aegis-desktop 0.8.12 → 0.8.13

package/main.js

@@ -57,6 +57,49 @@ try {
   autoProvision = require('./vendor/auto-provision.js');
 }
 
+// The shared presence beacon (client/presence.js) — the client half of
+// aegis1's `/api/v1/heartbeat` (app.py `heartbeat_v1`), which writes the
+// `client_presence` row the admin panel's presence card reads. Started once the
+// account key is known (see the beacon block in `app.whenReady`), stopped in
+// `will-quit`. Same file the CLI beacons through, so the panel sees one
+// vocabulary (`app: 'desktop'` / `'aegiscode'`) and not two.
+let sharedPresence;
+try {
+  sharedPresence = require('../client/presence.js');
+} catch {
+  sharedPresence = require('./vendor/presence.js');
+}
+
+// The device fingerprint (client/device-fingerprint.js) — the SAME identity the
+// auto-provision path registers a device-key against, now also carried in every
+// presence beat so one laptop is one machine in the admin panel rather than one
+// row per launch. Resolved here rather than left to presence.js's own fallback
+// for the same reason the CLI resolves it at its call site: a host that cannot
+// state its identity should fail visibly, not substitute a different one.
+let sharedFingerprint;
+try {
+  sharedFingerprint = require('../client/device-fingerprint.js');
+} catch {
+  sharedFingerprint = require('./vendor/device-fingerprint.js');
+}
+
+// φ(α): the authorship key and sealed session records (lib/fingerprint.js).
+// The service is built with the app's own data dir, so the key it mints is the
+// key `aegiscode fingerprint` resolves in the terminal — one identity, two
+// hosts, no second store. Everything cryptographic lives in the shared client
+// modules it loads; this require only wires the IPC surface in registerIpc()
+// below (`fingerprintStatus`/`keygen`/`mint`/`verify`/`backup`).
+const { createFingerprintService } = require('./lib/fingerprint.js');
+
+// The two opt-in automations (lib/auto.js): the auto-drain timer and the
+// seal-on-quiet auto-mint. Both are DEFAULT OFF and read their switch from the
+// settings store's reserved `__autoDrain`/`__autoMint` namespaces on every tick,
+// so this require wires the TIMING only — the queue worker still owns the lock
+// and lib/fingerprint.js still owns the seal. See the header of lib/auto.js for
+// why the "nothing drains unless the user asked" rule became a default rather
+// than an absolute.
+const { createAutoDrain, createAutoMint } = require('./lib/auto.js');
+
 // The shared `~/.aegiscode/.env` loader (client/env-file.js, staged to
 // ./vendor/env-file.js when packaged). It is what makes the key instruction the
 // same in every host — "put it in ~/.aegiscode/.env" — because AEGIS_API_KEY is
@@ -148,6 +191,7 @@ const SYNC_PREFIX = 'sync:';
 const TOOLS_PREFIX = 'tools:';
 const QUICK_PREFIX = 'quick:';
 const QUEUE_PREFIX = 'queue:';
+const AUTO_PREFIX = 'auto:';
 
 /**
  * Main -> renderer push channel for chat SSE deltas (D2.1 streaming render).
@@ -638,6 +682,11 @@ function providerRouteConfigured(engine) {
  * import to stay unit-testable.
  */
 function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, avatar) {
+  // One service for the window's lifetime, bound to the app's data dir. It is
+  // created lazily inside its handlers rather than here, so a broken shared
+  // module surfaces as an error in the fingerprint panel instead of preventing
+  // the window from opening at all.
+  const fingerprint = createFingerprintService({ dir });
   // `providerConfigured` is an injected thunk (bootstrap() passes one that reads
   // the settings store) so this module keeps its no-Electron, unit-testable
   // shape; absent in tests and older call sites, where it reads as "no".
@@ -701,6 +750,29 @@ function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConf
         onStream: payload && payload.onStream,
       }),
 
