aegis-desktop 1.0.13 → 1.0.15

package/vendor/presence.js

@@ -1,440 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * Client presence beacon — the client half of aegis1's `/api/v1/heartbeat`.
- *
- * WHAT IT IS FOR. aegis1 already had `/api/heartbeat` (the dashboard's own JS
- * pinging to bump `users.last_active_at`). What it did NOT have was any way to
- * answer "who is running aegiscode right now, which app, which build, how many
- * machines?" — a user sitting in a session but not making model calls was
- * invisible. `heartbeat_v1()` in aegis1/app.py closes that gap by writing a
- * `client_presence` row keyed on (user_id, app, install), and this module is
- * the beacon that feeds it. Same for both hosts: the CLI's `aegiscode` binary
- * and the desktop's main process require this one file.
- *
- * THE SERVER CONTRACT (aegis1/app.py `heartbeat_v1`, do not change one side
- * without the other):
- *
- *   POST /api/v1/heartbeat     X-API-Key: <the user's aegis key>
- *   {"app": "desktop", "version": "0.8.12", "platform": "linux",
- *    "install": "9f3c1a2b4d5e6f70", "queue": 2, "autonomous": false}
- *   -> 200 {"ok": true, "online": true, "seen_at": ..., "beat_interval_s": 300}
- *
- * Auth is the ordinary `@login_required`, which already accepts X-API-Key or
- * Bearer — the same key every host signs in with. So the beacon introduces NO
- * second credential and no new client secret, and a host with no key has
- * nothing to beacon AT: `apiKey` absent means this module is inert by
- * construction (see `disabledPresence()`), never a 401 loop.
- *
- * `install` IS THE FINGERPRINT. Not a second identifier invented here: it is
- * `machineFingerprint()` from ./device-fingerprint.js, the same SHA-256 the
- * device-registration path uses. That is deliberate and it is the property the
- * admin panel needs — "how many machines does this user run" has to count
- * machines, so the beacon must carry the machine's identity, not a random
- * per-run token that would make one laptop look like fifty. It is a 64-char
- * lowercase hex digest and aegis1's `_presence_token(install, 64)` accepts
- * exactly that width. Note what this does and does not imply: it is a stable
- * pseudonym for a machine, so a user's own rows join up; it is NOT a
- * cross-account tracking device and the server never sees the raw machine id it
- * was derived from.
- *
- * FOUR PROPERTIES, in order of importance — the same discipline
- * `lib/local/telemetry.js` is built around, for the same reason:
- *
- *   1. It cannot break the host. `beat()` returns a boolean and NEVER throws,
- *      whatever the network, the DNS, the JSON, or an injected `fetch` does.
- *      A beacon that can take down a CLI session or an Electron main process
- *      is worse than no beacon at all.
- *   2. It cannot leak. The request body is rebuilt field by field from the
- *      arguments — never spread, never `JSON.stringify(callerObject)` — and
- *      only `app`, `version`, `platform`, `install`, `queue`, `autonomous` can
- *      ever be sent. No conversation content, no file paths, no model output,
- *      no email, no prompt text. `sane()` additionally truncates each field to
- *      the same width the server enforces, so a caller cannot smuggle a blob
- *      through a field this module owns.
- *   3. It cannot keep the process alive. The timer is `unref()`d, so `stop()`
- *      is a convenience, not a requirement: an interrupted CLI exits on time
- *      even if nobody ever calls it, and the desktop's quit path does not have
- *      to thread a handle through.
- *   4. It cannot hammer. The cadence is the SERVER's (`beat_interval_s` in the
- *      response), so the beacon can be slowed or sped up without shipping a
- *      client release; failures back off exponentially instead of retrying on
- *      the same rhythm, which is what turns a dead endpoint from a client
- *      problem into a server problem.
- *
- * Nothing in this file may import Electron: it is plain Node so the CLI, the
- * desktop main process and the tests can all drive the same code. Each host
- * injects its own `app` name, version, platform and queue depth.
