@bivy/bivy 0.16.18-staging.9 → 0.16.18

package/dist/agents/claude-code/runtime.js

@@ -12,6 +12,7 @@
 //     permission callback, which maps cleanly onto our generic `toolInterceptor`.
 //   * The SDK is loaded with a dynamic import so it stays an *optional*
 //     dependency: a Bivy install only needs it when this runtime is selected.
+import { withSessionCredentials, credentialEnvFallback } from "../../credentials/session.js";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -782,7 +783,7 @@ class ClaudeSession {
     async interactiveTuiCommand() {
         if (!claudeCliAvailable())
             return null;
-        const env = await this.resolveCredentialEnv().catch(() => ({}));
+        const env = await this.resolveCredentialEnv().catch(credentialEnvFallback);
         return { command: "claude", args: ["--resume", this.sessionFile], env };
     }
     getMessages() {
@@ -956,7 +957,7 @@ class ClaudeSession {
         if (this.query)
             return this.refreshSupportedModels();
         try {
-            const env = { ...process.env, ...depCacheEnv(this.cwd), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv().catch(() => ({}))) };
+            const env = { ...process.env, ...depCacheEnv(this.cwd), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv().catch(credentialEnvFallback)) };
             if (anthropicCredentialPreflight(env))
                 return; // no credential — keep FALLBACK_MODELS
             await this.ensureStarted();
@@ -989,7 +990,7 @@ class ClaudeSession {
             // refresh it immediately even if its expiry claims it is still valid.
             // The resolver compares this under the vault lock, making concurrent
             // failures converge on one rotation.
-            const credEnv = await this.resolveCredentialEnv(rejectedToken).catch(() => ({}));
+            const credEnv = await this.resolveCredentialEnv(rejectedToken).catch(credentialEnvFallback);
             const nextToken = authTokenFromEnv(credEnv);
             if (!nextToken || nextToken === this.spawnedToken)
                 return false;
@@ -1039,8 +1040,8 @@ class ClaudeSession {
         try {
             cred = await store.getCredential(provider, { workspace: this.cwd, ...(rejectedToken ? { rejectedToken } : {}) });
         }
-        catch {
-            return {};
+        catch (error) {
+            return credentialEnvFallback(error);
         }
         if (!cred)
             return {};
@@ -1314,7 +1315,7 @@ class ClaudeSession {
         // reach the SDK, surface an actionable message instead of letting it spawn
         // and fail its first request with an opaque `401 Unauthorized`.
         if (!this.query) {
-            const env = { ...process.env, ...depCacheEnv(this.cwd), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv().catch(() => ({}))) };
+            const env = { ...process.env, ...depCacheEnv(this.cwd), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv().catch(credentialEnvFallback)) };
             const preflightError = anthropicCredentialPreflight(env);
             if (preflightError) {
                 this.messages.push({ role: "user", content: hasImages ? content : prompt, timestamp: Date.now() });
@@ -1507,12 +1508,12 @@ export class ClaudeCodeRuntime {
         return [{ id: "anthropic", name: "Anthropic", oauth: true, models: FALLBACK_MODELS }];
     }
     async createSession(options) {
-        const session = new ClaudeSession(this.options, options.workspace, options.toolInterceptor, options.toolProvider);
+        const session = new ClaudeSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace, options.toolInterceptor, options.toolProvider);
         this.sessions.push(session);
         return { session };
     }
     async openSession(options) {
-        const session = new ClaudeSession(this.options, options.workspace, options.toolInterceptor, options.toolProvider, options.sessionFile);
+        const session = new ClaudeSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace, options.toolInterceptor, options.toolProvider, options.sessionFile);
         this.sessions.push(session);
         return {
             session,

