@bivy/bivy 0.10.1-staging.329 → 0.10.1-staging.331

package/dist/agents/claude-code/runtime.js

@@ -950,7 +950,7 @@ class ClaudeSession {
         const provider = this.runtimeOptions.credentialProvider?.trim() || "anthropic";
         let cred;
         try {
-            cred = await store.getCredential(provider);
+            cred = await store.getCredential(provider, { workspace: this.cwd });
         }
         catch {
             return {};

package/dist/credentials/api.js

@@ -6,10 +6,9 @@
 //
 // Deliberately Pi-FREE: every function here operates on Bivy's own encrypted
 // vault (credential-store.ts) with zero Pi involvement, so the service compiles
-// and tests without Pi. The one thing that legitimately comes from Pi — the
-// model-provider *catalog* (Bivy has none of its own) — is INJECTED:
-// `joinProviderCatalog` takes the catalog as a parameter, and the thin
-// `runtime/provider-catalog.ts` bridge supplies Pi's. See
+// and tests without Pi. Provider catalog data is likewise injected:
+// `joinProviderCatalog` receives Bivy's baseline overlaid with optional live
+// runtime metadata by the thin `runtime/provider-catalog.ts` bridge. See
 // docs/credentials-service-plan.md §3.1.
 import { createCredentialVault } from "./store.js";
 import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "./records.js";
@@ -27,9 +26,9 @@ export async function joinProviderCatalog(credsDir, catalog) {
         id: provider.id,
         name: provider.name,
         oauth: provider.oauth,
-        configured: provider.configured,
+        configured: provider.configured || infoById.has(provider.id),
         kind: infoById.get(provider.id)?.type,
-        source: provider.source,
+        source: provider.source ?? (infoById.has(provider.id) ? "stored" : undefined),
         expiresAt: infoById.get(provider.id)?.expiresAt,
     }));
 }
@@ -56,16 +55,17 @@ export async function exportSyncableRecords(credsDir) {
 /**
  * Browser-safe account API-key projection. Used to converge a node-less PWA's
  * E2E account vault with an enrolled node. OAuth refresh tokens, references,
- * non-default labels, and node-local records are deliberately excluded.
+ * and node-local records are deliberately excluded; labeled API-key accounts
+ * are included as distinct vault items.
  */
 export async function exportAccountApiKeys(credsDir) {
     return (await createCredentialVault(credsDir).listRecords())
         .flatMap((record) => {
-        if (record.label !== DEFAULT_LABEL || record.sync !== "account" || record.source.kind !== "stored")
+        if (record.sync !== "account" || record.source.kind !== "stored")
             return [];
         const credential = record.source.cred;
         return credential.type === "api_key" && typeof credential.key === "string"
-            ? [{ provider: record.provider, key: credential.key, updatedAt: record.updatedAt }]
+            ? [{ provider: record.provider, label: record.label, key: credential.key, updatedAt: record.updatedAt }]
             : [];
     });
 }
@@ -88,6 +88,18 @@ export async function importCredentialRecords(credsDir, records, deletedAt = {})
     }
     return createCredentialVault(credsDir).importRecords(list, tombstones);
 }
+/** Apply a hosted custody snapshot as an authoritative filtered set. */
+export async function reconcileHostedCredentialRecords(credsDir, records, previous) {
+    const current = Object.values(records ?? {}).filter((record) => Boolean(record) && typeof record === "object" && typeof record.provider === "string" && typeof record.label === "string");
+    const currentIds = new Set(current.map((record) => `${record.provider}\u0000${record.label}`));
+    const store = createCredentialVault(credsDir);
+    for (const prior of previous) {
+        if (!currentIds.has(`${prior.provider}\u0000${prior.label}`))
+            await store.deleteRecord(prior.provider, prior.label);
+    }
+    await importCredentialRecords(credsDir, records);
+    return current.map((record) => ({ provider: record.provider, label: record.label }));
+}
 /** Export provider revocations for cross-node convergence. */
 export async function exportProviderAuthTombstones(credsDir) {
     return createCredentialVault(credsDir).exportTombstones();
@@ -169,7 +181,7 @@ export async function listCredentialRecords(credsDir) {
         const verification = await vault.readVerification(record.provider, record.label).catch(() => undefined);
         const verified = verification ? { lastVerifiedAt: verification.at, lastVerifiedOk: verification.ok } : {};
         if (source.kind === "reference") {
-            return { provider: record.provider, label: record.label, kind: "reference", sync: record.sync, origin: record.origin, ref: source.ref, testable: false, ...verified };
+            return { provider: record.provider, label: record.label, kind: "reference", sync: record.sync, origin: record.origin, unattended: record.unattended === true, ref: source.ref, testable: false, ...verified };
         }
         const cred = source.cred;
         const summary = {
@@ -178,6 +190,7 @@ export async function listCredentialRecords(credsDir) {
             kind: cred.type,
             sync: record.sync,
             origin: record.origin,
+            unattended: record.unattended === true,
             testable: isTestableProvider(record.provider),
             ...verified,
         };
@@ -193,10 +206,14 @@ export async function listCredentialRecords(credsDir) {
  */
 async function labeledMeta(credsDir, provider, label) {
     const existing = await createCredentialVault(credsDir).readRecord(provider, label);
-    return { sync: existing?.sync ?? defaultSyncFor("bivy"), origin: existing?.origin ?? "bivy" };
+    return {
+        sync: existing?.sync ?? defaultSyncFor("bivy"),
+        origin: existing?.origin ?? "bivy",
+        ...(existing?.unattended === true ? { unattended: true } : {}),
+    };
 }
 /** Store an API key under a specific label (multi-account). */
-export async function setProviderApiKeyLabeled(credsDir, provider, label, key) {
+export async function setProviderApiKeyLabeled(credsDir, provider, label, key, sync) {
     const id = provider.trim().toLowerCase();
     if (!id)
         throw new Error("Provider is required");
@@ -209,10 +226,11 @@ export async function setProviderApiKeyLabeled(credsDir, provider, label, key) {
         label: normalizeLabel(label),
         source: { kind: "stored", cred: { type: "api_key", key: apiKey } },
         ...meta,
+        ...(sync ? { sync } : {}),
     });
 }
 /** Store a reference (op:// / env://) under a specific label (multi-account). */
-export async function setProviderReferenceLabeled(credsDir, provider, label, ref) {
+export async function setProviderReferenceLabeled(credsDir, provider, label, ref, sync) {
     const id = provider.trim().toLowerCase();
     if (!id)
         throw new Error("Provider is required");
@@ -226,6 +244,7 @@ export async function setProviderReferenceLabeled(credsDir, provider, label, ref
         label: normalizeLabel(label),
         source: { kind: "reference", ref: pointer, backend },
         ...meta,
+        ...(sync ? { sync } : {}),
     });
 }
 /** Forget a single labeled credential (`provider:label`). */
@@ -244,12 +263,20 @@ export async function removeProviderCredential(credsDir, provider, label = DEFAU
  *  check — chosen for being cheap (no completion/generation billed) and not
  *  mutating anything provider-side. A provider absent here is honestly
  *  reported as `testable: false` rather than guessing at a result. */
-const PROVIDER_PING = {
-    anthropic: (token) => ({ url: "https://api.anthropic.com/v1/models", headers: { "x-api-key": token, "anthropic-version": "2023-06-01" } }),
-    openai: (token) => ({ url: "https://api.openai.com/v1/models", headers: { authorization: `Bearer ${token}` } }),
-};
+function providerPing(provider, secret) {
+    // Keep dispatch explicit: provider ids originate at the API boundary and
+    // must never select an arbitrary callable property.
+    switch (provider) {
+        case "anthropic":
+            return { url: "https://api.anthropic.com/v1/models", headers: { "x-api-key": secret, "anthropic-version": "2023-06-01" } };
+        case "openai":
+            return { url: "https://api.openai.com/v1/models", headers: { authorization: `Bearer ${secret}` } };
+        default:
+            return undefined;
+    }
+}
 function isTestableProvider(provider) {
-    return provider.trim().toLowerCase() in PROVIDER_PING;
+    return providerPing(provider.trim().toLowerCase(), "") !== undefined;
 }
 /**
  * Probe whether a stored credential actually works, and persist the result
@@ -290,10 +317,10 @@ export async function testCredential(credsDir, provider, label, oauth, fetchImpl
             if (!token)
                 return { ok: false, at, reason: "not_found" };
         }
-        const ping = PROVIDER_PING[id];
+        const ping = providerPing(id, token);
         if (!ping)
             return { ok: false, at, reason: "not_supported" };
-        const { url, headers } = ping(token);
+        const { url, headers } = ping;
         try {
             const controller = new AbortController();
             const timeout = setTimeout(() => controller.abort(), 8_000);
@@ -333,6 +360,33 @@ export function getCredentialIngestPolicy(credsDir) {
 export function setCredentialIngestPolicy(credsDir, policy) {
     setIngestPolicyFile(defaultPresetsPath(credsDir), policy);
 }
+/** Explicitly grant/revoke use by separately escrowed unattended runners. */
+export async function setCredentialUnattended(credsDir, provider, label, unattended) {
+    const id = provider.trim().toLowerCase();
+    if (!id)
+        throw new Error("Provider is required");
+    const store = createCredentialVault(credsDir);
+    const existing = await store.readRecord(id, label);
+    if (!existing)
+        throw new Error(`No credential for ${id}:${normalizeLabel(label)}`);
+    if (existing.sync !== "account" && unattended)
+        throw new Error("A machine-only credential cannot be granted to unattended runners");
+    if (existing.source.kind === "reference" && unattended)
+        throw new Error("Password-manager references cannot be resolved by unattended runners");
+    await store.putRecord({ ...existing, unattended });
+}
+/** Credentials included in the explicit hosted custody snapshot. */
+export async function exportUnattendedRecords(credsDir) {
+    const records = await createCredentialVault(credsDir).exportSyncableRecords();
+    return Object.fromEntries(Object.entries(records).filter(([, record]) => record.unattended === true && record.source.kind === "stored"));
+}
+/** Monotonic logical revision for the filtered custody projection. */
+export async function unattendedCredentialRevision(credsDir) {
+    const store = createCredentialVault(credsDir);
+    const records = await store.listRecords();
+    const deletedAt = await store.exportRecordTombstones();
+    return Math.max(0, ...records.map((record) => Number(record.updatedAt) || 0), ...Object.values(deletedAt).map((stamp) => Number(stamp) || 0));
+}
 /** Set a labeled credential's sync tier — the per-credential opt-out toggle. */
 export async function setCredentialSync(credsDir, provider, label, sync) {
     const id = provider.trim().toLowerCase();
@@ -347,5 +401,5 @@ export async function setCredentialSync(credsDir, provider, label, sync) {
     if (existing.source.kind === "reference" && existing.source.backend === "command" && sync === "account") {
         throw new Error("A cmd:// reference is node-local (it runs a command on this machine) and cannot be synced.");
     }
-    await store.putRecord({ ...existing, sync });
+    await store.putRecord({ ...existing, sync, ...(sync === "node" ? { unattended: false } : {}) });
 }