+    // φ(α) — the authorship key and the sealed session records, the same ones
+    // `aegiscode fingerprint` mints in the terminal (lib/fingerprint.js).
+    // Every handler resolves `{ ok, … }` instead of rejecting, so the renderer
+    // can show the real message; an IPC rejection reaches it as an opaque
+    // "Error invoking remote method" with the reason buried in main-process
+    // logs, and the one error a user is likely to hit (a key file other users
+    // can read) is exactly the one that must be readable.
+    fingerprintStatus: () => fingerprint.status(),
+    fingerprintKeygen: (payload) => fingerprint.keygen(payload || {}),
+    fingerprintMint: (payload) => fingerprint.mint(payload || {}),
+    fingerprintVerify: (payload) => fingerprint.verify(payload || {}),
+    fingerprintBackup: (payload) => fingerprint.backup(payload || {}),
+    // The vault (client/record-vault.js). `publish` sends the SEALED BYTES to
+    // gdrive:AEGIS-AGPL/records and writes the `.anchor.json` link beside the
+    // local record; `anchor` checks the copy still matches; `vaultAudit`
+    // inspects the whole folder for key material. The key is never publishable —
+    // record-vault.js refuses it by path, by shape and by byte comparison, in
+    // the shared module rather than in this dispatch, so the CLI inherits the
+    // same refusal.
+    fingerprintPublish: (payload) => fingerprint.publish(payload || {}),
+    fingerprintAnchor: (payload) => fingerprint.anchor(payload || {}),
+    fingerprintVault: () => fingerprint.vaultList(),
+    fingerprintVaultAudit: () => fingerprint.vaultAudit(),
     byokStatus: () => aegis.byokStatus(),
     byokSet: (payload) =>
       aegis.byokSet(
@@ -726,7 +798,7 @@ function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConf
     memorySaveBatch: (payload) =>
       aegis.memorySaveBatch(payload && payload.entries),
     memoryImport: (payload) =>
-      importForeignMemory(aegis, dir, payload),
+      importForeignMemory(aegis, dir, payload, avatar),
     importConversation: (payload) =>
       aegis.importConversation(payload || {}),
 
