aegis-desktop 1.0.12 → 1.0.13

package/main.js

@@ -26,6 +26,7 @@
 
 const path = require('node:path');
 const fs = require('node:fs');
+const { execFile } = require('node:child_process');
 const { pathToFileURL } = require('node:url');
 
 // Dev / CI / smoke-test layout: desktop/ lives inside the repo, so the shared
@@ -88,6 +89,30 @@ try {
   sharedTopup = require('./vendor/topup.js');
 }
 
+// Google identity + Drive (client/google-signin.js, client/drive-connect.js,
+// client/drive-upload.js). google-signin.js already existed for the CLI's
+// `connect --google`; this is the first time desktop wires any of it. See
+// lib/google-connect.js for how the three are sequenced.
+let googleSignIn;
+try {
+  googleSignIn = require('../client/google-signin.js');
+} catch {
+  googleSignIn = require('./vendor/google-signin.js');
+}
+let driveConnectLib;
+try {
+  driveConnectLib = require('../client/drive-connect.js');
+} catch {
+  driveConnectLib = require('./vendor/drive-connect.js');
+}
+let driveUploadLib;
+try {
+  driveUploadLib = require('../client/drive-upload.js');
+} catch {
+  driveUploadLib = require('./vendor/drive-upload.js');
+}
+const { createGoogleConnect } = require('./lib/google-connect.js');
+
 // The device fingerprint (client/device-fingerprint.js) — the SAME identity the
 // auto-provision path registers a device-key against, now also carried in every
 // presence beat so one laptop is one machine in the admin panel rather than one
@@ -2771,6 +2796,10 @@ function createNpmUpdateManager({
   fetchImpl,
   setTimeoutImpl = setTimeout,
   clearTimeoutImpl = clearTimeout,
+  // Both injectable so the install path is testable without running npm or
+  // killing the test runner's own process.
+  runUpgrade,
+  relaunch,
 } = {}) {
   const PKG = 'aegis-desktop';
   let current = 'unknown';
@@ -2792,6 +2821,11 @@ function createNpmUpdateManager({
     attempts: 0,
     retryInMs: 0,
     command: null,
+    // `plan` is the shared verdict the banner was rendered from. `download()`
+    // installs from THIS object rather than re-deriving a command, so the
+    // button can only ever run what the banner promised.
+    plan: null,
+    method: null,
     canDownload: false,
   };
   const set = (patch) => {
@@ -2818,6 +2852,34 @@ function createNpmUpdateManager({
   let inFlight = null;
   let interval = null;
 
+  /**
+   * How THIS desktop copy was installed: 'npm' | 'pip' | 'npx' | 'source'.
+   *
+   * Memoised — it cannot change while the process runs. `entry` is the app
+   * directory: an unpackaged run is either a global npm install (a path with
+   * `node_modules` in it), a checkout (`desktop/` beside `.git`), or a pip
+   * launcher, which declares itself through AEGIS_INSTALL_METHOD because
+   * nothing in the filesystem would otherwise say so.
+   */
+  let methodCache = null;
+  function detectMethod() {
+    if (methodCache) return methodCache;
+    const detect = updater && updater.detectInstallMethod;
+    if (typeof detect !== 'function') { methodCache = 'npm'; return methodCache; }
+    try {
+      methodCache = detect({
+        env: process.env,
+        argv: process.argv,
+        pkg: PKG,
+        entry: __dirname,
+        fileExists: (rel) => fs.existsSync(path.resolve(__dirname, '..', rel)),
+      });
+    } catch {
+      methodCache = 'npm';
+    }
+    return methodCache;
+  }
+
   /** 1m, 5m, 15m, 60m, 60m… — capped, never unbounded. */
   const delayFor = () =>
     UPDATE_RETRY_BACKOFF_MS[Math.min(Math.max(attempts - 1, 0), UPDATE_RETRY_BACKOFF_MS.length - 1)];
@@ -2917,8 +2979,14 @@ function createNpmUpdateManager({
         // The npm applier's instruction comes from the ONE shared verdict
         // (`updatePlan`), the same call `aegiscode`'s notice and `aegis doctor`
         // render — so the banner cannot offer a command the terminal would not.
+        //
+        // `method` is this copy's install channel, detected the same way the
+        // CLI does. It matters because `npm i -g` against a pip-installed
+        // aegis-desktop writes a second copy beside the one the user actually
+        // runs: the button would appear to work and change nothing.
+        const method = detectMethod();
         const plan = typeof updater.updatePlan === 'function'
-          ? updater.updatePlan({ current, latest: res.latest, behind: true, channel: 'npm', pkg: PKG })
+          ? updater.updatePlan({ current, latest: res.latest, behind: true, channel: 'npm', pkg: PKG, method })
           : null;
         return set({
           status: 'available',
@@ -2928,11 +2996,13 @@ function createNpmUpdateManager({
           transient: false,
           attempts: 0,
           retryInMs: 0,
+          plan,
+          method,
           command: (plan && plan.instruction) || `npm i -g ${PKG}@latest`,
-          // npm owns installation here, so there is nothing for this process
-          // to download — the banner must offer the command, not a Download
-          // button that would silently do nothing.
-          canDownload: false,
+          // A channel with an `apply` argv has something this process can run;
+          // `npx` and a source checkout do not, and offering a button that
+          // silently does nothing is worse than the command alone.
+          canDownload: Boolean(plan && plan.apply),
         });
       }
 
