aegis-desktop 1.0.13 → 1.0.15

package/lib/settings.js

@@ -1,892 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * settings.js — provider-config store for the desktop host (plan P1 §5.1).
- * Holds base URLs and provider keys in the main process only. Keys are
- * encrypted at rest via Electron safeStorage when available, otherwise stored
- * base64 (best-effort; never real security) — and only masked previews ever
- * cross the IPC bridge.
- *
- * The in-app AEGIS key lives in its own reserved namespace (AEGIS_KEY_NAMESPACE)
- * with dedicated accessors, so the provider CRUD surface — and the Settings
- * pane built on it — can never list it as a provider or remove it.
- *
- * Pure Node + injectable storage dir / safeStorage so it unit-tests without
- * an Electron binary.
- *
- * AEGISONE D5 splits this store in two, along the line the repo already drew
- * for sessions and credentials:
- *
- *   <userData>/settings.json          HOST-LOCAL — provider rows and the AEGIS key
- *                                     (`safeStorage` blobs a plain Node process
- *                                     cannot decrypt on Linux), plus machine/UI
- *                                     state. `SETTINGS_FILE`, below.
- *   $AEGISCODE_HOME/preferences.json  SHARED, NON-SECRET — the preferences both
- *                                     faces must agree about. Owned by
- *                                     `client/prefs.js`; `sharedDir` (an
- *                                     injectable seam, defaulting to
- *                                     `credentials.aegisHome()`) locates it.
- *
- * So `getSharedPref`/`setSharedPref` and the memory-persist preference read and
- * write the SHARED file, a legacy `<userData>` `__memoryPersist` namespace is
- * adopted once and then only read as a fallback, and everything key-bearing
- * stays here in `<userData>`. The shared store refuses key material outright
- * (`client/prefs.js` `assertNoSecrets`), which is what keeps the split honest.
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-
-// The shared, non-secret preference store (AEGISONE D5) and the data-dir
-// helper, resolved the same two ways lib/sync/sessions.js resolves the other
-// cross-host modules: in-repo `<repo>/client/*.js`, packaged
-// `desktop/vendor/*.js`. A missing module is a loud error rather than a second
-// implementation — the drift this arrangement exists to prevent.
-const prefs = (() => {
-  try {
-    return require('../../client/prefs.js');
-  } catch {
-    return require('../vendor/prefs.js');
-  }
-})();
-
-const credentials = (() => {
-  try {
-    return require('../../client/credentials.js');
-  } catch {
-    return require('../vendor/credentials.js');
-  }
-})();
-
-// The local-model transport. Required for ONE function: `remoteRefusal`, the
-// fail-closed check that keeps a non-local base URL out of the `local` row. The
-// module owns that policy so this store, the engine and the CLI cannot drift
-// about what "local" means — the failure mode a second implementation would
-// produce is one host refusing an unpaid turn while another served it.
-const localTransport = require('./local/local.js');
-
-/** The provider row the `local` class reads its base URL from. Not a reserved
- *  namespace: it is a legitimate config row, and `list()` reporting it is
- *  harmless because the byok rows are selected by their `byok:` prefix. */
-const LOCAL_NAMESPACE = 'local';
-
-const SETTINGS_FILE = 'settings.json';
-
-/**
- * Reserved namespace for the in-app AEGIS API key. It deliberately does NOT
- * look like a provider id: the provider-config surface (get/set/remove/list,
- * and therefore the Settings pane and the model: IPC) must never be able to
- * list it as a provider or delete it via "Remove" — that coupling is defect
- * #1 of the AEGIS-key wiring review (settings.set('aegis', …) used the same
- * namespace as user provider configs). Use the dedicated AEGIS accessors on
- * the store (setAegisKey / aegisRawKey / aegisKey) to touch it.
- */
-const AEGIS_KEY_NAMESPACE = '__aegis';
-
-/** Pre-fix builds persisted the AEGIS key as a plain provider named 'aegis';
- *  migrateLegacyAegisKey() relocates it (and list() hides it meanwhile). */
-const LEGACY_AEGIS_NAMESPACE = 'aegis';
-
-/** Reserved namespace for the global quick-launcher shortcut config
- *  ({ enabled, shortcut }) — app-level settings, not a provider, so it must
- *  stay out of the provider CRUD surface for the same reason the AEGIS key
- *  does (see AEGIS_KEY_NAMESPACE above). */
-const QUICK_LAUNCHER_NAMESPACE = '__quickLauncher';
-
-/** Default global shortcut: rare enough on both major platforms to avoid
- *  fighting existing app/OS bindings, memorable enough to type once. */
-const DEFAULT_QUICK_LAUNCHER_SHORTCUT = 'CmdOrCtrl+Shift+Space';
-
-/** Reserved namespace for where `fingerprint publish`/the vault card sends
- *  sealed records: `{ backend }`, one of VAULT_BACKEND_VALUES — app-level, not
- *  a provider, for the same reason the quick launcher isn't. Default is
- *  `aegiscloud` (unset reads as the default, same convention as confirm mode)
- *  because it is the only backend that exists on a fresh install — see
- *  client/record-vault.js's own DEFAULT_BACKEND. `drive` asks the fingerprint
- *  service to talk to rclone's `gdrive` remote instead (the user's own Drive,
- *  configured by them); `off` means publish/anchor/vault/audit refuse with a
- *  named reason rather than silently reaching either backend. */
-const VAULT_BACKEND_NAMESPACE = '__vaultBackend';
-const DEFAULT_VAULT_BACKEND = 'aegiscloud';
-const VAULT_BACKEND_VALUES = Object.freeze(['aegiscloud', 'drive', 'off']);
-
-/** Reserved namespace for the tool-call approval ("confirm mode") preference:
- *  `{ enabled }` — app-level, not a provider, so it stays out of the provider
- *  CRUD surface for the same reason the AEGIS key does. Default is ON
- *  (settings.getConfirmMode() === true when unset), which is the historical
- *  behaviour: exec/writeFile/editFile always asked for approval.