- */
-
-const {
-  PRESENCE_PATH,
-  DEFAULT_INTERVAL_MS,
-  MIN_INTERVAL_MS,
-  MAX_INTERVAL_MS,
-  BACKOFF_FACTOR,
-  MAX_BACKOFF_MS,
-  REQUEST_TIMEOUT_MS,
-  APP_NAMES,
-  saneToken,
-  saneCount,
-} = require('./presence-constants.js');
-
-const DEFAULT_API_BASE = 'https://aegiscloud.org';
-
-/**
- * The store returned when there is nothing to beacon (no key, or a host that
- * explicitly opted out). Every method answers, nothing happens, no timer is
- * created and no request is made: `enabled` is false and `beat()` is a no-op
- * that reports `false`. Checked by test/presence.test.mjs.
- */
-function disabledPresence(reason) {
-  const state = {
-    enabled: false,
-    reason: String(reason || 'disabled'),
-    beats: 0,
-    failures: 0,
-    lastError: null,
-    lastSeenAt: null,
-    intervalMs: null,
-    install: null,
-    app: null,
-    running: false,
-  };
-  return {
-    enabled: false,
-    reason: state.reason,
-    install: null,
-    beat: () => Promise.resolve(false),
-    start: () => false,
-    stop: () => false,
-    state: () => ({ ...state }),
-  };
-}
-
-/** One ISO-8601 UTC string, or null. Never throws on a hostile clock. */
-function isoOf(ms) {
-  try {
-    const n = Number(ms);
-    if (!Number.isFinite(n)) return null;
-    return new Date(n).toISOString();
-  } catch {
-    return null;
-  }
-}
-
-/**
- * @param {object} opts
- * @param {string} [opts.apiKey]        the aegis key; absent ⇒ inert
- * @param {string} [opts.baseUrl]       defaults to https://aegiscloud.org
- * @param {string} [opts.app]           'desktop' | 'cli' | ... (see APP_NAMES)
- * @param {string} [opts.version]       the host's own build string
- * @param {string} [opts.platform]      process.platform
- * @param {string} [opts.install]       machine fingerprint (default: computed)
- * @param {number|function} [opts.queueDepth]  pending queue tasks (may be a fn)
- * @param {boolean|function} [opts.autonomous] a drain is running (may be a fn)
- * @param {number} [opts.intervalMs]    initial cadence before the server answers
- * @param {boolean} [opts.enabled]      explicit kill switch (default true)
- * @param {string} [opts.clientVersion] X-AEGIS-Version header (version gate)
- * @param {function} [opts.fetchImpl]   fetch override (tests)
- * @param {function} [opts.now]         clock override (tests)
- * @param {function} [opts.log]         (level, message, err) => void
- * @param {function} [opts.setTimer]    setTimeout override (tests)
- * @param {function} [opts.clearTimer]  clearTimeout override (tests)
- */
-function createPresence(opts = {}) {
-  const apiKey = typeof opts.apiKey === 'string' ? opts.apiKey.trim() : '';
-  if (!apiKey) return disabledPresence('no-api-key');
-  if (opts.enabled === false) return disabledPresence('disabled');
-
-  const log = typeof opts.log === 'function' ? opts.log : () => {};
-  // A logger that throws is not allowed to matter — same rule as telemetry.js.
-  function debugOnce(kind) {
-    if (logged.has(kind)) return;
-    logged.add(kind);
-    try {
-      log('debug', `presence: ${kind}`);
-    } catch {
-      /* a broken logger is not an error path */
-    }
-  }
-  const logged = new Set();
-
-  const now = typeof opts.now === 'function' ? opts.now : () => Date.now();
-  const setTimer = typeof opts.setTimer === 'function' ? opts.setTimer : setTimeout;
-  const clearTimer = typeof opts.clearTimer === 'function' ? opts.clearTimer : clearTimeout;
-
-  // The fingerprint. Required lazily so a host that never beacons (the tests
-  // for the other modules) does not touch the filesystem at require time.
