aegiscode 6.5.5 → 6.5.6

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aegiscode",
   "productName": "AEGIS Code",
-  "version": "6.5.5",
-  "description": "aegiscode — the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
+  "version": "6.5.6",
+  "description": "aegiscode \u2014 the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
   "author": {
     "name": "AEGIS Code",
     "email": "nborneklint@gmail.com"

package/src/app.js

@@ -65,6 +65,26 @@ function defaultSystemPrompt() {
   return _defaultSystem || undefined;
 }
 
+// The engine accepts exactly 'once' | 'session' and coerces anything else to
+// 'deny' (vendor/desktop/lib/local/engine.js → respondApproval). Bridging the
+// vocabularies here, rather than trusting every prompter to speak the engine's
+// dialect, is what stops an approval from silently becoming a denial. The
+// failure mode is invisible from the outside: the tool is refused, the model
+// is told the user declined, and it retries against a gate that can only ever
+// say no — the turn burns its whole budget.
+//
+// Module scope on purpose: this must exist before createApp() runs, because it
+// is re-exported for the conformance tests. A nested copy here previously left
+// the export binding undefined and threw on require.
+function normalizeDecision(decision) {
+  const v = typeof decision === 'string' ? decision.trim().toLowerCase() : '';
+  if (v === 'session') return 'session';
+  if (v === 'once' || v === 'allow' || v === 'yes' || v === 'approve' || v === 'approved') {
+    return 'once';
+  }
+  return 'deny';
+}
+
 function createApp(options = {}) {
   const opts = {
     model: null,
@@ -453,6 +473,8 @@ function createApp(options = {}) {
       return Promise.resolve('deny');
     };
 
+    // Vocabulary bridging lives at module scope (see normalizeDecision) so the
+    // same function the tests import is the one the live path calls.
     const onDelta = (chunk) => {
       if (!chunk) return;
       if (chunk.reasoning) {
@@ -481,7 +503,7 @@ function createApp(options = {}) {
         const decide = p.approval || approvalPrompter || denyNoPrompter;
         Promise.resolve(decide(info))
           .catch(() => 'deny')
-          .then((decision) => engine.respondApproval(info.id, decision));
+          .then((decision) => engine.respondApproval(info.id, normalizeDecision(decision)));
       }
     };
 
@@ -1366,4 +1388,4 @@ function createApp(options = {}) {
   };
 }
 
-module.exports = { createApp, VERSION };
+module.exports = { createApp, VERSION, normalizeDecision };

