@bivy/bivy 0.20.9-staging.9 → 0.21.0

package/dist/server.js

@@ -44,7 +44,7 @@ import { createAppCommands } from "./controllers/app-commands.js";
 import { createFileCommands } from "./controllers/file-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
-import { aggregateModelCatalog, catalogReplyEvent, mergeProviderCatalog } from "./runtime/model-catalog.js";
+import { aggregateModelCatalog, catalogReplyEvent, warmSessionCatalog, mergeProviderCatalog } from "./runtime/model-catalog.js";
 import { resolveModelRef } from "./runtime/model-ref.js";
 import { RuntimeHost, enforcementLevelFor, remoteRuntimeEnabled } from "./runtime/host.js";
 import { RemoteRuntime, RemoteRuntimeSession } from "./runtime/remote.js";
@@ -54,6 +54,7 @@ import { ControlPlaneSessionLocationRegistry, LayeredSessionLocationRegistry } f
 import { attachAdoptedSessions, classifyAttachFailure } from "./runtime/adoption.js";
 import { createCredentialStore, testProviderCredential } from "./runtime/credentials.js";
 import { decodeAutomationTemplate } from "./automation-template.js";
+import { resealAutomationTemplates } from "./automation-reseal.js";
 import { passWebhookFilter } from "./automation-filter-gate.js";
 import { isModelAuthError, authProviderForSession, classifyModelAuthError } from "./runtime/auth-errors.js";
 import { createCredentialVault, migrateVaultDir } from "./runtime/credential-store.js";
@@ -76,12 +77,11 @@ import { listNativePiSessions, piAgentDir } from "./agents/pi/integration.js";
 import { deriveSessionState } from "./session/session-state.js";
 import { resolveStreamingBehavior } from "./session/record.js";
 import { createSessionEngine } from "./session/engine.js";
-import { exportProviderAuth, exportAccountApiKeys, exportAccountOAuthCredentials, importAccountOAuthCredentials, exportSyncableProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, setCredentialSync, setCredentialUnattended, exportUnattendedRecords, unattendedCredentialRevision, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, exportSyncableRecords, exportRecordTombstones, importCredentialRecords, reconcileHostedCredentialRecords } from "./credentials/api.js";
+import { exportProviderAuth, exportAccountApiKeys, exportAccountOAuthCredentials, importAccountOAuthCredentials, exportSyncableProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, setCredentialSync, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, exportSyncableRecords, exportRecordTombstones, importCredentialRecords } from "./credentials/api.js";
 import { listProviders } from "./runtime/provider-catalog.js";
 import { exportLocalModels, importLocalModels } from "./runtime/local-model-store.js";
 import { sessionLikeFields } from "./session/start-like.js";
 import { BIVY_AGENT_NOTE, mergeSyncedAgentInstructions, readAgentInstructions, sessionInstructions, writeAgentInstructions, MAX_AGENT_INSTRUCTIONS_BYTES } from "./agent-instructions.js";
-import { execEphemeralRequest } from "./ephemeral-exec.js";
 import { ApprovalManager } from "./approval.js";
 import { QuestionManager, validQuestions, isAskUserQuestionTool, formatQuestionResult } from "./question.js";
 import { NodeIdentity } from "./identity.js";
@@ -109,7 +109,6 @@ import { forceAbortTurn } from "./session/abort-recovery.js";
 import { runRequiredAutomationChecks } from "./automation-checks.js";
 import { configToLegacySettings, mergeLegacyIntoNodeConfig, readNodeConfig, writeNodeConfig } from "./node-config.js";
 import { loadProjectPolicy, resolveProjectSafety } from "./project-policy.js";
-import { hostedCustodyNode } from "./hosted-custody.js";
 import { PolicyEngine } from "./policy/policy-engine.js";
 import { SessionAllowRules } from "./policy/session-allow.js";
 import { TerminalManager } from "./terminal.js";
@@ -177,6 +176,7 @@ import { getSttConfig, isSttProvider, removeSttKey, setSttKey, setSttProvider, t
 import { synthesizeOpenAiSpeech } from "./tts.js";
 import { seal, open } from "./e2e.js";
 import { recoverModelAuthKey } from "./model-auth-key-recovery.js";
+import { runPrompt, trustedInstructions } from "./work-instructions.js";
 import { RunDelegationService, parseDelegationSource } from "./run-tools.js";
 import { delegationCard } from "./session/delegation-cards.js";
 import { TERMINAL_DELEGATION, isDelegatedFrom } from "./session/delegations.js";
@@ -1081,6 +1081,7 @@ const linkedDevices = createLinkedDeviceController({
         syncPairingMetadata();
         relay?.pushRotate(deliveries);
         broadcast({ type: "devices.updated", devices });
+        void resealRetiredAutomationTemplates();
     },
 });
 const accessDevices = createAccessDeviceController({
@@ -1562,6 +1563,15 @@ function nodeConfiguredDefaultAgent() {
 }
 /** How interactive sessions recover after a restart interrupted them mid-turn.
