aegis-desktop 1.0.10 → 1.0.13

package/main.js

@@ -26,6 +26,7 @@
 
 const path = require('node:path');
 const fs = require('node:fs');
+const { execFile } = require('node:child_process');
 const { pathToFileURL } = require('node:url');
 
 // Dev / CI / smoke-test layout: desktop/ lives inside the repo, so the shared
@@ -88,6 +89,30 @@ try {
   sharedTopup = require('./vendor/topup.js');
 }
 
+// Google identity + Drive (client/google-signin.js, client/drive-connect.js,
+// client/drive-upload.js). google-signin.js already existed for the CLI's
+// `connect --google`; this is the first time desktop wires any of it. See
+// lib/google-connect.js for how the three are sequenced.
+let googleSignIn;
+try {
+  googleSignIn = require('../client/google-signin.js');
+} catch {
+  googleSignIn = require('./vendor/google-signin.js');
+}
+let driveConnectLib;
+try {
+  driveConnectLib = require('../client/drive-connect.js');
+} catch {
+  driveConnectLib = require('./vendor/drive-connect.js');
+}
+let driveUploadLib;
+try {
+  driveUploadLib = require('../client/drive-upload.js');
+} catch {
+  driveUploadLib = require('./vendor/drive-upload.js');
+}
+const { createGoogleConnect } = require('./lib/google-connect.js');
+
 // The device fingerprint (client/device-fingerprint.js) — the SAME identity the
 // auto-provision path registers a device-key against, now also carried in every
 // presence beat so one laptop is one machine in the admin panel rather than one
@@ -109,13 +134,14 @@ try {
 // below (`fingerprintStatus`/`keygen`/`mint`/`verify`/`backup`).
 const { createFingerprintService } = require('./lib/fingerprint.js');
 
-// The two opt-in automations (lib/auto.js): the auto-drain timer and the
-// seal-on-quiet auto-mint. Both are DEFAULT OFF and read their switch from the
-// settings store's reserved `__autoDrain`/`__autoMint` namespaces on every tick,
-// so this require wires the TIMING only — the queue worker still owns the lock
-// and lib/fingerprint.js still owns the seal. See the header of lib/auto.js for
-// why the "nothing drains unless the user asked" rule became a default rather
-// than an absolute.
+// The two background automations (lib/auto.js): the auto-drain timer and the
+// seal-on-quiet auto-mint. Both are DEFAULT ON — the queue and the seal run
+// with no click and no card on the desktop — and both read their switch from
+// the settings store's reserved `__autoDrain`/`__autoMint` namespaces on every
+// tick, so this require wires the TIMING only: the queue worker still owns the
+// lock and lib/fingerprint.js still owns the seal. An explicit `enabled: false`
+// in the settings store is what stops either one, and stopping it takes effect
+// on the very next tick.
 const { createAutoDrain, createAutoMint } = require('./lib/auto.js');
 
 // The shared `~/.aegiscode/.env` loader (client/env-file.js, staged to
@@ -260,6 +286,12 @@ const MENU_SEARCH_CHANNEL = `${IPC_PREFIX}menuSearch`;
  *  knows the open session id, main.js just pings it. */
 const MENU_EXPORT_MARKDOWN_CHANNEL = `${IPC_PREFIX}menuExportMarkdown`;
 const MENU_EXPORT_JSON_CHANNEL = `${IPC_PREFIX}menuExportJson`;
+/** View > Authorship panel. The φ(α) card that used to open this sheet was
+ *  removed from the sidebar (sealing runs in the background now), so the menu
+ *  is what keeps the panel — key, records, vault — reachable at all. Same split
+ *  as the channels above: main has no panel state, it just asks the renderer to
+ *  open the sheet it already owns. */
+const MENU_FINGERPRINT_CHANNEL = `${IPC_PREFIX}menuFingerprint`;
 