@@ -1943,12 +2015,85 @@ function createQueueDispatch({
   };
 }
 
+/**
+ * The two opt-in automations, as an IPC surface (`auto:<name>`).
+ *
+ * lib/auto.js owns the TIMING; this owns the ANSWERS the renderer gets, and
+ * deliberately nothing else: it has no timer of its own, it does not read the
+ * settings store (the automations do, on every tick), and it does not touch the
+ * queue file or a record (the queue worker and lib/fingerprint.js do). Split
+ * out as a pure function so a test can drive it with stub automations and a
+ * fake ipcMain, exactly like createQueueDispatch.
+ *
+ * `sealNow` is the panel's explicit "seal this session" shortcut through the
+ * AUTOMATION rather than through the fingerprint service directly, so the
+ * pending-turn counter is reset by the same call that files the record — a
+ * manual seal followed by the timer must not file the same session twice.
+ */
+function createAutoDispatch({ autoDrain, autoMint } = {}) {
+  if (!autoDrain || typeof autoDrain.state !== 'function') {
+    throw new Error('createAutoDispatch: the auto-drain automation is required');
+  }
+  if (!autoMint || typeof autoMint.state !== 'function') {
+    throw new Error('createAutoDispatch: the auto-mint automation is required');
+  }
+  return {
+    /** Both switches and both live states, in one answer. */
+    autoStatus: () => ({ ok: true, drain: autoDrain.state(), mint: autoMint.state() }),
+    autoSetDrain: (payload) => {
+      const p = payload || {};
+      const patch = {};
+      if (p.enabled != null) patch.enabled = Boolean(p.enabled);
+      if (p.intervalMs != null) patch.intervalMs = Number(p.intervalMs);
+      try {
+        return { ok: true, drain: autoDrain.set(patch) };
+      } catch (err) {
+        return { ok: false, error: errorText(err) };
+      }
+    },
+    autoSetMint: (payload) => {
+      const p = payload || {};
+      const patch = {};
+      if (p.enabled != null) patch.enabled = Boolean(p.enabled);
+      if (p.publish != null) patch.publish = Boolean(p.publish);
+      try {
+        return { ok: true, mint: autoMint.set(patch) };
+      } catch (err) {
+        return { ok: false, error: errorText(err) };
+      }
+    },
+    /** Seal the open session now, ahead of the quiet timer. Resets the counter
+     *  either way: a seal that failed is still not something to retry from a
+     *  timer that was about to fire on the same turns, and the panel shows the
+     *  failure. */
+    autoSealNow: async (payload) => {
+      const p = payload || {};
+      if (p.publish != null) autoMint.set({ publish: Boolean(p.publish) });
+      try {
+        const result = await autoMint.flush();
+        autoMint.reset();
+        return { ok: true, ...result };
+      } catch (err) {
+        autoMint.reset();
+        return { ok: false, error: errorText(err) };
+      }
+    },
+  };
+}
+
 /**
  * Register the queue surface as `queue:<name>` on ipcMain — the same
  * per-namespace pattern as MODEL_PREFIX/SYNC_PREFIX/QUICK_PREFIX above, with
- * one addition: drain/proceed need the raw IPC event, because their progress
- * frames are pushed to the window that ASKED for the drain, over
+ * one addition: every handler keeps the raw IPC event, because a drain's
+ * progress frames are pushed to the window that ASKED for it, over
  * QUEUE_PROGRESS_CHANNEL (never CHAT_DELTA_CHANNEL — see that constant).
+ *
+ * Every handler, not just drain/proceed: with the auto-drain switch armed the
+ * drain is started by a TIMER, so there is no "window that asked for it" — the
+ * sink has to be whichever window last touched this surface (the card that
+ * armed the switch, or the one that just read queue.list()). Leaving only
+ * drain/proceed to set `target` would make an automatic drain's progress
+ * invisible in exactly that case, and an invisible drain reads as a hang.
  */
 function registerQueueIpc(ipcMain, { engine, env, queue, autonomous, entitlement, aegis } = {}) {
   // The window a drain's frames go to. One drain runs at a time process-wide
@@ -2004,14 +2149,26 @@ function registerQueueIpc(ipcMain, { engine, env, queue, autonomous, entitlement
     },
   });
   for (const [name, handler] of Object.entries(dispatch)) {
-    if (name === 'drain' || name === 'proceed') {
-      ipcMain.handle(`${QUEUE_PREFIX}${name}`, (event, payload) => {
-        target = (event && event.sender) || null;
-        return handler(payload);
-      });
-      continue;
-    }
-    ipcMain.handle(`${QUEUE_PREFIX}${name}`, (_event, payload) => handler(payload));
+    ipcMain.handle(`${QUEUE_PREFIX}${name}`, (event, payload) => {
+      target = (event && event.sender) || null;
+      return handler(payload);
+    });
+  }
+  return dispatch;
+}
+
+/**
+ * Register the automation surface as `auto:<name>` on ipcMain.
+ *
+ * Unlike the queue, no handler here needs the IPC event: these calls are
+ * answers about a switch, not a stream, and the one long-running one
+ * (`sealNow`) resolves its own result. Nothing is pushed to the renderer from
+ * this file — the card and the panel re-read status after every action, which
+ * is also what makes a stale paint impossible.
+ */
+function registerAutoIpc(ipcMain, dispatch) {
+  for (const [name, handler] of Object.entries(dispatch)) {
+    ipcMain.handle(`${AUTO_PREFIX}${name}`, (_event, payload) => handler(payload));
   }
   return dispatch;
 }
@@ -2707,13 +2864,34 @@ function bootstrap() {
     note.show();
   }
 
