aegis-desktop 0.8.11 → 0.8.13

package/lib/fingerprint.js

@@ -0,0 +1,327 @@
+'use strict';
+
+/**
+ * The desktop's φ(α) surface: the same keys and the same records the terminal
+ * host mints, driven over IPC instead of argv.
+ *
+ * `main.js` builds one of these in `createIpcDispatch` and exposes four
+ * handlers (`fingerprintStatus`, `fingerprintKeygen`, `fingerprintMint`,
+ * `fingerprintVerify` + `fingerprintBackup`), which `preload.js` forwards. The
+ * cryptography is NOT here — it is `client/{fingerprint,authorship-key,attest}.js`,
+ * the same files the CLI calls, so a record minted in the app verifies in the
+ * terminal and vice versa. A second implementation would be the whole bug this
+ * arrangement exists to prevent, and `test/fingerprint-interop.test.mjs` is
+ * what holds the engine side of that too.
+ *
+ * ## Publishing (the vault) and the one thing that never goes there
+ *
+ * A record can be published to the shared vault (`fingerprintPublish` →
+ * `client/record-vault.js`, default `gdrive:AEGIS-AGPL`), which writes the
+ * *sealed bytes* unchanged plus a `.anchor.json` **link beside the local copy**
+ * — so "where is this record published?" is answerable later, from the record.
+ * The ownership key is NOT publishable and is not offered: the vault module
+ * refuses a key-shaped file by name, by shape and by comparing the bytes against
+ * the resolved key, and this service never passes one. The GUI is the host most
+ * likely to be asked to "just back the key up to Drive", so the refusal is
+ * enforced in the shared module rather than left as a rule in this comment.
+ *
+ * ## Why it takes `dir` instead of reading `$AEGIS_HOME`
+ *
+ * The app already owns a data directory (`app.getPath('userData')` in the
+ * packaged app, the repo's `.aegiscode` in dev) and every other store the app
+ * touches lives in it. A key that resolved to a *different* directory than the
+ * one `aegiscode login` writes credentials to would be a second, invisible
+ * identity — the exact failure the shared credential store was built to avoid.
+ * So the directory is injected, and `AEGIS_HOME` is set from it for the shared
+ * modules: one store, both hosts, no ambient guesswork.
+ *
+ * ## Errors are values, not throws
+ *
+ * Every method returns `{ ok, … }` or `{ ok: false, error }`. An IPC handler
+ * that rejects gives the renderer an opaque `Error: Error invoking remote
+ * method` string with the real message buried in main-process logs; a returned
+ * error is a message the UI can show verbatim, which matters most for the one
+ * error a user is likely to hit ("this key file is readable by other users").
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Resolve a shared client module by existence: repo checkout first, then the
+ * packaged app's flattened `vendor/` (electron-builder cannot reach outside the
+ * app directory — see scripts/predist.mjs, which must stage all four).
+ */
+function resolveShared(name) {
+  const candidates = [
+    path.join(__dirname, '..', '..', 'client', name), // dev / CI: repo root
+    path.join(__dirname, '..', 'vendor', name), // packaged: desktop/vendor
+  ];
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  throw new Error(
+    `aegis-desktop: cannot find client/${name} — expected it beside desktop/ in the repo ` +
+      'or under desktop/vendor/ in a build. Run `npm run predist` in desktop/.',
+  );
+}
+
+function load() {
+  const fp = require(resolveShared('fingerprint.js'));
+  return {
+    fp,
+    authorship: require(resolveShared('authorship-key.js')),
+    attest: require(resolveShared('attest.js')),
+    vault: require(resolveShared('record-vault.js')),
+  };
+}
+
+function slug(value, max = 80) {
+  return (
+    String(value || 'session')
+      .replace(/[^A-Za-z0-9._-]+/g, '_')
+      .replace(/^[._-]+/, '')
+      .slice(0, max) || 'session'
+  );
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.dir  the app's data directory (userData in a package)
+ * @param {object} [o.env] process env, injectable for tests
+ */
+function createFingerprintService({ dir, env } = {}) {
+  if (!dir) throw new Error('aegis-desktop: createFingerprintService needs a data dir');
+  // One store: the shared modules read AEGIS_HOME and nothing else.
+  const scope = { ...(env || process.env), AEGIS_HOME: (env || process.env).AEGIS_HOME || dir };
+
+  const recordPath = (record, session) =>
+    path.join(dir, 'fingerprints', `${slug(session)}.${String(record.createdAt).replace(/[:.]/g, '-')}.json`);
