aegis-desktop 1.0.13 → 1.0.15

package/vendor/prefs.js

@@ -1,353 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * prefs.js — the ONE shared, non-secret preference store (AEGISONE, decision
- * D5: "one store for preferences; secrets stay where the OS can decrypt them").
- *
- * Both faces read and write this file:
- *
- *   the window  desktop/lib/settings.js   (the memory-persist preference, and the
- *                                          CLI-key accessors `getSharedPref`/
- *                                          `setSharedPref` the store exposes)
- *   the shell   cli/src/config.js         (theme, model/class pin, effort, vim,
- *                                          memoryPersist)
- *
- * and `desktop/lib/sync/persist-gate.js` reads it directly, in the main process,
- * before it opens a socket.
- *
- * WHY A THIRD FILE, when the repo already has credentials.json and sessions.json
- * in the same directory: those two are a *secret* store and a *content* store.
- * This one is neither. Splitting the desktop's single `<userData>/settings.json`
- * along the line D5 already drew for sessions and credentials is what makes the
- * split honest:
- *
- *   $AEGISCODE_HOME/preferences.json   non-secret preferences (this file)
- *   <userData>/settings.json           host-local: `safeStorage` blobs (a plain
- *                                      Node process, i.e. the CLI, cannot decrypt
- *                                      those on Linux) + machine/UI state
- *
- * The boundary is enforced, not documented: `set()` refuses to write anything
- * that looks like key material (`scanForSecrets`/`assertNoSecrets` below), so a
- * caller that tries to park an API key in the shared store gets a thrown error
- * rather than a plaintext secret in a file the other host reads. A preference
- * store that *can* carry a key is a second place to leak one; this one cannot.
- *
- * Adoption of a pre-unification `<userData>/settings.json` is one-way, once and
- * idempotent — the pattern `client/session-store.js` already proves and
- * `test/shared-store.test.mjs` property D already asserts. There is no merge
- * loop and no last-writer-wins ping-pong: shared values are never copied back
- * into the legacy file, and a second adoption attempt is refused.
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-// The data dir is defined once, in the shared credential module — the same rule
-// cli/src/config.js and desktop/lib/sync/sessions.js follow, so the two faces
-// cannot drift about where the store lives (`$AEGISCODE_HOME`, else
-// `~/.aegiscode`).
-const { aegisHome } = require('./credentials.js');
-
-const PREFS_FILE = 'preferences.json';
-const PREFS_VERSION = 1;
-
-/**
- * The non-secret preference keys the shell's `config.js` keeps in the shared
- * store (everything else in its config — `updateCheck`, `lastCwd`, a legacy
- * `provider`/`baseURL` row — stays in `config.json`, which is host-local).
- *
- * This list is also the access-control list for the desktop's generic
- * `getSharedPref`/`setSharedPref`, so the window can read exactly the
- * preferences the shell owns and not reach into anyone else's state.
- */
-const SHARED_PREF_KEYS = Object.freeze([
-  'themeIndex',
-  'model',
-  'modelClass',
-  'currentModelId',
-  'models',
-  'effort',
-  'vim',
-  'memoryPersist',
-  // ON8 / D8 rule 1: the confirmation gate is a POSTURE, not a surface. The
-  // window's "confirm before running tools" switch and the shell's rule set
-  // answer the same question ("may this call run unattended?"), so the switch
-  // lives beside the rules that gate answers, in the one store both hosts read.
-  'confirmMode',
-]);
-
-/**
- * The legacy desktop namespace D5 retires: `<userData>/settings.json`'s
- * `__memoryPersist: { enabled }` becomes the shared store's `memoryPersist`
- * boolean — the shell's own spelling (`cli/src/config.js` `MEMORY_PERSIST_KEY`),
- * so one preference has one representation instead of two that could disagree.
- */
-const LEGACY_MEMORY_PERSIST_NAMESPACE = '__memoryPersist';
-
-/**
- * The second legacy namespace this store retires (ON8): the window's
- * `__confirmMode: { enabled }` becomes the shared `confirmMode` boolean. Same
- * rule, same reason as memory-persist above — and it is the one that closes
- * D8's rule 1 in the direction that used to be impossible: a posture set in
- * the window is now the posture the shell reads.