 /**
  * Main -> renderer push for a resolved aegis:// deep link (D? deep linking).
@@ -830,7 +862,7 @@ function providerRouteConfigured(engine) {
  * reject), injected by bootstrap() so this module still needs no `electron`
  * import to stay unit-testable.
  */
-function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, avatar) {
+function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, avatar, getVaultBackend) {
   // One service for the window's lifetime, bound to the app's data dir — but
   // created LAZILY, which is what the comment here always claimed and what the
   // code did not do. `createFingerprintService({ dir })` throws on a missing
@@ -844,12 +876,12 @@ function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConf
   let fingerprintService = null;
   const fingerprint = new Proxy({}, {
     get(_target, prop) {
-      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir, getVaultBackend });
       const value = fingerprintService[prop];
       return typeof value === 'function' ? value.bind(fingerprintService) : value;
     },
     has(_target, prop) {
-      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir, getVaultBackend });
       return prop in fingerprintService;
     },
   });
@@ -1046,8 +1078,8 @@ function withReplyNotify(promise, event, onReplyFinished) {
  *  tests, where the safe no-op default in createIpcDispatch takes over.
  *  `onReplyFinished` is likewise bootstrap()-only: it fires the native
  *  "reply ready" notification when the window is unfocused/hidden. */
-function registerIpc(ipcMain, aegis, dir, persistApiKey, openExternal, onReplyFinished, providerConfigured) {
-  const dispatch = createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured);
+function registerIpc(ipcMain, aegis, dir, persistApiKey, openExternal, onReplyFinished, providerConfigured, getVaultBackend) {
+  const dispatch = createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, undefined, getVaultBackend);
   for (const [name, handler] of Object.entries(dispatch)) {
     if (name === 'chatCompletion') {
       // Streaming render (D2.1): when the renderer asks for stream, SSE deltas
@@ -1154,6 +1186,29 @@ function registerConfirmModeIpc(ipcMain, dispatch) {
   return dispatch;
 }
 
+/**
+ * Vault backend preference: `aegis:getVaultBackend` / `aegis:setVaultBackend`.
+ * Same shape as createConfirmModeDispatch — unit-testable with a stub store —
+ * and registered through the same generic registerConfirmModeIpc, which does
+ * nothing confirm-mode-specific; it just wires `{name: handler}` pairs as
+ * `aegis:<name>`.
+ *
+ * `getVaultBackend` answers `{ backend }`, one of
+ * desktop/lib/settings.js's VAULT_BACKEND_VALUES ('aegiscloud' | 'drive' |
+ * 'off'). `setVaultBackend` refuses an unrecognised value the same way
+ * settings.setVaultBackendConfig does (returns the unchanged state rather than
+ * writing something the fingerprint service's vaultScope()/vaultDisabled()
+ * would not recognise either) — a bad payload cannot silently point the vault
+ * somewhere, or at nothing, that the picker never actually offered.
+ */
+function createVaultBackendDispatch(settings) {
+  if (!settings) throw new Error('createVaultBackendDispatch requires a settings store');
+  return {
+    getVaultBackend: () => settings.vaultBackendConfig(),
+    setVaultBackend: (payload) => settings.setVaultBackendConfig(payload && payload.backend),
+  };
+}
+
 /**
  * Funnel instrumentation (Phase 2 of docs/upgrade-conversion-plan.md):
  * `aegis:telemetryEvent` / `aegis:telemetryReport`, backed by the store in
@@ -2741,6 +2796,10 @@ function createNpmUpdateManager({
   fetchImpl,
   setTimeoutImpl = setTimeout,
   clearTimeoutImpl = clearTimeout,
+  // Both injectable so the install path is testable without running npm or
+  // killing the test runner's own process.
+  runUpgrade,
+  relaunch,
 } = {}) {
   const PKG = 'aegis-desktop';
   let current = 'unknown';
@@ -2762,6 +2821,11 @@ function createNpmUpdateManager({
     attempts: 0,
     retryInMs: 0,
     command: null,
+    // `plan` is the shared verdict the banner was rendered from. `download()`
+    // installs from THIS object rather than re-deriving a command, so the
+    // button can only ever run what the banner promised.
+    plan: null,
+    method: null,
     canDownload: false,
   };
   const set = (patch) => {
@@ -2788,6 +2852,34 @@ function createNpmUpdateManager({
   let inFlight = null;
   let interval = null;
 