@@ -2974,16 +3044,97 @@ function createNpmUpdateManager({
     }
   }
 
+  /**
+   * Run one installer argv and resolve to a status patch. Never rejects.
+   *
+   * `npm i -g` against a global prefix needs no elevation the way a system
+   * package does, but it still writes outside the app dir and it can fail on a
+   * permissions wall — so a failure is reported with npm's own last lines
+   * rather than a blanket "update failed".
+   */
+  function runInstall(target) {
+    const exec = runUpgrade || ((cmd, args) => new Promise((resolve) => {
+      execFile(cmd, args, { timeout: 180_000, windowsHide: true }, (err, stdout, stderr) => {
+        if (err) return resolve({ ok: false, output: String(stderr || stdout || err.message || err) });
+        resolve({ ok: true, output: String(stdout || '') });
+      });
+    }));
+    return Promise.resolve(exec(target.command, target.args)).then(
+      (res) => ({ ok: Boolean(res && res.ok), output: String((res && res.output) || '') }),
+      (err) => ({ ok: false, output: errorText(err) }),
+    );
+  }
+
   return {
     status: () => state,
     check,
-    // npm installs are the user's to run; saying so beats pretending to act.
-    download: async () => set({
-      status: state.status === 'available' ? 'available' : state.status,
-      command: `npm i -g ${PKG}@latest`,
-      canDownload: false,
-    }),
-    quitAndInstall: () => {},
+    /**
+     * The banner's Download button. It INSTALLS.
+     *
+     * This used to be a no-op that re-set `command` and `canDownload:false`:
+     * the button was hidden for every npm install, so the affordance and the
+     * action were both missing, and the only way to update the window was to
+     * read a shell command off a banner and type it into a different app.
+     *
+     * It still runs only on an explicit click (nothing here installs on a
+     * timer), and it still does not hot-swap the running process: after a
+     * successful install the honest state is 'downloaded' — "restart to install"
+     * — because the new files are on disk and this process is still the old
+     * ones. That is the same promise the packaged electron-updater path makes,
+     * so the banner needs no branch.
+     */
+    download: async () => {
+      const target = state.plan && state.plan.apply;
+      if (!target) {
+        // Nothing to install on this channel (npx fetches fresh every run; a
+        // checkout belongs to its git remote). Say who owns it instead of
+        // pretending to act.
+        return set({
+          status: state.status === 'available' ? 'available' : state.status,
+          command: (state.plan && state.plan.instruction) || state.command,
+          canDownload: false,
+        });
+      }
+      set({ status: 'downloading', error: null, progress: 0 });
+      const res = await runInstall(target);
+      if (!res.ok) {
+        // `transient: false` deliberately: an installer that refused is not a
+        // network blip, and the retry ladder must not quietly re-run an npm
+        // install every minute.
+        return set({
+          status: 'error',
+          transient: false,
+          error: res.output.trim().split('\n').slice(-3).join(' ').trim() || 'the installer failed',
+          command: `${target.command} ${target.args.join(' ')}`,
+        });
+      }
+      return set({
+        status: 'downloaded',
+        version: state.version,
+        error: null,
+        progress: 100,
+        command: `npm i -g ${PKG}@latest`,
+        canDownload: false,
+      });
+    },
+    /**
+     * "Restart to install". Relaunches the app so the freshly installed files
+     * are what runs — `app.relaunch()` before `app.exit()`, the standard pair,
+     * because `app.quit()` alone would not start a new process.
+     */
+    quitAndInstall: () => {
+      if (state.status !== 'downloaded') return;
+      const again = relaunch || (() => {
+        try {
+          const { app } = require('electron');
+          app.relaunch();
+          app.exit(0);
+        } catch {
+          /* not under Electron (a test or the CLI): nothing to relaunch */
+        }
+      });
+      again();
+    },
     start: () => {
       check().catch(() => {});
       interval = setInterval(() => check().catch(() => {}), UPDATE_CHECK_INTERVAL_MS);
@@ -3396,6 +3547,26 @@ function bootstrap() {
     describeFailure: autoProvision.provisionFailureText,
     onChange: (state) => broadcastAccountStatus(state),
   });
+
+  // Google sign-in + Drive connect (lib/google-connect.js). Same key store as
+  // accountKey above (settings.setAegisKey) — one saved key, whichever door
+  // last wrote it — and the same banner: a successful Google sign-in clears
+  // whatever "no key" state accountKey was showing, same as a successful
+  // register-device retry does.
+  const googleConnect = createGoogleConnect({
+    aegis,
+    credentials,
+    persistKey: (key) => settings.setAegisKey(key),
+    openUrl: (url) => {
+      if (!isSafeExternalUrl(url)) return false;
+      shell.openExternal(url);
+      return true;
+    },
+    googleSignIn,
+    driveConnect: driveConnectLib,
+    driveUpload: driveUploadLib,
+    onAccountChange: () => broadcastAccountStatus(accountKey.status()),
+  });
   const keyPresentAtStart = Boolean(aegis.apiKey);
   const earlyKeyProvision = autoProvision.autoProvisionApiKey(aegis, credentials, { app: 'desktop' }).then((result) => {
     accountKey.recordStartup(result);
@@ -3873,6 +4044,14 @@ function bootstrap() {
   registerUpdateIpc(ipcMain, updateManager);
   ipcMain.handle(`${IPC_PREFIX}accountStatus`, () => accountKey.status());
   ipcMain.handle(`${IPC_PREFIX}registerAccount`, () => accountKey.registerAccount());
+  // Google sign-in + Drive connect/sync (lib/google-connect.js). Every call
+  // resolves `{ ok, … }` / `{ ok: false, error }` rather than throwing, same
+  // contract as the fingerprint* handlers below — the renderer shows the
+  // actual reason instead of Electron's opaque "Error invoking remote method".
+  ipcMain.handle(`${IPC_PREFIX}driveSignIn`, () => googleConnect.signInWithGoogle());
+  ipcMain.handle(`${IPC_PREFIX}driveConnect`, () => googleConnect.connectDrive());
+  ipcMain.handle(`${IPC_PREFIX}driveStatus`, () => googleConnect.status());
+  ipcMain.handle(`${IPC_PREFIX}driveSyncMemory`, () => googleConnect.syncMemoryNow());
   registerExportIpc(
     ipcMain,
     sessionStore,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -26,6 +26,7 @@
   "scripts": {
     "start": "electron .",
     "predist": "node scripts/predist.mjs",
+    "prepack": "node scripts/predist.mjs --quiet",
     "prepublishOnly": "npm run predist",
     "icon": "node scripts/generate-icon.mjs",
     "shots": "node scripts/capture-marketing-shots.mjs",