-  //
-  // An injected `fingerprint` is an IDENTITY SOURCE, not a first choice: when a
-  // host hands one in, that is the machine's identity and the built-in ladder
-  // is not consulted. That matters for the packaged hosts, which resolve the
-  // fingerprint once at their own call site (cli/src/presence.js, desktop
-  // main.js) and must be able to fail loudly if it cannot — a silent fallback
-  // here would hide a broken identity by substituting a different one, and the
-  // panel would count the same laptop as two machines.
-  let install = saneToken(opts.install, 64);
-  if (!install && typeof opts.fingerprint === 'function') {
-    try {
-      install = saneToken(opts.fingerprint(), 64);
-    } catch {
-      debugOnce('fingerprint');
-    }
-  } else if (!install) {
-    try {
-      install = saneToken(require('./device-fingerprint.js').machineFingerprint(), 64);
-    } catch {
-      debugOnce('fingerprint');
-    }
-  }
-  if (!install) {
-    // No machine identity could be resolved at all (an exotic sandbox). A
-    // beacon without an install key would write a NEW presence row on every
-    // beat — one user, infinite machines in the panel. Better to stay out of
-    // the table than to poison it: see device-fingerprint.js for the ladder
-    // (machine id -> persisted install id -> hostname) that makes this rare.
-    return disabledPresence('no-install-identity');
-  }
-
-  const app = saneToken(opts.app, 24).toLowerCase() || 'other';
-  const version = saneToken(opts.version, 32);
-  const rawPlatform = saneToken(opts.platform, 16).toLowerCase();
-  const platform = rawPlatform || (typeof process !== 'undefined' && process.platform ? process.platform : '');
-  const baseUrl = String(opts.baseUrl || (typeof process !== 'undefined' && process.env && process.env.AEGIS_API_BASE) || DEFAULT_API_BASE).replace(/\/+$/, '');
-  const path = PRESENCE_PATH;
-  const fetchImpl =
-    typeof opts.fetchImpl === 'function'
-      ? opts.fetchImpl
-      : typeof fetch === 'function'
-        ? fetch
-        : null;
-
-  /** A caller passing a function is asking to be read at send time, so the
-   *  beacon reports the LIVE queue depth rather than the depth at boot. */
-  function readDynamic(value, fallback) {
-    try {
-      return typeof value === 'function' ? value() : value;
-    } catch {
-      return fallback;
-    }
-  }
-
-  let intervalMs = clampInterval(opts.intervalMs);
-  const state = {
-    enabled: true,
-    reason: null,
-    beats: 0,
-    failures: 0,
-    lastError: null,
-    lastSeenAt: null,
-    intervalMs,
-    install,
-    app,
-    version: version || null,
-    platform: platform || null,
-    running: false,
-  };
-
-  let timer = null;
-  let inflight = null;
-  let backoffMs = 0;
-  let stopped = false;
-
-  function clampInterval(ms) {
-    const n = Number(ms);
-    if (!Number.isFinite(n) || n <= 0) return DEFAULT_INTERVAL_MS;
-    return Math.min(MAX_INTERVAL_MS, Math.max(MIN_INTERVAL_MS, Math.floor(n)));
-  }
-
-  /** The ONLY body shape this module can ever send. Field by field, on purpose. */
-  function body() {
-    return {
-      app,
-      version: version || undefined,
-      platform: platform || undefined,
-      install,
-      queue: saneCount(readDynamic(opts.queueDepth, 0)),
-      autonomous: Boolean(readDynamic(opts.autonomous, false)),
-    };
-  }
-
-  /**
-   * Send one beat. Resolves `true` when the server acknowledged, `false` on
-   * every other outcome — no key, offline, DNS failure, 500, a malformed body,
-   * an aborted request. It never rejects, so a caller may `void beat()` without
-   * an unhandled-rejection guard, and a concurrent call while one is in flight
-   * is answered by the in-flight promise rather than by a second request (two
-   * beacons racing would double-count `beats` on the server).
