@bivy/bivy 0.16.24 → 0.16.25-staging.2

package/dist/agents/claude-code/integration.js

@@ -43,6 +43,7 @@ export function claudeCodeIntegration(origin) {
                 testedVersion: CLAUDE_TESTED_VERSION,
                 source: origin,
                 authOwner: "agent",
+                credentialRequirements: { owner: "agent", strategy: "agent-login", providers: ["anthropic"] },
                 notes: installed
                     ? "Uses the Claude Code executable already on this node, including its native auth, configuration, and sessions. Set BIVY_CLAUDE_MODEL to pick a default model."
                     : agentInstalled

package/dist/agents/codex/integration.js

@@ -157,6 +157,7 @@ export function codexIntegration(origin) {
                 testedVersion: CODEX_TESTED_VERSION,
                 source: origin,
                 authOwner: "agent",
+                credentialRequirements: { owner: "agent", strategy: "agent-login", providers: ["openai-codex", "openai"] },
                 notes: installed
                     ? "Uses Codex's native app-server, login, configuration, rollouts, model selection, and sandbox while Bivy mediates structured tool approvals."
                     : "Install and sign in to Codex on this node; Bivy will connect to that existing agent.",

package/dist/agents/pi/integration.js

@@ -125,6 +125,7 @@ export function piIntegration(origin) {
                 testedVersion: PI_TESTED_VERSION,
                 source: origin,
                 authOwner: "agent",
+                credentialRequirements: { owner: "agent", strategy: "one-of", providers: [] },
                 notes: !nodeSupportsPi()
                     ? unsupportedNodeMessage()
                     : installed

package/dist/controllers/credential-commands.js

@@ -122,13 +122,20 @@ export function createCredentialCommands(deps) {
             }
         },
         async "credential.unattended.set"(msg, ctx) {
+            const provider = String(msg.provider ?? "");
+            const label = String(msg.label ?? "");
+            const previous = (await listCredentialRecords(credsDir)).find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
             try {
-                await setCredentialUnattended(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), msg.unattended === true);
+                await setCredentialUnattended(credsDir, provider, label, msg.unattended === true);
                 await deps.pushModelAuthToControlPlane();
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.unattended.set.ok", requestId: msg.requestId });
             }
             catch (error) {
+                // The UI must never claim an encrypted Cloud copy exists when custody
+                // publication failed. Restore the prior local grant before rejecting.
+                await setCredentialUnattended(credsDir, provider, label, previous).catch(() => { });
+                deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 const message = error instanceof Error ? error.message : String(error);
                 ctx.reply({ type: "credential.unattended.set.error", requestId: msg.requestId, error: message });
             }

package/dist/credentials/document.js

@@ -87,17 +87,44 @@ function sameRecordContent(a, b) {
     const strip = ({ updatedAt: _drop, ...rest }) => rest;
     return JSON.stringify(strip(a)) === JSON.stringify(strip(b));
 }
+function canonicalCredential(credential) {
+    const { updatedAt: _drop, ...content } = credential;
+    const stable = (value) => {
+        if (Array.isArray(value))
+            return value.map(stable);
+        if (!value || typeof value !== "object")
+            return value;
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+            .map(([key, child]) => [key, stable(child)]));
+    };
+    return JSON.stringify(stable(content));
+}
 /**
- * Should `incoming` replace `local` during a non-destructive merge? The v2 rule,
- * re-keyed to records:
- *  - No local → take incoming.
- *  - Only stored-OAuth-vs-stored-OAuth needs freshness arbitration; anything else
- *    (api-key, reference, a type/source switch) lets a real content change win.
- *  - A snapshot with a blank refresh token must never clobber a usable one
- *    (rotated refresh tokens are single-use).
- *  - Prefer the token minted LATER by `refreshedAt`; else the later `expires`. A
- *    tie KEEPS local (strictly-greater wins), so equal stamps can't churn/rotate.
+ * OAuth ordering shared by record and legacy-wire merges. This must be a total,
+ * symmetric order: OpenAI/Codex rotates refresh tokens, so node A may publish r2
+ * after refreshing while node B later uploads its stale r1 snapshot. `updatedAt`
+ * on B can be later merely because it synced later; it must not beat the actual
+ * token mint time. A usable refresh token wins over a blank one, then the newer
+ * `refreshedAt` wins (falling back to access-token `expires` for old records).
+ * Equal freshness uses canonical content only to make both merge directions
+ * converge; it does not pretend that store write time is token freshness.
  */
+export function preferIncomingOAuthCredential(local, incoming) {
+    const localHasRefresh = Boolean(String(local.refresh ?? "").trim());
+    const incomingHasRefresh = Boolean(String(incoming.refresh ?? "").trim());
+    if (localHasRefresh !== incomingHasRefresh)
+        return incomingHasRefresh;
+    const localRefreshed = Number(local.refreshedAt);
+    const incomingRefreshed = Number(incoming.refreshedAt);
+    const bothHaveRefreshTime = Number.isFinite(localRefreshed) && Number.isFinite(incomingRefreshed);
+    const localFreshness = bothHaveRefreshTime ? localRefreshed : (Number(local.expires) || 0);
+    const incomingFreshness = bothHaveRefreshTime ? incomingRefreshed : (Number(incoming.expires) || 0);
+    if (incomingFreshness !== localFreshness)
+        return incomingFreshness > localFreshness;
+    return canonicalCredential(incoming) > canonicalCredential(local);
+}
+/** Should `incoming` replace `local` during a non-destructive merge? */
 export function preferIncomingRecord(local, incoming) {
     if (!local)
         return true;
@@ -105,15 +132,7 @@ export function preferIncomingRecord(local, incoming) {
     const incomingOauth = oauthOf(incoming);
     if (!localOauth || !incomingOauth)
         return true;
-    const localRefresh = String(localOauth.refresh ?? "").trim();
-    const incomingRefresh = String(incomingOauth.refresh ?? "").trim();
-    if (!incomingRefresh && localRefresh)
-        return false;
-    const lt = Number(localOauth.refreshedAt);
-    const it = Number(incomingOauth.refreshedAt);
-    if (Number.isFinite(lt) && Number.isFinite(it))
-        return it > lt;
-    return (Number(incomingOauth.expires) || 0) > (Number(localOauth.expires) || 0);
+    return preferIncomingOAuthCredential(localOauth, incomingOauth);
 }
 /** A tombstone wins only when it is newer than the record it would remove. */
 export function tombstoneWinsRecord(record, deletedAt) {