- *  NOTE: like the AEGIS key and the quick launcher, this lives in its own
- *  top-level namespace — never inside a provider's `cfg[provider]` object. */
-const CONFIRM_MODE_NAMESPACE = '__confirmMode';
-
-/** Reserved namespace for the persisting-memory preference: `{ enabled }` —
- *  app-level, not a provider. This is the desktop's counterpart to the CLI's
- *  `memoryPersist` config key, and the gate `lib/sync/persist-gate.js` reads
- *  before any automatic cloud push. Default is ON (an absent namespace means
- *  persistence is on, which is the shipped decision); an explicit `false` is
- *  what turns it off. Nothing secret lives here, so no encryption. */
-const MEMORY_PERSIST_NAMESPACE = '__memoryPersist';
-
-/** Reserved namespace for the avatar/companion preferences:
- *  `{ enabled, showLevel, motion }` — app-level, not a provider, so it stays out
- *  of the provider CRUD surface for the same reason the AEGIS key does. The
- *  persona itself is deliberately NOT stored here: it is a document, not a
- *  preference, and it lives at `<userData>/avatar/persona.json`, read and
- *  written by main through lib/avatar/store.js so a hand-edited or imported
- *  persona is validated on the way in.
- *  Defaults are the shipped behaviour: the avatar is ON, the level readout is
- *  shown, and motion follows the OS `prefers-reduced-motion` setting. */
-const AVATAR_NAMESPACE = '__avatar';
-
-/** Reserved namespace for the funnel-instrumentation opt-in: `{ enabled }` —
- *  app-level, not a provider. DEFAULT OFF (an absent namespace means nothing is
- *  recorded), which is the opposite of every other preference in this file and
- *  is the whole point: telemetry is opt-in, not opt-out. Read by
- *  main.js telemetryEnabled() through getTelemetryOptIn(). */
-const TELEMETRY_NAMESPACE = '__telemetry';
-
-/** Reserved namespace for the auto-drain switch:
- *  `{ enabled, intervalMs }` — app-level, not a provider.
- *
- *  DEFAULT ON (user request: the queue must work with no click and nothing on
- *  screen). An absent namespace means "drain in the background"; only an
- *  explicit `enabled: false` disarms it, and that is what the settings store
- *  writes when someone turns the worker off from the CLI or by hand.
- *
- *  The guards are what make that default defensible, and they live in
- *  `lib/auto.js`, not here: a tick skips when the queue is empty (so an idle
- *  install costs one JSON parse and no lock I/O), when another host holds the
- *  drain lock, when a drain is already in flight, and when the switch was
- *  turned off since the last tick — the switch is re-read on EVERY tick, so
- *  disarming stops the very next one. Nothing secret lives here, so no
- *  encryption — same shape as `__confirmMode`/`__memoryPersist` above. */
-const AUTO_DRAIN_NAMESPACE = '__autoDrain';
-
-/** Reserved namespace for the auto-mint (seal-on-quiet) switch:
- *  `{ enabled, publish }` — app-level, not a provider.
- *
- *  `enabled` is DEFAULT ON, same as auto-drain: a session seals itself once it
- *  has been quiet, with nothing on screen asking for it. Only an explicit
- *  `enabled: false` disarms it.
- *
- *  `publish` stays a separate, DEFAULT OFF switch: sealing writes a local
- *  record, whereas publishing sends those bytes to the vault over `rclone` and
- *  writes an anchor beside them. An automatic network copy is never implied by
- *  an automatic seal.
- *
- *  The AI half of the record resolves through the shared rungs in
- *  client/attest.js (`$AEGIS_AI_SECRET`/`$AEGIS_AI_MODEL` in the app scope) —
- *  this namespace deliberately does NOT hold a credential, because a settings
- *  file that can carry a provider key is a second place to leak one. */
-const AUTO_MINT_NAMESPACE = '__autoMint';
-
-/** How often an armed auto-drain looks at the queue. One minute is the
- *  compromise the two failure modes set: a shorter interval makes the desktop
- *  a busy-waiter over a file several hosts write (each tick stats the queue and
- *  the lock), and a longer one means a task queued in the card sits visibly
- *  idle. The worker does the rest of the waiting itself. */
-const AUTO_DRAIN_INTERVAL_DEFAULT_MS = 60_000;
-
-/** Floor for `intervalMs`. Below this the timer is a poll loop, not a drain
- *  cadence: nothing about a queue whose tasks take minutes to run changes
- *  fifteen times a second, and the tick does file I/O. */
-const AUTO_DRAIN_INTERVAL_MIN_MS = 15_000;
-
-/** Ceiling for `intervalMs` — half an hour. A hand-edited settings file asking
- *  for a day is a typo, not a preference. */
-const AUTO_DRAIN_INTERVAL_MAX_MS = 30 * 60_000;
-
-/** Reserved namespaces: the provider-config surface must never see or mutate
- *  any of these. The two automation switches are here for the SAME reason the
- *  others are — `set()`/`remove()`/`list()` operate on provider rows, and a
- *  preference parked in that namespace would be listed as a provider and
- *  deletable with "Remove". */
-const RESERVED_NAMESPACES = Object.freeze([
-  AEGIS_KEY_NAMESPACE,
-  LEGACY_AEGIS_NAMESPACE,
-  QUICK_LAUNCHER_NAMESPACE,
-  VAULT_BACKEND_NAMESPACE,
-  CONFIRM_MODE_NAMESPACE,
-  MEMORY_PERSIST_NAMESPACE,
-  AVATAR_NAMESPACE,
-  TELEMETRY_NAMESPACE,
-  AUTO_DRAIN_NAMESPACE,
-  AUTO_MINT_NAMESPACE,
-]);
-
-/** Motion modes the renderer understands (`system` = follow the OS). */
-const AVATAR_MOTION_MODES = Object.freeze(['system', 'full', 'minimal']);
-
-/** True for the AEGIS-key namespace(s) — provider CRUD must refuse these. */
-function isReservedNamespace(provider) {
-  return RESERVED_NAMESPACES.includes(provider);
-}
-
-/** Same masking shape as desktop/main.js so previews are consistent. */
-function maskKey(key) {
-  if (!key) return null;
-  if (key.length <= 10) return 'configured';
-  return `${key.slice(0, 9)}\u2026${key.slice(-4)}`;
-}
-
-const IS_WIN32 = process.platform === 'win32';
-
-/**
- * Restrict the settings file to the current user. POSIX enforces 0600 at the
- * kernel; Windows ignores POSIX modes entirely, so an equivalent ACL is applied
- * via icacls (inheritance removed, only the current user granted full control).
- * A failure is reported — never silently swallowed — because a credential file
- * that did not get restricted must not look like it did.
