aegis-desktop 1.0.9 → 1.0.12

package/README.md

@@ -13,7 +13,7 @@ Prebuilt binaries (AppImage / MSI+NSIS / dmg) ship with each release, and the
 package is on npm:
 
 ```bash
-npm install -g aegis-desktop     # requires Node 18+
+npm install -g aegis-desktop     # requires Node 22+
 aegis                            # launch
 ```
 

package/lib/auto.js

@@ -12,13 +12,17 @@
  * BACKGROUND. desktop/main.js and desktop/preload.js both stated an absolute
  * rule when the queue shipped: "NOTHING DRAINS UNLESS THE USER ASKED. There is
  * no interval, no drain at startup, and no drain-on-idle anywhere in this
- * file." That rule was right when the only trigger was a click, and it is still
- * the behaviour of a default install — but it made "queue a task and walk away"
- * impossible, which is the one thing an unattended queue is FOR. The user asked
- * for both automations explicitly (option A of that discussion), so the rule
- * becomes a DEFAULT rather than an absolute, in the only way that keeps the
- * original sentence true: an explicit, persisted, default-off switch, and a
- * tick that does nothing unless it is armed.
+ * file." A click was the only trigger, which made "queue a task and walk away"
+ * impossible — the one thing an unattended queue is FOR. The user asked for the
+ * automation (twice: "autonomous queue", then "work in the background
+ * instead"), so both switches now DEFAULT ON and the sidebar card that used to
+ * gate them is hidden: draining and sealing happen with nothing on screen.
+ *
+ * What keeps that safe is not an off-by-default — it is the guards below, which
+ * are unchanged and all of them skips rather than drains: an empty queue, a
+ * drain already in flight, another host holding the lock, and a switch turned
+ * off since the last tick (re-read EVERY tick, so off stops the very next one,
+ * whoever wrote it: the settings file, the CLI, a hand edit).
  *
  * There are exactly two automations, because there are exactly two acts in the
  * app that are irreversible-ish and cost something:

package/lib/fingerprint.js

@@ -94,12 +94,43 @@ function slug(value, max = 80) {
  * @param {object} o
  * @param {string} o.dir  the app's data directory (userData in a package)
  * @param {object} [o.env] process env, injectable for tests
+ * @param {() => string} [o.getVaultBackend] reads the live preference
+ *   ('aegiscloud' | 'drive' | 'off', desktop/lib/settings.js's
+ *   vaultBackendConfig) — a function, not a value, so a change made in
+ *   Settings while the app is running reaches the very next vault call with
+ *   no restart, the same contract getConfirmMode's gate already keeps.
  */
-function createFingerprintService({ dir, env } = {}) {
+function createFingerprintService({ dir, env, getVaultBackend } = {}) {
   if (!dir) throw new Error('aegis-desktop: createFingerprintService needs a data dir');
   // One store: the shared modules read AEGIS_HOME and nothing else.
   const scope = { ...(env || process.env), AEGIS_HOME: (env || process.env).AEGIS_HOME || dir };
 
+  /** `true` only when the user has explicitly turned sync off — not when no
+   *  preference has been recorded yet, which must keep resolving to whatever
+   *  record-vault.js's own default is. */
+  function vaultDisabled() {
+    return typeof getVaultBackend === 'function' && getVaultBackend() === 'off';
+  }
+
+  /**
+   * `scope`, with the vault backend layered on top of it when a preference
+   * names one. 'aegiscloud' and an absent preference both fall through to
+   * `scope` unchanged — client/record-vault.js's own DEFAULT_BACKEND is
+   * already 'aegiscloud', so there is nothing to add for either case. 'drive'
+   * is the one preference that actually changes the destination: it asks the
+   * rclone adapter for the `gdrive` remote (the user's own Google Drive,
+   * configured by them — see client/record-vault.js's DEFAULT_REMOTE). 'off'
+   * is handled by `vaultDisabled()` before this is ever called, not here.
+   */
+  function vaultScope() {
+    if (typeof getVaultBackend === 'function' && getVaultBackend() === 'drive') {
+      return { ...scope, AEGIS_VAULT_BACKEND: 'rclone', AEGIS_VAULT_REMOTE: scope.AEGIS_VAULT_REMOTE || 'gdrive' };
+    }
+    return scope;
+  }
+
+  const VAULT_OFF_ERROR = 'the vault is turned off — turn it back on (Google Drive or AE) in Settings to publish or inspect it';
+
   const recordPath = (record, session) =>
     path.join(dir, 'fingerprints', `${slug(session)}.${String(record.createdAt).replace(/[:.]/g, '-')}.json`);
 
