@bivy/bivy 0.20.9-staging.2 → 0.20.9-staging.21

package/dist/device-registry.js

@@ -7,6 +7,7 @@ import { generatePairingKeypair, generateRoomKey, generatePairSecret, deriveWrap
 import { seal, open } from "./e2e.js";
 const DEFAULT_PAIR_TTL_MS = 5 * 60_000;
 const ROOM_KEY_BYTES = 32;
+const MAX_RETIRED_ROOM_KEYS = 8;
 /**
  * Validate + canonicalize a pre-shared room-key seed. Returns the canonical
  * base64 of a well-formed 32-byte key, or undefined for anything malformed
@@ -81,6 +82,7 @@ export class PairingStore {
             return new PairingStore(filePath, {
                 nodeKeypair: parsed.nodeKeypair,
                 roomKeyB64: parsed.roomKeyB64,
+                ...(Array.isArray(parsed.retiredRoomKeysB64) && parsed.retiredRoomKeysB64.length ? { retiredRoomKeysB64: parsed.retiredRoomKeysB64 } : {}),
                 devices: Array.isArray(parsed.devices) ? parsed.devices : [],
             });
         }
@@ -130,6 +132,30 @@ export class PairingStore {
     roomKey() {
         return Buffer.from(this.data.roomKeyB64, "base64");
     }
+    /** Room keys replaced by earlier rotations that still guard stored data. */
+    retiredRoomKeys() {
+        return (this.data.retiredRoomKeysB64 ?? []).map((key) => Buffer.from(key, "base64"));
+    }
+    /** Drop retired room keys once nothing stored is sealed under them. */
+    forgetRetiredRoomKeys() {
+        if (!this.data.retiredRoomKeysB64)
+            return;
+        delete this.data.retiredRoomKeysB64;
+        this.persist();
+    }
+    /** Open a payload sealed under the current room key or a retired one. */
+    openSealed(payload) {
+        let lastError;
+        for (const key of [this.roomKey(), ...this.retiredRoomKeys()]) {
+            try {
+                return open(key, payload);
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        throw lastError;
+    }
     /** Issue a single-use, expiring pairing secret to embed in a linking QR. */
     issuePairSecret(ttlMs = DEFAULT_PAIR_TTL_MS) {
         this.sweepSecrets();
@@ -215,6 +241,7 @@ export class PairingStore {
     }
     /** Rotate the room key and re-wrap it for all current devices. */
     rotateRoomKey() {
+        this.data.retiredRoomKeysB64 = [this.data.roomKeyB64, ...(this.data.retiredRoomKeysB64 ?? [])].slice(0, MAX_RETIRED_ROOM_KEYS);
         this.data.roomKeyB64 = generateRoomKey().toString("base64");
         this.persist();
         const roomKey = this.roomKey();

package/dist/ephemeral-teardown.js

@@ -9,6 +9,7 @@ export function readEphemeralTeardownConfig(env = process.env) {
         onFinish: env.BIVY_TEARDOWN_ON_FINISH === "1",
         finishGraceMs: Number(env.BIVY_TEARDOWN_FINISH_GRACE_MS) || 10_000,
         idleGraceMs: Number(env.BIVY_SESSION_IDLE_CLOSE_MS) || 30 * 60 * 1000,
+        sleep: env.BIVY_EPHEMERAL_SLEEP === "1",
     };
 }
 /**
@@ -20,8 +21,10 @@ export function readEphemeralTeardownConfig(env = process.env) {
 export function shouldSelfTeardown(cfg, state) {
     if (!cfg.enabled)
         return false;
+    // A fresh box waits for its first work. A sleeping machine woken for
+    // nothing goes back to sleep after the idle window instead of running to TTL.
     if (!state.everBusy)
-        return false;
+        return cfg.sleep && state.idleForMs >= cfg.idleGraceMs;
     if (state.anyWorking || state.anyRemoteActive || state.inFlightWork > 0)
         return false;
     const grace = cfg.onFinish ? cfg.finishGraceMs : cfg.idleGraceMs;
@@ -50,6 +53,13 @@ export async function performSelfTeardown(deps) {
     torndown = true;
     const log = deps.log ?? ((m) => console.log(`[ephemeral-teardown] ${m}`));
     const exit = deps.exit ?? ((c) => process.exit(c));
+    if (deps.sleep) {
+        // Exit only: the provider keeps the stopped machine and its disk, and a
+        // wake starts it again. Signalling settled would get it reaped.
+        log(`machine idle — sleeping (provider=${deps.provider})`);
+        exit(0);
+        return;
+    }
     log(`machine idle — self-teardown (provider=${deps.provider})`);
     try {
         await deps.signalSettled?.();