- */
-const LEGACY_CONFIRM_MODE_NAMESPACE = '__confirmMode';
-
-/**
- * Key names that mean "secret" wherever they appear in the tree. Deliberately
- * conservative: `keyMask`-style *previews* never reach this file (they are not
- * preferences), and no legitimate preference is named `token`/`secret`/`auth`.
- */
-const SECRET_KEY_RE =
-  /(^|[^a-z0-9])(api[_-]?key|apikey|key|keys|token|secret|password|passwd|credential|credentials|authorization|bearer|private[_-]?key|access[_-]?key|session[_-]?key)([^a-z0-9]|$)/i;
-
-/**
- * Values that are key material whatever they are called. Every shape here is a
- * real prefix this product's hosts mint or accept: AEGIS Cloud keys
- * (`aegis_…`), OpenAI/BYOK keys (`sk-…`), GitHub/Anthropic strings (`ghp_`,
- * `sk-ant-…`), JWTs (`eyJ…`, which is what an OAuth-ish provider returns), and
- * a bare long base64 blob (which is what Electron's `safeStorage` ciphertext —
- * and a base64-encoded key, the exact fallback `settings.js` uses when
- * `safeStorage` is unavailable — looks like).
- */
-const SECRET_VALUE_RES = [
-  /\baegis_[A-Za-z0-9_\-]{12,}/,
-  /\bsk-[A-Za-z0-9_\-]{12,}/,
-  /\bghp_[A-Za-z0-9_\-]{20,}/,
-  /\bxox[baprs]-[A-Za-z0-9\-]{10,}/,
-  /\beyJ[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{8,}/,
-  /^[A-Za-z0-9+/]{48,}={0,2}$/,
-];
-
-/** The shared dir: an explicit `dir`, else `$AEGISCODE_HOME`/`~/.aegiscode`. */
-function prefsDir(opts) {
-  const o = opts || {};
-  if (o.dir && String(o.dir).trim()) return path.resolve(String(o.dir).trim());
-  return aegisHome(o.env);
-}
-
-/** The shared file. `prefsFile({ dir, env })`. */
-function prefsFile(opts) {
-  const o = opts || {};
-  if (o.file && String(o.file).trim()) return path.resolve(String(o.file).trim());
-  return path.join(prefsDir(o), PREFS_FILE);
-}
-
-/**
- * Every finding in `value` that looks like key material, as dotted paths.
- * An empty array means "nothing key-shaped in here" — the property the exit
- * criteria assert about the shared file, with a negative control that shows the
- * scan can fail.
- */
-function scanForSecrets(value, atPath = '', found = []) {
-  if (value == null) return found;
-  if (typeof value === 'string') {
-    if (SECRET_VALUE_RES.some((re) => re.test(value))) found.push(atPath || '(root)');
-    return found;
-  }
-  if (typeof value !== 'object') return found;
-  if (Array.isArray(value)) {
-    value.forEach((v, i) => scanForSecrets(v, `${atPath}[${i}]`, found));
-    return found;
-  }
-  for (const [k, v] of Object.entries(value)) {
-    const here = atPath ? `${atPath}.${k}` : k;
-    // An empty/absent value is not key material — `{ key: null }` is how this
-    // repo clears a stored credential, and refusing that would be noise.
-    if (SECRET_KEY_RE.test(k) && v != null && v !== '' && v !== false) {
-      found.push(here);
-      continue;
-    }
-    scanForSecrets(v, here, found);
-  }
-  return found;
-}
-
-/** Throw when `value` carries key material. The writer's fail-closed gate. */
-function assertNoSecrets(value, what = 'shared preference store') {
-  const found = scanForSecrets(value);
-  if (found.length) {
-    throw new Error(
-      `${what} must not carry key material — refusing to write (found: ${found.join(', ')}). ` +
-        'Secrets belong in the host-local credential store, where the OS can protect them.'
-    );
-  }
-  return value;
-}
-
-function readJson(file, fallback) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : fallback;
-  } catch {
-    return fallback;
-  }
-}
-
-/** Read the shared store. Never throws: a corrupt file reads as empty. */
-function load(opts) {
-  return readJson(prefsFile(opts), {});
-}
-
-/**
- * Write the shared store atomically and 0600.
- *
- * 0600 rather than 0644 even though nothing secret belongs here: the file
- * decides whether a user's turns are persisted to the cloud (`memoryPersist`)
- * and which provider row the local class dials, so a writable copy is another
- * local account's way to change how this host behaves. The mode is the control;
- * the scan above is the boundary.