package/dist/agents/pi/runtime.js

@@ -188,7 +188,8 @@ class PiSession {
      */
     async interactiveTuiCommand() {
         const file = this.sessionFile;
-        if (!file)
+        // The shared native auth.json cannot represent a session-local assignment.
+        if (!file || Object.keys(this.tui.credentialLabels ?? {}).length)
             return null;
         // Pi's own TUI reads its plaintext auth.json store, so project the vault to
         // disk (refreshed) for the hand-off. Best-effort: an empty auth.json just
@@ -423,7 +424,7 @@ export class PiRuntime {
                 modelsPath: path.join(piDir, "models.json"),
                 allowModelNetwork,
             })
-            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork, workspace: sessionManager.getCwd() || options.workspace });
+            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork, workspace: sessionManager.getCwd() || options.workspace, credentialLabels: options.credentialLabels });
         const backgroundShells = new BackgroundShellTracker();
         const createRuntime = async ({ cwd, agentDir, sessionManager, sessionStartEvent }) => {
             const sessionId = sessionManager.getSessionId();
@@ -451,6 +452,7 @@ export class PiRuntime {
             sessionManager,
         });
         const tui = {
+            credentialLabels: options.credentialLabels,
             credsDir,
             piDir,
             sessionsDir: this.options.sessionsDir,

package/dist/automation-template.js

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Wire format mirrored in src/automation-template.ts (node has no core dependency).
+const PREFIX = "bivy-automation-v1\n";
+/** Account labels, never credentials, travel inside the encrypted template. */
+export function encodeAutomationTemplate(instructions, credentialLabels) {
+    return Object.keys(credentialLabels).length || instructions.startsWith(PREFIX)
+        ? PREFIX + JSON.stringify({ instructions, credentialLabels })
+        : instructions;
+}
+/** Legacy plaintext templates remain valid. Malformed structured templates fail closed. */
+export function decodeAutomationTemplate(value) {
+    if (!value.startsWith(PREFIX))
+        return { instructions: value, credentialLabels: {} };
+    const data = JSON.parse(value.slice(PREFIX.length));
+    if (!data || typeof data.instructions !== "string" || !data.credentialLabels ||
+        typeof data.credentialLabels !== "object" || Array.isArray(data.credentialLabels) ||
+        Object.entries(data.credentialLabels).some(([provider, label]) => !provider.trim() || provider !== provider.trim().toLowerCase() || typeof label !== "string" || !label.trim())) {
+        throw new Error("Invalid automation account selections");
+    }
+    return { instructions: data.instructions, credentialLabels: data.credentialLabels };
+}

package/dist/credentials/resolver.js

@@ -14,6 +14,7 @@ import { createCredentialVault } from "./store.js";
 import { selectCredential } from "./selection.js";
 export { projectIdsFromWorkspace } from "./selection.js";
 import { loadPresets, defaultPresetsPath } from "./presets.js";
+import { credentialEnvFallback } from "./session.js";
 /** Refresh an OAuth token this many ms before it expires (clock-skew guard). */
 const OAUTH_REFRESH_SKEW_MS = 60_000;
 /** Resolver over Bivy's credential store, with OAuth refresh-on-read via the bridge. */
@@ -166,11 +167,20 @@ export async function buildAgentCredentialEnv(store, providers, activeProvider,
         try {
             cred = await store.getCredential(id, workspace ? { workspace } : undefined);
         }
-        catch {
+        catch (error) {
+            credentialEnvFallback(error);
             continue;
         }
         if (!cred)
             continue;
+        // Session-pinned Anthropic auth clears the competing ambient login even
+        // when the agent has not advertised its active model provider yet.
+        if (cred.provider === "anthropic" && cred.env) {
+            for (const key of ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"]) {
+                if (cred.env[key] === "")
+                    env[key] = "";
+            }
+        }
         const isActive = !!active && cred.provider === active;
         if (cred.kind === "oauth") {
             // OAuth *subscription* tokens are provider-specific and are not accepted