+  // Both automations (lib/auto.js) are built further down, AFTER the queue and
+  // the fingerprint have been wired — they call into both. This `let` is how
+  // the reply hook below (which has to be handed to registerIpc up here) can
+  // reach one that does not exist yet: it fires when a turn FINISHES, which is
+  // always long after bootstrap() has returned, and it is null-guarded so a
+  // reply arriving in that theoretical gap is a no-op rather than a TypeError.
+  let autoMint = null;
+
+  /**
+   * The reply hook: the native notification (unchanged) plus the auto-mint's
+   * quiet clock. The clock is restarted by every finished turn, never read as
+   * "seal now" — lib/auto.js's flush() is what decides, and only once the
+   * session has been quiet for its full interval.
+   */
+  const handleReplyFinished = (event, result) => {
+    notifyReplyIfUnfocused(event);
+    if (autoMint && typeof autoMint.note === 'function') {
+      autoMint.note({ sessionId: (result && result.sessionId) || null });
+    }
+  };
+
   registerIpc(
     ipcMain,
     aegis,
     dataDir,
     persistApiKey,
     (url) => shell.openExternal(url),
-    notifyReplyIfUnfocused,
+    handleReplyFinished,
     () => providerRouteConfigured(engine)
   );
   registerModelIpc(
@@ -2721,7 +2899,7 @@ function bootstrap() {
     engine,
     sessionsDir,
     aegis,
-    notifyReplyIfUnfocused,
+    handleReplyFinished,
     undefined,
     settingsDir
   );
@@ -2775,10 +2953,67 @@ function bootstrap() {
   //
   // It gets its OWN engine, built with the approval gate off: a queued task has
   // nobody to answer a card, so the interactive engine is the wrong one to hand
-  // a worker (see createQueueEngine). Registration alone drains nothing — the
-  // queue runs only when the renderer's card asks it to, which is the whole
-  // gate: no timer, no boot drain, no idle drain.
-  registerQueueIpc(ipcMain, { engine: createQueueEngine(aegis, settings), aegis });
+  // a worker (see createQueueEngine).
+  //
+  // Registration alone drains nothing. There are now exactly two ways a drain
+  // starts, and both are visible in the UI: a click on the card's
+  // Run one / Drain all, or the card's "drain automatically" switch — a
+  // PERSISTED, DEFAULT-OFF setting (settings.js `__autoDrain`) read by
+  // lib/auto.js on every tick. There is still no boot drain and no
+  // drain-on-idle; the interval only exists while the switch is on.
+  const queueDispatch = registerQueueIpc(ipcMain, {
+    engine: createQueueEngine(aegis, settings),
+    aegis,
+  });
+
+  // ── the two opt-in automations (lib/auto.js) ─────────────────────────────
+  //
+  // Created here because this is the first point where every collaborator
+  // exists: settings (the switches), the queue dispatch above (the drain), and
+  // the fingerprint service (the seal). What they do NOT get is a vote — both
+  // modules re-read the persisted switch on every tick, so flipping the toggle
+  // in the card or the panel stops the very next one.
+  const autoDrain = createAutoDrain({
+    // The SAME entry point the card's "Drain all" button calls
+    // (createQueueDispatch's `proceed` -> drainAll). Not a second loop: the
+    // worker's own per-task lock, Stop, and the progress frames are all the
+    // ones the button already uses.
+    proceed: () => queueDispatch.proceed(),
+    settings,
+    queue: queueModule,
+    env: process.env,
+    log: (entry) => {
+      // Visible in the main-process log, and nowhere else. An automation that
+      // fails silently is indistinguishable from one that is switched off.
+      if (entry && entry.type !== 'skip') console.log('[auto-drain]', entry.type, entry.reason || entry.error || '');
+    },
+  });
+
+  // The seal. `mint` is lib/fingerprint.js's own — the same call the panel's
+  // "Seal this session" makes, reading the same session log through the same
+  // shared adapter. The service is built LAZILY for the reason createIpcDispatch
+  // states: a broken shared module must surface as an error in the panel, not as
+  // a window that never opens. `aiSecret` is never passed, so the AI axis of the
+  // record is attested from `$AEGIS_AI_SECRET` in the app's scope by
+  // client/attest.js's own rungs — no key enters main.js, the settings store, or
+  // the DOM for this path.
+  let autoFingerprint = null;
+  autoMint = createAutoMint({
+    mint: (payload) => {
+      if (!autoFingerprint) autoFingerprint = createFingerprintService({ dir: dataDir });
+      return autoFingerprint.mint(payload || {});
+    },
+    settings,
+  });
+
+  registerAutoIpc(ipcMain, createAutoDispatch({ autoDrain, autoMint }));
+
+  // Arm whatever the user left switched on — and nothing else. Both start()
+  // calls are reads of a persisted, default-off setting: on a default install
+  // the drain timer is not created at all and the mint has no pending turns, so
+  // the queue still waits for a click and no session is ever sealed by itself.
+  autoDrain.start();
+  autoMint.start();
 
