Error(data.message || 'This operation was aborted');
+      stop.name = 'AbortError';
+      stop.code = 'ABORT_ERR';
+      throw stop;
+    }
+
     const choice = (data && data.choices && data.choices[0]) || {};
     const text =
       (choice.message && choice.message.content) ||
@@ -6178,6 +6271,13 @@ async function init() {
       if (fpPanel && typeof fpPanel.open === 'function') fpPanel.open();
     });
   }
+  // Account > Google Drive Backup… — same panel, scrolled straight to the
+  // Drive row instead of leaving Sign in with Google to be found by hand.
+  if (aegis.onMenuGoogleDrive) {
+    aegis.onMenuGoogleDrive(() => {
+      if (fpPanel && typeof fpPanel.open === 'function') fpPanel.open({ focus: 'drive' });
+    });
+  }
   if (aegis.onMenuExportMarkdown) aegis.onMenuExportMarkdown(() => exportSession('markdown'));
   if (aegis.onMenuExportJson) aegis.onMenuExportJson(() => exportSession('json'));
   // aegis:// deep link (main.js sendDeepLinkToWindow) — delivered once the

package/renderer/fingerprint.js

@@ -621,7 +621,7 @@
       return Boolean(o) && !o.hidden;
     };
 
-    async function open() {
+    async function open(opts) {
       const o = el(IDS.overlay);
       if (!o) return;
       o.hidden = false;
@@ -630,6 +630,22 @@
       if (d.body && d.body.classList) d.body.classList.add('fp-open');
       await refresh();
       await doVault();
+      // The Google Drive row sits at the bottom of a panel most of whose
+      // controls are unrelated (the φ(α) key). The top-menu entry for it
+      // (main.js's "Google Drive Backup…") opens straight here instead of
+      // leaving the user to find it among Seal/Verify/Publish/Vault.
+      if (opts && opts.focus === 'drive') {
+        const row = el(IDS.driveStatus);
+        if (row && row.scrollIntoView) row.scrollIntoView({ block: 'center' });
+        // Whichever Drive action is actually clickable right now — sign-in
+        // first, then connect, then sync — so focus lands on the next step
+        // instead of a disabled button.
+        const next = [IDS.driveSignIn, IDS.driveConnect, IDS.driveSyncNow]
+          .map(el)
+          .find((btn) => btn && !btn.disabled);
+        if (next) next.focus();
+        return;
+      }
       const f = el(IDS.close);
       if (f) f.focus();
     }

package/vendor/aegis.js

@@ -489,6 +489,47 @@ const TRANSIENT_STREAM_ERROR_PATTERN =
 const TRANSIENT_STREAM_RETRIES = 2;
 const TRANSIENT_STREAM_BASE_WAIT_MS = 500;
 