package/dist/credentials/selected-store.js

@@ -1,11 +1,20 @@
 import { defaultPresetsPath, loadPresets } from "./presets.js";
 import { selectCredential } from "./selection.js";
+import { CredentialSelectionError } from "./session.js";
 /** A provider-addressed view of the vault for consumers without labeled accounts.
  * Resolve on every operation; never copy a work credential into the default slot.
  * Refresh writes stay attached to the selected record's label and metadata.
  */
 export function selectedCredentialStore(store, credsDir, context) {
-    const select = async (provider) => selectCredential(provider, await store.listRecords(), loadPresets(defaultPresetsPath(credsDir)), context)?.record;
+    const selectRecord = (provider, records, presets) => {
+        const record = selectCredential(provider, records, presets, context)?.record;
+        const label = context?.credentialLabels?.[provider];
+        if (label && (!record || record.source.kind !== "stored")) {
+            throw new CredentialSelectionError(`Selected account “${label}” for ${provider} is unavailable on this machine`);
+        }
+        return record;
+    };
+    const select = async (provider) => selectRecord(provider, await store.listRecords(), loadPresets(defaultPresetsPath(credsDir)));
     return {
         async read(provider) {
             const record = await select(provider);
@@ -17,8 +26,8 @@ export function selectedCredentialStore(store, credsDir, context) {
         async list() {
             const records = await store.listRecords();
             const presets = loadPresets(defaultPresetsPath(credsDir));
-            return [...new Set(records.map((r) => r.provider))].flatMap((providerId) => {
-                const record = selectCredential(providerId, records, presets, context)?.record;
+            return [...new Set([...records.map((r) => r.provider), ...Object.keys(context?.credentialLabels ?? {})])].flatMap((providerId) => {
+                const record = selectRecord(providerId, records, presets);
                 if (record?.source.kind !== "stored")
                     return [];
                 const credential = record.source.cred;

package/dist/credentials/selection.js

@@ -17,8 +17,9 @@ export function selectCredential(provider, records, presets, context) {
     const workspace = context?.workspace?.trim();
     const projects = [context?.project?.trim(), ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter(Boolean);
     const projectPreset = projects.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
+    const preferLabel = context?.credentialLabels?.[id] ?? context?.preferLabel;
     return resolveCredential(id, records, presets, {
         ...(projectPreset ? { preset: projectPreset } : {}),
-        ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}),
+        ...(preferLabel ? { preferLabel } : {}),
     });
 }

package/dist/credentials/session.js

@@ -0,0 +1,48 @@
+export class CredentialSelectionError extends Error {
+}
+/** Preserve historical best-effort auth only when no explicit account failed. */
+export function credentialEnvFallback(error) {
+    if (error instanceof CredentialSelectionError)
+        throw error;
+    return {};
+}
+/** Bind a private provider→label map, without changing shared vault assignments. */
+export async function withSessionCredentials(options, labels) {
+    if (!labels || !Object.keys(labels).length)
+        return options;
+    const store = options.credentials;
+    if (!store)
+        throw new CredentialSelectionError("This agent manages its own login and cannot use automation account overrides");
+    const selected = { ...labels };
+    const credentials = {
+        listConfigured: async () => [...new Set([...(await store.listConfigured?.().catch(() => []) ?? []), ...Object.keys(selected)])],
+        async getCredential(provider, context) {
+            const label = selected[provider.trim().toLowerCase()];
+            let credential;
+            try {
+                credential = await store.getCredential(provider, { ...context, ...(label ? { preferLabel: label } : {}) });
+            }
+            catch (error) {
+                if (label)
+                    throw new CredentialSelectionError(`Could not read selected account “${label}” for ${provider}`);
+                throw error;
+            }
+            if (label && !credential)
+                throw new CredentialSelectionError(`Selected account “${label}” for ${provider} is unavailable on this machine`);
+            if (label && credential?.kind === "oauth" && credential.provider !== "anthropic") {
+                throw new CredentialSelectionError(`This agent cannot use a ${provider} subscription override; use an API key or a Bivy-managed model agent`);
+            }
+            // Do not let an inherited alternative Anthropic login outrank the pin.
+            if (label && credential?.provider === "anthropic")
+                return {
+                    ...credential,
+                    env: { ...credential.env, [credential.kind === "oauth" ? "ANTHROPIC_API_KEY" : "CLAUDE_CODE_OAUTH_TOKEN"]: "" },
+                };
+            return credential;
+        },
+    };
+    // Fail before starting a subprocess, including overrides for a second provider.
+    for (const provider of Object.keys(selected))
+        await credentials.getCredential(provider);
+    return { ...options, credentials };
+}

