aegis-desktop 0.8.7 → 0.8.8

package/main.js

@@ -47,6 +47,16 @@ try {
   credentials = require('./vendor/credentials.js');
 }
 
+// Same auto-provision helper the MCP plugin and the CLI use (see
+// client/auto-provision.js) — one implementation so all three hosts ask
+// aegis1 for the same account on the same machine, with the same timeout.
+let autoProvision;
+try {
+  autoProvision = require('../client/auto-provision.js');
+} catch {
+  autoProvision = require('./vendor/auto-provision.js');
+}
+
 // The shared `~/.aegiscode/.env` loader (client/env-file.js, staged to
 // ./vendor/env-file.js when packaged). It is what makes the key instruction the
 // same in every host — "put it in ~/.aegiscode/.env" — because AEGIS_API_KEY is
@@ -2972,7 +2982,7 @@ function bootstrap() {
     return win;
   }
 
-  app.whenReady().then(() => {
+  app.whenReady().then(async () => {
     // Hydrate the client from the persisted key BEFORE the renderer issues any
     // status/model call, so class/model dropdowns populate immediately when a
     // key was saved in-app (safeStorage is usable only after app ready).
@@ -2987,6 +2997,20 @@ function bootstrap() {
         // The shared store is the newer write: bring this host's encrypted copy
         // up to date so a CLI rotation does not have to be redone in Settings.
         if (chosen.source === 'shared') settings.setAegisKey(chosen.key);
+      } else {
+        // Nothing configured anywhere (env, this app's encrypted copy, or the
+        // shared store): a fresh install. Auto-provision a free device key
+        // from aegis1 — same shared helper mcp/server.js and the CLI use, so
+        // the desktop app works with no manual sign-in step. It starts at
+        // zero token-bank balance server-side (register-device), and pooled
+        // aegiscloud models additionally require an upgraded plan (aegis1's
+        // is_pro() gate) — this only unblocks BYOK and account status/
+        // settings until the account is funded and/or upgraded. Failure
+        // (offline, aegis1 unreachable) falls through exactly as before: the
+        // renderer's normal "not signed in" state handles it, and the next
+        // launch tries again.
+        const result = await autoProvision.autoProvisionApiKey(aegis, credentials);
+        if (result.key) settings.setAegisKey(result.key);
       }
     }
     // Apply whatever was last saved (or the default): ship the shortcut only

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "Thin Electron host for AEGIS \u2014 a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/vendor/aegis.js

@@ -189,11 +189,12 @@ function createClient(opts = {}) {
     return headers;
   }
 
-  async function apiPost(path, body, headers) {
+  async function apiPost(path, body, headers, opts) {
     const res = await fetch(`${apiBase}${path}`, {
       method: 'POST',
       headers: headers || authHeaders(),
       body: JSON.stringify(body || {}),
+      signal: opts && opts.signal,
     });
     return parseResponse(res);
   }
@@ -371,6 +372,19 @@ function createClient(opts = {}) {
     return apiPost('/api/verify-api-key', { api_key: apiKey });
   }
 
+  /**
+   * Ask aegis1 for a free device key when the caller has none configured yet
+   * (`POST /api/v1/auth/register-device`). Idempotent server-side on
+   * `fingerprint` — the same fingerprint always returns the same account's
+   * key rather than minting a new one. The account starts at zero token-bank
+   * balance: this hands out an account, not free inference, so the existing
+   * balance=0 gate on `/api/v1/chat/completions` still applies unchanged.
+   * Sends no API key of its own — there isn't one yet.
+   */
+  async function registerDevice(fingerprint, opts) {
+    return apiPost('/api/v1/auth/register-device', { fingerprint }, undefined, opts);
+  }
+
   /** Build the OpenAI-style messages array from either a full history or the
    *  single-shot { system, prompt } shorthand.
    *
@@ -994,6 +1008,7 @@ function createClient(opts = {}) {
     },
     promptUrl,
     verifyApiKey,
+    registerDevice,
     chatCompletion,
     byokChatCompletion,
     listModels,

