@bivy/bivy 0.16.25-staging.2 → 0.16.25-staging.20

package/bin/agent-manifest.json

@@ -193,7 +193,10 @@
       "certification": "release-tested",
       "testedVersion": "1.0.0",
       "headlessFlags": [
+        "--always-approve",
         "-p",
+        "--output-format",
+        "streaming-json",
         "--resume"
       ],
       "install": {

package/dist/agents/pi/runtime.js

@@ -268,8 +268,29 @@ class PiSession {
      * reload. Async because that resolution reads the store.
      */
     async getModels() {
-        const models = await this.session.modelRuntime.getAvailable();
-        return models.map((model) => toModelInfo(model, true));
+        const runtime = this.session.modelRuntime;
+        try {
+            const models = await runtime.getAvailable();
+            return models.map((model) => toModelInfo(model, true));
+        }
+        catch (error) {
+            // The runtime's availability refresh is a Promise.all across every
+            // provider's auth check, so one broken provider (an unreachable custom
+            // endpoint, a single failing credential read) rejects the whole catalog
+            // and the picker shows nothing. Degrade to per-provider listing and
+            // skip only the broken ones; rethrow only when truly nothing survives.
+            const models = [];
+            for (const provider of runtime.getProviders()) {
+                try {
+                    for (const model of await runtime.getAvailable(provider.id))
+                        models.push(toModelInfo(model, true));
+                }
+                catch { /* this provider is broken — the rest still list */ }
+            }
+            if (models.length)
+                return models;
+            throw error instanceof Error ? error : new Error(String(error));
+        }
     }
     /**
      * Every model Pi knows about — built-in and custom, regardless of whether
@@ -281,7 +302,10 @@ class PiSession {
     async getAllModels() {
         const runtime = this.session.modelRuntime;
         // Refresh availability first so `hasConfiguredAuth` reflects current creds.
-        await runtime.getAvailable();
+        // Best-effort: a failed refresh (one broken provider rejects the shared
+        // Promise.all) must not blank the full catalog — the flags then reflect
+        // the last successful refresh, which the picker can still act on.
+        await runtime.getAvailable().catch(() => { });
         return runtime.getModels().map((model) => toModelInfo(model, runtime.hasConfiguredAuth(model.provider)));
     }
     /** Reload the projected models.json in-place so a live session immediately

