@bivy/bivy 0.16.25-staging.17 → 0.16.25-staging.19

package/dist/controllers/credential-commands.js

@@ -95,7 +95,8 @@ export function createCredentialCommands(deps) {
         async "credential.remove"(msg, ctx) {
             try {
                 await removeProviderCredential(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""));
-                await deps.pushModelAuthToControlPlane();
+                // Deleting a granted credential must also remove its escrowed cloud copy.
+                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: true });
                 await deps.refreshSessionAfterAuth();
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 deps.broadcast({ type: "providers.list", providers: await deps.listProvidersUnified() });
@@ -111,7 +112,8 @@ export function createCredentialCommands(deps) {
             try {
                 const sync = msg.sync === "node" ? "node" : "account";
                 await setCredentialSync(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), sync);
-                await deps.pushModelAuthToControlPlane();
+                // Demoting to machine-only revokes any custody grant; let it clear the escrow.
+                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: sync === "node" });
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.sync.set.ok", requestId: msg.requestId });
             }
@@ -127,7 +129,10 @@ export function createCredentialCommands(deps) {
             const previous = (await listCredentialRecords(credsDir)).find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
             try {
                 await setCredentialUnattended(credsDir, provider, label, msg.unattended === true);
-                await deps.pushModelAuthToControlPlane();
+                // Fail loud: the grant reply must reflect whether the encrypted cloud
+                // copy actually reached the control plane. An explicit disable is the
+                // one caller allowed to publish an empty escrow snapshot.
+                await deps.pushModelAuthToControlPlane({ throwOnFailure: true, allowEmptyHostedEscrow: msg.unattended !== true });
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.unattended.set.ok", requestId: msg.requestId });
             }

package/dist/credentials/document.js

@@ -87,17 +87,22 @@ function sameRecordContent(a, b) {
     const strip = ({ updatedAt: _drop, ...rest }) => rest;
     return JSON.stringify(strip(a)) === JSON.stringify(strip(b));
 }
+const stable = (value) => {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+        .map(([key, child]) => [key, stable(child)]));
+};
 function canonicalCredential(credential) {
     const { updatedAt: _drop, ...content } = credential;
-    const stable = (value) => {
-        if (Array.isArray(value))
-            return value.map(stable);
-        if (!value || typeof value !== "object")
-            return value;
-        return Object.fromEntries(Object.entries(value)
-            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
-            .map(([key, child]) => [key, stable(child)]));
-    };
+    return JSON.stringify(stable(content));
+}
+/** Stable record content sans the store-owned stamp — the final merge tie-break. */
+function canonicalRecord(record) {
+    const { updatedAt: _drop, ...content } = record;
     return JSON.stringify(stable(content));
 }
 /**
@@ -132,6 +137,19 @@ export function preferIncomingRecord(local, incoming) {
     const incomingOauth = oauthOf(incoming);
     if (!localOauth || !incomingOauth)
         return true;
+    // Identical token content means this is a metadata-only change (an
+    // unattended-runs grant/revoke, a sync-tier move). Token freshness cannot
+    // order those, so the newer record write wins — without this, a grant made
+    // on one machine never reaches its peers, and a peer's next hosted-escrow
+    // push would read as "nothing granted". Equal stamps fall back to canonical
+    // record content so both merge directions still converge.
+    if (canonicalCredential(localOauth) === canonicalCredential(incomingOauth)) {
+        const localAt = Number(local.updatedAt) || 0;
+        const incomingAt = Number(incoming.updatedAt) || 0;
+        if (incomingAt !== localAt)
+            return incomingAt > localAt;
+        return canonicalRecord(incoming) > canonicalRecord(local);
+    }
     return preferIncomingOAuthCredential(localOauth, incomingOauth);
 }
 /** A tombstone wins only when it is newer than the record it would remove. */
@@ -251,7 +269,14 @@ export function mergeDocuments(local, incomingCredentials, incomingDeletedAt = {
             continue;
         if (!(key in credentials))
             imported += 1;
-        credentials[key] = incoming;
+        // An incoming record with no opinion on unattended custody (undefined — the
+        // v2 wire and plaintext ingest never carry the flag) must not strip an
+        // explicit local grant/revoke: agent-side token refreshes flow through this
+        // merge, and dropping the flag would make the node's next escrow push
+        // silently revoke the encrypted cloud copy the user still relies on.
+        credentials[key] = localRecord && incoming.unattended === undefined && localRecord.unattended !== undefined
+            ? { ...incoming, unattended: localRecord.unattended }
+            : incoming;
         const incomingUpdatedAt = Number(incoming.updatedAt);
         if (!Number.isFinite(deletedAt[key]) || incomingUpdatedAt > deletedAt[key])
             delete deletedAt[key];