package/dist/credentials/resolver.js

@@ -10,11 +10,23 @@
 //
 // This keeps Bivy's hot credential path decoupled from Pi: Pi is just another
 // agent that reads the same store.
+import path from "node:path";
 import { createCredentialVault } from "./store.js";
 import { resolveCredential } from "./records.js";
 import { loadPresets, defaultPresetsPath } from "./presets.js";
 /** Refresh an OAuth token this many ms before it expires (clock-skew guard). */
 const OAUTH_REFRESH_SKEW_MS = 60_000;
+/** Stable project identifiers discoverable without importing repo/session code. */
+export function projectIdsFromWorkspace(workspace) {
+    const resolved = path.resolve(workspace);
+    const ids = new Set([resolved, path.basename(resolved)]);
+    for (const part of resolved.split(path.sep)) {
+        const split = part.indexOf("__");
+        if (split > 0 && split < part.length - 2)
+            ids.add(`${part.slice(0, split)}/${part.slice(split + 2)}`);
+    }
+    return [...ids];
+}
 /** Resolver over Bivy's credential store, with OAuth refresh-on-read via the bridge. */
 export class NodeCredentialResolver {
     credsDir;
@@ -22,7 +34,6 @@ export class NodeCredentialResolver {
     oauth;
     store;
     presetsPath;
-    presetsCache;
     // Reference resolution (op:///env:///cmd://) and OAuth refresh are injected
     // capabilities (ports) — the resolver stays free of secrets.ts and the Pi
     // OAuth bridge. The node adapters are bound by the runtime shim.
@@ -33,13 +44,12 @@ export class NodeCredentialResolver {
         this.store = createCredentialVault(credsDir);
         this.presetsPath = defaultPresetsPath(credsDir);
     }
-    /** The node's selection presets, read once per resolver (see presets.ts). */
+    /** Read assignments on each resolution so a vault UI change applies to an
+     * already-running agent on its next turn, not only after a daemon restart. */
     presets() {
-        if (!this.presetsCache)
-            this.presetsCache = loadPresets(this.presetsPath);
-        return this.presetsCache;
+        return loadPresets(this.presetsPath);
     }
-    async getCredential(provider) {
+    async getCredential(provider, context) {
         const id = provider.trim().toLowerCase();
         if (!id)
             return undefined;
@@ -48,7 +58,15 @@ export class NodeCredentialResolver {
         // credential; ambiguity (multiple accounts, no preset) returns nothing rather
         // than guessing.
         const records = await this.store.listRecords().catch(() => []);
-        const selection = resolveCredential(id, records, this.presets());
+        const presets = this.presets();
+        // Project assignments are ordinary preset mappings named `project:<id>`.
+        // Bivy-managed clones encode owner/repo as owner__repo in their workspace
+        // path; direct local workspaces also match their absolute path/basename.
+        const explicitProject = context?.project?.trim();
+        const workspace = context?.workspace?.trim();
+        const projectCandidates = [explicitProject, ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter((value) => Boolean(value));
+        const projectPreset = projectCandidates.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
+        const selection = resolveCredential(id, records, presets, { ...(projectPreset ? { preset: projectPreset } : {}), ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}) });
         if (!selection)
             return undefined;
         const source = selection.record.source;
@@ -64,7 +82,10 @@ export class NodeCredentialResolver {
         }
         const cred = source.cred;
         if (cred.type === "api_key") {
-            const token = typeof cred.key === "string" ? cred.key : "";
+            // Keyless local endpoints are valid. They still need a harmless value in
+            // the conventional API-key variable because several OpenAI-compatible
+            // clients require the variable even when the server ignores auth.
+            const token = typeof cred.key === "string" && cred.key ? cred.key : cred.env ? "local" : "";
             if (!token)
                 return undefined;
             return { provider: id, kind: "api_key", token, ...(cred.env ? { env: cred.env } : {}) };
@@ -148,7 +169,7 @@ const BASE_URL_TO_KEY_VAR = {
  * non-active provider would silently redirect the real provider. Best-effort: a
  * provider that fails to resolve is skipped rather than failing the session.
  */
-export async function buildAgentCredentialEnv(store, providers, activeProvider) {
+export async function buildAgentCredentialEnv(store, providers, activeProvider, workspace) {
     const ids = providers ?? (store.listConfigured ? await store.listConfigured().catch(() => []) : []);
     const active = activeProvider?.trim().toLowerCase() || undefined;
     // Process the active provider LAST so its base URL and standard-key alias win
@@ -159,7 +180,7 @@ export async function buildAgentCredentialEnv(store, providers, activeProvider)
     for (const id of ordered) {
         let cred;
         try {
-            cred = await store.getCredential(id);
+            cred = await store.getCredential(id, workspace ? { workspace } : undefined);
         }
         catch {
             continue;