package/dist/exec.js

@@ -14,6 +14,7 @@
 // A turn that ends without any assistant text because the agent FAILED (e.g. an
 // unauthenticated CLI) exits non-zero with the error on stderr, rather than
 // reporting a silent empty success.
+import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
 const USAGE = `Usage: bivy exec [options] "<prompt>"   (or pipe the prompt on stdin, or pass -)
 
@@ -223,7 +224,9 @@ async function main() {
         try {
             await api(args.url, args.token, "/api/session/prompt", {
                 method: "POST",
-                body: JSON.stringify({ sessionId, text: prompt, clientMessageId: `exec-${sessionId}` }),
+                // One id per exec run: the node drops a repeated id as a duplicate send
+                // for a day, so an id shared by every run in a session ate follow-ups.
+                body: JSON.stringify({ sessionId, text: prompt, clientMessageId: `exec-${randomUUID()}` }),
             });
         }
         catch (error) {

package/dist/runtime/model-catalog.js

@@ -147,3 +147,19 @@ export async function catalogReplyEvent(load, sessionId) {
         return { type: "session.error", sessionId, error: `Couldn't read this machine's model catalog: ${error instanceof Error ? error.message : String(error)}` };
     }
 }
+/**
+ * Give a session's agent up to `timeoutMs` to publish its real model catalog
+ * before a caller reads it. A not-yet-started agent otherwise answers from a
+ * placeholder list. Never throws; a runtime without warmModels() is a no-op.
+ */
+export async function warmSessionCatalog(session, timeoutMs) {
+    if (!session.warmModels)
+        return;
+    let timer;
+    await Promise.race([
+        session.warmModels().catch(() => { }),
+        new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); }),
+    ]);
+    if (timer)
+        clearTimeout(timer);
+}

