aegis-desktop 1.0.9 → 1.0.10

package/README.md

@@ -13,7 +13,7 @@ Prebuilt binaries (AppImage / MSI+NSIS / dmg) ship with each release, and the
 package is on npm:
 
 ```bash
-npm install -g aegis-desktop     # requires Node 18+
+npm install -g aegis-desktop     # requires Node 22+
 aegis                            # launch
 ```
 

package/lib/local/autonomous.js

@@ -209,8 +209,15 @@ const DEFAULT_MODEL = 'nexus-brain';
  *     depends on what the user's own daemon happens to have. Both REQUIRE an
  *     explicit model, refused by name instead of silently resolving to
  *     something nobody chose.
+ *   - 'pro' DOES have a default, but not one this app chooses: a blank model
+ *     means "the `claude` CLI picks for the subscription", which is what
+ *     `--model` omitted says (engine.js sends no flag for `default`). Once a
+ *     model IS stated it must be one of claude-pro.js's PRO_MODELS aliases —
+ *     the same list the model picker offers — because the child accepts only
+ *     those four spellings, and a `provider:model` id copied from a byok task
+ *     would otherwise be handed to `claude --model` and fail there.
  */
-const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local', 'pro']);
 
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
@@ -270,6 +277,34 @@ function modelRefusal(id, cls) {
     }
     return '';
   }
+  if (normalized === 'pro') {
+    // The subscription route. A blank model is legal and meaningful: engine.js
+    // sends no `--model` at all for 'default', so the child resolves the pick
+    // itself. Anything STATED must be a PRO_MODELS alias, because those four
+    // spellings are exactly what `claude --model` accepts — a byok-style
+    // "provider:model" copied between tasks would be handed to the child and
+    // fail there, three stages into a drain, with the queue's own file naming
+    // something the queue never validated.
+    if (!stated) return '';
+    // Required lazily: claude-pro.js is a heavy sibling (child spawn, session
+    // files) and this module is loaded by queue.js at every CLI start. The
+    // require is a plain sibling path with no back-require, so there is no
+    // cycle to guard — this is about load cost, not correctness.
+    let aliases;
+    try {
+      aliases = require('./claude-pro.js').PRO_MODELS;
+    } catch {
+      // If the alias list cannot be read we cannot validate a stated model, and
+      // accepting it unvalidated is the exact failure this arm exists to stop.
+      return `a pro task's model cannot be checked right now — queue it with no --model to let the claude CLI pick`;
+    }
+    const ids = (Array.isArray(aliases) ? aliases : []).map((m) => String(m && m.id).trim());
+    if (ids.includes(stated.toLowerCase())) return '';
+    return (
+      `the autonomous queue's Pro class runs the subscription through the claude CLI, ` +
+      `which accepts only its own model aliases (${ids.join('/')}); "${stated}" is not one`
+    );
+  }
   // normalized === 'local'
   if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
   return '';
@@ -594,13 +629,18 @@ function createQueueWorker({
    */
   async function runTask(item, { carry = '', commit } = {}) {
     const cwd = item.cwd || process.cwd();
-    // Aegis Cloud or nothing — checked BEFORE the turn, not at the server. An
-    // item whose model is not a pooled tier (a hand-edited queue file, a
-    // `--model` the CLI accepted before this rule existed, another host's
-    // older build) would otherwise go out as `class: 'aegis'` with an id the
-    // pool does not serve: billed work if it happens to be a per-provider
-    // spelling, an opaque server error otherwise. Failing here names the model
-    // and the allowed ones, and costs nothing.
+    // The task's own (model, class) pair checked BEFORE the turn, not at the
+    // server. An item whose model does not belong to its class (a hand-edited
+    // queue file, a `--model` the CLI accepted before this rule existed,
+    // another host's older build) would otherwise go out under a transport
+    // that does not serve it: billed work if it happens to be a per-provider
+    // spelling, an opaque server error otherwise, and for 'pro' a `claude
+    // --model` that the child rejects. Failing here names the model and the
+    // spellings that class accepts, and costs nothing.
+    //
+    // "Aegis Cloud or nothing" was this comment's old claim, and it stopped
+    // being true when byok/local were added (9eeef09) — modelRefusal is what
+    // actually enforces the rule now, per class, and it runs for all four.
     const cls = normalizeClass(item.class);
     const refusal = modelRefusal(item.model, cls);
     if (refusal) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -58,14 +58,17 @@
     "test:renderer-fonts": "node test/renderer-fonts.test.mjs",
     "test:account-key": "node test/account-key.test.mjs"
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "dependencies": {
     "electron-updater": "^6.8.9"
   },
   "devDependencies": {
-    "electron-builder": "^25.1.8",
-    "electron": "^33.0.0"
+    "electron-builder": "^26.15.3",
+    "electron": "^44.0.0"
   },
   "optionalDependencies": {
-    "electron": "^33.0.0"
+    "electron": "^44.0.0"
   }
 }