   // ---------------------------------------------------------------------
   // Global quick-launcher (D? quick launcher): a frameless, always-on-top,
@@ -2927,7 +3162,17 @@ function bootstrap() {
   // A held global shortcut outlives this app if not released — every quit
   // path (explicit quit, window-all-closed on non-mac, OS shutdown) must
   // free it.
+  // The presence beacon (aegis1 /api/v1/heartbeat), held here so the quit path
+  // can stop it. `null` until `app.whenReady` starts it: the beacon needs the
+  // resolved account key, and a `let` (not a `const`) because a quit can
+  // precede a successful start.
+  let presenceBeacon = null;
+
   app.on('will-quit', () => {
+    // Beacon timers are unref'd, so this is not what keeps the process alive —
+    // it is what stops a beat from being sent while Electron tears the process
+    // down under it.
+    if (presenceBeacon && typeof presenceBeacon.stop === 'function') presenceBeacon.stop();
     globalShortcut.unregisterAll();
     // The update manager's retry/interval timers are unref'd so they never
     // hold the process open, but an explicit quit should still cancel them
@@ -3089,6 +3334,57 @@ function bootstrap() {
         if (result.key) settings.setAegisKey(result.key);
       }
     }
+    // ── presence beacon ───────────────────────────────────────────────────
+    //
+    // aegis1's `/api/v1/heartbeat` (`heartbeat_v1`), the client half of the
+    // admin panel's presence card: which app, which build, which OS, how many
+    // machines, and whether a drain is running. Started HERE because it needs
+    // the account key and this is the first point where the key is final —
+    // resolved from env/the shared store, or auto-provisioned just above — so
+    // the very first beat carries the account the app is actually signed in
+    // with rather than a stale one. Stopped in `will-quit`.
+    //
+    // `install` is the machine fingerprint (client/device-fingerprint.js), the
+    // SAME identity the device-registration path uses: the panel's "how many
+    // machines" is only true if every beat from one laptop carries one id.
+    //
+    // A keyless app gets an inert store from presence.js — no timer, no
+    // request — so an offline or signed-out launch is silent rather than a 401
+    // loop. A beacon failure must never block the window from opening.
+    try {
+      if (presenceBeacon && typeof presenceBeacon.stop === 'function') presenceBeacon.stop();
+      presenceBeacon = sharedPresence.createPresence({
+        apiKey: aegis.apiKey,
+        // 'desktop' is one of the names aegis1's PRESENCE_APPS keeps; anything
+        // else it does not recognise is stored as 'other' with a 200 and no
+        // error anywhere. See client/presence-constants.js.
+        app: 'desktop',
+        version: app.getVersion(),
+        platform: process.platform,
+        install: sharedFingerprint.machineFingerprint(),
+        // Read at SEND time: the panel wants the queue as it is now, not the
+        // depth it happened to have at launch. Same queue file the CLI drains
+        // (`desktop/lib/local/queue.js` — see registerQueueIpc below).
+        queueDepth: () => {
+          try {
+            const items = queueModule.readQueue(queueModule.queuePath());
+            return items.filter((t) => t && t.status === 'pending').length;
+          } catch {
+            return 0;
+          }
+        },
+        // The desktop card's drain is renderer-driven today; there is no
+        // always-on worker in main to report, so this stays false rather than
+        // claiming a drain that is not running.
+        autonomous: false,
+        log: (level, message) => {
+          if (level !== 'debug') console.warn(message);
+        },
+      });
+      presenceBeacon.start();
+    } catch (err) {
+      console.warn('presence: beacon not started', err && err.message);
+    }
     // Apply whatever was last saved (or the default): ship the shortcut only
     // when app.isPackaged || the settings flag is on — see
     // shouldEnableGlobalShortcut — so a plain `electron .` dev run never
@@ -3196,4 +3492,7 @@ module.exports = {
   queueEngineWithDeniedApprovals,
   createQueueDispatch,
   registerQueueIpc,
+  AUTO_PREFIX,
+  createAutoDispatch,
+  registerAutoIpc,
 };

