aegis-desktop 1.0.13 → 1.0.14

package/main.js

@@ -292,6 +292,12 @@ const MENU_EXPORT_JSON_CHANNEL = `${IPC_PREFIX}menuExportJson`;
  *  as the channels above: main has no panel state, it just asks the renderer to
  *  open the sheet it already owns. */
 const MENU_FINGERPRINT_CHANNEL = `${IPC_PREFIX}menuFingerprint`;
+/** Account > Google Drive Backup… — opens the same φ(α) sheet as the item
+ *  above, scrolled straight to the Drive row. Only on the menu once an AEGIS
+ *  account key exists (buildAppMenu's `enabled`, rebuilt on accountKey's
+ *  onChange): signing in with Google is itself how an anonymous install gets
+ *  one, so the item stays but disabled until that first key lands. */
+const MENU_GOOGLE_DRIVE_CHANNEL = `${IPC_PREFIX}menuGoogleDrive`;
 
 /**
  * Main -> renderer push for a resolved aegis:// deep link (D? deep linking).
@@ -413,6 +419,54 @@ function errorText(err) {
   return err && err.message ? err.message : String(err);
 }
 
+/** Is this rejection the user pressing stop?
+ *
+ *  `engine.cancel()` aborts the session's AbortController, and the in-flight
+ *  transport turn rejects with `DOMException [AbortError]: This operation was
+ *  aborted`. That is the app working exactly as asked — but `ipcMain.handle`
+ *  prints EVERY rejection with a full stack ("Error occurred in handler for
+ *  'model:chat':"), so a deliberate Ctrl-X was the loudest thing in the
+ *  terminal and read like a crash. The renderer cannot tell it either: an
+ *  abort that crosses IPC loses `name`/`code` and arrives as a bare message,
+ *  which is why the classification is made HERE, where the object is intact,
+ *  and handed on as data (see the `aborted` resolution in registerModelIpc).
+ *
+ *  Evidence only — `aegisCancelled`, `name`, `code` — and never the message.
+ *
+ *  The first version also matched any message containing "abort", as the
+ *  renderer's `isCancellation` backstop does. That is wrong on this side of the
+ *  boundary: the renderer has a per-turn `userStopped` flag to corroborate a
+ *  fuzzy match against, and main has no such notion, so the message WAS the
+ *  whole signal. A genuine failure saying "connection aborted by peer" or
+ *  "upstream aborted the connection" would have been resolved as a clean stop
+ *  and quietly discarded, since this branch rethrows everything else. The bit
+ *  that cannot lie is stamped on the error by the engine at the point it knows
+ *  for certain — its own controller's signal read aborted — which no upstream
+ *  cause can fake. `name`/`code` are kept because a DOMException raised by
+ *  `AbortController.abort()` itself carries them reliably.
+ */
+function isAbortShapedError(err) {
+  if (!err || typeof err !== 'object') return false;
+  if (err.aegisCancelled === true) return true;
+  return err.name === 'AbortError' || err.code === 'ABORT_ERR';
+}
+
+/** The resolved stand-in for a stopped turn.
+ *
+ *  Same shape as the `bestEffortFailed` payload below, so every existing
+ *  `data.choices[0].message.content` reader keeps working, plus the
+ *  `aborted` discriminator the renderer keys its salvage path off.
+ */
+function abortedTurnPayload(err) {
+  return {
+    aborted: true,
+    status: 0,
+    code: 'ABORT_ERR',
+    message: errorText(err),
+    choices: [{ message: { content: '' } }],
+  };
+}
+
 /**
  * Precise classification of a cloud-sync refusal — the desktop port of
  * `describeError()` in cli/src/cloudsync.js, so both hosts name a 402/401 the
@@ -2074,6 +2128,21 @@ function registerModelIpc(ipcMain, engine, sessionsDir, aegis, onReplyFinished,
     if (name === 'chat') {
       ipcMain.handle(`${MODEL_PREFIX}${name}`, (event, payload) => {
         const opts = { ...(payload || {}) };
+        // A background dispatch the user never typed — the welcome panel's
+        // greeting, a discovery lane — is allowed to fail quietly. A REJECTED
+        // ipcMain.handle is printed by Electron itself ("Error occurred in
+        // handler for 'model:chat':" plus the whole stack), and the renderer
+        // that catches it is another process, so a greeting that timed out on
+        // boot put a provider stack trace in the terminal as the first thing
+        // the app said. Nothing was lost: those lanes already treat "no answer"