package/src/chatflow.js

@@ -298,6 +298,27 @@ function shortcutsGrid(cols, ctx) {
   ];
 }
 
+/**
+ * The engine's approval vocabulary — and the ONLY tokens that survive
+ * `respondApproval` (see cli/vendor/desktop/lib/local/engine.js). It accepts
+ * 'once' and 'session' and coerces EVERYTHING ELSE to 'deny'.
+ *
+ * This overlay used to answer 'allow': the desktop renderer's word for "yes",
+ * not the engine's. So a user who pressed "1. Yes" was denied anyway — silently,
+ * on every mutating tool, every time. The model then read "the user denied the
+ * request" and retried with a different command, which was denied too, and the
+ * turn burned several rounds of tokens to accomplish nothing. Emitting the
+ * engine's own words is the whole fix; `test/cli-approval.test.mjs` pins it so
+ * the two vocabularies cannot drift apart again.
+ */
+const APPROVE_ONCE = 'once';
+const APPROVE_SESSION = 'session';
+const DENY_TOKEN = 'deny';
+
+/** Choice labels, in overlay order. Index maps 1:1 onto DECISIONS. */
+const APPROVAL_CHOICES = ['Yes', 'Yes, allow for this session', 'No'];
+const APPROVAL_DECISIONS = [APPROVE_ONCE, APPROVE_SESSION, DENY_TOKEN];
+
 /** The tool-approval dialog body. */
 function confirmLines(overlay, cols, ctx) {
   const t = themeOf(ctx);
@@ -322,8 +343,13 @@ function confirmLines(overlay, cols, ctx) {
     const left = active ? span(t.lavender, GLYPH.cursor) : span('', ' ');
     return [left, span(t.gray, ` ${i + 1}. `), span(active ? t.lavender : t.white, label)];
   };
-  lines.push(opt(0, 'Yes'));
-  lines.push(opt(1, 'No'));
+  const toolName = overlay.name || 'this tool';
+  APPROVAL_CHOICES.forEach((label, i) => {
+    // The session option names the tool it will stop asking about, so the
+    // blanket allow is never something the user has to infer.
+    const text = i === 1 ? `Yes, and allow ${toolName} for this session` : label;
+    lines.push(opt(i, text));
+  });
   lines.push([span('', '')]);
   lines.push([span(t.gray, 'Esc to cancel')]);
   return lines;
@@ -815,34 +841,28 @@ async function runSession(host) {
       overlay = { type: 'confirm', name: info.tool || info.name || 'tool', args: info.args || {}, sel: 0, info };
       render();
       (async () => {
+        const choose = (decision) => {
+          overlay = null;
+          render();
+          resolve(decision);
+        };
         for (;;) {
           const key = await nextKey();
           if (key.name === KEY.UP || key.name === KEY.DOWN || key.name === KEY.TAB) {
-            overlay.sel = 1 - overlay.sel;
+            const step = key.name === KEY.UP ? -1 : 1;
+            overlay.sel = (overlay.sel + step + APPROVAL_CHOICES.length) % APPROVAL_CHOICES.length;
             render();
           } else if (key.name === KEY.ENTER) {
-            const yes = overlay.sel === 0;
-            overlay = null;
-            render();
-            resolve(yes ? 'allow' : 'deny');
+            choose(APPROVAL_DECISIONS[overlay.sel] || DENY_TOKEN);
             return;
           } else if (key.name === KEY.ESC || key.name === KEY.CTRL_C) {
-            overlay = null;
-            render();
-            resolve('deny');
+            choose(DENY_TOKEN);
             return;
           } else if (key.name === 'char') {
             const ch = String(key.ch).trim();
-            if (ch === '1') {
-              overlay = null;
-              render();
-              resolve('allow');
-              return;
-            }
-            if (ch === '2') {
-              overlay = null;
-              render();
-              resolve('deny');
+            const idx = Number(ch) - 1;
+            if (Number.isInteger(idx) && idx >= 0 && idx < APPROVAL_DECISIONS.length) {
+              choose(APPROVAL_DECISIONS[idx]);
               return;
             }
           }
@@ -1765,6 +1785,10 @@ module.exports = {
   statusLine,
   shortcutsGrid,
   confirmLines,
+  // The approval vocabulary, exported so a test can assert the CLI only ever
+  // answers with tokens the engine actually honours (see APPROVAL_CHOICES).
+  APPROVAL_CHOICES,
+  APPROVAL_DECISIONS,
   rowLines,
   transcriptLines,
   inputPreviewText,

package/vendor/desktop/lib/local/engine.js

@@ -346,6 +346,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
   // In-memory only, on purpose — never persisted, so a restart (or
   // newChat()'s clearSessionApprovals) always starts from a clean gate.
   const sessionAllowlists = new Map(); // rootSessionId -> Set<toolName>
+  // Denials are remembered for the same reason allows are, mirroring it for
+  // the other answer. Without this, a "Deny" was forgotten the instant it was
+  // given: the model read `… the user denied the request`, re-planned, called
+  // the SAME tool again, and the gate raised a SECOND card — so one "no" cost
+  // the user a prompt per round for up to maxRounds (24 chat / 40 autonomous)
+  // rounds, each round re-sending the whole conversation to the provider. A
+  // gate that only remembers "yes" turns a single click into a retry storm;
+  // remembering "no" makes the first answer stick.
+  const sessionDenials = new Map(); // rootSessionId -> Set<toolName>
   const pendingApprovals = new Map(); // approvalId -> { resolve }
 
   function sessionAllows(rootId, name) {
@@ -358,10 +367,44 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     sessionAllowlists.get(rootId).add(name);
   }
 
+  /** Has this conversation already refused this tool? Checked before the card
+   *  is raised, so a repeat call is refused outright instead of re-prompting. */
+  function sessionDenies(rootId, name) {
+    const set = sessionDenials.get(rootId);
+    return Boolean(set && set.has(name));
+  }
+
+  function denyForSession(rootId, name) {
+    if (!sessionDenials.has(rootId)) sessionDenials.set(rootId, new Set());
+    sessionDenials.get(rootId).add(name);
+  }
+
+  /**
+   * The text a refused tool hands back to the model. The old one-line
+   * `"<tool> was not executed — the user denied the request."` read to a
+   * capable agent as a transient failure to route around: it would apologise,
+   * pick a different command that does the same thing, and call the gate
+   * again. This says the durable part out loud (the refusal covers the rest of
+   * the conversation, not just that call) and asks for the one response that
+   * actually helps — say what you need and stop, so the user can re-enable it.
+   */
+  function denialText(name) {
+    return (
+      `${name} was not executed — the user denied this tool for this conversation. ` +
+      `Do NOT retry it and do NOT attempt the same effect by another route ` +
+      `(another command, a writeFile instead of an edit, a subagent). ` +
+      `Stop calling tools and reply in plain text: say what you were trying to do, ` +
+      `what you need, and that the user can re-enable ${name} to let it proceed.`
+    );
+  }
+
   /** newChat() in the renderer calls this so a fresh conversation never
-   *  inherits a prior thread's blanket allows. */
+   *  inherits a prior thread's blanket allows — or its refusals. A new chat is
+   *  a new gate in both directions: leaving denials behind would silently
+   *  refuse a tool in a thread where the user never said no. */
   function clearSessionApprovals(rootSessionId) {
     sessionAllowlists.delete(rootSessionId);
+    sessionDenials.delete(rootSessionId);
     return { ok: true };
   }
 
