aegis-desktop 1.0.13 → 1.0.15

package/vendor/authorship-key.js

@@ -1,412 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * authorship-key.js — the key half of φ(α): keygen, and where `--secret` comes
- * from.
- *
- * `client/fingerprint.js` is the vendored engine module and answers "is this
- * record intact?". With the *public* covenant hash as key, that answer is
- * "intact, and by the way anyone holding the covenant can also forge it" —
- * integrity, not authorship. This file is the other half of that sentence: a
- * private key under the user's own directory, at mode 600, that no one else
- * has, so a valid record means "minted by whoever holds this key".
- *
- * ## The ladder (`resolveKey`)
- *
- *   1. `--secret <file>` (alias `--secret-file`, the engine's name)
- *   2. `AEGIS_FINGERPRINT_SECRET` in the environment
- *   3. `$AEGIS_HOME/keys/authorship.key` — the same path `keygen` writes
- *   4. nothing: refuse, and say which command mints one.
- *
- * Step 4 is where this deliberately *diverges* from the engine. The engine's
- * last rung is the published covenant hash, which keeps its tools runnable with
- * no setup at all. Here an unconfigured host gets an error instead, because the
- * plugin's records are meant to travel — a plugin record that silently keyed
- * itself to a public constant would verify on every covenant holder's machine,
- * which reads as authorship to everyone who did not look up how it was keyed.
- * A caller who genuinely wants the engine's public mode says so explicitly:
- * `--public --covenant <file>`, and that mode is labelled on every record it
- * mints (`keySource` in the tool output, never inside the HMAC body — see
- * below).
- *
- * ## What never happens
- *
- * The raw secret is never printed, never returned in a plain-object field that
- * a `console.log` would surface, and never written anywhere but the key file.
- * `keygen` returns a *derived* fingerprint — `keyFingerprint(secret)` from the
- * vendored module, i.e. `sha256('aegiscode-agent-v1\n' + secret)[0:12]`, the
- * same 12 hex the avatar registry indexes by — so a human can confirm two
- * machines hold the same key without either machine revealing it. The
- * derivation is spelled out here because the engine's own comment calls it a
- * bare `sha256(secret)`, which it is not; the code is the contract, and both
- * host tests re-derive the formula rather than trusting either description.
- *
- * Mode 600 is enforced twice on purpose: `fs.writeFileSync`'s `mode` is masked
- * by the process umask, so passing it is not the same as getting it. The write
- * is followed by an explicit `chmodSync` and a re-`stat` that throws if the
- * result is not 0600 — a key that lands 644 must fail the operation, not warn
- * about it. Both `resolveKey` and `backup` refuse a file that is group- or
- * other-readable (any bit of 0o077); a secret the filesystem will hand to
- * another user is not a secret. On Windows there is no POSIX mode to check, so
- * the guarantee there is the directory (0700 under the user's profile) rather
- * than the file — stated here because the tests can only assert the POSIX half.
- *
- * No privilege is involved anywhere: `node:fs`/`node:crypto` under `$HOME`, and
- * one `git check-ignore` spawn in `backup` that is bounded and failure-tolerant.
- */
-
-const crypto = require('node:crypto');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-
-const fp = require('./fingerprint.js');
-
-/** 0600 — owner read/write only. Enforced after the write, and re-checked. */
-const KEY_FILE_MODE = 0o600;
-const DIR_MODE = 0o700;
-
-/** Any of these bits set means the file is readable by someone else. */
-const GROUP_OTHER_BITS = 0o077;
-
-/** 32 random bytes, base64url: 256 bits, matching the engine's keygen exactly. */
-const KEY_BYTES = 32;
-
-const SECRET_ENV = 'AEGIS_FINGERPRINT_SECRET';
-const HOME_ENV = 'AEGIS_HOME';
-const KEY_FILENAME = 'authorship.key';
-
-const isWin = process.platform === 'win32';
-
-// ---------------------------------------------------------------------------
-// paths
-// ---------------------------------------------------------------------------
-
-/** `$AEGIS_HOME`, else `~/.aegiscode` — the plugin's private store. */
-function dataDir(env = process.env) {
-  const home = env[HOME_ENV];
-  if (home && String(home).trim()) return path.resolve(String(home).trim());
-  return path.join(os.homedir(), '.aegiscode');
-}
-
-/** Where `keygen` writes with no `--out`, and the ladder's third rung. */
-function defaultKeyPath(env = process.env) {
-  return path.join(dataDir(env), 'keys', KEY_FILENAME);
-}
-
-function modeOf(file) {
-  return fs.statSync(file).mode & 0o777;
-}
-
-function modeString(mode) {
-  return mode.toString(8).padStart(3, '0');
-}
-
-/**
- * Refuse a secret file that other users can read.