+  /**
+   * How THIS desktop copy was installed: 'npm' | 'pip' | 'npx' | 'source'.
+   *
+   * Memoised — it cannot change while the process runs. `entry` is the app
+   * directory: an unpackaged run is either a global npm install (a path with
+   * `node_modules` in it), a checkout (`desktop/` beside `.git`), or a pip
+   * launcher, which declares itself through AEGIS_INSTALL_METHOD because
+   * nothing in the filesystem would otherwise say so.
+   */
+  let methodCache = null;
+  function detectMethod() {
+    if (methodCache) return methodCache;
+    const detect = updater && updater.detectInstallMethod;
+    if (typeof detect !== 'function') { methodCache = 'npm'; return methodCache; }
+    try {
+      methodCache = detect({
+        env: process.env,
+        argv: process.argv,
+        pkg: PKG,
+        entry: __dirname,
+        fileExists: (rel) => fs.existsSync(path.resolve(__dirname, '..', rel)),
+      });
+    } catch {
+      methodCache = 'npm';
+    }
+    return methodCache;
+  }
+
   /** 1m, 5m, 15m, 60m, 60m… — capped, never unbounded. */
   const delayFor = () =>
     UPDATE_RETRY_BACKOFF_MS[Math.min(Math.max(attempts - 1, 0), UPDATE_RETRY_BACKOFF_MS.length - 1)];
@@ -2887,8 +2979,14 @@ function createNpmUpdateManager({
         // The npm applier's instruction comes from the ONE shared verdict
         // (`updatePlan`), the same call `aegiscode`'s notice and `aegis doctor`
         // render — so the banner cannot offer a command the terminal would not.
+        //
+        // `method` is this copy's install channel, detected the same way the
+        // CLI does. It matters because `npm i -g` against a pip-installed
+        // aegis-desktop writes a second copy beside the one the user actually
+        // runs: the button would appear to work and change nothing.
+        const method = detectMethod();
         const plan = typeof updater.updatePlan === 'function'
-          ? updater.updatePlan({ current, latest: res.latest, behind: true, channel: 'npm', pkg: PKG })
+          ? updater.updatePlan({ current, latest: res.latest, behind: true, channel: 'npm', pkg: PKG, method })
           : null;
         return set({
           status: 'available',
@@ -2898,11 +2996,13 @@ function createNpmUpdateManager({
           transient: false,
           attempts: 0,
           retryInMs: 0,
+          plan,
+          method,
           command: (plan && plan.instruction) || `npm i -g ${PKG}@latest`,
-          // npm owns installation here, so there is nothing for this process
-          // to download — the banner must offer the command, not a Download
-          // button that would silently do nothing.
-          canDownload: false,
+          // A channel with an `apply` argv has something this process can run;
+          // `npx` and a source checkout do not, and offering a button that
+          // silently does nothing is worse than the command alone.
+          canDownload: Boolean(plan && plan.apply),
         });
       }
 