@@ -110,7 +141,22 @@ function createFingerprintService({ dir, env } = {}) {
         const { fp, authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
         const history = path.join(authorship.dataDir(scope), 'history.jsonl');
-        const target = vault.vaultTarget(scope);
+        if (vaultDisabled()) {
+          return {
+            ok: true,
+            configured: Boolean(key.secret),
+            keySource: key.source,
+            keyPath: key.path,
+            keyFingerprint: key.secret ? fp.keyFingerprint(key.secret) : null,
+            publicKey: key.public,
+            defaultKeyPath: authorship.defaultKeyPath(scope),
+            historyPath: history,
+            historyPresent: fs.existsSync(history),
+            dataDir: authorship.dataDir(scope),
+            vault: { backend: 'off', remote: null, root: null, recordsDir: null },
+          };
+        }
+        const target = vault.vaultTarget(vaultScope());
         return {
           ok: true,
           configured: Boolean(key.secret),
@@ -125,7 +171,12 @@ function createFingerprintService({ dir, env } = {}) {
           // Where a publish goes, so the panel can say it before the user asks
           // for one — and so a misconfigured root is visible, not discovered by
           // a record landing in the wrong folder.
-          vault: { remote: target.remote, root: target.root, recordsDir: `${target.root}/${vault.RECORDS_DIR}` },
+          vault: {
+            backend: target.backend,
+            remote: target.remote,
+            root: target.root,
+            recordsDir: target.backend === vault.BACKEND_CLOUD ? vault.CLOUD_PREFIX : `${target.root}/${vault.RECORDS_DIR}`,
+          },
         };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
@@ -155,7 +206,7 @@ function createFingerprintService({ dir, env } = {}) {
      * session carry the same behaviour digest — and the same AI digest, from the
      * same turns.
      */
-    mint({ history = null, session = null, turns = null, label = null, account = null,
+    async mint({ history = null, session = null, turns = null, label = null, account = null,
           model = null, tools = null, codeRoots = null, codeDirty = null, out = null,
           createdAt = null, publish = false, aiSecret = undefined, aiModel = null } = {}) {
       try {
@@ -196,11 +247,15 @@ function createFingerprintService({ dir, env } = {}) {
         let vault = null;
         let vaultError = null;
         if (publish) {
-          try {
-            const key = authorship.resolveKey({ argv: [], env: scope });
-            vault = load().vault.publish({ file, argv: [], env: scope, secret: key.secret });
-          } catch (e) {
-            vaultError = (e && e.message) || String(e);
+          if (vaultDisabled()) {
+            vaultError = VAULT_OFF_ERROR;
+          } else {
+            try {
+              const key = authorship.resolveKey({ argv: [], env: scope });
+              vault = await load().vault.publish({ file, argv: [], env: vaultScope(), secret: key.secret });
+            } catch (e) {
+              vaultError = (e && e.message) || String(e);
+            }
           }
         }
         return {
@@ -225,13 +280,14 @@ function createFingerprintService({ dir, env } = {}) {
      * preferred path is the file, because the sha256 in the anchor is then about
      * the bytes on disk rather than a re-serialisation of them.
      */
-    publish({ file = null, record = null, dryRun = false } = {}) {
+    async publish({ file = null, record = null, dryRun = false } = {}) {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
         return {
           ok: true,
-          ...vault.publish({ file, record, argv: [], env: scope, secret: key.secret, dryRun }),
+          ...(await vault.publish({ file, record, argv: [], env: vaultScope(), secret: key.secret, dryRun })),
         };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
@@ -246,22 +302,24 @@ function createFingerprintService({ dir, env } = {}) {
      * sealed it has moved on" are three different situations and a single
      * boolean would flatten them into one that hides the interesting case.
      */
-    anchor({ file = null, record = null, anchor = null } = {}) {
+    async anchor({ file = null, record = null, anchor = null } = {}) {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         if (!file && !record && !anchor) return { ok: false, error: 'anchor needs a record or an anchor' };
         const key = authorship.resolveKey({ argv: [], env: scope });
-        return { ok: true, ...vault.checkAnchor({ file, record, anchor, argv: [], env: scope, key }) };
+        return { ok: true, ...(await vault.checkAnchor({ file, record, anchor, argv: [], env: vaultScope(), key })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }
     },
 