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
     "email": "nborneklint@gmail.com"
   },
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "main": "main.js",
   "homepage": "https://aegiscloud.org",
   "bin": {

package/preload.js

@@ -18,6 +18,7 @@ const MODEL_PREFIX = 'model:';
 const SYNC_PREFIX = 'sync:';
 const QUICK_PREFIX = 'quick:';
 const QUEUE_PREFIX = 'queue:';
+const AUTO_PREFIX = 'auto:';
 const QUEUE_PROGRESS_CHANNEL = `${QUEUE_PREFIX}progress`;
 const CHAT_DELTA_CHANNEL = `${IPC_PREFIX}chatDelta`;
 const UPDATE_STATUS_CHANNEL = `${IPC_PREFIX}updateStatus`;
@@ -63,6 +64,13 @@ function invokeQueue(name, payload) {
   );
 }
 
+function invokeAuto(name, payload) {
+  return ipcRenderer.invoke(
+    AUTO_PREFIX + name,
+    payload === undefined ? undefined : payload
+  );
+}
+
 /**
  * Build the chatDelta listener for one streaming request.
  *
@@ -162,6 +170,26 @@ const api = {
   // isSafeExternalUrl for the http/https-only allowlist.
   openExternal: (url) => invoke('openExternal', { url }),
 
+  // φ(α) — the authorship key and sealed session records (main.js
+  // createIpcDispatch -> lib/fingerprint.js). Every call resolves
+  // `{ ok, … }`/`{ ok: false, error }` rather than throwing, so the UI shows the
+  // actual reason (e.g. "this key file is readable by other users") instead of
+  // Electron's opaque "Error invoking remote method". The key itself is never
+  // returned in any of these payloads — only its derived 12-hex fingerprint.
+  fingerprintStatus: () => invoke('fingerprintStatus'),
+  fingerprintKeygen: (payload) => invoke('fingerprintKeygen', payload || {}),
+  fingerprintMint: (payload) => invoke('fingerprintMint', payload || {}),
+  fingerprintVerify: (payload) => invoke('fingerprintVerify', payload || {}),
+  fingerprintBackup: (payload) => invoke('fingerprintBackup', payload || {}),
+  // The vault: publish a sealed record (default gdrive:AEGIS-AGPL/records),
+  // check the published copy against the link, list it, audit it for key
+  // material. `publish` is also a flag on fingerprintMint (`{ publish: true }`),
+  // which seals and travels in one call. No handler takes or returns the key.
+  fingerprintPublish: (payload) => invoke('fingerprintPublish', payload || {}),
+  fingerprintAnchor: (payload) => invoke('fingerprintAnchor', payload || {}),
+  fingerprintVault: () => invoke('fingerprintVault'),
+  fingerprintVaultAudit: () => invoke('fingerprintVaultAudit'),
+
   // Tool-call approval toggle (Settings → "Confirm before running tools"):
   // main.js createConfirmModeDispatch persists it in the settings store's
   // reserved `__confirmMode` namespace, and the engine's gate
@@ -384,10 +412,16 @@ const quickLauncher = {
 //      task's own tool loop runs in — and main.js refuses it unless it is an
 //      absolute path that already exists; this file never joins, reads or writes
 //      a path itself.
-//   2. No drain that starts by itself. `drain`/`proceed` are invoked only from
-//      the queue card's two buttons. Draining spends money on a real model in a
-//      real checkout, so the trigger is a click and nothing else — main.js has
-//      no timer to call it, and this file has no default.
+//   2. No drain that starts by itself UNLESS the persisted switch is armed.
+//      `drain`/`proceed` above are invoked only from the queue card's two
+//      buttons; the timer that can call one without a click lives in
+//      desktop/lib/auto.js and is armed by exactly one thing — the
+//      `aegis.auto.setDrain({ enabled: true })` call the card's toggle makes
+//      below, which writes settings.js's reserved `__autoDrain` namespace. It
+//      is OFF in a default install, it is re-read on every tick, and switching
+//      it off stops the very next one. Draining spends money on a real model in
+//      a real checkout, so that switch is persisted and visible rather than
+//      implied — but it is also not hidden from this file's users any more.
 const queue = {
   // Queue one task. `payload` is { task, cwd, model, effort, workers, maxRounds,
   // commit }; main.js range-checks every field and answers
@@ -427,6 +461,51 @@ const queue = {
   },
 };
 