- */
-function restrictFile(file) {
-  if (IS_WIN32) {
-    const user = process.env.USERNAME || process.env.USER || process.env.USERDOMAIN;
-    if (!user) {
-      console.error(
-        `[settings] cannot restrict ${file}: no current user to grant (USERNAME unset)`
-      );
-      return;
-    }
-    try {
-      execFileSync('icacls', [file, '/inheritance:r', '/grant:r', `${user}:(F)`], {
-        stdio: 'ignore',
-      });
-    } catch (err) {
-      console.error(`[settings] failed to restrict ACL on ${file}: ${err.message}`);
-    }
-    return;
-  }
-  try {
-    fs.chmodSync(file, 0o600);
-  } catch (err) {
-    console.error(`[settings] failed to chmod ${file} to 0600: ${err.message}`);
-  }
-}
-
-function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
-  if (!dir) throw new Error('createSettingsStore requires a storage dir');
-  const file = path.join(dir, SETTINGS_FILE);
-
-  // --- the shared, non-secret preference store (AEGISONE D5) --------------
-  //
-  // `prefsDir` is the injectable seam (tests point it at a temp dir); the
-  // default is the same `$AEGISCODE_HOME` / `~/.aegiscode` directory the
-  // session store and the credential store already use, so an install has one
-  // answer to "where does this host keep its data".
-  const sharedDir = (() => {
-    const explicit = prefsDir === undefined || prefsDir === null ? '' : String(prefsDir).trim();
-    return explicit ? path.resolve(explicit) : credentials.aegisHome(env);
-  })();
-
-  // One-way, once, idempotent adoption of a pre-D5 `<userData>/settings.json`
-  // non-secret half (D5, step 2): an existing user's preference survives the
-  // upgrade. Best-effort — a store must still open when the legacy file is
-  // unreadable or the shared dir is unwritable.
-  const adoption = (() => {
-    try {
-      return prefs.adopt({ dir: sharedDir, legacyDir: dir });
-    } catch (err) {
-      // Best-effort, but NOT silent (AEGISONE ON8). Swallowing this throw is how
-      // `prefs.adopt()`'s refusal to write its own ledger went unnoticed — the
-      // migration failed for every install that had something to adopt, and the
-      // store reported a healthy `adopted: false`. A failed migration is a
-      // preference a user set that this launch did not honor, so it is reported
-      // where a developer will see it; a store must still open either way.
-      if (process.env.AEGISCODE_DEBUG || process.env.AEGIS_HIST_DEBUG) {
-        process.stderr.write(`aegis-desktop: shared-preference adoption failed: ${err.message}\n`);
-      }
-      return { adopted: false, keys: [], reason: `adoption failed: ${err.message}` };
-    }
-  })();
-
-  /** The shared preference file this store reads and writes (never a secret). */
-  function sharedFile() {
-    return prefs.prefsFile({ dir: sharedDir });
-  }
-
-  function loadShared() {
-    try {
-      return prefs.load({ dir: sharedDir });
-    } catch {
-      return {};
-    }
-  }
-
-  /**
-   * One shared preference, as the CLI's `config.js` stores it. Restricted to
-   * `SHARED_PREF_KEYS` — the window may read exactly the preferences the shell
-   * owns, not reach into arbitrary state in a file another host reads.
-   */
-  function getSharedPref(key) {
-    if (!prefs.SHARED_PREF_KEYS.includes(key)) {
-      throw new Error(`"${key}" is not a shared preference (see client/prefs.js SHARED_PREF_KEYS)`);
-    }
-    const value = loadShared()[key];
-    return value === undefined ? null : value;
-  }
-
-  /** Write one shared preference. Key material is refused by the store itself. */
-  function setSharedPref(key, value) {
-    if (!prefs.SHARED_PREF_KEYS.includes(key)) {
-      throw new Error(`"${key}" is not a shared preference (see client/prefs.js SHARED_PREF_KEYS)`);
-    }
-    prefs.set({ [key]: value }, { dir: sharedDir });
-    return getSharedPref(key);
-  }
-
-  const safeAvailable = () =>
-    Boolean(
-      safeStorage &&
-        typeof safeStorage.isEncryptionAvailable === 'function' &&
-        safeStorage.isEncryptionAvailable()
-    );
-
-  function encrypt(value) {
-    if (value == null) return null;
-    if (safeAvailable()) {
-      return safeStorage.encryptString(String(value)).toString('base64');
-    }
-    return Buffer.from(String(value), 'utf8').toString('base64');
-  }
-
-  function decrypt(value) {
-    if (!value) return null;
-    try {
-      const buf = Buffer.from(String(value), 'base64');
-      if (safeAvailable()) return safeStorage.decryptString(buf);
-      return buf.toString('utf8');
-    } catch {
-      return null;
-    }
-  }
-
-  function load() {
-    try {
-      return JSON.parse(fs.readFileSync(file, 'utf8')) || {};
-    } catch {
-      return {};
-    }
-  }
-
-  function save(data) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}`;
-    // 0600, written before the rename so the file is never briefly readable:
-    // this store holds provider keys, and both hosts are now able to write it
-    // (the CLI uses the same file, without Electron's safeStorage, so at-rest
-    // base64 is all the protection there is — file mode is the real control).
-    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
-    fs.renameSync(tmp, file);
-    restrictFile(file);
-  }
-
-  /** Provider CRUD must never touch a reserved (AEGIS-key) namespace. */
-  function assertNotReserved(provider) {
-    if (isReservedNamespace(provider)) {
-      throw new Error(
-        `reserved namespace "${provider}" is not a provider config — ` +
-          'use setAegisKey()/aegisRawKey() for the AEGIS key'
-      );
-    }
-  }
-
-  function get(provider) {
-    const cfg = (load()[provider]) || {};
-    const key = decrypt(cfg.key);
-    return {
-      provider,
-      baseURL: cfg.baseURL || '',
-      configured: Boolean(key),
-      keyMask: maskKey(key),
-    };
-  }
-
-  /**
-   * Write a provider row.
-   *
-   * The endpoint policy lives at this seam for exactly one namespace: `local`,
-   * the row holding the local model server's base URL. It is refused HERE so
-   * the unusable configuration cannot be created — a row that could never
-   * legally be dialed should not be persistable, because it would sit on disk
-   * looking like a working setup. The engine re-checks before every call as
-   * well (a file hand-edited after it was written cannot be spent either), so
-   * there are two gates for two failure modes.
-   *
-   * Every other row is a `byok:<provider>`, and those stay policy-free: they are
-   * remote by definition and reach their provider through AEGIS's relay, and the
-   * relay is what bills the turn — so a remote address there is correct rather
-   * than a misconfiguration. `baseURL` stays in the record shape for back-compat
-   * with rows already on disk.
