Description
Dots Desktop keeps machine-scoped secrets in the Electron main process and encrypts them with the operating system’s user-bound safe storage before writing any bytes to disk. The current stores cover an embedding-provider key, the buyer license credential, and the private desktop release-feed token. Persisted files contain versioned ciphertext and timestamps, not the original values.
Renderer-facing bridges are deliberately write-only for secret material. Settings can set, clear, and inspect safe status fields, but no channel returns plaintext. Each store validates format before encryption, writes atomically, and refuses to persist when the OS keystore is unavailable. Unreadable or corrupted ciphertext degrades to a named status without leaking content into errors or telemetry.
Selling Points
- Keeps sensitive credentials out of web-renderer memory after submission, reducing exposure to browser-surface compromise.
- Uses Windows DPAPI or the platform-equivalent Electron safe storage rather than a reversible application-only encoding.
- Refuses plaintext fallback when encryption is unavailable, so convenience never silently weakens custody.
- Atomic file replacement prevents a crash during save from leaving a truncated credential record.
- Status APIs reveal whether a key is present or unreadable without returning the key itself.
User Story
A buyer enters a provider key and private release credential in desktop settings. Dots validates each value, seals it under their operating-system account, and reports that it is stored. The renderer cannot read it back; later, the main process decrypts it only for the daemon spawn or update client that needs it. The user gets durable configuration without plaintext secrets in settings files.
Extension Surface
This is fixed core. apps/desktop/src/main/embedding-key-store.ts, apps/desktop/src/main/license-credentials.ts, and apps/desktop/src/main/update-feed-credentials.ts implement separate closed records with explicit consumers. Their injectable safe-storage interfaces support testing, not third-party credential backends. No external plugin can register a new store or request decryption through the public desktop bridge.
Capabilities & Limits
- Encrypts supported credentials at rest and writes ciphertext records atomically.
- Exposes set, clear, presence, encryption-availability, and update-time status without secret values.
- Contains malformed, corrupted, or user-moved ciphertext as absent or unreadable state.
- Limit: OS-user-bound encryption does not protect against another process already running as the same user.
- Limit: custody currently covers named desktop credentials; it is not a general-purpose plugin secret vault.
Implementation Map
apps/desktop/src/main/embedding-key-store.tsapps/desktop/src/main/license-credentials.tsapps/desktop/src/main/update-feed-credentials.tsapps/desktop/src/main/embedding-key-ipc.ts