aegiscode 6.3.0 → 6.3.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegiscode",
   "productName": "AEGIS Code",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "description": "aegiscode — the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
   "author": {
     "name": "AEGIS Code",

package/src/app.js

@@ -27,6 +27,7 @@ const { GLYPH, VERBS, themeOf, RESET, THEME_TABLE } = require('./theme.js');
 const { LiveRegion, termWidth, w } = require('./screen.js');
 const { parseLine, COMMANDS, visibleCommands } = require('./commands.js');
 const { updateConfig, loadPermissions, loadConfig, configExists } = require('./config.js');
+const { normalizeModelCatalog, pickerEntries, catalogIds } = require('./models.js');
 const { appendHistory, readSessionTranscript, readOwnSessions } = require('./history.js');
 const { snapshotCheckpoint } = require('./checkpoint.js');
 const screens = require('./screens.js');
@@ -146,6 +147,71 @@ function createApp(options = {}) {
     }
   }
 
+  // ── the AEGIS Cloud model catalog ──────────────────────────────────────────
+  //
+  // `/model` (and the alt+p chord that dispatches it) reads the pinnable ids
+  // from the server, and `state().models` is where it looks. That path had no
+  // source at all: `commands.js` calls `c.loadModels()` inside a `try {} catch
+  // {}`, `c.loadModels` was never defined on either command context, and
+  // `buildState()` hardcoded `models: []` — so the TypeError was swallowed and
+  // both `/model` and the picker reported "no models advertised" on a perfectly
+  // healthy account, forever. The ids themselves are the server's (see
+  // models.js), fetched here and cached, because the pool adds and retires
+  // providers without a client release.
+  const MODEL_CACHE_MS = 5 * 60_000;
+  const modelCache = { at: 0, models: [] };
+
+  /**
+   * Fetch (or return the cached) model catalog. Rejects when the account cannot
+   * read it at all — no key, offline, or a server error — which callers treat as
+   * "nothing to offer" rather than retrying per keystroke.
+   * @returns {Promise<Array<{id:string,label:string,note:string}>>}
+   */
+  async function loadModels({ force = false } = {}) {
+    const fresh = modelCache.models.length && Date.now() - modelCache.at < MODEL_CACHE_MS;
+    if (!force && fresh) return modelCache.models;
+    const data = await client.listModels();
+    modelCache.models = normalizeModelCatalog(data && data.models);
+    modelCache.at = Date.now();
+    return modelCache.models;
+  }
+
+  /**
+   * A pinned model id the server does not advertise is a *silent* fallback: the
+   * pool answers from its own default with no error, so the pin looks honoured
+   * while the reply came from another model — and the cost is attributed to the
+   * model that was pinned. Two shipped defaults did exactly that: `sonnet`
+   * (written into config.json by onboarding, merged in from DEFAULT_CONFIG, and
+   * never advertised by AEGIS Cloud) and any `provider/model` spelling a user
+   * typed by hand. Clears such a pin once, says so, and leaves the server's own
+   * default in its place.
+   *
+   * Best-effort and offline-safe: a catalog that cannot be read clears nothing.
+   */
+  async function validatePinnedModel() {
+    const pinned = commandCtx.model;
+    if (!pinned) return null;
+    let models;
+    try {
+      models = await loadModels();
+    } catch {
+      return null;
+    }
+    if (!models.length) return null;
+    if (catalogIds(models).has(String(pinned).toLowerCase())) return null;
+    commandCtx.model = null;
+    updateConfig({ model: null, currentModelId: null });
+    emit(
+      render.renderNotice(
+        ctx(),
+        'warn',
+        `pinned model "${pinned}" is not advertised by AEGIS Cloud — pin cleared, ` +
+          'the pool will choose; /models lists what you can pin.'
+      )
+    );
+    return pinned;
+  }
+
   function bannerLines() {
     return render.renderBanner(ctx(), {
       width: width(),
@@ -517,7 +583,9 @@ function createApp(options = {}) {
       plan: session.plan || null,
       account: session.account || null,
       permissions: { mode: rules.defaultMode, rules },
-      models: [],
+      // The selectable (pickable) catalog, not the raw payload: alias tiers are
+      // dropped, live ids only (see models.js pickerEntries).
+      models: pickerEntries(modelCache.models),
       commands: visibleCommands(),
       transcript: transcript.slice(),
       sessions: [],
@@ -633,6 +701,10 @@ function createApp(options = {}) {
       runPrompt: (text) => runPrompt(text),
       ask: (text) => ask(text),
       runTool: (name, args) => runTool(name, args),
+      // The AEGIS catalog fetch `/model` and alt+p expect (see loadModels).
+      // Wired on the app's context so the chatflow's `Object.assign`-based
+      // context inherits it too — one definition, both hosts.
+      loadModels: (o) => loadModels(o),
       refreshSpend: () => refreshSpend(),
       state: () => buildState(),
       setInput: () => {},
@@ -916,6 +988,7 @@ function createApp(options = {}) {
       TOOLS,
       ask: (prompt, o) => ask(prompt, o),
       makeCommandContext: () => makeCommandContext(),
+      loadModels: (o) => loadModels(o),
       buildState: () => buildState(),
       dispatchLine: (line, c) => handleLine(line, c),
       refreshSpend: () => refreshSpend(),
@@ -1037,6 +1110,11 @@ function createApp(options = {}) {
         save: (patch) => updateConfig(patch),
       });
       if (!onboard.ok) return 0;
+      // A stored pin the platform does not advertise routes elsewhere in
+      // silence (see validatePinnedModel) — checked once, here, where the user
+      // can act on it. Not on `-p`: a network round-trip ahead of the first
+      // token would be a startup cost bought for a warning no script watches.
+      await validatePinnedModel();
       // `--continue` must load the last session *before* the loop starts, and
       // it has to be read here rather than captured at construction: the
       // history file is written by the loop itself.
@@ -1071,6 +1149,8 @@ function createApp(options = {}) {
     refreshSpend,
     bannerLines,
     makeHost,
+    loadModels,
+    validatePinnedModel,
     recordTurn,
     persistTurn,
     restorePrefs,