package/dist/runtime/agent-service.js

@@ -135,8 +135,8 @@ export class AgentService {
             const toolProvider = message.options.toolSpecs?.length ? this.makeToolProvider(svc, message.options.toolSpecs) : undefined;
             const workspace = message.options.workspace ?? process.cwd();
             const result = message.op === "open" && message.options.sessionFile
-                ? await runtime.openSession({ workspace, sessionFile: message.options.sessionFile, toolInterceptor, toolProvider })
-                : await runtime.createSession({ workspace, toolInterceptor, toolProvider });
+                ? await runtime.openSession({ workspace, credentialLabels: message.options.credentialLabels, sessionFile: message.options.sessionFile, toolInterceptor, toolProvider })
+                : await runtime.createSession({ workspace, credentialLabels: message.options.credentialLabels, toolInterceptor, toolProvider });
             svc.session = result.session;
             svc.id = result.session.id;
             svc.lastSent = this.mirror(result.session);

package/dist/runtime/pi-oauth.js

@@ -26,8 +26,11 @@ export function piCredentialStore(store) {
 export async function createPiModelRuntime(opts) {
     const store = opts.store ?? createCredentialVault(opts.credsDir);
     const { ModelRuntime } = await import("@earendil-works/pi-coding-agent");
+    const selected = selectedCredentialStore(store, opts.credsDir, { workspace: opts.workspace, credentialLabels: opts.credentialLabels });
+    for (const provider of Object.keys(opts.credentialLabels ?? {}))
+        await selected.read(provider);
     return ModelRuntime.create({
-        credentials: piCredentialStore(selectedCredentialStore(store, opts.credsDir, { workspace: opts.workspace })),
+        credentials: piCredentialStore(selected),
         modelsPath: path.join(opts.piDir, "models.json"),
         allowModelNetwork: opts.allowModelNetwork ?? false,
     });

package/dist/runtime/process.js

@@ -5,6 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { stripAnsi } from "./ansi.js";
 import { buildAgentCredentialEnv } from "./credentials.js";
+import { withSessionCredentials, credentialEnvFallback } from "../credentials/session.js";
 import { egressEnv, sessionEgressEnv } from "../harness/egress.js";
 import { depCacheEnv } from "../harness/dep-cache.js";
 import { bivySessionEnv } from "./session-env.js";
@@ -304,7 +305,7 @@ class ProcessSession {
         // added after this session started) reach the agent. The vault wins over any
         // ambient key so Bivy's shared sign-in is authoritative.
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(credentialEnvFallback)
             : {};
         // Optional prepare step (e.g. Codex materializes its auth.json from the vault
         // and pins CODEX_HOME). Runs after credentials, before preflight/spawn; its
@@ -530,7 +531,7 @@ export class ProcessRuntime {
         return [...byProvider.values()];
     }
     async createSession(options) {
-        const session = new ProcessSession(this.options, options.workspace);
+        const session = new ProcessSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace);
         this.sessions.push(session);
         return { session, warning: "Generic CLI runtime streams stdout/stderr only; approvals, model picker, and resume depend on the underlying agent protocol." };
     }
@@ -538,7 +539,7 @@ export class ProcessRuntime {
         // Resumable runtimes bind the agent's session id so each prompt continues it
         // (see resumeArgs); non-resumable ones ignore the ref and start fresh.
         if (this.options.resumable) {
-            const session = new ProcessSession(this.options, options.workspace, options.sessionFile);
+            const session = new ProcessSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace, options.sessionFile);
             this.sessions.push(session);
             return { session };
         }

