AI offer: don't prompt local-model download on Intel

- `get_ai_status` returned `Offer` on Intel Macs (default provider is "local"), so the install toast appeared and only revealed the arch limitation after the user clicked Download and `start_ai_download` rejected. Now gated upstream.
- Extracted pure `compute_ai_status` helper so the gate and dismissal logic are unit-testable without the `MANAGER` singleton or the compile-time `cfg!(target_arch)`.
- Added 7 tests covering provider/install/server/arch/dismissal combinations.
- Clarified `ai/mod.rs` module docstring: only the **local** path needs Apple Silicon. Cloud AI works on any hardware.
- Added a Gotcha to `ai/CLAUDE.md` so this trap doesn't get reintroduced.

Author: vdavid

apps/desktop/src-tauri/src/ai/CLAUDE.md

@@ -139,6 +139,8 @@ privacy-focused users. The architecture doesn't fight this switch: it's just a d
 
 ## Gotchas
 
+**Gotcha**: Only **local** AI requires Apple Silicon. Cloud AI (BYOK OpenAI / Anthropic / Gemini / any OpenAI-compatible endpoint) works on Intel Macs too. Don't gate the whole AI subsystem on `is_local_ai_supported()` — gate only the local-specific code paths (`start_ai_server`, `start_ai_download`, and the `Offer` branch of `compute_ai_status` in `manager.rs`). The frontend has its own short-circuit: `ai-state.svelte.ts::initAiState` returns early when `ai.provider === "cloud"` so the install toast never fires for cloud users, regardless of arch. A previous version of `get_ai_status` returned `Offer` on Intel because the default provider is `"local"`; users saw the download toast and only learned their hardware couldn't run it after clicking Download and hitting the `start_ai_download` rejection. Now `compute_ai_status` gates `Offer` on `local_ai_supported`.
+
 **Gotcha**: `genai` requires `base_url` to end with `/`. Without the trailing slash, `Url::join("chat/completions")` strips the last segment and you'd hit `https://api.openai.com/chat/completions` (404) instead of `/v1/chat/completions`. `client.rs::build_client` normalizes by appending `/` if missing.
 
 **Gotcha**: `genai 0.6` auto-routes `gpt-5*`, `*-codex`, `*-pro` to the Responses API, but `o1*`/`o3*`/`o4*`/`chatgpt-*` stay on Chat Completions even though they also reject custom `temperature`. We layer `is_openai_chat_reasoning_model()` on top to strip `temperature`/`top_p` and substitute `ReasoningEffort::Low` for those. The heuristic also matches `gpt-5*` as defense-in-depth in case `genai`'s routing rule changes.

apps/desktop/src-tauri/src/ai/manager.rs

@@ -116,21 +116,59 @@ pub fn shutdown() {
 #[specta::specta]
 pub fn get_ai_status() -> AiStatus {
     let manager = MANAGER.lock_ignore_poison();
-    match &*manager {
-        Some(m) if m.provider == "off" => AiStatus::Unavailable,
-        Some(m) if m.state.installed && m.child_pid.is_some() => AiStatus::Available,
-        Some(m) if m.state.installed => AiStatus::Unavailable, // installed but server not running
-        Some(m) => {
-            // Check if dismissed
-            if let Some(until) = m.state.dismissed_until
-                && is_still_dismissed(until)
-            {
-                return AiStatus::Unavailable;
-            }
-            AiStatus::Offer
-        }
-        None => AiStatus::Unavailable,
+    let Some(m) = manager.as_ref() else {
+        return AiStatus::Unavailable;
+    };
+    compute_ai_status(
+        &m.provider,
+        m.state.installed,
+        m.child_pid.is_some(),
+        m.state.dismissed_until,
+        is_local_ai_supported(),
+        current_unix_seconds(),
+    )
+}
+
+/// Pure decision function for [`get_ai_status`]. Split out so the global `MANAGER` lock
+/// and the compile-time `cfg!(target_arch)` gate don't have to participate in tests.
+fn compute_ai_status(
+    provider: &str,
+    installed: bool,
+    server_running: bool,
+    dismissed_until: Option<u64>,
+    local_ai_supported: bool,
+    now_secs: u64,
+) -> AiStatus {
+    if provider == "off" {
+        return AiStatus::Unavailable;
     }
+    if installed && server_running {
+        return AiStatus::Available;
+    }
+    if installed {
+        return AiStatus::Unavailable; // installed but server not running
+    }
+    // Not installed. Only offer the local-model download if the hardware can run it;
+    // otherwise the user sees the toast, clicks Download, and only then discovers
+    // `start_ai_download` rejects with "Local AI not supported on this hardware".
+    // Cloud AI is unaffected: the frontend short-circuits this status path when
+    // `ai.provider === "cloud"` (see `ai-state.svelte.ts::initAiState`).
+    if !local_ai_supported {
+        return AiStatus::Unavailable;
+    }
+    if let Some(until) = dismissed_until
+        && now_secs < until
+    {
+        return AiStatus::Unavailable;
+    }
+    AiStatus::Offer
+}
+
+fn current_unix_seconds() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
 }
 