  *  Defaults to "auto" (re-drive the turn); "manual" waits for a user tap. */
+/** This machine runs Slack prompts, which arrive unsealed: the node setting, or BIVY_SLACK_PROMPTS. Off by default. */
+function slackPromptsEnabled() {
+    const env = process.env.BIVY_SLACK_PROMPTS;
+    if (env === "1" || env === "true")
+        return true;
+    if (env === "0" || env === "false")
+        return false;
+    return readNodeConfig(appDir)?.automation?.slackPrompts === true;
+}
 /** Agents may screenshot app previews: the node setting, or BIVY_APP_SCREENSHOTS. */
 function appScreenshotsEnabled() {
     const env = process.env.BIVY_APP_SCREENSHOTS;
@@ -2267,7 +2277,7 @@ const notAgentServers = (offers) => offers.filter((offer) => !agentCommands.has(
 const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     start: async (spec) => {
         let failure = "Could not start the app terminal.";
-        const id = await runTerms.openRunTerminal({ ...spec, agent: "app", label: spec.name }, (event) => {
+        const id = await runTerms.openRunTerminal({ ...spec, agent: "app", label: spec.name, background: true }, (event) => {
             const e = event;
             if (e.type === "terminal.error" && e.error)
                 failure = e.error;
@@ -2441,7 +2451,7 @@ const RELAY_COMMANDS = {
         credsDir,
         sendEvent: (event) => relay?.sendEvent(event),
         broadcast,
-        pushModelAuthToControlPlane: (opts) => pushModelAuthToControlPlane(false, opts?.throwOnFailure === true, opts?.allowEmptyHostedEscrow === true),
+        pushModelAuthToControlPlane: (opts) => pushModelAuthToControlPlane(false, opts?.throwOnFailure === true),
         refreshSessionAfterAuth,
         listProvidersUnified,
     }),
@@ -2897,6 +2907,13 @@ const RELAY_COMMANDS = {
         if (!requestedSessionId && wantedRuntimeId && record?.runtimeId !== wantedRuntimeId)
             record = null;
         record ??= await sessionForModelQuery(wantedRuntimeId);
+        // A session whose agent hasn't started yet answers from the runtime's
+        // placeholder catalog, which can be missing the account's current models —
+        // a freshly launched machine then rejected a saved model it actually has.
+        // Warm the real catalog first (a no-op re-read once the agent is running),
+        // bounded so a slow spawn still answers with what is known.
+        if (requestedSessionId)
+            await warmSessionCatalog(record.session, SESSION_MODELS_WARM_MS);
         // Tag the list with the runtime it was resolved for so the client can
         // tell whether it belongs to the agent it currently has selected. Without
         // this a models.list answered for one agent (e.g. Codex's models) could
@@ -3069,8 +3086,7 @@ const RELAY_COMMANDS = {
                 }
             }
             await removeProvider(credsDir, id);
-            // Deleting a granted credential must also remove its escrowed cloud copy.
-            await pushModelAuthToControlPlane(false, false, true);
+            await pushModelAuthToControlPlane();
             await refreshSessionAfterAuth();
             broadcast({ type: "provider.oauth.reset", provider: id, ok: true, providers: await listProvidersUnified() });
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
@@ -3082,8 +3098,7 @@ const RELAY_COMMANDS = {
     async "provider.remove"(msg) {
         try {
             await removeProvider(credsDir, String(msg.provider ?? msg.id ?? ""));
-            // Deleting a granted credential must also remove its escrowed cloud copy.
-            await pushModelAuthToControlPlane(false, false, true);
+            await pushModelAuthToControlPlane();
             await refreshSessionAfterAuth();
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
         }
@@ -3187,22 +3202,6 @@ const RELAY_COMMANDS = {
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Promotion lost the epoch race" });
         ctx.reply({ type: "session.promote.result", requestId, ok: true, sessionId, epoch });
     },
-    // Ephemeral provisioning transport (node-broker path). A remote device that
-    // holds the user's cloud credentials asks this node to make ONE allowlisted
-    // HTTPS request to a provider (Fly/Hetzner/AWS/...) on its behalf. The
-    // token/credentials ride in the request headers and are used transiently —
-    // never persisted here — so the provisioning stays end-to-end (the control
-    // plane never sees it). The host allowlist is the SSRF guard.