+/**
+ * The two opt-in automations (desktop/lib/auto.js via main.js
+ * registerAutoIpc): the auto-drain timer over the queue, and the seal-on-quiet
+ * timer over the current session.
+ *
+ * Same discipline as the queue surface above: every field is named and coerced
+ * HERE, so the renderer cannot smuggle an extra key into a settings namespace
+ * that main.js reserved (`__autoDrain` / `__autoMint`), and no path, secret or
+ * free-form string crosses. In particular there is NO field for an AI secret:
+ * the AI half of a sealed record is attested from `$AEGIS_AI_SECRET` in the
+ * app's own scope (client/attest.js), so no key can be handed in from the DOM
+ * even by a mistake in main.js.
+ *
+ * Both switches are OFF until one of these calls says otherwise, and the only
+ * caller is a toggle the user clicked — see the queue section's note 2 above.
+ */
+const auto = {
+  // { ok, drain: { enabled, intervalMs, armed, busy, ticks, drains, last, lastSkip }, mint: { … } }
+  status: () => invokeAuto('autoStatus'),
+  // Persist the drain switch and re-arm to match. `intervalMs` is clamped in
+  // settings.js (15s–30min); the renderer sends what the user picked and does
+  // not decide the floor.
+  setDrain: (patch) => {
+    const p = patch || {};
+    const out = { enabled: Boolean(p.enabled) };
+    if (p.intervalMs != null && Number.isFinite(Number(p.intervalMs))) {
+      out.intervalMs = Number(p.intervalMs);
+    }
+    return invokeAuto('autoSetDrain', out);
+  },
+  // Persist the auto-seal switch. `publish` is independent of `enabled`: a
+  // failed publish never unseals anything, so the two are separate answers.
+  setMint: (patch) => {
+    const p = patch || {};
+    return invokeAuto('autoSetMint', {
+      enabled: Boolean(p.enabled),
+      publish: Boolean(p.publish),
+    });
+  },
+  // Seal the open session now, through the same automation the timer uses — so
+  // the pending-turn counter is reset by the same call and a session is never
+  // sealed twice.
+  sealNow: (publish) => invokeAuto('autoSealNow', { publish: Boolean(publish) }),
+};
+
 /**
  * Task ids are the queue file's positive integers (queue.js nextId). A retry or
  * a remove with anything else is answered locally instead of being sent as a
@@ -470,3 +549,4 @@ contextBridge.exposeInMainWorld('models', Object.freeze(models));
 contextBridge.exposeInMainWorld('sync', Object.freeze(sync));
 contextBridge.exposeInMainWorld('quickLauncher', Object.freeze(quickLauncher));
 contextBridge.exposeInMainWorld('queue', Object.freeze(queue));
+contextBridge.exposeInMainWorld('auto', Object.freeze(auto));