     /** What is in the vault. */
-    vaultList() {
+    async vaultList() {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { vault } = load();
-        return { ok: true, ...vault.list({ argv: [], env: scope }) };
+        return { ok: true, ...(await vault.list({ argv: [], env: vaultScope() })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }
@@ -272,11 +330,12 @@ function createFingerprintService({ dir, env } = {}) {
      * already there before publishing was restricted. A finding is a fact about
      * the vault, not about this app, so it is returned rather than acted on.
      */
-    vaultAudit() {
+    async vaultAudit() {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
-        return { ok: true, ...vault.audit({ argv: [], env: scope, secret: key.secret || null }) };
+        return { ok: true, ...(await vault.audit({ argv: [], env: vaultScope(), secret: key.secret || null })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }

package/lib/local/autonomous.js

@@ -209,8 +209,15 @@ const DEFAULT_MODEL = 'nexus-brain';
  *     depends on what the user's own daemon happens to have. Both REQUIRE an
  *     explicit model, refused by name instead of silently resolving to
  *     something nobody chose.
+ *   - 'pro' DOES have a default, but not one this app chooses: a blank model
+ *     means "the `claude` CLI picks for the subscription", which is what
+ *     `--model` omitted says (engine.js sends no flag for `default`). Once a
+ *     model IS stated it must be one of claude-pro.js's PRO_MODELS aliases —
+ *     the same list the model picker offers — because the child accepts only
+ *     those four spellings, and a `provider:model` id copied from a byok task
+ *     would otherwise be handed to `claude --model` and fail there.
  */
-const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local', 'pro']);
 
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
@@ -270,6 +277,34 @@ function modelRefusal(id, cls) {
     }
     return '';
   }
+  if (normalized === 'pro') {
+    // The subscription route. A blank model is legal and meaningful: engine.js
+    // sends no `--model` at all for 'default', so the child resolves the pick
+    // itself. Anything STATED must be a PRO_MODELS alias, because those four
+    // spellings are exactly what `claude --model` accepts — a byok-style
+    // "provider:model" copied between tasks would be handed to the child and
+    // fail there, three stages into a drain, with the queue's own file naming
+    // something the queue never validated.
+    if (!stated) return '';
+    // Required lazily: claude-pro.js is a heavy sibling (child spawn, session
+    // files) and this module is loaded by queue.js at every CLI start. The
+    // require is a plain sibling path with no back-require, so there is no
+    // cycle to guard — this is about load cost, not correctness.
+    let aliases;
+    try {
+      aliases = require('./claude-pro.js').PRO_MODELS;
+    } catch {
+      // If the alias list cannot be read we cannot validate a stated model, and
+      // accepting it unvalidated is the exact failure this arm exists to stop.
+      return `a pro task's model cannot be checked right now — queue it with no --model to let the claude CLI pick`;
+    }
+    const ids = (Array.isArray(aliases) ? aliases : []).map((m) => String(m && m.id).trim());
+    if (ids.includes(stated.toLowerCase())) return '';
+    return (
+      `the autonomous queue's Pro class runs the subscription through the claude CLI, ` +
+      `which accepts only its own model aliases (${ids.join('/')}); "${stated}" is not one`
+    );
+  }
   // normalized === 'local'
   if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
   return '';
@@ -594,13 +629,18 @@ function createQueueWorker({
    */
   async function runTask(item, { carry = '', commit } = {}) {
     const cwd = item.cwd || process.cwd();
-    // Aegis Cloud or nothing — checked BEFORE the turn, not at the server. An
-    // item whose model is not a pooled tier (a hand-edited queue file, a
-    // `--model` the CLI accepted before this rule existed, another host's
-    // older build) would otherwise go out as `class: 'aegis'` with an id the
-    // pool does not serve: billed work if it happens to be a per-provider
-    // spelling, an opaque server error otherwise. Failing here names the model
-    // and the allowed ones, and costs nothing.
+    // The task's own (model, class) pair checked BEFORE the turn, not at the
+    // server. An item whose model does not belong to its class (a hand-edited
+    // queue file, a `--model` the CLI accepted before this rule existed,
+    // another host's older build) would otherwise go out under a transport
+    // that does not serve it: billed work if it happens to be a per-provider
+    // spelling, an opaque server error otherwise, and for 'pro' a `claude
+    // --model` that the child rejects. Failing here names the model and the
+    // spellings that class accepts, and costs nothing.
+    //
+    // "Aegis Cloud or nothing" was this comment's old claim, and it stopped
+    // being true when byok/local were added (9eeef09) — modelRefusal is what
+    // actually enforces the rule now, per class, and it runs for all four.
     const cls = normalizeClass(item.class);
     const refusal = modelRefusal(item.model, cls);
     if (refusal) {

