aegis-desktop 1.0.2 → 1.0.4

package/lib/account-key.js

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+'use strict';
+
+/**
+ * The desktop's view of whether this machine has an AEGIS account key. When
+ * startup could not provision one, the banner says why and offers a retry.
+ * Pure: Electron, the store and the provisioner are injected.
+ */
+
+function provisionFailureText(result) {
+  const err = result && result.error;
+  if (!err) return 'the server returned no account key';
+  if (err.status === 429) return 'too many sign-ups from this network — try again later';
+  if (!err.status || err.status === 408 || err.status >= 500) return 'could not reach aegiscloud.org';
+  return `the server refused the request (HTTP ${err.status})`;
+}
+
+function createAccountKey({ aegis, credentials, persistKey, provision, onChange }) {
+  let failure = null;
+  let inFlight = null;
+
+  function status() {
+    if (aegis.apiKey || !failure) return null;
+    return { status: 'no-key', reason: failure };
+  }
+
+  function recordStartup(result) {
+    failure = (result.key || aegis.apiKey) ? null : provisionFailureText(result);
+    onChange(status());
+  }
+
+  function registerAccount() {
+    if (!inFlight) {
+      inFlight = (async () => {
+        try {
+          const result = await provision(aegis, credentials);
+          if (result.key) {
+            persistKey(result.key);
+            failure = null;
+          } else {
+            failure = provisionFailureText(result);
+          }
+          const state = status();
+          onChange(state);
+          return state;
+        } finally {
+          inFlight = null;
+        }
+      })();
+    }
+    return inFlight;
+  }
+
+  return { status, recordStartup, registerAccount };
+}
+
+module.exports = { createAccountKey, provisionFailureText };

package/main.js

@@ -152,6 +152,7 @@ try {
 // backed by transport-only modules in desktop/lib/. No brain logic enters here.
 const os = require('node:os');
 const { createLocalEngine } = require('./lib/local/engine.js');
+const { createAccountKey } = require('./lib/account-key.js');
 const { createSettingsStore, isReservedNamespace } = require('./lib/settings.js');
 const sessionStore = require('./lib/sync/sessions.js');
 const memoryQueue = require('./lib/sync/memory-queue.js');
@@ -2633,6 +2634,7 @@ function registerAutoIpc(ipcMain, dispatch) {
  * polling `aegis:updateStatus`.
  */
 const UPDATE_STATUS_CHANNEL = `${IPC_PREFIX}updateStatus`;
+const ACCOUNT_STATUS_CHANNEL = `${IPC_PREFIX}accountStatusChanged`;
 
 /** Re-check for a new release every few hours — frequent enough that a
  *  long-lived session still notices a release, rare enough to not hammer
@@ -3203,6 +3205,29 @@ function buildAppMenu({ app, Menu, BrowserWindow, updateManager }) {
 function bootstrap() {
   const { app, BrowserWindow, ipcMain, safeStorage, shell, Menu, Notification, screen, dialog, globalShortcut } = electron;
 
+  // A container/CI/headless server with no usable GPU crashes Chromium's GPU
+  // process in a retry loop that ends in a FATAL exit ("GPU process isn't
+  // usable. Goodbye.") — and that happens BEFORE app.whenReady() ever fires,
+  // so autoProvisionApiKey() (the free device key + welcome-trial grant)
+  // never runs either: `npm install -g aegis-desktop && aegis` on exactly
+  // that class of machine registered nothing, with no error a user could
+  // act on. Must be called before the app is ready (Electron's own
+  // constraint); software rendering is a fine tradeoff for a text/chat UI
+  // with no WebGL or video.
+  //
+  // disableHardwareAcceleration() alone was not enough on a container whose
+  // Mesa/VA-API/DRI stack is fully broken rather than merely GPU-less:
+  // Chromium still spawned a GPU process for the SwiftShader software path,
+  // and that crash-looped to the same FATAL exit, just after a longer delay
+  // (measured: survived past 15s, died at ~44s). These three switches tell
+  // Chromium to skip GPU-process creation entirely rather than retry it
+  // under software rendering — the documented combination for Electron under
+  // Docker/CI/headless Linux.
+  app.disableHardwareAcceleration();
+  app.commandLine.appendSwitch('disable-gpu');
+  app.commandLine.appendSwitch('disable-software-rasterizer');
+  app.commandLine.appendSwitch('disable-gpu-compositing');
+
   // A second launch (double-clicking the icon again, `aegis` from a second
   // terminal, …) must focus the existing window, not spawn a second process
   // fighting the first over the same on-disk settings/session/queue files —
@@ -3272,6 +3297,53 @@ function bootstrap() {
     dir: dataDir,
   });
 
