v1.0.2 — move the vault key into the OS credential store

Author: PraneethReddy-github

.eslintrc.cjs

@@ -0,0 +1,44 @@
+/* ESLint 8 (eslintrc format) — matches the `eslint . --ext .ts,.tsx` script. */
+module.exports = {
+  root: true,
+  env: { browser: true, node: true, es2022: true },
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    ecmaVersion: 2022,
+    sourceType: 'module',
+    ecmaFeatures: { jsx: true }
+  },
+  plugins: ['@typescript-eslint', 'react', 'react-hooks'],
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:react/recommended',
+    'plugin:react/jsx-runtime',
+    'plugin:react-hooks/recommended'
+  ],
+  settings: { react: { version: 'detect' } },
+  ignorePatterns: ['node_modules/', 'out/', 'dist/', 'dist-electron/', 'resources/', '.eslintrc.cjs'],
+  rules: {
+    // The IPC boundary and electron-updater are genuinely untyped; `any` is deliberate there.
+    '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-non-null-assertion': 'off',
+    // TypeScript already checks props.
+    'react/prop-types': 'off',
+    'no-unused-vars': 'off',
+    '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+    // `catch { /* best effort */ }` is a deliberate pattern throughout the services.
+    'no-empty': ['error', { allowEmptyCatch: true }],
+    '@typescript-eslint/no-unused-expressions': ['error', { allowTernary: true, allowShortCircuit: true }],
+    // Dependency arrays are hand-tuned in several hooks; surface as guidance, not failure.
+    'react-hooks/exhaustive-deps': 'warn',
+    // Terminal code parses OSC/ANSI sequences — control chars in regexes are the point.
+    'no-control-regex': 'off',
+    // Lazy `require()` in the main process is deliberate (platform-gated, optional deps).
+    '@typescript-eslint/no-var-requires': 'off',
+    // The codebase writes defensive leading semicolons (`;(expr).method()`).
+    'no-extra-semi': 'off',
+    // guacamole-lite's types come from shims.d.ts; `@ts-expect-error` would be "unused"
+    // there and break typecheck. Allow a described `@ts-ignore` instead.
+    '@typescript-eslint/ban-ts-comment': ['error', { 'ts-ignore': 'allow-with-description' }]
+  }
+}

README.md

@@ -1,26 +1,45 @@
 {
   "appId": "dev.ternix.app",
   "productName": "Ternix",
-  "directories": { "output": "dist-electron", "buildResources": "resources" },
-  "files": ["out/**/*", "resources/**/*"],
-  "asarUnpack": ["**/node_modules/{better-sqlite3,node-pty,serialport,keytar}/**/*"],
+  "directories": {
+    "output": "dist-electron",
+    "buildResources": "resources"
+  },
+  "files": [
+    "out/**/*",
+    "resources/**/*"
+  ],
+  "asarUnpack": [
+    "**/node_modules/{better-sqlite3,node-pty,serialport,keytar}/**/*"
+  ],
   "npmRebuild": true,
   "win": {
-    "target": ["nsis", "portable"],
-    "icon": "resources/icon.ico"
+    "target": [
+      "nsis",
+      "portable"
+    ],
+    "icon": "resources/icon.png"
   },
   "mac": {
-    "target": ["dmg", "zip"],
-    "icon": "resources/icon.icns",
+    "target": [
+      "dmg",
+      "zip"
+    ],
+    "icon": "resources/icon.png",
     "hardenedRuntime": true,
     "gatekeeperAssess": false,
     "entitlements": "resources/entitlements.mac.plist",
     "entitlementsInherit": "resources/entitlements.mac.plist"
   },
   "linux": {
-    "target": ["AppImage", "deb"],
+    "target": [
+      "AppImage",
+      "deb"
+    ],
     "icon": "resources/icons",
-    "executableArgs": ["--no-sandbox"],
+    "executableArgs": [
+      "--no-sandbox"
+    ],
     "category": "Utility",
     "maintainer": "Ternix"
   },

electron-builder.json

@@ -3,6 +3,16 @@ import type Database from 'better-sqlite3'
 // Version-based migrations. `user_version` PRAGMA tracks the applied schema version.
 // Each migration bumps the DB from version N-1 to N. Migration 0 is the base schema
 // (applied by DatabaseService via SCHEMA_SQL), so migrations here start at 1.
+//
+// Migrations are forward-only: there is no `down`. An older build opening a newer
+// database silently no-ops here (its `pending` list comes out empty) and then runs
+// against a schema it was never written for. Reads survive that — they are `SELECT *`
+// and ignore unknown columns — but writes name their columns explicitly.
+//
+// So, if you ever add a schema migration: make it ADDITIVE and give new columns a
+// DEFAULT (or allow NULL). A `NOT NULL` column without a default, a renamed column, or
+// a dropped table all break any previously-released build a user might downgrade to.
+// Keep that rule and downgrades stay safe without any version guard.
 