- *
- * Not a warning: `resolveKey` has already chosen this file, so continuing means
- * minting records under a key the filesystem publishes. The message names the
- * one-line fix, because the alternative fix a user reaches for first — deleting
- * the key and starting over — orphans every record already minted under it.
- */
-function assertPrivate(file) {
-  if (isWin) return; // no POSIX mode; the directory is the boundary (see header)
-  const mode = modeOf(file);
-  if (mode & GROUP_OTHER_BITS) {
-    throw new Error(
-      `authorship-key: ${file} is mode ${modeString(mode)} — a secret file must not be ` +
-        `group/other readable. chmod 600 ${file}`,
-    );
-  }
-}
-
-/** A key file is one line of base64url. Anything else is not one. */
-function readSecretFile(file) {
-  const raw = fs.readFileSync(file, 'utf8');
-  const secret = raw.replace(/\r?\n$/, '');
-  if (!secret.trim()) throw new Error(`authorship-key: ${file} is empty`);
-  if (/\s/.test(secret.trim())) {
-    throw new Error(`authorship-key: ${file} holds more than one line — not a key file`);
-  }
-  return secret.trim();
-}
-
-// ---------------------------------------------------------------------------
-// argv
-// ---------------------------------------------------------------------------
-
-/**
- * `--secret` and `--secret-file` are the same flag. The engine spells it
- * `--secret-file`; the plugin's docs and the request that produced this module
- * both say `--secret`. Accepting one name and rejecting the other would be a
- * parse error where a user means the same thing, so both are read here — once,
- * in the shared module, so the CLI and the desktop cannot disagree about it.
- */
-function flag(argv, name, fallback = null) {
-  const names = name === '--secret' ? ['--secret', '--secret-file'] : [name];
-  for (const n of names) {
-    const i = argv.indexOf(n);
-    if (i !== -1 && argv[i + 1] !== undefined && !argv[i + 1].startsWith('--')) return argv[i + 1];
-  }
-  return fallback;
-}
-
-function hasFlag(argv, name) {
-  const names = name === '--secret' ? ['--secret', '--secret-file'] : [name];
-  return names.some((n) => argv.includes(n));
-}
-
-// ---------------------------------------------------------------------------
-// the ladder
-// ---------------------------------------------------------------------------
-
-/**
- * Resolve the key to mint/verify with.
- *
- * @returns {{secret: string|null, source: string, public: boolean, path: string|null}}
- *          `secret: null` means "no key configured" — the caller decides whether
- *          that is a refusal (mint/verify) or an ordinary unconfigured state
- *          (status), exactly as presence does with a missing API key.
- */
-function resolveKey(o = {}) {
-  const argv = o.argv || [];
-  const env = o.env || process.env;
-
-  const file = flag(argv, '--secret');
-  if (file) {
-    if (!fs.existsSync(file)) throw new Error(`authorship-key: no such secret file: ${file}`);
-    assertPrivate(file);
-    return { secret: readSecretFile(file), source: file, public: false, path: file };
-  }
-
-  if (hasFlag(argv, '--public')) {
-    // Explicit public mode, and only with the document that defines the key.