package/lib/local/claude-pro.js

@@ -116,6 +116,23 @@ function claudeOAuthToken(env) {
  */
 const SHADOWING_ENV_VARS = Object.freeze(['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN']);
 
+/**
+ * Whether `value` is shaped like an Anthropic console API key.
+ *
+ * Deliberately a SHAPE test, not a validity test. This process cannot know
+ * whether a key is live without spending it, so it does not try: it answers
+ * only "could this possibly be the console credential that is allowed to
+ * outrank a subscription". Anthropic console keys are `sk-ant-`-prefixed. The
+ * check is case-sensitive and anchored, because that is the literal the vendor
+ * uses — a case-insensitive match would accept `SK-ANT-` junk.
+ *
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isAnthropicConsoleKey(value) {
+  return typeof value === 'string' && /^sk-ant-[A-Za-z0-9_-]{8,}$/.test(value.trim());
+}
+
 /**
  * The env for one `claude` child, with a shadowing value that cannot be a
  * credential removed.
@@ -151,28 +168,69 @@ const SHADOWING_ENV_VARS = Object.freeze(['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_T
  * value that provably cannot be a key is dropped, and the drop is REPORTED
  * rather than silent (see `envDroppedLine`).
  *
+ * ── the second rule: a length floor is not a shape (measured, 2026-10-21) ───
+ *
+ * The floor above answers "is this too short to be anything?" and nothing more.
+ * A 35-character value that is NOT an Anthropic console key clears it, still
+ * wins the CLI's precedence, and still takes the plan down — so the floor alone
+ * reproduced the original bug one paste later. Measured state that produced it:
+ *
+ *   ~/.aegiscode/.env held ANTHROPIC_API_KEY=<35 chars, not sk-ant-*>
+ *   ~/.claude/.credentials.json held a valid `claudeAiOauth` for plan `pro`
+ *   `aegiscode -p "say hi" --json`
+ *     → {"text":"Invalid API key · Fix external API key","model":"sonnet",
+ *        "tokens":0,"balance_eur":1.54}          exit 0, in 2.3 s
+ *
+ * and the child was spawned with the stale value present (`ANTHROPIC_LEN=35`,
+ * observed by a fake `claude` on PATH). Unsetting the variable in the SHELL did
+ * not help either: this host loads `~/.aegiscode/.env` into `process.env`
+ * itself, so the file is an input no caller can undo.
+ *
+ * So when a subscription IS present, only a value shaped like an Anthropic
+ * console key may shadow it. That is the narrowest rule that keeps the promise
+ * the old comment made — "a user who set one deliberately is asking for the
+ * pay-per-token path" — while refusing a value that provably is not one. With
+ * no subscription there is nothing to shadow and no opinion is taken: any value
+ * clearing the floor passes, exactly as before.
+ *
  * @param {object} [baseEnv] the caller's env bag
  * @param {string} [token]   a `CLAUDE_CODE_OAUTH_TOKEN` to hand the child
- * @returns {{env: object, dropped: Array<{name: string, length: number}>}}
+ * @param {{hasSubscription?: boolean}} [opts] whether a subscription is present
+ *   (see the second rule above); absent means "assume not", which keeps every
+ *   pre-existing caller and test on the old behaviour.