+
+  return {
+    /** Which key is in use, and where it came from. Never returns the key. */
+    status() {
+      try {
+        const { fp, authorship, vault } = load();
+        const key = authorship.resolveKey({ argv: [], env: scope });
+        const history = path.join(authorship.dataDir(scope), 'history.jsonl');
+        const target = vault.vaultTarget(scope);
+        return {
+          ok: true,
+          configured: Boolean(key.secret),
+          keySource: key.source,
+          keyPath: key.path,
+          keyFingerprint: key.secret ? fp.keyFingerprint(key.secret) : null,
+          publicKey: key.public,
+          defaultKeyPath: authorship.defaultKeyPath(scope),
+          historyPath: history,
+          historyPresent: fs.existsSync(history),
+          dataDir: authorship.dataDir(scope),
+          // Where a publish goes, so the panel can say it before the user asks
+          // for one — and so a misconfigured root is visible, not discovered by
+          // a record landing in the wrong folder.
+          vault: { remote: target.remote, root: target.root, recordsDir: `${target.root}/${vault.RECORDS_DIR}` },
+        };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /** Mint a private key. `force` replaces one, which orphans its records. */
+    keygen({ out = null, force = false } = {}) {
+      try {
+        const { authorship } = load();
+        const argv = [];
+        if (out) argv.push('--out', out);
+        if (force) argv.push('--force');
+        const r = authorship.keygen({ argv, env: scope });
+        return { ok: true, ...r };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /**
+     * Seal a session as a record.
+     *
+     * `turns` may be passed in (the renderer's own view of the session) or left
+     * out, in which case the shared adapter reads the session log — same code
+     * path as the CLI, so a GUI record and a terminal record of the same
+     * session carry the same behaviour digest — and the same AI digest, from the
+     * same turns.
+     */
+    mint({ history = null, session = null, turns = null, label = null, account = null,
+          model = null, tools = null, codeRoots = null, codeDirty = null, out = null,
+          createdAt = null, publish = false, aiSecret = undefined, aiModel = null } = {}) {
+      try {
+        const { attest, authorship } = load();
+        const roots = Array.isArray(codeRoots) ? codeRoots.filter(Boolean) : [];
+        const r = attest.mintSession({
+          argv: [],
+          env: scope,
+          history: history || path.join(authorship.dataDir(scope), 'history.jsonl'),
+          session: session || undefined,
+          turns: turns || undefined,
+          label: label || undefined,
+          account: account || undefined,
+          model: model || undefined,
+          tools: Array.isArray(tools) ? tools : undefined,
+          code: roots.length ? attest.collectCode({ roots }) : [],
+          codeDirty: typeof codeDirty === 'boolean' ? codeDirty : null,
+          // The AI axis. `undefined` walks the shared rungs (`--ai-secret` never
+          // applies here; `$AEGIS_AI_SECRET` in the app's scope does), and an
+          // explicit null means "no credential — mint the axis as unobserved".
+          // The authorship key is never borrowed for this: it says who sealed the
+          // record, not which mind answered.
+          aiSecret,
+          aiModel: aiModel === null ? undefined : aiModel,
+          // Pinning the time is how the CLI and the app mint the *same* record
+          // for the same session (see client/attest.js). Left null, the record
+          // is stamped now, which is what an ordinary seal wants.
+          createdAt: createdAt || undefined,
+        });
+        const file = path.resolve(out || recordPath(r.record, session || 'last'));
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(r.record, null, 2) + '\n');
+
+        // Sealing and travelling are separate acts: `publish` is opt-in, and a
+        // failed publish NEVER unseals the record — the local file is already
+        // written and the error is reported beside it, because the seal is the
+        // evidence and the copy is the convenience.
+        let vault = null;
+        let vaultError = null;
+        if (publish) {
+          try {
+            const key = authorship.resolveKey({ argv: [], env: scope });
+            vault = load().vault.publish({ file, argv: [], env: scope, secret: key.secret });