-    const covenant = flag(argv, '--covenant');
-    if (!covenant) {
-      throw new Error(
-        'authorship-key: --public requires --covenant <file> — the public key IS the ' +
-          "covenant document's hash, so it cannot be assumed",
-      );
-    }
-    if (!fs.existsSync(covenant)) {
-      throw new Error(`authorship-key: no such covenant file: ${covenant}`);
-    }
-    const secret = crypto.createHash('sha256').update(fs.readFileSync(covenant)).digest('hex');
-    return { secret, source: `covenant (public): ${covenant}`, public: true, path: null };
-  }
-
-  const envSecret = env[SECRET_ENV];
-  if (envSecret && String(envSecret).trim()) {
-    return { secret: String(envSecret).trim(), source: SECRET_ENV, public: false, path: null };
-  }
-
-  const def = defaultKeyPath(env);
-  if (fs.existsSync(def)) {
-    assertPrivate(def);
-    return { secret: readSecretFile(def), source: def, public: false, path: def };
-  }
-
-  return { secret: null, source: null, public: false, path: null };
-}
-
-// ---------------------------------------------------------------------------
-// keygen
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a private key.
- *
- * `--out F` chooses the path (default `$AEGIS_HOME/keys/authorship.key`);
- * `--force` overwrites an existing one. Without `--force` an existing key is an
- * error, never a silent replacement: overwriting the key orphans every record
- * ever minted under it, and the loss is invisible until someone verifies an old
- * record. Replacing a key is a deliberate act, so it is a flag.
- *
- * @returns {{out: string, created: boolean, replaced: boolean,
- *            keyFingerprint: string, bytes: number, secretPrinted: false, mode: string}}
- */
-/**
- * Write a secret to `file`, creating its parent directory, and translate the
- * filesystem errnos a user actually hits into a sentence that names the fix.
- *
- * `keygen` is the first command a new install runs, and its failure mode on a
- * locked-down or full disk used to be the bare kernel message — `EACCES:
- * permission denied, open '/home/u/.aegiscode/keys/authorship.key'`. That says
- * what broke and not what to do, and the remedy is not guessable from it: the
- * unwritable thing is the *directory*, which the path in the message never
- * names. Found by the `unwritable-home` usertest profile, which reported it
- * three times across as many commits before it was treated as a defect.
- *
- * Only the three errnos with an unambiguous remedy are rewritten. Everything
- * else propagates untouched — inventing advice for an errno we do not recognise
- * would be worse than the errno.
- */
-function writeSecret(file, secret) {
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true, mode: DIR_MODE });
-    fs.writeFileSync(file, secret + '\n', { mode: KEY_FILE_MODE });
-  } catch (e) {
-    const errno = e && e.code;
-    const dir = path.dirname(file);
-    if (errno === 'EACCES' || errno === 'EPERM') {
-      throw new Error(
-        `authorship-key: cannot write ${file} — ${dir} is not writable by this user (${errno}). ` +
-          `Fix it with:  chmod u+rwx ${dir}`,
-      );
-    }
-    if (errno === 'EROFS') {
-      throw new Error(
-        `authorship-key: cannot write ${file} — ${dir} is on a read-only filesystem (EROFS). ` +
-          'Point --out (or $AEGIS_HOME) at a writable location.',
-      );
-    }
-    if (errno === 'ENOSPC') {
-      throw new Error(`authorship-key: cannot write ${file} — the disk is full (ENOSPC).`);
-    }
-    throw e;
-  }
-}
-
-function keygen(o = {}) {
-  const argv = o.argv || [];
-  const env = o.env || process.env;
-  const out = path.resolve(flag(argv, '--out') || defaultKeyPath(env));
-  const force = hasFlag(argv, '--force') || o.force === true;
-
-  const exists = fs.existsSync(out);
-  if (exists && !force) {
-    throw new Error(`authorship-key: ${out} already exists — pass --force to replace it`);
-  }
-  if (exists && !isWin) {
-    // Replacing a key that is itself world-readable is how a *second* party
-    // ends up holding the old one; refuse rather than rotate on top of it.
-    assertPrivate(out);
-  }
-
-  const secret = crypto.randomBytes(KEY_BYTES).toString('base64url');
-  writeSecret(out, secret);
-  // writeFileSync's mode is ANDed with the complement of the umask, so a 0022
-  // umask turns 0600 into 0644 and the call still "succeeds". Set it outright.