package/dist/runtime/bivy-provider-catalog.js

@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+/**
+ * Bivy-owned, browser-safe provider registry and baseline model catalog.
+ *
+ * This is versioned product metadata, not runtime state. It intentionally has
+ * no Node, Pi, agent, or network dependencies, so clients can show providers,
+ * authentication choices, help links, and a useful model baseline before they
+ * connect to a node. Runtime discovery may augment this snapshot but does not
+ * own these provider identities.
+ */
+export const BIVY_PROVIDER_CATALOG_VERSION = "2026-08-14";
+const apiKey = (label, helpUrl) => ({ kind: "api_key", label, ...(helpUrl ? { helpUrl } : {}) });
+const oauth = (label, oauthProviderId) => ({ kind: "oauth", label, ...(oauthProviderId ? { oauthProviderId } : {}) });
+const reference = { kind: "reference", label: "Password manager or environment" };
+/** Authoritative common providers and the offline baseline models Bivy ships. */
+export const BIVY_PROVIDER_CATALOG = [
+    { id: "anthropic", name: "Anthropic", authMethods: [oauth("Claude Pro / Max", "anthropic"), apiKey("Anthropic API key", "https://console.anthropic.com/settings/keys"), reference], env: ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"], compatibility: "anthropic", helpUrl: "https://docs.anthropic.com/", models: [
+            { id: "claude-opus-4-1", name: "Claude Opus 4.1", reasoning: true },
+            { id: "claude-sonnet-4-5", name: "Claude Sonnet 4.5", reasoning: true },
+            { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5" },
+        ] },
+    { id: "openai", name: "OpenAI API", aliases: ["openai-api"], authMethods: [apiKey("OpenAI API key", "https://platform.openai.com/api-keys"), reference], env: ["OPENAI_API_KEY"], compatibility: "openai", helpUrl: "https://platform.openai.com/docs/", models: [
+            { id: "gpt-5.4", name: "GPT-5.4", reasoning: true },
+            { id: "gpt-5.4-mini", name: "GPT-5.4 mini", reasoning: true },
+            { id: "gpt-4o", name: "GPT-4o" },
+        ] },
+    { id: "openai-codex", name: "OpenAI — ChatGPT subscription", aliases: ["codex"], authMethods: [oauth("ChatGPT Plus / Pro", "openai-codex")], compatibility: "openai", models: [
+            { id: "gpt-5.3-codex-spark", name: "GPT-5.3 Codex Spark", reasoning: true },
+            { id: "gpt-5-codex", name: "GPT-5 Codex", reasoning: true },
+        ] },
+    { id: "google", name: "Google Gemini", aliases: ["gemini"], authMethods: [apiKey("Gemini API key", "https://aistudio.google.com/app/apikey"), reference], env: ["GEMINI_API_KEY", "GOOGLE_API_KEY"], compatibility: "google", helpUrl: "https://ai.google.dev/gemini-api/docs", models: [
+            { id: "gemini-2.5-pro", name: "Gemini 2.5 Pro", reasoning: true },
+            { id: "gemini-2.5-flash", name: "Gemini 2.5 Flash", reasoning: true },
+        ] },
+    { id: "xai", name: "xAI", authMethods: [oauth("Grok / X subscription", "xai"), apiKey("xAI API key", "https://console.x.ai"), reference], env: ["XAI_API_KEY", "GROK_API_KEY"], compatibility: "openai", models: [] },
+    { id: "openrouter", name: "OpenRouter", authMethods: [apiKey("OpenRouter API key", "https://openrouter.ai/keys"), reference], env: ["OPENROUTER_API_KEY"], compatibility: "openai", models: [] },
+    { id: "groq", name: "Groq", authMethods: [apiKey("Groq API key", "https://console.groq.com/keys"), reference], env: ["GROQ_API_KEY"], compatibility: "openai", models: [] },
+    { id: "mistral", name: "Mistral", authMethods: [apiKey("Mistral API key", "https://console.mistral.ai/api-keys"), reference], env: ["MISTRAL_API_KEY"], compatibility: "openai", models: [] },
+    { id: "deepseek", name: "DeepSeek", authMethods: [apiKey("DeepSeek API key", "https://platform.deepseek.com/api_keys"), reference], env: ["DEEPSEEK_API_KEY"], compatibility: "openai", models: [] },
+    { id: "together", name: "Together AI", authMethods: [apiKey("Together API key", "https://api.together.ai/settings/api-keys"), reference], env: ["TOGETHER_API_KEY"], compatibility: "openai", models: [] },
+    { id: "fireworks", name: "Fireworks AI", authMethods: [apiKey("Fireworks API key", "https://fireworks.ai/account/api-keys"), reference], env: ["FIREWORKS_API_KEY"], compatibility: "openai", models: [] },
+    { id: "cohere", name: "Cohere", authMethods: [apiKey("Cohere API key", "https://dashboard.cohere.com/api-keys"), reference], env: ["COHERE_API_KEY"], models: [] },
+    { id: "perplexity", name: "Perplexity", authMethods: [apiKey("Perplexity API key", "https://www.perplexity.ai/settings/api"), reference], env: ["PERPLEXITY_API_KEY"], compatibility: "openai", models: [] },
+];
+/** Common providers that accept API keys, for browser pickers and validation. */
+export const BIVY_API_KEY_PROVIDER_IDS = BIVY_PROVIDER_CATALOG
+    .filter((provider) => provider.authMethods.some((method) => method.kind === "api_key"))
+    .map((provider) => provider.id);
+const providersById = new Map();
+for (const provider of BIVY_PROVIDER_CATALOG) {
+    providersById.set(provider.id, provider);
+    for (const alias of provider.aliases ?? [])
+        providersById.set(alias, provider);
+}
+/** Resolve a canonical provider id or a declared alias. */
+export function bivyProvider(id) {
+    return providersById.get(String(id || "").trim().toLowerCase());
+}
+/** Search the static registry without requiring a node or network request. */
+export function searchBivyProviders(query) {
+    const needle = query.trim().toLowerCase();
+    return BIVY_PROVIDER_CATALOG.filter((provider) => !needle || `${provider.name} ${provider.id} ${(provider.aliases ?? []).join(" ")}`.toLowerCase().includes(needle));
+}