package/dist/agents/profiles.js

@@ -370,32 +370,49 @@ export const AGENT_PROFILES = {
         // UUID (sessions live under ~/.grok/sessions/<cwd>/<id>/). The interactive
         // TUI uses the same store via `grok --resume <id>`. Model ids match
         // `grok models` for the official CLI (override with BIVY_GROK_MODELS).
-        args: ["-p"],
-        // The current CLI's `--output-format streaming-json` emits newline-delimited
-        // JSON keyed off `type`: {type:"text",data} for the answer, {type:"thought",
-        // data} for reasoning, {type:"end"} to close the turn (plus tool frames). The
-        // shared tolerant generic-stream-json parser understands this shape (and the
-        // ACP session/update envelope other CLIs use), so Grok gets faithful
-        // transcripts — answer prose, a thinking sidecar, and tool cards — without a
-        // Grok-specific adapter. Keep the plain args as the explicit
-        // BIVY_AGENT_STRUCTURED=0 fallback.
-        jsonArgs: ["--output-format", "streaming-json", "-p"],
+        // `--always-approve` auto-approves every tool execution. Without it, Grok's
+        // headless `-p` turn emits a tool_call and then waits for the client to
+        // approve it over the streaming-json (ACP) channel; Bivy governs effects at
+        // the sandbox tier and closes stdin, so the pending call races to a "User
+        // cancelled the execution" — i.e. Grok could never actually run a tool under
+        // Bivy. The flag is the Grok analogue of Cursor's `--force`, Copilot's
+        // `--allow-all-tools`, Droid's `--auto`, etc.
+        args: ["--always-approve", "-p"],
+        // The current CLI's `--output-format streaming-json` emits NDJSON of the
+        // agent-native ACP session updates: assistant text, a {type:"thought"}
+        // reasoning sidecar, and tool_call/tool_call_update frames. The shared
+        // tolerant generic-stream-json parser understands this shape (and the ACP
+        // session/update envelope other CLIs use), so Grok gets faithful transcripts
+        // — answer prose, a thinking sidecar, and tool cards — without a Grok-specific
+        // adapter. Keep the plain args as the explicit BIVY_AGENT_STRUCTURED=0
+        // fallback.
+        jsonArgs: ["--output-format", "streaming-json", "--always-approve", "-p"],
         parserId: "generic-stream-json",
+        // Resume mirrors the fresh-launch recipe (structured output + auto-approve)
+        // so a continued turn streams and runs tools exactly like the first one.
         resume: {
-            template: ["--resume", "{id}", "-p"],
+            template: ["--output-format", "streaming-json", "--resume", "{id}", "--always-approve", "-p"],
             historyLoader: "grok",
         },
         model: {
             flag: "-m",
             models: [
                 // Official Grok CLI (1.x) advertises grok-4.6 as the default subscription
-                // model (verified against `grok models`); the older grok-4.5 / grok-4-latest
-                // / grok-code-fast-1 ids now return "unknown model id". Keep the list
-                // honest; operators can override with BIVY_GROK_MODELS if their install
-                // exposes more.
+                // model (verified against the authenticated `~/.grok/models_cache.json`,
+                // origin cli-chat-proxy.grok.com/v1/models); the older grok-4.5 /
+                // grok-4-latest / grok-code-fast-1 ids now return "unknown model id".
+                // Keep the list honest; operators can override with BIVY_GROK_MODELS if
+                // their install exposes more.
                 { id: "grok-4.6", name: "Grok 4.6", provider: "xai" },
             ],
         },
+        // Grok's reasoning models expose a `--reasoning-effort <EFFORT>` flag
+        // (verified against `grok --help`, 1.0.0); the authenticated model catalog
+        // lists low/medium/high/xhigh with `high` as the default. `{level}` fills
+        // the value; insertAt: 0 keeps the trailing `-p` prompt flag last so the
+        // prompt still lands as its value. Threads through the resume path too, so a
+        // continued turn keeps the chosen effort. Override with BIVY_GROK_THINKING.
+        thinking: { levels: ["low", "medium", "high", "xhigh"], default: "high", template: ["--reasoning-effort", "{level}"], insertAt: 0 },
         promptMode: "argv",
         install: {
             kind: "curl",

package/dist/controllers/credential-commands.js

@@ -95,7 +95,8 @@ export function createCredentialCommands(deps) {
         async "credential.remove"(msg, ctx) {
             try {
                 await removeProviderCredential(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""));
-                await deps.pushModelAuthToControlPlane();
+                // Deleting a granted credential must also remove its escrowed cloud copy.
+                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: true });
                 await deps.refreshSessionAfterAuth();
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 deps.broadcast({ type: "providers.list", providers: await deps.listProvidersUnified() });
@@ -111,7 +112,8 @@ export function createCredentialCommands(deps) {
             try {
                 const sync = msg.sync === "node" ? "node" : "account";
                 await setCredentialSync(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), sync);
-                await deps.pushModelAuthToControlPlane();
+                // Demoting to machine-only revokes any custody grant; let it clear the escrow.
+                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: sync === "node" });
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.sync.set.ok", requestId: msg.requestId });
             }
@@ -127,7 +129,10 @@ export function createCredentialCommands(deps) {
             const previous = (await listCredentialRecords(credsDir)).find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
             try {
                 await setCredentialUnattended(credsDir, provider, label, msg.unattended === true);
-                await deps.pushModelAuthToControlPlane();
+                // Fail loud: the grant reply must reflect whether the encrypted cloud
+                // copy actually reached the control plane. An explicit disable is the
+                // one caller allowed to publish an empty escrow snapshot.
+                await deps.pushModelAuthToControlPlane({ throwOnFailure: true, allowEmptyHostedEscrow: msg.unattended !== true });
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.unattended.set.ok", requestId: msg.requestId });
             }