-  fs.chmodSync(out, KEY_FILE_MODE);
-  if (!isWin) {
-    const mode = modeOf(out);
-    if (mode !== KEY_FILE_MODE) {
-      throw new Error(
-        `authorship-key: ${out} landed mode ${modeString(mode)}, expected 600 — refusing to ` +
-          'report success for a key another user may be able to read',
-      );
-    }
-  }
-
-  // Read it back: a key that does not survive the round trip is worse than no
-  // key, because the fingerprint below would name something unrecoverable.
-  const readBack = readSecretFile(out);
-  if (readBack !== secret) throw new Error(`authorship-key: ${out} does not read back as written`);
-
-  return {
-    out,
-    created: !exists,
-    replaced: exists,
-    keyFingerprint: fp.keyFingerprint(secret),
-    bytes: KEY_BYTES,
-    secretPrinted: false,
-    mode: isWin ? 'n/a' : modeString(modeOf(out)),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// backup
-// ---------------------------------------------------------------------------
-
-function git(args, cwd) {
-  try {
-    return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-  } catch {
-    return null;
-  }
-}
-
-function insideGitTree(dir) {
-  return git(['rev-parse', '--is-inside-work-tree'], dir) === 'true\n';
-}
-
-/**
- * Copy the key to a destination that is not inside a git working tree, unless
- * the destination is covered by that repo's `.gitignore`.
- *
- * The check exists because the failure it prevents is unrecoverable in the
- * wrong direction: a key committed once is public forever, and rotating it does
- * not un-publish it. `--allow-git` is the escape hatch for a user who has
- * deliberately encrypted or otherwise protected the destination.
- */
-function backup(o = {}) {
-  const argv = o.argv || [];
-  const env = o.env || process.env;
-  const to = flag(argv, '--to');
-  if (!to) throw new Error('authorship-key: backup requires --to DIR');
-
-  const from = flag(argv, '--secret') || defaultKeyPath(env);
-  if (!fs.existsSync(from)) throw new Error(`authorship-key: no key at ${from} — run keygen first`);
-  assertPrivate(from);
-
-  const destDir = path.resolve(to);
-
-  const name = flag(argv, '--name') || path.basename(from);
-  const dest = path.join(destDir, name);
-
-  if (insideGitTree(destDir) && !hasFlag(argv, '--allow-git') && !o.allowGit) {
-    const ignored = git(['check-ignore', '-q', dest], destDir);
-    if (ignored === null) {
-      throw new Error(
-        `authorship-key: ${dest} is inside a git working tree and is not gitignored — ` +
-          'a committed key cannot be un-published. Add it to .gitignore, choose another ' +
-          '--to, or pass --allow-git if you know the destination is protected',
-      );
-    }
-  }
-
-  const secret = readSecretFile(from);
-  writeSecret(dest, secret);
-  fs.chmodSync(dest, KEY_FILE_MODE);
-  if (!isWin && modeOf(dest) !== KEY_FILE_MODE) {
-    throw new Error(`authorship-key: ${dest} landed mode ${modeString(modeOf(dest))}, expected 600`);
-  }
-  if (readSecretFile(dest) !== secret) {
-    throw new Error(`authorship-key: ${dest} does not read back as the same key`);
-  }
-
-  return {
-    from,
-    to: dest,
-    keyFingerprint: fp.keyFingerprint(secret),
-    matchesSource: true,
-    secretPrinted: false,
-  };
-}
-
-module.exports = {
-  KEY_FILE_MODE,
-  DIR_MODE,
-  GROUP_OTHER_BITS,
-  KEY_BYTES,
-  SECRET_ENV,
-  HOME_ENV,
-  KEY_FILENAME,
-  dataDir,
-  defaultKeyPath,
-  assertPrivate,
-  readSecretFile,
-  flag,
-  hasFlag,
-  resolveKey,
-  keygen,
-  backup,
-  modeString,
-};