-   */
-  function beat() {
-    if (stopped) return Promise.resolve(false);
-    if (inflight) return inflight;
-    if (!fetchImpl) {
-      debugOnce('no-fetch');
-      state.lastError = 'no fetch implementation';
-      state.failures += 1;
-      return Promise.resolve(false);
-    }
-
-    const startedAt = now();
-    inflight = (async () => {
-      let timedOut = false;
-      let cancel = null;
-      try {
-        const controller = typeof AbortController === 'function' ? new AbortController() : null;
-        if (controller) {
-          const t = setTimer(() => {
-            timedOut = true;
-            try {
-              controller.abort();
-            } catch {
-              /* already gone */
-            }
-          }, REQUEST_TIMEOUT_MS);
-          if (t && typeof t.unref === 'function') t.unref();
-          cancel = () => clearTimer(t);
-        }
-
-        const res = await fetchImpl(`${baseUrl}${path}`, {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            'X-API-Key': apiKey,
-            'X-AEGIS-Version': saneToken(opts.clientVersion, 32) || version || '',
-          },
-          body: JSON.stringify(body()),
-          ...(controller ? { signal: controller.signal } : {}),
-        });
-        if (cancel) cancel();
-
-        // `ok` on the response, not `res.ok === true` semantics: a 404 (server
-        // predates the route) and a 401 (key revoked) are both just "not this
-        // time" — the beacon must not retry storm either of them.
-        if (!res || typeof res.status !== 'number' || res.status < 200 || res.status >= 300) {
-          state.failures += 1;
-          state.lastError = `http ${res && res.status ? res.status : 'error'}`;
-          backoffMs = nextBackoff(backoffMs);
-          return false;
-        }
-
-        let data = null;
-        try {
-          data = await res.json();
-        } catch {
-          // A 200 with an unreadable body is still a successful beat: the
-          // server wrote the row before it serialised the answer. Only the
-          // cadence hint is lost, and the current one stays in force.
-          data = null;
-        }
-
-        state.beats += 1;
-        state.failures = 0;
-        state.lastError = null;
-        state.lastSeenAt = isoOf(now());
-        backoffMs = 0;
-        // The server owns the cadence. An unrecognised/hostile value is clamped
-        // rather than trusted: a `beat_interval_s` of 0 would be a hot loop.
-        if (data && typeof data === 'object' && data.beat_interval_s != null) {
-          const secs = Number(data.beat_interval_s);
-          if (Number.isFinite(secs) && secs > 0) intervalMs = clampInterval(secs * 1000);
-        }
-        state.intervalMs = intervalMs;
-        return true;
-      } catch (err) {
-        if (cancel) cancel();
-        state.failures += 1;
-        state.lastError = timedOut ? 'timeout' : String((err && err.message) || err || 'error').slice(0, 200);
-        backoffMs = nextBackoff(backoffMs);
-        if (state.failures === 1) debugOnce('beat-failed'); // once, then quiet
-        return false;
-      } finally {
-        inflight = null;
-        if (state.running) schedule(Math.max(0, intervalMs + backoffMs - (now() - startedAt)));
-      }
-    })();
-
-    return inflight;
-  }
-
-  function nextBackoff(current) {
-    const base = current > 0 ? current * BACKOFF_FACTOR : Math.max(MIN_INTERVAL_MS, intervalMs);
-    return Math.min(MAX_BACKOFF_MS, Math.floor(base));
-  }
-
-  /** One timer at a time, always unref'd, always cleared before replacing. */
-  function schedule(delayMs) {
-    if (stopped || typeof setTimer !== 'function') return;
-    if (timer) clearTimer(timer);
-    const delay = Math.max(1000, Math.floor(Number(delayMs) || intervalMs));
-    timer = setTimer(() => {
-      timer = null;
-      void beat();
-    }, delay);
-    if (timer && typeof timer.unref === 'function') timer.unref();
-  }
-
-  /**
-   * Start beaconing and send the FIRST beat immediately. A host that is opened
-   * and closed in under a minute still registers — waiting one full interval
-   * before the first beat would make the panel blind to exactly the short
-   * sessions the route was added for.