package/dist/credentials/document.js

@@ -87,17 +87,22 @@ function sameRecordContent(a, b) {
     const strip = ({ updatedAt: _drop, ...rest }) => rest;
     return JSON.stringify(strip(a)) === JSON.stringify(strip(b));
 }
+const stable = (value) => {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+        .map(([key, child]) => [key, stable(child)]));
+};
 function canonicalCredential(credential) {
     const { updatedAt: _drop, ...content } = credential;
-    const stable = (value) => {
-        if (Array.isArray(value))
-            return value.map(stable);
-        if (!value || typeof value !== "object")
-            return value;
-        return Object.fromEntries(Object.entries(value)
-            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
-            .map(([key, child]) => [key, stable(child)]));
-    };
+    return JSON.stringify(stable(content));
+}
+/** Stable record content sans the store-owned stamp — the final merge tie-break. */
+function canonicalRecord(record) {
+    const { updatedAt: _drop, ...content } = record;
     return JSON.stringify(stable(content));
 }
 /**
@@ -132,6 +137,19 @@ export function preferIncomingRecord(local, incoming) {
     const incomingOauth = oauthOf(incoming);
     if (!localOauth || !incomingOauth)
         return true;
+    // Identical token content means this is a metadata-only change (an
+    // unattended-runs grant/revoke, a sync-tier move). Token freshness cannot
+    // order those, so the newer record write wins — without this, a grant made
+    // on one machine never reaches its peers, and a peer's next hosted-escrow
+    // push would read as "nothing granted". Equal stamps fall back to canonical
+    // record content so both merge directions still converge.
+    if (canonicalCredential(localOauth) === canonicalCredential(incomingOauth)) {
+        const localAt = Number(local.updatedAt) || 0;
+        const incomingAt = Number(incoming.updatedAt) || 0;
+        if (incomingAt !== localAt)
+            return incomingAt > localAt;
+        return canonicalRecord(incoming) > canonicalRecord(local);
+    }
     return preferIncomingOAuthCredential(localOauth, incomingOauth);
 }
 /** A tombstone wins only when it is newer than the record it would remove. */
@@ -251,7 +269,14 @@ export function mergeDocuments(local, incomingCredentials, incomingDeletedAt = {
             continue;
         if (!(key in credentials))
             imported += 1;
-        credentials[key] = incoming;
+        // An incoming record with no opinion on unattended custody (undefined — the
+        // v2 wire and plaintext ingest never carry the flag) must not strip an
+        // explicit local grant/revoke: agent-side token refreshes flow through this
+        // merge, and dropping the flag would make the node's next escrow push
+        // silently revoke the encrypted cloud copy the user still relies on.
+        credentials[key] = localRecord && incoming.unattended === undefined && localRecord.unattended !== undefined
+            ? { ...incoming, unattended: localRecord.unattended }
+            : incoming;
         const incomingUpdatedAt = Number(incoming.updatedAt);
         if (!Number.isFinite(deletedAt[key]) || incomingUpdatedAt > deletedAt[key])
             delete deletedAt[key];