-    async "ephemeral.exec"(msg) {
-        const requestId = String(msg.requestId ?? "");
-        try {
-            const result = await execEphemeralRequest(msg.request);
-            relay?.sendEvent({ type: "ephemeral.exec.result", requestId, ...result });
-        }
-        catch (error) {
-            relay?.sendEvent({ type: "ephemeral.exec.result", requestId, error: error instanceof Error ? error.message : String(error) });
-        }
-    },
     // Subscription / OAuth login driven from a remote device. The node runs the
     // provider's device-code (or paste-back) flow and reports the verification
     // link + code over the relay; the phone never needs the node's localhost.
@@ -3547,6 +3546,7 @@ function startRelayIfConfigured() {
     if (config.controlPlaneUrl && config.enrollmentToken) {
         sessionAdvertiseTarget = { controlPlaneUrl: config.controlPlaneUrl, enrollmentToken: config.enrollmentToken };
         void syncModelAuthFromControlPlane();
+        void resealRetiredAutomationTemplates();
         if (remoteRuntimeEnabled()) {
             // Stage 3: layer a control-plane-backed location registry UNDER the in-memory
             // one (so a lookup surviving a restart resolves from durable state), then
@@ -3590,16 +3590,16 @@ function startRelayIfConfigured() {
     return true;
 }
 const modelAuthVaultKeyPath = path.join(appDir, "model-auth-vault.json");
-const hostedModelAuthVaultKeyPath = path.join(appDir, "model-auth-hosted-vault.json");
-const hostedImportedRecordsPath = path.join(appDir, "model-auth-hosted-records.json");
 let lastPushedModelAuthCiphertext = "";
-let lastPushedHostedModelAuthCiphertext = "";
-let lastPushedHostedModelAuthRevision = -1;
-// Custody semantics are keyed on the dedicated flag (plus an ephemeral
-// back-compat case) — see src/hosted-custody.ts. A persistent personal node
-// that polls the hosted GitHub queue is NOT a custody guest: it owns its
-// logins and must keep account sync and unattended-escrow publishing.
-const isHostedCustodyNode = () => hostedCustodyNode();
+// Every node, the account's cloud computer included, owns its vault key and
+// gets it wrapped node-to-node. Remove state left by the retired hosted
+// custody mode, whose key the control plane could also decrypt.
+for (const retired of ["model-auth-hosted-vault.json", "model-auth-hosted-records.json"]) {
+    try {
+        fs.rmSync(path.join(appDir, retired), { force: true });
+    }
+    catch { /* best effort */ }
+}
 function readLocalModelAuthVaultKey() {
     try {
         const parsed = JSON.parse(fs.readFileSync(modelAuthVaultKeyPath, "utf8"));
@@ -3625,40 +3625,6 @@ function forgetLocalModelAuthVaultKey() {
     }
     catch { /* best effort */ }
 }
-function readHostedModelAuthVaultKey() {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(hostedModelAuthVaultKeyPath, "utf8"));
-        if (parsed.vaultKeyB64 && Buffer.from(parsed.vaultKeyB64, "base64").length === 32)
-            return parsed.vaultKeyB64;
-    }
-    catch { /* no hosted key */ }
-    return undefined;
-}
-function writeHostedModelAuthVaultKey(vaultKeyB64) {
-    fs.writeFileSync(hostedModelAuthVaultKeyPath, `${JSON.stringify({ vaultKeyB64, createdAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
-}
-function readHostedImportedRecords() {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(hostedImportedRecordsPath, "utf8"));
-        return Array.isArray(parsed?.records)
-            ? parsed.records.filter((record) => Boolean(record) && typeof record === "object" && typeof record.provider === "string" && typeof record.label === "string")
-            : [];
-    }
-    catch {
-        return [];
-    }
-}
-function writeHostedImportedRecords(records) {
-    fs.writeFileSync(hostedImportedRecordsPath, `${JSON.stringify({ records }, null, 2)}\n`, { mode: 0o600 });
-}
-function ensureHostedModelAuthVaultKey() {
-    const existing = readHostedModelAuthVaultKey();
-    if (existing)
-        return existing;
-    const created = randomBytes(32).toString("base64");
-    writeHostedModelAuthVaultKey(created);
-    return created;
-}
 function ensureLocalModelAuthVaultKey() {
     const existing = readLocalModelAuthVaultKey();
     if (existing)
@@ -3708,6 +3674,43 @@ async function modelAuthFetch(pathname, init = {}) {
         headers.set("content-type", "application/json");
     return fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}${pathname}`, { ...init, headers });
 }
+// A device revoke rotates the room key. Re-seal this node's stored automation
+// instructions under the new key so the node and its devices can still read
+// them, then drop the retired keys. Retried at startup until it completes.