+"use strict";const crypto=require("node:crypto"),fs=require("node:fs"),os=require("node:os"),path=require("node:path"),{execFileSync:execFileSync}=require("node:child_process"),fp=require("./fingerprint.js"),KEY_FILE_MODE=384,DIR_MODE=448,GROUP_OTHER_BITS=63,KEY_BYTES=32,SECRET_ENV="AEGIS_FINGERPRINT_SECRET",HOME_ENV="AEGIS_HOME",KEY_FILENAME="authorship.key",isWin="win32"===process.platform;function dataDir(e=process.env){const r=e[HOME_ENV];return r&&String(r).trim()?path.resolve(String(r).trim()):path.join(os.homedir(),".aegiscode")}function defaultKeyPath(e=process.env){return path.join(dataDir(e),"keys",KEY_FILENAME)}function modeOf(e){return 511&fs.statSync(e).mode}function modeString(e){return e.toString(8).padStart(3,"0")}function assertPrivate(e){if(isWin)return;const r=modeOf(e);if(r&GROUP_OTHER_BITS)throw new Error(`authorship-key: ${e} is mode ${modeString(r)} — a secret file must not be group/other readable. chmod 600 ${e}`)}function readSecretFile(e){const r=fs.readFileSync(e,"utf8").replace(/\r?\n$/,"");if(!r.trim())throw new Error(`authorship-key: ${e} is empty`);if(/\s/.test(r.trim()))throw new Error(`authorship-key: ${e} holds more than one line — not a key file`);return r.trim()}function flag(e,r,t=null){const i="--secret"===r?["--secret","--secret-file"]:[r];for(const r of i){const t=e.indexOf(r);if(-1!==t&&void 0!==e[t+1]&&!e[t+1].startsWith("--"))return e[t+1]}return t}function hasFlag(e,r){return("--secret"===r?["--secret","--secret-file"]:[r]).some((r=>e.includes(r)))}function resolveKey(e={}){const r=e.argv||[],t=e.env||process.env,i=flag(r,"--secret");if(i){if(!fs.existsSync(i))throw new Error(`authorship-key: no such secret file: ${i}`);return assertPrivate(i),{secret:readSecretFile(i),source:i,public:!1,path:i}}if(hasFlag(r,"--public")){const e=flag(r,"--covenant");if(!e)throw new Error("authorship-key: --public requires --covenant <file> — the public key IS the covenant document's hash, so it cannot be assumed");if(!fs.existsSync(e))throw new Error(`authorship-key: no such covenant file: ${e}`);return{secret:crypto.createHash("sha256").update(fs.readFileSync(e)).digest("hex"),source:`covenant (public): ${e}`,public:!0,path:null}}const o=t[SECRET_ENV];if(o&&String(o).trim())return{secret:String(o).trim(),source:SECRET_ENV,public:!1,path:null};const n=defaultKeyPath(t);return fs.existsSync(n)?(assertPrivate(n),{secret:readSecretFile(n),source:n,public:!1,path:n}):{secret:null,source:null,public:!1,path:null}}function writeSecret(e,r){try{fs.mkdirSync(path.dirname(e),{recursive:!0,mode:DIR_MODE}),fs.writeFileSync(e,r+"\n",{mode:KEY_FILE_MODE})}catch(r){const t=r&&r.code,i=path.dirname(e);if("EACCES"===t||"EPERM"===t)throw new Error(`authorship-key: cannot write ${e} — ${i} is not writable by this user (${t}). Fix it with:  chmod u+rwx ${i}`);if("EROFS"===t)throw new Error(`authorship-key: cannot write ${e} — ${i} is on a read-only filesystem (EROFS). Point --out (or $AEGIS_HOME) at a writable location.`);if("ENOSPC"===t)throw new Error(`authorship-key: cannot write ${e} — the disk is full (ENOSPC).`);throw r}}function keygen(e={}){const r=e.argv||[],t=e.env||process.env,i=path.resolve(flag(r,"--out")||defaultKeyPath(t)),o=hasFlag(r,"--force")||!0===e.force,n=fs.existsSync(i);if(n&&!o)throw new Error(`authorship-key: ${i} already exists — pass --force to replace it`);n&&!isWin&&assertPrivate(i);const s=crypto.randomBytes(32).toString("base64url");if(writeSecret(i,s),fs.chmodSync(i,KEY_FILE_MODE),!isWin){const e=modeOf(i);if(e!==KEY_FILE_MODE)throw new Error(`authorship-key: ${i} landed mode ${modeString(e)}, expected 600 — refusing to report success for a key another user may be able to read`)}if(readSecretFile(i)!