@bivy/bivy 0.6.0 → 0.7.0

package/dist/server.js

@@ -45,20 +45,22 @@ import { RelayConnector, loadRelayConfig } from "./relay-client.js";
 import { readEphemeralTeardownConfig, shouldSelfTeardown, performSelfTeardown } from "./ephemeral-teardown.js";
 import { buildSessionSnapshot, applySessionSnapshot } from "./session/snapshot.js";
 import { createCheckpointBundle, applyCheckpointBundle, materializeCheckpoint } from "./session/checkpoint-pack.js";
+import { configuredTurnTimeoutMs } from "./session/turn-watchdog.js";
+import { runRequiredAutomationChecks } from "./automation-checks.js";
 import { PolicyEngine } from "./policy/policy-engine.js";
 import { TerminalManager } from "./terminal.js";
 import { commandLaunch } from "./command-launch.js";
 import { listMultiplexerSessions, attachCommand } from "./multiplexer.js";
 import { createWorktree, removeWorktree, branchSlug, gitRepoRoot } from "./worktree.js";
 import { HarnessManager } from "./harness/manager.js";
-import { startEgressProxyIfEnabled } from "./harness/egress.js";
+import { startEgressProxyIfEnabled, applySessionSandboxEgress, stopSessionEgress } from "./harness/egress.js";
 import { initSharedDepCache, sharedDepCacheRoot } from "./harness/dep-cache.js";
 import { evictToCap, dirSizeBytes } from "./harness/cache-evict.js";
 import { checkDiskAdmission } from "./harness/disk-admission.js";
 import { sandboxTier, setConfiguredSandboxTier, normalizeSandboxTier } from "./harness/sandbox.js";
 import { setConfiguredAutoAttachToolImages } from "./harness/tool-image-attachments.js";
 import { injectMcpProxyForSession, injectBivyToolsForSession } from "./harness/mcp-inject.js";
-import { parseRepo, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, fetchOrigin } from "./repo-workspace.js";
+import { parseRepo, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, resolveAdoptBaseRef, fetchOrigin } from "./repo-workspace.js";
 import { configureGitAuth, writeGitCredentialEndpoint } from "./git-auth.js";
 import { GitHubTaskPoller, resolveGitHubTaskConfig, buildTaskPrompt, buildResumePrompt, buildInteractiveResumePrompt, DEFAULT_ISSUE_INSTRUCTIONS, parseBivyDirectives, commitAll, pushBranch, mergeBaseIntoBranch, completeMerge, abortMerge, findOpenPullRequestForBranch, findPullRequestsForBranch, findMergedPullRequestForBranch, issueBranchName, getPullRequest, commentIssue, listOpenLabelledIssues, selectActionableIssues, getIssue, getIssueCommentBody, addLabel, removeLabel, announcePickup, } from "./github-tasks.js";
 import { buildLinearTaskPrompt, getLinearIssue, linearBranchName } from "./linear-tasks.js";
@@ -73,6 +75,8 @@ import { thinkingTextFromContent } from "./session/transcript-merge.js";
 import { normalizeMessages } from "./session/transcript-normal.js";
 import { buildNativeImportSeedPrompt } from "./session/native-import.js";
 import { EventLog } from "./session/event-log.js";
+import { revertFile } from "./session/revert-file.js";
+import { buildDiagnosticsReport, activationRecord } from "./diagnostics.js";
 import { AttachmentStore, isValidAttachmentHash } from "./session/attachment-store.js";
 import { planAttachment, isAttachPlanError, MAX_AGENT_ATTACHMENT_BYTES } from "./session/attach-to-chat.js";
 import { extractInlineImageUrls, assistantTextForImageScan, fetchInlineImage, isFetchImageError, inlineImageDisplayName, } from "./session/inline-image-fetch.js";
@@ -531,7 +535,9 @@ if (sessionRunPolicy) {
     console.log(`[policy] in-session model reroute enabled: ${process.env.BIVY_SESSION_MODEL_FALLBACK}`);
 }
 let lastUpdateCheckAt = 0;
-let updateNoticeSentFor = "";
+// The most recent "this node is behind" finding, so a client that connects after
+// the check already ran still gets the banner (replayed on connect below).
+let pendingBivyUpdate = null;
 function runtimeSummary(rt) {
     return runtimeHost.summary(rt);
 }
@@ -621,11 +627,11 @@ function readJsonFile(file) {
         return undefined;
     }
 }
-async function maybeNotifyBivyUpdate(record) {
-    // The daemon creates an initial session during startup before any UI is
-    // connected. Don't consume the once-per-version notice until someone can see it.