+/**
+ * The sentence aegis1 puts in a mid-stream error frame when the UPSTREAM
+ * provider call it was relaying hit its own deadline. Deliberately kept out of
+ * TRANSIENT_STREAM_ERROR_PATTERN: a socket reset is worth re-issuing at once,
+ * but a provider timeout has already spent a full deadline, so the same retry
+ * would make a stuck upstream cost three of them before anything was said.
+ *
+ * It still has to be CLASSIFIED, not passed through raw. The frame arrives
+ * after the stream's own 200 OK, so `res.status` is 200 — the throw used to be
+ * stamped with that and reached the desktop host as `{ status: 200 }`, which
+ * reads as a success to every downstream branch (engine.js keys its recovery
+ * on `status === 402`/`400`; the renderer keys "waited too long" on status 0).
+ */
+const SSE_UPSTREAM_TIMEOUT_PATTERN = /request timed out|timed out waiting|upstream timeout/i;
+
+/**
+ * The message for a provider timeout, stating whose deadline expired.
+ *
+ * This used to read "the provider returned no answer within the 60s stream
+ * budget (raise AEGIS_SSE_IDLE_TIMEOUT_MS for a slower provider)". Measured
+ * live, that sentence was false in the one case it fired: the provider gave up
+ * in ~11-13s and aegis1 relayed it, so the client's own watchdog never fired at
+ * all — `sseError` is only ever set from a `json.error` frame, and our stall
+ * raises its own `stream stalled - …` error from `readWithIdleTimeout` instead.
+ * The advice pointed at an env var that provably cannot help, which is worse
+ * than saying nothing: a user follows it, restarts, and the turn still fails.
+ *
+ * So the message separates the two deadlines and names elapsed time, which is
+ * the fact that tells a reader which one it was without trusting the prose.
+ * `elapsedMs` is omitted when the caller has no measured start (the
+ * non-streaming path), rather than inventing one.
+ */
+function upstreamTimeoutMessage(base, elapsedMs) {
+  const took = Number(elapsedMs) > 0 ? ` after ${(Number(elapsedMs) / 1000).toFixed(1)}s` : '';
+  return (
+    `${base} — the upstream provider gave up before answering${took}. ` +
+    "That is the provider's own deadline, not this client's stream budget, so " +
+    'raising AEGIS_SSE_IDLE_TIMEOUT_MS cannot help'
+  );
+}
+
 /**
  * .mcp.json / Electron pass config as "${VAR}" template refs. When the var is
  * unset, hosts have been observed to leave the template literally unexpanded
@@ -982,7 +1023,32 @@ function createClient(opts = {}) {
         (data && (data.error?.message || data.error || data.message)) ||
         `HTTP ${res.status}`;
       const err = new Error(redact(typeof msg === 'string' ? msg : JSON.stringify(msg)));
-      err.status = res.status;
+      // The buffered twin of postStream's upstream-timeout classification.
+      //
+      // Aegis1 answers a NON-streaming request by draining the same generator
+      // itself, so the provider's deadline arrives here as a plain 503 carrying
+      // the same sentence a streaming caller gets as an error frame. Without
+      // this the one failure had two shapes depending on wire form: the stream
+      // path said `status 0 / code timeout` with an explanation, while the
+      // buffered path said `status 503 / code undefined` and nothing else —
+      // measured live, same provider, same 10s wall, ~10.8s either way. A host
+      // gating on `code === 'timeout'` therefore saw it on one path only.
+      //
+      // Status becomes 0 for the same reason as the stream path: this is
+      // "waited too long", which every downstream branch already reads as
+      // status 0 + code, and a 5xx would instead be taken as a server fault.
+      // The server's own number is preserved on `serverStatus`, because 5xx is
+      // worth knowing even when it means the same thing to the caller.
+      const upstreamTimeout =
+        res.status >= 500 && res.status < 600 && SSE_UPSTREAM_TIMEOUT_PATTERN.test(err.message);
+      if (upstreamTimeout) {
+        err.serverStatus = res.status;
+        err.status = 0;
+        err.code = 'timeout';
+        err.message = upstreamTimeoutMessage(err.message);
+      } else {
+        err.status = res.status;
+      }
       err.data = data;
       throw err;
     }
@@ -1262,6 +1328,29 @@ function createClient(opts = {}) {
     baseURL,
   } = {}) {
     const key = providerKey !== undefined ? providerKey : opts.providerKey;
+    // `custom` is the one catalog provider whose address the server does NOT
+    // know: every other id maps to a host aegis1 has baked in, and `custom`
+    // travels as `base_url` on each request instead. So a custom call that
+    // names no endpoint is not "a provider we can guess a default for" — there
+    // is no default to guess, and aegis1 answers 400 (`_byok_custom_base_url`
+    // refuses it). Refusing HERE turns that server-side 400 into a client-side
+    // sentence naming the missing half, which is the difference between "custom
+    // is broken" and "you saved a key but never saved the endpoint".
+    //
+    // Reachable without the card: `/byok-key custom <key>` saves a key alone,
+    // and a hand-edited row can hold a key with no address. Guarded on the
+    // value actually being absent (`!baseURL`), never on the provider alone, so
+    // a correctly-saved custom row is untouched.
+    if (provider === 'custom' && !baseURL) {
+      const err = new Error(
+        'the "custom" provider dials the endpoint you name, and this call names none — ' +
+          'save the address first: /model-add custom <https-base-url> <api-key> <model-id>, ' +
+          'or the endpoint field in Settings › Provider (custom).'
+      );
+      err.status = 400;
+      err.code = 'custom_endpoint_missing';
+      throw err;
+    }
     // Same rule as the pooled path above: omit `max_tokens` entirely when the
     // caller states none, rather than inventing a default. The server treats a
     // body max_tokens as a ceiling *over* its own ladder, so a defaulted 4096
@@ -1506,6 +1595,11 @@ function createClient(opts = {}) {
     // moves `lastPayloadAt` below.
     const idleMs = idleBudgetFor(res, idleTimeoutMs);
     let lastPayloadAt = Date.now();
+    // When this response began, for the one place that needs to tell the two
+    // deadlines apart: a provider timeout frame carries no duration, and the
+    // elapsed time is what separates "the upstream gave up" (seconds, well
+    // inside our budget) from "our own watchdog fired" (the full budget).
+    const streamStartedAt = lastPayloadAt;
     let keepAlives = 0;
     async function readWithIdleTimeout() {
       let timer;
@@ -1684,8 +1778,39 @@ function createClient(opts = {}) {
           _transientStreamAttempt: transientStreamAttempt + 1,
         });
       }
-      const err = new Error(sseError);
-      err.status = res.status;
+      // Deliberately NOT retried: this sentence is aegis1 relaying an upstream
+      // abort ("Provider request timed out") as a mid-stream error frame with
+      // the headers already 200 OK — the same frame shape as the reset above,
+      // but the stall has already cost the caller a full provider deadline, and
+      // re-issuing would make a stuck upstream cost three of them before the
+      // host could say anything. One attempt, classified, and out.
+      //
+      // What must NOT happen is the shape this used to be thrown in: `res.status`
+      // here is the SSE response's own 200 (the headers landed long before the
+      // error frame did), so the rejection carried "success" as its status and
+      // nothing downstream could classify it — the desktop host printed the raw
+      // stack with `{ status: 200 }` for a turn that never produced a byte. A
+      // timeout is stated in the shape every other "waited too long" on this
+      // lane uses (status 0 + a code), which is what engine.js's `status === 402`
+      // / `status === 400` branches already key off and what local.js translates
+      // its own two clocks into — so "waited too long" stays one branch for
+      // every class.
+      //
+      // Message: the budget is NOT named as the cause any more, because this
+      // branch cannot be our own watchdog. `sseError` comes only from a
+      // `json.error` frame the server sent; our watchdog raises `stream
+      // stalled - …` out of readWithIdleTimeout and never reaches this code.
+      // So every error here is the provider's deadline, already expired, and
+      // the elapsed time says so as a fact rather than as prose — see
+      // upstreamTimeoutMessage().
+      const timedOut = SSE_UPSTREAM_TIMEOUT_PATTERN.test(sseError);
+      const err = new Error(
+        timedOut
+          ? upstreamTimeoutMessage(sseError, Date.now() - streamStartedAt)
+          : sseError
+      );
+      err.status = timedOut ? 0 : res.status;
+      if (timedOut) err.code = 'timeout';
       throw err;
     }
 