 /// Returns the port the llama-server is listening on, if running.
@@ -823,14 +861,6 @@ fn cleanup_stale_partial_download(m: &mut ManagerState) {
     }
 }
 
-fn is_still_dismissed(until_timestamp: u64) -> bool {
-    let now = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs();
-    now < until_timestamp
-}
-
 async fn do_download<R: Runtime>(app: &AppHandle<R>) -> Result<(), String> {
     let ai_dir = get_ai_dir(app);
     fs::create_dir_all(&ai_dir).map_err(|e| format!("Failed to create AI directory: {e}"))?;
@@ -1077,4 +1107,61 @@ mod tests {
         let status = get_ai_status();
         assert_eq!(status, AiStatus::Unavailable);
     }
+
+    // --- compute_ai_status: pure decision function ---
+
+    const NOW: u64 = 1_700_000_000;
+
+    #[test]
+    fn compute_ai_status_provider_off_is_unavailable() {
+        let s = compute_ai_status("off", true, true, None, true, NOW);
+        assert_eq!(s, AiStatus::Unavailable);
+    }
+
+    #[test]
+    fn compute_ai_status_installed_and_running_is_available() {
+        let s = compute_ai_status("local", true, true, None, true, NOW);
+        assert_eq!(s, AiStatus::Available);
+    }
+
+    #[test]
+    fn compute_ai_status_installed_but_server_down_is_unavailable() {
+        let s = compute_ai_status("local", true, false, None, true, NOW);
+        assert_eq!(s, AiStatus::Unavailable);
+    }
+
+    #[test]
+    fn compute_ai_status_not_installed_offers_on_apple_silicon() {
+        let s = compute_ai_status("local", false, false, None, true, NOW);
+        assert_eq!(s, AiStatus::Offer);
+    }
+
+    #[test]
+    fn compute_ai_status_not_installed_does_not_offer_on_intel() {
+        // The bug this guard fixes: Intel users with default provider="local" used to see
+        // the AI download toast, only to be rejected by `start_ai_download` on click.
+        let s = compute_ai_status("local", false, false, None, false, NOW);
+        assert_eq!(s, AiStatus::Unavailable);
+    }
+
+    #[test]
+    fn compute_ai_status_intel_with_installed_state_still_unavailable() {
+        // Defense in depth: even if state somehow says installed on Intel (e.g. user copied
+        // their data dir across machines), we still don't claim Available because the binary
+        // is ARM64-only and won't run.
+        let s = compute_ai_status("local", true, false, None, false, NOW);
+        assert_eq!(s, AiStatus::Unavailable);
+    }
+
+    #[test]
+    fn compute_ai_status_dismissed_offer_is_hidden() {
+        let s = compute_ai_status("local", false, false, Some(NOW + 60), true, NOW);
+        assert_eq!(s, AiStatus::Unavailable);
+    }
+
+    #[test]
+    fn compute_ai_status_expired_dismissal_offers_again() {
+        let s = compute_ai_status("local", false, false, Some(NOW - 60), true, NOW);
+        assert_eq!(s, AiStatus::Offer);
+    }
 }

apps/desktop/src-tauri/src/ai/mod.rs

@@ -1,7 +1,12 @@
-//! Local AI features powered by local LLMs via llama-server.
+//! AI features. Two paths:
 //!
-//! AI features require Apple Silicon (M1 or later). Intel Macs are not supported
-//! because the bundled llama-server binary is ARM64-only.
+//! - **Local LLM** via bundled `llama-server`. Requires Apple Silicon (M1+) because the
+//!   binary is ARM64-only. Gated by [`is_local_ai_supported`].
+//! - **Cloud AI** (OpenAI / Anthropic / Gemini / any OpenAI-compatible endpoint, BYOK).
+//!   Works on any hardware, including Intel Macs.
+//!
+//! Don't conflate the two: an Intel user can absolutely use AI features, just not the
+//! local path. Code that turns off "AI" wholesale on non-aarch64 is a bug.
 //!
 //! ## Model registry
 //!