package/src/commands.js

@@ -478,10 +478,25 @@ const COMMANDS = [
         await loadModels(c);
         const models = c.state().models || [];
         if (!models.length) {
-          note(c, 'No pinnable models advertised — /models lists what the server advertises.');
+          // Say why, and what unblocks it: an unreachable catalog is almost
+          // always a missing key or no network, and "no models advertised"
+          // read as "the platform has none" rather than "this client could not
+          // ask".
+          note(c, c.state().online
+            ? 'Could not read the model catalog (offline, or the server refused it) — /models retries.'
+            : // The key travels in the environment only (client/aegis.js reads
+              // AEGIS_API_KEY); /login is an unavailable command here, so
+              // pointing at it would send the user to a refusal.
+              'No API key set, so the model catalog cannot be read — export AEGIS_API_KEY (free at https://aegiscloud.org), then retry /model.');
           c.render();
           return true;
         }
+        // A pin that is not in the catalog is not honoured — the pool answers
+        // from its own default with no error. Say so where the pin is visible
+        // rather than letting the reply look like the pinned model.
+        if (c.ctx.model && !models.some((m) => m.id === c.ctx.model)) {
+          note(c, `pinned model "${c.ctx.model}" is not in the catalog — the pool will answer with its own default; pick one below.`);
+        }
         // The overlay's own copy promises /model add|remove (overlays.js, a
         // separate workstream); this build refuses both, so say here how a
         // model is actually selected.
@@ -516,6 +531,16 @@ const COMMANDS = [
       // dir, so the write stays inside that dir.
       c.saveConfig({ model: id, currentModelId: id });
       note(c, `Pinned model: ${id}`);
+      // The server accepts an id it does not advertise and answers from its own
+      // default — no error, a different model, and the spend attributed to the
+      // id that was pinned. Warn (never refuse: the catalog is cached, and
+      // refusing would break a pin made against a server that is briefly
+      // unreachable) so the mismatch is visible at the moment it is created.
+      await loadModels(c);
+      const models = c.state().models || [];
+      if (models.length && !models.some((m) => m.id === id)) {
+        note(c, `"${id}" is not in the AEGIS Cloud catalog — the pool will answer with its own default. /models lists the real ids.`);
+      }
       c.render();
       return true;
     },

