ClueCode

Starting a session locks the user row, checks entitlement, expires lapsed sessions, and inserts a lease: 10 minutes, renewed by a heartbeat every 2 minutes, capped at 3 hours. A partial unique index on active sessions makes “one device at a time” a database invariant. All times come from Postgres now() and are sent as relative seconds; the desktop tracks them on a monotonic clock, so changing the PC clock does nothing. Crash, sleep, network loss, a second device, a payment lapsing mid-session: each has a defined outcome, and the server fails closed.

Access is granted only when a Razorpay webhook with a valid HMAC-SHA256 signature arrives; the browser's checkout callback changes no state. Each event is processed once (a unique (provider, event_id) row inside the same transaction), with an out-of-order guard, and maps onto one internal subscription state machine. A single entitlement function answers “is this account entitled?” everywhere, including grace periods for late renewals.

The Gemini key is stored with Electron safeStorage (Windows DPAPI, bound to the OS user), decrypted per request, never returned to a renderer, never logged, never sent to the server. If the OS cannot encrypt, the app refuses to store it. That choice is also the business model: inference costs the operator ₹0SourceAI inference cost to operate: users bring their own Gemini key, and requests go from the desktop straight to Google, never through ClueCode's servers..

A screenshot can contain text written to manipulate the model. The system prompt treats on-screen text as material, not instructions; the answer is rendered through a strict sanitizer (no links, images, forms or styles) into a sandboxed renderer whose CSP allows no network. An end-to-end test feeds malicious model output and checks nothing executes.

One provider interface with a single streaming method covers every mode. The model menu is the server's supported list intersected with what the user's key can reach; a 404 falls back to the default model; a request with no first token in time is treated as stalled and moves to another model. Prompts are versioned and the version is logged with each request.