+async function resealRetiredAutomationTemplates() {
+    const retired = pairingStore.retiredRoomKeys();
+    if (!retired.length || !sessionAdvertiseTarget)
+        return;
+    const current = pairingStore.roomKey();
+    try {
+        const res = await modelAuthFetch("/node/automation-templates");
+        if (!res?.ok)
+            throw new Error(`control plane returned ${res?.status}`);
+        const { templates } = await res.json();
+        const result = await resealAutomationTemplates({
+            nodeId: identity.nodeId,
+            current,
+            retired,
+            templates,
+            save: async (id, templateCiphertext) => {
+                const saved = await modelAuthFetch(`/node/automation-templates/${encodeURIComponent(id)}`, { method: "PUT", body: JSON.stringify({ templateCiphertext }) });
+                if (!saved?.ok)
+                    throw new Error(`control plane returned ${saved?.status}`);
+            },
+        });
+        if (result.resealed)
+            console.log(`[automation-reseal] re-sealed ${result.resealed} automation template(s) under the rotated room key`);
+        if (result.unreadable.length)
+            console.warn(`[automation-reseal] ${result.unreadable.length} automation template(s) were sealed under a key this node no longer has: ${result.unreadable.join(", ")}`);
+        // Another rotation during this pass retired `current`; run again for it.
+        if (!pairingStore.roomKey().equals(current))
+            return void resealRetiredAutomationTemplates();
+        pairingStore.forgetRetiredRoomKeys();
+    }
+    catch (error) {
+        console.warn("[automation-reseal] will retry at next start:", error.message);
+    }
+}
 const remoteSessionAdmission = createRemoteSessionAdmission(async (idempotencyKey) => {
     // Only remote scopes reach this callback. Self-hosted control planes answer
     // allowed without an extension; losing enrollment mid-launch must fail closed.
@@ -3772,6 +3775,11 @@ function ensureModelAuthColdStart() {
             return;
         // A concurrent sync may have already landed the key — stop as soon as we have it.
         if (readLocalModelAuthVaultKey() || modelAuthColdStartAttempts >= MODEL_AUTH_COLDSTART_MAX_ATTEMPTS) {
+            // No online peer answered: credential sync has settled without the
+            // vault. A launch waiting on this milestone proceeds and asks the user
+            // to sign in on this machine instead of waiting forever.
+            if (!readLocalModelAuthVaultKey())
+                void reportEphemeralMilestone("credentialsReadyAt");
             stopModelAuthColdStart();
             return;
         }
@@ -3792,61 +3800,34 @@ async function syncModelAuthFromControlPlane() {
         if (!res?.ok)
             return;
         const data = (await res.json().catch(() => ({})));
-        const hostedCustody = isHostedCustodyNode();
-        let hostedData = {};
-        if (hostedCustody) {
-            const hostedResponse = await modelAuthFetch("/node/model-auth-hosted-vault");
-            if (hostedResponse?.ok)
-                hostedData = (await hostedResponse.json().catch(() => ({})));
-        }
-        const targetVault = hostedCustody ? hostedData.hostedVault : data.vault;
-        let vaultKeyB64 = hostedCustody ? readHostedModelAuthVaultKey() : readLocalModelAuthVaultKey();
-        // Hosted runners may decrypt ONLY the separately encrypted snapshot of
-        // records that the user explicitly granted to unattended execution.
-        if (hostedCustody && !vaultKeyB64 && hostedData.hostedKey && hostedData.hostedVault && Buffer.from(hostedData.hostedKey, "base64").length === 32) {
-            vaultKeyB64 = hostedData.hostedKey;
-            writeHostedModelAuthVaultKey(vaultKeyB64);
-        }
-        if (targetVault?.ciphertext && (vaultKeyB64 || (!hostedCustody && data.wrappedKey))) {
+        const targetVault = data.vault;
+        let vaultKeyB64 = readLocalModelAuthVaultKey();
+        if (targetVault?.ciphertext && (vaultKeyB64 || data.wrappedKey)) {
             let decrypted;
             try {
-                if (hostedCustody) {
-                    decrypted = decryptModelAuthEnvelope(targetVault.ciphertext, vaultKeyB64);
-                }
-                else {
-                    const wrapped = data.wrappedKey;
-                    const recovered = recoverModelAuthKey({
-                        localKey: vaultKeyB64,
-                        unwrap: wrapped ? () => pairingStore.unwrapFromNodePublicKey(wrapped.wrappedByPublicKey, wrapped.wrappedKey) : undefined,
-                        decrypt: (key) => decryptModelAuthEnvelope(targetVault.ciphertext, key),
-                    });
-                    if (!recovered)
-                        throw new Error("No available key can decrypt the account vault");
-                    vaultKeyB64 = recovered.key;
-                    decrypted = recovered.value;
-                    writeLocalModelAuthVaultKey(vaultKeyB64);
-                }
+                const wrapped = data.wrappedKey;
+                const recovered = recoverModelAuthKey({
+                    localKey: vaultKeyB64,
+                    unwrap: wrapped ? () => pairingStore.unwrapFromNodePublicKey(wrapped.wrappedByPublicKey, wrapped.wrappedKey) : undefined,
+                    decrypt: (key) => decryptModelAuthEnvelope(targetVault.ciphertext, key),
+                });
+                if (!recovered)
+                    throw new Error("No available key can decrypt the account vault");
+                vaultKeyB64 = recovered.key;
+                decrypted = recovered.value;
+                writeLocalModelAuthVaultKey(vaultKeyB64);
             }
             catch (error) {
                 // Most commonly this node cached the previous generation while another
                 // survivor completed a revoke-triggered re-key. Forget it and request a
                 // wrap of the current key; retaining it would make every poll fail forever.