-   */
-  function set(provider, { baseURL, key } = {}) {
-    assertNotReserved(provider);
-    let nextBaseURL = baseURL;
-    if (provider === LOCAL_NAMESPACE && baseURL) {
-      const refusal = localTransport.remoteRefusal(baseURL);
-      if (refusal) throw refusal;
-      // Persist the DIALABLE spelling, not the typed one: `localhost:11434` is
-      // how a user writes the address, and `http://localhost:11434` is what the
-      // probe and the chat call must dial (local.js `normalizeBase`, whose
-      // header explains why a scheme-less string is the common case rather than
-      // an edge one). Storing the raw form left every consumer to normalize for
-      // itself — and a consumer that forgot read the URL as a remote host.
-      nextBaseURL = localTransport.normalizeBase(baseURL);
-    }
-    const data = load();
-    const cfg = data[provider] || {};
-    if (nextBaseURL !== undefined) cfg.baseURL = nextBaseURL;
-    if (key !== undefined) cfg.key = key ? encrypt(key) : null;
-    data[provider] = cfg;
-    save(data);
-    return get(provider);
-  }
-
-  function rawKey(provider) {
-    const cfg = load()[provider] || {};
-    return decrypt(cfg.key);
-  }
-
-  function remove(provider) {
-    assertNotReserved(provider);
-    const data = load();
-    delete data[provider];
-    save(data);
-    return { ok: true };
-  }
-
-  /** Every provider config, never the AEGIS key (defect #1). */
-  function list() {
-    const data = load();
-    return Object.keys(data)
-      .filter((p) => !isReservedNamespace(p))
-      .map((p) => get(p));
-  }
-
-  // --- AEGIS key: separate namespace, separate accessors -------------------
-
-  function aegisKey() {
-    const cfg = load()[AEGIS_KEY_NAMESPACE] || {};
-    const key = decrypt(cfg.key);
-    return { configured: Boolean(key), keyMask: maskKey(key) };
-  }
-
-  /** Main-process-only: the decrypted AEGIS key. Never crosses IPC. */
-  function aegisRawKey() {
-    const cfg = load()[AEGIS_KEY_NAMESPACE] || {};
-    return decrypt(cfg.key);
-  }
-
-  /**
-   * When this host last wrote its own AEGIS key (ISO string, or null).
-   *
-   * The shared credential file records the same thing, and startup compares the
-   * two so the most recently saved key wins. Without a stamp the app cannot tell
-   * "I saved this last week" from "the user ran `aegiscode login` a minute ago
-   * with a rotated key", and would silently keep presenting the stale one.
-   */
-  function aegisKeySavedAt() {
-    const cfg = load()[AEGIS_KEY_NAMESPACE] || {};
-    return cfg.savedAt || null;
-  }
-
-  function setAegisKey(key) {
-    const data = load();
-    data[AEGIS_KEY_NAMESPACE] = {
-      ...(data[AEGIS_KEY_NAMESPACE] || {}),
-      key: key ? encrypt(key) : null,
-      savedAt: key ? new Date().toISOString() : null,
-    };
-    save(data);
-    return aegisKey();
-  }
-
-  /**
-   * Relocate a pre-fix `settings['aegis'].key` into the reserved namespace and
-   * drop the pseudo-provider entry. Moved at ciphertext level (no decrypt /
-   * re-encrypt), so it is safe to run before Electron's app 'ready' — when
-   * safeStorage is not usable yet. Idempotent; never throws.
-   */
-  function migrateLegacyAegisKey() {
-    try {
-      const data = load();
-      if (!data[LEGACY_AEGIS_NAMESPACE]) return { migrated: false };
-      const legacy = data[LEGACY_AEGIS_NAMESPACE] || {};
-      const current = data[AEGIS_KEY_NAMESPACE] || {};
-      const next = { ...data };
-      if (legacy.key && !current.key) {
-        next[AEGIS_KEY_NAMESPACE] = { ...current, key: legacy.key };
-      }
-      delete next[LEGACY_AEGIS_NAMESPACE];
-      save(next);
-      return { migrated: true };
-    } catch {
-      return { migrated: false };
-    }
-  }
-
-  // --- Quick launcher: reserved namespace, plain (unencrypted) config ------
-  // No secret lives here — just a bool and a shortcut string — so unlike the
-  // AEGIS key above there is nothing to encrypt/decrypt.
-
-  function quickLauncherConfig() {
-    const cfg = load()[QUICK_LAUNCHER_NAMESPACE] || {};
-    const shortcut =
-      typeof cfg.shortcut === 'string' && cfg.shortcut.trim()
-        ? cfg.shortcut.trim()
-        : DEFAULT_QUICK_LAUNCHER_SHORTCUT;
-    return { enabled: Boolean(cfg.enabled), shortcut };
-  }
-
-  function setQuickLauncherConfig({ enabled, shortcut } = {}) {
-    const data = load();
-    data[QUICK_LAUNCHER_NAMESPACE] = {
-      enabled: Boolean(enabled),
-      shortcut:
-        typeof shortcut === 'string' && shortcut.trim()
-          ? shortcut.trim()
-          : DEFAULT_QUICK_LAUNCHER_SHORTCUT,
-    };
-    save(data);
-    return quickLauncherConfig();
-  }
-
-  // --- Vault backend: reserved namespace, plain (unencrypted) preference ---
-  // No secret lives here either — just which of three named destinations a
-  // publish goes to — so like the quick launcher there is nothing to encrypt.
-
-  function vaultBackendConfig() {
-    const cfg = load()[VAULT_BACKEND_NAMESPACE] || {};
-    const backend = VAULT_BACKEND_VALUES.includes(cfg.backend) ? cfg.backend : DEFAULT_VAULT_BACKEND;
-    return { backend };
-  }
-
-  function setVaultBackendConfig(backend) {
-    if (!VAULT_BACKEND_VALUES.includes(backend)) return vaultBackendConfig();
-    const data = load();
-    data[VAULT_BACKEND_NAMESPACE] = { backend };
-    save(data);
-    return vaultBackendConfig();
-  }
-
-  // --- Confirm mode: SHARED preference (AEGISONE ON8, decision D8 rule 1) --
-  // "Confirm before running tools" — the switch for the renderer's tool-call
-  // approval gate (desktop/lib/local/engine.js gatedExecuteTool). ON (default,
-  // and the behaviour shipped so far) means every mutating tool call — exec /
-  // writeFile / editFile — is previewed and approved by the user first. OFF
-  // means the engine runs them straight through, like a tool the session
-  // already allowed. Nothing secret is stored here, so no encryption.