+  // Resolve/auto-provision the account key as early as possible — BEFORE
+  // app.whenReady(), not inside it. autoProvisionApiKey() is a plain Node
+  // fetch call with no Electron dependency: createClient(credentials.
+  // clientOptions()) above already resolved any existing key (env, the
+  // shared file, the env-file fallback) onto `aegis.apiKey`, so this is a
+  // genuine registerDevice call only on a truly fresh install — the same
+  // one-call-is-enough guarantee autoProvisionApiKey() provides to the CLI
+  // and the MCP plugin. It persists straight to the plain shared
+  // credentials file via credentials.saveApiKey(), not safeStorage.
+  //
+  // Why this can't wait for 'ready': a container/CI host with a broken
+  // graphics stack crashes Chromium's GPU process in a retry loop that can
+  // end in a FATAL exit (see disableHardwareAcceleration above) BEFORE
+  // whenReady() ever resolves — measured here surviving 15s before dying at
+  // 42-44s even with hardware acceleration and GPU compositing disabled.
+  // Gating registration on 'ready' meant that exact class of host — exactly
+  // what `npm install -g aegis-desktop && aegis` on a headless server lands
+  // on — registered nothing and left no trace. Running it here means the
+  // account exists and the key is on disk the moment the process starts,
+  // independent of whether the window ever manages to open.
+  //
+  // Not calling settings.setAegisKey() here: safeStorage is not safe to use
+  // before 'ready' (see migrateLegacyAegisKey's own comment in desktop/lib/
+  // settings.js, the one other place in this codebase that already had to
+  // reason about this). The
+  // existing app.whenReady() block further down already re-reads the shared
+  // store via credentials.preferNewest() and writes the encrypted copy once
+  // ready — this just guarantees there is something there for it to find
+  // even when 'ready' never comes.
+  const accountKey = createAccountKey({
+    aegis,
+    credentials,
+    persistKey: (key) => settings.setAegisKey(key),
+    provision: autoProvision.autoProvisionApiKey,
+    onChange: (state) => broadcastAccountStatus(state),
+  });
+  const earlyKeyProvision = autoProvision.autoProvisionApiKey(aegis, credentials).then((result) => {
+    accountKey.recordStartup(result);
+    if (!result.key && !aegis.apiKey) {
+      const reason =
+        (result.error && (result.error.status || result.error.message || String(result.error))) ||
+        'no key returned';
+      console.warn(`auto-provision: no account key from register-device (${reason})`);
+    }
+    return result;
+  });
+
   // A provider key typed in the Settings pane used to reach ONLY this app's
   // encrypted store, so `aegiscode` (the CLI) and the MCP plugin never saw it:
   // same machine, same provider, key asked for twice, and a key entered here
@@ -3706,6 +3778,11 @@ function bootstrap() {
       if (!win.isDestroyed()) win.webContents.send(UPDATE_STATUS_CHANNEL, state);
     }
   }
+  function broadcastAccountStatus(state) {
+    for (const win of openWindows) {
+      if (!win.isDestroyed()) win.webContents.send(ACCOUNT_STATUS_CHANNEL, state);
+    }
+  }
 