-                if (hostedCustody) {
-                    try {
-                        fs.rmSync(hostedModelAuthVaultKeyPath, { force: true });
-                    }
-                    catch { /* best effort */ }
-                    lastPushedHostedModelAuthCiphertext = "";
-                }
-                else {
-                    forgetLocalModelAuthVaultKey();
-                    lastPushedModelAuthCiphertext = "";
-                    await modelAuthFetch("/node/model-auth-key/request", {
-                        method: "POST",
-                        body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64(), rejectedWrappedKey: data.wrappedKey?.wrappedKey }),
-                    });
-                    ensureModelAuthColdStart();
-                }
+                forgetLocalModelAuthVaultKey();
+                lastPushedModelAuthCiphertext = "";
+                await modelAuthFetch("/node/model-auth-key/request", {
+                    method: "POST",
+                    body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64(), rejectedWrappedKey: data.wrappedKey?.wrappedKey }),
+                });
+                ensureModelAuthColdStart();
                 console.warn("[auth-sync] cached vault key is stale; requested the rotated key:", error.message);
                 return;
             }
@@ -3856,45 +3837,31 @@ async function syncModelAuthFromControlPlane() {
             // so importing records alone (plus its record-keyed tombstones) is complete.
             // Fall back to the provider-keyed fields for a v2 peer.
             if (v >= 3) {
-                if (hostedCustody) {
-                    // Hosted snapshots are authoritative filtered sets, not additive peer
-                    // merges. Remove custody-derived records omitted by a later snapshot
-                    // so a revoke takes effect on already-running hosted nodes.
-                    const current = await reconcileHostedCredentialRecords(credsDir, records, readHostedImportedRecords());
-                    writeHostedImportedRecords(current);
-                }
-                else {
-                    await importCredentialRecords(credsDir, records, recordsDeletedAt);
-                }
+                await importCredentialRecords(credsDir, records, recordsDeletedAt);
             }
             else {
                 await importProviderAuth(credsDir, providers, deletedAt);
             }
             importLocalModels(localModelsDir, localModels);
-            // Account-wide agent instructions reconcile last-writer-wins. Hosted
-            // runners hold only the filtered credential snapshot, which never carries
-            // them, so they neither import nor republish.
-            const instructionsSync = hostedCustody ? "unchanged" : mergeSyncedAgentInstructions(appDir, decrypted.agentInstructions);
+            // Account-wide agent instructions reconcile last-writer-wins.
+            const instructionsSync = mergeSyncedAgentInstructions(appDir, decrypted.agentInstructions);
             if (instructionsSync === "imported")
                 broadcast({ type: "node.settings", settings: nodeSettingsSnapshot() });
             // A synced key or config change can both alter the projection, so always
             // regenerate it (and refresh the panel) after importing the vault.
             await writePiModelsProjection();
             await broadcastLocalModels();
-            if (hostedCustody)
-                lastPushedHostedModelAuthCiphertext = targetVault.ciphertext;
-            else
-                lastPushedModelAuthCiphertext = targetVault.ciphertext;
+            lastPushedModelAuthCiphertext = targetVault.ciphertext;
             // Got the key and imported the vault (incl. any subscription-OAuth logins) —
             // the cold-start race is over.
             stopModelAuthColdStart();
             broadcast({ type: "providers.list", providers: await listProvidersUnified() });
-            if (!hostedCustody && data.vault?.needsRotation)
+            if (data.vault?.needsRotation)
                 await pushModelAuthToControlPlane(true);
             else if (instructionsSync === "local-newer")
                 await pushModelAuthToControlPlane();
         }
-        else if (targetVault?.ciphertext && !vaultKeyB64 && !hostedCustody) {
+        else if (targetVault?.ciphertext && !vaultKeyB64) {
             await modelAuthFetch("/node/model-auth-key/request", { method: "POST", body: JSON.stringify({ publicKey: pairingStore.nodePublicKeyB64() }) });
             // No peer has wrapped our key yet. Fast-retry (bounded) so a short-lived
             // ephemeral runner picks up the key within seconds of a peer answering,
@@ -3907,13 +3874,10 @@ async function syncModelAuthFromControlPlane() {
             await pushModelAuthToControlPlane();
         }
         await processModelAuthKeyRequests(data.requests ?? []);
-        // A personal node with no vault has nothing to hydrate and is ready. A
-        // hosted-custody guest is different: an absent filtered snapshot means it
-        // has no model credential at all, not that hydration succeeded.