+ * @returns {{env: object, dropped: Array<{name: string, length: number, reason: string}>}}
  */
-function childEnvPlan(baseEnv, token) {
+function childEnvPlan(baseEnv, token, opts) {
   const env = { ...(baseEnv || {}) };
   const dropped = [];
   const usable = envFileLib && typeof envFileLib.credentialLooksUsable === 'function'
     ? envFileLib.credentialLooksUsable
     : null;
+  // Only a present subscription can be shadowed, so it is the only case that
+  // earns the stricter shape rule (see the docstring's second section).
+  const hasSubscription = !!(opts && opts.hasSubscription);
   // A host whose env module predates the floor keeps today's behaviour (the
   // variable passes through): a second copy of the floor here is the drift
   // client/env-file.js exists to prevent.
   if (usable) {
     for (const name of SHADOWING_ENV_VARS) {
       const value = env[name];
-      if (typeof value !== 'string' || usable(value)) continue;
+      if (typeof value !== 'string') continue;
+      // Two independent reasons to refuse, and they are reported apart because
+      // they mean different things to the user: too short is junk, while a
+      // well-formed value that is not a console key is a key for something
+      // else that would silently outrank the plan they are paying for.
+      let reason = null;
+      if (!usable(value)) reason = 'too-short';
+      else if (hasSubscription && name === 'ANTHROPIC_API_KEY' && !isAnthropicConsoleKey(value)) {
+        reason = 'not-a-console-key';
+      }
+      if (!reason) continue;
       delete env[name];
       // A variable set to '' shadows nothing worth reporting — it is removed
       // (harmless) but the user is not told about a value they never gave.
       const length = value.trim().length;
-      if (length > 0) dropped.push({ name, length });
+      if (length > 0) dropped.push({ name, length, reason });
     }
   }
   if (token) env.CLAUDE_CODE_OAUTH_TOKEN = token;
@@ -183,20 +241,51 @@ function childEnvPlan(baseEnv, token) {
 function envDroppedLine(dropped) {
   const list = Array.isArray(dropped) ? dropped : [];
   if (!list.length) return null;
-  const names = list.map((d) => `${d.name} (${d.length} character${d.length === 1 ? '' : 's'})`).join(', ');
-  return `aegis: not passed to the claude child — ${names}: too short to be a credential, and the CLI would have spent it instead of your subscription`;
+  const shaped = list.filter((d) => d && d.reason === 'not-a-console-key');
+  const short = list.filter((d) => !d || d.reason !== 'not-a-console-key');
+  const parts = [];
+  if (short.length) {
+    const names = short.map((d) => `${d.name} (${d.length} character${d.length === 1 ? '' : 's'})`).join(', ');
+    parts.push(`${names}: too short to be a credential, and the CLI would have spent it instead of your subscription`);
+  }
+  if (shaped.length) {
+    const names = shaped.map((d) => `${d.name} (${d.length} characters)`).join(', ');
+    parts.push(
+      `${names}: not an Anthropic console key (\`sk-ant-\`), and the CLI would have spent it instead of your subscription`
+    );
+  }
+  return `aegis: not passed to the claude child — ${parts.join('; ')}`;
 }
 