+        // as "keep what is on screen". So the flag turns the rejection into a
+        // resolved classified payload (the renderer gets MORE than it used to —
+        // status and code, which `ipcRenderer.invoke` would have flattened to a
+        // message string anyway) and the terminal gets one line, not a stack.
+        const bestEffort = opts.bestEffort === true;
+        // …and it never reaches the wire: this is a host-side instruction, not
+        // a provider field, and the engine forwards what it recognises.
+        delete opts.bestEffort;
         // The rung every renderer sends is low|medium|high; this is the one
         // place a stale window can still hand us the retired `auto` (a page
         // loaded before the select lost that row, or a renderer that forgot to
@@ -2099,10 +2168,59 @@ function registerModelIpc(ipcMain, engine, sessionsDir, aegis, onReplyFinished,
             sender.send(CHAT_DELTA_CHANNEL, taggedChunk(chunk, opts.sessionId));
           }
         };
-        return withReplyNotify(
-          handler({ ...opts, onStream: forward }),
-          event,
-          onReplyFinished
+        const lane = opts.class || 'model';
+        const turn = handler({ ...opts, onStream: forward });
+        if (!bestEffort) {
+          // A user-pressed stop must not be printed as an app error. The
+          // rejection itself is correct — it is how the turn unwinds — so the
+          // catch is added AFTER withReplyNotify, which means the success and
+          // "reply ready" notification paths are untouched and only the
+          // rejection is reclassified. Anything that is not an abort rethrows
+          // verbatim: a genuine provider failure still reaches the renderer as
+          // a rejection, and still prints, because that is information.
+          //
+          // Resolved rather than rethrown because `ipcMain.handle` prints what
+          // it rejects and no flag suppresses that. The renderer turns this
+          // payload back into an AbortError (see `models.chat` in app.js), so
+          // `isCancellation` → `salvageTurn` still runs and a half-written
+          // answer is kept and labelled "stopped by you" — the same outcome as
+          // before, minus the stack trace.
+          return withReplyNotify(turn, event, onReplyFinished).catch((err) => {
+            if (!isAbortShapedError(err)) throw err;
+            console.warn(
+              `[model] ${lane} turn stopped before it finished: ${errorText(err)} [ABORT_ERR]`
+            );
+            return abortedTurnPayload(err);
+          });
+        }
+        return turn.then(
+          (result) => {
+            if (onReplyFinished) onReplyFinished(event, result);
+            return result;
+          },
+          (err) => {
+            // Classified, not verbatim: the status and code are what tell an
+            // operator which failure this was (0/timeout, 402 balance, 401
+            // key), and neither survives the IPC boundary unless it is stated
+            // here. The stack does not survive anything useful.
+            const status = err && typeof err.status === 'number' ? err.status : 0;
+            const code = (err && err.code) || '';
+            console.warn(
+              `[model] background ${lane} turn produced no answer: ${errorText(err)}` +
+                `${status ? ` (status ${status})` : ''}${code ? ` [${code}]` : ''}`
+            );
+            // Resolved, so Electron does not print the rejection and the lane
+            // that asked can read "nothing came back" without a try/catch.
+            // `bestEffortFailed` is the discriminator; the empty content keeps
+            // every existing `data.choices[0].message.content` reader working.
+            return {
+              bestEffortFailed: true,
+              status,
+              code: code || undefined,
+              message: errorText(err),
+              choices: [{ message: { content: '' } }],
+            };
+          }
         );
       });
       continue;
@@ -2723,35 +2841,39 @@ const ACCOUNT_STATUS_CHANNEL = `${IPC_PREFIX}accountStatusChanged`;
 const UPDATE_CHECK_INTERVAL_MS = 4 * 60 * 60 * 1000;
 