package/dist/credentials/store.js

@@ -554,6 +554,23 @@ export class BivyCredentialStore {
             // engine (merge-never-destroy, freshest-OAuth-wins, rotation-safe,
             // tombstone-newer-wins — see document.ts).
             const incoming = migrateToV3({ v: 2, providers: snapshot, deletedAt });
+            // The v2 wire carries no record metadata, so migrateToV3 synthesizes
+            // defaults (sync: "account", origin: "bivy", no unattended flag). Those
+            // defaults must not clobber local intent — a machine-only sync tier or an
+            // unattended-runs custody grant — when only the token content is newer
+            // (e.g. an agent's own TUI refreshed the OAuth token set). Inherit the
+            // existing record's metadata; the merge engine still decides freshness.
+            for (const [key, record] of Object.entries(incoming.credentials)) {
+                const existing = document.credentials[key];
+                if (!existing)
+                    continue;
+                incoming.credentials[key] = {
+                    ...record,
+                    sync: existing.sync,
+                    origin: existing.origin,
+                    ...(existing.unattended !== undefined ? { unattended: existing.unattended } : {}),
+                };
+            }
             const result = mergeDocuments(document, incoming.credentials, incoming.deletedAt);
             if (result.changed)
                 this.writeDocument(result.document);

package/dist/server.js

@@ -1966,7 +1966,7 @@ const RELAY_COMMANDS = {
         credsDir,
         sendEvent: (event) => relay?.sendEvent(event),
         broadcast,
-        pushModelAuthToControlPlane,
+        pushModelAuthToControlPlane: (opts) => pushModelAuthToControlPlane(false, opts?.throwOnFailure === true, opts?.allowEmptyHostedEscrow === true),
         refreshSessionAfterAuth,
         listProvidersUnified,
     }),
@@ -2581,7 +2581,8 @@ const RELAY_COMMANDS = {
                 }
             }
             await removeProvider(credsDir, id);
-            await pushModelAuthToControlPlane();
+            // Deleting a granted credential must also remove its escrowed cloud copy.
+            await pushModelAuthToControlPlane(false, false, true);
             await refreshSessionAfterAuth();
             broadcast({ type: "provider.oauth.reset", provider: id, ok: true, providers: await listProvidersUnified() });
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
@@ -2593,7 +2594,8 @@ const RELAY_COMMANDS = {
     async "provider.remove"(msg) {
         try {
             await removeProvider(credsDir, String(msg.provider ?? msg.id ?? ""));
-            await pushModelAuthToControlPlane();
+            // Deleting a granted credential must also remove its escrowed cloud copy.
+            await pushModelAuthToControlPlane(false, false, true);
             await refreshSessionAfterAuth();
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
         }
@@ -3388,12 +3390,19 @@ async function processModelAuthKeyRequests(requests) {
         });
     }
 }
-async function pushHostedModelAuthToControlPlane() {
+async function pushHostedModelAuthToControlPlane(allowEmpty = false) {
     const [records, revision] = await Promise.all([exportUnattendedRecords(credsDir), unattendedCredentialRevision(credsDir)]);
     // A setup guest must not establish an empty snapshot when the credential is
     // first saved (before the explicit grant command follows). Otherwise its
     // one allowed initial write would be consumed by an unusable vault.
-    if (isHostedCustodyNode() && Object.keys(records).length === 0)
+    //
+    // And an IMPLICIT empty push must never revoke the escrow: an empty snapshot
+    // is how "disable unattended runs" removes the cloud copy, but every vault
+    // change funnels through here — so a node whose copy simply lacks the grant
+    // (not yet synced, or granted elsewhere) would otherwise wipe the encrypted
+    // cloud copy the user's other machines just published. Only an explicit
+    // local revoke/delete (allowEmpty) may publish an empty snapshot.
+    if (Object.keys(records).length === 0 && (!allowEmpty || isHostedCustodyNode()))
         return;
     if (revision === lastPushedHostedModelAuthRevision)
         return;