-/** The shadowing value in `env` that cannot be a credential, if any (see above). */
-function shadowingValue(env) {
+/**
+ * The shadowing value in `env` that cannot be spent as the credential the CLI
+ * would take it for, if any (see the two rules in `childEnvPlan`).
+ *
+ * This must agree with `childEnvPlan` exactly: a status surface that says "no
+ * shadowing value" while the child is in fact being handed one is worse than no
+ * report at all. Both reasons are therefore reported, and each carries the same
+ * `reason` tag the drop report uses so the two lines cannot drift apart.
+ *
+ * @param {object} env
+ * @param {{hasSubscription?: boolean}} [opts]
+ * @returns {{name: string, length: number, reason: string}|null}
+ */
+function shadowingValue(env, opts) {
   const bag = env || {};
   const usable = envFileLib && typeof envFileLib.credentialLooksUsable === 'function'
     ? envFileLib.credentialLooksUsable
     : null;
   if (!usable) return null;
+  const hasSubscription = !!(opts && opts.hasSubscription);
   for (const name of SHADOWING_ENV_VARS) {
     const value = bag[name];
-    if (typeof value === 'string' && !usable(value)) return { name, length: value.trim().length };
+    if (typeof value !== 'string') continue;
+    let reason = null;
+    if (!usable(value)) reason = 'too-short';
+    else if (hasSubscription && name === 'ANTHROPIC_API_KEY' && !isAnthropicConsoleKey(value)) {
+      reason = 'not-a-console-key';
+    }
+    if (reason) return { name, length: value.trim().length, reason };
   }
   return null;
 }
@@ -264,7 +353,30 @@ function claudeProStatus(opts) {
   // child is fixed regardless (childEnvPlan); this reports it so a status
   // surface can say why, rather than leaving `apiKeySource: ANTHROPIC_API_KEY`
   // to be discovered from `claude auth status` by hand.
-  out.shadowed = shadowingValue(env);
+  // A SUBSCRIPTION — the thing a stray `ANTHROPIC_API_KEY` would outrank — is an
+  // `oauth` plan or a `CLAUDE_CODE_OAUTH_TOKEN` handed to the child. A
+  // `credentials.json` holding a plain API key is not: there is no plan there to
+  // shadow, so the strict shape rule must not fire and drop the user's own key.
+  // This is computed once and published, so the report and the child env read
+  // ONE answer instead of each deciding for itself.
+  out.subscriptionPresent = out.loggedIn && out.kind !== 'apikey';
+  // The stricter rule only applies when a subscription is present, so the
+  // subscription this function just resolved is the same input the child env
+  // gets. Passing it here is what keeps `shadowed` and the drop report agreeing.
+  out.shadowed = shadowingValue(env, { hasSubscription: out.subscriptionPresent });
+  // "Can this host serve a `pro` turn at all?" is NOT the same question as
+  // "is there a subscription to shadow?" (above). A pin is phantom only when
+  // nothing usable survives to the child, and a bare API key in
+  // `credentials.json` (`kind: 'apikey'`) is a route with no plan behind it —
+  // so `subscriptionPresent` excludes it deliberately, while callability must
+  // count it. Answered by running the SAME planner the child env comes from, so
+  // this cannot disagree with what `claude` is actually handed: a variable the
+  // planner drops is not a credential, whatever it looks like in `env`.
+  const plan = childEnvPlan(env, null, { hasSubscription: out.subscriptionPresent });
+  out.credentialPresent = out.loggedIn
+    || typeof plan.env.ANTHROPIC_API_KEY === 'string'
+    || typeof plan.env.ANTHROPIC_AUTH_TOKEN === 'string'
+    || typeof plan.env.CLAUDE_CODE_OAUTH_TOKEN === 'string';
   return out;
 }
 