 export interface Migration {
   version: number
@@ -11,12 +21,13 @@ export interface Migration {
 }
 
 export const migrations: Migration[] = [
-  // Example forward-migration scaffold. Add new entries here as the schema evolves.
-  // {
-  //   version: 1,
-  //   description: 'add color column to snippets',
-  //   up: (db) => db.exec(`ALTER TABLE snippets ADD COLUMN color TEXT`)
-  // }
+  {
+    version: 1,
+    description: 'repair snippets marked non-global but owned by no session',
+    // The global checkbox used to persist is_global=0 without ever recording a session_id.
+    // Such rows are visible from nowhere once scoping is enforced, so adopt them as global.
+    up: (db) => db.exec(`UPDATE snippets SET is_global = 1 WHERE is_global = 0 AND session_id IS NULL`)
+  }
 ]
 
 export function runMigrations(db: Database.Database): void {

electron/db/migrations/index.ts

@@ -1,5 +1,6 @@
 import { DatabaseService } from '../services/DatabaseService'
 import { CryptoService } from '../services/CryptoService'
+import { scopeSnippet } from './snippetScope'
 import type {
   Group,
   Session,
@@ -406,21 +407,26 @@ export const snippetsRepo = {
   },
   create(data: Partial<Snippet> & { name: string; command: string }): Snippet {
     const db = DatabaseService.get()
+    const scope = scopeSnippet(data.is_global, data.session_id)
     const info = db
       .prepare(`INSERT INTO snippets (name, description, command, tags, is_global, session_id) VALUES (?, ?, ?, ?, ?, ?)`)
-      .run(data.name, data.description ?? null, data.command, JSON.stringify(data.tags ?? []), data.is_global === false ? 0 : 1, data.session_id ?? null)
+      .run(data.name, data.description ?? null, data.command, JSON.stringify(data.tags ?? []), scope.is_global, scope.session_id)
     return rowToSnippet(db.prepare(`SELECT * FROM snippets WHERE id = ?`).get(info.lastInsertRowid))
   },
   update(id: number, data: Partial<Snippet>): Snippet {
     const db = DatabaseService.get()
     const cur = rowToSnippet(db.prepare(`SELECT * FROM snippets WHERE id = ?`).get(id))
+    const scope = scopeSnippet(
+      data.is_global ?? cur.is_global,
+      data.session_id !== undefined ? data.session_id : cur.session_id
+    )
     db.prepare(`UPDATE snippets SET name=?, description=?, command=?, tags=?, is_global=?, session_id=? WHERE id=?`).run(
       data.name ?? cur.name,
       data.description !== undefined ? data.description : cur.description,
       data.command ?? cur.command,
       JSON.stringify(data.tags ?? cur.tags),
-      (data.is_global ?? cur.is_global) ? 1 : 0,
-      data.session_id !== undefined ? data.session_id : cur.session_id,
+      scope.is_global,
+      scope.session_id,
       id
     )
     return rowToSnippet(db.prepare(`SELECT * FROM snippets WHERE id = ?`).get(id))

electron/db/repo.ts

@@ -0,0 +1,31 @@
+// Self-check for snippet scoping. Run: node --experimental-strip-types electron/db/snippetScope.check.ts
+import assert from 'node:assert/strict'
+import { scopeSnippet } from './snippetScope.ts'
+import { visibleInSession } from '../../src/utils/snippets.ts'
+
+// Global wins regardless of any session id riding along, so toggling the box back to
+// global never leaves a stale owner behind.
+assert.deepEqual(scopeSnippet(true, null), { is_global: 1, session_id: null })
+assert.deepEqual(scopeSnippet(true, 7), { is_global: 1, session_id: null })
+assert.deepEqual(scopeSnippet(undefined, null), { is_global: 1, session_id: null })
+
+// Unchecking the box records the owning session.
+assert.deepEqual(scopeSnippet(false, 7), { is_global: 0, session_id: 7 })
+
+// An unowned scoped snippet would be visible from nowhere: refuse to write it.
+assert.throws(() => scopeSnippet(false, null), /must belong to a session/)
+assert.throws(() => scopeSnippet(false, undefined), /must belong to a session/)
+
+const snip = (is_global: boolean, session_id: number | null) =>
+  ({ is_global, session_id }) as Parameters<typeof visibleInSession>[0]
+
+// Global snippets show everywhere, including on local tabs with no session.
+assert.equal(visibleInSession(snip(true, null), 7), true)
+assert.equal(visibleInSession(snip(true, null), null), true)
+
+// Scoped snippets show only in their own session — this is the bug that was reported.
+assert.equal(visibleInSession(snip(false, 7), 7), true)
+assert.equal(visibleInSession(snip(false, 7), 8), false)
+assert.equal(visibleInSession(snip(false, 7), null), false)
+
+console.log('snippet scoping: all checks passed')

