aegiscode 6.2.0 → 6.3.1

package/src/commands.js

@@ -52,6 +52,7 @@ const {
 } = require('./config.js');
 const { copyToClipboard } = require('./clipboard.js');
 const { snapshotCheckpoint, listCheckpoints, loadCheckpoint } = require('./checkpoint.js');
+const screens = require('./screens.js');
 const { summarizeTranscript, recapLine } = require('./summarize.js');
 const { sessionAccounting, accountingFromUsage, estimateTokens } = require('./tokens.js');
 const { transcriptToMarkdown, transcriptToJSON, writeExportFile, lastAssistantText } = require('./export.js');
@@ -102,6 +103,19 @@ const tip = (c, text) => c.push({ role: 'tip', text });
 const done = (c, text) => c.push({ role: 'done', text });
 const shortCwd = () => process.cwd().split('/').filter(Boolean).pop() || '~';
 
+/**
+ * Refresh the pinnable-model list on the session context before reading it.
+ * `c.loadModels()` (owned by the app/chatflow) fetches from the server and
+ * records the result on `c.state().models`; it is best-effort — offline it
+ * rejects, and the caller falls through to the honest empty note rather than
+ * opening an empty picker.
+ */
+async function loadModels(c) {
+  try {
+    await c.loadModels();
+  } catch {}
+}
+
 /**
  * The ÆGIS LLM routes are gated on the pooled brain being reachable — exactly
  * as the reference hides its ÆGIS routes when the backend is absent. `hidden`
@@ -190,13 +204,17 @@ const COMMANDS = [
         c.render();
         return true;
       }
-      note(c, `Running ${cmd} in ${shortCwd()} — output streams below.`);
-      c.push({ role: 'tool', label: 'Bash', args: cmd });
+      note(c, `Running ${cmd} in ${shortCwd()} — output streams below, Esc stops it.`);
       const job = runDevServer(cmd, {
         cwd: process.cwd(),
         onLine: (line) => c.push({ role: 'note', text: `  ${line}` }),
       });
+      // Bind the job to the session so the status line draws "esc to stop" and
+      // Esc actually stops it (the reference's openStream/closeStream contract).
+      if (!job.label) job.label = cmd;
+      c.openStream(job);
       job.done.then(({ code, stopped }) => {
+        c.closeStream(job);
         done(c, stopped ? `${cmd} stopped` : `${cmd} exited (code ${code})`);
         c.render();
       });
@@ -290,7 +308,7 @@ const COMMANDS = [
       c.render();
       const summary = await c.withWorking((signal) =>
         summarizeTranscript(c.transcript, {
-          callModel: (p) => c.ask(p).then((r) => r.text),
+          callModel: (p, opts) => c.ask(p, opts).then((r) => r.text),
           model: c.ctx.model,
           signal,
         }));
@@ -375,7 +393,12 @@ const COMMANDS = [
           : 'Clipboard unavailable; nothing copied.');
       } else {
         try {
-          const p = writeExportFile(body, isJson ? 'json' : 'md');
+          // Honour the command context's cwd. The handler used to fall through
+          // to writeExportFile's own `process.cwd()` default, so /export wrote
+          // into whatever directory the process happened to be in — which meant
+          // running the command smoke test (it invokes every handler) littered
+          // the repository root with aegiscodex-export-*.md files.
+          const p = writeExportFile(body, isJson ? 'json' : 'md', c.ctx.cwd || process.cwd());
           note(c, `Exported conversation to ${p}`);
         } catch (e) {
           note(c, `/export: ${e.message}`);
@@ -399,9 +422,23 @@ const COMMANDS = [
     desc: 'Create an AEGIS.md file in the project',
     handler: async (c, args) => {
       const file = (args.file || 'AEGIS.md').trim();
-      const p = path.join(process.cwd(), file);
+      // The command context's cwd, not process.cwd(): /cd moves the session to
+      // another directory, and a handler that reads process.cwd() then writes
+      // the file into the directory the user just left. It also means the
+      // command smoke test (which invokes every handler) no longer drops an
+      // AEGIS.md into the repository root.
+      const cwd = c.ctx.cwd || process.cwd();
+      const p = path.resolve(cwd, file);
+      // Refuse a path that resolves outside the project — the reference's /init
+      // takes no argument, and `path.join(cwd, '../../x')` writes outside it.
+      const root = cwd.endsWith(path.sep) ? cwd : cwd + path.sep;
+      if (p !== cwd && !p.startsWith(root)) {
+        note(c, `/init: refusing to write outside the project directory (${p}).`);
+        c.render();
+        return true;
+      }
       if (fs.existsSync(p)) { note(c, `${file} already exists — not overwriting.`); c.render(); return true; }
-      const sniff = sniffProject(process.cwd());
+      const sniff = sniffProject(cwd);
       try {
         fs.writeFileSync(p, buildAegisMd(sniff) + '\n');
       } catch (e) {
@@ -410,7 +447,7 @@ const COMMANDS = [
         return true;
       }
       note(c, `Created ${p} (${sniff.lang})`);
-      if (fs.existsSync(path.join(process.cwd(), 'node_modules')) && !fs.existsSync(path.join(process.cwd(), '.gitignore'))) {
+      if (fs.existsSync(path.join(cwd, 'node_modules')) && !fs.existsSync(path.join(cwd, '.gitignore'))) {
         tip(c, 'Add "node_modules/" to a .gitignore before committing.');
       }
       c.render();