package/dist/runtime/model-catalog.js

@@ -9,6 +9,7 @@
 // run, with pi as just one (rich) contributor. New api-key providers are
 // supported dynamically (the provider→env mapping is generic); OAuth providers
 // are those in Bivy's native registry.
+import { BIVY_PROVIDER_CATALOG, BIVY_PROVIDER_CATALOG_VERSION, bivyProvider } from "./bivy-provider-catalog.js";
 import { createCredentialVault } from "./credential-store.js";
 import { isNativeOAuthProvider } from "./oauth/model-oauth-providers.js";
 async function catalogOf(runtime) {
@@ -33,17 +34,44 @@ export async function aggregateModelCatalog(runtimes, credsDir) {
         Promise.all(runtimes.map(async (runtime) => ({ agent: runtime.id, providers: await catalogOf(runtime) }))),
         createCredentialVault(credsDir).list().catch(() => []),
     ]);
-    const configured = new Set(stored.map((info) => info.providerId));
+    const configured = new Set(stored.map((info) => bivyProvider(info.providerId)?.id ?? info.providerId));
     const byProvider = new Map();
     const seenModel = new Map();
+    // The baseline makes this useful with zero installed agents and offline. Live
+    // catalogs below add availability and replace same-id model metadata with the
+    // fresher runtime row while retaining models absent from runtime discovery.
+    for (const provider of BIVY_PROVIDER_CATALOG) {
+        const models = provider.models.map((model) => ({ provider: provider.id, ...model }));
+        byProvider.set(provider.id, {
+            id: provider.id,
+            name: provider.name,
+            oauth: provider.authMethods.some((method) => method.kind === "oauth"),
+            configured: configured.has(provider.id),
+            agents: [],
+            models,
+            provenance: { baselineVersion: BIVY_PROVIDER_CATALOG_VERSION, runtimeIds: [] },
+        });
+        seenModel.set(provider.id, new Set(models.map((model) => model.id)));
+    }
+    const refreshedAt = Date.now();
     for (const { agent, providers } of perAgent) {
         for (const provider of providers) {
-            const id = provider.id.trim().toLowerCase();
-            if (!id)
+            const rawId = provider.id.trim().toLowerCase();
+            if (!rawId)
                 continue;
+            const definition = bivyProvider(rawId);
+            const id = definition?.id ?? rawId;
             let entry = byProvider.get(id);
             if (!entry) {
-                entry = { id, name: provider.name || id, oauth: isNativeOAuthProvider(id), configured: configured.has(id), agents: [], models: [] };
+                entry = {
+                    id,
+                    name: provider.name || id,
+                    oauth: isNativeOAuthProvider(id),
+                    configured: configured.has(id),
+                    agents: [],
+                    models: [],
+                    provenance: { runtimeIds: [], refreshedAt },
+                };
                 byProvider.set(id, entry);
                 seenModel.set(id, new Set());
             }
@@ -51,12 +79,21 @@ export async function aggregateModelCatalog(runtimes, credsDir) {
                 entry.oauth = true;
             if (!entry.agents.includes(agent))
                 entry.agents.push(agent);
+            const provenance = entry.provenance ??= { runtimeIds: [] };
+            if (!provenance.runtimeIds.includes(agent))
+                provenance.runtimeIds.push(agent);
+            provenance.refreshedAt = refreshedAt;
             const models = seenModel.get(id);
             for (const model of provider.models) {
-                if (models.has(model.id))
+                const normalized = { ...model, provider: id };
+                if (models.has(model.id)) {
+                    const index = entry.models.findIndex((candidate) => candidate.id === model.id);
+                    if (index >= 0)
+                        entry.models[index] = normalized;
                     continue;
+                }
                 models.add(model.id);
-                entry.models.push(model);
+                entry.models.push(normalized);
             }
         }
     }
@@ -79,6 +116,7 @@ export function mergeProviderCatalog(base, catalog) {
         if (existing) {
             existing.agents = provider.agents;
             existing.models = provider.models;
+            existing.provenance = provider.provenance;
             if (provider.oauth)
                 existing.oauth = true;
         }
@@ -90,6 +128,7 @@ export function mergeProviderCatalog(base, catalog) {
                 configured: provider.configured,
                 agents: provider.agents,
                 models: provider.models,
+                provenance: provider.provenance,
             });
         }
     }

package/dist/runtime/oauth/model-oauth.js

@@ -308,13 +308,13 @@ export { isNativeOAuthProvider, nativeOAuthProviderIds } from "./model-oauth-pro
  * store. The interaction (prompt/notify) is caller-supplied; the whole flow —
  * PKCE, callback server, token exchange — is Bivy's.
  */
-export async function loginModelOAuth(credsDir, providerId, interaction) {
+export async function loginModelOAuth(credsDir, providerId, interaction, label = DEFAULT_LABEL) {
     const provider = getModelOAuthProvider(providerId);
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
     const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
     const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
-    await createCredentialVault(credsDir).modify(providerId, async () => credential);
+    await createCredentialVault(credsDir).modifyRecord(providerId, label, async () => credential);
 }
 /** Exchange the refresh token for a fresh credential (network call; throws on failure). */
 async function refreshTokens(provider, current) {

package/dist/runtime/process.js

@@ -299,7 +299,7 @@ class ProcessSession {
         // added after this session started) reach the agent. The vault wins over any
         // ambient key so Bivy's shared sign-in is authoritative.
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
             : {};
         // Optional prepare step (e.g. Codex materializes its auth.json from the vault
         // and pins CODEX_HOME). Runs after credentials, before preflight/spawn; its

