@bivy/bivy 0.20.9-staging.34 → 0.20.9-staging.35

package/README.md

@@ -228,8 +228,7 @@ bivy secrets ref github.repo-token op://Bivy/GitHub/repo-token
 
 **Not every CLI login syncs.** Native agent logins may still be per-machine;
 GitHub App private-key sync is separately opt-in. If you lose every node and
-device able to unwrap a vault, you must sign in to providers again. Explicit
-hosted-provisioning custody grants are separate from ordinary encrypted sync.
+device able to unwrap a vault, you must sign in to providers again.
 
 [Credential sync and runtime coverage →](docs/credential-sync.md) ·
 [Credentials guide →](docs/credentials-guide.md) ·

package/dist/apps/styles.css

@@ -1517,7 +1517,6 @@ button.sheet-action:last-child { border-bottom: 0; }
 .vault-detail-grid { display: grid; grid-template-columns: minmax(110px, auto) 1fr; gap: 10px 18px; padding: 14px; border: 1px solid var(--line); border-radius: var(--radius-md); background: var(--surface-2); }
 .vault-detail-grid strong { min-width: 0; overflow-wrap: anywhere; }
 .vault-detail-grid code { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.vault-custody-note { padding: 12px 14px; border-left: 3px solid var(--accent); border-radius: var(--radius-sm) var(--radius-md) var(--radius-md) var(--radius-sm); background: var(--surface-2); line-height: 1.5; }
 .vault-advanced { padding: 10px 0; border-top: 1px solid var(--line); }
 .vault-advanced summary { cursor: pointer; color: var(--ink); font-weight: 600; }
 .vault-advanced[open] summary { margin-bottom: 10px; }
@@ -1916,6 +1915,7 @@ button.template-card.is-featured .template-card-icon {
 .autom-runner-select-copy span { color: var(--muted); font-size: 12px; line-height: 1.35; }
 .autom-runner-select-row .autom-inline-select { flex: none; width: min(42%, 190px); }
 .autom-runner-help {
+  display: flex; align-items: center; flex-wrap: wrap; gap: var(--space-2);
   padding: 10px 12px; border-top: 1px solid var(--line);
   color: var(--ink); background: color-mix(in srgb, var(--warn) 9%, var(--surface));
   font-size: 12px; line-height: 1.45;

package/dist/controllers/credential-commands.js

@@ -10,7 +10,7 @@
 // provider-list helpers) as composition deps.
 import { testProviderCredential } from "../runtime/credentials.js";
 import { NativeAuthPreviewService } from "../runtime/native-auth-preview.js";
-import { exportAccountApiKeys, exportAccountOAuthCredentials, importAccountOAuthCredentials, exportRecordTombstones, listCredentialRecords, removeProviderCredential, setProviderApiKeyLabeled, setProviderReferenceLabeled, setCredentialSync, setCredentialUnattended, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, } from "../credentials/api.js";
+import { exportAccountApiKeys, exportAccountOAuthCredentials, importAccountOAuthCredentials, exportRecordTombstones, listCredentialRecords, removeProviderCredential, setProviderApiKeyLabeled, setProviderReferenceLabeled, setCredentialSync, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, } from "../credentials/api.js";
 export function createCredentialCommands(deps) {
     const { credsDir } = deps;
     const nativeAuth = new NativeAuthPreviewService(credsDir);
@@ -95,8 +95,7 @@ export function createCredentialCommands(deps) {
         async "credential.remove"(msg, ctx) {
             try {
                 await removeProviderCredential(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""));
-                // Deleting a granted credential must also remove its escrowed cloud copy.
-                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: true });
+                await deps.pushModelAuthToControlPlane();
                 await deps.refreshSessionAfterAuth();
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 deps.broadcast({ type: "providers.list", providers: await deps.listProvidersUnified() });
@@ -112,8 +111,7 @@ export function createCredentialCommands(deps) {
             try {
                 const sync = msg.sync === "node" ? "node" : "account";
                 await setCredentialSync(credsDir, String(msg.provider ?? ""), String(msg.label ?? ""), sync);
-                // Demoting to machine-only revokes any custody grant; let it clear the escrow.
-                await deps.pushModelAuthToControlPlane({ allowEmptyHostedEscrow: sync === "node" });
+                await deps.pushModelAuthToControlPlane();
                 deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
                 ctx.reply({ type: "credential.sync.set.ok", requestId: msg.requestId });
             }
@@ -123,28 +121,6 @@ export function createCredentialCommands(deps) {
                 ctx.reply({ type: "credential.sync.set.error", requestId: msg.requestId, error: message });
             }
         },
-        async "credential.unattended.set"(msg, ctx) {
-            const provider = String(msg.provider ?? "");
-            const label = String(msg.label ?? "");
-            const previous = (await listCredentialRecords(credsDir)).find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
-            try {
-                await setCredentialUnattended(credsDir, provider, label, msg.unattended === true);
-                // Fail loud: the grant reply must reflect whether the encrypted cloud
-                // copy actually reached the control plane. An explicit disable is the
-                // one caller allowed to publish an empty escrow snapshot.
-                await deps.pushModelAuthToControlPlane({ throwOnFailure: true, allowEmptyHostedEscrow: msg.unattended !== true });
-                deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
-                ctx.reply({ type: "credential.unattended.set.ok", requestId: msg.requestId });
-            }
-            catch (error) {
-                // The UI must never claim an encrypted Cloud copy exists when custody
-                // publication failed. Restore the prior local grant before rejecting.
-                await setCredentialUnattended(credsDir, provider, label, previous).catch(() => { });
-                deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
-                const message = error instanceof Error ? error.message : String(error);
-                ctx.reply({ type: "credential.unattended.set.error", requestId: msg.requestId, error: message });
-            }
-        },
         // "Test connection": a bounded, non-secret liveness probe for one credential
         // record (see credentials/api.ts testCredential). The reply carries only
         // ok/at/reason — the credential's own token never leaves this handler.