-  //
-  // This preference MOVED to the shared store (`confirmMode`) because D8 rule 1
-  // is "one posture, two faces": a rule set in the window has to be the rule the
-  // shell honors. The pre-ON8 `__confirmMode` namespace in `<userData>` is
-  // adopted once (client/prefs.js `extractNonSecretHalf`) and still read as a
-  // fallback, never written — a second writer is the split-brain this replaced.
-  // The gate's polarity is unchanged: ON when unset, in both places, so an
-  // install that never touched the switch keeps the gate exactly as it was.
-
-  function confirmModeState() {
-    const shared = loadShared();
-    if (typeof shared.confirmMode === 'boolean') {
-      return { enabled: shared.confirmMode, source: 'config' };
-    }
-    const cfg = load()[CONFIRM_MODE_NAMESPACE] || {};
-    if (cfg.enabled === undefined) return { enabled: true, source: 'default' };
-    return { enabled: Boolean(cfg.enabled), source: 'config' };
-  }
-
-  function getConfirmMode() {
-    return confirmModeState().enabled;
-  }
-
-  function setConfirmMode(enabled) {
-    prefs.set({ confirmMode: Boolean(enabled) }, { dir: sharedDir });
-    // One-way: retire the legacy copy in the same breath, so the posture exists
-    // in exactly one place from here on (the same retirement the memory-persist
-    // preference below does).
-    const data = load();
-    if (data[CONFIRM_MODE_NAMESPACE] !== undefined) {
-      delete data[CONFIRM_MODE_NAMESPACE];
-      save(data);
-    }
-    // The boolean, not the state record: main.js's IPC reply is `{ enabled }`
-    // and it wraps the return value itself, so widening this would have put an
-    // object inside an object on the wire.
-    return confirmModeState().enabled;
-  }
-
-  // --- Telemetry: reserved namespace, plain preference, DEFAULT OFF --------
-  // The opt-in flag for the funnel instrumentation (Phase 2 of
-  // docs/upgrade-conversion-plan.md; the store itself is
-  // lib/local/telemetry.js). Unlike confirm mode, the absent case is FALSE:
-  // nothing is recorded until someone says so, either here or through
-  // `AEGIS_TELEMETRY=1` (main.js telemetryEnabled() reads both, env first).
-  // The flag only says "may this install record its own two prompt events to
-  // its own userData"; the records stay anonymous either way — see the header
-  // of lib/local/telemetry.js for what a record may contain.
-
-  function getTelemetryOptIn() {
-    const cfg = load()[TELEMETRY_NAMESPACE] || {};
-    return cfg.enabled === true;
-  }
-
-  function setTelemetryOptIn(enabled) {
-    const data = load();
-    data[TELEMETRY_NAMESPACE] = { enabled: Boolean(enabled) };
-    save(data);
-    return getTelemetryOptIn();
-  }
-
-  // --- Persisting memory: SHARED preference (AEGISONE D5) -----------------
-  // The desktop's half of "persisting memory for every account": whether a
-  // finished turn is pushed to cloud memory automatically. ON when unset —
-  // an install that never touched the toggle behaves like cli/, whose
-  // `memoryPersist` also defaults to on. `memoryPersistState()` reports the
-  // SOURCE as well as the value so "off" and "never set" stay distinguishable.
-  //
-  // This preference is the seam D5 closes: it lives in the SHARED store under
-  // the shell's own key (`memoryPersist`), so `/cloud memory off` in the
-  // terminal and the Settings toggle in the window are one value, not two that
-  // can disagree. The pre-D5 `__memoryPersist` namespace in `<userData>` is
-  // adopted once (above) and still read as a fallback, never written — a second
-  // writer is exactly the split-brain this replaced. lib/sync/persist-gate.js
-  // reads the same shared key straight off disk, in the main process, and the
-  // two must agree on the default.
-
-  function getMemoryPersist() {
-    return memoryPersistState().enabled;
-  }
-
-  /** `{ enabled, source }` — mirrors cli/src/cloudsync.js memoryPersistState(). */
-  function memoryPersistState() {
-    const shared = loadShared();
-    if (typeof shared.memoryPersist === 'boolean') {
-      return { enabled: shared.memoryPersist, source: 'config' };
-    }
-    // Pre-D5 install, or one whose adoption had nothing to move: the legacy
-    // namespace still answers until the first write retires it.
-    const cfg = load()[MEMORY_PERSIST_NAMESPACE] || {};
-    if (cfg.enabled === undefined) return { enabled: true, source: 'default' };
-    return { enabled: Boolean(cfg.enabled), source: 'config' };
-  }
-
-  function setMemoryPersist(enabled) {
-    prefs.set({ memoryPersist: Boolean(enabled) }, { dir: sharedDir });
-    // One-way: drop the legacy copy in the same breath so the preference exists
-    // in exactly one place from here on (the same retirement
-    // cli/src/config.js's setMemoryPersist() does for the pre-flip `cloudSync`).
-    const data = load();
-    if (data[MEMORY_PERSIST_NAMESPACE] !== undefined) {
-      delete data[MEMORY_PERSIST_NAMESPACE];
-      save(data);
-    }
-    return memoryPersistState();
-  }
-
-  // --- Avatar: reserved namespace, plain preferences ------------
-  // The companion's on/off switch, its level readout, and its motion mode.
-  // Nothing secret lives here, so no encryption — same reasoning as the quick
-  // launcher and memory-persist namespaces above.
-  //
-  // Deliberately narrow: `setAvatar()` stores only these three known keys, so a
-  // renderer (or a hand-edited settings.json) cannot park arbitrary state — a
-  // persona document, a capability override — in a namespace main reads back.
-  // The persona is a separate, validated file (lib/avatar/store.js) for exactly
-  // that reason.
-
-  function getAvatar() {
-    const cfg = load()[AVATAR_NAMESPACE] || {};
-    return {
-      // Unset === true: the companion ships on; an explicit `false` is the only
-      // thing that turns it off (and it must survive a reload).