 /**
- * Auto-update state machine over electron-updater (GitHub Releases provider,
- * configured via desktop/electron-builder.yml `publish:` — see main.js's
- * top-of-file note and that file's comment for the feed this points at).
+ * The npm registry is the ONLY update channel, packaged build included.
+ *
+ * There used to be a second one: electron-updater reading GitHub Releases via
+ * electron-builder.yml's `publish:` feed. That feed never existed. The repo
+ * named there (aegiscloud-devs/aegiscode-plugin) is private and has no
+ * published release, so every launch of a packaged app failed its check with
  *
- * Deliberately inert outside a packaged app: `electron .` in dev has no
- * app-update.yml (electron-builder only writes one at build time), so
- * calling checkForUpdates() there would just throw on every launch. Rather
- * than special-case that error, `isPackaged: false` skips wiring the real
- * autoUpdater entirely and every method resolves a harmless 'disabled'
- * state — dev never touches the network or the update machinery.
+ *   404 "method: GET url: .../releases.atom    Please double check that your
+ *   authentication token is correct..."
  *
- * `autoDownload` stays false: checking happens automatically (on ready and
- * on the interval below), but the multi-hundred-MB download itself only
- * starts when the renderer's banner "Download" button calls download() —
- * see the IPC dispatch below. This keeps every step user-visible and
- * matches the "never auto-restart without consent" rule: quitAndInstall()
- * is likewise only ever invoked by an explicit "Restart to install" click.
+ * — GitHub answers 404 rather than 403 to an unauthenticated request on a
+ * private repo, and electron-updater reports every non-200 as an auth problem,
+ * so the banner blamed the user's token for a destination that was never
+ * public and never had a release. Meanwhile aegis-desktop ships to npm on
+ * every release. So the packaged path now uses the same npm manager as every
+ * other install, and `publish:`/electron-updater are gone rather than left
+ * pointing at a feed nobody can read.
+ *
+ * Checking happens automatically on ready and on the interval below; nothing
+ * here installs or restarts on its own. `download()` runs only on the banner's
+ * explicit click, and `quitAndInstall()` only on "Restart to install".
  */
 
 /**
- * Update state backed by the npm registry, for installs that are not packaged
- * electron builds (i.e. `npm i -g aegis-desktop`).
+ * Update state backed by the npm registry — the channel for EVERY install,
+ * packaged AppImage/deb/NSIS/dmg included.
  *
- * Mirrors the electron-updater manager's shape exactly so the IPC dispatch and
- * the renderer banner need no branch: status/check/download/quitAndInstall/
- * start. `download` and `quitAndInstall` are no-ops that report the install
- * command instead of acting — npm owns installation here, and silently
- * swapping the package under a running process is not something to do on the
- * user's behalf.
+ * Keeps the state shape the IPC dispatch and the renderer banner consume
+ * (status/check/download/quitAndInstall/start), so neither needed a branch
+ * when the packaged path stopped using electron-updater. Which installer owns
+ * this copy is `detectInstallMethod`'s answer, and the command shown is that
+ * plan's `instruction` — an AppImage or a global npm install must not be told
+ * to run a command that writes a different copy.
  */
 /**
  * How long to wait before re-checking after a FAILED background check: 1m, 5m,
@@ -2792,6 +2914,13 @@ function describeRegistryFailure(reason, status, pkg) {
 