- */
-function write(next, opts) {
-  assertNoSecrets(next);
-  const file = prefsFile(opts);
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const tmp = `${file}.tmp-${process.pid}`;
-  fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
-  fs.renameSync(tmp, file);
-  try {
-    fs.chmodSync(file, 0o600);
-  } catch {
-    /* Windows: POSIX modes are a no-op, ACLs are the OS's business */
-  }
-  return next;
-}
-
-/** Merge a patch into the shared store and return the merged view. */
-function set(patch, opts) {
-  const next = { ...load(opts), ...(patch || {}) };
-  // `undefined` in a patch is how callers retire a key (JSON.stringify drops
-  // it), so drop those before the scan and the write.
-  for (const k of Object.keys(next)) if (next[k] === undefined) delete next[k];
-  if (next.version === undefined) next.version = PREFS_VERSION;
-  return write(next, opts);
-}
-
-/** One shared preference value, or `fallback`. */
-function get(key, opts, fallback) {
-  const v = load(opts)[key];
-  return v === undefined ? fallback : v;
-}
-
-/** True when the store holds an explicit value for `key`. */
-function has(key, opts) {
-  return load(opts)[key] !== undefined;
-}
-
-/**
- * Retire a key. Confined here (read-modify-write) so the two faces never
- * clobber each other's namespaces with a whole-file overwrite.
- */
-function remove(key, opts) {
-  const next = load(opts);
-  delete next[key];
-  return write(next, opts);
-}
-
-/**
- * The non-secret half of a legacy `<userData>/settings.json`, in the shared
- * store's spellings. Only namespaces THIS store owns are extracted: the other
- * app-level namespaces (`__avatar`, `__telemetry`,
- * `__autoDrain`, `__autoMint`, `__quickLauncher`) stay host-local until their
- * own phase moves them, and the provider rows are never here at all because a
- * provider row is where a key lives.
- */
-function extractNonSecretHalf(legacy) {
-  const out = {};
-  const src = (legacy || {})[LEGACY_MEMORY_PERSIST_NAMESPACE];
-  if (src && typeof src === 'object' && typeof src.enabled === 'boolean') {
-    out.memoryPersist = src.enabled;
-  }
-  // ON8: the confirmation gate adopts the same way. `enabled: true` means the
-  // gate is UP, which is the shared `confirmMode: true`; the shared key keeps
-  // the window's own polarity so an adopting install cannot flip its gate.
-  const gate = (legacy || {})[LEGACY_CONFIRM_MODE_NAMESPACE];
-  if (gate && typeof gate === 'object' && typeof gate.enabled === 'boolean') {
-    out.confirmMode = gate.enabled;
-  }
-  return out;
-}
-
-/**
- * One-way, once, idempotent adoption of the legacy desktop store's non-secret
- * half.
- *
- * `adopt({ dir, env, legacyDir })`:
- *   - `dir`/`env` locate the SHARED store;
- *   - `legacyDir` is the old settings directory (Electron's `<userData>`; main
- *     passes the same dir its store was built with).
- *
- * One-way: the legacy file is read, never written — a preference that moved to
- * the shared store is not mirrored back. Once: a key the shared store already
- * carries is never overwritten, so a second run has nothing left to do and
- * returns `adopted:false` without touching the file. That is what makes it
- * idempotent rather than a periodic merge.
- */
-function adopt(opts) {
-  const o = opts || {};
-  const shared = prefsFile(o);
-  const legacyDir = o.legacyDir;
-  const legacyFile = legacyDir ? path.join(String(legacyDir), 'settings.json') : null;
-  if (legacyFile && path.resolve(legacyFile) === shared) {
-    return { adopted: false, keys: [], from: legacyFile, reason: 'shared store is the legacy file' };
-  }
-  if (!legacyFile || !fs.existsSync(legacyFile)) {
-    return { adopted: false, keys: [], from: legacyFile, reason: 'no legacy settings file' };
-  }
-  const current = load(o);
-  const half = extractNonSecretHalf(readJson(legacyFile, {}));
-  // One-way means missing-only: an explicit shared value outranks the legacy
-  // one and is never clobbered by it.