-      enabled: cfg.enabled === undefined ? true : Boolean(cfg.enabled),
-      showLevel: cfg.showLevel === undefined ? true : Boolean(cfg.showLevel),
-      motion: AVATAR_MOTION_MODES.includes(cfg.motion) ? cfg.motion : 'system',
-    };
-  }
-
-  /** `{ ...preferences, source }` — mirrors memoryPersistState() so "off" and
-   *  "never set" stay distinguishable in the UI and in tests. */
-  function avatarState() {
-    const cfg = load()[AVATAR_NAMESPACE] || {};
-    return {
-      ...getAvatar(),
-      source: cfg.enabled === undefined ? 'default' : 'config',
-    };
-  }
-
-  /** Partial merge of the three known keys. Unknown keys are dropped, not saved. */
-  function setAvatar(patch = {}) {
-    const current = getAvatar();
-    const p = patch && typeof patch === 'object' ? patch : {};
-    const next = {
-      enabled: p.enabled === undefined ? current.enabled : Boolean(p.enabled),
-      showLevel: p.showLevel === undefined ? current.showLevel : Boolean(p.showLevel),
-      motion: AVATAR_MOTION_MODES.includes(p.motion) ? p.motion : current.motion,
-    };
-    const data = load();
-    data[AVATAR_NAMESPACE] = next;
-    save(data);
-    return avatarState();
-  }
-
-  // --- Auto-drain / auto-mint: reserved namespaces, DEFAULT OFF ------------
-  // The two opt-in automations (lib/auto.js). Both live in their own top-level
-  // namespace, both are booted OFF, and both keep the "off" and "never set"
-  // cases distinguishable through a `source` field — the same shape
-  // memoryPersistState()/avatarState() use above, for the same reason: a UI
-  // that cannot tell "you turned it off" from "this build never had it" shows
-  // the wrong sentence after an upgrade.
-  //
-  // `intervalMs` is clamped rather than trusted: it comes back through IPC from
-  // a renderer and off disk from a hand-edited file, and a timer is the one
-  // place where a hostile or fat-fingered number costs real CPU.
-
-  /** A usable tick interval, or the default. Out-of-range reads as unset. */
-  function clampAutoDrainInterval(value) {
-    const n = Number(value);
-    if (!Number.isFinite(n)) return AUTO_DRAIN_INTERVAL_DEFAULT_MS;
-    const ms = Math.round(n);
-    if (ms < AUTO_DRAIN_INTERVAL_MIN_MS || ms > AUTO_DRAIN_INTERVAL_MAX_MS) {
-      return AUTO_DRAIN_INTERVAL_DEFAULT_MS;
-    }
-    return ms;
-  }
-
-  function getAutoDrain() {
-    const cfg = load()[AUTO_DRAIN_NAMESPACE] || {};
-    return {
-      // Unset === TRUE. The queue drains in the background unless someone
-      // switched it off in as many words; `lib/auto.js` re-reads this on every
-      // tick, so that off switch stops the very next one.
-      enabled: cfg.enabled !== false,
-      intervalMs: clampAutoDrainInterval(cfg.intervalMs),
-    };
-  }
-
-  function autoDrainState() {
-    const cfg = load()[AUTO_DRAIN_NAMESPACE] || {};
-    return {
-      ...getAutoDrain(),
-      source: cfg.enabled === undefined ? 'default' : 'config',
-    };
-  }
-
-  function setAutoDrain(patch = {}) {
-    const current = getAutoDrain();
-    const p = patch && typeof patch === 'object' ? patch : {};
-    const data = load();
-    data[AUTO_DRAIN_NAMESPACE] = {
-      enabled: p.enabled === undefined ? current.enabled : Boolean(p.enabled),
-      intervalMs:
-        p.intervalMs === undefined
-          ? current.intervalMs
-          : clampAutoDrainInterval(p.intervalMs),
-    };
-    save(data);
-    return autoDrainState();
-  }
-
-  function getAutoMint() {
-    const cfg = load()[AUTO_MINT_NAMESPACE] || {};
-    return {
-      // Unset === TRUE (background sealing). `publish` below stays opt-in.
-      enabled: cfg.enabled !== false,
-      // Independent of `enabled` on purpose: an automatic seal must not drag
-      // an automatic upload along with it.
-      publish: cfg.publish === true,
-    };
-  }
-
-  function autoMintState() {
-    const cfg = load()[AUTO_MINT_NAMESPACE] || {};
-    return {
-      ...getAutoMint(),
-      source: cfg.enabled === undefined ? 'default' : 'config',
-    };
-  }
-
-  function setAutoMint(patch = {}) {
-    const current = getAutoMint();
-    const p = patch && typeof patch === 'object' ? patch : {};
-    const data = load();
-    data[AUTO_MINT_NAMESPACE] = {
-      enabled: p.enabled === undefined ? current.enabled : Boolean(p.enabled),
-      publish: p.publish === undefined ? current.publish : Boolean(p.publish),
-    };
-    save(data);
-    return autoMintState();
-  }
-
-  return {
-    file,
-    sharedDir,
-    adoption,
-    sharedFile,
-    getSharedPref,
-    setSharedPref,
-    get,
-    set,
-    rawKey,
-    remove,
-    list,
-    maskKey,
-    aegisKey,
-    aegisRawKey,
-    aegisKeySavedAt,
-    setAegisKey,
-    migrateLegacyAegisKey,
-    quickLauncherConfig,
-    setQuickLauncherConfig,
-    vaultBackendConfig,
-    setVaultBackendConfig,
-    getConfirmMode,
-    setConfirmMode,
-    confirmModeState,
-    getTelemetryOptIn,
-    setTelemetryOptIn,
-    getMemoryPersist,
-    memoryPersistState,
-    setMemoryPersist,
-    getAvatar,
-    avatarState,