   const updateManager = createUpdateManager({
     autoUpdater: realAutoUpdater,
@@ -3713,6 +3790,8 @@ function bootstrap() {
     onStatus: broadcastUpdateStatus,
   });
   registerUpdateIpc(ipcMain, updateManager);
+  ipcMain.handle(`${IPC_PREFIX}accountStatus`, () => accountKey.status());
+  ipcMain.handle(`${IPC_PREFIX}registerAccount`, () => accountKey.registerAccount());
   registerExportIpc(
     ipcMain,
     sessionStore,
@@ -3820,41 +3899,24 @@ function bootstrap() {
     // it, and nothing here may shadow an explicit export.
     const envKey = credentials.normalizeApiKey(process.env[credentials.KEY_ENV]);
     if (!envKey) {
+      // Wait for the pre-ready attempt above rather than racing a second
+      // registerDevice call: autoProvisionApiKey() already ran (or is still
+      // running) the instant this process started, specifically so it is
+      // not gated on 'ready' — see the earlyKeyProvision comment above for
+      // why (a container with a broken graphics stack can crash before
+      // 'ready' ever fires). Swallowing a keyless outcome here was how a
+      // machine could sit absent from the admin panel's user list AND its
+      // presence card with no trace anywhere — the server now logs every
+      // registration attempt, and earlyKeyProvision's own .then() already
+      // warns on failure, so there is nothing further to report if it
+      // didn't land.
+      await earlyKeyProvision;
       const chosen = credentials.preferNewest(settings.aegisRawKey(), settings.aegisKeySavedAt());
       if (chosen.key) {
         aegis.setApiKey(chosen.key);
         // The shared store is the newer write: bring this host's encrypted copy
         // up to date so a CLI rotation does not have to be redone in Settings.
         if (chosen.source === 'shared') settings.setAegisKey(chosen.key);
-      } else {
-        // Nothing configured anywhere (env, this app's encrypted copy, or the
-        // shared store): a fresh install. Auto-provision a free device key
-        // from aegis1 — same shared helper mcp/server.js and the CLI use, so
-        // the desktop app works with no manual sign-in step. A brand-new
-        // fingerprint is granted aegis1's 30-day welcome-trial `unlimited`
-        // entitlement (token-bank credit + a subscriptions row) in the same
-        // register-device call that mints the key — see client/
-        // auto-provision.js's header for the aegis1 commit that made this a
-        // real grant rather than a badge. Failure (offline, aegis1
-        // unreachable) falls through exactly as before: the renderer's
-        // normal "not signed in" state handles it, and the next launch tries
-        // again.
-        const result = await autoProvision.autoProvisionApiKey(aegis, credentials);
-        if (result.key) settings.setAegisKey(result.key);
-        else {
-          // Swallowing this was how a machine could sit keyless — and therefore
-          // absent from the admin panel's user list AND its presence card —
-          // with no trace anywhere: the app just opened in its normal
-          // signed-out state, and the next launch retried with the same
-          // invisible outcome. The server now logs every registration attempt;
-          // this closes the other half so one launch is diagnosable. A 429 here
-          // is not fatal (aegis1 creates the account and withholds the trial),
-          // so it must read as "retry", not as a broken install.
-          const reason =
-            (result.error && (result.error.status || result.error.message || String(result.error))) ||
-            'no key returned';
-          console.warn(`auto-provision: no account key from register-device (${reason})`);
-        }
       }
     }
     // ── presence beacon ───────────────────────────────────────────────────