package/vendor/drive-connect.js

@@ -40,14 +40,39 @@ function driveConnectUrl(apiBase) {
 }
 
 /**
- * One status check: is a Drive token on file for this account?
+ * One status check: is a Drive token on file for this account, and is the
+ * account tied to a Google identity at all?
  *
- * @param {{driveToken: () => Promise<{connected:boolean, email?:string}>}} aegis
+ * `googleLinked` comes from the server (`/api/drive/token`'s `google_linked`,
+ * derived from `users.google_id`) and is NOT the same question as "does this
+ * machine have an API key". Every install auto-provisions an anonymous device
+ * key, so a key always exists while the account behind it may never have
+ * touched Google. Connecting Drive in that state attaches the tokens to
+ * whatever Google account the browser happens to hold — a different account
+ * than the one this machine polls — and the poll just times out. Callers need
+ * this flag to refuse that ordering.
+ *
+ * Older servers answer `google_linked` not at all; a connected account is
+ * proof enough (only a Google round-trip can store those tokens), so a
+ * missing flag next to a live token reads as linked rather than as a
+ * regression that would disable the button for everyone.
+ *
+ * @param {{driveToken: () => Promise<{connected:boolean, email?:string, google_linked?:boolean}>}} aegis
  */
 async function driveStatus(aegis) {
   const data = await aegis.driveToken();
+  const connected = Boolean(data && data.connected);
+  const raw = data && data.google_linked;
+  // Did the server actually answer the question? A server that predates the
+  // field omits it entirely, and an account with no Drive token answers 404
+  // with no flag — both look exactly like an explicit `false` once collapsed
+  // to a boolean. Callers that must not block a real sign-in need to tell
+  // "not linked" apart from "nobody asked the server".
+  const known = typeof raw === 'boolean';
   return {
-    connected: Boolean(data && data.connected),
+    connected,
+    googleLinked: connected || raw === true,
+    googleLinkedKnown: known || connected,
     email: (data && data.email) || null,
   };
 }