package/dist/credentials/store.js

@@ -20,7 +20,7 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { seal, open } from "../e2e.js";
-import { migrateToV3, mergeDocuments, recordFromStored, emptyDocument, } from "./document.js";
+import { migrateToV3, mergeDocuments, preferIncomingOAuthCredential, recordFromStored, emptyDocument, } from "./document.js";
 import { credKey, parseCredKey, normalizeLabel, inferReferenceBackend, DEFAULT_LABEL } from "./records.js";
 // Node crypto adapter for the at-rest vault. e2e.ts (AES-256-GCM seal/open) is a
 // repo crypto leaf; this node service may depend on it. Injecting a Sealer
@@ -61,29 +61,16 @@ function defaultKey(provider) {
  *  - No local entry → take the incoming one.
  *  - Only OAuth-vs-OAuth needs freshness arbitration (an api-key set/replace, or a
  *    type switch, keeps the existing "incoming wins on a real content change").
- *  - A snapshot that omits the refresh token must never clobber a usable one —
- *    rotated refresh tokens are single-use, so an incoming with a blank refresh is
- *    strictly worse than a local one that still has it.
- *  - Prefer the token minted LATER by `refreshedAt` (monotonic mint order) when
- *    both carry it; otherwise fall back to the access-token `expires`. In both
- *    cases a tie KEEPS the local credential (strictly-greater wins), so an equal
- *    stamp can't needlessly churn/rotate the vault, and clock skew can't let an
- *    equal-`expires` stale token win.
+ *  - A snapshot that omits the refresh token must never clobber a usable one.
+ *  - OAuth ordering is delegated to document.ts so record-shaped and legacy
+ *    wire merges use the same deterministic refreshedAt/expires/content order.
  */
 export function preferIncomingCredential(local, incoming) {
     if (!local)
         return true;
     if (local.type !== "oauth" || incoming.type !== "oauth")
         return true;
-    const localRefresh = String(local.refresh ?? "").trim();
-    const incomingRefresh = String(incoming.refresh ?? "").trim();
-    if (!incomingRefresh && localRefresh)
-        return false;
-    const lt = Number(local.refreshedAt);
-    const it = Number(incoming.refreshedAt);
-    if (Number.isFinite(lt) && Number.isFinite(it))
-        return it > lt;
-    return (Number(incoming.expires) || 0) > (Number(local.expires) || 0);
+    return preferIncomingOAuthCredential(local, incoming);
 }
 /** A tombstone wins only when it is newer than the credential it would remove. */
 export function tombstoneWins(credential, deletedAt) {

package/dist/remote/relay-client.js

@@ -87,6 +87,7 @@ export class RelayConnector {
     // and the socket closing. This — not "a connector object exists" — is what
     // "connected" means to the control plane, so it's what `bivy status` reports.
     ready = false;
+    remoteClients = 0;
     // Most recent relay-side failure (ticket mint, socket error, or an `error`
     // frame), surfaced by `bivy status`/`doctor` so a node that never connects
     // explains why instead of silently showing "configured".
@@ -120,6 +121,8 @@ export class RelayConnector {
     get connected() {
         return this.ready && this.ws?.readyState === WebSocket.OPEN;
     }
+    /** Actual viewers on this relay connection, not a sticky prompt flag. */
+    get clientCount() { return this.connected ? this.remoteClients : 0; }
     /** Most recent relay-side failure, if any — for status/diagnostics. */
     get lastError() {
         return this.lastErrorMessage;
@@ -132,6 +135,7 @@ export class RelayConnector {
     stop() {
         this.closed = true;
         this.ready = false;
+        this.remoteClients = 0;
         this.stopHeartbeat();
         this.clearBackoffReset();
         this.ws?.close();
@@ -330,6 +334,8 @@ export class RelayConnector {
             // before declaring the connector usable or resetting reconnect backoff.
         });
         ws.on("message", (data) => {
+            if (this.ws !== ws)
+                return;
             let env;
             try {
                 env = JSON.parse(data.toString());
@@ -348,6 +354,13 @@ export class RelayConnector {
                 console.log("[relay] connected");
                 return;
             }
+            if (env.t === "peer.online" || env.t === "peer.offline") {
+                if (typeof env.clients === "number" && Number.isSafeInteger(env.clients) && env.clients >= 0)
+                    this.remoteClients = env.clients;
+                else if (env.t === "peer.online")
+                    this.remoteClients = Math.max(1, this.remoteClients);
+                return;
+            }
             if (env.t === "pair" && typeof env.p === "string") {
                 void this.handlePairFrame(env.p);
                 return;
@@ -396,7 +409,10 @@ export class RelayConnector {
             this.lastPongAt = Date.now();
         });
         ws.on("close", () => {
+            if (this.ws !== ws)
+                return;
             this.ready = false;
+            this.remoteClients = 0;
             this.stopHeartbeat();
             this.clearBackoffReset();
             this.scheduleReconnect();