package/dist/runtime/protocol.js

@@ -4,6 +4,7 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { buildAgentCredentialEnv } from "./credentials.js";
+import { withSessionCredentials, credentialEnvFallback } from "../credentials/session.js";
 import { bivySessionEnv } from "./session-env.js";
 import { mergeAgentCommands } from "./slash-commands.js";
 import { withExactCapabilitySurface } from "./types.js";
@@ -318,7 +319,7 @@ class ProtocolSession {
         if (!hook)
             return null;
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(credentialEnvFallback)
             : {};
         let prepareEnv = this.prepareEnv;
         if (this.runtimeOptions.prepare) {
@@ -340,7 +341,7 @@ class ProtocolSession {
         if (this.child)
             return;
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(credentialEnvFallback)
             : {};
         // Optional prepare step, run before the child spawns because a shim reads its
         // credential at launch (e.g. Codex mints ~/.codex/auth.json from the vault and
@@ -440,7 +441,7 @@ class ProtocolSession {
         if (!this.runtimeOptions.prepare && !this.runtimeOptions.preflight)
             return undefined;
         const credentialEnv = this.runtimeOptions.credentials
-            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(() => ({}))
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider, this.cwd).catch(credentialEnvFallback)
             : {};
         if (this.runtimeOptions.prepare) {
             this.prepareEnv =
@@ -993,7 +994,7 @@ export class ProtocolRuntime {
         return this.options.catalog ?? [];
     }
     async createSession(options) {
-        const session = new ProtocolSession(this.options, options.workspace, this.capabilities, options.toolInterceptor);
+        const session = new ProtocolSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace, this.capabilities, options.toolInterceptor);
         try {
             await session.start();
             this.sessions.push(session);
@@ -1010,7 +1011,7 @@ export class ProtocolRuntime {
         // Adopt the caller's canonical id (a reopen of a known session) so the
         // resumed session keeps its original id instead of taking `sessionFile` (the
         // agent's own ref) as its id — see OpenSessionOptions.canonicalId.
-        const session = new ProtocolSession(this.options, options.workspace, this.capabilities, options.toolInterceptor, options.sessionFile, options.canonicalId);
+        const session = new ProtocolSession(await withSessionCredentials(this.options, options.credentialLabels), options.workspace, this.capabilities, options.toolInterceptor, options.sessionFile, options.canonicalId);
         try {
             await session.start();
             if (!this.options.resumable && !this.capabilities.resume) {

package/dist/runtime/remote.js

@@ -543,12 +543,12 @@ export class RemoteRuntime {
     async createSession(options) {
         const transport = await this.config.connect();
         const toolSpecs = options.toolProvider?.list();
-        return startRemoteSession(transport, { runtime: this.id, sandbox: this.config.sandbox, op: "create", options: { workspace: options.workspace, hasToolInterceptor: Boolean(options.toolInterceptor), ...(toolSpecs?.length ? { toolSpecs } : {}) } }, { toolInterceptor: options.toolInterceptor, toolProvider: options.toolProvider });
+        return startRemoteSession(transport, { runtime: this.id, sandbox: this.config.sandbox, op: "create", options: { credentialLabels: options.credentialLabels, workspace: options.workspace, hasToolInterceptor: Boolean(options.toolInterceptor), ...(toolSpecs?.length ? { toolSpecs } : {}) } }, { toolInterceptor: options.toolInterceptor, toolProvider: options.toolProvider });
     }
     async openSession(options) {
         const transport = await this.config.connect();
         const toolSpecs = options.toolProvider?.list();
-        return startRemoteSession(transport, { runtime: this.id, sandbox: this.config.sandbox, op: "open", options: { workspace: options.workspace, sessionFile: options.sessionFile, hasToolInterceptor: Boolean(options.toolInterceptor), ...(toolSpecs?.length ? { toolSpecs } : {}) } }, { toolInterceptor: options.toolInterceptor, toolProvider: options.toolProvider });
+        return startRemoteSession(transport, { runtime: this.id, sandbox: this.config.sandbox, op: "open", options: { credentialLabels: options.credentialLabels, workspace: options.workspace, sessionFile: options.sessionFile, hasToolInterceptor: Boolean(options.toolInterceptor), ...(toolSpecs?.length ? { toolSpecs } : {}) } }, { toolInterceptor: options.toolInterceptor, toolProvider: options.toolProvider });
     }
     /**
      * Re-attach to a session already live on the agent service (Stage 2 routing).