package/dist/runtime/protocol.js

@@ -299,7 +299,7 @@ class ProtocolSession {
         if (!hook)
             return null;
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
             : {};
         let prepareEnv = this.prepareEnv;
         if (this.runtimeOptions.prepare) {
@@ -321,7 +321,7 @@ class ProtocolSession {
         if (this.child)
             return;
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
             : {};
         // Optional prepare step, run before the child spawns because a shim reads its
         // credential at launch (e.g. Codex mints ~/.codex/auth.json from the vault and
@@ -778,7 +778,7 @@ class ProtocolSession {
         // idempotent (it no-ops once auth.json exists), so the repeat is cheap.
         if (this.runtimeOptions.prepare || this.runtimeOptions.preflight) {
             const credentialEnv = this.runtimeOptions.credentials
-                ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider).catch(() => ({}))
+                ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
                 : {};
             if (this.runtimeOptions.prepare) {
                 this.prepareEnv =

package/dist/runtime/provider-catalog.js

@@ -1,15 +1,43 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
-// The Pi-catalog bridge: the single place the credential API's provider listing
-// is joined with Pi's model-provider catalog.
-//
-// The credential API (src/credentials/api.ts) is deliberately Pi-free and takes
-// the catalog as data (`joinProviderCatalog`). This thin module is the injection
-// point — it fetches Pi's catalog and hands it in. Swapping Pi for a Bivy-owned
-// catalog later is a change here and nowhere else.
+// Bivy's provider catalog joined with live Pi status and Bivy credentials.
+// Static product metadata comes from @bivy/core; Pi is an optional freshness
+// overlay rather than the authority or a prerequisite for listing providers.
+import { BIVY_PROVIDER_CATALOG, bivyProvider } from "./bivy-provider-catalog.js";
 import { listPiProviders } from "./pi-oauth.js";
 import { joinProviderCatalog } from "../credentials/api.js";
-/** Enumerate model providers with their current auth status (catalog from Pi). */
+/** Pure baseline/live merge, exported for alternate runtime bridges and tests. */
+export function overlayProviderCatalog(live) {
+    const byId = new Map();
+    for (const provider of BIVY_PROVIDER_CATALOG) {
+        byId.set(provider.id, {
+            id: provider.id,
+            name: provider.name,
+            oauth: provider.authMethods.some((method) => method.kind === "oauth"),
+            configured: false,
+        });
+    }
+    for (const row of live) {
+        const rawId = row.id.trim().toLowerCase();
+        if (!rawId)
+            continue;
+        const definition = bivyProvider(rawId);
+        const id = definition?.id ?? rawId;
+        const previous = byId.get(id);
+        byId.set(id, {
+            id,
+            // Bivy owns names for registered identities; live catalogs name unknowns.
+            name: definition?.name ?? (row.name || previous?.name || id),
+            oauth: previous?.oauth === true || row.oauth,
+            configured: previous?.configured === true || row.configured,
+            // Preserve the live source/freshness signal (stored, environment, etc.).
+            ...(row.source ? { source: row.source } : previous?.source ? { source: previous.source } : {}),
+        });
+    }
+    return [...byId.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Enumerate Bivy's baseline providers, overlaid with Pi's live auth status. */
 export async function listProviders(credsDir, piDir) {
-    return joinProviderCatalog(credsDir, await listPiProviders(credsDir, piDir));
+    const live = await listPiProviders(credsDir, piDir).catch(() => []);
+    return joinProviderCatalog(credsDir, overlayProviderCatalog(live));
 }

