From 1e719407894755fa7bd3976d7549f176f3e87c36 Mon Sep 17 00:00:00 2001
From: Lotus CI <ci@lotusguild.org>
Date: Fri, 25 Sep 2026 15:48:26 -0400
Subject: [PATCH] fix(build): bundle the web app's Giphy key so the desktop GIF
 picker works
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The web deploy serves a config.json kept on the server (not in git), which
is where the Giphy key lives. The desktop app bundles the repo's
config.json, whose gifApiKey is empty, so on desktop the GIF button never
appeared even with Settings → GIF Picker switched on.

scripts/sync-web-config.mjs copies an allow-list of deployment-only keys
(just gifApiKey) from https://chat.lotusguild.org/config.json into
cinny/config.json before the Windows and Linux builds. The key is public
already (served to every web visitor; Giphy keys are client keys). A fetch
failure is a warning, not a build failure.

Tested locally: sets the key, is a no-op on a second run, and skips cleanly
on a 404.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
---
 .gitea/workflows/release.yml |  9 +++++++++
 scripts/sync-web-config.mjs  | 30 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 scripts/sync-web-config.mjs

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 784e461..85022ba 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -93,6 +93,12 @@ jobs:
         shell: powershell
         run: cd cinny; npm ci
 
+      # Deployment-only config (e.g. the Giphy key) lives on the web server,
+      # not in git; copy it in so the desktop GIF picker works.
+      - name: Sync web config
+        shell: powershell
+        run: node scripts/sync-web-config.mjs
+
       - name: Install Tauri deps
         shell: powershell
         run: npm ci
@@ -208,6 +214,9 @@ jobs:
       - name: Install frontend deps
         run: cd cinny && npm ci
 
+      - name: Sync web config
+        run: node scripts/sync-web-config.mjs
+
       - name: Install Tauri deps
         run: npm ci
 
diff --git a/scripts/sync-web-config.mjs b/scripts/sync-web-config.mjs
new file mode 100644
index 0000000..c08a275
--- /dev/null
+++ b/scripts/sync-web-config.mjs
@@ -0,0 +1,30 @@
+// Copy deployment-only client config from the live web app into the bundled
+// cinny/config.json before a desktop build.
+//
+// The web deploy serves a config.json kept on the server (not in git), so
+// values such as the Giphy key exist only there; the desktop app bundles the
+// repo's config.json, where they are empty. Without this the GIF picker can be
+// switched on in Settings and still never show a button on desktop.
+//
+// Only an allow-list of keys is copied, and a failure to fetch is a warning:
+// the build still succeeds, just without those values.
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const SOURCE = process.env.WEB_CONFIG_URL || 'https://chat.lotusguild.org/config.json';
+const TARGET = 'cinny/config.json';
+const KEYS = ['gifApiKey'];
+
+try {
+  const res = await fetch(SOURCE, { signal: AbortSignal.timeout(15000) });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const web = await res.json();
+  const local = JSON.parse(readFileSync(TARGET, 'utf8'));
+  const copied = KEYS.filter((k) => typeof web[k] === 'string' && web[k] && local[k] !== web[k]);
+  copied.forEach((k) => {
+    local[k] = web[k];
+  });
+  writeFileSync(TARGET, `${JSON.stringify(local, null, 2)}\n`);
+  console.log(`sync-web-config: ${copied.length ? `set ${copied.join(', ')}` : 'nothing to change'}`);
+} catch (e) {
+  console.warn(`sync-web-config: skipped (${e.message}); building with the repo config`);
+}