package/dist/repo-workspace.js

@@ -361,7 +361,11 @@ export async function cloneOrUpdateRepo(opts) {
     // that now-unlinked cwd makes git abort before it can even process `clone`
     // ("Unable to read current working directory"). The repos root is durable
     // across package updates and was created immediately above.
-    await exec("git", [...cc, "clone", url, dest], { cwd: opts.root, timeout: 600_000, env });
+    // Preserve the full ref/history graph needed by worktrees and PR bases, but
+    // defer file blobs until checkout/tooling actually reads them. GitHub supports
+    // protocol-v2 partial clones; this removes large historical assets from the
+    // managed session's first-message critical path without shallow-history bugs.
+    await exec("git", [...cc, "clone", "--filter=blob:none", url, dest], { cwd: opts.root, timeout: 600_000, env });
     // Persist the helper config so agent-run git in this clone authenticates too.
     // These follow-up processes need an explicit cwd for the same reason.
     await configureRepoCredentialHelper((a) => exec("git", a, { cwd: dest }), dest);

package/dist/runtime/canonical-session.js

@@ -0,0 +1,31 @@
+/** Keep Bivy's durable identity when a portable import receives a new native id.
+ * Methods/accessors still run against the native object (including private
+ * fields and provider resume ids). No per-agent identity rewriting is needed. */
+export function canonicalSession(session, id) {
+    if (!id || session.id === id)
+        return session;
+    const methods = new Map();
+    // A facade target also supports frozen native session objects: a Proxy over
+    // the native object cannot override a non-configurable, read-only id.
+    return new Proxy(Object.create(Object.getPrototypeOf(session)), {
+        get(_target, key) {
+            if (key === "id")
+                return id;
+            const value = Reflect.get(session, key, session);
+            if (typeof value !== "function")
+                return value;
+            if (methods.get(key)?.original !== value)
+                methods.set(key, { original: value, bound: value.bind(session) });
+            return methods.get(key).bound;
+        },
+        set: (_target, key, value) => key !== "id" && Reflect.set(session, key, value, session),
+        has: (_target, key) => key === "id" || key in session,
+        ownKeys: () => [...new Set([...Reflect.ownKeys(session), "id"])],
+        getOwnPropertyDescriptor(_target, key) {
+            if (key === "id")
+                return { value: id, enumerable: true, configurable: true };
+            const descriptor = Reflect.getOwnPropertyDescriptor(session, key);
+            return descriptor ? { ...descriptor, configurable: true } : undefined;
+        },
+    });
+}

package/dist/runtime/codex-auth.js

@@ -18,11 +18,11 @@
 // `id_token` — the same call Codex itself makes to refresh.
 //
 // Rotation note: OpenAI rotates the refresh token on every grant, so we persist
-// the rotated token back to the vault. We mint only when no auth.json exists yet
-// (Codex then owns and self-refreshes it), which keeps churn to a single grant.
-// The residual edge case — Codex self-refreshing later invalidates the vault's
-// copy for *other* `openai-codex` consumers — is documented; for the common case
-// (the subscription was connected for Codex) there are no other consumers.
+// the rotated token back to the vault. Codex then owns and self-refreshes its
+// auth.json; terminal-exit ingest and the next launch fold its `last_refresh`
+// token set back into the vault. This repairs persistence but does NOT serialize
+// two machines using copies of one login: operators must still run only one
+// machine (or one serialized job stream) per OpenAI refresh-token lineage.
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -130,7 +130,10 @@ export async function ensureCodexAuth(credsDir) {
             const nativeAccess = String(projected.tokens?.access_token ?? "");
             if (nativeRefresh && Number.isFinite(nativeStamp)) {
                 await store.modify("openai-codex", async (current) => {
-                    if (!current || current.type !== "oauth" || nativeStamp <= Number(current.updatedAt ?? 0))
+                    if (!current || current.type !== "oauth")
+                        return current;
+                    const currentFreshness = Number(current.refreshedAt ?? current.updatedAt ?? 0);
+                    if (nativeStamp <= currentFreshness)
                         return current;
                     return { ...current, access: nativeAccess || current.access, refresh: nativeRefresh, refreshedAt: nativeStamp };
                 });
@@ -147,15 +150,17 @@ export async function ensureCodexAuth(credsDir) {
         return undefined;
     // Persist the rotated refresh token back to the vault FIRST — OpenAI rotates it
     // on every grant, so the previous one is now dead. If we can't persist it, bail
-    // rather than strand the vault on a token we've just invalidated.
+    // rather than strand the vault on a token we've just invalidated. Use the same
+    // stamp in auth.json so later ingestion recognizes this exact token generation.
+    const refreshedAt = Date.now();
     try {
         await store.modify("openai-codex", async (current) => ({
             ...(current ?? cred),
             type: "oauth",
             access: refreshed.accessToken,
             refresh: refreshed.refreshToken,
-            expires: Date.now() + refreshed.expiresIn * 1000,
-            refreshedAt: Date.now(),
+            expires: refreshedAt + refreshed.expiresIn * 1000,
+            refreshedAt,
         }));
     }
     catch {
@@ -171,7 +176,7 @@ export async function ensureCodexAuth(credsDir) {
             refresh_token: refreshed.refreshToken,
             account_id: accountId,
         },
-        last_refresh: new Date().toISOString(),
+        last_refresh: new Date(refreshedAt).toISOString(),
     };
     try {
         fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });

package/dist/runtime/credential-ingest.js

@@ -75,9 +75,20 @@ export function codexAuthToCredential(raw) {
         return undefined;
     const accountId = typeof tokens?.account_id === "string" ? tokens.account_id : undefined;
     const expires = jwtExpiryMs(access) ?? Date.now() + 60 * 60 * 1000;
+    // Codex writes last_refresh when it rotates the single-use refresh token.
+    // Preserve that mint-order signal: without it, an offline node's stale r1
+    // auth.json could be imported after node A's r2 and win merely by syncing last.
+    const nativeRefreshTime = Date.parse(String(record.last_refresh ?? ""));
     return {
         providerId: "openai-codex",
-        credential: { type: "oauth", access, refresh, expires, ...(accountId ? { accountId } : {}) },
+        credential: {
+            type: "oauth",
+            access,
+            refresh,
+            expires,
+            ...(Number.isFinite(nativeRefreshTime) ? { refreshedAt: nativeRefreshTime } : {}),
+            ...(accountId ? { accountId } : {}),
+        },
     };
 }
 /** Fold a login/refresh done in the Codex CLI back into Bivy's vault. Returns imported count. */

package/dist/runtime/credential-provisioning.js

@@ -67,7 +67,11 @@ export async function provisionAgentRun(credsDir, piDir, agentId, workspace) {
     }
     else if (agentId === "codex") {
         // Codex reads OPENAI_API_KEY (already in env) or its own auth.json; mint the
-        // latter from a connected ChatGPT subscription when present.
+        // latter from a connected ChatGPT subscription when present. Codex may rotate
+        // that file while running; server.ts calls ingestAgentCredentials("codex") on
+        // terminal exit, and ensureCodexAuth also reconciles it on the next launch, so
+        // refreshed tokens flow back to the vault. This is persistence, not a global
+        // lease: never run two machines concurrently from copies of one Codex login.
         const home = await ensureCodexAuth(credsDir).catch(() => undefined);
         if (home)
             env.CODEX_HOME = home;

package/dist/runtime/host.js

@@ -2,6 +2,7 @@
 // Copyright (c) 2026 Petter André Sjulstad
 import { canonicalAgentId, listRuntimes, makeRuntime } from "./index.js";
 import { RemoteRuntime, connectSocketTransport } from "./remote.js";
+import { canonicalSession } from "./canonical-session.js";
 import { withExactCapabilitySurface } from "./types.js";
 function remoteRuntimeSelection() {
     const flag = process.env.BIVY_REMOTE_RUNTIME?.trim();
@@ -140,7 +141,8 @@ export class RuntimeHost {
         return runtime.createSession(options);
     }
     async openSession(runtime, options) {
-        return runtime.openSession(options);
+        const result = await runtime.openSession(options);
+        return { ...result, session: canonicalSession(result.session, options.canonicalId) };
     }
     async listSessions(runtime) {
         return runtime.listSessions();

package/dist/runtime/index.js

@@ -108,6 +108,7 @@ function genericCliInfo() {
         capabilities: { toolInterception: false, modelSelection: false, resume, packages: false, fork: false },
         supportTier: "experimental",
         authOwner: "agent",
+        credentialRequirements: { owner: "agent", strategy: "agent-login", providers: [] },
         notes: configured
             ? `Configured through BIVY_AGENT_COMMAND / BIVY_AGENT_ARGS / BIVY_AGENT_PROMPT_MODE. Provides universal streaming but not structured approvals unless the agent speaks Bivy protocol.${resume ? " Resumable via BIVY_AGENT_RESUME_TEMPLATE." : " Set BIVY_AGENT_RESUME_TEMPLATE (a JSON arg array with {id}) if the configured agent has its own \"continue session <id>\" flag."}`
             : "Set BIVY_AGENT_COMMAND to enable this universal CLI runtime.",
@@ -549,6 +550,8 @@ function cliAgentInfo(id, spec) {
             modelSelection = refined.modelSelection;
         }
     }
+    const authOwner = spec.authOwner ?? "agent";
+    const credentialProviders = [...new Set((spec.model?.models ?? []).flatMap((model) => model.provider ? [model.provider] : []))];
     return {
         id,
         executionMode,
@@ -584,7 +587,12 @@ function cliAgentInfo(id, spec) {
         nativeSandbox: Boolean(spec.nativeSandbox),
         supportTier: spec.supportTier ?? "experimental",
         testedVersion: spec.testedVersion,
-        authOwner: spec.authOwner ?? "agent",
+        authOwner,
+        credentialRequirements: {
+            owner: authOwner,
+            strategy: credentialProviders.length > 0 ? "one-of" : "agent-login",
+            providers: credentialProviders,
+        },
         notes: installed
             ? acpActive
                 // Promoted to ACP: the description must match the governed path actually in
@@ -807,6 +815,7 @@ function acpInfo() {
         capabilities: { toolInterception: true, modelSelection: false, resume: true, packages: false, fork: false },
         supportTier: "experimental",
         authOwner: "agent",
+        credentialRequirements: { owner: "agent", strategy: "agent-login", providers: [] },
         notes: configured
             ? "Drives an ACP agent via bin/acp-shim.mjs → ProtocolRuntime: Approve/Deny for blocking permission requests, observed activity, streaming transcript, and session/load resume — no per-agent code. Validate against your agent, then promote it into the picker as data."
             : "Set BIVY_ACP_COMMAND (and optional BIVY_ACP_ARGS, a JSON array) to the ACP agent's launch command, e.g. BIVY_ACP_COMMAND=gemini BIVY_ACP_ARGS='[\"--experimental-acp\"]'.",
@@ -862,6 +871,7 @@ function openClawInfo() {
         capabilities: { toolInterception: false, modelSelection: false, resume: false, packages: false, fork: false },
         supportTier: "experimental",
         authOwner: "agent",
+        credentialRequirements: { owner: "agent", strategy: "agent-login", providers: [] },
         notes: installed
             ? "Available on PATH. This phase-1 CLI adapter streams stdout/stderr only; Gateway RPC and structured tool approvals require a future OpenClaw protocol bridge. Configure with BIVY_OPENCLAW_COMMAND, BIVY_OPENCLAW_ARGS, and BIVY_OPENCLAW_AGENT."
             : `${options.command} was not found on PATH. Install OpenClaw on this node, use the PWA install button, or set BIVY_OPENCLAW_COMMAND to its CLI path.`,
@@ -889,6 +899,7 @@ function protocolInfo() {
         capabilities: { toolInterception: true, modelSelection: true, resume: true, packages: false, fork: false, ...(commands ? { commands } : {}) },
         supportTier: "experimental",
         authOwner: "mixed",
+        credentialRequirements: { owner: "mixed", strategy: "one-of", providers: [] },
         notes: configured
             ? "Configured through BIVY_PROTOCOL_COMMAND / BIVY_PROTOCOL_ARGS. Advertise agent-native slash commands with BIVY_PROTOCOL_COMMANDS (JSON [{name,description}]); other capability flags are finalized by the agent handshake."
             : "Set BIVY_PROTOCOL_COMMAND to enable a JSONL Bivy Agent Protocol runtime.",