package/dist/server.js

@@ -45,7 +45,7 @@ import { dedupeSessionSummaries } from "./session-identity.js";
 import { deriveSessionState } from "./session/session-state.js";
 import { resolveStreamingBehavior } from "./session/record.js";
 import { createSessionEngine } from "./session/engine.js";
-import { exportProviderAuth, exportAccountApiKeys, exportSyncableProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, setCredentialSync, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, exportSyncableRecords, exportRecordTombstones, importCredentialRecords } from "./credentials/api.js";
+import { exportProviderAuth, exportAccountApiKeys, exportSyncableProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, setCredentialSync, setCredentialUnattended, exportUnattendedRecords, unattendedCredentialRevision, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, exportSyncableRecords, exportRecordTombstones, importCredentialRecords, reconcileHostedCredentialRecords } from "./credentials/api.js";
 import { listProviders } from "./runtime/provider-catalog.js";
 import { exportLocalModels, importLocalModels } from "./runtime/local-model-store.js";
 import { execEphemeralRequest } from "./ephemeral-exec.js";
@@ -2599,17 +2599,20 @@ const RELAY_COMMANDS = {
     async "credentials.account.export"(_msg, ctx) {
         // This reply travels inside the already-paired E2E node channel. It contains
         // API keys only; OAuth/ref/node-local material is excluded by the API.
-        ctx.reply({ type: "credentials.account.export", requestId: _msg.requestId, entries: await exportAccountApiKeys(credsDir) });
+        ctx.reply({ type: "credentials.account.export", requestId: _msg.requestId, entries: await exportAccountApiKeys(credsDir), records: await listCredentialRecords(credsDir), deletedAt: await exportRecordTombstones(credsDir) });
     },
     async "credential.set"(msg, ctx) {
         try {
             const provider = String(msg.provider ?? "").trim().toLowerCase();
             const label = String(msg.label ?? "");
             const ref = typeof msg.ref === "string" ? msg.ref.trim() : "";
+            const requestedSync = msg.sync === "account" || msg.sync === "node" ? msg.sync : undefined;
+            // Persist the secret and its requested tier atomically. Creating a
+            // machine-only credential must never leave an account-tier crash window.
             if (ref)
-                await setProviderReferenceLabeled(credsDir, provider, label, ref);
+                await setProviderReferenceLabeled(credsDir, provider, label, ref, requestedSync);
             else
-                await setProviderApiKeyLabeled(credsDir, provider, label, String(msg.key ?? ""));
+                await setProviderApiKeyLabeled(credsDir, provider, label, String(msg.key ?? ""), requestedSync);
             await pushModelAuthToControlPlane();
             await refreshSessionAfterAuth();
             relay?.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
@@ -2622,27 +2625,45 @@ const RELAY_COMMANDS = {
             ctx.reply({ type: "credential.set.error", requestId: msg.requestId, error: message });
         }
     },
-    async "credential.remove"(msg) {
+    async "credential.remove"(msg, ctx) {
         try {
             await removeProviderCredential(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""));
             await pushModelAuthToControlPlane();
             await refreshSessionAfterAuth();
             relay?.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
+            ctx.reply({ type: "credential.remove.ok", requestId: msg.requestId });
         }
         catch (error) {
-            relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
+            const message = error instanceof Error ? error.message : String(error);
+            relay?.sendEvent({ type: "session.error", error: message });
+            ctx.reply({ type: "credential.remove.error", requestId: msg.requestId, error: message });
         }
     },
-    async "credential.sync.set"(msg) {
+    async "credential.sync.set"(msg, ctx) {
         try {
             const sync = msg.sync === "node" ? "node" : "account";
             await setCredentialSync(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), sync);
             await pushModelAuthToControlPlane();
             relay?.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
+            ctx.reply({ type: "credential.sync.set.ok", requestId: msg.requestId });
         }
         catch (error) {
-            relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
+            const message = error instanceof Error ? error.message : String(error);
+            relay?.sendEvent({ type: "session.error", error: message });
+            ctx.reply({ type: "credential.sync.set.error", requestId: msg.requestId, error: message });
+        }
+    },
+    async "credential.unattended.set"(msg, ctx) {
+        try {
+            await setCredentialUnattended(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), msg.unattended === true);
+            await pushModelAuthToControlPlane();
+            relay?.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
+            ctx.reply({ type: "credential.unattended.set.ok", requestId: msg.requestId });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            ctx.reply({ type: "credential.unattended.set.error", requestId: msg.requestId, error: message });
         }
     },
     // "Test connection": a bounded, non-secret liveness probe for one credential
@@ -2674,14 +2695,16 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
         }
     },
-    async "credentials.presets.setMapping"(msg) {
+    async "credentials.presets.setMapping"(msg, ctx) {
         try {
             setCredentialPresetMapping(credsDir, String(msg.preset ?? ""), String(msg.provider ?? ""), String(msg.label ?? ""));
             await refreshSessionAfterAuth();
             relay?.sendEvent({ type: "credentials.presets", presets: getCredentialPresets(credsDir) });
+            ctx.reply({ type: "credentials.presets.setMapping.ok", requestId: msg.requestId });
         }
         catch (error) {
-            relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
+            const message = error instanceof Error ? error.message : String(error);
+            ctx.reply({ type: "credentials.presets.setMapping.error", requestId: msg.requestId, error: message });
         }
     },
     // --- Local / custom models (Bivy-owned registry; Pi is a projection). ---
@@ -2850,7 +2873,7 @@ const RELAY_COMMANDS = {
     // `auth.oauth.progress|done|error` already mirror to the relay via broadcast.
     async "provider.oauth.start"(msg) {
         try {
-            const state = await startOAuthLogin(String(msg.provider ?? msg.id ?? ""));
+            const state = await startOAuthLogin(String(msg.provider ?? msg.id ?? ""), String(msg.label ?? "default"));
             relay?.sendEvent({
                 type: "provider.oauth.started",
                 id: state.id,
@@ -3303,7 +3326,12 @@ function startRelayIfConfigured() {
     return true;
 }
 const modelAuthVaultKeyPath = path.join(appDir, "model-auth-vault.json");
+const hostedModelAuthVaultKeyPath = path.join(appDir, "model-auth-hosted-vault.json");
+const hostedImportedRecordsPath = path.join(appDir, "model-auth-hosted-records.json");
 let lastPushedModelAuthCiphertext = "";
+let lastPushedHostedModelAuthCiphertext = "";
+let lastPushedHostedModelAuthRevision = -1;
+const isHostedCustodyNode = () => Boolean(process.env.BIVY_GITHUB_HOSTED_TASKS);
 function readLocalModelAuthVaultKey() {
     try {
         const parsed = JSON.parse(fs.readFileSync(modelAuthVaultKeyPath, "utf8"));
@@ -3329,6 +3357,40 @@ function forgetLocalModelAuthVaultKey() {
     }
     catch { /* best effort */ }
 }
+function readHostedModelAuthVaultKey() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(hostedModelAuthVaultKeyPath, "utf8"));
+        if (parsed.vaultKeyB64 && Buffer.from(parsed.vaultKeyB64, "base64").length === 32)
+            return parsed.vaultKeyB64;
+    }
+    catch { /* no hosted key */ }
+    return undefined;
+}
+function writeHostedModelAuthVaultKey(vaultKeyB64) {
+    fs.writeFileSync(hostedModelAuthVaultKeyPath, `${JSON.stringify({ vaultKeyB64, createdAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+}
+function readHostedImportedRecords() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(hostedImportedRecordsPath, "utf8"));
+        return Array.isArray(parsed?.records)
+            ? parsed.records.filter((record) => Boolean(record) && typeof record === "object" && typeof record.provider === "string" && typeof record.label === "string")
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeHostedImportedRecords(records) {
+    fs.writeFileSync(hostedImportedRecordsPath, `${JSON.stringify({ records }, null, 2)}\n`, { mode: 0o600 });
+}
+function ensureHostedModelAuthVaultKey() {
+    const existing = readHostedModelAuthVaultKey();
+    if (existing)
+        return existing;
+    const created = randomBytes(32).toString("base64");