@@ -379,22 +422,28 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
   /**
    * Ask the renderer to approve one mutating tool call. Resolves 'once',
-   * 'session' or 'deny'. Sent over `rootOnDelta` (see chat()) as an
-   * `{ approval }` chunk so it rides the exact same streaming channel as
-   * tool-activity chunks — no new IPC surface needed on the push side, only
-   * on the reply side (respondApproval). Fails safe: no listener able to
-   * ever answer (no onDelta, or the turn was aborted) resolves 'deny'
-   * instead of hanging the tool round forever.
+   * 'session' or 'deny' (an explicit choice by the user) — or 'cancel' when
+   * nobody ever answered: no listener able to reply, or the turn was aborted.
+   * 'cancel' is kept apart from 'deny' on purpose. Both refuse the call, but
+   * only 'deny' is a decision the user made, so only 'deny' may be remembered
+   * as "this conversation said no" (see sessionDenials). Folding the two
+   * together — which is what the old fail-safe did, resolving 'deny' for an
+   * abort — would let a cancelled turn permanently refuse a tool the user
+   * never ruled on. Sent over `rootOnDelta` (see chat()) as an `{ approval }`
+   * chunk so it rides the exact same streaming channel as tool-activity
+   * chunks — no new IPC surface needed on the push side, only on the reply
+   * side (respondApproval). Fails safe: an unanswered request refuses the
+   * call instead of hanging the tool round forever.
    */
   function requestApproval(rootSessionId, rootOnDelta, signal, info) {
     return new Promise((resolve) => {
       if (signal && signal.aborted) {
-        resolve('deny');
+        resolve('cancel');
         return;
       }
       const id = randomUUID();
       let settled = false;
-      const onAbort = () => finish('deny');
+      const onAbort = () => finish('cancel');
       const finish = (decision) => {
         if (settled) return;
         settled = true;
@@ -405,7 +454,7 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       if (signal) signal.addEventListener('abort', onAbort, { once: true });
       pendingApprovals.set(id, { resolve: finish });
       if (typeof rootOnDelta !== 'function') {
-        finish('deny');
+        finish('cancel');
         return;
       }
       rootOnDelta({
@@ -440,6 +489,13 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     if (!T.MUTATING_TOOLS.has(name)) return T.executeTool(name, args, toolCtx);
     if (!confirmModeEnabled()) return T.executeTool(name, args, toolCtx);
     if (sessionAllows(rootSessionId, name)) return T.executeTool(name, args, toolCtx);
+    // Already refused in this conversation: refuse again WITHOUT raising a
+    // second card. Before this, the model's retry after a denial re-prompted
+    // the user for the same tool — one "no" produced a card per round for up
+    // to maxRounds rounds, each one a billed provider call re-sending the
+    // whole conversation. Checked after the confirm-mode short-circuit so
+    // turning the gate off still overrides an earlier refusal.
+    if (sessionDenies(rootSessionId, name)) return { ok: false, error: denialText(name) };
 
     let preview = null;
     if (name === 'writeFile' || name === 'editFile') {
@@ -453,8 +509,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       diff: preview && preview.diff,
     });
 
+    // Only a click is remembered. 'cancel' (aborted turn / nobody able to
+    // answer) refuses this call but must not write a durable "no" the user
+    // never gave.
     if (decision === 'deny') {
-      return { ok: false, error: `${name} was not executed — the user denied the request.` };
+      denyForSession(rootSessionId, name);
+      return { ok: false, error: denialText(name) };
+    }
+    if (decision !== 'session' && decision !== 'once') {
+      return { ok: false, error: `${name} was not executed — the request was cancelled.` };
     }
     if (decision === 'session') allowForSession(rootSessionId, name);