@@ -2944,16 +3044,97 @@ function createNpmUpdateManager({
     }
   }
 
+  /**
+   * Run one installer argv and resolve to a status patch. Never rejects.
+   *
+   * `npm i -g` against a global prefix needs no elevation the way a system
+   * package does, but it still writes outside the app dir and it can fail on a
+   * permissions wall — so a failure is reported with npm's own last lines
+   * rather than a blanket "update failed".
+   */
+  function runInstall(target) {
+    const exec = runUpgrade || ((cmd, args) => new Promise((resolve) => {
+      execFile(cmd, args, { timeout: 180_000, windowsHide: true }, (err, stdout, stderr) => {
+        if (err) return resolve({ ok: false, output: String(stderr || stdout || err.message || err) });
+        resolve({ ok: true, output: String(stdout || '') });
+      });
+    }));
+    return Promise.resolve(exec(target.command, target.args)).then(
+      (res) => ({ ok: Boolean(res && res.ok), output: String((res && res.output) || '') }),
+      (err) => ({ ok: false, output: errorText(err) }),
+    );
+  }
+
   return {
     status: () => state,
     check,
-    // npm installs are the user's to run; saying so beats pretending to act.
-    download: async () => set({
-      status: state.status === 'available' ? 'available' : state.status,
-      command: `npm i -g ${PKG}@latest`,
-      canDownload: false,
-    }),
-    quitAndInstall: () => {},
+    /**
+     * The banner's Download button. It INSTALLS.
+     *
+     * This used to be a no-op that re-set `command` and `canDownload:false`:
+     * the button was hidden for every npm install, so the affordance and the
+     * action were both missing, and the only way to update the window was to
+     * read a shell command off a banner and type it into a different app.
+     *
+     * It still runs only on an explicit click (nothing here installs on a
+     * timer), and it still does not hot-swap the running process: after a
+     * successful install the honest state is 'downloaded' — "restart to install"
+     * — because the new files are on disk and this process is still the old
+     * ones. That is the same promise the packaged electron-updater path makes,
+     * so the banner needs no branch.
+     */
+    download: async () => {
+      const target = state.plan && state.plan.apply;
+      if (!target) {
+        // Nothing to install on this channel (npx fetches fresh every run; a
+        // checkout belongs to its git remote). Say who owns it instead of
+        // pretending to act.
+        return set({
+          status: state.status === 'available' ? 'available' : state.status,
+          command: (state.plan && state.plan.instruction) || state.command,
+          canDownload: false,
+        });
+      }
+      set({ status: 'downloading', error: null, progress: 0 });
+      const res = await runInstall(target);
+      if (!res.ok) {
+        // `transient: false` deliberately: an installer that refused is not a
+        // network blip, and the retry ladder must not quietly re-run an npm
+        // install every minute.
+        return set({
+          status: 'error',
+          transient: false,
+          error: res.output.trim().split('\n').slice(-3).join(' ').trim() || 'the installer failed',
+          command: `${target.command} ${target.args.join(' ')}`,
+        });
+      }
+      return set({
+        status: 'downloaded',
+        version: state.version,
+        error: null,
+        progress: 100,
+        command: `npm i -g ${PKG}@latest`,
+        canDownload: false,
+      });
+    },
+    /**
+     * "Restart to install". Relaunches the app so the freshly installed files
+     * are what runs — `app.relaunch()` before `app.exit()`, the standard pair,
+     * because `app.quit()` alone would not start a new process.
+     */
+    quitAndInstall: () => {
+      if (state.status !== 'downloaded') return;
+      const again = relaunch || (() => {
+        try {
+          const { app } = require('electron');
+          app.relaunch();
+          app.exit(0);
+        } catch {
+          /* not under Electron (a test or the CLI): nothing to relaunch */
+        }
+      });
+      again();
+    },
     start: () => {
       check().catch(() => {});
       interval = setInterval(() => check().catch(() => {}), UPDATE_CHECK_INTERVAL_MS);
@@ -3156,6 +3337,10 @@ function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
     label: 'Export Session…',
     click: () => sendToFocusedWindow(BrowserWindow, MENU_EXPORT_JSON_CHANNEL),
   };
+  const fingerprintItem = {
+    label: 'Authorship Panel…',
+    click: () => sendToFocusedWindow(BrowserWindow, MENU_FINGERPRINT_CHANNEL),
+  };
 