electron/db/snippetScope.check.ts

@@ -0,0 +1,10 @@
+/**
+ * The two states a snippet may be in. A global snippet belongs to no session; a scoped one
+ * must name the session that owns it, otherwise it is visible from nowhere.
+ * Kept dependency-free so both the repo and its self-check can import it.
+ */
+export function scopeSnippet(is_global: boolean | undefined, session_id: number | null | undefined) {
+  if (is_global !== false) return { is_global: 1 as const, session_id: null }
+  if (session_id == null) throw new Error('A session-scoped snippet must belong to a session')
+  return { is_global: 0 as const, session_id }
+}

electron/db/snippetScope.ts

@@ -1,5 +1,5 @@
 import { handle } from './util'
-import { homedir } from 'node:os'
+import { homedir, userInfo } from 'node:os'
 import { readdirSync, mkdirSync, rmSync, renameSync, lstatSync } from 'node:fs'
 import { join, resolve as resolvePath } from 'node:path'
 import type { SftpEntry } from '@shared/index'
@@ -11,6 +11,16 @@ function localModePerms(mode: number): string {
   return t[(mode >> 6) & 7] + t[(mode >> 3) & 7] + t[mode & 7]
 }
 
+/**
+ * Node gives us a uid, not a name, and there is no passwd lookup in stdlib. The current user
+ * is the one we can name, and on Windows every file reports uid 0, so name them all.
+ * ponytail: other uids stay numeric; parse /etc/passwd if that ever matters.
+ */
+function localOwner(uid: number): string {
+  const me = userInfo()
+  return process.platform === 'win32' || uid === me.uid ? me.username : String(uid)
+}
+
 function listLocal(dir: string): SftpEntry[] {
   // Resolve to absolute path — handles relative inputs and Windows drive roots
   const absDir = resolvePath(dir)
@@ -33,7 +43,7 @@ function listLocal(dir: string): SftpEntry[] {
         mode: st.mode,
         permissions: localModePerms(st.mode),
         modified: st.mtimeMs,
-        owner: String(st.uid ?? ''),
+        owner: localOwner(st.uid),
         group: String(st.gid ?? '')
       })
     } catch {

electron/ipc/sftp.ts

@@ -19,7 +19,9 @@ export function registerSnippetHandlers(): void {
         command: s.command,
         description: s.description ?? null,
         tags: Array.isArray(s.tags) ? s.tags : [],
-        is_global: s.is_global !== false
+        // ponytail: session ids are meaningless across machines, so imports land global.
+        // Thread a session mapping through here if scoped snippets ever need to survive export.
+        is_global: true
       })
       n++
     }

electron/ipc/snippets.ts

@@ -97,10 +97,20 @@ export function registerSystemHandlers(getWindow: () => BrowserWindow | null): v
     return autoUpdater
   }
 
+  /**
+   * Apply the user's channel choice. The GitHub provider publishes a single `latest.yml`,
+   * so a separate `beta` channel file would 404 — `allowPrerelease` is what actually
+   * surfaces pre-releases. Read on every call so switching channels needs no restart.
+   */
+  const applyChannel = (up: any) => {
+    up.allowPrerelease = (settingsRepo.get('updates.channel') ?? 'stable') === 'beta'
+  }
+
   handle<{ available: boolean; version?: string }>('updates:check', async () => {
     try {
       const up = getUpdater()
       if (!up) return { available: false }
+      applyChannel(up)
       const result = await up.checkForUpdates()
       const latestVersion = result?.updateInfo?.version
       const isAvailable = latestVersion && latestVersion !== app.getVersion()
@@ -112,7 +122,9 @@ export function registerSystemHandlers(getWindow: () => BrowserWindow | null): v
 
   handle<void>('updates:download', async () => {
     const up = getUpdater()
-    if (up) await up.downloadUpdate()
+    if (!up) return
+    applyChannel(up)
+    await up.downloadUpdate()
   })
 
   on('updates:install', () => {