package/vendor/auto-provision.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/**
+ * Auto-provision a free aegis1 device key when a host finds no key configured
+ * anywhere (env, the shared 0600 store, legacy config.json). One
+ * implementation shared by every host (MCP plugin, desktop, CLI) — see
+ * client/credentials.js's own header for why that matters here: three copies
+ * of the same timeout/endpoint/save logic is how they drift.
+ *
+ * Calls aegis1's `POST /api/v1/auth/register-device` (see client/aegis.js's
+ * `registerDevice`), idempotent per machine fingerprint (client/
+ * device-fingerprint.js) so a wiped credential store still resolves back to
+ * the same account rather than minting a new, unfunded one.
+ *
+ * The provisioned account starts at ZERO token-bank balance server-side, and
+ * aegis1 additionally requires an upgraded (paid, active) plan to use pooled
+ * aegiscloud models at all (nexus_chat_completions' is_pro() gate) — this
+ * only unblocks BYOK and account status/settings until the account is funded
+ * and/or upgraded. It is account creation, not a grant of free inference.
+ */
+const { machineFingerprint } = require('./device-fingerprint.js');
+
+const DEVICE_REGISTER_TIMEOUT_MS = 8000;
+
+/**
+ * @param {object} aegisClient A client from client/aegis.js (createClient()).
+ * @param {object} credentials client/credentials.js (or a compatible double).
+ * @returns {Promise<{ok: boolean, key: string, error?: Error}>}
+ *   `ok` is true only when a usable key was obtained AND persisted to the
+ *   shared store; `aegisClient.setApiKey()` has already been called on
+ *   success, so the caller's client is immediately usable either way it
+ *   inspects `ok`.
+ */
+async function autoProvisionApiKey(aegisClient, credentials) {
+  if (aegisClient.apiKey) return { ok: true, key: aegisClient.apiKey };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEVICE_REGISTER_TIMEOUT_MS);
+  try {
+    const data = await aegisClient.registerDevice(machineFingerprint(), { signal: controller.signal });
+    const key = data && typeof data.api_key === 'string' ? data.api_key.trim() : '';
+    if (!key) return { ok: false, key: '' };
+    const saved = credentials.saveApiKey(key);
+    aegisClient.setApiKey(key);
+    return { ok: !!saved.ok, key };
+  } catch (err) {
+    return { ok: false, key: '', error: err };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+module.exports = { autoProvisionApiKey, DEVICE_REGISTER_TIMEOUT_MS };

package/vendor/device-fingerprint.js

@@ -0,0 +1,63 @@
+'use strict';
+
+/**
+ * A stable per-machine identifier, used ONLY to ask aegis1 for a free device
+ * key (`POST /api/v1/auth/register-device`) when no key is configured yet. It
+ * is not a credential itself — the endpoint treats it as an idempotency key,
+ * so a wiped `~/.aegiscode` still resolves back to the same aegis1 account
+ * (and whatever balance it holds) instead of minting a fresh, unfunded one.
+ *
+ * Derivation mirrors ae-guix's `getMachineFingerprint()` (main.js) so the two
+ * hosts don't invent divergent conventions for the same idea: the OS's own
+ * machine identity where one exists, hashed with a purpose-specific prefix so
+ * it can never collide with a fingerprint minted for another purpose.
+ */
+const crypto = require('node:crypto');
+const os = require('node:os');
+
+/** Best-effort OS machine identity. Empty string, never throws, if none is reachable. */
+function readMachineId() {
+  try {
+    if (process.platform === 'linux') {
+      const fs = require('node:fs');
+      try {
+        return fs.readFileSync('/etc/machine-id', 'utf8').trim();
+      } catch {
+        return fs.readFileSync('/var/lib/dbus/machine-id', 'utf8').trim();
+      }
+    }
+    if (process.platform === 'darwin') {
+      const { execSync } = require('node:child_process');
+      const out = execSync('ioreg -rd1 -c IOPlatformExpertDevice', {
+        encoding: 'utf8',
+        timeout: 3000,
+      });
+      const m = out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+      if (m) return m[1];
+    }
+    if (process.platform === 'win32') {
+      const { execSync } = require('node:child_process');
+      const out = execSync('reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid', {
+        encoding: 'utf8',
+        timeout: 3000,
+      });
+      const m = out.match(/MachineGuid\s+REG_SZ\s+(\S+)/);
+      if (m) return m[1];
+    }
+  } catch {
+    /* no reachable machine id on this host — the caller falls back below */
+  }
+  return '';
+}
+
+/**
+ * sha256("aegiscode-plugin-device-v1:" + machine identity), hex.
+ *
+ * @param {string} [overrideId] - test-only override for the raw machine identity.
+ */
+function machineFingerprint(overrideId) {
+  const id = overrideId || readMachineId() || `${os.hostname()}:${os.platform()}:${os.arch()}`;
+  return crypto.createHash('sha256').update(`aegiscode-plugin-device-v1:${id}`).digest('hex');
+}
+
+module.exports = { machineFingerprint, readMachineId };