@@ -435,10 +472,40 @@ const COMMANDS = [
       const id = (args.sub || '').trim();
       if (!id) {
         note(c, `model: ${c.ctx.model || 'server default'}`);
-        c.openOverlay({ type: 'model', items: c.state().models || [], sel: 0, current: c.ctx.model });
+        // Populate the picker from the server first — app.js's state().models
+        // is empty until loadModels() has run, so an unguarded read renders an
+        // empty picker whose Enter does nothing.
+        await loadModels(c);
+        const models = c.state().models || [];
+        if (!models.length) {
+          // Say why, and what unblocks it: an unreachable catalog is almost
+          // always a missing key or no network, and "no models advertised"
+          // read as "the platform has none" rather than "this client could not
+          // ask".
+          note(c, c.state().online
+            ? 'Could not read the model catalog (offline, or the server refused it) — /models retries.'
+            : // The key travels in the environment only (client/aegis.js reads
+              // AEGIS_API_KEY); /login is an unavailable command here, so
+              // pointing at it would send the user to a refusal.
+              'No API key set, so the model catalog cannot be read — export AEGIS_API_KEY (free at https://aegiscloud.org), then retry /model.');
+          c.render();
+          return true;
+        }
+        // A pin that is not in the catalog is not honoured — the pool answers
+        // from its own default with no error. Say so where the pin is visible
+        // rather than letting the reply look like the pinned model.
+        if (c.ctx.model && !models.some((m) => m.id === c.ctx.model)) {
+          note(c, `pinned model "${c.ctx.model}" is not in the catalog — the pool will answer with its own default; pick one below.`);
+        }
+        // The overlay's own copy promises /model add|remove (overlays.js, a
+        // separate workstream); this build refuses both, so say here how a
+        // model is actually selected.
+        note(c, '/model <id> pins one for this session; /models lists what the server advertises.');
+        c.openOverlay({ type: 'model', items: models, sel: 0, current: c.ctx.model });
         return true;
       }
       if (id === 'list') {
+        await loadModels(c);
         const models = c.state().models || [];
         if (!models.length) note(c, 'No pinnable models advertised — /models lists the server\'s ids.');
         else panel(c, panels.buildModelList(c.ctx.model, models, c.ctx));
@@ -452,14 +519,28 @@ const COMMANDS = [
       }
       if (id === '-') {
         c.ctx.model = null;
-        // Session-scoped pin only (matches the plugin's existing /model): this
-        // never writes ~/.aegiscode/config.json, so a test run stays hermetic.
+        c.saveConfig({ model: null, currentModelId: null });
         note(c, 'Model pin cleared — the server will choose.');
         c.render();
         return true;
       }
       c.ctx.model = id;
+      // Persist, so the next launch restores it. app.js's restorePrefs() reads
+      // this on startup; without the write it had nothing to restore and the
+      // pin silently evaporated at exit. Tests point AEGISCODE_HOME at a temp
+      // dir, so the write stays inside that dir.
+      c.saveConfig({ model: id, currentModelId: id });
       note(c, `Pinned model: ${id}`);
+      // The server accepts an id it does not advertise and answers from its own
+      // default — no error, a different model, and the spend attributed to the
+      // id that was pinned. Warn (never refuse: the catalog is cached, and
+      // refusing would break a pin made against a server that is briefly
+      // unreachable) so the mismatch is visible at the moment it is created.
+      await loadModels(c);
+      const models = c.state().models || [];
+      if (models.length && !models.some((m) => m.id === id)) {
+        note(c, `"${id}" is not in the AEGIS Cloud catalog — the pool will answer with its own default. /models lists the real ids.`);
+      }
       c.render();
       return true;
     },
@@ -487,7 +568,7 @@ const COMMANDS = [
       c.render();
       const line = await c.withWorking((signal) =>
         recapLine(c.transcript, {
-          callModel: (p) => c.ask(p).then((r) => r.text),
+          callModel: (p, opts) => c.ask(p, opts).then((r) => r.text),
           model: c.ctx.model,
           signal,
         }));
@@ -580,8 +661,13 @@ const COMMANDS = [
     handler: async (c, args) => {
       const m = (args.mode || '').toLowerCase();
       if (m === 'dark' || m === 'light') {
-        c.ctx.light = m === 'light';
-        c.ctx.themeIndex = c.ctx.light ? 0 : 1;
+        // Resolve through the theme table rather than hardcoding an index, so
+        // "light" names the same row the picker would have named: index 2
+        // ("Light mode"), not index 0 ("Auto"). themeIndex is what the
+        // colorblind/ANSI palettes key off, so a wrong index silently selects
+        // the wrong palette rather than merely displaying a wrong label.
+        const want = m === 'light' ? 2 : 1;
+        screens.applyTheme(c.ctx, want);
       } else {
         await c.showThemePicker();
       }