 function createNpmUpdateManager({
   onStatus,
+  // A packaged build (AppImage/deb/NSIS/dmg) is NOT the npm copy. `npm i -g`
+  // from inside one writes a SECOND install beside the running binary and the
+  // relaunch then starts the unchanged original — a button that appears to work
+  // and changes nothing. The version news still comes from npm (there is no
+  // other channel), but the packaged case names the install instead of
+  // pretending to apply it.
+  packaged = false,
   now = () => Date.now(),
   fetchImpl,
   setTimeoutImpl = setTimeout,
@@ -2915,8 +3044,8 @@ function createNpmUpdateManager({
    *
    * `intervalMs: 0` is deliberate: the *schedule* stays this manager's (it
    * polls every `UPDATE_CHECK_INTERVAL_MS` and drives its retry ladder off the
-   * result), but the *check* is not re-implemented here. The desktop keeps its
-   * applier — `electron-updater` below — and loses its own version fetch.
+   * result), but the *check* is not re-implemented here. The desktop's applier
+   * is the npm install above; it has no version fetch of its own.
    */
   async function fetchDetailed() {
     if (fetchImpl) return fetchImpl({ pkg: PKG });
@@ -2998,11 +3127,22 @@ function createNpmUpdateManager({
           retryInMs: 0,
           plan,
           method,
-          command: (plan && plan.instruction) || `npm i -g ${PKG}@latest`,
+          // A packaged build is not the npm copy, so it must not be told to run
+          // `npm i -g` — that writes a second install and the relaunch starts
+          // the unchanged original. It gets the same version news, addressed to
+          // the install that actually owns it.
+          command: packaged
+            ? `${res.latest} is published — reinstall AEGIS Desktop from the installer to pick it up`
+            : (plan && plan.instruction) || `npm i -g ${PKG}@latest`,
+          // Whether `command` is something to TYPE or a sentence to READ. The
+          // banner otherwise prefixes "run:" to it, which is right for
+          // `npm i -g aegis-desktop@latest` and wrong for a channel with no
+          // command at all (packaged, npx, a source checkout).
+          commandIsSentence: packaged || Boolean(plan && !plan.apply),
           // A channel with an `apply` argv has something this process can run;
-          // `npx` and a source checkout do not, and offering a button that
-          // silently does nothing is worse than the command alone.
-          canDownload: Boolean(plan && plan.apply),
+          // `npx`, a source checkout and a packaged build do not, and offering
+          // a button that silently does nothing is worse than the command alone.
+          canDownload: Boolean(plan && plan.apply) && !packaged,
         });
       }
 
@@ -3080,11 +3220,12 @@ function createNpmUpdateManager({
      * timer), and it still does not hot-swap the running process: after a
      * successful install the honest state is 'downloaded' — "restart to install"
      * — because the new files are on disk and this process is still the old
-     * ones. That is the same promise the packaged electron-updater path makes,
-     * so the banner needs no branch.
+     * ones. Packaged and npm installs share that promise, so the banner needs
+     * no branch.
      */
     download: async () => {
-      const target = state.plan && state.plan.apply;
+      // Nothing to run for a packaged build — see the `packaged` option above.
+      const target = !packaged && state.plan && state.plan.apply;
       if (!target) {
         // Nothing to install on this channel (npx fetches fresh every run; a
         // checkout belongs to its git remote). Say who owns it instead of
@@ -3151,7 +3292,7 @@ function createNpmUpdateManager({
   };
 }
 
-function createUpdateManager({ autoUpdater, isPackaged, onStatus }) {
+function createUpdateManager({ isPackaged, onStatus }) {
   let state = { status: 'idle', version: null, error: null, canDownload: false };
 
   function setState(patch) {
@@ -3159,76 +3300,16 @@ function createUpdateManager({ autoUpdater, isPackaged, onStatus }) {
     if (onStatus) onStatus(state);
   }
 