-    setAvatar,
-    getAutoDrain,
-    autoDrainState,
-    setAutoDrain,
-    getAutoMint,
-    autoMintState,
-    setAutoMint,
-    clampAutoDrainInterval,
-  };
-}
-
-module.exports = {
-  SETTINGS_FILE,
-  AEGIS_KEY_NAMESPACE,
-  LEGACY_AEGIS_NAMESPACE,
-  QUICK_LAUNCHER_NAMESPACE,
-  VAULT_BACKEND_NAMESPACE,
-  CONFIRM_MODE_NAMESPACE,
-  MEMORY_PERSIST_NAMESPACE,
-  AVATAR_NAMESPACE,
-  TELEMETRY_NAMESPACE,
-  AUTO_DRAIN_NAMESPACE,
-  AUTO_MINT_NAMESPACE,
-  AUTO_DRAIN_INTERVAL_DEFAULT_MS,
-  AUTO_DRAIN_INTERVAL_MIN_MS,
-  AUTO_DRAIN_INTERVAL_MAX_MS,
-  AVATAR_MOTION_MODES,
-  DEFAULT_QUICK_LAUNCHER_SHORTCUT,
-  DEFAULT_VAULT_BACKEND,
-  VAULT_BACKEND_VALUES,
-  RESERVED_NAMESPACES,
-  isReservedNamespace,
-  maskKey,
-  createSettingsStore,
-};
+"use strict";const fs=require("node:fs"),path=require("node:path"),{execFileSync:execFileSync}=require("node:child_process"),prefs=(()=>{try{return require("../../client/prefs.js")}catch{return require("../vendor/prefs.js")}})(),credentials=(()=>{try{return require("../../client/credentials.js")}catch{return require("../vendor/credentials.js")}})(),localTransport=require("./local/local.js"),LOCAL_NAMESPACE="local",SETTINGS_FILE="settings.json",AEGIS_KEY_NAMESPACE="__aegis",LEGACY_AEGIS_NAMESPACE="aegis",QUICK_LAUNCHER_NAMESPACE="__quickLauncher",DEFAULT_QUICK_LAUNCHER_SHORTCUT="CmdOrCtrl+Shift+Space",VAULT_BACKEND_NAMESPACE="__vaultBackend",DEFAULT_VAULT_BACKEND="aegiscloud",VAULT_BACKEND_VALUES=Object.freeze(["aegiscloud","drive","off"]),CONFIRM_MODE_NAMESPACE="__confirmMode",MEMORY_PERSIST_NAMESPACE="__memoryPersist",AVATAR_NAMESPACE="__avatar",TELEMETRY_NAMESPACE="__telemetry",AUTO_DRAIN_NAMESPACE="__autoDrain",AUTO_MINT_NAMESPACE="__autoMint",AUTO_DRAIN_INTERVAL_DEFAULT_MS=6e4,AUTO_DRAIN_INTERVAL_MIN_MS=15e3,AUTO_DRAIN_INTERVAL_MAX_MS=18e5,RESERVED_NAMESPACES=Object.freeze(["__aegis","aegis","__quickLauncher","__vaultBackend","__confirmMode","__memoryPersist","__avatar","__telemetry","__autoDrain","__autoMint"]),AVATAR_MOTION_MODES=Object.freeze(["system","full","minimal"]);function isReservedNamespace(e){return RESERVED_NAMESPACES.includes(e)}function maskKey(e){return e?e.length<=10?"configured":`${e.slice(0,9)}…${e.slice(-4)}`:null}const IS_WIN32="win32"===process.platform;function restrictFile(e){if(IS_WIN32){const t=process.env.USERNAME||process.env.USER||process.env.USERDOMAIN;if(!t)return void console.error(`[settings] cannot restrict ${e}: no current user to grant (USERNAME unset)`);try{execFileSync("icacls",[e,"/inheritance:r","/grant:r",`${t}:(F)`],{stdio:"ignore"})}catch(t){console.error(`[settings] failed to restrict ACL on ${e}: ${t.message}`)}}else try{fs.chmodSync(e,384)}catch(t){console.error(`[settings] failed to chmod ${e} to 0600: ${t.message}`)}}function createSettingsStore({dir:e,safeStorage:t,prefsDir:n,env:r}={}){if(!e)throw new Error("createSettingsStore requires a storage dir");const o=path.join(e,SETTINGS_FILE),i=(()=>{const e=null==n?"":String(n).trim();return e?path.resolve(e):credentials.aegisHome(r)})(),s=(()=>{try{return prefs.adopt({dir:i,legacyDir:e})}catch(e){return(process.env.AEGISCODE_DEBUG||process.env.AEGIS_HIST_DEBUG)&&process.stderr.write(`aegis-desktop: shared-preference adoption failed: ${e.message}\n`),{adopted:!1,keys:[],reason:`adoption failed: ${e.message}`}}})();function a(){try{return prefs.load({dir:i})}catch{return{}}}function c(e){if(!prefs.SHARED_PREF_KEYS.includes(e))throw new Error(`"${e}" is not a shared preference (see client/prefs.js SHARED_PREF_KEYS)`);const t=a()[e];return void 0===t?null:t}const u=()=>Boolean(t&&"function"==typeof t.isEncryptionAvailable&&t.isEncryptionAvailable());function _(e){return null==e?null:u()?t.encryptString(String(e)).toString("base64"):Buffer.from(String(e),"utf8").toString("base64")}function l(e){if(!e)return null;try{const n=Buffer.from(String(e),"base64");return u()?t.decryptString(n):n.toString("utf8")}catch{return null}}function d(){try{return JSON.parse(fs.readFileSync(o,"utf8"))||{}}catch{return{}}}function A(e){fs.mkdirSync(path.dirname(o),{recursive:!0});const t=`${o}.tmp-${process.pid}`;fs.writeFileSync(t,JSON.stringify(e,null,2),{mode:384}),fs.renameSync(t,o),restrictFile(o)}function f(e){if(isReservedNamespace(e))throw new Error(`reserved namespace "${e}" is not a provider config — use setAegisKey()/aegisRawKey() for the AEGIS key`)}function E(e){const t=d()[e]||{},n=l(t.key);return{provider:e,baseURL:t.baseURL||"",configured:Boolean(n),keyMask:maskKey(n)}}function S(){const e=l((d().__aegis||{}).key);return{configured:Boolean(e),keyMask:maskKey(e)}}function m(){const e=d().__quickLauncher||{},t="string"==typeof e.shortcut&&e.shortcut.trim()?e.shortcut.trim():"CmdOrCtrl+Shift+Space";return{enabled:Boolean(e.enabled),shortcut:t}}function M(){const e=d().__vaultBackend||{};return{backend:VAULT_BACKEND_VALUES.includes(e.backend)?e.backend:"aegiscloud"}}function g(){const e=a();if("boolean"==typeof e.confirmMode)return{enabled:e.confirmMode,source:"config"};const t=d().__confirmMode||{};return void 0===t.enabled?