aegis-desktop 0.8.12 → 0.8.14

package/lib/auto.js

@@ -0,0 +1,423 @@
+'use strict';
+
+/**
+ * auto.js — the two opt-in automations, and the rules that make them safe to
+ * leave switched on.
+ *
+ * BACKGROUND. desktop/main.js and desktop/preload.js both stated an absolute
+ * rule when the queue shipped: "NOTHING DRAINS UNLESS THE USER ASKED. There is
+ * no interval, no drain at startup, and no drain-on-idle anywhere in this
+ * file." That rule was right when the only trigger was a click, and it is still
+ * the behaviour of a default install — but it made "queue a task and walk away"
+ * impossible, which is the one thing an unattended queue is FOR. The user asked
+ * for both automations explicitly (option A of that discussion), so the rule
+ * becomes a DEFAULT rather than an absolute, in the only way that keeps the
+ * original sentence true: an explicit, persisted, default-off switch, and a
+ * tick that does nothing unless it is armed.
+ *
+ * There are exactly two automations, because there are exactly two acts in the
+ * app that are irreversible-ish and cost something:
+ *
+ *   createAutoDrain — runs pending queue tasks on a timer. Spend: a full tool
+ *     loop on a real model, in a real checkout. Guarded by the queue's own file
+ *     lock (a second drain is refused by queue.js, not here), by a re-entrancy
+ *     flag, by an empty-queue check, and by a lock-holder check that skips the
+ *     tick instead of racing another host for it.
+ *   createAutoMint — seals the current session as a φ(α) record once the
+ *     session goes QUIET. Not once per turn: a record is about a session, so a
+ *     debounce that resets on every finished turn means one record per session
+ *     that carries all of its turns — human axis and AI axis alike. Publishing
+ *     is a separate flag and is never implied by sealing.
+ *
+ * WHAT THIS MODULE DELIBERATELY DOES NOT DO:
+ *   - It does not decide whether it MAY run. `settings.getAutoDrain()` /
+ *     `getAutoMint()` are read on every tick, so turning the toggle off stops
+ *     the very next tick, and the namespaces are reserved
+ *     (settings.js RESERVED_NAMESPACES) so no provider row can forge one.
+ *   - It does not take the drain lock, spawn a worker, or write a record. The
+ *     queue worker owns the lock; lib/fingerprint.js owns the seal. This file
+ *     owns the TIMING and the skips, and calls in.
+ *   - It does not swallow a failure. Every skip and every failure is recorded
+ *     in `state()` with a reason, because an automation that fails silently is
+ *     indistinguishable from one that is switched off.
+ *
+ * Timers are injected (`setIntervalFn`/`setTimeoutFn`) so the tests drive the
+ * cadence without waiting for it, and so this module never keeps a Node process
+ * alive by itself.
+ */
+
+/** How long a session must be quiet before an armed auto-mint seals it. Long
+ *  enough that a normal pause for thought does not file a half-finished
+ *  session, short enough that walking away leaves a record behind. */
+const AUTO_MINT_QUIET_DEFAULT_MS = 90_000;
+
+/** Floor: sealing on every turn boundary would file one record per exchange and
+ *  re-read the whole history each time. */
+const AUTO_MINT_QUIET_MIN_MS = 10_000;
+
+/** Ceiling: an hour of quiet. Beyond that the app is closed anyway. */
+const AUTO_MINT_QUIET_MAX_MS = 60 * 60_000;
+
+function errorText(err) {
+  return (err && err.message) || String(err);
+}
+
+/**
+ * The auto-drain timer.
+ *
+ * `proceed` is main.js's drain-all entry point (the same function the card's
+ * "Drain all" button calls) — this module never re-implements the loop, the
+ * lock, the settle-back-into-the-file write, or the Stop path.
+ */
+function createAutoDrain({
+  proceed,
+  settings,
+  queue,
+  env = process.env,
+  log = () => {},
+  setIntervalFn = setInterval,
+  clearIntervalFn = clearInterval,
+} = {}) {
+  if (typeof proceed !== 'function') {
+    throw new Error('createAutoDrain: a proceed() entry point is required');
+  }
+  if (!settings || typeof settings.getAutoDrain !== 'function') {
+    throw new Error('createAutoDrain: the settings store is required');
+  }
+
+  /** The armed timer, or null. `null` is the OFF state and the only one a
+   *  default install is ever in. */
+  let timer = null;
+  /** A tick is mid-flight. A drain takes minutes; without this the next tick
+   *  would stack a second drainAll() on top of the first (queue.js would refuse
+   *  it at the lock, but only after a round trip and a second set of frames). */
+  let busy = false;
+  let ticks = 0;
+  let drains = 0;
+  let last = null;
+  let lastSkip = null;
+
+  const record = (entry) => {
+    last = entry;
+    log(entry);
+    return entry;
+  };
+
+  const skip = (reason, extra) => {
+    lastSkip = { at: Date.now(), reason, ...(extra || {}) };
+    return lastSkip;
+  };
+
+  function state() {
+    const cfg = settings.autoDrainState();
+    return {
+      ...cfg,
+      armed: Boolean(timer),
+      busy,
+      ticks,
+      drains,
+      last,
+      lastSkip,
+    };
+  }
+
+  function arm() {
+    const cfg = settings.getAutoDrain();
+    // Off is checked BEFORE the "already armed at this cadence" shortcut, or