package/preload.js

@@ -285,6 +285,20 @@ const api = {
     ipcRenderer.on(ACCOUNT_STATUS_CHANNEL, listener);
     return () => ipcRenderer.removeListener(ACCOUNT_STATUS_CHANNEL, listener);
   },
+  // Google sign-in + Drive connect/sync (main.js lib/google-connect.js).
+  // `driveSignIn` opens a browser for aegis1's `/auth/google` round-trip and
+  // replaces this machine's saved key with the Google-linked one — the
+  // desktop counterpart of the CLI's `aegiscode connect`. `driveConnect`
+  // opens `/connect/drive` and polls until this (now Google-linked) account
+  // shows a Drive token on file; it is only coherent once `driveSignIn` has
+  // actually run. `driveStatus` is a one-shot, no-browser read for painting
+  // the card on load. `driveSyncMemory` pulls this account's AEGIS cloud
+  // memory and backs it up to a dedicated "AEGIS Memory" Drive folder. Every
+  // one resolves `{ ok, … }` / `{ ok: false, error }`, never throws.
+  driveSignIn: () => invoke('driveSignIn'),
+  driveConnect: () => invoke('driveConnect'),
+  driveStatus: () => invoke('driveStatus'),
+  driveSyncMemory: () => invoke('driveSyncMemory'),
   // Native menu accelerators with no built-in Electron role (Cmd/Ctrl+N,
   // Cmd/Ctrl+K — see main.js buildAppMenu): main.js just pings the channel,
   // the renderer owns what "new chat" / "search" actually do.