package/dist/server.js

@@ -36,6 +36,7 @@ import { InMemoryLocationRegistry } from "./runtime/location-registry.js";
 import { ControlPlaneSessionLocationRegistry, LayeredSessionLocationRegistry } from "./runtime/control-plane-location.js";
 import { attachAdoptedSessions, classifyAttachFailure } from "./runtime/adoption.js";
 import { createCredentialStore, testProviderCredential } from "./runtime/credentials.js";
+import { decodeAutomationTemplate } from "./automation-template.js";
 import { isModelAuthError, authProviderForSession, classifyModelAuthError } from "./runtime/auth-errors.js";
 import { createCredentialVault, migrateVaultDir } from "./runtime/credential-store.js";
 import { probeAnthropicAccess } from "./runtime/anthropic-preflight.js";
@@ -4136,6 +4137,7 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
     // which now adopts the existing remote branch rather than colliding.
     const existing = findIssueSession(source);
     if (existing?.worktree && fs.existsSync(existing.worktree.path)) {
+        assertSessionAccounts(existing, overrides.credentialLabels);
         const currentSandbox = existing.sandbox ?? sandboxTier();
         const safety = projectSafety(existing.worktree.path, overrides.sandbox ?? currentSandbox, overrides.approvalMode);
         if (safety.sandbox !== currentSandbox) {
@@ -4208,6 +4210,7 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
         runtimeId: directives.runtimeId,
         sandbox: safety.sandbox,
         approvalMode: safety.approval,
+        credentialLabels: overrides.credentialLabels,
     });
     record.githubIssueUrl = `https://github.com/${cfg.owner}/${cfg.repo}/issues/${issue.number}`;
     // Title the session from the issue up front so it never shows as "Untitled
@@ -4805,6 +4808,11 @@ function linearSessionSource(externalId) {
  * starting, and return false so the caller falls through. Returns true only when
  * it fully handled the item.
  */
+function assertSessionAccounts(record, labels) {
+    if (Object.entries(labels ?? {}).some(([provider, label]) => record.credentialLabels?.[provider] !== label)) {
+        throw new Error("This session uses different provider accounts; start a new session to use the automation's selections");
+    }
+}
 async function continueCorrelatedSession(item, prompt, report, opts) {
     if (item.targetKind !== "existing_session" || !item.targetSessionId)
         return false;
@@ -4831,6 +4839,7 @@ async function continueCorrelatedSession(item, prompt, report, opts) {
         }
         return false;
     }
+    assertSessionAccounts(record, opts?.credentialLabels);
     const branch = record.worktree?.branch;
     if (opts?.resumeOnMissing) {
         // Durable work targeting an existing Session waits for its current turn to
@@ -4908,13 +4917,16 @@ async function executeWorkItem(item, report, signal) {
     // assigned node can read. The envelope prefix is Bivy's own and never appears
     // on issue/Slack/Linear bodies, so decrypt whenever it's present regardless of
     // source.
+    let credentialLabels;
     if (item.body?.startsWith("bivy-room-v1:")) {
         const [, nodeId, ...payload] = item.body.split(":");
         if (nodeId !== identity.nodeId || payload.length === 0) {
             throw new Error("automation instructions were encrypted for a different node");
         }
         try {
-            item = { ...item, body: open(pairingStore.roomKey(), payload.join(":")) };
+            const template = decodeAutomationTemplate(open(pairingStore.roomKey(), payload.join(":")));
+            credentialLabels = template.credentialLabels;
+            item = { ...item, body: template.instructions };
         }
         catch {
             throw new Error("could not decrypt automation instructions on this node");
@@ -4983,6 +4995,7 @@ async function executeWorkItem(item, report, signal) {
         await runIssueTask(cfg, issue, {
             runtimeId: item.runtimeId,
             model: item.model,
+            credentialLabels,
             sandbox: normalizeSandboxTier(item.sandbox),