+    // switching off would leave the old timer running (harmless — its tick
+    // skips as 'disabled' — but `armed` would read true in the card, which is
+    // the kind of lie that makes a user distrust the switch).
+    if (!cfg.enabled) {
+      stop();
+      return state();
+    }
+    if (timer && cfg.intervalMs === timer.__intervalMs) return state();
+    stop();
+    timer = setIntervalFn(() => {
+      // Fire and forget: a tick's own failures are recorded in `last`, and an
+      // unhandled rejection here would take the main process's error handler
+      // with it. tick() never throws.
+      tick();
+    }, cfg.intervalMs);
+    timer.__intervalMs = cfg.intervalMs;
+    // A drain must never be the reason a process stays alive; in Electron the
+    // window is, and in a test the harness is.
+    if (timer && typeof timer.unref === 'function') timer.unref();
+    log({ type: 'auto-drain-armed', intervalMs: cfg.intervalMs });
+    return state();
+  }
+
+  function stop() {
+    if (!timer) return state();
+    clearIntervalFn(timer);
+    timer = null;
+    log({ type: 'auto-drain-disarmed' });
+    return state();
+  }
+
+  /**
+   * One decision, and the only place the guards live.
+   *
+   * Order matters. `disabled` is first so an armed-then-switched-off timer
+   * cannot act on a stale config; `busy` before any file read; `empty` before
+   * the lock so an idle install costs one JSON parse and no lock I/O; and the
+   * lock-holder check LAST, because taking a lock we would only hand straight
+   * back is the one skip that has a real cost (it makes another host's drain
+   * fail its own acquire).
+   */
+  async function tick() {
+    ticks += 1;
+    const cfg = settings.getAutoDrain();
+    if (!cfg.enabled) return record({ type: 'skip', reason: 'disabled' });
+    if (busy) return record({ type: 'skip', reason: 'busy' });
+    if (!queue || typeof queue.loadQueue !== 'function') {
+      return record({ type: 'skip', reason: 'no queue access' });
+    }
+
+    let items;
+    try {
+      items = queue.loadQueue(env);
+    } catch (err) {
+      return record({ type: 'error', phase: 'read', error: errorText(err) });
+    }
+    if (!queue.pendingCount(items)) return record({ type: 'skip', reason: 'empty' });
+
+    // Another host holds the drain (the CLI's `aegiscode autonomous`, a
+    // systemd unit, another window). queue.js's lock would refuse us anyway —
+    // this check is so the refusal is a quiet skip rather than a drain attempt
+    // whose every frame reports "locked".
+    try {
+      const holder = queue.lockHolder(env);
+      if (holder && holder.pid && holder.pid !== process.pid) {
+        const alive = typeof queue.isAlive === 'function' ? queue.isAlive(holder.pid) : true;
+        if (alive) return record({ type: 'skip', reason: 'locked', holder });
+      }
+    } catch {
+      // An unreadable lock file is not a reason to skip: queue.js's own
+      // acquireLock decides, and a stale/unparseable marker is exactly the case
+      // it reclaims immediately.
+    }
+
+    busy = true;
+    try {
+      const result = await proceed();
+      if (result && result.locked) {
+        return record({
+          type: 'skip',
+          reason: 'locked',
+          holder: result.holder || null,
+        });
+      }
+      drains += 1;
+      return record({
+        type: 'drain',
+        ok: !(result && result.ok === false),
+        ran: (result && result.ran) || [],
+        reason: (result && result.reason) || null,
+      });
+    } catch (err) {
+      return record({ type: 'error', phase: 'drain', error: errorText(err) });
+    } finally {
+      busy = false;
+    }
+  }
+
+  return {
+    state,
+    /** Read the persisted switch and arm/disarm to match. Called at boot and
+     *  after every toggle — never called by a timer. */
+    start: arm,
+    arm,
+    stop,
+    tick,
+    /** The card's toggle. Persists through the settings store, then re-arms,
+     *  so the answer the renderer paints is the answer the timer is running.
+     *  Without the re-arm the switch would persist and do nothing until the next
+     *  restart — the exact silent failure this test file exists to catch. */
+    set(patch) {
+      settings.setAutoDrain(patch || {});
+      arm();
+      return state();
+    },
+    /** Test seam: whatever is armed, for a harness that injects its own timer
+     *  and needs to fire it. */
+    _timer: () => timer,
+  };
+}
+
+/**
+ * The auto-mint (seal-on-quiet) timer.
+ *
+ * `mint` is lib/fingerprint.js's own `mint()` — the same call the panel's "Seal
+ * this session" button makes, reading the same session log through the same
+ * shared adapter, so an automatic record and a hand-sealed one of the same
+ * session are the same record.
+ */
+function createAutoMint({
+  mint,
+  settings,
+  log = () => {},
+  quietMs = AUTO_MINT_QUIET_DEFAULT_MS,
+  setTimeoutFn = setTimeout,
+  clearTimeoutFn = clearTimeout,
+} = {}) {
+  if (typeof mint !== 'function') throw new Error('createAutoMint: mint() is required');
+  if (!settings || typeof settings.getAutoMint !== 'function') {