@@ -633,7 +745,18 @@ function runClaudePro(opts, deps) {
     // "API key: he" and the subscription is unreachable — see childEnvPlan.
     const baseEnv = o.env || process.env;
     const token = claudeOAuthToken(baseEnv);
-    const plan = childEnvPlan(baseEnv, token);
+    // Whether a subscription is present decides whether a non-console
+    // `ANTHROPIC_API_KEY` may shadow it (childEnvPlan's second rule). It is read
+    // from the same credential file `claudeProStatus` reports on, and a failure
+    // to read it must NOT weaken the child's env: an unreadable file means "no
+    // subscription proven", which is the old behaviour, not a crash mid-turn.
+    let hasSubscription = false;
+    try {
+      hasSubscription = !!claudeProStatus({ env: baseEnv }).subscriptionPresent;
+    } catch {
+      /* unprovable subscription → the floor-only rule, exactly as before */
+    }
+    const plan = childEnvPlan(baseEnv, token, { hasSubscription });
     const childEnv = plan.env;
     const droppedLine = envDroppedLine(plan.dropped);
     if (droppedLine && o.onDelta) {

package/lib/local/engine.js

@@ -524,27 +524,43 @@ const EFFORT_TOKEN_BUDGET = { low: 8192, medium: 16384, high: 32768 };
 /**
  * DeepSeek native reasoning level per config rung.
  *
- * The field is `reasoning_effort`, NOT `effort`. Verified live 2026-10-02: a
- * DeepSeek body carrying `effort` returns HTTP 200 and is ignored, while
- * `reasoning_effort` binds and rejects an unknown value with a 422 naming its
- * enum (none|minimal|low|medium|high|xhigh|ultra|max). Behaviourally,
- * `reasoning_effort:"none"` produced 0 reasoning_content chars and `"max"`
- * produced 138, whereas `effort:"none"` still produced 112 — thinking stayed
- * on. So the old field was inert on every turn, and inertness is the worst
- * failure here: it 200s, nothing surfaces, and the model merely thinks at the
- * wrong depth.
+ * The field is `effort`, NOT `reasoning_effort`. Verified live 2026-10-21
+ * against the surface this client actually reaches — the relay's
+ * `https://api.deepseek.com/anthropic` transport — by measuring output tokens
+ * over interleaved paired samples (n=12) against an absent-field baseline:
  *
- * Every rung of the knob has a namesake in that enum, so the map is 1:1 rather
- * than the earlier (low|max, no medium) fold, which rested on the mistaken
- * belief that DeepSeek had no `medium`. `max_tokens` (EFFORT_TOKEN_BUDGET)
- * still scales as the output ceiling, since hidden chain-of-thought shares that
- * budget on DeepSeek.
+ *   absent 818 · low 772 · medium 836 · high 818 · max 1494
  *
- * Mirrors the upstream engine's src/backend.js DEEPSEEK_EFFORT verbatim;
- * desktop/renderer/budget.js carries the renderer's copy for the same
- * no-drift guarantee as DEEPSEEK_REASONING_MODEL_RE above.
+ * Only `max` separates from sending nothing. `GET /models` reports
+ * `supported_levels: ["low","high","max"]`, default `high`, on both live ids
+ * (`deepseek-flash`, `deepseek-v4-pro`) — so `medium` is not a level these
+ * models have. It passes the deserializer (unknown values *do* 422 with the
+ * enum, so validation is real) and is then absorbed into the default, which is
+ * this codebase's worst failure mode: a 200, nothing surfaced, and the model
+ * thinking at a depth nobody chose.
+ *
+ * What the earlier version of this comment asserted — that `reasoning_effort`
+ * binds and `effort` is ignored — was measured on the vendor's OpenAI-shaped
+ * `/chat/completions`, a surface this client never reaches, and it led to the
+ * knob being dead end-to-end: aegis1 forwards `reasoning_effort` only for
+ * BYOK_REASONING_EFFORT_PROVIDERS (openai/groq/gemini/grok — deepseek is
+ * absent), so the field was dropped at the relay. The `effort` channel is the
+ * one aegis1 gates on `provider_id == "deepseek"` (app.py) and that the
+ * Anthropic adapter nests as `output_config.effort`; it is the only channel
+ * that reaches the vendor, and the only one that measurably binds.
+ *
+ * The map folds `medium` upward for the same reason the Gemini row does: the
+ * vendor has no such level, and a rung that 200s while doing nothing is worse
+ * than one that says what it does. `max` is deliberately NOT reachable — it is
+ * not a rung of this knob, and mapping the default rung onto it would silently
+ * multiply reasoning spend on every turn nobody asked to deepen.
+ * `max_tokens` (EFFORT_TOKEN_BUDGET) still scales as the output ceiling, since
+ * hidden chain-of-thought shares that budget on DeepSeek.
+ *
+ * desktop/renderer/budget.js carries the renderer's copy; test/budget.test.mjs
+ * compares the two tables, so the mirror cannot drift silently.
  */
-const DEEPSEEK_EFFORT = { low: 'low', medium: 'medium', high: 'high' };
+const DEEPSEEK_EFFORT = { low: 'low', medium: 'high', high: 'high' };
 