+          } catch (e) {
+            vaultError = (e && e.message) || String(e);
+          }
+        }
+        return {
+          ok: true,
+          record: r.record,
+          out: file,
+          keySource: r.keySource,
+          public: r.public,
+          vault,
+          vaultError,
+        };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /**
+     * Publish a sealed record to the vault, and link the local copy to it.
+     *
+     * `record` is accepted as well as `file` so the panel can publish what it
+     * just minted without a round trip through the filesystem — but the
+     * preferred path is the file, because the sha256 in the anchor is then about
+     * the bytes on disk rather than a re-serialisation of them.
+     */
+    publish({ file = null, record = null, dryRun = false } = {}) {
+      try {
+        const { authorship, vault } = load();
+        const key = authorship.resolveKey({ argv: [], env: scope });
+        return {
+          ok: true,
+          ...vault.publish({ file, record, argv: [], env: scope, secret: key.secret, dryRun }),
+        };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /**
+     * Is the published copy still the record that was sealed?
+     *
+     * Reports the three claims separately (`present`, `unchanged`, `attested`),
+     * because "the file is gone" and "the file was replaced" and "the key that
+     * sealed it has moved on" are three different situations and a single
+     * boolean would flatten them into one that hides the interesting case.
+     */
+    anchor({ file = null, record = null, anchor = null } = {}) {
+      try {
+        const { authorship, vault } = load();
+        if (!file && !record && !anchor) return { ok: false, error: 'anchor needs a record or an anchor' };
+        const key = authorship.resolveKey({ argv: [], env: scope });
+        return { ok: true, ...vault.checkAnchor({ file, record, anchor, argv: [], env: scope, key }) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /** What is in the vault. */
+    vaultList() {
+      try {
+        const { vault } = load();
+        return { ok: true, ...vault.list({ argv: [], env: scope }) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /**
+     * Inspect the vault for key material — including the `keys/` copy that was
+     * already there before publishing was restricted. A finding is a fact about
+     * the vault, not about this app, so it is returned rather than acted on.
+     */
+    vaultAudit() {
+      try {
+        const { authorship, vault } = load();
+        const key = authorship.resolveKey({ argv: [], env: scope });
+        return { ok: true, ...vault.audit({ argv: [], env: scope, secret: key.secret || null }) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /**
+     * Recompute a record's attestation. Accepts a path or the record itself, so
+     * the renderer can verify what it just minted without a round trip through
+     * the filesystem.
+     */
+    verify({ file = null, record = null } = {}) {
+      try {
+        const { fp, authorship } = load();
+        let body = record;
+        if (!body) {
+          if (!file) return { ok: false, error: 'verify needs a record file or the record itself' };
+          body = JSON.parse(fs.readFileSync(file, 'utf8'));
+        }
+        const key = authorship.resolveKey({ argv: [], env: scope });
+        if (!key.secret) {
+          return { ok: false, error: 'no authorship key — run keygen first', reason: 'no key' };
+        }
+        const v = fp.verify(body, key.secret);
+        return {
+          ok: v.ok,
+          reason: v.reason,
+          id: v.id,
+          credentialMatch: v.credentialMatch,
+          keySource: key.source,
+          recordedKeyFingerprint: body.keyFingerprint || null,
+        };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+
+    /** Copy the key out. Refuses a destination inside a non-ignored git tree. */
+    backup({ to = null, name = null, allowGit = false } = {}) {
+      try {
+        if (!to) return { ok: false, error: 'backup needs a destination directory' };
+        const { authorship } = load();
+        const argv = ['--to', to];
+        if (name) argv.push('--name', name);
+        if (allowGit) argv.push('--allow-git');
+        return { ok: true, ...authorship.backup({ argv, env: scope }) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
+  };
+}
+
+module.exports = { createFingerprintService, resolveShared, slug };