+    throw new Error('createAutoMint: the settings store is required');
+  }
+
+  const quiet = (() => {
+    const n = Number(quietMs);
+    if (!Number.isFinite(n)) return AUTO_MINT_QUIET_DEFAULT_MS;
+    const ms = Math.round(n);
+    if (ms < AUTO_MINT_QUIET_MIN_MS || ms > AUTO_MINT_QUIET_MAX_MS) {
+      return AUTO_MINT_QUIET_DEFAULT_MS;
+    }
+    return ms;
+  })();
+
+  /** The pending debounce, or null. */
+  let timer = null;
+  /** Turns that arrived since the last seal. The ONLY thing that makes a seal
+   *  due: without it, a quiet period with no new work would re-seal the same
+   *  session over and over, one identical record per quiet minute. */
+  let pendingTurns = 0;
+  let busy = false;
+  let seals = 0;
+  let failures = 0;
+  let last = null;
+  let lastError = null;
+  let lastSeal = null;
+
+  function state() {
+    const cfg = settings.autoMintState();
+    return {
+      ...cfg,
+      armed: Boolean(timer),
+      quietMs: quiet,
+      pendingTurns,
+      busy,
+      seals,
+      failures,
+      last,
+      lastError,
+      lastSeal,
+    };
+  }
+
+  function disarm() {
+    if (!timer) return;
+    clearTimeoutFn(timer);
+    timer = null;
+  }
+
+  /** A turn finished. Restart the quiet clock; do not seal anything now. */
+  function note(info) {
+    const cfg = settings.getAutoMint();
+    if (!cfg.enabled) {
+      // Counted even while off, so switching the toggle on mid-session seals a
+      // session that already has work in it rather than waiting for the next
+      // turn — which is what a user who just flipped the switch means.
+      pendingTurns += 1;
+      return state();
+    }
+    pendingTurns += 1;
+    last = { type: 'turn', at: Date.now(), sessionId: (info && info.sessionId) || null };
+    disarm();
+    timer = setTimeoutFn(() => {
+      timer = null;
+      flush();
+    }, quiet);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+    return state();
+  }
+
+  /**
+   * Seal now, if there is anything to seal. This is what the debounce timer
+   * calls; it is also the seam a test drives directly instead of waiting.
+   */
+  async function flush() {
+    const cfg = settings.getAutoMint();
+    if (!cfg.enabled) return { type: 'skip', reason: 'disabled' };
+    if (busy) return { type: 'skip', reason: 'busy' };
+    if (!pendingTurns) return { type: 'skip', reason: 'nothing new' };
+    busy = true;
+    // Claimed BEFORE the call: a seal that throws must not leave the counter
+    // armed, or every later quiet period retries a failure that will not heal
+    // (no key, unreadable history) and files a new error each time.
+    const claimed = pendingTurns;
+    pendingTurns = 0;
+    try {
+      // `aiSecret` is left undefined on purpose: that makes lib/fingerprint.js
+      // walk the shared rungs in client/attest.js, so the AI axis is attested
+      // from `$AEGIS_AI_SECRET` in the app's scope and `aiModel` from the same
+      // place the CLI resolves it. This host never invents either, and never
+      // borrows the authorship key for the AI axis (they answer different
+      // questions: who sealed it, and which mind answered).
+      const result = await mint({ publish: cfg.publish === true });
+      if (!result || result.ok === false) {
+        failures += 1;
+        lastError = (result && result.error) || 'the seal did not complete';
+        return (last = { type: 'error', phase: 'seal', error: lastError });
+      }
+      seals += 1;
+      lastError = null;
+      lastSeal = {
+        at: Date.now(),
+        id: (result.record && result.record.id) || null,
+        out: result.out || null,
+        turns: claimed,
+        // Reported separately by lib/fingerprint.js: the seal is the evidence,
+        // the cloud copy is the convenience, and a failed publish never
+        // unseals anything.
+        vaultError: result.vaultError || null,
+      };
+      return (last = { type: 'seal', ...lastSeal });
+    } catch (err) {
+      failures += 1;
+      lastError = errorText(err);
+      return (last = { type: 'error', phase: 'seal', error: lastError });
+    } finally {
+      busy = false;
+    }
+  }
+
+  return {
+    state,
+    note,
+    flush,
+    /** Disarm the debounce and forget the pending count — the renderer's
+     *  explicit "seal now" path calls this after sealing, so the record it just
+     *  filed is not filed again by the timer. */
+    reset() {
+      disarm();
+      pendingTurns = 0;
+      return state();
+    },
+    start() {
+      // Arming at boot means "the switch is on", not "seal immediately": with
+      // pendingTurns at 0 there is nothing to seal until a turn arrives.
+      if (!settings.getAutoMint().enabled) disarm();
+      return state();
+    },
+    stop() {
+      disarm();
+      return state();
+    },
+    set(patch) {
+      settings.setAutoMint(patch || {});
+      if (!settings.getAutoMint().enabled) disarm();
+      return state();
+    },
+    /** Test seam: is the debounce armed? */
+    _timer: () => timer,
+  };
+}
+
+module.exports = {
+  createAutoDrain,
+  createAutoMint,
+  AUTO_MINT_QUIET_DEFAULT_MS,
+  AUTO_MINT_QUIET_MIN_MS,
+  AUTO_MINT_QUIET_MAX_MS,
+};