package/renderer/app.js

@@ -1183,12 +1183,15 @@ function renderUpdateBanner(state) {
   let showRetry = false;
   const version = state.version ? `v${state.version} ` : '';
   if (status === 'available') {
-    // The npm channel cannot install itself, so its banner names the command
-    // instead of offering a Download button that would do nothing.
+    // A channel the main process can install for (npm, pip) gets a real
+    // Download button — `canDownload` is true only when it has an argv to run.
+    // The rest (npx, a source checkout) have nothing to install, so the banner
+    // names the command instead of offering a button that would do nothing.
     text = state.command
       ? `Update ${version}available — run: ${state.command}`
       : `Update ${version}available.`;
     showDownload = !!state.canDownload;
+    if (showDownload) text = `Update ${version}available.`;
   } else if (status === 'downloading') {
     const pct = typeof state.progress === 'number' ? ` (${Math.round(state.progress)}%)` : '';
     text = `Downloading update${pct}…`;
@@ -6467,9 +6470,16 @@ async function init() {
 
     els.updateDownloadBtn.addEventListener('click', () => {
       els.updateDownloadBtn.disabled = true;
-      aegis.downloadUpdate().finally(() => {
-        els.updateDownloadBtn.disabled = false;
-      });
+      // The resolved value is the post-install state: render it as well as
+      // waiting for the push, so a channel whose installer finishes inside the
+      // invoke still repaints (and so a failure surfaces even if the push
+      // channel is not wired yet).
+      Promise.resolve(aegis.downloadUpdate())
+        .then((state) => { if (state && state.status) renderUpdateBanner(state); })
+        .catch(() => {})
+        .finally(() => {
+          els.updateDownloadBtn.disabled = false;
+        });
     });
 
     // The only place quitAndInstallUpdate is ever called — an explicit user

package/renderer/fingerprint.js

@@ -78,6 +78,10 @@
     audit: 'fp-audit',
     vaultList: 'fp-vault-list',
     out: 'fp-out',
+    driveStatus: 'fp-drive-status',
+    driveSignIn: 'fp-drive-signin',
+    driveConnect: 'fp-drive-connect',
+    driveSyncNow: 'fp-drive-sync',
   };
 
   // ------------------------------------------------------------- formatting
@@ -139,6 +143,23 @@
     });
   }
 
+  /**
+   * The one-line summary of the Google Drive card — `desktop/lib/
+   * google-connect.js`'s `status()` shape, `{signedIn, connected, email}`.
+   *
+   * Three distinct states, because "not connected" means something different
+   * depending on whether this machine has signed in with Google at all:
+   * connecting Drive before signing in attaches the tokens to a different
+   * account than the one this machine polls (see google-connect.js's header
+   * comment), so the line has to say WHICH step is next, not just "no".
+   */
+  function driveLine(status) {
+    if (!status || status.ok === false) return (status && status.error) || 'unavailable';
+    if (!status.signedIn) return 'not signed in — sign in with Google first';
+    if (!status.connected) return 'signed in · Google Drive not connected yet';
+    return `Google Drive connected${status.email ? ` · ${status.email}` : ''}`;
+  }
+
   /** The anchor answer, kept as three separate claims on purpose: "the file is
    *  gone", "the file was replaced" and "the key that sealed it has moved on"
    *  are three different situations, and one boolean hides the interesting one
@@ -342,6 +363,50 @@
         say: (r) => (r.ok ? `vault backend set to ${dash(r.backend)}` : `could not save that: ${r.error}`),
       });
 