package/dist/server.js

@@ -70,6 +70,8 @@ import { authMiddleware, resolveAuth, isAuthorized, requestOriginAllowed } from
 import { RelayConnector, loadRelayConfig, soloCredentials } from "./remote/index.js";
 import { readEphemeralTeardownConfig, shouldSelfTeardown, snapshotsDurableForTeardown, performSelfTeardown } from "./ephemeral-teardown.js";
 import { buildSessionSnapshot, applySessionSnapshot } from "./session/snapshot.js";
+import { clearTurnActivity } from "./session/turn-activity.js";
+import { rebuildSnapshotRuntime } from "./session/snapshot-runtime.js";
 import { createCheckpointBundle, applyCheckpointBundle, materializeCheckpoint } from "./session/checkpoint-pack.js";
 import { configuredTurnTimeoutMs, configuredTurnStallMs, configuredTurnActivityStallMs } from "./session/turn-watchdog.js";
 import { createTurnWatchdog, probeTurnPidAlive } from "./session/turn-watchdog-runtime.js";
@@ -2879,16 +2881,25 @@ const RELAY_COMMANDS = {
         // resolves to afterward.
         const acknowledgeReducedProtections = msg.acknowledgeReducedProtections === true;
         const gateNow = new Date().toISOString();
-        const rt = getRuntime(agentFrom(msg) ?? defaultRuntimeId);
-        const gateContract = computeSessionContract({ runtime: rt, preview: false, sandbox: sandboxFrom(msg), acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
-        if (gateContract.requiresAcknowledgement) {
-            relay?.sendEvent({
-                type: "session.error",
-                code: "reduced_protections_ack_required",
-                error: `${rt.displayName || rt.id} would run this session with reduced protections for a certified profile. Confirm to continue.`,
-                contract: gateContract,
-                requestId,
-            });
+        try {
+            const rt = getRuntime(agentFrom(msg) ?? defaultRuntimeId);
+            const gateContract = computeSessionContract({ runtime: rt, preview: false, sandbox: sandboxFrom(msg), acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
+            if (gateContract.requiresAcknowledgement) {
+                relay?.sendEvent({
+                    type: "session.error",
+                    code: "reduced_protections_ack_required",
+                    error: `${rt.displayName || rt.id} would run this session with reduced protections for a certified profile. Confirm to continue.`,
+                    contract: gateContract,
+                    requestId,
+                });
+                return;
+            }
+        }
+        catch (error) {
+            // Agent availability is checked before workspace creation. Return a real
+            // terminal response to the requesting client instead of letting the relay's
+            // outer console-only catch strand an invisible pending session forever.
+            relay?.sendEvent({ type: "session.error", requestId, error: error instanceof Error ? error.message : String(error) });
             return;
         }
         let record;
@@ -2925,6 +2936,10 @@ const RELAY_COMMANDS = {
         // live-recomputed later, so it can't silently "improve" behind the user.
         record.contract = computeSessionContract({ runtime: getRuntime(record.runtimeId), preview: false, sandbox: record.sandbox, approvalMode: record.approvalMode, acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
         persistSessionMetadata(record);
+        // Session creation returns only after the selected repository/workspace and
+        // runtime are usable. On ephemeral nodes this records a content-free latency
+        // milestone; ordinary personal nodes have no hosted Machine and ignore it.
+        void reportEphemeralMilestone("repositoryReadyAt");
         relay?.sendEvent({
             ...transcripts.buildHistoryEvent({
                 sessionId: record.id,
@@ -3050,7 +3065,7 @@ const hostedImportedRecordsPath = path.join(appDir, "model-auth-hosted-records.j
 let lastPushedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthRevision = -1;
-const isHostedCustodyNode = () => Boolean(process.env.BIVY_GITHUB_HOSTED_TASKS);
+const isHostedCustodyNode = () => Boolean(process.env.BIVY_HOSTED_CREDENTIAL_CUSTODY || process.env.BIVY_GITHUB_HOSTED_TASKS);
 function readLocalModelAuthVaultKey() {
     try {
         const parsed = JSON.parse(fs.readFileSync(modelAuthVaultKeyPath, "utf8"));
@@ -3334,9 +3349,13 @@ async function syncModelAuthFromControlPlane() {
             await pushModelAuthToControlPlane();
         }
         await processModelAuthKeyRequests(data.requests ?? []);
-        // Ready means there is no encrypted vault to hydrate, or this node has the
-        // key needed to consume it. Ciphertext with no key remains not-ready.
-        if (!targetVault?.ciphertext || (hostedCustody ? readHostedModelAuthVaultKey() : readLocalModelAuthVaultKey()))
+        // A personal node with no vault has nothing to hydrate and is ready. A
+        // hosted-custody guest is different: an absent filtered snapshot means it
+        // has no model credential at all, not that hydration succeeded.
+        const credentialsReady = hostedCustody
+            ? Boolean(targetVault?.ciphertext && readHostedModelAuthVaultKey())
+            : Boolean(!targetVault?.ciphertext || readLocalModelAuthVaultKey());
+        if (credentialsReady)
             void reportEphemeralMilestone("credentialsReadyAt");
     }
     catch (error) {
@@ -3359,6 +3378,11 @@ async function processModelAuthKeyRequests(requests) {
 }
 async function pushHostedModelAuthToControlPlane() {
     const [records, revision] = await Promise.all([exportUnattendedRecords(credsDir), unattendedCredentialRevision(credsDir)]);