-        const credentialsReady = hostedCustody
-            ? Boolean(targetVault?.ciphertext && readHostedModelAuthVaultKey())
-            : Boolean(!targetVault?.ciphertext || readLocalModelAuthVaultKey());
-        if (credentialsReady)
+        // With no account vault there is nothing to hydrate; with one, ready once
+        // this node holds its key. (The cold-start retry reports it too when no
+        // peer answers, so a waiting launch can move on.)
+        if (!targetVault?.ciphertext || readLocalModelAuthVaultKey())
             void reportEphemeralMilestone("credentialsReadyAt");
     }
     catch (error) {
@@ -3934,51 +3898,7 @@ async function processModelAuthKeyRequests(requests) {
         });
     }
 }
-async function pushHostedModelAuthToControlPlane(allowEmpty = false) {
-    const [records, revision] = await Promise.all([exportUnattendedRecords(credsDir), unattendedCredentialRevision(credsDir)]);
-    // A setup guest must not establish an empty snapshot when the credential is
-    // first saved (before the explicit grant command follows). Otherwise its
-    // one allowed initial write would be consumed by an unusable vault.
-    //
-    // And an IMPLICIT empty push must never revoke the escrow: an empty snapshot
-    // is how "disable unattended runs" removes the cloud copy, but every vault
-    // change funnels through here — so a node whose copy simply lacks the grant
-    // (not yet synced, or granted elsewhere) would otherwise wipe the encrypted
-    // cloud copy the user's other machines just published. Only an explicit
-    // local revoke/delete (allowEmpty) may publish an empty snapshot.
-    if (Object.keys(records).length === 0 && (!allowEmpty || isHostedCustodyNode()))
-        return;
-    if (revision === lastPushedHostedModelAuthRevision)
-        return;
-    const key = ensureHostedModelAuthVaultKey();
-    const ciphertext = encryptModelAuthProviders({}, {}, {}, key, records, {});
-    const publish = async (expectedGeneration) => modelAuthFetch("/node/model-auth-hosted-vault", {
-        method: "PUT",
-        body: JSON.stringify({ ciphertext, vaultKeyB64: key, expectedGeneration, revision }),
-    });
-    const currentResponse = await modelAuthFetch("/node/model-auth-hosted-vault");
-    if (currentResponse?.status === 403)
-        throw new Error("hosted credential custody is not enabled for this account");
-    const current = currentResponse?.ok
-        ? (await currentResponse.json().catch(() => ({})))
-        : {};
-    let response = await publish(current.hostedVault?.generation ?? 0);
-    if (response?.status === 409) {
-        const conflict = await response.json().catch(() => ({}));
-        // Retry only when our logical state is at least as new; the store also
-        // enforces this revision check atomically with the generation CAS.
-        if (revision >= Number(conflict.revision ?? 0))
-            response = await publish(Number(conflict.generation ?? 0));
-    }
-    if (response?.ok) {
-        lastPushedHostedModelAuthCiphertext = ciphertext;
-        lastPushedHostedModelAuthRevision = revision;
-    }
-    else {
-        throw new Error(`hosted model-auth push failed (${response?.status ?? "offline"})`);
-    }
-}
-async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false, allowEmptyHostedEscrow = false) {
+async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = false) {
     if (!sessionAdvertiseTarget)
         return;
     // Piggyback the (plaintext, non-secret) provider status summary on every
@@ -3988,16 +3908,6 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
     // versa.
     await pushProviderSummaryToControlPlane();
     try {
-        // A hosted runner holds only the explicitly granted snapshot and must never
-        // overwrite the peer-to-peer account vault with that filtered subset.
-        if (isHostedCustodyNode()) {
-            // A credential-setup guest may establish the initial filtered snapshot.
-            // The control plane refuses managed-guest replacement after that first
-            // write, so normal hosted runners remain recipients rather than authorities.