-  if (!isPackaged || !autoUpdater) {
-    // Not a packaged build — which is how this app is INSTALLED FROM NPM, not
-    // just how it runs in dev. That case used to resolve a flat 'disabled' and
-    // never check anything, so an npm-installed desktop could never learn a
-    // new version existed.
-    //
-    // electron-updater's configured feed is GitHub Releases
-    // (electron-builder.yml `publish:`), and there has never been a published
-    // release to read — the only one is a draft, invisible to the updater, and
-    // the release workflow cannot run while Actions is billing-locked. So the
-    // feed the packaged path depends on does not exist, while the registry we
-    // actually publish to does.
-    //
-    // npm is therefore the real update channel. Checking it costs one request
-    // a day, reports the version and the exact command, and deliberately does
-    // NOT self-install: replacing your own running process mid-session is a
-    // different promise from telling you an update exists.
-    return createNpmUpdateManager({ onStatus: setState });
-  }
-
-  autoUpdater.autoDownload = false;
-  autoUpdater.autoInstallOnAppQuit = false;
-
-  autoUpdater.on('checking-for-update', () => setState({ status: 'checking', error: null }));
-  autoUpdater.on('update-available', (info) =>
-    setState({ status: 'available', version: info && info.version, error: null, canDownload: true })
-  );
-  autoUpdater.on('update-not-available', () => setState({ status: 'up-to-date', error: null }));
-  autoUpdater.on('download-progress', (progress) =>
-    setState({ status: 'downloading', progress: progress && progress.percent })
-  );
-  autoUpdater.on('update-downloaded', (info) =>
-    setState({ status: 'downloaded', version: info && info.version, error: null })
-  );
-  // Any failure — offline, a malformed feed, a 404 on latest.yml — lands
-  // here instead of an unhandled rejection, since electron-updater emits
-  // 'error' for background failures that occur outside the promise a
-  // check()/download() call is awaiting.
-  autoUpdater.on('error', (err) => setState({ status: 'error', error: errorText(err) }));
-
-  async function check() {
-    try {
-      await autoUpdater.checkForUpdates();
-    } catch (err) {
-      setState({ status: 'error', error: errorText(err) });
-    }
-    return state;
-  }
-
-  async function download() {
-    try {
-      await autoUpdater.downloadUpdate();
-    } catch (err) {
-      setState({ status: 'error', error: errorText(err) });
-    }
-    return state;
-  }
-
-  function quitAndInstall() {
-    autoUpdater.quitAndInstall();
-  }
-
-  function start() {
-    check();
-    const timer = setInterval(check, UPDATE_CHECK_INTERVAL_MS);
-    // Never keep the process alive solely to poll for updates.
-    if (timer.unref) timer.unref();
-  }
-
-  return { status: () => state, check, download, quitAndInstall, start };
+  // ONE channel for every install shape: packaged or `npm i -g`, AppImage, deb,
+  // NSIS, dmg. There is no second applier any more — see this section's header
+  // for the 404 the GitHub Releases feed produced on every packaged launch.
+  //
+  // The old branch here existed only because electron-updater needed a
+  // build-time app-update.yml and a non-packaged run had none. npm needs
+  // neither, so there is nothing left to branch on: the npm manager reads the
+  // registry, reports the version, and names the command that updates THIS
+  // copy (its install method is detected, not assumed).
+  return createNpmUpdateManager({ onStatus: setState, packaged: Boolean(isPackaged) });
 }
 
 /** Pure mapping: IPC payload -> update-manager call, same shape as
@@ -3298,7 +3379,7 @@ function sendDeepLinkToWindow(win, parsed) {
  *  hours, and an About item (mac gets one for free in the app submenu; other
  *  platforms get a Help menu — role 'about' shows app.setAboutPanelOptions()
  *  cross-platform since Electron 15). */
-function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
+function buildAppMenu({ app, Menu, BrowserWindow, updateManager, loggedIn }) {
   const isMac = process.platform === 'darwin';
 
   app.setAboutPanelOptions({
@@ -3341,6 +3422,11 @@ function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
     label: 'Authorship Panel…',
     click: () => sendToFocusedWindow(BrowserWindow, MENU_FINGERPRINT_CHANNEL),
   };
+  const googleDriveItem = {
+    label: 'Google Drive Backup…',
+    enabled: Boolean(loggedIn),
+    click: () => sendToFocusedWindow(BrowserWindow, MENU_GOOGLE_DRIVE_CHANNEL),
+  };
 
   const template = [
     ...(isMac
@@ -3392,6 +3478,7 @@ function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
         searchItem,
         { type: 'separator' },
         fingerprintItem,
+        googleDriveItem,
         { type: 'separator' },
         { role: 'reload', accelerator: 'CmdOrCtrl+R' },
         { role: 'forceReload' },
@@ -3441,6 +3528,60 @@ function bootstrap() {
   app.commandLine.appendSwitch('disable-software-rasterizer');
   app.commandLine.appendSwitch('disable-gpu-compositing');
 