+    // A setup guest must not establish an empty snapshot when the credential is
+    // first saved (before the explicit grant command follows). Otherwise its
+    // one allowed initial write would be consumed by an unusable vault.
+    if (isHostedCustodyNode() && Object.keys(records).length === 0)
+        return;
     if (revision === lastPushedHostedModelAuthRevision)
         return;
     const key = ensureHostedModelAuthVaultKey();
@@ -3369,7 +3393,7 @@ async function pushHostedModelAuthToControlPlane() {
     });
     const currentResponse = await modelAuthFetch("/node/model-auth-hosted-vault");
     if (currentResponse?.status === 403)
-        return; // hosted provisioning is disabled
+        throw new Error("hosted credential custody is not enabled for this account");
     const current = currentResponse?.ok
         ? (await currentResponse.json().catch(() => ({})))
         : {};
@@ -3385,11 +3409,11 @@ async function pushHostedModelAuthToControlPlane() {
         lastPushedHostedModelAuthCiphertext = ciphertext;
         lastPushedHostedModelAuthRevision = revision;
     }
-    else if (response?.status !== 403 && response?.status !== 409) {
+    else {
         throw new Error(`hosted model-auth push failed (${response?.status ?? "offline"})`);
     }
 }
-async function pushModelAuthToControlPlane(rotateKey = false) {
+async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false) {
     if (!sessionAdvertiseTarget)
         return;
     // Piggyback the (plaintext, non-secret) provider status summary on every
@@ -3402,8 +3426,11 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
         // A hosted runner holds only the explicitly granted snapshot and must never
         // overwrite the peer-to-peer account vault with that filtered subset.
         if (isHostedCustodyNode()) {
-            // Hosted runners are recipients, never authorities for the custody set.
-            // Letting one republish its stale filtered copy could undo a revocation.
+            // A credential-setup guest may establish the initial filtered snapshot.
+            // The control plane refuses managed-guest replacement after that first
+            // write, so normal hosted runners remain recipients rather than authorities.
+            if (process.env.BIVY_HOSTED_CREDENTIAL_PUBLISH === "1" && !lastPushedHostedModelAuthCiphertext)
+                await pushHostedModelAuthToControlPlane();
             return;
         }
         // Only push credentials on the account-sync tier; a `sync: "node"` credential
@@ -3446,6 +3473,8 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
     }
     catch (error) {
         console.warn("[auth-sync] could not push model auth:", error.message);
+        if (throwOnFailure)
+            throw error;
     }
 }
 // --- GitHub App private-key vault sync (issue #88) --------------------------
@@ -6322,6 +6351,7 @@ function persistSessionMetadata(record, status = sessionStatus(record)) {
         delegationDepth: record.delegationDepth,
         runtimeId: record.runtimeId,
         sandbox: record.sandbox,
+        approvalMode: record.approvalMode,
         credentialLabels: record.credentialLabels,
         agentName: getRuntime(record.runtimeId).displayName,
         contract: record.contract,
@@ -6842,18 +6872,23 @@ async function restoreSessionFromSnapshot(sessionId) {
         if (!data.ciphertext)
             return false;
         const applied = await applySessionSnapshot(data.ciphertext, pairingStore.roomKey(), {
+            expectedSessionId: sessionId,
             persistRecords: (id, records) => eventLog.rewrite(id, records),
             applyBundle: async (id, buf) => applyCheckpointBundle(await ensureReplicaRepo(id), id, buf),
             materialize: async (id) => materializeCheckpoint(await ensureReplicaRepo(id), id),
         });
-        // Register the rebuilt session so it lists and opens (mirrors the standby's
-        // upsertReplicaMeta); the transcript replays from the restored EventLog.
-        try {
-            metadata.upsertSession({ id: sessionId, source: "restored", status: "saved" });
-        }
-        catch {
-            /* best-effort listing */
-        }
+        const info = applied.sessionInfo;
+        if (!info?.runtimeId)
+            throw new Error("Snapshot lacks runtime information; transcript retained but not resumable");
+        const workspace = applied.checkpointCommit ? await ensureReplicaRepo(sessionId) : defaultWorkspace;
+        const rt = await ensureRuntimeAvailable(info.runtimeId, sandboxTier(info.sandbox));
+        const sessionFile = await rebuildSnapshotRuntime(info, rt, eventLog.readBase(sessionId), workspace);
+        // The imported native id may differ; RuntimeHost keeps this durable Bivy id
+        // while letting native methods use their own new resume token.
+        metadata.upsertSession({ id: sessionId, path: sessionFile, runtimeId: info.runtimeId,
+            workspace, name: info.name, sandbox: sandboxTier(info.sandbox), approvalMode: approvalModeFrom(info.approvalMode),
+            credentialLabels: info.credentialLabels,
+            source: "restored", status: "saved" });
         console.log(`[restore] session ${sessionId}: ${applied.recordCount} records, checkpoint ${applied.checkpointCommit ?? "none"}`);
         void reportEphemeralMilestone("snapshotReadyAt");
         return true;
@@ -6884,6 +6919,12 @@ async function flushSessionSnapshots() {
         result.required++;
         try {
             const sealed = await buildSessionSnapshot(record.id, roomKey, {
+                sessionInfo: () => {