-  const keys = Object.keys(half).filter((k) => current[k] === undefined);
-  if (!keys.length) {
-    return {
-      adopted: false,
-      keys: [],
-      from: legacyFile,
-      reason: Object.keys(half).length
-        ? 'shared store already carries these preferences'
-        : 'legacy store has no shared preferences',
-    };
-  }
-  const patch = {};
-  for (const k of keys) patch[k] = half[k];
-  // `names`, NOT `keys` (AEGISONE ON8): this ledger is written through `write()`
-  // below, so it is scanned like everything else — and `SECRET_KEY_RE` matches
-  // `key`/`keys` by design, because a preference named `keys` IS how key material
-  // would smuggle itself into a file the desktop and the shell both read. Spelled
-  // `keys`, this field made `assertNoSecrets` refuse the store's own write, so
-  // EVERY adoption with something to adopt threw — the whole pre-D5 migration was
-  // dead, silently (settings.js's best-effort catch turned the throw into "no
-  // adoption" and no one was told). The scanner is the control here, not the bug;
-  // a field name is free to change.
-  patch.adopted = {
-    from: legacyFile,
-    at: new Date().toISOString(),
-    names: keys.slice().sort(),
-  };
-  write({ ...current, ...patch }, o);
-  return { adopted: true, keys: keys.slice().sort(), from: legacyFile };
-}
-
-module.exports = {
-  PREFS_FILE,
-  PREFS_VERSION,
-  SHARED_PREF_KEYS,
-  LEGACY_MEMORY_PERSIST_NAMESPACE,
-  prefsDir,
-  prefsFile,
-  load,
-  set,
-  get,
-  has,
-  remove,
-  scanForSecrets,
-  assertNoSecrets,
-  extractNonSecretHalf,
-  adopt,
-};
+"use strict";const fs=require("node:fs"),path=require("node:path"),{aegisHome:aegisHome}=require("./credentials.js"),PREFS_FILE="preferences.json",PREFS_VERSION=1,SHARED_PREF_KEYS=Object.freeze(["themeIndex","model","modelClass","currentModelId","models","effort","vim","memoryPersist","confirmMode"]),LEGACY_MEMORY_PERSIST_NAMESPACE="__memoryPersist",LEGACY_CONFIRM_MODE_NAMESPACE="__confirmMode",SECRET_KEY_RE=/(^|[^a-z0-9])(api[_-]?key|apikey|key|keys|token|secret|password|passwd|credential|credentials|authorization|bearer|private[_-]?key|access[_-]?key|session[_-]?key)([^a-z0-9]|$)/i,SECRET_VALUE_RES=[/\baegis_[A-Za-z0-9_\-]{12,}/,/\bsk-[A-Za-z0-9_\-]{12,}/,/\bghp_[A-Za-z0-9_\-]{20,}/,/\bxox[baprs]-[A-Za-z0-9\-]{10,}/,/\beyJ[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{8,}/,/^[A-Za-z0-9+/]{48,}={0,2}$/];function prefsDir(e){const r=e||{};return r.dir&&String(r.dir).trim()?path.resolve(String(r.dir).trim()):aegisHome(r.env)}function prefsFile(e){const r=e||{};return r.file&&String(r.file).trim()?path.resolve(String(r.file).trim()):path.join(prefsDir(r),PREFS_FILE)}function scanForSecrets(e,r="",t=[]){if(null==e)return t;if("string"==typeof e)return SECRET_VALUE_RES.some((r=>r.test(e)))&&t.push(r||"(root)"),t;if("object"!=typeof e)return t;if(Array.isArray(e))return e.forEach(((e,o)=>scanForSecrets(e,`${r}[${o}]`,t))),t;for(const[o,s]of Object.entries(e)){const e=r?`${r}.${o}`:o;SECRET_KEY_RE.test(o)&&null!=s&&""!==s&&!1!==s?t.push(e):scanForSecrets(s,e,t)}return t}function assertNoSecrets(e,r="shared preference store"){const t=scanForSecrets(e);if(t.length)throw new Error(`${r} must not carry key material — refusing to write (found: ${t.join(", ")}). Secrets belong in the host-local credential store, where the OS can protect them.