+  // Chromium asks xdg-desktop-portal for the desktop accent colour on Linux so
+  // form controls can match the system palette. On this Cinnamon session the
+  // portal's appearance backend does not answer that request the way Chromium
+  // expects, so Chromium cancels it and the portal framework prints to stderr:
+  //
+  //   [<pid>:<date>:ERROR:components/dbus/xdg/request.cc(173)]
+  //     Request ended (non-user cancelled).
+  //
+  // Harmless — Chromium falls back to its default accent — but it lands in the
+  // terminal of every `npm start` next to real errors, and reads like an app
+  // failure. This app renders its own theme tokens and never consults the
+  // system accent colour (no nativeTheme/accentColor reference in main.js,
+  // preload.js, renderer/ or lib/), so that lookup is pure cost here.
+  //
+  // Measured on this Electron build (44.8.0) via dbus-monitor: the switch is
+  // honoured and halves startup portal traffic — org.freedesktop.portal.
+  // Settings Reads go 4 -> 2 and accent-color calls 2 -> 0 per launch. The
+  // surviving Reads are color-scheme, which Electron 44 exposes no gate for;
+  // left alone deliberately, since the window chrome follows light/dark.
+  app.commandLine.appendSwitch('disable-features', 'UsePortalAccentColor');
+
+  // The X11 clipboard advertises its drag-and-drop target formats by looking
+  // each MIME atom up in Chromium's atom cache, and Chromium logs an ERROR for
+  // every atom it has to mint on the spot:
+  //
+  //   [<pid>:<date>:ERROR:ui/gfx/x/atom_cache.cc(236)]
+  //     Add application/vnd.portal.filetransfer to kAtomsToCache
+  //   [<pid>:<date>:ERROR:ui/gfx/x/atom_cache.cc(236)]
+  //     Add application/vnd.portal.files to kAtomsToCache
+  //
+  // They fire the first time you CUT (Ctrl-X) or drag a selection, because the
+  // initial atom table covers copy but not the portal file-transfer pair, and
+  // they are printed at ERROR level even though the behaviour is correct: the
+  // atoms get added and the clipboard works.
+  //
+  // Measured on this Electron build (44.8.0): no feature gate suppresses these
+  // — `--disable-features=XdgFileTransferPortal` left them at 2, and adding
+  // UsePortalAccentColor above also left them at 2. Only the log level does
+  // (2 -> 0 at `--log-level=3`). So this is a logging decision, not a feature
+  // one, and it is deliberately the LAST such switch: `3` = FATAL, which
+  // silences ERROR-level chatter like the above while still printing anything
+  // that actually kills the process.
+  //
+  // Never applied over a level the user chose: `--log-level` on the command
+  // line, or ELECTRON_ENABLE_LOGGING (which asks for the verbose output this
+  // would undo), wins. Neither is something this app sets for itself, so a
+  // developer debugging Chromium still sees everything.
+  const argvLogLevel = process.argv.some((a) =>
+    /^--(log-level|enable-logging)/.test(a)
+  );
+  if (!argvLogLevel && !process.env.ELECTRON_ENABLE_LOGGING) {
+    app.commandLine.appendSwitch('log-level', '3');
+  }
+
   // A second launch (double-clicking the icon again, `aegis` from a second
   // terminal, …) must focus the existing window, not spawn a second process
   // fighting the first over the same on-disk settings/session/queue files —
@@ -4012,18 +4153,6 @@ function bootstrap() {
       });
   });
 
-  // electron-updater touches the network and expects a build-time
-  // app-update.yml that only exists in a packaged app; requiring it is safe
-  // either way, but it's wrapped defensively so a version mismatch or a
-  // missing optional native dep degrades to "updates disabled" instead of
-  // taking the whole app down.
-  let realAutoUpdater = null;
-  try {
-    realAutoUpdater = require('electron-updater').autoUpdater;
-  } catch {
-    realAutoUpdater = null;
-  }
-
   const openWindows = new Set();
   function broadcastUpdateStatus(state) {
     for (const win of openWindows) {
@@ -4034,10 +4163,19 @@ function bootstrap() {
     for (const win of openWindows) {
       if (!win.isDestroyed()) win.webContents.send(ACCOUNT_STATUS_CHANNEL, state);
     }
+    // The Google Drive menu item is enabled/disabled on login state (see
+    // buildAppMenu) — native menus don't repaint themselves, so every path
+    // that can change aegis.apiKey (register-device, Google sign-in) has to
+    // rebuild through here, the one place both already call.
+    rebuildAppMenu();
+  }
+  function rebuildAppMenu() {
+    Menu.setApplicationMenu(
+      buildAppMenu({ app, Menu, BrowserWindow, updateManager, loggedIn: Boolean(aegis.apiKey) })
+    );
   }
 
   const updateManager = createUpdateManager({
-    autoUpdater: realAutoUpdater,
     isPackaged: app.isPackaged,
     onStatus: broadcastUpdateStatus,
   });
@@ -4059,7 +4197,7 @@ function bootstrap() {
     (opts) => dialog.showSaveDialog(BrowserWindow.getFocusedWindow(), opts),
     (filePath, content) => fs.promises.writeFile(filePath, content, 'utf8')
   );
-  Menu.setApplicationMenu(buildAppMenu({ app, Menu, BrowserWindow, updateManager }));
+  rebuildAppMenu();
 
