feat(desktop): encrypted Agent Provider settings panel

[tlongwell-block]

Summary

Adds a Settings → Agent Provider panel to the desktop GUI for configuring the sprout-agent provider, model, API key, and behavior knobs. The panel ships in two layered commits:

1. 3dceb02 — encrypted Agent Provider settings panel. Single global config per identity. NIP-44 v2 self-encrypted at rest. Auto-detect provider + base URL from the API key shape.
2. 9013310 — multi-provider profiles for sprout-agent. Many named profiles per identity; one marked as default; per-sprout-agent pin selector in Create/Edit. Legacy single-config envelopes migrate idempotently on first read.

What you get

• One global place to configure sprout-agent (no more shell env exports).
• The API key never touches disk in plaintext. Envelope is bound to the current nsec + carries the owner pubkey inside the ciphertext (rollback / envelope-swap protection).
• Paste a key → the panel auto-detects provider, fills base URL + a sane model default, and warns on sk-ant-admin01- admin keys.
• Multiple named profiles (e.g. "Anthropic work", "OpenAI personal", "local Ollama") with one default. Each sprout-agent can pin a specific profile or fall through to the default.
• Per-agent dialogs hide Model + System prompt fields for sprout-agent (those are owned globally now); they show a profile picker instead.
• Identity rotation: if a saved envelope was written under a different nsec, the UI shows a banner and offers a clear; spawn refuses to inject (fail closed).

Threat model

• Plaintext lifetime: API key enters via IPC exactly once on save → Zeroizing<String> → NIP-44 envelope on disk → on spawn, decrypt → StoredSettings (Drop zeroizes) → EnvPairs (Drop zeroizes every value buffer) → handed to Command::env by reference, source buffer zeroized after each pair.
• Spawn-time validation mirrors save-time rules (validate_stored): non-loopback http:// rejected, control chars in key/model/base_url rejected, userinfo/query/fragment in URL rejected, size caps, positive-int knobs. Closes a rollback-to-pre-validation-envelope attack.
• Multi-profile identity check: the v3 wrapper carries owner_pubkey at the wrapper level (authoritative) AND per-profile (v2 defense-in-depth). Migration refuses to launder a mismatched legacy owner_pubkey into a clean v3 envelope under the current pubkey.
• Hydration race: the Add/Edit profile dialog mounts once and switches between profile ids by prop. Without gating, profile A's form values can be submitted under profile B's id during the load window, or reseeded across a cross-window mutation. Fixed by an explicit hydration state machine (useProfileDialogHydration): close-reset / profile-switch-reset / hydrate-once, plus hydrationStale and viewIsFresh = isFetched && !isFetching gates on Save.
• Plaintext key + reveal toggle are scrubbed on dialog close AND on profile switch (no leakage across opens).
• Env-as-secret-channel is explicitly out of scope for this PR — same-user processes on the box can still read /proc/<pid>/environ. A separate fd-handoff feature is tracked.

Plaintext schema (v3 wrapper)

ProfilesPlaintext {
  schema_version: 3,
  owner_pubkey,
  default_profile_id: Option<String>,
  profiles: [
    NamedProfile { id, label, created_at, updated_at, settings: StoredSettings }
  ],
}

Legacy v1/v2 plaintexts migrate idempotently on first read: wrap as the sole profile, label "Default", mark default, stamp owner_pubkey with the envelope pubkey. A mismatched legacy owner_pubkey aborts as IdentityMismatch (typed dispatch — no string-matching on error text).

Capacity

No explicit count cap on profiles.len(). The real bound is the JSON-serialized ProfilesPlaintext fitting under MAX_PLAINTEXT_BYTES = 48 KiB (headroom under NIP-44 v2's 65535-byte plaintext limit). Measured against the real serializer:

Profiles	Size
1 typical (sk-ant key + Anthropic defaults, no system_prompt)	855 B
10 typical	~7 KB
72 typical	49,135 B (last that fits)
73 typical	save rejected — clear "plaintext too large" error

A profile with a max-sized 32 KB system_prompt eats most of the budget on its own (~1 fat + ~15 typical fit alongside it). Typical sprout-agent profiles carry no system_prompt — the agent defaults it.

If we ever need to feel infinite: raise MAX_PLAINTEXT_BYTES (still bounded by NIP-44 v2's limit) or chunk across multiple envelopes. Not worth doing speculatively.

UI

• Settings → Agent Provider card lists profiles with per-row Set-default / Edit / Delete. Two-click destructive arm on row Delete.
• Add / Edit profile dialog (AgentProviderProfileDialog) carries label + provider + key + model + base URL + advanced knobs. Auto-detect from key format (Anthropic, OpenAI legacy/proj/svcacct, OpenRouter, Groq, xAI, Cerebras, Together, Perplexity, Fireworks, bare sk- → DeepSeek, plus localhost/127.0.0.1 patterns for Ollama / vLLM / llama.cpp) drives provider + base URL + default model through a single applyProviderSwitch reducer so the policy can't drift between the manual picker and the auto-detect effect.
• In-dialog Delete mirrors the row's two-click arm; explicitly disarms on cancel or profile switch (regression-tested).
• CreateAgentDialog / EditAgentDialog show a Sprout Profile picker for sprout-agent rows only. Picker uses a PENDING sentinel so the <select> stays controlled during load / identity-mismatch. Save is blocked symmetrically in Create and Edit when sprout-agent has no pin AND no valid default.
• ManagedAgentRow shows the resolved profile label for sprout-agent rows; warning color + "(none set — edit to fix)" when the default is null or dangling. Non-sprout rows fire zero settings queries.
• No-default banner, identity-rotation banner, load-error banner, and clear-all dialog retarget v1's banners at the wrapper.

