aegis-desktop 1.0.13 → 1.0.15

package/lib/provider-key-mirror.js

@@ -1,254 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * provider-key-mirror.js — make a provider key saved in the DESKTOP visible to
- * every other host on the same machine.
- *
- * The desktop's Provider settings rows persist into its own encrypted settings
- * store (`desktop/lib/settings.js` -> `settings.json` under the app's userData
- * dir). That store is private to this app: `aegiscode` (the CLI) and the MCP
- * plugin never read it, and they cannot — it is an encrypted Electron store in
- * another process's data directory. So a key added in the desktop was invisible
- * to the CLI on the next run: same machine, same provider, key asked for twice.
- *
- * The fix is not to teach every host to open an encrypted Electron store. It is
- * to write the key where all four hosts already look at start-up —
- * `~/.aegiscode/.env`, through the ONE shared writer (`client/env-file.js`
- * `setEnvValue`). After this, "add your provider key in the app" and "put it in
- * ~/.aegiscode/.env" are the same instruction, which is the point.
- *
- * Policy, deliberately narrow:
- *
- *   - PROVIDER keys only. The AEGIS *account* key is already shared through
- *     `credentials.json` (`client/credentials.js`), which the CLI, the MCP
- *     plugin and the desktop all read. A second copy in the env file would be a
- *     second authority that can silently disagree with the first — exactly the
- *     "which one won?" failure env-file.js refuses for duplicate lines. So
- *     `setAegisKey()` is deliberately NOT wrapped.
- *   - The variable name comes from `envFile.envVarFor(provider)`, the same
- *     mapping the CLI's model picker uses (`keyForModelId`), and must end in
- *     `_API_KEY`. A name we cannot map is a name we do not invent: an
- *     unrecognised provider leaves the file untouched rather than growing an
- *     unrelated variable.
- *   - Removing a key only touches the file if the file actually carries that
- *     variable, so "Remove" on a provider the file never knew about does not
- *     add a stray `OPENAI_API_KEY=` line to a hand-written file.
- *   - A failure to mirror is REPORTED and swallowed. The key IS saved (the
- *     encrypted store has it); only the cross-host copy failed, and refusing
- *     the whole save over that would throw away the key the user just typed.
- */
-
-/** Reserved namespaces (`__aegis`, `__quickLauncher`, …) are the store's own
- *  bookkeeping, not providers — never a key variable. */
-const RESERVED_PREFIX = '__';
-
-/** Every provider key variable in this product family ends this way. */
-const KEY_VAR_SUFFIX = /_API_KEY$/;
-
-/**
- * Write one provider key into the shared env file.
- *
- * @param {object} envFile  client/env-file.js (injected: this module must stay
- *                          unit-testable without touching the real home dir)
- * @param {string} provider provider id, e.g. 'openai'
- * @param {string} key      the key; '' means "clear it"
- * @param {object} [opts]   `onWarn(message)`, `envOpts` forwarded to env-file
- *                          (its `{ file, env }` seam, used by tests)
- * @returns {object|null}   env-file's own result, or null when nothing was
- *                          mirrored (no mapping, reserved row, absent variable)
- */
-function mirrorProviderKeyToEnvFile(envFile, provider, key, opts = {}) {
-  const warn = typeof opts.onWarn === 'function' ? opts.onWarn : () => {};
-  const envOpts = opts.envOpts || {};
-  if (!envFile || typeof envFile.setEnvValue !== 'function') return null;
-  if (typeof provider !== 'string' || !provider) return null;
-  if (provider.startsWith(RESERVED_PREFIX)) return null;
-
-  const name = typeof envFile.envVarFor === 'function' ? envFile.envVarFor(provider) : '';
-  if (!name || !KEY_VAR_SUFFIX.test(name)) return null;
-
-  try {
-    if (key) return envFile.setEnvValue(name, key, envOpts);
-    const status =
-      typeof envFile.keyStatus === 'function' ? envFile.keyStatus(name, envOpts) : null;
-    if (!status || !status.inFile) return null;
-    if (typeof envFile.clearEnvValue === 'function') {
-      return envFile.clearEnvValue(name, envOpts);
-    }
-    // An older vendored env-file without a remover. Writing an empty value is
-    // NOT a removal — `setEnvValue` refuses an empty value outright, so that
-    // call returned an error and left the stale line in place. Unset the live
-    // variable and say plainly that the file still carries it.