`);return e}function readJson(e,r){try{const t=JSON.parse(fs.readFileSync(e,"utf8"));return t&&"object"==typeof t&&!Array.isArray(t)?t:r}catch{return r}}function load(e){return readJson(prefsFile(e),{})}function write(e,r){assertNoSecrets(e);const t=prefsFile(r);fs.mkdirSync(path.dirname(t),{recursive:!0});const o=`${t}.tmp-${process.pid}`;fs.writeFileSync(o,JSON.stringify(e,null,2)+"\n",{mode:384}),fs.renameSync(o,t);try{fs.chmodSync(t,384)}catch{}return e}function set(e,r){const t={...load(r),...e||{}};for(const e of Object.keys(t))void 0===t[e]&&delete t[e];return void 0===t.version&&(t.version=1),write(t,r)}function get(e,r,t){const o=load(r)[e];return void 0===o?t:o}function has(e,r){return void 0!==load(r)[e]}function remove(e,r){const t=load(r);return delete t[e],write(t,r)}function extractNonSecretHalf(e){const r={},t=(e||{})[LEGACY_MEMORY_PERSIST_NAMESPACE];t&&"object"==typeof t&&"boolean"==typeof t.enabled&&(r.memoryPersist=t.enabled);const o=(e||{})[LEGACY_CONFIRM_MODE_NAMESPACE];return o&&"object"==typeof o&&"boolean"==typeof o.enabled&&(r.confirmMode=o.enabled),r}function adopt(e){const r=e||{},t=prefsFile(r),o=r.legacyDir,s=o?path.join(String(o),"settings.json"):null;if(s&&path.resolve(s)===t)return{adopted:!1,keys:[],from:s,reason:"shared store is the legacy file"};if(!s||!fs.existsSync(s))return{adopted:!1,keys:[],from:s,reason:"no legacy settings file"};const n=load(r),a=extractNonSecretHalf(readJson(s,{})),i=Object.keys(a).filter((e=>void 0===n[e]));if(!i.length)return{adopted:!1,keys:[],from:s,reason:Object.keys(a).length?"shared store already carries these preferences":"legacy store has no shared preferences"};const c={};for(const e of i)c[e]=a[e];return c.adopted={from:s,at:(new Date).toISOString(),names:i.slice().sort()},write({...n,...c},r),{adopted:!0,keys:i.slice().sort(),from:s}}module.exports={PREFS_FILE:PREFS_FILE,PREFS_VERSION:1,SHARED_PREF_KEYS:SHARED_PREF_KEYS,LEGACY_MEMORY_PERSIST_NAMESPACE:LEGACY_MEMORY_PERSIST_NAMESPACE,prefsDir:prefsDir,prefsFile:prefsFile,load:load,set:set,get:get,has:has,remove:remove,scanForSecrets:scanForSecrets,assertNoSecrets:assertNoSecrets,extractNonSecretHalf:extractNonSecretHalf,adopt:adopt};

package/vendor/presence-constants.js

@@ -1,109 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * The wire contract and the sanitising helpers for the presence beacon
- * (client/presence.js).
- *
- * These live in their own file for one reason: the widths and the app-name
- * vocabulary below are not this client's invention, they are aegis1's
- * (`_presence_token`, `_presence_app` and `PRESENCE_BEAT_INTERVAL_S` in
- * aegis1/app.py, and the `client_presence` table in aegis1/db.py). A test can
- * assert them without loading the network module, and if the server widens a
- * column the mismatch is visible in one file instead of being spread through
- * the beacon's request path.
- *
- * Kept dependency-free: plain Node, no Electron, no aegis.js — `presence.js`
- * requires this, and the tests require both.
- */
-
-/** aegis1: `@app.route("/api/v1/heartbeat", methods=["POST"])`. The v1 path is
- *  the client beacon; `/api/heartbeat` is the dashboard's own JS ping and is
- *  deliberately NOT used here — it takes no app/install field and writes no
- *  presence row. */
-const PRESENCE_PATH = '/api/v1/heartbeat';
-
-/** Fallback cadence, in ms, used until the server answers with its own.