+    writeHostedModelAuthVaultKey(created);
+    return created;
+}
 function ensureLocalModelAuthVaultKey() {
     const existing = readLocalModelAuthVaultKey();
     if (existing)
@@ -3442,32 +3504,47 @@ async function syncModelAuthFromControlPlane() {
         if (!res?.ok)
             return;
         const data = (await res.json().catch(() => ({})));
-        let vaultKeyB64 = readLocalModelAuthVaultKey();
-        if (!vaultKeyB64 && data.wrappedKey?.wrappedKey) {
+        const hostedCustody = isHostedCustodyNode();
+        let hostedData = {};
+        if (hostedCustody) {
+            const hostedResponse = await modelAuthFetch("/node/model-auth-hosted-vault");
+            if (hostedResponse?.ok)
+                hostedData = (await hostedResponse.json().catch(() => ({})));
+        }
+        const targetVault = hostedCustody ? hostedData.hostedVault : data.vault;
+        let vaultKeyB64 = hostedCustody ? readHostedModelAuthVaultKey() : readLocalModelAuthVaultKey();
+        if (!hostedCustody && !vaultKeyB64 && data.wrappedKey?.wrappedKey) {
             vaultKeyB64 = pairingStore.unwrapFromNodePublicKey(data.wrappedKey.wrappedByPublicKey, data.wrappedKey.wrappedKey);
             writeLocalModelAuthVaultKey(vaultKeyB64);
         }
-        // Node-less inheritance: a lone HOSTED ephemeral (no peer to wrap the key)
-        // adopts the vault key the control plane escrowed for this hosted account, so
-        // it can decrypt the synced vault (incl. subscription OAuth) on cold start. The
-        // control plane serves `hostedKey` only for hosted-provisioning accounts.
-        if (!vaultKeyB64 && data.hostedKey && Buffer.from(data.hostedKey, "base64").length === 32) {
-            vaultKeyB64 = data.hostedKey;
-            writeLocalModelAuthVaultKey(vaultKeyB64);
+        // Hosted runners may decrypt ONLY the separately encrypted snapshot of
+        // records that the user explicitly granted to unattended execution.
+        if (hostedCustody && !vaultKeyB64 && hostedData.hostedKey && hostedData.hostedVault && Buffer.from(hostedData.hostedKey, "base64").length === 32) {
+            vaultKeyB64 = hostedData.hostedKey;
+            writeHostedModelAuthVaultKey(vaultKeyB64);
         }
-        if (data.vault?.ciphertext && vaultKeyB64) {
+        if (targetVault?.ciphertext && vaultKeyB64) {
             let decrypted;
             try {
-                decrypted = decryptModelAuthEnvelope(data.vault.ciphertext, vaultKeyB64);
+                decrypted = decryptModelAuthEnvelope(targetVault.ciphertext, vaultKeyB64);
             }
             catch (error) {
                 // Most commonly this node cached the previous generation while another
                 // survivor completed a revoke-triggered re-key. Forget it and request a
                 // wrap of the current key; retaining it would make every poll fail forever.
-                forgetLocalModelAuthVaultKey();
-                lastPushedModelAuthCiphertext = "";
-                await modelAuthFetch("/node/model-auth-key/request", { method: "POST", body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64() }) });
-                ensureModelAuthColdStart();
+                if (hostedCustody) {
+                    try {
+                        fs.rmSync(hostedModelAuthVaultKeyPath, { force: true });
+                    }
+                    catch { /* best effort */ }
+                    lastPushedHostedModelAuthCiphertext = "";
+                }
+                else {
+                    forgetLocalModelAuthVaultKey();
+                    lastPushedModelAuthCiphertext = "";
+                    await modelAuthFetch("/node/model-auth-key/request", { method: "POST", body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64() }) });
+                    ensureModelAuthColdStart();
+                }
                 console.warn("[auth-sync] cached vault key is stale; requested the rotated key:", error.message);
                 return;
             }
@@ -3477,7 +3554,16 @@ async function syncModelAuthFromControlPlane() {
             // so importing records alone (plus its record-keyed tombstones) is complete.
             // Fall back to the provider-keyed fields for a v2 peer.
             if (v >= 3) {
-                await importCredentialRecords(credsDir, records, recordsDeletedAt);
+                if (hostedCustody) {
+                    // Hosted snapshots are authoritative filtered sets, not additive peer
+                    // merges. Remove custody-derived records omitted by a later snapshot
+                    // so a revoke takes effect on already-running hosted nodes.
+                    const current = await reconcileHostedCredentialRecords(credsDir, records, readHostedImportedRecords());
+                    writeHostedImportedRecords(current);
+                }
+                else {
+                    await importCredentialRecords(credsDir, records, recordsDeletedAt);
+                }
             }
             else {
                 await importProviderAuth(credsDir, providers, deletedAt);
@@ -3487,15 +3573,18 @@ async function syncModelAuthFromControlPlane() {
             // regenerate it (and refresh the panel) after importing the vault.
             await writePiModelsProjection();
             await broadcastLocalModels();
-            lastPushedModelAuthCiphertext = data.vault.ciphertext;
+            if (hostedCustody)
+                lastPushedHostedModelAuthCiphertext = targetVault.ciphertext;
+            else
+                lastPushedModelAuthCiphertext = targetVault.ciphertext;
             // Got the key and imported the vault (incl. any subscription-OAuth logins) —
             // the cold-start race is over.
             stopModelAuthColdStart();
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
-            if (data.vault.needsRotation)
+            if (!hostedCustody && data.vault?.needsRotation)
                 await pushModelAuthToControlPlane(true);
         }
-        else if (data.vault?.ciphertext && !vaultKeyB64) {
+        else if (targetVault?.ciphertext && !vaultKeyB64 && !hostedCustody) {
             await modelAuthFetch("/node/model-auth-key/request", { method: "POST", body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64() }) });
             // No peer has wrapped our key yet. Fast-retry (bounded) so a short-lived
             // ephemeral runner picks up the key within seconds of a peer answering,
@@ -3509,7 +3598,7 @@ async function syncModelAuthFromControlPlane() {
         await processModelAuthKeyRequests(data.requests ?? []);
         // Ready means there is no encrypted vault to hydrate, or this node has the
         // key needed to consume it. Ciphertext with no key remains not-ready.
-        if (!data.vault?.ciphertext || readLocalModelAuthVaultKey())
+        if (!targetVault?.ciphertext || (hostedCustody ? readHostedModelAuthVaultKey() : readLocalModelAuthVaultKey()))
             void reportEphemeralMilestone("credentialsReadyAt");
     }
     catch (error) {
@@ -3530,6 +3619,38 @@ async function processModelAuthKeyRequests(requests) {
         });
     }
 }
+async function pushHostedModelAuthToControlPlane() {
+    const [records, revision] = await Promise.all([exportUnattendedRecords(credsDir), unattendedCredentialRevision(credsDir)]);
+    if (revision === lastPushedHostedModelAuthRevision)
+        return;
+    const key = ensureHostedModelAuthVaultKey();
+    const ciphertext = encryptModelAuthProviders({}, {}, {}, key, records, {});
+    const publish = async (expectedGeneration) => modelAuthFetch("/node/model-auth-hosted-vault", {
+        method: "PUT",
+        body: JSON.stringify({ ciphertext, vaultKeyB64: key, expectedGeneration, revision }),
+    });
+    const currentResponse = await modelAuthFetch("/node/model-auth-hosted-vault");
+    if (currentResponse?.status === 403)
+        return; // hosted provisioning is disabled
+    const current = currentResponse?.ok
+        ? (await currentResponse.json().catch(() => ({})))
+        : {};
+    let response = await publish(current.hostedVault?.generation ?? 0);
+    if (response?.status === 409) {
+        const conflict = await response.json().catch(() => ({}));
+        // Retry only when our logical state is at least as new; the store also
+        // enforces this revision check atomically with the generation CAS.
+        if (revision >= Number(conflict.revision ?? 0))
+            response = await publish(Number(conflict.generation ?? 0));
+    }
+    if (response?.ok) {
+        lastPushedHostedModelAuthCiphertext = ciphertext;
+        lastPushedHostedModelAuthRevision = revision;
+    }
+    else if (response?.status !== 403 && response?.status !== 409) {
+        throw new Error(`hosted model-auth push failed (${response?.status ?? "offline"})`);
+    }
+}
 async function pushModelAuthToControlPlane(rotateKey = false) {
     if (!sessionAdvertiseTarget)
         return;
@@ -3540,6 +3661,13 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
     // versa.
     await pushProviderSummaryToControlPlane();