package/dist/credentials/store.js

@@ -554,6 +554,23 @@ export class BivyCredentialStore {
             // engine (merge-never-destroy, freshest-OAuth-wins, rotation-safe,
             // tombstone-newer-wins — see document.ts).
             const incoming = migrateToV3({ v: 2, providers: snapshot, deletedAt });
+            // The v2 wire carries no record metadata, so migrateToV3 synthesizes
+            // defaults (sync: "account", origin: "bivy", no unattended flag). Those
+            // defaults must not clobber local intent — a machine-only sync tier or an
+            // unattended-runs custody grant — when only the token content is newer
+            // (e.g. an agent's own TUI refreshed the OAuth token set). Inherit the
+            // existing record's metadata; the merge engine still decides freshness.
+            for (const [key, record] of Object.entries(incoming.credentials)) {
+                const existing = document.credentials[key];
+                if (!existing)
+                    continue;
+                incoming.credentials[key] = {
+                    ...record,
+                    sync: existing.sync,
+                    origin: existing.origin,
+                    ...(existing.unattended !== undefined ? { unattended: existing.unattended } : {}),
+                };
+            }
             const result = mergeDocuments(document, incoming.credentials, incoming.deletedAt);
             if (result.changed)
                 this.writeDocument(result.document);

package/dist/hosted-custody.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// One pure policy decision: does THIS daemon hold only control-plane-custodied
+// credentials (the separately escrowed unattended snapshot), or is it a normal
+// personal node that owns its vault?
+//
+// The distinction matters everywhere model-auth sync branches: a custody node
+// never pushes/pulls the account vault, never publishes the unattended escrow,
+// and treats the control plane's filtered snapshot as an authoritative set
+// (reconcile deletes what a newer snapshot omits). Getting this wrong on a
+// personal node silently breaks credential sync AND makes the unattended-runs
+// toggle a no-op — the "Allowed — encrypted cloud copy enabled" UI then lies,
+// and every Bivy Cloud session fails with "credential didn't reach Bivy Cloud".
+/**
+ * True when this daemon must run with hosted-custody semantics:
+ *  - `BIVY_HOSTED_CREDENTIAL_CUSTODY` — the dedicated flag the provisioner sets
+ *    on managed (Bivy Cloud) machines; always authoritative.
+ *  - `BIVY_GITHUB_HOSTED_TASKS` + `BIVY_EPHEMERAL` — back-compat for
+ *    provisioned user-owned queue runners that predate the dedicated flag.
+ *
+ * `BIVY_GITHUB_HOSTED_TASKS` ALONE is not custody: it is persisted onto any
+ * long-lived personal node when a GitHub App is connected (it only means "poll
+ * the hosted task queue"). Such a node owns its own logins and must keep full
+ * personal-vault semantics — account sync, escrow publishing, loud toggles.
+ */
+export function hostedCustodyNode(env = process.env) {
+    if (env.BIVY_HOSTED_CREDENTIAL_CUSTODY)
+        return true;
+    return Boolean(env.BIVY_GITHUB_HOSTED_TASKS && env.BIVY_EPHEMERAL);
+}

package/dist/runtime/process.js

@@ -369,8 +369,14 @@ class ProcessSession {
                 this.nativeSessionRef = learnedRef;
                 this.upstreamSessionStarted = true;
             }
-            for (const event of events)
-                this.emit(event);
+            // Sync the parser's final transcript into this.messages BEFORE emitting the
+            // terminal events (message_end/turn_end/agent_end). The daemon persists a
+            // base-transcript snapshot synchronously on message_end/turn_end by reading
+            // getMessages() — so if the push happened after the emit loop (as it once
+            // did), that snapshot saw an empty turn and the agent's answer + paired
+            // tool blocks were never persisted, vanishing on reload for every
+            // structured-pipe CLI (Grok, Goose, Gemini, …). Populating first makes
+            // getMessages() authoritative the instant message_end fires.
             if (!messagesPushed && events.some((e) => e.type === "agent_end")) {
                 messagesPushed = true;
                 for (const message of activeParser.messages())
@@ -381,6 +387,8 @@ class ProcessSession {
                 if (usage)
                     this.lastUsage = usage;
             }
+            for (const event of events)
+                this.emit(event);
         };
         const feedParser = (activeParser, text) => {
             lineBuf += text;

