@bivy/bivy 0.3.0-staging.44 → 0.3.0-staging.45

package/dist/server.js

@@ -3600,6 +3600,14 @@ async function syncModelAuthFromControlPlane() {
             vaultKeyB64 = pairingStore.unwrapFromNodePublicKey(data.wrappedKey.wrappedByPublicKey, data.wrappedKey.wrappedKey);
             writeLocalModelAuthVaultKey(vaultKeyB64);
         }
+        // Node-less inheritance: a lone HOSTED ephemeral (no peer to wrap the key)
+        // adopts the vault key the control plane escrowed for this hosted account, so
+        // it can decrypt the synced vault (incl. subscription OAuth) on cold start. The
+        // control plane serves `hostedKey` only for hosted-provisioning accounts.
+        if (!vaultKeyB64 && data.hostedKey && Buffer.from(data.hostedKey, "base64").length === 32) {
+            vaultKeyB64 = data.hostedKey;
+            writeLocalModelAuthVaultKey(vaultKeyB64);
+        }
         if (data.vault?.ciphertext && vaultKeyB64) {
             const { providers, localModels } = decryptModelAuthEnvelope(data.vault.ciphertext, vaultKeyB64);
             await importProviderAuth(credsDir, providers);
@@ -3666,6 +3674,13 @@ async function pushModelAuthToControlPlane() {
             method: "PUT",
             body: JSON.stringify({ targetNodeId: identity.nodeId, wrappedByPublicKey: pairingStore.nodePublicKeyB64(), wrappedKey: pairingStore.wrapForNodePublicKey(pairingStore.nodePublicKeyB64(), vaultKeyB64) }),
         });
+        // Node-less inheritance: a HOSTED node also escrows the vault key to the control
+        // plane (sealed at rest, hosted-only) so the account's NEXT hosted ephemeral —
+        // possibly the only node — can decrypt this vault without a peer to wrap the key.
+        // Gated to hosted nodes; the CP double-checks the account is hosted. Best effort.
+        if (process.env.BIVY_GITHUB_HOSTED_TASKS) {
+            await modelAuthFetch("/node/model-auth-key/hosted-escrow", { method: "PUT", body: JSON.stringify({ vaultKeyB64 }) }).catch(() => { });
+        }
         lastPushedModelAuthCiphertext = ciphertext;
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.3.0-staging.44",
+  "version": "0.3.0-staging.45",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",