     try {
+        // A hosted runner holds only the explicitly granted snapshot and must never
+        // overwrite the peer-to-peer account vault with that filtered subset.
+        if (isHostedCustodyNode()) {
+            // Hosted runners are recipients, never authorities for the custody set.
+            // Letting one republish its stale filtered copy could undo a revocation.
+            return;
+        }
         // Only push credentials on the account-sync tier; a `sync: "node"` credential
         // stays local (per-credential opt-out). Tombstones still converge for all.
         const providers = await exportSyncableProviderAuth(credsDir);
@@ -3554,8 +3682,10 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
         if (rotateKey)
             writeLocalModelAuthVaultKey(vaultKeyB64);
         const ciphertext = encryptModelAuthProviders(providers, deletedAt, localModels, vaultKeyB64, records, recordsDeletedAt);
-        if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext)
+        if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext) {
+            await pushHostedModelAuthToControlPlane();
             return;
+        }
         const push = await modelAuthFetch("/node/model-auth-vault", { method: "PUT", body: JSON.stringify({ ciphertext, rotated: rotateKey }) });
         if (!push?.ok) {
             if (rotateKey) {
@@ -3570,14 +3700,11 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
             method: "PUT",
             body: JSON.stringify({ targetNodeId: identity.nodeId, wrappedByPublicKey: pairingStore.nodePublicKeyB64(), wrappedKey: pairingStore.wrapForNodePublicKey(pairingStore.nodePublicKeyB64(), vaultKeyB64) }),
         });
-        // Node-less inheritance: a HOSTED node also escrows the vault key to the control
-        // plane (sealed at rest, hosted-only) so the account's NEXT hosted ephemeral —
-        // possibly the only node — can decrypt this vault without a peer to wrap the key.
-        // Gated to hosted nodes; the CP double-checks the account is hosted. Best effort.
-        if (process.env.BIVY_GITHUB_HOSTED_TASKS) {
-            await modelAuthFetch("/node/model-auth-key/hosted-escrow", { method: "PUT", body: JSON.stringify({ vaultKeyB64 }) }).catch(() => { });
-        }
         lastPushedModelAuthCiphertext = ciphertext;
+        // Publish a DIFFERENT ciphertext under a DIFFERENT key containing only
+        // records with `unattended:true`. Escrowing this key cannot decrypt the E2E
+        // account vault, which is the critical custody separation.
+        await pushHostedModelAuthToControlPlane();
     }
     catch (error) {
         console.warn("[auth-sync] could not push model auth:", error.message);
@@ -5480,7 +5607,7 @@ function chooseHeadlessOAuthOption(prompt) {
     return (options.find((option) => /device|headless/i.test(`${option?.id ?? ""} ${option?.label ?? ""}`))?.id
         ?? options[0]?.id);
 }
-async function startOAuthLogin(provider) {
+async function startOAuthLogin(provider, label = "default") {
     if (!isNativeOAuthProvider(provider)) {
         throw new Error(`Provider ${provider} does not support browser/subscription login`);
     }
@@ -5534,7 +5661,7 @@ async function startOAuthLogin(provider) {
         // Free-text/secret steps can't be answered from a remote device.
         throw new Error(`${input.message} Use terminal login for this provider step.`);
     };
-    loginModelOAuth(credsDir, provider, { signal: abort.signal, notify, prompt })
+    loginModelOAuth(credsDir, provider, { signal: abort.signal, notify, prompt }, label)
         .then(() => {
         state.status = "done";
         settleInitial();
@@ -5544,8 +5671,11 @@ async function startOAuthLogin(provider) {
         // list. Push a fresh list to every connected client; otherwise Settings
         // clears the login form but continues rendering its stale "Not connected"
         // snapshot until a reload or a later manual refresh.
-        void listProvidersUnified()
-            .then((providers) => broadcast({ type: "providers.list", providers }))
+        void Promise.all([listProvidersUnified(), listCredentialRecords(credsDir)])
+            .then(([providers, records]) => {
+            broadcast({ type: "providers.list", providers });
+            broadcast({ type: "credentials.records", records });
+        })
             .catch(() => { });
         void pushModelAuthToControlPlane();
         void refreshSessionAfterAuth();
@@ -9404,6 +9534,108 @@ app.post("/api/auth/api-key", async (req, res, next) => {
         next(error);
     }
 });
+// Item-addressed credential-vault REST API. This mirrors the relay commands so
+// direct/self-hosted and hosted clients use the same records and behavior.
+app.get("/api/auth/credentials", async (_req, res, next) => {
+    try {
+        res.json({ records: await listCredentialRecords(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.get("/api/auth/credentials/account-export", async (_req, res, next) => {
+    try {
+        res.json({ entries: await exportAccountApiKeys(credsDir), records: await listCredentialRecords(credsDir), deletedAt: await exportRecordTombstones(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.post("/api/auth/credentials", async (req, res, next) => {
+    try {
+        const provider = String(req.body?.provider ?? "").trim().toLowerCase();
+        const label = String(req.body?.label ?? "default");
+        const ref = typeof req.body?.ref === "string" ? req.body.ref.trim() : "";
+        const requestedSync = req.body?.sync === "account" || req.body?.sync === "node" ? req.body.sync : undefined;
+        if (ref)
+            await setProviderReferenceLabeled(credsDir, provider, label, ref, requestedSync);
+        else
+            await setProviderApiKeyLabeled(credsDir, provider, label, String(req.body?.key ?? ""), requestedSync);
+        await pushModelAuthToControlPlane();
+        await refreshSessionAfterAuth();
+        res.json({ ok: true, records: await listCredentialRecords(credsDir), providers: await listProvidersUnified() });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.delete("/api/auth/credentials/:provider/:label", async (req, res, next) => {
+    try {
+        await removeProviderCredential(credsDir, String(req.params.provider), String(req.params.label));
+        await pushModelAuthToControlPlane();
+        await refreshSessionAfterAuth();
+        res.json({ ok: true, records: await listCredentialRecords(credsDir), providers: await listProvidersUnified() });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.post("/api/auth/credentials/:provider/:label/availability", async (req, res, next) => {
+    try {
+        const sync = req.body?.sync === "node" ? "node" : "account";
+        await setCredentialSync(credsDir, String(req.params.provider), String(req.params.label), sync);
+        await pushModelAuthToControlPlane();
+        res.json({ ok: true, records: await listCredentialRecords(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.post("/api/auth/credentials/:provider/:label/unattended", async (req, res, next) => {
+    try {
+        await setCredentialUnattended(credsDir, String(req.params.provider), String(req.params.label), req.body?.unattended === true);
+        await pushModelAuthToControlPlane();
+        res.json({ ok: true, records: await listCredentialRecords(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.post("/api/auth/credentials/:provider/:label/test", async (req, res, next) => {
+    try {
+        const provider = String(req.params.provider).trim().toLowerCase();
+        const label = String(req.params.label);
+        const result = await testProviderCredential(credsDir, provider, label);
+        res.json({ provider, label, ...result, records: await listCredentialRecords(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.get("/api/auth/credential-assignments", (_req, res) => {
+    res.json({ presets: getCredentialPresets(credsDir) });
+});
+app.post("/api/auth/credential-assignments/active", async (req, res, next) => {
+    try {
+        setActiveCredentialPreset(credsDir, String(req.body?.active ?? ""));
+        await refreshSessionAfterAuth();
+        res.json({ ok: true, presets: getCredentialPresets(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
+app.post("/api/auth/credential-assignments", async (req, res, next) => {
+    try {
+        setCredentialPresetMapping(credsDir, String(req.body?.preset ?? "default"), String(req.body?.provider ?? ""), String(req.body?.label ?? ""));
+        await refreshSessionAfterAuth();
+        res.json({ ok: true, presets: getCredentialPresets(credsDir) });
+    }
+    catch (error) {
+        next(error);
+    }
+});
 // List model providers + auth status (the "Models & providers" screen). Shared by
 // every agent runtime via the credential vault, so one login here serves all.
 app.get("/api/auth/providers", async (_req, res, next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.329",
+  "version": "0.10.1-staging.331",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",