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -32,7 +32,7 @@
     "demo": "node scripts/record-demo-gif.mjs",
     "dist": "npm run predist && electron-builder",
     "dist:dir": "npm run predist && electron-builder --dir",
-    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check scripts/bundle-fonts.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check scripts/bundle-fonts.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/account-key.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
     "test:shell": "node ../test/desktop-shell.mjs",
     "test:model": "node ../test/model-dispatch.mjs",
     "test:budget": "node ../test/budget.test.mjs",
@@ -55,7 +55,8 @@
     "test:avatar-events": "node test/avatar-events.test.mjs",
     "test:avatar-tiers": "node test/avatar-tiers.test.mjs",
     "test:avatar-persona": "node test/avatar-persona.test.mjs",
-    "test:renderer-fonts": "node test/renderer-fonts.test.mjs"
+    "test:renderer-fonts": "node test/renderer-fonts.test.mjs",
+    "test:account-key": "node test/account-key.test.mjs"
   },
   "dependencies": {
     "electron-updater": "^6.8.9"

package/preload.js

@@ -27,6 +27,7 @@ const AUTO_PREFIX = 'auto:';
 const QUEUE_PROGRESS_CHANNEL = `${QUEUE_PREFIX}progress`;
 const CHAT_DELTA_CHANNEL = `${IPC_PREFIX}chatDelta`;
 const UPDATE_STATUS_CHANNEL = `${IPC_PREFIX}updateStatus`;
+const ACCOUNT_STATUS_CHANNEL = `${IPC_PREFIX}accountStatusChanged`;
 const MENU_NEW_CHAT_CHANNEL = `${IPC_PREFIX}menuNewChat`;
 const MENU_SEARCH_CHANNEL = `${IPC_PREFIX}menuSearch`;
 const MENU_EXPORT_MARKDOWN_CHANNEL = `${IPC_PREFIX}menuExportMarkdown`;
@@ -268,6 +269,13 @@ const api = {
     ipcRenderer.on(UPDATE_STATUS_CHANNEL, listener);
     return () => ipcRenderer.removeListener(UPDATE_STATUS_CHANNEL, listener);
   },
+  accountStatus: () => invoke('accountStatus'),
+  registerAccount: () => invoke('registerAccount'),
+  onAccountStatus: (onStatus) => {
+    const listener = (_event, state) => onStatus(state);
+    ipcRenderer.on(ACCOUNT_STATUS_CHANNEL, listener);
+    return () => ipcRenderer.removeListener(ACCOUNT_STATUS_CHANNEL, listener);
+  },
   // Native menu accelerators with no built-in Electron role (Cmd/Ctrl+N,
   // Cmd/Ctrl+K — see main.js buildAppMenu): main.js just pings the channel,
   // the renderer owns what "new chat" / "search" actually do.

package/renderer/app.js

@@ -73,6 +73,9 @@ const ELEMENT_IDS = {
   updateRestartBtn: 'update-restart-btn',
   updateRetryBtn: 'update-retry-btn',
   updateLaterBtn: 'update-later-btn',
+  accountBanner: 'account-banner',
+  accountBannerText: 'account-banner-text',
+  accountRetryBtn: 'account-retry-btn',
   connDot: 'conn-dot',
   connText: 'conn-text',
   app: 'st-app',
@@ -1140,6 +1143,17 @@ function renderUpdateBanner(state) {
   els.updateBanner.hidden = false;
 }
 
+function renderAccountBanner(state) {
+  if (!els.accountBanner) return;
+  if (!state || state.status !== 'no-key') {
+    els.accountBanner.hidden = true;
+    return;
+  }
+  els.accountBannerText.textContent =
+    `No AEGIS account key on this machine: ${state.reason}.`;
+  els.accountBanner.hidden = false;
+}
+
 async function loadAccountInfo() {
   try {
     const verify = await aegis.verifyApiKey();
@@ -5703,6 +5717,20 @@ async function init() {
 
   // Auto-update banner: `?`-guarded like the memory inspector above, since
   // the markup is optional and a missing node must never crash boot.
+  if (els.accountBanner && aegis.onAccountStatus) {
+    aegis.onAccountStatus(renderAccountBanner);
+    aegis.accountStatus().then(renderAccountBanner).catch((err) => console.warn('account status unavailable', err));
+    els.accountRetryBtn.addEventListener('click', () => {
+      els.accountRetryBtn.disabled = true;
+      aegis.registerAccount()
+        .then(renderAccountBanner)
+        .catch((err) => renderAccountBanner({ status: 'no-key', reason: String((err && err.message) || err) }))
+        .finally(() => {
+          els.accountRetryBtn.disabled = false;
+        });
+    });
+  }
+
   if (els.updateBanner && aegis.onUpdateStatus) {
     aegis.onUpdateStatus(renderUpdateBanner);
     aegis.updateStatus().then(renderUpdateBanner).catch(() => {});