package/dist/server.js

@@ -44,7 +44,7 @@ import { createAppCommands } from "./controllers/app-commands.js";
 import { createFileCommands } from "./controllers/file-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
-import { aggregateModelCatalog, catalogReplyEvent, mergeProviderCatalog } from "./runtime/model-catalog.js";
+import { aggregateModelCatalog, catalogReplyEvent, warmSessionCatalog, mergeProviderCatalog } from "./runtime/model-catalog.js";
 import { resolveModelRef } from "./runtime/model-ref.js";
 import { RuntimeHost, enforcementLevelFor, remoteRuntimeEnabled } from "./runtime/host.js";
 import { RemoteRuntime, RemoteRuntimeSession } from "./runtime/remote.js";
@@ -54,6 +54,7 @@ import { ControlPlaneSessionLocationRegistry, LayeredSessionLocationRegistry } f
 import { attachAdoptedSessions, classifyAttachFailure } from "./runtime/adoption.js";
 import { createCredentialStore, testProviderCredential } from "./runtime/credentials.js";
 import { decodeAutomationTemplate } from "./automation-template.js";
+import { resealAutomationTemplates } from "./automation-reseal.js";
 import { passWebhookFilter } from "./automation-filter-gate.js";
 import { isModelAuthError, authProviderForSession, classifyModelAuthError } from "./runtime/auth-errors.js";
 import { createCredentialVault, migrateVaultDir } from "./runtime/credential-store.js";
@@ -80,9 +81,7 @@ import { exportProviderAuth, exportAccountApiKeys, exportAccountOAuthCredentials
 import { listProviders } from "./runtime/provider-catalog.js";
 import { exportLocalModels, importLocalModels } from "./runtime/local-model-store.js";
 import { sessionLikeFields } from "./session/start-like.js";
-import { MAX_SUGGESTION_TEXT, MAX_SUGGESTION_TITLE, SUGGESTION_RUNS, isTaskSuggestion } from "./session/suggestions.js";
 import { BIVY_AGENT_NOTE, mergeSyncedAgentInstructions, readAgentInstructions, sessionInstructions, writeAgentInstructions, MAX_AGENT_INSTRUCTIONS_BYTES } from "./agent-instructions.js";
-import { execEphemeralRequest } from "./ephemeral-exec.js";
 import { ApprovalManager } from "./approval.js";
 import { QuestionManager, validQuestions, isAskUserQuestionTool, formatQuestionResult } from "./question.js";
 import { NodeIdentity } from "./identity.js";
@@ -143,7 +142,7 @@ import { AgentQuestions, askQuestionsFrom } from "./session/agent-questions.js";
 import { AutomationProposals, describeChange } from "./session/automation-proposals.js";
 import { createSessionTokenCodec, isSessionToken, sessionTokenAllows } from "./session/session-tokens.js";
 import { setSessionTokenSigner } from "./runtime/session-env.js";
-import { MAX_NOTICE_TEXT, isAgentNotice, noticePush } from "./session/notices.js";
+import { MAX_NOTICE_TEXT, noticePush } from "./session/notices.js";
 import { createForkCommands } from "./controllers/fork-commands.js";
 import { createGithubCommands } from "./controllers/github-commands.js";
 import { createCredentialCommands } from "./controllers/credential-commands.js";
@@ -1082,6 +1081,7 @@ const linkedDevices = createLinkedDeviceController({
         syncPairingMetadata();
         relay?.pushRotate(deliveries);
         broadcast({ type: "devices.updated", devices });
+        void resealRetiredAutomationTemplates();
     },
 });
 const accessDevices = createAccessDeviceController({
@@ -2268,7 +2268,7 @@ const notAgentServers = (offers) => offers.filter((offer) => !agentCommands.has(
 const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     start: async (spec) => {
         let failure = "Could not start the app terminal.";
-        const id = await runTerms.openRunTerminal({ ...spec, agent: "app", label: spec.name }, (event) => {
+        const id = await runTerms.openRunTerminal({ ...spec, agent: "app", label: spec.name, background: true }, (event) => {
             const e = event;
             if (e.type === "terminal.error" && e.error)
                 failure = e.error;
@@ -2898,6 +2898,13 @@ const RELAY_COMMANDS = {
         if (!requestedSessionId && wantedRuntimeId && record?.runtimeId !== wantedRuntimeId)
             record = null;
         record ??= await sessionForModelQuery(wantedRuntimeId);
+        // A session whose agent hasn't started yet answers from the runtime's
+        // placeholder catalog, which can be missing the account's current models —
+        // a freshly launched machine then rejected a saved model it actually has.
+        // Warm the real catalog first (a no-op re-read once the agent is running),
+        // bounded so a slow spawn still answers with what is known.
+        if (requestedSessionId)
+            await warmSessionCatalog(record.session, SESSION_MODELS_WARM_MS);