package/lib/local/autonomous.js

@@ -322,6 +322,7 @@ function autonomousDirective(rounds = DEFAULT_ROUNDS) {
     'Work the task end to end:',
     '1. Plan in one line, then start acting in the same turn — never end a turn on a plan.',
     '2. Read only what you need to make the change (no fishing through the repo).',
+    '2b. If this demand has been made before, establish whether it was met: check recalled memory, the queue file, PLAN.md, and git history for the earlier attempt. When it was fixed and the problem is back, state how it was fixed then and why it regressed, and fix that cause — a blind re-fix is a regression, not a resolution.',
     '3. Make the change with Write/Edit/Bash, then VERIFY it: re-read the result and run the relevant test/command.',
     '4. If verification fails, fix it and verify again — loop until it passes or you are genuinely blocked.',
     '5. Do not ask for permission, do not hand the work back, do not stop at "let me check…".',

package/lib/local/prompt.js

@@ -31,6 +31,12 @@ const MAIN_CHAT_PROMPT =
   `- Use tools silently. A one-line reason is enough; do not narrate your plan as a story. ` +
   `- Never claim what a tool found or what a command returned before the tool actually runs. ` +
   `  Report only the results you really received. ` +
+  `- Before you start a fix or feature the user asks for, check whether they have asked for ` +
+  `  it before and whether it was already delivered: look in recalled memory, ` +
+  `  ~/.aegiscode/queue.jsonl, PLAN.md/notes, and \`git log\` for the same demand. If it was ` +
+  `  resolved before and the problem is back, report how it was resolved (the commit, file, or ` +
+  `  mechanism that fixed it) and why it regressed, then fix the cause — never re-fix blind as ` +
+  `  if the request were new. If it was never met, say so plainly before starting. ` +
   `- Match the response to the request. A greeting, a question about something you already ` +
   `  know, or a request for an opinion is answered in plain words with NO tools. Only reach ` +
   `  for a tool when the answer genuinely depends on something in this repo or on this ` +

package/lib/settings.js

@@ -92,7 +92,59 @@ const AVATAR_NAMESPACE = '__avatar';
  *  main.js telemetryEnabled() through getTelemetryOptIn(). */
 const TELEMETRY_NAMESPACE = '__telemetry';
 