package/src/config.js

@@ -43,7 +43,17 @@ function permissionsPath() {
 
 const DEFAULT_CONFIG = {
   themeIndex: 1,   // Dark mode
-  model: 'sonnet',
+  // No pinned model. This host runs on AEGIS Cloud, whose pinnable ids are the
+  // server's (`/models`) — a client-side default here would have to name one,
+  // and the one it named (`sonnet`) is not advertised by the platform at all:
+  // the pool accepts an unknown id and answers from its own default with no
+  // error, so the pin looked honoured while the reply came from another model.
+  // Worse, onboarding persists this object on first run (`updateConfig` merges
+  // DEFAULT_CONFIG under the patch), so the phantom pin was written to disk for
+  // every user who ever completed the trust check. `null` = no pin; the server
+  // chooses, and app.js's validatePinnedModel() clears a stored id the catalog
+  // does not advertise.
+  model: null,
   // Phase 6: the full model table (seeded from src/models.js MODELS on first
   // read by pickerModels()). 'currentModelId' mirrors `model` under the
   // aegiscode- name so /model add/remove/switch stay compatible both ways.

package/src/events.js

@@ -249,6 +249,36 @@ function drainQueue() {
 }
 
 /** Test seam: forget attached stdin, timers and queued keys. */
+/** True once a key stream is attached — i.e. whether nextKey() has a source. */
+function isKeyStreamAttached() {
+  return !!attachedStdin;
+}
+
+/**
+ * Tear the pump down, removing the data listener.
+ *
+ * `resetKeyStream()` deliberately only *drops the reference* (it is used
+ * between tests and after a child-process handover), which leaves the listener
+ * registered on stdin. Attaching again would then run two pumps over the same
+ * bytes and dispatch every keystroke twice. Onboarding attaches before the
+ * session loop does, so it needs a real detach rather than a reset.
+ */
+function detachKeyStream() {
+  if (attachedStdin && onData) {
+    try {
+      attachedStdin.removeListener('data', onData);
+    } catch {
+      /* stream already gone */
+    }
+    try {
+      if (typeof attachedStdin.setRawMode === 'function') attachedStdin.setRawMode(false);
+    } catch {
+      /* not a TTY */
+    }
+  }
+  resetKeyStream();
+}
+
 function resetKeyStream() {
   clearTimeout(escTimer);
   clearTimeout(pasteTimer);
@@ -270,6 +300,8 @@ module.exports = {
   suspendKeyStream,
   resumeKeyStream,
   isKeyStreamSuspended,
+  isKeyStreamAttached,
+  detachKeyStream,
   nextKey,
   nextKeyTimeout,
   requeueKeys,