==s)throw new Error(`authorship-key: ${i} does not read back as written`);return{out:i,created:!n,replaced:n,keyFingerprint:fp.keyFingerprint(s),bytes:32,secretPrinted:!1,mode:isWin?"n/a":modeString(modeOf(i))}}function git(e,r){try{return execFileSync("git",e,{cwd:r,encoding:"utf8",stdio:["ignore","pipe","ignore"]})}catch{return null}}function insideGitTree(e){return"true\n"===git(["rev-parse","--is-inside-work-tree"],e)}function backup(e={}){const r=e.argv||[],t=e.env||process.env,i=flag(r,"--to");if(!i)throw new Error("authorship-key: backup requires --to DIR");const o=flag(r,"--secret")||defaultKeyPath(t);if(!fs.existsSync(o))throw new Error(`authorship-key: no key at ${o} — run keygen first`);assertPrivate(o);const n=path.resolve(i),s=flag(r,"--name")||path.basename(o),a=path.join(n,s);if(insideGitTree(n)&&!hasFlag(r,"--allow-git")&&!e.allowGit&&null===git(["check-ignore","-q",a],n))throw new Error(`authorship-key: ${a} is inside a git working tree and is not gitignored — a committed key cannot be un-published. Add it to .gitignore, choose another --to, or pass --allow-git if you know the destination is protected`);const c=readSecretFile(o);if(writeSecret(a,c),fs.chmodSync(a,KEY_FILE_MODE),!isWin&&modeOf(a)!==KEY_FILE_MODE)throw new Error(`authorship-key: ${a} landed mode ${modeString(modeOf(a))}, expected 600`);if(readSecretFile(a)!==c)throw new Error(`authorship-key: ${a} does not read back as the same key`);return{from:o,to:a,keyFingerprint:fp.keyFingerprint(c),matchesSource:!0,secretPrinted:!1}}module.exports={KEY_FILE_MODE:KEY_FILE_MODE,DIR_MODE:DIR_MODE,GROUP_OTHER_BITS:GROUP_OTHER_BITS,KEY_BYTES:32,SECRET_ENV:SECRET_ENV,HOME_ENV:HOME_ENV,KEY_FILENAME:KEY_FILENAME,dataDir:dataDir,defaultKeyPath:defaultKeyPath,assertPrivate:assertPrivate,readSecretFile:readSecretFile,flag:flag,hasFlag:hasFlag,resolveKey:resolveKey,keygen:keygen,backup:backup,modeString:modeString};

package/vendor/auto-provision.js

@@ -1,136 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * Auto-provision a free aegis1 device key when a host finds no key configured
- * anywhere (env, the shared 0600 store, legacy config.json). One
- * implementation shared by every host (MCP plugin, desktop, CLI) — see
- * client/credentials.js's own header for why that matters here: three copies
- * of the same timeout/endpoint/save logic is how they drift.
- *
- * Calls aegis1's `POST /api/v1/auth/register-device` (see client/aegis.js's
- * `registerDevice`), idempotent per machine fingerprint (client/
- * device-fingerprint.js) so a wiped credential store still resolves back to
- * the same account rather than minting a new, unfunded one.
- *
- * As of aegis1 commit 4372830, a brand-new fingerprint (first call ever for
- * this machine) is granted the 30-day welcome-trial `unlimited` entitlement
- * server-side — a token-bank credit (UNLIMITED_CLOUD_ALLOWANCE_MICROS) and a
- * time-boxed `unlimited` row in `subscriptions` — in the SAME request that
- * mints the key, not a separate step this client has to ask for. is_pro()'s
- * pool gate and the BYOK fee waiver both see that grant immediately. This
- * comment previously said the account "starts at ZERO balance" and "only
- * unblocks BYOK" — that described pre-4372830 behavior and was stale; see
- * services/billing_service.py's is_pro()/is_unlimited() docstrings on the
- * aegis1 side for the current contract. A re-registration of an already-known
- * fingerprint (the idempotent path) does NOT re-grant the trial — it only
- * happens once per machine, ever.