-            if (process.env.BIVY_HOSTED_CREDENTIAL_PUBLISH === "1" && !lastPushedHostedModelAuthCiphertext)
-                await pushHostedModelAuthToControlPlane();
-            return;
-        }
         // Only push credentials on the account-sync tier; a `sync: "node"` credential
         // stays local (per-credential opt-out). Tombstones still converge for all.
         const providers = await exportSyncableProviderAuth(credsDir);
@@ -4013,10 +3923,8 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
             writeLocalModelAuthVaultKey(vaultKeyB64);
         const instructions = readAgentInstructions(appDir);
         const ciphertext = encryptModelAuthProviders(providers, deletedAt, localModels, vaultKeyB64, records, recordsDeletedAt, instructions.updatedAt > 0 ? instructions : undefined);
-        if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext) {
-            await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
+        if (!rotateKey && ciphertext === lastPushedModelAuthCiphertext)
             return;
-        }
         const push = await modelAuthFetch("/node/model-auth-vault", { method: "PUT", body: JSON.stringify({ ciphertext, rotated: rotateKey }) });
         if (!push?.ok) {
             if (rotateKey) {
@@ -4032,10 +3940,6 @@ async function pushModelAuthToControlPlane(rotateKey = false, throwOnFailure = f
             body: JSON.stringify({ targetNodeId: identity.nodeId, wrappedByPublicKey: pairingStore.nodePublicKeyB64(), wrappedKey: pairingStore.wrapForNodePublicKey(pairingStore.nodePublicKeyB64(), vaultKeyB64) }),
         });
         lastPushedModelAuthCiphertext = ciphertext;
-        // Publish a DIFFERENT ciphertext under a DIFFERENT key containing only
-        // records with `unattended:true`. Escrowing this key cannot decrypt the E2E
-        // account vault, which is the critical custody separation.
-        await pushHostedModelAuthToControlPlane(allowEmptyHostedEscrow);
     }
     catch (error) {
         console.warn("[auth-sync] could not push model auth:", error.message);
@@ -5558,13 +5462,14 @@ async function executeWorkItem(item, report, signal) {
     // source.
     let credentialLabels;
     let filter;
-    if (item.body?.startsWith("bivy-room-v1:")) {
+    const sealed = Boolean(item.body?.startsWith("bivy-room-v1:"));
+    if (sealed) {
         const [, nodeId, ...payload] = item.body.split(":");
         if (nodeId !== identity.nodeId || payload.length === 0) {
             throw new Error("automation instructions were encrypted for a different node");
         }
         try {
-            const template = decodeAutomationTemplate(open(pairingStore.roomKey(), payload.join(":")));
+            const template = decodeAutomationTemplate(pairingStore.openSealed(payload.join(":")));
             credentialLabels = template.credentialLabels;
             filter = template.filter;
             item = { ...item, body: template.instructions };
@@ -5573,6 +5478,12 @@ async function executeWorkItem(item, report, signal) {
             throw new Error("could not decrypt automation instructions on this node");
         }
     }
+    // Only sealed, fetched, built-in or opted-in Slack instructions reach the agent
+    // (src/work-instructions.ts): the control plane can't author a run.
+    const trusted = trustedInstructions(item, { sealed, slackPrompts: slackPromptsEnabled() });
+    if (!trusted.ok)
+        throw new Error(trusted.reason);
+    item = { ...item, body: trusted.body };
     // Gate before any repository fetch, session continuation, or agent creation.
     // A skip finishes this selected automation; it does not fall through to another.
     if (filter && !await passWebhookFilter(filter, item, report, signal))
@@ -5709,9 +5620,7 @@ async function executeWorkItem(item, report, signal) {
     // into the prompt. A scheduled chat message must arrive verbatim; the name is
     // only the run/session label.
     const delegatedProvenance = parseDelegationSource(item.source);
-    const request = item.source === "schedule" || delegatedProvenance
-        ? (item.body || item.title)
-        : item.body ? `${item.title}\n\n${item.body}` : item.title;
+    const request = runPrompt(item, trusted.titleInPrompt);
     // Plain chat messages (scheduled "message me later" reminders) skip
     // auto-push and required checks — even when a workspace target happens to be
     // a git checkout.
@@ -7619,7 +7528,7 @@ function evaluateEphemeralTeardown() {
     const records = new Set(openSessions.values());
     const anyWorking = [...records].some((r) => r.isWorking);
     const anyRemoteActive = clients.size > 0 || (relay?.clientCount ?? 0) > 0
-        || [...records].some((r) => r.remoteActive);
+        || [...records].some((r) => r.remoteActive) || remotePreview.inUse();
     const inFlightWork = controlPlanePoller?.inFlightCount() ?? 0;
     if (anyWorking || anyRemoteActive || inFlightWork > 0) {
         ephemeralEverBusy = true;
@@ -7973,9 +7882,7 @@ function actionableAgentError(runtimeId, error) {
         if (id.startsWith("codex"))
             return "Codex is not signed in. Run `codex login`, then retry; the same login works from Bivy and the PWA.";
         if (id === "pi" || id === "aider")
-            return isHostedCustodyNode()
-                ? "No model credential is available to this Bivy Cloud Machine. Connect a provider and enable it for Bivy Cloud, then retry."