         // Tag the list with the runtime it was resolved for so the client can
         // tell whether it belongs to the agent it currently has selected. Without
         // this a models.list answered for one agent (e.g. Codex's models) could
@@ -3188,22 +3195,6 @@ const RELAY_COMMANDS = {
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Promotion lost the epoch race" });
         ctx.reply({ type: "session.promote.result", requestId, ok: true, sessionId, epoch });
     },
-    // Ephemeral provisioning transport (node-broker path). A remote device that
-    // holds the user's cloud credentials asks this node to make ONE allowlisted
-    // HTTPS request to a provider (Fly/Hetzner/AWS/...) on its behalf. The
-    // token/credentials ride in the request headers and are used transiently —
-    // never persisted here — so the provisioning stays end-to-end (the control
-    // plane never sees it). The host allowlist is the SSRF guard.
-    async "ephemeral.exec"(msg) {
-        const requestId = String(msg.requestId ?? "");
-        try {
-            const result = await execEphemeralRequest(msg.request);
-            relay?.sendEvent({ type: "ephemeral.exec.result", requestId, ...result });
-        }
-        catch (error) {
-            relay?.sendEvent({ type: "ephemeral.exec.result", requestId, error: error instanceof Error ? error.message : String(error) });
-        }
-    },
     // Subscription / OAuth login driven from a remote device. The node runs the
     // provider's device-code (or paste-back) flow and reports the verification
     // link + code over the relay; the phone never needs the node's localhost.
@@ -3548,6 +3539,7 @@ function startRelayIfConfigured() {
     if (config.controlPlaneUrl && config.enrollmentToken) {
         sessionAdvertiseTarget = { controlPlaneUrl: config.controlPlaneUrl, enrollmentToken: config.enrollmentToken };
         void syncModelAuthFromControlPlane();
+        void resealRetiredAutomationTemplates();
         if (remoteRuntimeEnabled()) {
             // Stage 3: layer a control-plane-backed location registry UNDER the in-memory
             // one (so a lookup surviving a restart resolves from durable state), then
@@ -3709,6 +3701,43 @@ async function modelAuthFetch(pathname, init = {}) {
         headers.set("content-type", "application/json");
     return fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}${pathname}`, { ...init, headers });
 }
+// A device revoke rotates the room key. Re-seal this node's stored automation
+// instructions under the new key so the node and its devices can still read
+// them, then drop the retired keys. Retried at startup until it completes.
+async function resealRetiredAutomationTemplates() {
+    const retired = pairingStore.retiredRoomKeys();
+    if (!retired.length || !sessionAdvertiseTarget)
+        return;
+    const current = pairingStore.roomKey();
+    try {
+        const res = await modelAuthFetch("/node/automation-templates");
+        if (!res?.ok)
+            throw new Error(`control plane returned ${res?.status}`);
+        const { templates } = await res.json();
+        const result = await resealAutomationTemplates({
+            nodeId: identity.nodeId,
+            current,
+            retired,
+            templates,
+            save: async (id, templateCiphertext) => {
+                const saved = await modelAuthFetch(`/node/automation-templates/${encodeURIComponent(id)}`, { method: "PUT", body: JSON.stringify({ templateCiphertext }) });
+                if (!saved?.ok)
+                    throw new Error(`control plane returned ${saved?.status}`);
+            },
+        });
+        if (result.resealed)
+            console.log(`[automation-reseal] re-sealed ${result.resealed} automation template(s) under the rotated room key`);
+        if (result.unreadable.length)
+            console.warn(`[automation-reseal] ${result.unreadable.length} automation template(s) were sealed under a key this node no longer has: ${result.unreadable.join(", ")}`);
+        // Another rotation during this pass retired `current`; run again for it.
+        if (!pairingStore.roomKey().equals(current))
+            return void resealRetiredAutomationTemplates();
+        pairingStore.forgetRetiredRoomKeys();
+    }
+    catch (error) {
+        console.warn("[automation-reseal] will retry at next start:", error.message);
+    }
+}
 const remoteSessionAdmission = createRemoteSessionAdmission(async (idempotencyKey) => {
     // Only remote scopes reach this callback. Self-hosted control planes answer
     // allowed without an extension; losing enrollment mid-launch must fail closed.
@@ -5565,7 +5594,7 @@ async function executeWorkItem(item, report, signal) {