-    if (envOpts.env) delete envOpts.env[name];
-    else delete process.env[name];
-    warn(
-      `removed ${provider}'s key in the app, but ${name} is still in the shared env file — `
-      + 'this build has no clearEnvValue; delete the line by hand',
-    );
-    return null;
-  } catch (e) {
-    warn(`could not mirror ${provider}'s key into the shared env file: ${e && e.message}`);
-    return null;
-  }
-}
-
-/**
- * Copy every provider key the store already holds into the shared env file.
- *
- * `wrapProviderKeyMirror` above is a WRITE-TIME hook: it mirrors a key at the
- * moment it is saved. That leaves a real gap the hook cannot close, because a
- * key saved before the hook existed never fires it — an install whose provider
- * row predates this module (or any row written while the wrapper was not
- * installed, e.g. a direct settings write from a test or a repair script) keeps
- * its key in the encrypted store alone, and the CLI never sees it. A stored key
- * is not a mirrored key; only a fresh Save used to make them the same thing.
- *
- * The same gap swallows a "blank = keep" save: `renderer/app.js` saves a
- * provider row with `key` undefined when the key field is left empty (that
- * means "keep the stored one" — see the wrapper's comment), so the wrapper
- * correctly mirrors nothing and the row's real key stays host-local for ever.
- *
- * So this runs ONCE at start-up and reconciles the two stores by reading, not
- * by writing: for every non-reserved row that HAS a stored key whose variable
- * the shared file does not already carry, write it. It is:
- *
- *   - idempotent — a second call on an already-synced machine mirrors nothing
- *     (the `keyStatus(...).inFile` check is the guard), and it never rewrites a
- *     variable that is already present, so a hand-edited `.env` keeps its own
- *     spelling, comments and line order;
- *   - one-directional — store -> file only. The file is never read back into
- *     the encrypted store, so this cannot become a merge loop or overwrite a
- *     newer key the CLI wrote (which the desktop would then be second-guessing);
- *   - non-fatal — a row that cannot be decrypted or written is REPORTED and
- *     skipped. A start-up reconcile must never keep the window from opening.
- *
- * Must run after app 'ready': `safeStorage` (which decrypts the stored key) is
- * not usable before then.
- *
- * @param {object} store    a settings store (needs `list`, and `rawKey` for the
- *                          decrypted value — the exact pair settings.js exposes)
- * @param {object} envFile  client/env-file.js
- * @param {object} [opts]   `onWarn`, `envOpts` (see above)
- * @returns {{mirrored:string[], skipped:string[], failed:string[]}} what
- *          happened per provider, so a caller/test can assert rather than guess
- */
-function backfillProviderKeys(store, envFile, opts = {}) {
-  const warn = typeof opts.onWarn === 'function' ? opts.onWarn : () => {};
-  const envOpts = opts.envOpts || {};
-  const out = { mirrored: [], skipped: [], failed: [] };
-  if (!store || typeof store.list !== 'function') return out;
-  if (!envFile || typeof envFile.envVarFor !== 'function') return out;
-
-  let rows = [];
-  try {
-    rows = store.list() || [];
-  } catch (e) {
-    warn(`could not read the provider store to backfill the shared env file: ${e && e.message}`);
-    return out;
-  }
-
-  for (const row of rows) {
-    const provider = row && row.provider;
-    // Same filters as the write-time mirror: a reserved row is the store's own
-    // bookkeeping, and an unmappable name is a name we do not invent.