Backend (desktop/src-tauri/src/commands/agent_provider_settings/)

• mod.rs — IPC types + StoredSettings (Drop zeroizes api_key; no Debug derive) + v3 wrapper types.
• storage.rs — envelope read/write, NIP-44 encrypt/decrypt with Zeroizing<String>, atomic-rename writes, file-size cap, normalize_origin, validate_input, validate_stored.
• storage_profiles.rs — wrapper IO + v1/v2 → v3 migration; validate_label (trim, non-empty, ≤64 B, no control chars); new_profile_id (UUID v4); ParseError::{IdentityMismatch, Other} typed dispatch.
• commands.rs / commands_write.rs — Tauri commands for state read, create/update/delete profile, set-default, clear, env-presence. All writes pre-flighted through validate_label + validate_input.
• spawn.rs — LoadForSpawn enum + EnvPairs newtype whose Drop zeroizes every value buffer. resolve_target_profile chooses by explicit pin id → default → fail closed.
• Pin validation on agent create/update (Ok / Unknown / Indeterminate). Auto-clear of a stale pin only runs when a valid default exists; otherwise the warning persists and the user must pick.

Tests

• Rust: 353 / 353. The agent_provider_settings module alone is 69 tests — envelope round-trip, identity rotation, save-time validation matrix, migration v1→v3 + v2→v3 (accept, idempotent, mismatched owner aborts), resolve_target_profile policy matrix, auto-default first-save, schema-dispatch reject on v4+, validate_label edge cases, per-profile owner_pubkey cross-check at spawn, validate_stored (non-loopback http, control chars, userinfo/query, unknown provider, oversized prompt).
• TS / node-test: 55 cases — applyProviderSwitch reducer + detectProvider (all key shapes + base-URL override + loopback hosts + ambiguity rules).
• Playwright integration: 18/18 in settings-agent-provider + 7 agents scenarios. Includes the hydration-race regression test (pre-fills a valid label so hydrationStale is the only remaining gate), the cancel→reopen delete-disarm regression test (R13), in-dialog Delete arm/commit, no-default banner after deleting the default, clear-all flow, identity-rotation banner, provider-change warning, post-close apiKey + reveal-state scrub, two-profile list with Set-default / Edit / Delete.
• just check: green.

Screenshots

Live in desktop/screenshots/agent-provider/ and posted in the main channel — two-profile list, auto-detect-from-key add dialog, provider-change warning on issuer switch, no-default banner after deleting the default.

Codex review history

15 rounds across the two commits. Final verdicts:

v1 panel (3dceb02) — R1–R8, final R8 verdict 9/10, no blocking findings. Surfaced and fixed: non-loopback HTTP at save AND spawn, identity-mismatch fails closed, local-provider key leak prevention, inline-args resolver alignment (TS↔Rust), Zeroize on api_key before early-return, no Debug derive on input/stored types, control-char / length caps + trim, owner_pubkey v2 envelope, local-provider switch unblock, EditAgentDialog command field, model reset on detection switch, nested-<button> fix, applyProviderSwitch reducer extraction, post-save apiKey + revealKey scrub, validate_stored at spawn.

Multi-provider (9013310) — R7–R13:

• R7: backend pin validation (Ok / Unknown / Indeterminate); typed ParseError.
• R8 (8/10): block save on missing-pin-no-default; trim/normalize empty pin id at IPC.
• R9 (8.4/10): gate missing detection on status==='ok'; picker PENDING sentinel; block unstartable Create; split sprout-only query; in-dialog Delete UX.
• R10 (8.6/10): symmetric Edit gate (no-pin + no-default); flag dangling default on row label.
• R11 (8.2/10, HIGH): kill profile-hydration race via useProfileDialogHydration (close-reset / switch-reset / hydrate-once); scrub apiKey + revealKey on close AND profile switch.
• R12 (8.5/10, MED): stale-but-served fresh-query gate (viewIsFresh = isFetched && !isFetching); sharper race test (pre-fills label so hydrationStale is the only remaining gate).
• R13 (8.3/10, MED regression): the R12 scope-marker delete-armed pattern failed on close→reopen-same-profile (scope key matched, armed state persisted). Replaced with explicit scope-keyed effect that clears on any (open, profileId) transition. Regression test pins the fix.

The per-round review prompts + verdicts live in .review/ (gitignored).

Signed-off-by: Tyler Longwell 109685178+tlongwell-block@users.noreply.github.com
Co-authored-by: Dawn c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co