-/** Namespaces the provider-config surface must never see or mutate. */
+/** Reserved namespace for the auto-drain opt-in:
+ *  `{ enabled, intervalMs }` — app-level, not a provider.
+ *
+ *  DEFAULT OFF, and unlike every preference above that default is the design
+ *  rather than a convention: this is the one setting in the app that causes a
+ *  full tool loop to run on a real model in the user's checkout with nobody
+ *  watching. desktop/main.js and desktop/preload.js both used to state the
+ *  absolute rule — "there is no interval, no drain at startup, and no
+ *  drain-on-idle anywhere" — and that rule is still what an install that never
+ *  touches this namespace gets. What changed (user request, phase A of the
+ *  automation work) is that the rule became a DEFAULT instead of an absolute:
+ *  an explicit `enabled: true` here is the only thing that arms a timer, the
+ *  toggle that writes it is in the queue card, and `lib/auto.js` refuses to
+ *  run a tick when the queue is empty or another host already holds the drain
+ *  lock. Nothing secret lives here, so no encryption — same shape as
+ *  `__confirmMode`/`__memoryPersist` above. */
+const AUTO_DRAIN_NAMESPACE = '__autoDrain';
+
+/** Reserved namespace for the auto-mint (seal-on-quiet) opt-in:
+ *  `{ enabled, publish }` — app-level, not a provider.
+ *
+ *  DEFAULT OFF for the same reason as auto-drain, and `publish` is a second,
+ *  independent opt-in: sealing writes a local record, whereas publishing sends
+ *  those bytes to the vault over `rclone` and writes an anchor beside them. An
+ *  automatic network copy is never implied by an automatic seal.
+ *
+ *  The AI half of the record resolves through the shared rungs in
+ *  client/attest.js (`$AEGIS_AI_SECRET`/`$AEGIS_AI_MODEL` in the app scope) —
+ *  this namespace deliberately does NOT hold a credential, because a settings
+ *  file that can carry a provider key is a second place to leak one. */
+const AUTO_MINT_NAMESPACE = '__autoMint';
+
+/** How often an armed auto-drain looks at the queue. One minute is the
+ *  compromise the two failure modes set: a shorter interval makes the desktop
+ *  a busy-waiter over a file several hosts write (each tick stats the queue and
+ *  the lock), and a longer one means a task queued in the card sits visibly
+ *  idle. The worker does the rest of the waiting itself. */
+const AUTO_DRAIN_INTERVAL_DEFAULT_MS = 60_000;
+
+/** Floor for `intervalMs`. Below this the timer is a poll loop, not a drain
+ *  cadence: nothing about a queue whose tasks take minutes to run changes
+ *  fifteen times a second, and the tick does file I/O. */
+const AUTO_DRAIN_INTERVAL_MIN_MS = 15_000;
+
+/** Ceiling for `intervalMs` — half an hour. A hand-edited settings file asking
+ *  for a day is a typo, not a preference. */
+const AUTO_DRAIN_INTERVAL_MAX_MS = 30 * 60_000;
+
+/** Reserved namespaces: the provider-config surface must never see or mutate
+ *  any of these. The two automation switches are here for the SAME reason the
+ *  others are — `set()`/`remove()`/`list()` operate on provider rows, and a
+ *  preference parked in that namespace would be listed as a provider and
+ *  deletable with "Remove". */
 const RESERVED_NAMESPACES = Object.freeze([
   AEGIS_KEY_NAMESPACE,
   LEGACY_AEGIS_NAMESPACE,
@@ -101,6 +153,8 @@ const RESERVED_NAMESPACES = Object.freeze([
   MEMORY_PERSIST_NAMESPACE,
   AVATAR_NAMESPACE,
   TELEMETRY_NAMESPACE,
+  AUTO_DRAIN_NAMESPACE,
+  AUTO_MINT_NAMESPACE,
 ]);
 
 /** Motion modes the renderer understands (`system` = follow the OS). */
@@ -451,6 +505,93 @@ function createSettingsStore({ dir, safeStorage } = {}) {
     return avatarState();
   }
 