   const template = [
     ...(isMac
@@ -3206,6 +3391,8 @@ function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
       submenu: [
         searchItem,
         { type: 'separator' },
+        fingerprintItem,
+        { type: 'separator' },
         { role: 'reload', accelerator: 'CmdOrCtrl+R' },
         { role: 'forceReload' },
         { type: 'separator' },
@@ -3360,6 +3547,26 @@ function bootstrap() {
     describeFailure: autoProvision.provisionFailureText,
     onChange: (state) => broadcastAccountStatus(state),
   });
+
+  // Google sign-in + Drive connect (lib/google-connect.js). Same key store as
+  // accountKey above (settings.setAegisKey) — one saved key, whichever door
+  // last wrote it — and the same banner: a successful Google sign-in clears
+  // whatever "no key" state accountKey was showing, same as a successful
+  // register-device retry does.
+  const googleConnect = createGoogleConnect({
+    aegis,
+    credentials,
+    persistKey: (key) => settings.setAegisKey(key),
+    openUrl: (url) => {
+      if (!isSafeExternalUrl(url)) return false;
+      shell.openExternal(url);
+      return true;
+    },
+    googleSignIn,
+    driveConnect: driveConnectLib,
+    driveUpload: driveUploadLib,
+    onAccountChange: () => broadcastAccountStatus(accountKey.status()),
+  });
   const keyPresentAtStart = Boolean(aegis.apiKey);
   const earlyKeyProvision = autoProvision.autoProvisionApiKey(aegis, credentials, { app: 'desktop' }).then((result) => {
     accountKey.recordStartup(result);
@@ -3467,7 +3674,8 @@ function bootstrap() {
     persistApiKey,
     (url) => shell.openExternal(url),
     handleReplyFinished,
-    () => providerRouteConfigured(engine)
+    () => providerRouteConfigured(engine),
+    () => settings.vaultBackendConfig().backend
   );
   const modelIpc = registerModelIpc(
     ipcMain,
@@ -3495,6 +3703,15 @@ function bootstrap() {
   // the CLI, which shares this store.
   registerConfirmModeIpc(ipcMain, withAutoRoundsSwitch(createConfirmModeDispatch(settings), modelIpc.modelDispatch));
 
+  // Vault backend preference (Settings/the authorship panel → Google Drive /
+  // AE / No sync): aegis:getVaultBackend / aegis:setVaultBackend. Registered
+  // here, beside confirm mode, for the same reason — this is where the
+  // settings store lands, and lib/fingerprint.js's vaultScope()/vaultDisabled()
+  // read the live value through the getVaultBackend thunks passed to
+  // registerIpc and createAutoMint above, so a change here reaches the very
+  // next publish/anchor/vault/audit call with no restart.
+  registerConfirmModeIpc(ipcMain, createVaultBackendDispatch(settings));
+
   // Funnel instrumentation (Phase 2 of docs/upgrade-conversion-plan.md):
   // aegis:telemetryEvent / aegis:telemetryReport, backed by
   // lib/local/telemetry.js.
@@ -3539,12 +3756,12 @@ function bootstrap() {
   // nobody to answer a card, so the interactive engine is the wrong one to hand
   // a worker (see createQueueEngine).
   //
-  // Registration alone drains nothing. There are now exactly two ways a drain
-  // starts, and both are visible in the UI: a click on the card's
-  // Run one / Drain all, or the card's "drain automatically" switch — a
-  // PERSISTED, DEFAULT-OFF setting (settings.js `__autoDrain`) read by
-  // lib/auto.js on every tick. There is still no boot drain and no
-  // drain-on-idle; the interval only exists while the switch is on.
+  // Registration alone drains nothing. Two ways a drain starts: the queue
+  // card's Run one / Drain all (the card is hidden now, but the IPC and the
+  // CLI entry point are the same call), or the background worker below — a
+  // PERSISTED setting (settings.js `__autoDrain`), ON unless explicitly
+  // switched off, read by lib/auto.js on every tick. There is still no boot
+  // drain and no drain-on-idle: the first tick is one interval after start.
   const queueDispatch = registerQueueIpc(ipcMain, {
     engine: createQueueEngine(aegis, settings),
     aegis,
@@ -3584,7 +3801,12 @@ function bootstrap() {
   let autoFingerprint = null;
   autoMint = createAutoMint({
     mint: (payload) => {
-      if (!autoFingerprint) autoFingerprint = createFingerprintService({ dir: dataDir });
+      if (!autoFingerprint) {
+        autoFingerprint = createFingerprintService({
+          dir: dataDir,
+          getVaultBackend: () => settings.vaultBackendConfig().backend,
+        });
+      }
       return autoFingerprint.mint(payload || {});
     },
     settings,
@@ -3592,10 +3814,12 @@ function bootstrap() {
 