-    if (typeof provider !== 'string' || !provider) continue;
-    if (provider.startsWith(RESERVED_PREFIX)) continue;
-
-    const name = envFile.envVarFor(provider);
-    if (!name || !KEY_VAR_SUFFIX.test(name)) {
-      out.skipped.push(provider);
-      continue;
-    }
-    // A name the env file itself refuses (a production secret, not a host key)
-    // is not a failure to report — `setEnvValue` would reject it by design.
-    if (typeof envFile.isForeignSecret === 'function' && envFile.isForeignSecret(name)) {
-      out.skipped.push(provider);
-      continue;
-    }
-
-    // Already shared? Then there is nothing to do, and — importantly — nothing
-    // to overwrite. This is the idempotence guard.
-    let status = null;
-    try {
-      status = typeof envFile.keyStatus === 'function' ? envFile.keyStatus(name, envOpts) : null;
-    } catch { /* unreadable file is "not in the file"; the write below reports it */ }
-    if (status && status.inFile) {
-      out.skipped.push(provider);
-      continue;
-    }
-
-    // `row.configured` is the store's own "a key is stored" flag (settings.js
-    // get() derives it from the decrypted value), so a base-URL-only row is
-    // skipped here rather than being asked for a key it never had.
-    if (row.configured === false) {
-      out.skipped.push(provider);
-      continue;
-    }
-
-    let key = '';
-    try {
-      key = typeof store.rawKey === 'function' ? store.rawKey(provider) : '';
-    } catch (e) {
-      warn(`could not decrypt ${provider}'s stored key for the shared env file: ${e && e.message}`);
-      out.failed.push(provider);
-      continue;
-    }
-    if (!key) {
-      out.skipped.push(provider);
-      continue;
-    }
-
-    const res = mirrorProviderKeyToEnvFile(envFile, provider, key, opts);
-    if (res && res.ok) out.mirrored.push(provider);
-    else out.failed.push(provider);
-  }
-  return out;
-}
-
-/**
- * Wrap a provider-settings store so every key saved or removed through it is
- * also written to the shared env file.
- *
- * Wrapping the store (rather than each caller) is the whole point: the Settings
- * pane, the welcome flow's provider rows and any future caller all funnel
- * through `store.set` / `store.remove`, so there is exactly one place that can
- * forget to mirror — and this is it.
- *
- * @param {object} store    a settings store (settings.get/set/remove/list)
- * @param {object} envFile  client/env-file.js
- * @param {object} [opts]   `onWarn`, `envOpts` (see above)
- * @returns {object} the same store, wrapped
- */
-function wrapProviderKeyMirror(store, envFile, opts = {}) {
-  if (!store || typeof store.set !== 'function') return store;
-  const mirror = (provider, key) => mirrorProviderKeyToEnvFile(envFile, provider, key, opts);
-
-  const rawSet = store.set.bind(store);
-  const rawRemove = typeof store.remove === 'function' ? store.remove.bind(store) : null;
-
-  store.set = (provider, cfg) => {
-    const res = rawSet(provider, cfg);
-    // A row with no key is a base-URL/local-daemon row: there is no secret to
-    // share, and mirroring would write an empty variable into a file every host
-    // sources. `cfg.key` undefined OR empty both mean "no key supplied"
-    // (a blank field in the pane means "keep the stored one").