+  // --- Auto-drain / auto-mint: reserved namespaces, DEFAULT OFF ------------
+  // The two opt-in automations (lib/auto.js). Both live in their own top-level
+  // namespace, both are booted OFF, and both keep the "off" and "never set"
+  // cases distinguishable through a `source` field — the same shape
+  // memoryPersistState()/avatarState() use above, for the same reason: a UI
+  // that cannot tell "you turned it off" from "this build never had it" shows
+  // the wrong sentence after an upgrade.
+  //
+  // `intervalMs` is clamped rather than trusted: it comes back through IPC from
+  // a renderer and off disk from a hand-edited file, and a timer is the one
+  // place where a hostile or fat-fingered number costs real CPU.
+
+  /** A usable tick interval, or the default. Out-of-range reads as unset. */
+  function clampAutoDrainInterval(value) {
+    const n = Number(value);
+    if (!Number.isFinite(n)) return AUTO_DRAIN_INTERVAL_DEFAULT_MS;
+    const ms = Math.round(n);
+    if (ms < AUTO_DRAIN_INTERVAL_MIN_MS || ms > AUTO_DRAIN_INTERVAL_MAX_MS) {
+      return AUTO_DRAIN_INTERVAL_DEFAULT_MS;
+    }
+    return ms;
+  }
+
+  function getAutoDrain() {
+    const cfg = load()[AUTO_DRAIN_NAMESPACE] || {};
+    return {
+      // Unset === false. This is the opposite of confirm mode/memory persist,
+      // and it is the whole point of the feature: nothing drains itself until
+      // someone says so in as many words.
+      enabled: cfg.enabled === true,
+      intervalMs: clampAutoDrainInterval(cfg.intervalMs),
+    };
+  }
+
+  function autoDrainState() {
+    const cfg = load()[AUTO_DRAIN_NAMESPACE] || {};
+    return {
+      ...getAutoDrain(),
+      source: cfg.enabled === undefined ? 'default' : 'config',
+    };
+  }
+
+  function setAutoDrain(patch = {}) {
+    const current = getAutoDrain();
+    const p = patch && typeof patch === 'object' ? patch : {};
+    const data = load();
+    data[AUTO_DRAIN_NAMESPACE] = {
+      enabled: p.enabled === undefined ? current.enabled : Boolean(p.enabled),
+      intervalMs:
+        p.intervalMs === undefined
+          ? current.intervalMs
+          : clampAutoDrainInterval(p.intervalMs),
+    };
+    save(data);
+    return autoDrainState();
+  }
+
+  function getAutoMint() {
+    const cfg = load()[AUTO_MINT_NAMESPACE] || {};
+    return {
+      enabled: cfg.enabled === true,
+      // Independent of `enabled` on purpose: an automatic seal must not drag
+      // an automatic upload along with it.
+      publish: cfg.publish === true,
+    };
+  }
+
+  function autoMintState() {
+    const cfg = load()[AUTO_MINT_NAMESPACE] || {};
+    return {
+      ...getAutoMint(),
+      source: cfg.enabled === undefined ? 'default' : 'config',
+    };
+  }
+
+  function setAutoMint(patch = {}) {
+    const current = getAutoMint();
+    const p = patch && typeof patch === 'object' ? patch : {};
+    const data = load();
+    data[AUTO_MINT_NAMESPACE] = {
+      enabled: p.enabled === undefined ? current.enabled : Boolean(p.enabled),
+      publish: p.publish === undefined ? current.publish : Boolean(p.publish),
+    };
+    save(data);
+    return autoMintState();
+  }
+
   return {
     file,
     get,
@@ -476,6 +617,13 @@ function createSettingsStore({ dir, safeStorage } = {}) {
     getAvatar,
     avatarState,
     setAvatar,
+    getAutoDrain,
+    autoDrainState,
+    setAutoDrain,
+    getAutoMint,
+    autoMintState,
+    setAutoMint,
+    clampAutoDrainInterval,
   };
 }
 
@@ -488,6 +636,11 @@ module.exports = {
   MEMORY_PERSIST_NAMESPACE,
   AVATAR_NAMESPACE,
   TELEMETRY_NAMESPACE,
+  AUTO_DRAIN_NAMESPACE,
+  AUTO_MINT_NAMESPACE,
+  AUTO_DRAIN_INTERVAL_DEFAULT_MS,
+  AUTO_DRAIN_INTERVAL_MIN_MS,
+  AUTO_DRAIN_INTERVAL_MAX_MS,
   AVATAR_MOTION_MODES,
   DEFAULT_QUICK_LAUNCHER_SHORTCUT,
   RESERVED_NAMESPACES,