package/src/models.js

@@ -0,0 +1,123 @@
+'use strict';
+
+/**
+ * AEGIS Cloud model catalog shaping — the one place `/model`, the alt+p picker
+ * and `/models` agree on what a pinnable model is.
+ *
+ * The ids a user may pin are the *server's*, never ours: the pool adds, renames
+ * and retires providers without a client release, so the catalog is fetched
+ * (`client.listModels()` → GET /api/v1/models on aegiscloud.org) and this module
+ * only normalises the payload. It deliberately invents no id, and has no
+ * fallback list: an offline client offers nothing rather than a model name that
+ * would silently route somewhere else.
+ *
+ * The platform lists per-provider ids (`deepseek`, `anthropic`, `groq`, …) plus
+ * the pooled-brain tiers. The desktop host collapsed all of that to a single
+ * "Nexus" entry because its dropdown *is* the model choice and surfacing
+ * per-provider routing invites pinning a provider that happens to be dead right
+ * now (see desktop/lib/local/engine.js selectBrainEntry). This host keeps every
+ * distinct id — a CLI user pinning `deepseek` explicitly is a legitimate
+ * request — but drops the pure-alias duplicates the server itself marks
+ * `hidden: true, alias_of: "<id>"` (`aegis-brain`, `nexus-brain-smart`, …),
+ * which are the same model advertised under another spelling.
+ */
+
+/** A pinned id of `null` means "no pin — let the pool choose" (the server's own default). */
+const NO_PIN = null;
+
+/**
+ * Labels for catalog ids the platform advertises without capabilities or a
+ * label of their own — `openai-gpt4o-mini` reads like a typo next to `openai`,
+ * and the brain tier is the one id whose *cost shape* a user needs before
+ * pinning it: verified live 2026-09-14, `model: "nexus-brain"` streams
+ * `pool-brain: 3 workers · effort=high · tier=brain · passes=4`, i.e. four
+ * billed provider calls per turn, where a provider id is one.
+ */
+const ID_NOTES = Object.freeze({
+  'openai-gpt4o-mini': 'OpenAI gpt-4o-mini, pooled',
+  'anthropic-haiku': 'Anthropic Haiku, pooled',
+  'nexus-brain': 'pooled brain · 3 workers + synthesis',
+});
+
+/** One raw entry (string id or object) → a catalog entry, or null when unusable. */
+function normalizeModel(entry) {
+  const m = typeof entry === 'string' ? { id: entry } : entry;
+  if (!m || typeof m !== 'object') return null;
+  const id = typeof m.id === 'string' ? m.id.trim() : '';
+  if (!id) return null;
+  const aliasOf =
+    typeof m.alias_of === 'string' && m.alias_of.trim() ? m.alias_of.trim() : null;
+  const capabilities = Array.isArray(m.capabilities)
+    ? m.capabilities.filter((c) => typeof c === 'string' && c)
+    : [];
+  const label =
+    (typeof m.label === 'string' && m.label.trim()) ||
+    (typeof m.name === 'string' && m.name.trim()) ||
+    id;
+  // The picker's right-hand column: what this entry *is*. An alias says so —
+  // otherwise a user reads five brain tiers and assumes five different models.
+  const note = aliasOf
+    ? `alias of ${aliasOf}`
+    : ID_NOTES[id] || capabilities.join(', ');
+  return {
+    id,
+    label,
+    note,
+    hidden: m.hidden === true,
+    aliasOf,
+    capabilities,
+  };
+}
+
+/** Normalise a raw `/api/v1/models` payload (`{models: [...]}` or the array). */
+function normalizeModelCatalog(raw) {
+  const list = Array.isArray(raw) ? raw : Array.isArray(raw && raw.models) ? raw.models : [];
+  const out = [];
+  const seen = new Set();
+  for (const entry of list) {
+    const m = normalizeModel(entry);
+    if (!m || seen.has(m.id)) continue;
+    seen.add(m.id);
+    out.push(m);
+  }
+  return out;
+}
+
+/**
+ * The entries the picker and `/models` offer: every distinct advertised model,
+ * minus the alias duplicates — unless the catalog is *only* aliases, in which
+ * case the aliases are all the server advertises and are offered rather than
+ * leaving the user with an empty list.
+ */
+function pickerEntries(catalog) {
+  const all = Array.isArray(catalog) ? catalog.filter(Boolean) : [];
+  const distinct = all.filter((m) => !m.aliasOf);
+  return distinct.length ? distinct : all;
+}
+
+/** The catalog entry for `id`, or null — the "is this a real id?" question. */
+function findModel(catalog, id) {
+  const want = typeof id === 'string' ? id.trim() : '';
+  if (!want) return null;
+  return (Array.isArray(catalog) ? catalog : []).find((m) => m && m.id === want) || null;
+}
+
+/**
+ * The set of ids the server accepts, lower-cased: a catalog id and a pinned id
+ * are the same thing only when they match byte-for-byte, but `/model Nexus-Brain`
+ * is a typo a user will make and the server's routing is case-insensitive
+ * enough that warning about it would be noise.
+ */
+function catalogIds(catalog) {
+  return new Set((Array.isArray(catalog) ? catalog : []).map((m) => String((m && m.id) || '').toLowerCase()).filter(Boolean));
+}
+
+module.exports = {
+  NO_PIN,
+  ID_NOTES,
+  normalizeModel,
+  normalizeModelCatalog,
+  pickerEntries,
+  findModel,
+  catalogIds,
+};

package/src/render.js

@@ -416,6 +416,10 @@ module.exports = {
   renderNotice,
   mdLines,
   inline,
+  // Welcome-mark pieces, shared with the onboarding screens so there is exactly
+  // one renderer for the mascot/moon/whale mark rather than two that can drift.
+  artRow,
+  tintWhale,
   // Style helpers kept for legacy consumers.
   fg,
   bg,