package/dist/server.js

@@ -80,6 +80,7 @@ import { forceAbortTurn } from "./session/abort-recovery.js";
 import { runRequiredAutomationChecks } from "./automation-checks.js";
 import { configToLegacySettings, mergeLegacyIntoNodeConfig, readNodeConfig, writeNodeConfig } from "./node-config.js";
 import { loadProjectPolicy, resolveProjectSafety } from "./project-policy.js";
+import { hostedCustodyNode } from "./hosted-custody.js";
 import { PolicyEngine } from "./policy/policy-engine.js";
 import { SessionAllowRules } from "./policy/session-allow.js";
 import { TerminalManager } from "./terminal.js";
@@ -1966,7 +1967,7 @@ const RELAY_COMMANDS = {
         credsDir,
         sendEvent: (event) => relay?.sendEvent(event),
         broadcast,
-        pushModelAuthToControlPlane,
+        pushModelAuthToControlPlane: (opts) => pushModelAuthToControlPlane(false, opts?.throwOnFailure === true, opts?.allowEmptyHostedEscrow === true),
         refreshSessionAfterAuth,
         listProvidersUnified,
     }),
@@ -2407,7 +2408,19 @@ const RELAY_COMMANDS = {
         // this a models.list answered for one agent (e.g. Codex's models) could
         // linger on the composer/picker after the user switched to another agent
         // (e.g. Claude) — the "Claude shows Codex models" bug.
-        relay?.sendEvent(await modelsListEventFor(record));
+        let event;
+        try {
+            event = await modelsListEventFor(record);
+        }
+        catch (error) {
+            // A catalog read failure must never answer with silence: the generic
+            // relay catch would swallow the rejection and the client (notably a
+            // Cloud launch waiting to validate its saved model) could only guess
+            // via timeout. Name the real reason on the session instead.
+            relay?.sendEvent({ type: "session.error", sessionId: requestedSessionId ?? record.id, error: `Couldn't read this machine's model catalog: ${error instanceof Error ? error.message : String(error)}` });
+            return;
+        }
+        relay?.sendEvent(event);
     },
     "models.prefetch"(msg) {
         // The composer's agent picker opened: warm the scratch session for each
@@ -2569,7 +2582,8 @@ const RELAY_COMMANDS = {
                 }
             }
             await removeProvider(credsDir, id);
-            await pushModelAuthToControlPlane();
+            // Deleting a granted credential must also remove its escrowed cloud copy.
+            await pushModelAuthToControlPlane(false, false, true);
             await refreshSessionAfterAuth();
             broadcast({ type: "provider.oauth.reset", provider: id, ok: true, providers: await listProvidersUnified() });
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
@@ -2581,7 +2595,8 @@ const RELAY_COMMANDS = {
     async "provider.remove"(msg) {
         try {
             await removeProvider(credsDir, String(msg.provider ?? msg.id ?? ""));
-            await pushModelAuthToControlPlane();
+            // Deleting a granted credential must also remove its escrowed cloud copy.
+            await pushModelAuthToControlPlane(false, false, true);
             await refreshSessionAfterAuth();
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
         }
@@ -3065,7 +3080,11 @@ const hostedImportedRecordsPath = path.join(appDir, "model-auth-hosted-records.j
 let lastPushedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthRevision = -1;
-const isHostedCustodyNode = () => Boolean(process.env.BIVY_HOSTED_CREDENTIAL_CUSTODY || process.env.BIVY_GITHUB_HOSTED_TASKS);
+// Custody semantics are keyed on the dedicated flag (plus an ephemeral
+// back-compat case) — see src/hosted-custody.ts. A persistent personal node
+// that polls the hosted GitHub queue is NOT a custody guest: it owns its
+// logins and must keep account sync and unattended-escrow publishing.
+const isHostedCustodyNode = () => hostedCustodyNode();
 function readLocalModelAuthVaultKey() {
     try {
         const parsed = JSON.parse(fs.readFileSync(modelAuthVaultKeyPath, "utf8"));
@@ -3376,12 +3395,19 @@ async function processModelAuthKeyRequests(requests) {
         });
     }
 }
-async function pushHostedModelAuthToControlPlane() {
+async function pushHostedModelAuthToControlPlane(allowEmpty = false) {
     const [records, revision] = await Promise.all([exportUnattendedRecords(credsDir), unattendedCredentialRevision(credsDir)]);
     // A setup guest must not establish an empty snapshot when the credential is
     // first saved (before the explicit grant command follows). Otherwise its
     // one allowed initial write would be consumed by an unusable vault.
-    if (isHostedCustodyNode() && Object.keys(records).length === 0)
+    //
+    // And an IMPLICIT empty push must never revoke the escrow: an empty snapshot
+    // is how "disable unattended runs" removes the cloud copy, but every vault
+    // change funnels through here — so a node whose copy simply lacks the grant
+    // (not yet synced, or granted elsewhere) would otherwise wipe the encrypted
+    // cloud copy the user's other machines just published. Only an explicit
+    // local revoke/delete (allowEmpty) may publish an empty snapshot.
+    if (Object.keys(records).length === 0 && (!allowEmpty || isHostedCustodyNode()))
         return;
     if (revision === lastPushedHostedModelAuthRevision)
         return;
@@ -3413,7 +3439,7 @@ async function pushHostedModelAuthToControlPlane() {
         throw new Error(`hosted model-auth push failed (${response?.status ?? "offline"})`);