             approvalMode: approvalModeFrom(item.approvalMode),
             onEvidence: report,
@@ -5007,7 +5020,7 @@ async function executeWorkItem(item, report, signal) {
             throw new Error(`Linear work item has an invalid repo "${repoSlug}"`);
         // Case B: a re-dispatch the control plane correlated to an existing session
         // continues it as a normal chat instead of starting cold (mirrors GitHub).
-        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue, item.body), report, { resumeOnMissing: item.targetKind === "existing_session", signal }))
+        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue, item.body), report, { resumeOnMissing: item.targetKind === "existing_session", signal, credentialLabels }))
             return;
         const githubToken = await resolveGitHubToken();
         if (!githubToken)
@@ -5023,6 +5036,7 @@ async function executeWorkItem(item, report, signal) {
             makeActive: false,
             source: linearSessionSource(item.externalId),
             runtimeId: item.runtimeId || nodeConfiguredDefaultAgent(),
+            credentialLabels,
             sandbox: safety.sandbox,
             approvalMode: safety.approval,
         });
@@ -5068,7 +5082,7 @@ async function executeWorkItem(item, report, signal) {
     // Scheduled runs targeting an existing session are STRICT: the message must
     // land in that session (resumed from disk if needed), never silently in a new
     // one — so a session that can't be resumed fails the run instead.
-    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: item.source === "schedule" || item.targetKind === "existing_session", isMessage, signal }))
+    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: item.source === "schedule" || item.targetKind === "existing_session", isMessage, signal, credentialLabels }))
         return;
     const requestedSandbox = normalizeSandboxTier(item.sandbox);
     // Prepare an explicit repository before resolving its policy. Otherwise a
@@ -5084,6 +5098,7 @@ async function executeWorkItem(item, report, signal) {
     const sessionOpts = {
         makeActive: false,
         title: item.title,
+        credentialLabels,
         runtimeId: item.runtimeId,
         sandbox,
     };
@@ -6303,6 +6318,7 @@ function persistSessionMetadata(record, status = sessionStatus(record)) {
         delegationDepth: record.delegationDepth,
         runtimeId: record.runtimeId,
         sandbox: record.sandbox,
+        credentialLabels: record.credentialLabels,
         agentName: getRuntime(record.runtimeId).displayName,
         contract: record.contract,
         status,
@@ -7570,7 +7586,7 @@ async function refreshRecordAfterTui(record) {
         const workspace = record.worktree?.path || oldSession.cwd || record.workspace;
         // Refreshing an EXISTING record: its id is already known, so attach_to_chat
         // (see toolProvider's SessionIdRef doc) can be wired live, not deferred.
-        const runtimeSessionOptions = { workspace, toolProvider: integrations.toolProvider({ current: record.id }), ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}) };
+        const runtimeSessionOptions = { credentialLabels: record.credentialLabels, workspace, toolProvider: integrations.toolProvider({ current: record.id }), ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}) };
         const { session, warning } = await runtimeHost.openSession(rt, { ...runtimeSessionOptions, sessionFile: record.sessionFile });
         record.session = session;
         record.sessionFile = session.sessionFile ?? record.sessionFile;
@@ -7805,6 +7821,7 @@ async function recoverRecordAfterAbort(record) {
         const workspace = record.worktree?.path || oldSession.cwd || record.workspace;
         const runtimeSessionOptions = {
             workspace,
+            credentialLabels: record.credentialLabels,
             toolProvider: integrations.toolProvider({ current: record.id }),
             ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}),
         };