   registerAutoIpc(ipcMain, createAutoDispatch({ autoDrain, autoMint }));
 
-  // Arm whatever the user left switched on — and nothing else. Both start()
-  // calls are reads of a persisted, default-off setting: on a default install
-  // the drain timer is not created at all and the mint has no pending turns, so
-  // the queue still waits for a click and no session is ever sealed by itself.
+  // Arm the background workers. Both start() calls are reads of a persisted
+  // setting that is ON unless it was explicitly switched off (settings.js
+  // `__autoDrain`/`__autoMint`), so a default install drains a queued task with
+  // no click and seals a quiet session with nothing on screen. Neither start()
+  // drains or seals anything by itself: the drain's first tick is one interval
+  // away and the mint waits for a finished turn before its quiet clock starts.
   autoDrain.start();
   autoMint.start();
 
@@ -3820,6 +4044,14 @@ function bootstrap() {
   registerUpdateIpc(ipcMain, updateManager);
   ipcMain.handle(`${IPC_PREFIX}accountStatus`, () => accountKey.status());
   ipcMain.handle(`${IPC_PREFIX}registerAccount`, () => accountKey.registerAccount());
+  // Google sign-in + Drive connect/sync (lib/google-connect.js). Every call
+  // resolves `{ ok, … }` / `{ ok: false, error }` rather than throwing, same
+  // contract as the fingerprint* handlers below — the renderer shows the
+  // actual reason instead of Electron's opaque "Error invoking remote method".
+  ipcMain.handle(`${IPC_PREFIX}driveSignIn`, () => googleConnect.signInWithGoogle());
+  ipcMain.handle(`${IPC_PREFIX}driveConnect`, () => googleConnect.connectDrive());
+  ipcMain.handle(`${IPC_PREFIX}driveStatus`, () => googleConnect.status());
+  ipcMain.handle(`${IPC_PREFIX}driveSyncMemory`, () => googleConnect.syncMemoryNow());
   registerExportIpc(
     ipcMain,
     sessionStore,
@@ -4104,6 +4336,7 @@ module.exports = {
   MENU_SEARCH_CHANNEL,
   MENU_EXPORT_MARKDOWN_CHANNEL,
   MENU_EXPORT_JSON_CHANNEL,
+  MENU_FINGERPRINT_CHANNEL,
   DEEP_LINK_CHANNEL,
   UPDATE_STATUS_CHANNEL,
   UPDATE_CHECK_INTERVAL_MS,
@@ -4139,6 +4372,7 @@ module.exports = {
   createQuickLauncherDispatch,
   registerQuickLauncherIpc,
   createConfirmModeDispatch,
+  createVaultBackendDispatch,
   withAutoRoundsSwitch,
   createTelemetryDispatch,
   registerTelemetryIpc,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -26,13 +26,14 @@
   "scripts": {
     "start": "electron .",
     "predist": "node scripts/predist.mjs",
+    "prepack": "node scripts/predist.mjs --quiet",
     "prepublishOnly": "npm run predist",
     "icon": "node scripts/generate-icon.mjs",
     "shots": "node scripts/capture-marketing-shots.mjs",
     "demo": "node scripts/record-demo-gif.mjs",
     "dist": "npm run predist && electron-builder",
     "dist:dir": "npm run predist && electron-builder --dir",
-    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check scripts/bundle-fonts.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/account-key.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/providers.js && node --check renderer/provider-toolbar.js && node --check renderer/companion.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check scripts/bundle-fonts.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/account-key.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
     "test:shell": "node ../test/desktop-shell.mjs",
     "test:model": "node ../test/model-dispatch.mjs",
     "test:budget": "node ../test/budget.test.mjs",
@@ -50,6 +51,8 @@
     "test:stream-policy": "node ../test/stream-policy.test.mjs",
     "test:renderer-dom": "node ../test/renderer-dom.test.mjs",
     "test:renderer-wiring": "node ../test/renderer-wiring.test.mjs",
+    "test:renderer-welcome": "node test/renderer-welcome.test.mjs",
+    "test:renderer-providers": "node ../test/renderer-providers.test.mjs",
     "test:avatar-xp": "node test/avatar-xp.test.mjs",
     "test:avatar-level": "node test/avatar-level.test.mjs",
     "test:avatar-events": "node test/avatar-events.test.mjs",