     }
 }
-async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false) {
+async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false, allowEmptyHostedEscrow = false) {
     if (!sessionAdvertiseTarget)
         return;
     // Piggyback the (plaintext, non-secret) provider status summary on every
@@ -3448,7 +3474,7 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
             writeLocalModelAuthVaultKey(vaultKeyB64);
         const ciphertext = encryptModelAuthProviders(providers, deletedAt, localModels, vaultKeyB64, records, recordsDeletedAt);
         if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext) {
-            await pushHostedModelAuthToControlPlane();
+            await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
             return;
         }
         const push = await modelAuthFetch("/node/model-auth-vault", { method: "PUT", body: JSON.stringify({ ciphertext, rotated: rotateKey }) });
@@ -3469,7 +3495,7 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
         // Publish a DIFFERENT ciphertext under a DIFFERENT key containing only
         // records with `unattended:true`. Escrowing this key cannot decrypt the E2E
         // account vault, which is the critical custody separation.
-        await pushHostedModelAuthToControlPlane();
+        await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
     }
     catch (error) {
         console.warn("[auth-sync] could not push model auth:", error.message);
@@ -9295,7 +9321,7 @@ async function modelsListEventFor(record) {
     const current = session.getCurrentModel();
     const models = await publicModelsList(session, current);
     const thinking = publicThinkingInfo(session);
-    return { type: "models.list", sessionId: record.id, runtimeId: record.runtimeId, current: current ? publicModel(current, current) : null, models, thinking };
+    return { type: "models.list", sessionId: record.id, runtimeId: record.runtimeId, modelSelection: getRuntime(record.runtimeId).capabilities.modelSelection !== false, current: current ? publicModel(current, current) : null, models, thinking };
 }
 function publicThinkingInfo(session) {
     const supports = typeof session.supportsThinking === "function" ? session.supportsThinking() : false;
@@ -9322,7 +9348,7 @@ app.get("/api/models", async (req, res, next) => {
         const current = session.getCurrentModel();
         const models = await publicModelsList(session, current);
         const thinking = publicThinkingInfo(session);
-        res.json({ sessionId: record.id, current: current ? publicModel(current, current) : null, models, thinking });
+        res.json({ sessionId: record.id, modelSelection: getRuntime(record.runtimeId).capabilities.modelSelection !== false, current: current ? publicModel(current, current) : null, models, thinking });
     }
     catch (error) {
         next(error);
@@ -9678,7 +9704,8 @@ app.post("/api/auth/credentials", async (req, res, next) => {
 app.delete("/api/auth/credentials/:provider/:label", async (req, res, next) => {
     try {
         await removeProviderCredential(credsDir, String(req.params.provider), String(req.params.label));
-        await pushModelAuthToControlPlane();
+        // Deleting a granted credential must also remove its escrowed cloud copy.
+        await pushModelAuthToControlPlane(false, false, true);
         await refreshSessionAfterAuth();
         res.json({ ok: true, records: await listCredentialRecords(credsDir), providers: await listProvidersUnified() });
     }
@@ -9690,7 +9717,8 @@ app.post("/api/auth/credentials/:provider/:label/availability", async (req, res,
     try {
         const sync = req.body?.sync === "node" ? "node" : "account";
         await setCredentialSync(credsDir, String(req.params.provider), String(req.params.label), sync);
-        await pushModelAuthToControlPlane();
+        // Demoting to machine-only revokes any custody grant; let that clear the escrow.
+        await pushModelAuthToControlPlane(false, false, sync === "node");
         res.json({ ok: true, records: await listCredentialRecords(credsDir) });
     }
     catch (error) {
@@ -9698,12 +9726,21 @@ app.post("/api/auth/credentials/:provider/:label/availability", async (req, res,
     }
 });
 app.post("/api/auth/credentials/:provider/:label/unattended", async (req, res, next) => {
-    try {
-        await setCredentialUnattended(credsDir, String(req.params.provider), String(req.params.label), req.body?.unattended === true);
-        await pushModelAuthToControlPlane();
+    const provider = String(req.params.provider);
+    const label = String(req.params.label);
+    const enable = req.body?.unattended === true;
+    const previous = (await listCredentialRecords(credsDir).catch(() => []))
+        .find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
+    try {
+        await setCredentialUnattended(credsDir, provider, label, enable);
+        // Fail loud (mirrors the relay command): the UI must never claim an
+        // encrypted cloud copy exists when custody publication failed. An explicit
+        // disable is the one caller allowed to publish an empty escrow snapshot.
+        await pushModelAuthToControlPlane(false, true, !enable);
         res.json({ ok: true, records: await listCredentialRecords(credsDir) });
     }
     catch (error) {
+        await setCredentialUnattended(credsDir, provider, label, previous).catch(() => { });
         next(error);
     }
 });