+                    const model = record.session.getCurrentModel();
+                    return { runtimeId: record.runtimeId, name: record.session.getName(),
+                        model: model ? { provider: model.provider, id: model.id } : undefined,
+                        sandbox: record.sandbox, approvalMode: record.approvalMode, credentialLabels: record.credentialLabels };
+                },
                 readRecords: (id) => eventLog.entries(id),
                 epochOf: () => 0,
                 checkpointHead: async (id) => {
@@ -6926,7 +6967,8 @@ function evaluateEphemeralTeardown() {
         return;
     const records = new Set(openSessions.values());
     const anyWorking = [...records].some((r) => r.isWorking);
-    const anyRemoteActive = [...records].some((r) => r.remoteActive);
+    const anyRemoteActive = clients.size > 0 || (relay?.clientCount ?? 0) > 0
+        || [...records].some((r) => r.remoteActive);
     const inFlightWork = controlPlanePoller?.inFlightCount() ?? 0;
     if (anyWorking || anyRemoteActive || inFlightWork > 0) {
         ephemeralEverBusy = true;
@@ -7049,6 +7091,8 @@ function markSessionWorking(record, activity, opts) {
     record.lastFailureAt = undefined;
     metadata.touchSession(record.id, "working");
     if (!wasWorking) {
+        // Do not miss a fast turn that begins and ends between teardown samples.
+        evaluateEphemeralTeardown();
         scheduleAdvertise(); // idle → working transition
         broadcastSessionState(record);
     }
@@ -7057,9 +7101,7 @@ function clearSessionWorking(record, forcedStatus) {
     turnWatchdog.clearTurnAttentionOnProgress(record, true);
     turnWatchdog.clearTurnWatchdog(record);
     touchSession(record);
-    record.isWorking = false;
-    record.lastActivity = undefined;
-    record.workingStartedAt = undefined;
+    clearTurnActivity(record);
     // A completed turn clears any pending manual-resume offer: the session has now
     // moved on (whether it was the resume itself or an unrelated new message).
     metadata.setResumePending(record.id, false);
@@ -7259,7 +7301,9 @@ function actionableAgentError(runtimeId, error) {
         if (id.startsWith("codex"))
             return "Codex is not signed in. Run `codex login`, then retry; the same login works from Bivy and the PWA.";
         if (id === "pi" || id === "aider")
-            return "No model credential is configured. Run `bivy provider login`, then retry. This is only required once and compatible credentials sync E2E-encrypted to your other Bivy nodes.";
+            return isHostedCustodyNode()
+                ? "No model credential is available to this Bivy Cloud Machine. Connect a provider and enable it for Bivy Cloud, then retry."
+                : "No model credential is configured. Run `bivy provider login`, then retry. This is only required once and compatible credentials sync E2E-encrypted to your other Bivy nodes.";
         return "The selected agent needs model authentication. Sign in through its native CLI, then retry.";
     }
     return raw;
@@ -7400,6 +7444,7 @@ function attachSessionListeners(record) {
         if (event.type === "turn_start")
             record.authRequiredSignaled = false;
         if (event.type === "message_update" && event.message && (event.message?.role === "assistant")) {
+            void reportEphemeralMilestone("firstTokenAt");
             transcripts.persistIntermediateFromEvent(record, event, false);
         }
         if (event.type === "message_end" && event.message && (event.message?.role === "assistant")) {
@@ -7540,7 +7585,7 @@ function attachSessionListeners(record) {
                     body: `${sessionNotifyLabel(record)} failed its last turn — tap to see what went wrong.`,
                 });
             }
-            else if (!record.isWorking && !record.remoteActive && (record.backgroundTaskCount ?? 0) === 0) {
+            else if (!record.isWorking && !record.remoteActive && clients.size === 0 && (relay?.clientCount ?? 0) === 0 && (record.backgroundTaskCount ?? 0) === 0) {
                 void sendNotificationHint({
                     kind: "session_done",
                     sessionId: record.id,
@@ -7943,7 +7988,7 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // made governance unable to tell that a defaulted session had full access and
     // also let a later node-default change alter its tier on resume.
     const policyWorkspace = requestedSessionFile ? (restoredWorktree?.path ?? storedMeta?.workspace ?? workspace) : workspace;
-    const sessionSafety = projectSafety(policyWorkspace, sandboxTier(opts.sandbox ?? storedMeta?.sandbox), opts.approvalMode ?? approvalMode);
+    const sessionSafety = projectSafety(policyWorkspace, sandboxTier(opts.sandbox ?? storedMeta?.sandbox), opts.approvalMode ?? approvalModeFrom(storedMeta?.approvalMode) ?? approvalMode);
     const sessionSandbox = sessionSafety.sandbox;
     const rt = await ensureRuntimeAvailable(opts.runtimeId ?? storedMeta?.runtimeId, sessionSandbox);
     const allowedAgents = loadProjectPolicy(policyWorkspace)?.routing?.allowedAgents;
@@ -8510,7 +8555,7 @@ const runTerms = createRunTerminals({
     loadRunLog: (termId) => runLogs.load(termId),
     listAllSessions,
     listProvidersUnified,
-    pushModelAuthToControlPlane: () => pushModelAuthToControlPlane(),
+    pushModelAuthToControlPlane: () => pushModelAuthToControlPlane(false, true),
     listPiSessions: async () => {
         // `bivy run pi` is an agent-owned native TUI and writes to Pi's own store;
         // governed Pi chats write to Bivy's isolated store. Search both so a native