package/src/config.js

@@ -43,7 +43,17 @@ function permissionsPath() {
 
 const DEFAULT_CONFIG = {
   themeIndex: 1,   // Dark mode
-  model: 'sonnet',
+  // No pinned model. This host runs on AEGIS Cloud, whose pinnable ids are the
+  // server's (`/models`) — a client-side default here would have to name one,
+  // and the one it named (`sonnet`) is not advertised by the platform at all:
+  // the pool accepts an unknown id and answers from its own default with no
+  // error, so the pin looked honoured while the reply came from another model.
+  // Worse, onboarding persists this object on first run (`updateConfig` merges
+  // DEFAULT_CONFIG under the patch), so the phantom pin was written to disk for
+  // every user who ever completed the trust check. `null` = no pin; the server
+  // chooses, and app.js's validatePinnedModel() clears a stored id the catalog
+  // does not advertise.
+  model: null,
   // Phase 6: the full model table (seeded from src/models.js MODELS on first
   // read by pickerModels()). 'currentModelId' mirrors `model` under the
   // aegiscode- name so /model add/remove/switch stay compatible both ways.

package/src/models.js

@@ -0,0 +1,123 @@
+'use strict';
+
+/**
+ * AEGIS Cloud model catalog shaping — the one place `/model`, the alt+p picker
+ * and `/models` agree on what a pinnable model is.
+ *
+ * The ids a user may pin are the *server's*, never ours: the pool adds, renames
+ * and retires providers without a client release, so the catalog is fetched
+ * (`client.listModels()` → GET /api/v1/models on aegiscloud.org) and this module
+ * only normalises the payload. It deliberately invents no id, and has no
+ * fallback list: an offline client offers nothing rather than a model name that
+ * would silently route somewhere else.
+ *
+ * The platform lists per-provider ids (`deepseek`, `anthropic`, `groq`, …) plus
+ * the pooled-brain tiers. The desktop host collapsed all of that to a single
+ * "Nexus" entry because its dropdown *is* the model choice and surfacing
+ * per-provider routing invites pinning a provider that happens to be dead right
+ * now (see desktop/lib/local/engine.js selectBrainEntry). This host keeps every
+ * distinct id — a CLI user pinning `deepseek` explicitly is a legitimate
+ * request — but drops the pure-alias duplicates the server itself marks
+ * `hidden: true, alias_of: "<id>"` (`aegis-brain`, `nexus-brain-smart`, …),
+ * which are the same model advertised under another spelling.
+ */
+
+/** A pinned id of `null` means "no pin — let the pool choose" (the server's own default). */
+const NO_PIN = null;
+
+/**
+ * Labels for catalog ids the platform advertises without capabilities or a
+ * label of their own — `openai-gpt4o-mini` reads like a typo next to `openai`,
+ * and the brain tier is the one id whose *cost shape* a user needs before
+ * pinning it: verified live 2026-09-14, `model: "nexus-brain"` streams
+ * `pool-brain: 3 workers · effort=high · tier=brain · passes=4`, i.e. four
+ * billed provider calls per turn, where a provider id is one.
+ */
+const ID_NOTES = Object.freeze({
+  'openai-gpt4o-mini': 'OpenAI gpt-4o-mini, pooled',
+  'anthropic-haiku': 'Anthropic Haiku, pooled',
+  'nexus-brain': 'pooled brain · 3 workers + synthesis',
+});
+
+/** One raw entry (string id or object) → a catalog entry, or null when unusable. */
+function normalizeModel(entry) {
+  const m = typeof entry === 'string' ? { id: entry } : entry;
+  if (!m || typeof m !== 'object') return null;
+  const id = typeof m.id === 'string' ? m.id.trim() : '';
+  if (!id) return null;
+  const aliasOf =
+    typeof m.alias_of === 'string' && m.alias_of.trim() ? m.alias_of.trim() : null;