@@ -7904,6 +7921,7 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     const restoredWorktree = requestedSessionFile ? restoredWorktreeFromMetadata(storedMeta) : undefined;
     const existing = requestedSessionFile ? (openSessions.get(requestedSessionFile) ?? (storedMeta?.id ? openSessions.get(storedMeta.id) : undefined)) : undefined;
     if (existing) {
+        assertSessionAccounts(existing, opts.credentialLabels);
         // Reopening an already-open session must NOT bump its last-active time —
         // that only tracks real user/agent activity, not focus. (Was touchSession.)
         if (makeActive)
@@ -7993,7 +8011,8 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // built now, up front — so hand it this box instead of a session id and fill
     // `.current` in the moment `sessionId` is (see toolProvider's SessionIdRef doc).
     const attachSessionIdRef = {};
-    const runtimeSessionOptions = { workspace: runtimeWorkspace, toolProvider: integrations.toolProvider(attachSessionIdRef), ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}) };
+    const credentialLabels = opts.credentialLabels ?? storedMeta?.credentialLabels;
+    const runtimeSessionOptions = { credentialLabels, workspace: runtimeWorkspace, toolProvider: integrations.toolProvider(attachSessionIdRef), ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}) };
     // Stage 2/3: prefer re-attaching to a still-live remote session — routed to its
     // OWN agent service — over re-opening a fresh copy from disk. Falls back to
     // open/create when nothing live is there.
@@ -8054,7 +8073,7 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // Rehydrating (rather than leaving this undefined for a resumed session)
     // also avoids a persistSessionMetadata call later silently clobbering the
     // stored contract with undefined via its `{...prev, ...input}` merge.
-    const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: sessionSafety.approval, automationRunId: storedMeta?.automationRunId, delegationDepth: storedMeta?.delegationDepth, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, contract: storedMeta?.contract, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral, workspaceState: runGit(["status", "--porcelain", "--untracked-files=normal"], sessionWorkspace) ? "dirty" : "clean" };
+    const record = { id: sessionId, session, runtimeId: rt.id, credentialLabels, sandbox: sessionSandbox, approvalMode: sessionSafety.approval, automationRunId: storedMeta?.automationRunId, delegationDepth: storedMeta?.delegationDepth, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, contract: storedMeta?.contract, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral, workspaceState: runGit(["status", "--porcelain", "--untracked-files=normal"], sessionWorkspace) ? "dirty" : "clean" };
     // Migration: a session resumed/reopened from before this feature (or from a
     // node that predates it) has no stored contract. Stamp an honest one now
     // from currently-observed facts rather than leaving it blank forever or
@@ -8371,7 +8390,7 @@ async function createWorkspaceSession(workspace, opts = {}) {
         await fetchOrigin(workspace);
         return createGitWorkspaceSession(workspace, parsed, opts);
     }
-    const record = await createSession(workspace, undefined, { runtimeId: opts.runtimeId, sandbox: opts.sandbox, makeActive: opts.makeActive });
+    const record = await createSession(workspace, undefined, { runtimeId: opts.runtimeId, credentialLabels: opts.credentialLabels, sandbox: opts.sandbox, makeActive: opts.makeActive });
     applyInitialSessionName(record, opts);
     return record;
 }
@@ -8389,6 +8408,7 @@ async function createGitWorkspaceSession(repoDir, parsed, opts = {}) {
         worktree: { branch, base },
         source: `repo:${parsed.slug}`,
         runtimeId: opts.runtimeId,
+        credentialLabels: opts.credentialLabels,
         sandbox: opts.sandbox,
         makeActive: opts.makeActive,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.18-staging.9",
+  "version": "0.16.18",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",