package/dist/session/snapshot-runtime.js

@@ -0,0 +1,21 @@
+import { buildForkHistory, normalizeMessages } from "./transcript-normal.js";
+/** An EventLog is a display mirror, not an agent's native conversation store.
+ * Reconstruct through the existing runtime-neutral history-import capability.
+ * Never call a missing native file a successful resume or silently start empty.
+ * This is portable replay, not byte-identical native runtime restoration. */
+export async function rebuildSnapshotRuntime(info, runtime, messages, workspace) {
+    if (runtime.id !== info.runtimeId)
+        throw new Error("Snapshot runtime identity mismatch");
+    if (!runtime.capabilities.forkHistoryImport || !runtime.importHistoryForFork) {
+        throw new Error("This runtime cannot replay snapshot history; the stored transcript is retained");
+    }
+    const history = buildForkHistory(normalizeMessages(messages, {
+        sourceRuntimeId: info.runtimeId, title: info.name, createdAt: new Date().toISOString(),
+    }));
+    if (!history.length)
+        throw new Error("Snapshot contains no replayable conversation");
+    const imported = await runtime.importHistoryForFork(history, { workspace, cwd: workspace, model: info.model });
+    if (!imported?.sessionFile?.trim())
+        throw new Error("Snapshot history import returned no resume reference");
+    return imported.sessionFile;
+}

package/dist/session/snapshot.js

@@ -34,7 +34,7 @@ export async function buildSessionSnapshot(sessionId, roomKey, deps) {
     // has no cursor, so buildReplFrame emits a zero-record frame rather than null).
     if (!frame || (frame.records.length === 0 && !frame.checkpointCommit))
         return null;
-    return seal(roomKey, JSON.stringify(frame));
+    return seal(roomKey, JSON.stringify({ ...frame, sessionInfo: deps.sessionInfo?.(sessionId) }));
 }
 /**
  * Decrypt and apply a sealed snapshot onto a fresh machine: rewrite the session's
@@ -45,6 +45,8 @@ export async function buildSessionSnapshot(sessionId, roomKey, deps) {
  */
 export async function applySessionSnapshot(sealed, roomKey, deps) {
     const frame = JSON.parse(open(roomKey, sealed));
+    if (deps.expectedSessionId && frame.sessionId !== deps.expectedSessionId)
+        throw new Error("Snapshot session identity mismatch");
     const applier = new StandbyApplier(deps);
     const ack = await applier.receive(frame);
     // We always ship a FULL frame + full bundle, so a fresh applier applies it
@@ -54,6 +56,7 @@ export async function applySessionSnapshot(sealed, roomKey, deps) {
         throw new Error(`snapshot apply failed: ${ack.status}`);
     }
     return {
+        sessionInfo: frame.sessionInfo,
         runtimeSessionRef: frame.runtimeSessionRef,
         recordCount: frame.records.length,
         checkpointCommit: frame.checkpointCommit,

package/dist/session/turn-activity.js

@@ -0,0 +1,6 @@
+export function clearTurnActivity(record) {
+    record.isWorking = false;
+    record.remoteActive = false;
+    record.lastActivity = undefined;
+    record.workingStartedAt = undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.24",
+  "version": "0.16.25-staging.2",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",
@@ -56,6 +56,9 @@
     "@earendil-works/pi-coding-agent": "0.85.1"
   },
   "overrides": {
+    "fast-uri": "3.1.6",
+    "hono": "4.13.5",
+    "qs": "6.16.0",
     "@hono/node-server": "2.0.12",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@earendil-works/pi-coding-agent": {
@@ -63,7 +66,6 @@
       "undici": "8.10.0"
     },
     "brace-expansion": "5.0.9",
-    "fast-uri": "4.1.4",
     "nanoid": "3.3.18",
     "undici": "8.10.0"
   },