             throw new Error("automation instructions were encrypted for a different node");
         }
         try {
-            const template = decodeAutomationTemplate(open(pairingStore.roomKey(), payload.join(":")));
+            const template = decodeAutomationTemplate(pairingStore.openSealed(payload.join(":")));
             credentialLabels = template.credentialLabels;
             filter = template.filter;
             item = { ...item, body: template.instructions };
@@ -7620,7 +7649,7 @@ function evaluateEphemeralTeardown() {
     const records = new Set(openSessions.values());
     const anyWorking = [...records].some((r) => r.isWorking);
     const anyRemoteActive = clients.size > 0 || (relay?.clientCount ?? 0) > 0
-        || [...records].some((r) => r.remoteActive);
+        || [...records].some((r) => r.remoteActive) || remotePreview.inUse;
     const inFlightWork = controlPlanePoller?.inFlightCount() ?? 0;
     if (anyWorking || anyRemoteActive || inFlightWork > 0) {
         ephemeralEverBusy = true;
@@ -7643,6 +7672,7 @@ function evaluateEphemeralTeardown() {
         }
         await performSelfTeardown({
             provider: ephemeralTeardownCfg.provider,
+            sleep: ephemeralTeardownCfg.sleep,
             signalSettled: signalSettledToControlPlane,
             shutdown: () => { try {
                 spawnSync("shutdown", ["-h", "now"], { stdio: "ignore" });
@@ -7657,7 +7687,7 @@ if (ephemeralTeardownCfg.enabled) {
     const ephemeralEvalMs = Math.max(2_000, Math.min(ephemeralTeardownCfg.finishGraceMs, 15_000));
     const ephemeralTeardownTimer = setInterval(() => evaluateEphemeralTeardown(), ephemeralEvalMs);
     ephemeralTeardownTimer.unref?.();
-    console.log(`[ephemeral-teardown] armed: provider=${ephemeralTeardownCfg.provider} onFinish=${ephemeralTeardownCfg.onFinish} ttl=${ephemeralTeardownCfg.ttlMin}m`);
+    console.log(`[ephemeral-teardown] armed: provider=${ephemeralTeardownCfg.provider} onFinish=${ephemeralTeardownCfg.onFinish} sleep=${ephemeralTeardownCfg.sleep} ttl=${ephemeralTeardownCfg.ttlMin}m`);
 }
 setTimeout(() => void sweepDiskGuardrails(), 30_000).unref?.();
 // One sweep shortly after boot clears ghosts left by a previous run before any
@@ -8130,14 +8160,17 @@ function attachSessionListeners(record) {
         if (event.type === "turn_start" || event.type === "message_boundary" || event.type === "message_end" || event.type === "turn_end") {
             transcripts.persistTranscriptSnapshot(record);
         }
-        // A finalized assistant message may reference a remote image via markdown
-        // (`![alt](https://…)`) — fetch and store it now so the chat can render it
-        // (see resolveInlineImages). Checked on both events: message_end is the
-        // precise "this assistant message is done" signal most runtimes emit, but
-        // turn_end is a safety net for one that only surfaces the final text there.
-        // Fire-and-forget and internally deduped, so checking on both costs nothing.
+        // A finalized assistant message may reference an image via markdown — a
+        // remote URL (`![alt](https://…)`) to fetch, or a file the agent just
+        // produced in its workspace (`![alt](out/chart.png)`) to read. Resolve and
+        // store either now, so the chat can render it and history keeps it after the
+        // workspace is gone. Checked on both events: message_end is the precise
+        // "this assistant message is done" signal most runtimes emit, but turn_end
+        // is a safety net for one that only surfaces the final text there. Both
+        // resolvers are internally deduped, so checking twice costs nothing.
         if (event.type === "message_end" || event.type === "turn_end") {
             transcripts.resolveInlineImages(record);
+            transcripts.resolveWorkspaceRefs(record, harnessDirFor(record));
         }
         // Durably persist the throttled sidecars at the turn boundary so a crash
         // loses at most the in-flight turn's UI detail, not the whole turn. A
@@ -9069,6 +9102,9 @@ async function sessionForModelQuery(runtimeId) {
     modelQueryScratchPending.set(wanted, build);
     return build;
 }
+/** How long a session's models.list waits for its agent's real catalog before
+ *  answering with what is known (below the client's 15 s launch timeout). */
+const SESSION_MODELS_WARM_MS = 8_000;
 // A fresh scratch answers its first models.list from the runtime's placeholder
 // list (no live agent yet). Warm the real catalog in the background — for Claude
 // Code this spins up the agent subprocess just far enough for supportedModels()
@@ -11741,10 +11777,9 @@ app.get("/api/session/:id/context", (req, res) => {