{enabled:!0,source:"default"}:{enabled:Boolean(t.enabled),source:"config"}}function y(){return!0===(d().__telemetry||{}).enabled}function N(){const e=a();if("boolean"==typeof e.memoryPersist)return{enabled:e.memoryPersist,source:"config"};const t=d().__memoryPersist||{};return void 0===t.enabled?{enabled:!0,source:"default"}:{enabled:Boolean(t.enabled),source:"config"}}function p(){const e=d().__avatar||{};return{enabled:void 0===e.enabled||Boolean(e.enabled),showLevel:void 0===e.showLevel||Boolean(e.showLevel),motion:AVATAR_MOTION_MODES.includes(e.motion)?e.motion:"system"}}function v(){const e=d().__avatar||{};return{...p(),source:void 0===e.enabled?"default":"config"}}function b(e){const t=Number(e);if(!Number.isFinite(t))return 6e4;const n=Math.round(t);return n<15e3||n>18e5?6e4:n}function T(){const e=d().__autoDrain||{};return{enabled:!1!==e.enabled,intervalMs:b(e.intervalMs)}}function R(){const e=d().__autoDrain||{};return{...T(),source:void 0===e.enabled?"default":"config"}}function C(){const e=d().__autoMint||{};return{enabled:!1!==e.enabled,publish:!0===e.publish}}function h(){const e=d().__autoMint||{};return{...C(),source:void 0===e.enabled?"default":"config"}}return{file:o,sharedDir:i,adoption:s,sharedFile:function(){return prefs.prefsFile({dir:i})},getSharedPref:c,setSharedPref:function(e,t){if(!prefs.SHARED_PREF_KEYS.includes(e))throw new Error(`"${e}" is not a shared preference (see client/prefs.js SHARED_PREF_KEYS)`);return prefs.set({[e]:t},{dir:i}),c(e)},get:E,set:function(e,{baseURL:t,key:n}={}){f(e);let r=t;if("local"===e&&t){const e=localTransport.remoteRefusal(t);if(e)throw e;r=localTransport.normalizeBase(t)}const o=d(),i=o[e]||{};return void 0!==r&&(i.baseURL=r),void 0!==n&&(i.key=n?_(n):null),o[e]=i,A(o),E(e)},rawKey:function(e){return l((d()[e]||{}).key)},remove:function(e){f(e);const t=d();return delete t[e],A(t),{ok:!0}},list:function(){const e=d();return Object.keys(e).filter((e=>!isReservedNamespace(e))).map((e=>E(e)))},maskKey:maskKey,aegisKey:S,aegisRawKey:function(){return l((d().__aegis||{}).key)},aegisKeySavedAt:function(){return(d().__aegis||{}).savedAt||null},setAegisKey:function(e){const t=d();return t.__aegis={...t.__aegis||{},key:e?_(e):null,savedAt:e?(new Date).toISOString():null},A(t),S()},migrateLegacyAegisKey:function(){try{const e=d();if(!e.aegis)return{migrated:!1};const t=e.aegis||{},n=e.__aegis||{},r={...e};return t.key&&!n.key&&(r.__aegis={...n,key:t.key}),delete r.aegis,A(r),{migrated:!0}}catch{return{migrated:!1}}},quickLauncherConfig:m,setQuickLauncherConfig:function({enabled:e,shortcut:t}={}){const n=d();return n.__quickLauncher={enabled:Boolean(e),shortcut:"string"==typeof t&&t.trim()?t.trim():"CmdOrCtrl+Shift+Space"},A(n),m()},vaultBackendConfig:M,setVaultBackendConfig:function(e){if(!VAULT_BACKEND_VALUES.includes(e))return M();const t=d();return t.__vaultBackend={backend:e},A(t),M()},getConfirmMode:function(){return g().enabled},setConfirmMode:function(e){prefs.set({confirmMode:Boolean(e)},{dir:i});const t=d();return void 0!==t.__confirmMode&&(delete t.__confirmMode,A(t)),g().enabled},confirmModeState:g,getTelemetryOptIn:y,setTelemetryOptIn:function(e){const t=d();return t.__telemetry={enabled:Boolean(e)},A(t),y()},getMemoryPersist:function(){return N().enabled},memoryPersistState:N,setMemoryPersist:function(e){prefs.set({memoryPersist:Boolean(e)},{dir:i});const t=d();return void 0!==t.__memoryPersist&&(delete t.__memoryPersist,A(t)),N()},getAvatar:p,avatarState:v,setAvatar:function(e={}){const t=p(),n=e&&"object"==typeof e?e:{},r={enabled:void 0===n.enabled?t.enabled:Boolean(n.enabled),showLevel:void 0===n.showLevel?t.showLevel:Boolean(n.showLevel),motion:AVATAR_MOTION_MODES.includes(n.motion)?n.motion:t.motion},o=d();return o.__avatar=r,A(o),v()},getAutoDrain:T,autoDrainState:R,setAutoDrain:function(e={}){const t=T(),n=e&&"object"==typeof e?e:{},r=d();return r.__autoDrain={enabled:void 0===n.enabled?t.enabled:Boolean(n.enabled),intervalMs:void 0===n.intervalMs?t.intervalMs:b(n.intervalMs)},A(r),R()},getAutoMint:C,autoMintState:h,setAutoMint:function(e={}){const t=C(),n=e&&"object"==typeof e?e:{},r=d();return r.__autoMint={enabled:void 0===n.enabled?t.enabled:Boolean(n.enabled),publish:void 0===n.publish?t.publish:Boolean(n.publish)},A(r),h()},clampAutoDrainInterval:b}}module.exports={SETTINGS_FILE:SETTINGS_FILE,AEGIS_KEY_NAMESPACE:"__aegis",LEGACY_AEGIS_NAMESPACE:"aegis",QUICK_LAUNCHER_NAMESPACE:"__quickLauncher",VAULT_BACKEND_NAMESPACE:"__vaultBackend",CONFIRM_MODE_NAMESPACE:"__confirmMode",MEMORY_PERSIST_NAMESPACE:"__memoryPersist",AVATAR_NAMESPACE:"__avatar",TELEMETRY_NAMESPACE:"__telemetry",AUTO_DRAIN_NAMESPACE:"__autoDrain",AUTO_MINT_NAMESPACE:"__autoMint",AUTO_DRAIN_INTERVAL_DEFAULT_MS:6e4,AUTO_DRAIN_INTERVAL_MIN_MS:15e3,AUTO_DRAIN_INTERVAL_MAX_MS:18e5,AVATAR_MOTION_MODES:AVATAR_MOTION_MODES,DEFAULT_QUICK_LAUNCHER_SHORTCUT:"CmdOrCtrl+Shift+Space",DEFAULT_VAULT_BACKEND:"aegiscloud",VAULT_BACKEND_VALUES:VAULT_BACKEND_VALUES,RESERVED_NAMESPACES:RESERVED_NAMESPACES,isReservedNamespace:isReservedNamespace,maskKey:maskKey,createSettingsStore:createSettingsStore};