-    if (cfg && typeof cfg.key === 'string' && cfg.key) mirror(provider, cfg.key);
-    return res;
-  };
-
-  if (rawRemove) {
-    store.remove = (provider) => {
-      const res = rawRemove(provider);
-      mirror(provider, '');
-      return res;
-    };
-  }
-  return store;
-}
-
-module.exports = { mirrorProviderKeyToEnvFile, wrapProviderKeyMirror, backfillProviderKeys };
+"use strict";const RESERVED_PREFIX="__",KEY_VAR_SUFFIX=/_API_KEY$/;function mirrorProviderKeyToEnvFile(e,r,n,t={}){const o="function"==typeof t.onWarn?t.onWarn:()=>{},i=t.envOpts||{};if(!e||"function"!=typeof e.setEnvValue)return null;if("string"!=typeof r||!r)return null;if(r.startsWith(RESERVED_PREFIX))return null;const s="function"==typeof e.envVarFor?e.envVarFor(r):"";if(!s||!KEY_VAR_SUFFIX.test(s))return null;try{if(n)return e.setEnvValue(s,n,i);const t="function"==typeof e.keyStatus?e.keyStatus(s,i):null;return t&&t.inFile?"function"==typeof e.clearEnvValue?e.clearEnvValue(s,i):(i.env?delete i.env[s]:delete process.env[s],o(`removed ${r}'s key in the app, but ${s} is still in the shared env file — this build has no clearEnvValue; delete the line by hand`),null):null}catch(e){return o(`could not mirror ${r}'s key into the shared env file: ${e&&e.message}`),null}}function backfillProviderKeys(e,r,n={}){const t="function"==typeof n.onWarn?n.onWarn:()=>{},o=n.envOpts||{},i={mirrored:[],skipped:[],failed:[]};if(!e||"function"!=typeof e.list)return i;if(!r||"function"!=typeof r.envVarFor)return i;let s=[];try{s=e.list()||[]}catch(e){return t(`could not read the provider store to backfill the shared env file: ${e&&e.message}`),i}for(const u of s){const s=u&&u.provider;if("string"!=typeof s||!s)continue;if(s.startsWith(RESERVED_PREFIX))continue;const l=r.envVarFor(s);if(!l||!KEY_VAR_SUFFIX.test(l)){i.skipped.push(s);continue}if("function"==typeof r.isForeignSecret&&r.isForeignSecret(l)){i.skipped.push(s);continue}let f=null;try{f="function"==typeof r.keyStatus?r.keyStatus(l,o):null}catch{}if(f&&f.inFile){i.skipped.push(s);continue}if(!1===u.configured){i.skipped.push(s);continue}let c="";try{c="function"==typeof e.rawKey?e.rawKey(s):""}catch(e){t(`could not decrypt ${s}'s stored key for the shared env file: ${e&&e.message}`),i.failed.push(s);continue}if(!c){i.skipped.push(s);continue}const a=mirrorProviderKeyToEnvFile(r,s,c,n);a&&a.ok?i.mirrored.push(s):i.failed.push(s)}return i}function wrapProviderKeyMirror(e,r,n={}){if(!e||"function"!=typeof e.set)return e;const t=(e,t)=>mirrorProviderKeyToEnvFile(r,e,t,n),o=e.set.bind(e),i="function"==typeof e.remove?e.remove.bind(e):null;return e.set=(e,r)=>{const n=o(e,r);return r&&"string"==typeof r.key&&r.key&&t(e,r.key),n},i&&(e.remove=e=>{const r=i(e);return t(e,""),r}),e}module.exports={mirrorProviderKeyToEnvFile:mirrorProviderKeyToEnvFile,wrapProviderKeyMirror:wrapProviderKeyMirror,backfillProviderKeys:backfillProviderKeys};

package/lib/quick-launcher.js

@@ -1,86 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * quick-launcher.js — pure geometry + gating logic for the global quick-
- * launcher popup (native desktop plumbing). Mirrors desktop/lib/window-state.js:
- * no Electron import, so both functions unit-test without the Electron binary.
- * main.js wires the result into a BrowserWindow + globalShortcut; this module
- * only decides where the window should sit and whether the shortcut should be
- * registered at all.
- */
-
-/**
- * A global shortcut is a machine-wide hook — every packaged build ships it,
- * but a `npm start` dev run must NOT silently start grabbing a hotkey that
- * might collide with whatever else the developer has running, unless they've
- * explicitly opted in via the settings flag.