package/preload.js

@@ -32,6 +32,7 @@ const MENU_NEW_CHAT_CHANNEL = `${IPC_PREFIX}menuNewChat`;
 const MENU_SEARCH_CHANNEL = `${IPC_PREFIX}menuSearch`;
 const MENU_EXPORT_MARKDOWN_CHANNEL = `${IPC_PREFIX}menuExportMarkdown`;
 const MENU_EXPORT_JSON_CHANNEL = `${IPC_PREFIX}menuExportJson`;
+const MENU_FINGERPRINT_CHANNEL = `${IPC_PREFIX}menuFingerprint`;
 const DEEP_LINK_CHANNEL = `${IPC_PREFIX}deepLink`;
 const QUICK_LAUNCHER_PUSH_CHANNEL = `${IPC_PREFIX}quickLauncherPush`;
 
@@ -204,6 +205,14 @@ const api = {
   getConfirmMode: () => invoke('getConfirmMode'),
   setConfirmMode: (enabled) => invoke('setConfirmMode', { enabled: Boolean(enabled) }),
 
+  // Vault backend (the authorship panel's Google Drive / AE / No sync picker):
+  // main.js createVaultBackendDispatch persists it in the settings store's
+  // reserved `__vaultBackend` namespace, and lib/fingerprint.js's
+  // vaultScope()/vaultDisabled() read it on every publish/anchor/vault/audit
+  // call. Both resolve `{ backend }`.
+  getVaultBackend: () => invoke('getVaultBackend'),
+  setVaultBackend: (backend) => invoke('setVaultBackend', { backend: String(backend || '') }),
+
   // Funnel instrumentation (Phase 2 of docs/upgrade-conversion-plan.md). The
   // renderer emits exactly two event names, on two surfaces, carrying a
   // campaign and a surface — nothing else, ever. This method picks those three
@@ -276,6 +285,20 @@ const api = {
     ipcRenderer.on(ACCOUNT_STATUS_CHANNEL, listener);
     return () => ipcRenderer.removeListener(ACCOUNT_STATUS_CHANNEL, listener);
   },
+  // Google sign-in + Drive connect/sync (main.js lib/google-connect.js).
+  // `driveSignIn` opens a browser for aegis1's `/auth/google` round-trip and
+  // replaces this machine's saved key with the Google-linked one — the
+  // desktop counterpart of the CLI's `aegiscode connect`. `driveConnect`
+  // opens `/connect/drive` and polls until this (now Google-linked) account
+  // shows a Drive token on file; it is only coherent once `driveSignIn` has
+  // actually run. `driveStatus` is a one-shot, no-browser read for painting
+  // the card on load. `driveSyncMemory` pulls this account's AEGIS cloud
+  // memory and backs it up to a dedicated "AEGIS Memory" Drive folder. Every
+  // one resolves `{ ok, … }` / `{ ok: false, error }`, never throws.
+  driveSignIn: () => invoke('driveSignIn'),
+  driveConnect: () => invoke('driveConnect'),
+  driveStatus: () => invoke('driveStatus'),
+  driveSyncMemory: () => invoke('driveSyncMemory'),
   // Native menu accelerators with no built-in Electron role (Cmd/Ctrl+N,
   // Cmd/Ctrl+K — see main.js buildAppMenu): main.js just pings the channel,
   // the renderer owns what "new chat" / "search" actually do.
@@ -298,6 +321,14 @@ const api = {
     ipcRenderer.on(MENU_EXPORT_MARKDOWN_CHANNEL, listener);
     return () => ipcRenderer.removeListener(MENU_EXPORT_MARKDOWN_CHANNEL, listener);
   },
+  // View > Authorship Panel… — the sidebar card that used to open the φ(α)
+  // sheet is gone (sealing runs in the background), so the menu is the entry