package/dist/credentials/api.js

@@ -132,18 +132,6 @@ export async function importCredentialRecords(credsDir, records, deletedAt = {})
     }
     return createCredentialVault(credsDir).importRecords(list, tombstones);
 }
-/** Apply a hosted custody snapshot as an authoritative filtered set. */
-export async function reconcileHostedCredentialRecords(credsDir, records, previous) {
-    const current = Object.values(records ?? {}).filter((record) => Boolean(record) && typeof record === "object" && typeof record.provider === "string" && typeof record.label === "string");
-    const currentIds = new Set(current.map((record) => `${record.provider}\u0000${record.label}`));
-    const store = createCredentialVault(credsDir);
-    for (const prior of previous) {
-        if (!currentIds.has(`${prior.provider}\u0000${prior.label}`))
-            await store.deleteRecord(prior.provider, prior.label);
-    }
-    await importCredentialRecords(credsDir, records);
-    return current.map((record) => ({ provider: record.provider, label: record.label }));
-}
 /** Export provider revocations for cross-node convergence. */
 export async function exportProviderAuthTombstones(credsDir) {
     return createCredentialVault(credsDir).exportTombstones();
@@ -225,7 +213,7 @@ export async function listCredentialRecords(credsDir) {
         const verification = await vault.readVerification(record.provider, record.label).catch(() => undefined);
         const verified = verification ? { lastVerifiedAt: verification.at, lastVerifiedOk: verification.ok } : {};
         if (source.kind === "reference") {
-            return { provider: record.provider, label: record.label, kind: "reference", sync: record.sync, origin: record.origin, unattended: record.unattended === true, ref: source.ref, testable: false, ...verified };
+            return { provider: record.provider, label: record.label, kind: "reference", sync: record.sync, origin: record.origin, ref: source.ref, testable: false, ...verified };
         }
         const cred = source.cred;
         const summary = {
@@ -234,7 +222,6 @@ export async function listCredentialRecords(credsDir) {
             kind: cred.type,
             sync: record.sync,
             origin: record.origin,
-            unattended: record.unattended === true,
             testable: isTestableProvider(record.provider),
             ...verified,
         };
@@ -253,7 +240,6 @@ async function labeledMeta(credsDir, provider, label) {
     return {
         sync: existing?.sync ?? defaultSyncFor("bivy"),
         origin: existing?.origin ?? "bivy",
-        ...(existing?.unattended === true ? { unattended: true } : {}),
     };
 }
 /** Store an API key under a specific label (multi-account). */
@@ -404,33 +390,6 @@ export function getCredentialIngestPolicy(credsDir) {
 export function setCredentialIngestPolicy(credsDir, policy) {
     setIngestPolicyFile(defaultPresetsPath(credsDir), policy);
 }
-/** Explicitly grant/revoke use by separately escrowed unattended runners. */
-export async function setCredentialUnattended(credsDir, provider, label, unattended) {
-    const id = provider.trim().toLowerCase();
-    if (!id)
-        throw new Error("Provider is required");
-    const store = createCredentialVault(credsDir);
-    const existing = await store.readRecord(id, label);
-    if (!existing)
-        throw new Error(`No credential for ${id}:${normalizeLabel(label)}`);
-    if (existing.sync !== "account" && unattended)
-        throw new Error("A machine-only credential cannot be granted to unattended runners");
-    if (existing.source.kind === "reference" && unattended)
-        throw new Error("Password-manager references cannot be resolved by unattended runners");
-    await store.putRecord({ ...existing, unattended });
-}
-/** Credentials included in the explicit hosted custody snapshot. */
-export async function exportUnattendedRecords(credsDir) {
-    const records = await createCredentialVault(credsDir).exportSyncableRecords();
-    return Object.fromEntries(Object.entries(records).filter(([, record]) => record.unattended === true && record.source.kind === "stored"));
-}
-/** Monotonic logical revision for the filtered custody projection. */
-export async function unattendedCredentialRevision(credsDir) {
-    const store = createCredentialVault(credsDir);
-    const records = await store.listRecords();
-    const deletedAt = await store.exportRecordTombstones();
-    return Math.max(0, ...records.map((record) => Number(record.updatedAt) || 0), ...Object.values(deletedAt).map((stamp) => Number(stamp) || 0));
-}
 /** Set a labeled credential's sync tier — the per-credential opt-out toggle. */
 export async function setCredentialSync(credsDir, provider, label, sync) {
     const id = provider.trim().toLowerCase();
@@ -445,5 +404,5 @@ export async function setCredentialSync(credsDir, provider, label, sync) {
     if (existing.source.kind === "reference" && existing.source.backend === "command" && sync === "account") {
         throw new Error("A cmd:// reference is node-local (it runs a command on this machine) and cannot be synced.");
     }
-    await store.putRecord({ ...existing, sync, ...(sync === "node" ? { unattended: false } : {}) });
+    await store.putRecord({ ...existing, sync });
 }