-   */
-  function start() {
-    if (stopped) return false;
-    state.running = true;
-    void beat();
-    return true;
-  }
-
-  /** Stop beaconing. Idempotent, and safe to call when start() never ran. */
-  function stop() {
-    stopped = true;
-    state.running = false;
-    if (timer) {
-      try {
-        clearTimer(timer);
-      } catch {
-        /* a timer that already fired is not an error */
-      }
-      timer = null;
-    }
-    return true;
-  }
-
-  return {
-    enabled: true,
-    app,
-    install,
-    beat,
-    start,
-    stop,
-    /**
-     * The in-flight beat, or null. Exposed for one reason: a SHORT-LIVED host
-     * (`aegiscode -p "…"`, `aegiscode autonomous run`) finishes its work in
-     * well under a second and calls `process.exit()`, which kills an in-flight
-     * request and loses the beat entirely — the machine is silently absent from
-     * the panel even though it just ran. The CLI awaits this before exiting
-     * (see `flush()` in cli/src/presence.js). A long-lived host can ignore it.
-     */
-    pending: () => inflight,
-    state: () => ({ ...state, intervalMs }),
-  };
-}
-
-module.exports = {
-  createPresence,
-  disabledPresence,
-  PRESENCE_PATH,
-  DEFAULT_INTERVAL_MS,
-  MIN_INTERVAL_MS,
-  MAX_INTERVAL_MS,
-  MAX_BACKOFF_MS,
-  REQUEST_TIMEOUT_MS,
-  APP_NAMES,
-};
+"use strict";const{PRESENCE_PATH:PRESENCE_PATH,DEFAULT_INTERVAL_MS:DEFAULT_INTERVAL_MS,MIN_INTERVAL_MS:MIN_INTERVAL_MS,MAX_INTERVAL_MS:MAX_INTERVAL_MS,BACKOFF_FACTOR:BACKOFF_FACTOR,MAX_BACKOFF_MS:MAX_BACKOFF_MS,REQUEST_TIMEOUT_MS:REQUEST_TIMEOUT_MS,APP_NAMES:APP_NAMES,saneToken:saneToken,saneCount:saneCount}=require("./presence-constants.js"),DEFAULT_API_BASE="https://aegiscloud.org";function disabledPresence(e){const n={enabled:!1,reason:String(e||"disabled"),beats:0,failures:0,lastError:null,lastSeenAt:null,intervalMs:null,install:null,app:null,running:!1};return{enabled:!1,reason:n.reason,install:null,beat:()=>Promise.resolve(!1),start:()=>!1,stop:()=>!1,state:()=>({...n})}}function isoOf(e){try{const n=Number(e);return Number.isFinite(n)?new Date(n).toISOString():null}catch{return null}}function createPresence(e={}){const n="string"==typeof e.apiKey?e.apiKey.trim():"";if(!n)return disabledPresence("no-api-key");if(!1===e.enabled)return disabledPresence("disabled");const t="function"==typeof e.log?e.log:()=>{};function r(e){if(!o.has(e)){o.add(e);try{t("debug",`presence: ${e}`)}catch{}}}const o=new Set,s="function"==typeof e.now?e.now:()=>Date.now(),i="function"==typeof e.setTimer?e.setTimer:setTimeout,a="function"==typeof e.clearTimer?e.clearTimer:clearTimeout;let l=saneToken(e.install,64);if(l||"function"!=typeof e.fingerprint){if(!l)try{l=saneToken(require("./device-fingerprint.js").machineFingerprint(),64)}catch{r("fingerprint")}}else try{l=saneToken(e.fingerprint(),64)}catch{r("fingerprint")}if(!l)return disabledPresence("no-install-identity");const u=saneToken(e.app,24).toLowerCase()||"other",c=saneToken(e.version,32),f=saneToken(e.platform,16).toLowerCase()||("undefined"!