package/lib/avatar/packs/core-wardrobe.pack.json

@@ -6,7 +6,7 @@
   "tier": "free",
   "unlocks": ["outfit.hoodie", "outfit.tshirt"],
   "author": "AEGIS Code",
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "summary": "The two starter outfits. Yours from level 1, and never sold back to you.",
   "items": [
     { "id": "hoodie", "label": "Hoodie", "parts": ["hoodie"] },

package/lib/avatar/packs/local-voice-core.pack.json

@@ -6,7 +6,7 @@
   "tier": "free",
   "unlocks": ["voice.core"],
   "author": "AEGIS Code",
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "summary": "Three bundled synthetic voices. Local engine only, off until the user turns it on, and nothing is ever sent anywhere to say a sentence.",
   "items": [
     { "id": "aegis-neutral", "label": "Neutral", "engine": "local", "consent": "synthetic" },

package/lib/avatar/packs/seasonal-winter.pack.json

@@ -6,7 +6,7 @@
   "tier": "paid",
   "unlocks": ["outfit.seasonal"],
   "author": "AEGIS Code",
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "summary": "A cosmetic pack. Paid packs sell looks only: this changes how the companion is drawn and nothing about what it can do.",
   "items": [
     { "id": "seasonal-winter", "label": "Winter coat", "parts": ["seasonal-winter", "scarf"] }

package/lib/avatar/profile.js

@@ -140,7 +140,16 @@ function keyOf(value) {
 }
 
 function asArray(value) {
-  return Array.isArray(value) ? value : [];
+  if (Array.isArray(value)) return value;
+  // A Set is what the folder builders accumulate source ids into (`ids: new
+  // Set()` in foldVocabulary/foldLanguage/foldCodebase). Without this branch
+  // `asArray(set)` returned [], so `citable(rec.ids)` was always empty, so
+  // `makeFacet` returned null for want of a source: vocabulary, language and
+  // codebase facets could never be produced at all — three of the seven classes
+  // were dead code, and `coldStart` stayed true for a holder whose only evidence
+  // was theirs.
+  if (value instanceof Set) return [...value];
+  return [];
 }
 
 function textOf(entry) {