package/dist/credentials/document.js

@@ -137,12 +137,11 @@ export function preferIncomingRecord(local, incoming) {
     const incomingOauth = oauthOf(incoming);
     if (!localOauth || !incomingOauth)
         return true;
-    // Identical token content means this is a metadata-only change (an
-    // unattended-runs grant/revoke, a sync-tier move). Token freshness cannot
-    // order those, so the newer record write wins — without this, a grant made
-    // on one machine never reaches its peers, and a peer's next hosted-escrow
-    // push would read as "nothing granted". Equal stamps fall back to canonical
-    // record content so both merge directions still converge.
+    // Identical token content means this is a metadata-only change (a sync-tier
+    // move). Token freshness cannot order those, so the newer record write wins —
+    // without this, a change made on one machine never reaches its peers. Equal
+    // stamps fall back to canonical record content so both merge directions still
+    // converge.
     if (canonicalCredential(localOauth) === canonicalCredential(incomingOauth)) {
         const localAt = Number(local.updatedAt) || 0;
         const incomingAt = Number(incoming.updatedAt) || 0;
@@ -269,14 +268,7 @@ export function mergeDocuments(local, incomingCredentials, incomingDeletedAt = {
             continue;
         if (!(key in credentials))
             imported += 1;
-        // An incoming record with no opinion on unattended custody (undefined — the
-        // v2 wire and plaintext ingest never carry the flag) must not strip an
-        // explicit local grant/revoke: agent-side token refreshes flow through this
-        // merge, and dropping the flag would make the node's next escrow push
-        // silently revoke the encrypted cloud copy the user still relies on.
-        credentials[key] = localRecord && incoming.unattended === undefined && localRecord.unattended !== undefined
-            ? { ...incoming, unattended: localRecord.unattended }
-            : incoming;
+        credentials[key] = incoming;
         const incomingUpdatedAt = Number(incoming.updatedAt);
         if (!Number.isFinite(deletedAt[key]) || incomingUpdatedAt > deletedAt[key])
             delete deletedAt[key];

package/dist/credentials/store.js

@@ -555,11 +555,11 @@ export class BivyCredentialStore {
             // tombstone-newer-wins — see document.ts).
             const incoming = migrateToV3({ v: 2, providers: snapshot, deletedAt });
             // The v2 wire carries no record metadata, so migrateToV3 synthesizes
-            // defaults (sync: "account", origin: "bivy", no unattended flag). Those
-            // defaults must not clobber local intent — a machine-only sync tier or an
-            // unattended-runs custody grant — when only the token content is newer
-            // (e.g. an agent's own TUI refreshed the OAuth token set). Inherit the
-            // existing record's metadata; the merge engine still decides freshness.
+            // defaults (sync: "account", origin: "bivy"). Those defaults must not
+            // clobber local intent — a machine-only sync tier — when only the token
+            // content is newer (e.g. an agent's own TUI refreshed the OAuth token
+            // set). Inherit the existing record's metadata; the merge engine still
+            // decides freshness.
             for (const [key, record] of Object.entries(incoming.credentials)) {
                 const existing = document.credentials[key];
                 if (!existing)
@@ -568,7 +568,6 @@ export class BivyCredentialStore {
                     ...record,
                     sync: existing.sync,
                     origin: existing.origin,
-                    ...(existing.unattended !== undefined ? { unattended: existing.unattended } : {}),
                 };
             }
             const result = mergeDocuments(document, incoming.credentials, incoming.deletedAt);