         previewAvailable,
     }));
 });
-// `bivy notify "<message>"`: a card in the chat, and a push naming the session
-// (never the text) when nobody has the app open, or when it's urgent. At most
-// one push a minute per session; later notices still post a card. A `bivy run`
-// terminal has no chat to hold the card, so its notice is the push alone.
+// `bivy notify`: a push naming the session (never any text) when nobody has the
+// app open, or when it's urgent. At most one push a minute per session. It adds
+// nothing to the chat: what the agent has to say belongs in its reply there.
 const lastNotifyPush = new Map();
 app.post("/api/session/:id/notify", (req, res) => {
     const record = openSessions.get(String(req.params.id));
@@ -11752,16 +11787,9 @@ app.post("/api/session/:id/notify", (req, res) => {
     const sessionId = record?.id ?? run?.sessionId;
     if (!sessionId)
         return res.status(404).json({ error: "Session not found" });
-    const text = typeof req.body?.text === "string" ? req.body.text.trim() : "";
-    const notice = { id: `notice-${randomBytes(8).toString("hex")}`, text, ...(req.body?.urgent === true ? { urgent: true } : {}) };
-    if (!isAgentNotice(notice))
-        return res.status(400).json({ error: `A notice needs text (up to ${MAX_NOTICE_TEXT} characters).` });
-    if (record) {
-        eventLog.appendNotice(record.id, { afterMessageCount: record.session.getMessages().length, notice });
-        broadcast(stampSessionEvent({ type: "session.event", sessionId: record.id, event: { type: "notice", id: notice.id, notice } }));
-    }
+    const urgent = req.body?.urgent === true;
     const watching = Boolean(record) && (clients.size > 0 || (relay?.clientCount ?? 0) > 0);
-    const push = noticePush({ urgent: notice.urgent, userWatching: watching, lastPushAt: lastNotifyPush.get(sessionId), now: Date.now(), pushConfigured: Boolean(sessionAdvertiseTarget) });
+    const push = noticePush({ urgent, userWatching: watching, lastPushAt: lastNotifyPush.get(sessionId), now: Date.now(), pushConfigured: Boolean(sessionAdvertiseTarget) });
     if (push === "sent") {
         lastNotifyPush.set(sessionId, Date.now());
         void sendNotificationHint({
@@ -11769,10 +11797,10 @@ app.post("/api/session/:id/notify", (req, res) => {
             sessionId,
             targetSessionId: sessionId,
             title: sessionNotifyLabel(record, run?.name || "A terminal session"),
-            body: "Has a message for you — tap to read it.",
+            body: "Wants you to take a look — tap to open the session.",
         });
     }
-    res.json({ ok: true, id: notice.id, posted: Boolean(record), push, userWatching: watching });
+    res.json({ ok: true, push, userWatching: watching });
 });
 // `bivy ask`: the question card and "needs your input" push, for any agent.
 // Returns at once with an id; `/wait` blocks up to 240s per call (under common
@@ -11830,23 +11858,6 @@ app.post("/api/session/:id/title", (req, res) => {
     sessionNamer.setSessionName(record, title);
     res.json({ ok: true, title });
 });
-// `bivy suggest "<task>"`: the agent proposes a task the user can start in one
-// tap, here, through this agent's sub-agents, or in a parallel session; `run`
-// is the one the agent recommends (see packages/web SuggestionCard).
-app.post("/api/session/:id/suggest", (req, res) => {
-    const record = openSessions.get(String(req.params.id));
-    if (!record)
-        return res.status(404).json({ error: "Session not found" });
-    const text = typeof req.body?.text === "string" ? req.body.text.trim() : "";
-    const title = typeof req.body?.title === "string" && req.body.title.trim() ? req.body.title.trim() : undefined;
-    const run = req.body?.run || undefined;
-    const suggestion = { id: `suggestion-${randomBytes(8).toString("hex")}`, text, ...(title ? { title } : {}), ...(run ? { run } : {}) };
-    if (!isTaskSuggestion(suggestion))
-        return res.status(400).json({ error: `A suggestion needs text (up to ${MAX_SUGGESTION_TEXT} characters), an optional title (up to ${MAX_SUGGESTION_TITLE}) and an optional run (${SUGGESTION_RUNS.join(", ")}).` });
-    eventLog.appendSuggestion(record.id, { afterMessageCount: record.session.getMessages().length, suggestion });
-    broadcast(stampSessionEvent({ type: "session.event", sessionId: record.id, event: { type: "suggestion", id: suggestion.id, suggestion } }));
-    res.json({ ok: true, id: suggestion.id });
-});
 // Explicit child Run API for first-party/user-directed workflows. These routes
 // are intentionally not advertised to agents as tools; the service still
 // authorizes every status lookup against this parent Session's provenance.