package/renderer/index.html

@@ -48,6 +48,13 @@
     </div>
   </div>
 
+  <div class="update-banner account-banner" id="account-banner" role="alert" hidden>
+    <span id="account-banner-text"></span>
+    <div class="update-banner-actions">
+      <button type="button" id="account-retry-btn" class="ghost-btn">Retry account setup</button>
+    </div>
+  </div>
+
   <main>
     <aside class="side">
       <section class="card">

package/vendor/auto-provision.js

@@ -33,32 +33,48 @@
 const { machineFingerprint } = require('./device-fingerprint.js');
 
 const DEVICE_REGISTER_TIMEOUT_MS = 8000;
+const DEVICE_REGISTER_RETRY_DELAYS_MS = [1000, 3000];
+
+// Network failure, timeout (status 0), 408, or 5xx. A 4xx — including 429, the
+// server's per-IP registration cap — is a refusal, and retrying it only spends
+// more of that cap.
+function isTransientRegisterError(err) {
+  const status = err && err.status;
+  return !status || status === 408 || status >= 500;
+}
 
 /**
  * @param {object} aegisClient A client from client/aegis.js (createClient()).
  * @param {object} credentials client/credentials.js (or a compatible double).
+ * @param {number[]} [retryDelaysMs] Wait before each retry of a transient failure.
  * @returns {Promise<{ok: boolean, key: string, error?: Error}>}
  *   `ok` is true only when a usable key was obtained AND persisted to the
  *   shared store; `aegisClient.setApiKey()` has already been called on
  *   success, so the caller's client is immediately usable either way it
  *   inspects `ok`.
  */
-async function autoProvisionApiKey(aegisClient, credentials) {
+async function autoProvisionApiKey(aegisClient, credentials, retryDelaysMs = DEVICE_REGISTER_RETRY_DELAYS_MS) {
   if (aegisClient.apiKey) return { ok: true, key: aegisClient.apiKey };
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), DEVICE_REGISTER_TIMEOUT_MS);
-  try {
-    const data = await aegisClient.registerDevice(machineFingerprint(), { signal: controller.signal });
-    const key = data && typeof data.api_key === 'string' ? data.api_key.trim() : '';
-    if (!key) return { ok: false, key: '' };
-    const saved = credentials.saveApiKey(key);
-    aegisClient.setApiKey(key);
-    return { ok: !!saved.ok, key };
-  } catch (err) {
-    return { ok: false, key: '', error: err };
-  } finally {
-    clearTimeout(timer);
+  let lastError = null;
+  for (let attempt = 0; attempt <= retryDelaysMs.length; attempt++) {
+    if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, retryDelaysMs[attempt - 1]));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEVICE_REGISTER_TIMEOUT_MS);
+    try {
+      const data = await aegisClient.registerDevice(machineFingerprint(), { signal: controller.signal });
+      const key = data && typeof data.api_key === 'string' ? data.api_key.trim() : '';
+      if (!key) return { ok: false, key: '' };
+      const saved = credentials.saveApiKey(key);
+      aegisClient.setApiKey(key);
+      return { ok: !!saved.ok, key };
+    } catch (err) {
+      lastError = err;
+      if (!isTransientRegisterError(err)) break;
+    } finally {
+      clearTimeout(timer);
+    }
   }
+  return { ok: false, key: '', error: lastError };
 }
 
-module.exports = { autoProvisionApiKey, DEVICE_REGISTER_TIMEOUT_MS };
+module.exports = { autoProvisionApiKey, DEVICE_REGISTER_TIMEOUT_MS, DEVICE_REGISTER_RETRY_DELAYS_MS };