- */
-function shouldEnableGlobalShortcut({ isPackaged, enabled } = {}) {
-  return Boolean(isPackaged) || Boolean(enabled);
-}
-
-/**
- * Where the launcher window should land: centred on the cursor's current
- * position, clamped so the whole window stays within that cursor's display
- * work area (never straddling into an unplugged second monitor, never
- * hanging off a screen edge). Falls back to centring on the first available
- * display — or the given fallback rectangle — when there is no usable cursor
- * point or display list (e.g. a headless test).
- *
- * `cursor` / `displays` take the plain shapes electron.screen already
- * returns (`{x,y}` / `{workArea:{x,y,width,height}}`), so this stays pure and
- * Electron-free for testing, exactly like window-state.js's clampToDisplay.
- */
-function computeQuickLauncherBounds({ cursor, displays, size, fallback } = {}) {
-  const width = Math.max(1, (size && size.width) || 560);
-  const height = Math.max(1, (size && size.height) || 320);
-  const list = Array.isArray(displays) ? displays : [];
-  const point =
-    cursor && Number.isFinite(cursor.x) && Number.isFinite(cursor.y) ? cursor : null;
-
-  const containing = point
-    ? list.find((d) => {
-        const wa = d && d.workArea;
-        return (
-          wa &&
-          point.x >= wa.x &&
-          point.x < wa.x + wa.width &&
-          point.y >= wa.y &&
-          point.y < wa.y + wa.height
-        );
-      })
-    : null;
-
-  const target = containing || list[0] || null;
-  if (!target || !target.workArea) {
-    return {
-      x: (fallback && fallback.x) || 0,
-      y: (fallback && fallback.y) || 0,
-      width,
-      height,
-    };
-  }
-
-  const wa = target.workArea;
-  let x;
-  let y;
-  if (point) {
-    x = Math.round(point.x - width / 2);
-    y = Math.round(point.y - height / 2);
-  } else {
-    x = Math.round(wa.x + (wa.width - width) / 2);
-    y = Math.round(wa.y + (wa.height - height) / 2);
-  }
-
-  x = Math.min(Math.max(x, wa.x), Math.max(wa.x, wa.x + wa.width - width));
-  y = Math.min(Math.max(y, wa.y), Math.max(wa.y, wa.y + wa.height - height));
-
-  return { x, y, width, height };
-}
-
-module.exports = { shouldEnableGlobalShortcut, computeQuickLauncherBounds };
+"use strict";function shouldEnableGlobalShortcut({isPackaged:t,enabled:a}={}){return Boolean(t)||Boolean(a)}function computeQuickLauncherBounds({cursor:t,displays:a,size:h,fallback:e}={}){const u=Math.max(1,h&&h.width||560),n=Math.max(1,h&&h.height||320),o=Array.isArray(a)?a:[],r=t&&Number.isFinite(t.x)&&Number.isFinite(t.y)?t:null,i=r?o.find((t=>{const a=t&&t.workArea;return a&&r.x>=a.x&&r.x<a.x+a.width&&r.y>=a.y&&r.y<a.y+a.height})):null,l=i||o[0]||null;if(!l||!l.workArea)return{x:e&&e.x||0,y:e&&e.y||0,width:u,height:n};const c=l.workArea;let d,s;return r?(d=Math.round(r.x-u/2),s=Math.round(r.y-n/2)):(d=Math.round(c.x+(c.width-u)/2),s=Math.round(c.y+(c.height-n)/2)),d=Math.min(Math.max(d,c.x),Math.max(c.x,c.x+c.width-u)),s=Math.min(Math.max(s,c.y),Math.max(c.y,c.y+c.height-n)),{x:d,y:s,width:u,height:n}}module.exports={shouldEnableGlobalShortcut:shouldEnableGlobalShortcut,computeQuickLauncherBounds:computeQuickLauncherBounds};