@@ -3425,7 +3434,7 @@ async function pushHostedModelAuthToControlPlane() {
         throw new Error(`hosted model-auth push failed (${response?.status ?? "offline"})`);
     }
 }
-async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false) {
+async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false, allowEmptyHostedEscrow = false) {
     if (!sessionAdvertiseTarget)
         return;
     // Piggyback the (plaintext, non-secret) provider status summary on every
@@ -3460,7 +3469,7 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
             writeLocalModelAuthVaultKey(vaultKeyB64);
         const ciphertext = encryptModelAuthProviders(providers, deletedAt, localModels, vaultKeyB64, records, recordsDeletedAt);
         if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext) {
-            await pushHostedModelAuthToControlPlane();
+            await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
             return;
         }
         const push = await modelAuthFetch("/node/model-auth-vault", { method: "PUT", body: JSON.stringify({ ciphertext, rotated: rotateKey }) });
@@ -3481,7 +3490,7 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
         // Publish a DIFFERENT ciphertext under a DIFFERENT key containing only
         // records with `unattended:true`. Escrowing this key cannot decrypt the E2E
         // account vault, which is the critical custody separation.
-        await pushHostedModelAuthToControlPlane();
+        await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
     }
     catch (error) {
         console.warn("[auth-sync] could not push model auth:", error.message);
@@ -9690,7 +9699,8 @@ app.post("/api/auth/credentials", async (req, res, next) => {
 app.delete("/api/auth/credentials/:provider/:label", async (req, res, next) => {
     try {
         await removeProviderCredential(credsDir, String(req.params.provider), String(req.params.label));
-        await pushModelAuthToControlPlane();
+        // Deleting a granted credential must also remove its escrowed cloud copy.
+        await pushModelAuthToControlPlane(false, false, true);
         await refreshSessionAfterAuth();
         res.json({ ok: true, records: await listCredentialRecords(credsDir), providers: await listProvidersUnified() });
     }
@@ -9702,7 +9712,8 @@ app.post("/api/auth/credentials/:provider/:label/availability", async (req, res,
     try {
         const sync = req.body?.sync === "node" ? "node" : "account";
         await setCredentialSync(credsDir, String(req.params.provider), String(req.params.label), sync);
-        await pushModelAuthToControlPlane();
+        // Demoting to machine-only revokes any custody grant; let that clear the escrow.
+        await pushModelAuthToControlPlane(false, false, sync === "node");
         res.json({ ok: true, records: await listCredentialRecords(credsDir) });
     }
     catch (error) {
@@ -9710,12 +9721,21 @@ app.post("/api/auth/credentials/:provider/:label/availability", async (req, res,
     }
 });
 app.post("/api/auth/credentials/:provider/:label/unattended", async (req, res, next) => {
-    try {
-        await setCredentialUnattended(credsDir, String(req.params.provider), String(req.params.label), req.body?.unattended === true);
-        await pushModelAuthToControlPlane();
+    const provider = String(req.params.provider);
+    const label = String(req.params.label);
+    const enable = req.body?.unattended === true;
+    const previous = (await listCredentialRecords(credsDir).catch(() => []))
+        .find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
+    try {
+        await setCredentialUnattended(credsDir, provider, label, enable);
+        // Fail loud (mirrors the relay command): the UI must never claim an
+        // encrypted cloud copy exists when custody publication failed. An explicit
+        // disable is the one caller allowed to publish an empty escrow snapshot.
+        await pushModelAuthToControlPlane(false, true, !enable);
         res.json({ ok: true, records: await listCredentialRecords(credsDir) });
     }
     catch (error) {
+        await setCredentialUnattended(credsDir, provider, label, previous).catch(() => { });
         next(error);
     }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.25-staging.17",
+  "version": "0.16.25-staging.19",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",