   // The local file this window is allowed to be at — used both to restore a
   // saved position/reload and to recognise (and block) any navigation away
@@ -4337,6 +4475,7 @@ module.exports = {
   MENU_EXPORT_MARKDOWN_CHANNEL,
   MENU_EXPORT_JSON_CHANNEL,
   MENU_FINGERPRINT_CHANNEL,
+  MENU_GOOGLE_DRIVE_CHANNEL,
   DEEP_LINK_CHANNEL,
   UPDATE_STATUS_CHANNEL,
   UPDATE_CHECK_INTERVAL_MS,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -64,9 +64,6 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "dependencies": {
-    "electron-updater": "^6.8.9"
-  },
   "devDependencies": {
     "electron-builder": "^26.15.3",
     "electron": "^44.0.0"

package/preload.js

@@ -33,6 +33,7 @@ const MENU_SEARCH_CHANNEL = `${IPC_PREFIX}menuSearch`;
 const MENU_EXPORT_MARKDOWN_CHANNEL = `${IPC_PREFIX}menuExportMarkdown`;
 const MENU_EXPORT_JSON_CHANNEL = `${IPC_PREFIX}menuExportJson`;
 const MENU_FINGERPRINT_CHANNEL = `${IPC_PREFIX}menuFingerprint`;
+const MENU_GOOGLE_DRIVE_CHANNEL = `${IPC_PREFIX}menuGoogleDrive`;
 const DEEP_LINK_CHANNEL = `${IPC_PREFIX}deepLink`;
 const QUICK_LAUNCHER_PUSH_CHANNEL = `${IPC_PREFIX}quickLauncherPush`;
 
@@ -260,11 +261,10 @@ const api = {
   getMemoryPersist: () => invoke('memoryPersist.get'),
   setMemoryPersist: (enabled) => invoke('memoryPersist.set', { enabled: Boolean(enabled) }),
 
-  // Auto-update (electron-updater over GitHub Releases — see main.js
-  // createUpdateManager). check/download resolve the same status shape the
-  // push channel delivers; both are no-ops that resolve `{ status:
-  // 'disabled' }` in an unpackaged dev build. quitAndInstallUpdate must only
-  // ever be called from an explicit user action (the banner's "Restart to
+  // Auto-update (npm registry — see main.js createUpdateManager). check and
+  // download resolve the same status shape the push channel delivers: download
+  // installs on an explicit click and only then, and quitAndInstallUpdate must
+  // only ever be called from an explicit user action (the banner's "Restart to
   // install" button) — main.js never restarts on its own.
   checkForUpdates: () => invoke('checkForUpdates'),
   downloadUpdate: () => invoke('downloadUpdate'),
@@ -329,6 +329,14 @@ const api = {
     ipcRenderer.on(MENU_FINGERPRINT_CHANNEL, listener);
     return () => ipcRenderer.removeListener(MENU_FINGERPRINT_CHANNEL, listener);
   },
+  // Account > Google Drive Backup… — same sheet as Authorship Panel above,
+  // opened straight to the Drive row instead of leaving the Google sign-in
+  // buttons to be found by scrolling past the unrelated φ(α) key controls.
+  onMenuGoogleDrive: (onTrigger) => {
+    const listener = () => onTrigger();
+    ipcRenderer.on(MENU_GOOGLE_DRIVE_CHANNEL, listener);
+    return () => ipcRenderer.removeListener(MENU_GOOGLE_DRIVE_CHANNEL, listener);
+  },
   onMenuExportJson: (onTrigger) => {
     const listener = () => onTrigger();
     ipcRenderer.on(MENU_EXPORT_JSON_CHANNEL, listener);