=typeof process&&process.platform?process.platform:""),_=String(e.baseUrl||"undefined"!=typeof process&&process.env&&process.env.AEGIS_API_BASE||DEFAULT_API_BASE).replace(/\/+$/,""),A=PRESENCE_PATH,E="function"==typeof e.fetchImpl?e.fetchImpl:"function"==typeof fetch?fetch:null;function M(e,n){try{return"function"==typeof e?e():e}catch{return n}}let p=b(e.intervalMs);const T={enabled:!0,reason:null,beats:0,failures:0,lastError:null,lastSeenAt:null,intervalMs:p,install:l,app:u,version:c||null,platform:f||null,running:!1};let S=null,m=null,d=0,N=!1;function b(e){const n=Number(e);return!Number.isFinite(n)||n<=0?DEFAULT_INTERVAL_MS:Math.min(MAX_INTERVAL_MS,Math.max(MIN_INTERVAL_MS,Math.floor(n)))}function y(){if(N)return Promise.resolve(!1);if(m)return m;if(!E)return r("no-fetch"),T.lastError="no fetch implementation",T.failures+=1,Promise.resolve(!1);const t=s();return m=(async()=>{let o=!1,P=null;try{const t="function"==typeof AbortController?new AbortController:null;if(t){const e=i((()=>{o=!0;try{t.abort()}catch{}}),REQUEST_TIMEOUT_MS);e&&"function"==typeof e.unref&&e.unref(),P=()=>a(e)}const r=await E(`${_}${A}`,{method:"POST",headers:{"Content-Type":"application/json","X-API-Key":n,"X-AEGIS-Version":saneToken(e.clientVersion,32)||c||""},body:JSON.stringify({app:u,version:c||void 0,platform:f||void 0,install:l,queue:saneCount(M(e.queueDepth,0)),autonomous:Boolean(M(e.autonomous,!1))}),...t?{signal:t.signal}:{}});if(P&&P(),!r||"number"!=typeof r.status||r.status<200||r.status>=300)return T.failures+=1,T.lastError=`http ${r&&r.status?r.status:"error"}`,d=I(d),!1;let S=null;try{S=await r.json()}catch{S=null}if(T.beats+=1,T.failures=0,T.lastError=null,T.lastSeenAt=isoOf(s()),d=0,S&&"object"==typeof S&&null!=S.beat_interval_s){const e=Number(S.beat_interval_s);Number.isFinite(e)&&e>0&&(p=b(1e3*e))}return T.intervalMs=p,!0}catch(e){return P&&P(),T.failures+=1,T.lastError=o?"timeout":String(e&&e.message||e||"error").slice(0,200),d=I(d),1===T.failures&&r("beat-failed"),!1}finally{m=null,T.running&&function(e){if(N||"function"!=typeof i)return;S&&a(S);const n=Math.max(1e3,Math.floor(Number(e)||p));S=i((()=>{S=null,y()}),n),S&&"function"==typeof S.unref&&S.unref()}(Math.max(0,p+d-(s()-t)))}})(),m}function I(e){const n=e>0?e*BACKOFF_FACTOR:Math.max(MIN_INTERVAL_MS,p);return Math.min(MAX_BACKOFF_MS,Math.floor(n))}return{enabled:!0,app:u,install:l,beat:y,start:function(){return!N&&(T.running=!0,y(),!0)},stop:function(){if(N=!0,T.running=!1,S){try{a(S)}catch{}S=null}return!0},pending:()=>m,state:()=>({...T,intervalMs:p})}}module.exports={createPresence:createPresence,disabledPresence:disabledPresence,PRESENCE_PATH:PRESENCE_PATH,DEFAULT_INTERVAL_MS:DEFAULT_INTERVAL_MS,MIN_INTERVAL_MS:MIN_INTERVAL_MS,MAX_INTERVAL_MS:MAX_INTERVAL_MS,MAX_BACKOFF_MS:MAX_BACKOFF_MS,REQUEST_TIMEOUT_MS:REQUEST_TIMEOUT_MS,APP_NAMES:APP_NAMES};