+  // point. The renderer owns the sheet, main only asks for it.
+  onMenuFingerprint: (onTrigger) => {
+    const listener = () => onTrigger();
+    ipcRenderer.on(MENU_FINGERPRINT_CHANNEL, listener);
+    return () => ipcRenderer.removeListener(MENU_FINGERPRINT_CHANNEL, listener);
+  },
   onMenuExportJson: (onTrigger) => {
     const listener = () => onTrigger();
     ipcRenderer.on(MENU_EXPORT_JSON_CHANNEL, listener);
@@ -452,16 +483,17 @@ const quickLauncher = {
 //      task's own tool loop runs in — and main.js refuses it unless it is an
 //      absolute path that already exists; this file never joins, reads or writes
 //      a path itself.
-//   2. No drain that starts by itself UNLESS the persisted switch is armed.
-//      `drain`/`proceed` above are invoked only from the queue card's two
-//      buttons; the timer that can call one without a click lives in
-//      desktop/lib/auto.js and is armed by exactly one thing — the
-//      `aegis.auto.setDrain({ enabled: true })` call the card's toggle makes
-//      below, which writes settings.js's reserved `__autoDrain` namespace. It
-//      is OFF in a default install, it is re-read on every tick, and switching
-//      it off stops the very next one. Draining spends money on a real model in
-//      a real checkout, so that switch is persisted and visible rather than
-//      implied — but it is also not hidden from this file's users any more.
+//   2. No drain that starts by itself unless the persisted switch says so —
+//      and in a default install it DOES say so. `drain`/`proceed` above are the
+//      manual entry points (the queue card is hidden now; the same calls back
+//      the `aegis autonomous` CLI path), and the timer that calls `proceed()`
+//      with no click lives in desktop/lib/auto.js, armed from settings.js's
+//      reserved `__autoDrain` namespace. That namespace is ON unless an
+//      explicit `enabled: false` is written — which is exactly what
+//      `aegis.auto.setDrain({ enabled: false })` below persists. Every tick
+//      re-reads it, so switching it off stops the very next one. Draining
+//      spends money on a real model in a real checkout, so the switch stays in
+//      the settings store rather than in this file's defaults.
 const queue = {
   // Queue one task. `payload` is { task, cwd, class, model, effort, workers,
   // maxRounds, commit }; main.js range-checks every field and answers
@@ -514,8 +546,9 @@ const queue = {
  * app's own scope (client/attest.js), so no key can be handed in from the DOM
  * even by a mistake in main.js.
  *
- * Both switches are OFF until one of these calls says otherwise, and the only
- * caller is a toggle the user clicked — see the queue section's note 2 above.
+ * Both switches are ON unless the settings store says otherwise; these calls
+ * are how a host turns one OFF. Nothing on screen has to ask first — see the
+ * queue section's note 2 above.
  */
 const auto = {
   // { ok, drain: { enabled, intervalMs, armed, busy, ticks, drains, last, lastSkip }, mint: { … } }