+  const capabilities = Array.isArray(m.capabilities)
+    ? m.capabilities.filter((c) => typeof c === 'string' && c)
+    : [];
+  const label =
+    (typeof m.label === 'string' && m.label.trim()) ||
+    (typeof m.name === 'string' && m.name.trim()) ||
+    id;
+  // The picker's right-hand column: what this entry *is*. An alias says so —
+  // otherwise a user reads five brain tiers and assumes five different models.
+  const note = aliasOf
+    ? `alias of ${aliasOf}`
+    : ID_NOTES[id] || capabilities.join(', ');
+  return {
+    id,
+    label,
+    note,
+    hidden: m.hidden === true,
+    aliasOf,
+    capabilities,
+  };
+}
+
+/** Normalise a raw `/api/v1/models` payload (`{models: [...]}` or the array). */
+function normalizeModelCatalog(raw) {
+  const list = Array.isArray(raw) ? raw : Array.isArray(raw && raw.models) ? raw.models : [];
+  const out = [];
+  const seen = new Set();
+  for (const entry of list) {
+    const m = normalizeModel(entry);
+    if (!m || seen.has(m.id)) continue;
+    seen.add(m.id);
+    out.push(m);
+  }
+  return out;
+}
+
+/**
+ * The entries the picker and `/models` offer: every distinct advertised model,
+ * minus the alias duplicates — unless the catalog is *only* aliases, in which
+ * case the aliases are all the server advertises and are offered rather than
+ * leaving the user with an empty list.
+ */
+function pickerEntries(catalog) {
+  const all = Array.isArray(catalog) ? catalog.filter(Boolean) : [];
+  const distinct = all.filter((m) => !m.aliasOf);
+  return distinct.length ? distinct : all;
+}
+
+/** The catalog entry for `id`, or null — the "is this a real id?" question. */
+function findModel(catalog, id) {
+  const want = typeof id === 'string' ? id.trim() : '';
+  if (!want) return null;
+  return (Array.isArray(catalog) ? catalog : []).find((m) => m && m.id === want) || null;
+}
+
+/**
+ * The set of ids the server accepts, lower-cased: a catalog id and a pinned id
+ * are the same thing only when they match byte-for-byte, but `/model Nexus-Brain`
+ * is a typo a user will make and the server's routing is case-insensitive
+ * enough that warning about it would be noise.
+ */
+function catalogIds(catalog) {
+  return new Set((Array.isArray(catalog) ? catalog : []).map((m) => String((m && m.id) || '').toLowerCase()).filter(Boolean));
+}
+
+module.exports = {
+  NO_PIN,
+  ID_NOTES,
+  normalizeModel,
+  normalizeModelCatalog,
+  pickerEntries,
+  findModel,
+  catalogIds,
+};

package/vendor/desktop/lib/local/engine.js

@@ -473,6 +473,17 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
   async function listModels(cls) {
     if (cls === 'aegis') {
+      // The catalog is behind the account's key: GET /api/v1/models answers
+      // `401 {"error":{"message":"No API key"}}` without one (verified against
+      // aegiscloud.org). Aegis Cloud is the *default* class, so firing the call
+      // anyway painted a raw "listModels failed: … 401" over the default model
+      // picker for every user who had just installed the app and not yet
+      // pasted a key — the one state where the UI must say what unblocks it and
+      // not what went wrong. Report the missing key as a state (`needsKey`) and
+      // let the renderer invite the user to connect; nothing else about the
+      // class changes, and the model dropdown keeps its "server default (auto)"
+      // entry so the class is usable the moment a key lands.
+      if (!aegis.apiKey) return { class: cls, models: [], needsKey: true };
       const data = await aegis.listModels();
       return { class: cls, models: filterAegisCatalog(normalizeCatalog(data && data.models)) };
     }