-                : "No model credential is configured. Run `bivy provider login`, then retry. This is only required once and compatible credentials sync E2E-encrypted to your other Bivy nodes.";
+            return "No model credential is configured. Run `bivy provider login`, then retry. This is only required once and compatible credentials sync E2E-encrypted to your other Bivy nodes.";
         return "The selected agent needs model authentication. Sign in through its native CLI, then retry.";
     }
     return raw;
@@ -8130,14 +8037,17 @@ function attachSessionListeners(record) {
         if (event.type === "turn_start" || event.type === "message_boundary" || event.type === "message_end" || event.type === "turn_end") {
             transcripts.persistTranscriptSnapshot(record);
         }
-        // A finalized assistant message may reference a remote image via markdown
-        // (`![alt](https://…)`) — fetch and store it now so the chat can render it
-        // (see resolveInlineImages). Checked on both events: message_end is the
-        // precise "this assistant message is done" signal most runtimes emit, but
-        // turn_end is a safety net for one that only surfaces the final text there.
-        // Fire-and-forget and internally deduped, so checking on both costs nothing.
+        // A finalized assistant message may reference an image via markdown — a
+        // remote URL (`![alt](https://…)`) to fetch, or a file the agent just
+        // produced in its workspace (`![alt](out/chart.png)`) to read. Resolve and
+        // store either now, so the chat can render it and history keeps it after the
+        // workspace is gone. Checked on both events: message_end is the precise
+        // "this assistant message is done" signal most runtimes emit, but turn_end
+        // is a safety net for one that only surfaces the final text there. Both
+        // resolvers are internally deduped, so checking twice costs nothing.
         if (event.type === "message_end" || event.type === "turn_end") {
             transcripts.resolveInlineImages(record);
+            transcripts.resolveWorkspaceRefs(record, harnessDirFor(record));
         }
         // Durably persist the throttled sidecars at the turn boundary so a crash
         // loses at most the in-flight turn's UI detail, not the whole turn. A
@@ -9069,6 +8979,9 @@ async function sessionForModelQuery(runtimeId) {
     modelQueryScratchPending.set(wanted, build);
     return build;
 }
+/** How long a session's models.list waits for its agent's real catalog before
+ *  answering with what is known (below the client's 15 s launch timeout). */
+const SESSION_MODELS_WARM_MS = 8_000;
 // A fresh scratch answers its first models.list from the runtime's placeholder
 // list (no live agent yet). Warm the real catalog in the background — for Claude
 // Code this spins up the agent subprocess just far enough for supportedModels()
@@ -10447,8 +10360,7 @@ app.post("/api/auth/credentials", async (req, res, next) => {
 app.delete("/api/auth/credentials/:provider/:label", async (req, res, next) => {
     try {
         await removeProviderCredential(credsDir, String(req.params.provider), String(req.params.label));
-        // Deleting a granted credential must also remove its escrowed cloud copy.
-        await pushModelAuthToControlPlane(false, false, true);
+        await pushModelAuthToControlPlane();
         await refreshSessionAfterAuth();
         res.json({ ok: true, records: await listCredentialRecords(credsDir), providers: await listProvidersUnified() });
     }
@@ -10460,30 +10372,10 @@ app.post("/api/auth/credentials/:provider/:label/availability", async (req, res,
     try {
         const sync = req.body?.sync === "node" ? "node" : "account";
         await setCredentialSync(credsDir, String(req.params.provider), String(req.params.label), sync);
-        // Demoting to machine-only revokes any custody grant; let that clear the escrow.
-        await pushModelAuthToControlPlane(false, false, sync === "node");
-        res.json({ ok: true, records: await listCredentialRecords(credsDir) });
-    }
-    catch (error) {
-        next(error);
-    }
-});
-app.post("/api/auth/credentials/:provider/:label/unattended", async (req, res, next) => {
-    const provider = String(req.params.provider);
-    const label = String(req.params.label);
-    const enable = req.body?.unattended === true;
-    const previous = (await listCredentialRecords(credsDir).catch(() => []))
-        .find((record) => record.provider === provider.trim().toLowerCase() && record.label === label)?.unattended === true;
-    try {
-        await setCredentialUnattended(credsDir, provider, label, enable);
-        // Fail loud (mirrors the relay command): the UI must never claim an
-        // encrypted cloud copy exists when custody publication failed. An explicit
-        // disable is the one caller allowed to publish an empty escrow snapshot.
-        await pushModelAuthToControlPlane(false, true, !enable);
+        await pushModelAuthToControlPlane();
         res.json({ ok: true, records: await listCredentialRecords(credsDir) });
     }
     catch (error) {
-        await setCredentialUnattended(credsDir, provider, label, previous).catch(() => { });
         next(error);
     }
 });