- */
-const { machineFingerprint } = require('./device-fingerprint.js');
-
-const DEVICE_REGISTER_TIMEOUT_MS = 8000;
-const DEVICE_REGISTER_RETRY_DELAYS_MS = [1000, 3000];
-
-// Network failure, timeout (status 0), 408, or 5xx. A 4xx — including 429, the
-// server's per-IP registration cap — is a refusal, and retrying it only spends
-// more of that cap.
-function isTransientRegisterError(err) {
-  const status = err && err.status;
-  return !status || status === 408 || status >= 500;
-}
-
-// Why automatic registration gave up, in words a host can show the user.
-function provisionFailureText(result) {
-  const err = result && result.error;
-  if (!err) return 'the server returned no account key';
-  if (err.status === 429) return 'too many sign-ups from this network — try again later';
-  if (err.status >= 500) return `aegiscloud.org failed to register this device: ${err.message}`;
-  if (isTransientRegisterError(err)) return 'could not reach aegiscloud.org';
-  return `the server refused the request (HTTP ${err.status})`;
-}
-
-// What to say about the welcome trial after a successful registration — or ''
-// when there is nothing worth saying. Shared by every host so the CLI's two
-// notice sites and the desktop cannot describe the same outcome in three
-// different ways, which is how the reused case went unmentioned for so long.
-//
-// The two clauses are mutually exclusive in practice (the server only sends
-// `trial_granted: false` on the new-fingerprint path, and `reused_account` only
-// on the idempotent one) but `reusedAccount` is checked first: if they ever
-// collide, "you already have this account" is the true statement, and a
-// throttling claim would be a lie about a machine that was never throttled.
-function trialOutcomeNote(result) {
-  if (result && result.reusedAccount) {
-    return '. This machine was already registered, so it got its existing account back — the welcome trial is granted once per machine, ever, and was not granted again. A fresh trial needs a new sign-up, not a new key.';
-  }
-  if (result && result.trialGranted === false) {
-    return '. The welcome trial was withheld this hour (too many new devices from this network)';
-  }
-  return '';
-}
-
-/**
- * @param {object} aegisClient A client from client/aegis.js (createClient()).
- * @param {object} credentials client/credentials.js (or a compatible double).
- * @param {{app?: string, retryDelaysMs?: number[]}} [options] `app` names the host
- *   for the server's presence panel; `retryDelaysMs` waits before each retry of a
- *   transient failure.
- * @returns {Promise<{ok: boolean, key: string, trialGranted?: boolean, reusedAccount?: boolean, error?: Error}>}
- *   `ok` is true only when a usable key was obtained AND persisted to the
- *   shared store; `aegisClient.setApiKey()` has already been called on
- *   success, so the caller's client is immediately usable either way it
- *   inspects `ok`. `trialGranted` is false when the server withheld the
- *   welcome trial (the account and key are still valid).
- *
- *   `reusedAccount` is the third outcome, and the one that used to be
- *   indistinguishable from a plain first install: this fingerprint was already
- *   registered, so aegis1 handed back the SAME account (aegis1 commit 2e2bd85
- *   added the `reused_account` field for exactly this). No trial is granted on
- *   that path and none can be — the welcome credit is once per machine, ever —
- *   and the server deliberately OMITS `trial_granted` there rather than
- *   sending false, so `trialGranted` stays `undefined`. Hosts must therefore
- *   branch on `reusedAccount`, not on `trialGranted`: reading an absent
- *   `trial_granted` as "not reused" is what left a wiped credential store
- *   showing a first-install notice over a returning account.