+    /**
+     * Google Drive — memory backup (desktop/lib/google-connect.js, exposed
+     * over `aegis.driveSignIn`/`driveConnect`/`driveStatus`/`driveSyncMemory`).
+     *
+     * Distinct from the vault backend buttons above: those choose where a
+     * SEALED φ(α) RECORD is published (rclone or the account vault). This is
+     * the account's AEGIS CLOUD MEMORY, backed up to the user's own Drive
+     * through real Google OAuth — unrelated data, unrelated credential.
+     */
+    function paintDrive(status) {
+      const line = el(IDS.driveStatus);
+      if (line) line.textContent = driveLine(status);
+      const connectBtn = el(IDS.driveConnect);
+      if (connectBtn) connectBtn.disabled = Boolean(status && !status.signedIn);
+      const syncBtn = el(IDS.driveSyncNow);
+      if (syncBtn) syncBtn.disabled = Boolean(!status || !status.connected);
+    }
+
+    async function loadDriveStatus() {
+      const r = await call('driveStatus');
+      state.drive = r;
+      paintDrive(r);
+      return r;
+    }
+
+    const doDriveSignIn = () =>
+      action('sign in with Google', () => call('driveSignIn'), {
+        after: (r) => (r && r.ok ? loadDriveStatus() : null),
+        say: (r) => (r.ok ? `signed in${r.username ? ` as ${r.username}` : ''}` : `sign-in failed: ${r.error}`),
+      });
+
+    const doDriveConnect = () =>
+      action('connect Google Drive', () => call('driveConnect'), {
+        after: (r) => (r && r.ok ? loadDriveStatus() : null),
+        say: (r) => (r.ok ? `Google Drive connected${r.email ? ` · ${r.email}` : ''}` : `could not connect: ${r.error}`),
+      });
+
+    const doDriveSyncNow = () =>
+      action('back up memory to Drive', () => call('driveSyncMemory'), {
+        say: (r) => (r.ok
+          ? `backed up ${r.count} memory entr${r.count === 1 ? 'y' : 'ies'}${r.webViewLink ? ` → ${r.webViewLink}` : ''}`
+          : `backup failed: ${r.error}`),
+      });
+
     function paintVault(list) {
       const ul = el(IDS.vaultList);
       if (!ul) return;
@@ -368,6 +433,7 @@
       paintStatus();
       await loadAutoMint();
       await loadVaultBackend();
+      await loadDriveStatus();
       return state.status;
     }
 
@@ -606,6 +672,9 @@
     bind(IDS.vaultBackendDrive, 'click', () => doSetVaultBackend('drive'));
     bind(IDS.vaultBackendCloud, 'click', () => doSetVaultBackend('aegiscloud'));
     bind(IDS.vaultBackendOff, 'click', () => doSetVaultBackend('off'));
+    bind(IDS.driveSignIn, 'click', doDriveSignIn);
+    bind(IDS.driveConnect, 'click', doDriveConnect);
+    bind(IDS.driveSyncNow, 'click', doDriveSyncNow);
     // The auto-seal switch is the ONE control on this panel that can file a
     // record with nobody watching, so it is the one that must repaint from
     // main's answer rather than from the checkbox the user just clicked.
@@ -626,8 +695,12 @@
       state,
       // Exposed for the test and for app.js's on-demand repaint. Every one is
       // idempotent, so calling them from a console is safe.
-      actions: { doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit, doSetVaultBackend },
+      actions: {
+        doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit,
+        doSetVaultBackend, doDriveSignIn, doDriveConnect, doDriveSyncNow,
+      },
       loadVaultBackend,
+      loadDriveStatus,
     };
   }
 
@@ -643,6 +716,7 @@
     auditVerdict,
     sealLine,
     autoMintLine,
+    driveLine,
     dash,
   };
 });

package/renderer/index.html

@@ -927,6 +927,23 @@
 
       <ul class="fp-vault-list" id="fp-vault-list"></ul>
 
+      <!-- Google Drive — memory backup. Unrelated to the vault above: that
+           publishes a sealed φ(α) RECORD; this backs up the account's AEGIS
+           CLOUD MEMORY to the user's own Drive through real Google OAuth
+           (desktop/lib/google-connect.js). Two buttons because connecting
+           Drive is only coherent once this machine has signed in with the
+           SAME Google identity — see that file's header comment — so
+           "Connect Drive" stays disabled (fingerprint.js paintDrive()) until
+           sign-in has actually landed. -->
+      <div class="fp-controls">
+        <div class="fp-row"><span class="fp-k">Google Drive</span><span class="fp-v" id="fp-drive-status">–</span></div>
+        <div class="fp-actions">
+          <button type="button" id="fp-drive-signin" class="ghost-btn">Sign in with Google</button>
+          <button type="button" id="fp-drive-connect" class="ghost-btn" disabled>Connect Drive</button>
+          <button type="button" id="fp-drive-sync" class="ghost-btn" disabled>Back up memory now</button>
+        </div>
+      </div>
+
       <div class="fp-out" id="fp-out">Ready. The key is never displayed.</div>
     </div>
   </div>