package/vendor/google-signin.js

@@ -37,10 +37,14 @@ function escapeHtml(s) {
   }[c]));
 }
 
-function page({ ok, error, username }) {
+function page({ ok, error, username, surface }) {
   const title = ok ? 'Signed in' : 'Sign-in failed';
+  // This page is shared by the CLI and the desktop, and only one of them is
+  // a terminal. The desktop passes `surface: 'app'`; the default keeps the
+  // CLI's existing wording.
+  const where = surface === 'app' ? 'the app' : 'the terminal';
   const body = ok
-    ? `Signed in${username ? ` as <b>${escapeHtml(username)}</b>` : ''}. You can close this tab and return to the terminal.`
+    ? `Signed in${username ? ` as <b>${escapeHtml(username)}</b>` : ''}. You can close this tab and return to ${where}.`
     : `Sign-in failed: ${escapeHtml(error || 'no token was returned')}. You can close this tab and try again.`;
   return `<!doctype html><html><head><meta charset="utf-8"><title>${title} — AEGIS</title></head>` +
     `<body style="font:16px sans-serif;max-width:32rem;margin:4rem auto;text-align:center;">` +
@@ -62,9 +66,13 @@ function buildAuthUrl(apiBase, callbackUrl) {
  * else (a browser pre-connect, `/favicon.ico`) gets a plain 404 and the
  * server keeps listening for the real one.
  *
+ * `surface` only changes the wording of the page the browser lands on after
+ * signing in ('terminal' for the CLI, 'app' for the desktop) — it changes
+ * nothing about the flow itself.
+ *
  * @returns {Promise<{url: string, wait: () => Promise<{apiKey:string, username:?string, memoryToken:?string}>}>}
  */
-async function startGoogleSignIn({ apiBase, host = '127.0.0.1', timeoutMs = 5 * 60 * 1000 } = {}) {
+async function startGoogleSignIn({ apiBase, host = '127.0.0.1', timeoutMs = 5 * 60 * 1000, surface = 'terminal' } = {}) {
   if (!apiBase) throw new Error('startGoogleSignIn requires apiBase');
 
   let settled = false;
@@ -93,7 +101,7 @@ async function startGoogleSignIn({ apiBase, host = '127.0.0.1', timeoutMs = 5 *
       return;
     }
     res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-    res.end(page({ ok: Boolean(token), error, username }));
+    res.end(page({ ok: Boolean(token), error, username, surface }));
 
     if (settled) return;
     settled = true;

package/vendor/model-discovery.js

@@ -101,6 +101,36 @@ const ENDPOINTS = Object.freeze({
     headers: bearer,
     note: 'OpenAI-compatible',
   }),
+  // The remaining providers in aegis1's catalog that speak `openai_chat` and
+  // answer a standard OpenAI-shaped list on `<base_url>/models`.
+  //
+  // Probed live rather than assumed, because "OpenAI-compatible chat" does not
+  // imply "has a list endpoint": cerebras, fireworks and sakana answer 401/403
+  // without a key (the endpoint exists and is gated) and NVIDIA's list answers
+  // 200 unauthenticated with 84 rows, which is why it is the one endpoint here
+  // whose list is public. Ollama is deliberately absent: it is keyless and
+  // local, so it has nothing to put in the API key this module requires, and
+  // `canDiscover` would be reporting a capability the caller cannot use.
+  cerebras: Object.freeze({
+    url: 'https://api.cerebras.ai/v1/models',
+    headers: bearer,
+    note: 'OpenAI-compatible under /v1',
+  }),
+  fireworks: Object.freeze({
+    url: 'https://api.fireworks.ai/inference/v1/models',
+    headers: bearer,
+    note: 'OpenAI-compatible under /inference/v1; ids are "accounts/fireworks/models/<id>"',
+  }),
+  nvidia_nim: Object.freeze({
+    url: 'https://integrate.api.nvidia.com/v1/models',
+    headers: bearer,
+    note: 'OpenAI-compatible; ids are "<vendor>/<model>"',
+  }),
+  sakana: Object.freeze({
+    url: 'https://api.sakana.ai/v1/models',
+    headers: bearer,
+    note: 'OpenAI-compatible under /v1',
+  }),
 });
 
 /** Other spellings a user types for a provider this module knows. */
@@ -112,6 +142,19 @@ const ALIASES = Object.freeze({
   'googleai': 'gemini',
   'open-ai': 'openai',
   'deep-seek': 'deepseek',
+  // Two catalog rows that are the SAME VENDOR under a second provider id: both
+  // `openai-gpt4o-mini` and `anthropic-haiku` share their sibling's credential
+  // and base_url, and differ only in the default model they pin (see
+  // `client/byok-catalog.js`, which notes the two OpenAI ids "share one
+  // credential and one model"). Discovery asks a vendor, so both spellings must
+  // reach the one list its key can already answer — otherwise a user holding a
+  // key filed under the `-haiku` / `-gpt4o-mini` row is told this client has no
+  // endpoint for their provider while the identical key under the sibling row
+  // is accepted. `custom` and `ollama` are deliberately NOT aliased: the first
+  // has no fixed base_url (it is supplied per request), and the second is
+  // keyless, so neither has a vendor list this module could ask.
+  'openai-gpt4o-mini': 'openai',
+  'anthropic-haiku': 'anthropic',
 });
 
 /**