@bivy/bivy 0.21.2-staging.3 → 0.21.2-staging.5

package/dist/automation-reseal.js

@@ -13,6 +13,8 @@ export async function resealAutomationTemplates(opts) {
         const plaintext = opts.retired.map((key) => tryOpen(key, payload)).find((text) => text !== undefined);
         if (plaintext === undefined) {
             result.unreadable.push(template.id);
+            if (!template.instructionsUnreadable)
+                await opts.markUnreadable(template.id);
             continue;
         }
         await opts.save(template.id, `${prefix}${seal(opts.current, plaintext)}`);

package/dist/server.js

@@ -1078,7 +1078,7 @@ const linkedDevices = createLinkedDeviceController({
         syncPairingMetadata();
         relay?.pushRotate(deliveries);
         broadcast({ type: "devices.updated", devices });
-        void resealRetiredAutomationTemplates();
+        void checkAutomationTemplates();
     },
 });
 const accessDevices = createAccessDeviceController({
@@ -3545,7 +3545,7 @@ function startRelayIfConfigured() {
     if (config.controlPlaneUrl && config.enrollmentToken) {
         sessionAdvertiseTarget = { controlPlaneUrl: config.controlPlaneUrl, enrollmentToken: config.enrollmentToken };
         void syncModelAuthFromControlPlane();
-        void resealRetiredAutomationTemplates();
+        void checkAutomationTemplates();
         if (remoteRuntimeEnabled()) {
             // Stage 3: layer a control-plane-backed location registry UNDER the in-memory
             // one (so a lookup surviving a restart resolves from durable state), then
@@ -3675,27 +3675,36 @@ async function modelAuthFetch(pathname, init = {}) {
 }
 // A device revoke rotates the room key. Re-seal this node's stored automation
 // instructions under the new key so the node and its devices can still read
-// them, then drop the retired keys. Retried at startup until it completes.
-async function resealRetiredAutomationTemplates() {
-    const retired = pairingStore.retiredRoomKeys();
-    if (!retired.length || !sessionAdvertiseTarget)
+// them, then drop the retired keys. Instructions no key opens are flagged so the
+// automation list asks for them again. Runs at every start (retried there until
+// it completes), after a revoke, and when a run can't open its instructions.
+let automationTemplateCheck = null;
+function checkAutomationTemplates() {
+    automationTemplateCheck ??= reconcileAutomationTemplates().finally(() => { automationTemplateCheck = null; });
+    return automationTemplateCheck;
+}
+async function reconcileAutomationTemplates() {
+    if (!sessionAdvertiseTarget)
         return;
+    const retired = pairingStore.retiredRoomKeys();
     const current = pairingStore.roomKey();
     try {
         const res = await modelAuthFetch("/node/automation-templates");
         if (!res?.ok)
             throw new Error(`control plane returned ${res?.status}`);
         const { templates } = await res.json();
+        const call = async (pathname, init) => {
+            const out = await modelAuthFetch(pathname, init);
+            if (!out?.ok)
+                throw new Error(`control plane returned ${out?.status}`);
+        };
         const result = await resealAutomationTemplates({
             nodeId: identity.nodeId,
             current,
             retired,
             templates,
-            save: async (id, templateCiphertext) => {
-                const saved = await modelAuthFetch(`/node/automation-templates/${encodeURIComponent(id)}`, { method: "PUT", body: JSON.stringify({ templateCiphertext }) });
-                if (!saved?.ok)
-                    throw new Error(`control plane returned ${saved?.status}`);
-            },
+            save: (id, templateCiphertext) => call(`/node/automation-templates/${encodeURIComponent(id)}`, { method: "PUT", body: JSON.stringify({ templateCiphertext }) }),
+            markUnreadable: (id) => call(`/node/automation-templates/${encodeURIComponent(id)}/unreadable`, { method: "POST" }),
         });
         if (result.resealed)
             console.log(`[automation-reseal] re-sealed ${result.resealed} automation template(s) under the rotated room key`);
@@ -3703,8 +3712,9 @@ async function resealRetiredAutomationTemplates() {
             console.warn(`[automation-reseal] ${result.unreadable.length} automation template(s) were sealed under a key this node no longer has: ${result.unreadable.join(", ")}`);
         // Another rotation during this pass retired `current`; run again for it.
         if (!pairingStore.roomKey().equals(current))
-            return void resealRetiredAutomationTemplates();
-        pairingStore.forgetRetiredRoomKeys();
+            return reconcileAutomationTemplates();
+        if (retired.length)
+            pairingStore.forgetRetiredRoomKeys();
     }
     catch (error) {
         console.warn("[automation-reseal] will retry at next start:", error.message);
@@ -5474,6 +5484,7 @@ async function executeWorkItem(item, report, signal) {
             item = { ...item, body: template.instructions };
         }
         catch {
+            void checkAutomationTemplates();
             throw new Error("could not decrypt automation instructions on this node");
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.21.2-staging.3",
+  "version": "0.21.2-staging.5",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",