package/dist/session/transcript-persistence.js

@@ -31,7 +31,15 @@ function capThinkingForPersistence(text) {
 function toolEventId(event) {
     const toolCall = event.toolCall;
     const input = (event.input || event.toolInput || event.args || toolCall?.input || {});
-    const explicit = event.toolUseId || event.tool_use_id || event.toolCallId || event.callId || event.id || toolCall?.id;
+    // Structured-pipe parsers (Grok/Goose/Gemini/… via the shared TurnAccumulator)
+    // emit a `tool_result` whose id lives under `result.toolCallId`, not at the top
+    // level. Without reading it here the result overlay was keyed `"<name>:"` and
+    // never paired with its `tool_call` overlay — orphaning the output in the
+    // transcript. Check the nested result id as a general shape, not a per-agent
+    // branch (protocol agents that already set a top-level id are unaffected).
+    const result = (event.result || event.toolResult);
+    const explicit = event.toolUseId || event.tool_use_id || event.toolCallId || event.callId || event.id || toolCall?.id ||
+        result?.toolCallId || result?.tool_use_id || result?.toolUseId || result?.id;
     if (explicit)
         return String(explicit);
     return `${String(event.toolName || event.name || toolCall?.name || "tool")}:${String(input.path || input.file || input.filePath || input.command || input.cmd || input.query || "")}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.25-staging.2",
+  "version": "0.16.25-staging.20",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",