- *  aegis1's PRESENCE_BEAT_INTERVAL_S is 300 (5 min) as this is written; if the
- *  two ever disagree the server's value wins at runtime, so this only bounds
- *  the very first beat. */
-const DEFAULT_INTERVAL_MS = 300 * 1000;
-
-/** One minute. `/api/heartbeat` and `/api/v1/heartbeat` are both
- *  `@login_required`, and that decorator throttles `_track_request()` to
- *  1/min/user — beating faster than this would buy nothing but load. */
-const MIN_INTERVAL_MS = 60 * 1000;
-
-/** One hour: the ceiling the server may ask for, and the ceiling the backoff
- *  ladder may reach. Past this the panel's "online" window is meaningless. */
-const MAX_INTERVAL_MS = 60 * 60 * 1000;
-
-/** Failures slow the beacon down rather than retrying on the same rhythm. */
-const BACKOFF_FACTOR = 2;
-const MAX_BACKOFF_MS = 30 * 60 * 1000;
-
-/** A beacon that has not answered in 20 s is a beacon that is not going to:
- *  the request body is ~120 bytes. Kept well under MIN_INTERVAL_MS so an
- *  in-flight beat can never overlap the next scheduled one. */
-const REQUEST_TIMEOUT_MS = 20 * 1000;
-
-/** The app vocabulary, copied EXACTLY from aegis1's `PRESENCE_APPS`
- *  (aegis1/app.py, right above `_presence_app`). This is not a suggestion: the
- *  server keeps a name only if it is in that tuple and maps everything else to
- *  'other', so a client that sends a name of its own invention is a client the
- *  operator cannot identify in the panel — silently, with a 200 and no error
- *  anywhere. `test/cli-presence.test.mjs` parses PRESENCE_APPS out of app.py and
- *  fails if these two lists drift.
- *
- *  The terminal host sends 'cli' rather than a product name for that reason:
- *  'aegiscode' is not in the server's tuple, so it would land as 'other'. */
-const APP_NAMES = Object.freeze(['desktop', 'cli', 'mcp', 'extension', 'web']);
-
-/**
- * One wire-safe token: trimmed, control characters and whitespace stripped,
- * truncated to the width the server's `_presence_token()` will accept. Returns
- * '' for anything that is not a usable string, so a caller can use the empty
- * result as "omit this field" rather than sending `null`.
- *
- * The sanitising is done HERE rather than left to the server on purpose: the
- * server sanitises so a bad field cannot 400 the beacon, but a client that
- * relies on that ships a body it cannot describe. Truncating at the source
- * means what this code sends and what the presence row stores are the same
- * string.
- */
-function saneToken(value, limit) {
-  try {
-    if (value == null) return '';
-    if (typeof value === 'number' && !Number.isFinite(value)) return '';
-    const text = String(value).replace(/[\u0000-\u001f\u007f\s]+/g, '');
-    const max = Number.isFinite(Number(limit)) && Number(limit) > 0 ? Math.floor(Number(limit)) : 64;
-    return text.slice(0, max);
-  } catch {
-    return '';
-  }
-}
-
-/** A non-negative integer queue depth. aegis1 clamps to [0, 100000] itself;
- *  clamping here too means the two never disagree about what was sent. */
-function saneCount(value) {
-  const n = Number(value);
-  if (!Number.isFinite(n) || n <= 0) return 0;
-  return Math.min(100000, Math.floor(n));
-}
-
-module.exports = {
-  PRESENCE_PATH,
-  DEFAULT_INTERVAL_MS,
-  MIN_INTERVAL_MS,
-  MAX_INTERVAL_MS,
-  BACKOFF_FACTOR,
-  MAX_BACKOFF_MS,
-  REQUEST_TIMEOUT_MS,
-  APP_NAMES,
-  saneToken,
-  saneCount,
-};
+"use strict";const PRESENCE_PATH="/api/v1/heartbeat",DEFAULT_INTERVAL_MS=3e5,MIN_INTERVAL_MS=6e4,MAX_INTERVAL_MS=36e5,BACKOFF_FACTOR=2,MAX_BACKOFF_MS=18e5,REQUEST_TIMEOUT_MS=2e4,APP_NAMES=Object.freeze(["desktop","cli","mcp","extension","web"]);function saneToken(e,n){try{if(null==e)return"";if("number"==typeof e&&!Number.isFinite(e))return"";const t=String(e).replace(/[\u0000-\u001f\u007f\s]+/g,""),_=Number.isFinite(Number(n))&&Number(n)>0?Math.floor(Number(n)):64;return t.slice(0,_)}catch{return""}}function saneCount(e){const n=Number(e);return!Number.isFinite(n)||n<=0?0:Math.min(1e5,Math.floor(n))}module.exports={PRESENCE_PATH:PRESENCE_PATH,DEFAULT_INTERVAL_MS:3e5,MIN_INTERVAL_MS:6e4,MAX_INTERVAL_MS:36e5,BACKOFF_FACTOR:2,MAX_BACKOFF_MS:18e5,REQUEST_TIMEOUT_MS:2e4,APP_NAMES:APP_NAMES,saneToken:saneToken,saneCount:saneCount};