 /**
  * Per-family effort translation, mirroring the upstream engine's
@@ -565,7 +581,7 @@ const DEEPSEEK_EFFORT = { low: 'low', medium: 'medium', high: 'high' };
 const EFFORT_IDENTITY = { low: 'low', medium: 'medium', high: 'high' };
 const EFFORT_INERT_RE = /non-reasoning/i;
 const EFFORT_DIALECTS = [
-  { provider: 'deepseek', re: DEEPSEEK_REASONING_MODEL_RE, field: 'reasoning_effort', map: DEEPSEEK_EFFORT },
+  { provider: 'deepseek', re: DEEPSEEK_REASONING_MODEL_RE, field: 'effort', map: DEEPSEEK_EFFORT },
   { provider: 'openai', re: /^(gpt-5|o[0-9])/i, field: 'reasoning_effort', map: EFFORT_IDENTITY },
   { provider: 'groq', re: /^(openai\/gpt-oss|qwen\/qwen3)/i, field: 'reasoning_effort', map: EFFORT_IDENTITY },
   { provider: 'xai', re: /^grok-(4\.[5-9]|[5-9])/, field: 'reasoning_effort', map: EFFORT_IDENTITY },
@@ -1967,8 +1983,8 @@ function createLocalEngine({
       const { provider, model: bareModel } = splitByokModel(opts.model);
       // Translate the rung for THIS vendor once, and carry the verdict rather
       // than a bare level: the relay validates strictly upstream and the field
-      // name is not portable (DeepSeek's OpenAI-compatible surface takes
-      // `reasoning_effort`, same spelling as OpenAI's). Undefined for a family
+      // name is not portable (DeepSeek's `/anthropic` transport takes `effort`,
+      // OpenAI-shaped vendors take `reasoning_effort`). Undefined for a family
       // with no dialect, which the transport then omits entirely.
       const effort = nativeEffort(provider, bareModel, opts.effort);
       try {
@@ -1999,10 +2015,16 @@ function createLocalEngine({
           toolChoice: opts.toolChoice,
           // Native effort knob, field and level both from the dialect table.
           // `bareModel` is already provider-less, so it matches the dialect
-          // regexes without further stripping. Only a dialect whose field is
-          // `reasoning_effort` is forwarded: DeepSeek used to ride a separate
-          // `effort` body key, which the API 200s and ignores, so that whole
-          // second channel is gone rather than left as a way to reintroduce it.
+          // regexes without further stripping. Both wire channels are live, and
+          // which one is used is the dialect's decision, not this call site's:
+          // DeepSeek's `/anthropic` transport takes `effort` (aegis1 gates it on
+          // provider_id == "deepseek" and the adapter nests it as
+          // `output_config.effort`), while the OpenAI-shaped vendors take
+          // `reasoning_effort`. Routing on the field name is what keeps a
+          // dialect from being silently dropped here — the previous form
+          // forwarded only `reasoning_effort`, so turning DeepSeek's dialect
+          // over to `effort` would have died at this line.
+          effort: effort && effort.field === 'effort' ? effort.level : undefined,
           reasoningEffort: effort && effort.field === 'reasoning_effort' ? effort.level : undefined,
           stream: true,
           onStream: opts.onDelta,