- */
-async function autoProvisionApiKey(aegisClient, credentials, options = {}) {
-  if (Array.isArray(options)) {
-    throw new TypeError('autoProvisionApiKey takes { app, retryDelaysMs }; a bare retry array is no longer accepted');
-  }
-  if (aegisClient.apiKey) return { ok: true, key: aegisClient.apiKey };
-  const { app, retryDelaysMs = DEVICE_REGISTER_RETRY_DELAYS_MS } = options;
-  let lastError = null;
-  for (let attempt = 0; attempt <= retryDelaysMs.length; attempt++) {
-    if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, retryDelaysMs[attempt - 1]));
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), DEVICE_REGISTER_TIMEOUT_MS);
-    try {
-      const data = await aegisClient.registerDevice(machineFingerprint(), { app, signal: controller.signal });
-      const key = data && typeof data.api_key === 'string' ? data.api_key.trim() : '';
-      if (!key) return { ok: false, key: '' };
-      const saved = credentials.saveApiKey(key);
-      aegisClient.setApiKey(key);
-      // `=== true` on purpose: an older aegis1 that predates `reused_account`
-      // sends nothing, and unknown must not read as reused.
-      return { ok: !!saved.ok, key, trialGranted: data.trial_granted, reusedAccount: data.reused_account === true };
-    } catch (err) {
-      lastError = err;
-      if (!isTransientRegisterError(err)) break;
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  return { ok: false, key: '', error: lastError };
-}
-
-module.exports = {
-  autoProvisionApiKey,
-  provisionFailureText,
-  trialOutcomeNote,
-  DEVICE_REGISTER_TIMEOUT_MS,
-  DEVICE_REGISTER_RETRY_DELAYS_MS,
-};
+"use strict";const{machineFingerprint:machineFingerprint}=require("./device-fingerprint.js"),DEVICE_REGISTER_TIMEOUT_MS=8e3,DEVICE_REGISTER_RETRY_DELAYS_MS=[1e3,3e3];function isTransientRegisterError(e){const r=e&&e.status;return!r||408===r||r>=500}function provisionFailureText(e){const r=e&&e.error;return r?429===r.status?"too many sign-ups from this network — try again later":r.status>=500?`aegiscloud.org failed to register this device: ${r.message}`:isTransientRegisterError(r)?"could not reach aegiscloud.org":`the server refused the request (HTTP ${r.status})`:"the server returned no account key"}function trialOutcomeNote(e){return e&&e.reusedAccount?". This machine was already registered, so it got its existing account back — the welcome trial is granted once per machine, ever, and was not granted again. A fresh trial needs a new sign-up, not a new key.":e&&!1===e.trialGranted?". The welcome trial was withheld this hour (too many new devices from this network)":""}async function autoProvisionApiKey(e,r,t={}){if(Array.isArray(t))throw new TypeError("autoProvisionApiKey takes { app, retryDelaysMs }; a bare retry array is no longer accepted");if(e.apiKey)return{ok:!0,key:e.apiKey};const{app:i,retryDelaysMs:n=DEVICE_REGISTER_RETRY_DELAYS_MS}=t;let o=null;for(let t=0;t<=n.length;t++){t>0&&await new Promise((e=>setTimeout(e,n[t-1])));const a=new AbortController,s=setTimeout((()=>a.abort()),8e3);try{const t=await e.registerDevice(machineFingerprint(),{app:i,signal:a.signal}),n=t&&"string"==typeof t.api_key?t.api_key.trim():"";if(!n)return{ok:!1,key:""};const o=r.saveApiKey(n);return e.setApiKey(n),{ok:!!o.ok,key:n,trialGranted:t.trial_granted,reusedAccount:!0===t.reused_account}}catch(e){if(o=e,!isTransientRegisterError(e))break}finally{clearTimeout(s)}}return{ok:!1,key:"",error:o}}module.exports={autoProvisionApiKey:autoProvisionApiKey,provisionFailureText:provisionFailureText,trialOutcomeNote:trialOutcomeNote,DEVICE_REGISTER_TIMEOUT_MS:8e3,DEVICE_REGISTER_RETRY_DELAYS_MS:DEVICE_REGISTER_RETRY_DELAYS_MS};