-    if (clients.size === 0 && !relay)
-        return;
+// Poll npm for a newer release (throttled to every 6h). On finding one, remember
+// it and push a dedicated `node.update` event so every connected app can show a
+// banner with a one-tap "Update this node" button (see runBivyUpdate). Safe to
+// call from anywhere — never throws, never interrupts a session.
+async function checkBivyUpdate() {
     const now = Date.now();
     if (now - lastUpdateCheckAt < 6 * 60 * 60 * 1000)
         return;
@@ -637,25 +643,48 @@ async function maybeNotifyBivyUpdate(record) {
         const res = await fetch(updateRegistryUrl, { signal: AbortSignal.timeout(5000) });
         if (!res.ok)
             return;
-        const latestVersion = (await res.json()).version;
-        if (!latestVersion || !isNewerVersion(latestVersion, current))
-            return;
-        if (updateNoticeSentFor === latestVersion)
+        const latest = (await res.json()).version;
+        if (!latest || !isNewerVersion(latest, current))
             return;
-        updateNoticeSentFor = latestVersion;
-        const label = ` ${latestVersion}`;
-        broadcast({
-            type: "session.notice",
-            sessionId: record.id,
-            level: "info",
-            message: `A newer Bivy version${label} is available. Run \`bivy update\` in your terminal to update.`,
-            action: "bivy update",
-        });
+        pendingBivyUpdate = { current, latest };
+        broadcast({ type: "node.update", current, latest });
     }
     catch {
         // Best-effort update checks should never interrupt a session.
     }
 }
+async function maybeNotifyBivyUpdate() {
+    // The daemon creates an initial session during startup before any UI is
+    // connected. Don't spend a check until someone can see the banner.
+    if (clients.size === 0 && !relay)
+        return;
+    await checkBivyUpdate();
+}
+// Run `bivy update` on this node, the same command a user would type. The CLI
+// re-spawns itself detached, waits for any in-flight turn, updates, and restarts
+// the service (logging to update.log), so we just fire-and-forget it here. The
+// bin ships next to this server bundle in both the git checkout (src/server.ts)
+// and the published package (dist/server.js), so repoRoot/bin/bivy.mjs resolves
+// in both. Returns a friendly error instead of throwing when it can't be found
+// (e.g. an unusual layout), so the banner can fall back to the manual command.
+function runBivyUpdate() {
+    const script = path.join(repoRoot, "bin", "bivy.mjs");
+    if (!fs.existsSync(script)) {
+        return { ok: false, error: "Could not locate the bivy CLI on this node — run `bivy update` in a terminal." };
+    }
+    try {
+        const child = spawn(process.execPath, [script, "update"], {
+            detached: true,
+            stdio: "ignore",
+            env: process.env,
+        });
+        child.unref();
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
 function runtimeInstallSpec(requested) {
     let id = String(requested ?? "").trim().toLowerCase();
     // Normalize a few historical aliases to their canonical runtime id.
@@ -921,6 +950,8 @@ function safeAttachmentName(value) {
  *                    with its normal file tools. Any file type is supported;
  *                    binary files arrive as base64 `data`.
  */
+const MAX_PROMPT_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+const MAX_PROMPT_ATTACHMENTS_BYTES = 40 * 1024 * 1024;
 function attachmentsFrom(value) {
     if (!Array.isArray(value))
         return { images: [], imageNotes: [], imageRefs: [], files: [] };
@@ -928,13 +959,24 @@ function attachmentsFrom(value) {
     const imageNotes = [];
     const imageRefs = [];
     const files = [];
-    for (const raw of value.slice(0, 12)) {
+    let totalBytes = 0;
+    if (value.length > 12)
+        throw new Error("A message can include at most 12 attachments");
+    for (const raw of value) {
         if (!raw || typeof raw !== "object")
             continue;
         const attachment = raw;
         const name = safeAttachmentName(attachment.name);
         const size = Number(attachment.size || 0);
         const mimeType = typeof attachment.mimeType === "string" && attachment.mimeType ? attachment.mimeType : undefined;
+        const encodedBytes = typeof attachment.data === "string" ? Math.floor(attachment.data.length * 3 / 4) : 0;
+        const textBytes = attachment.kind === "file" && typeof attachment.text === "string" ? Buffer.byteLength(attachment.text) : 0;
+        const actualBytes = encodedBytes || textBytes;
+        if (actualBytes > MAX_PROMPT_ATTACHMENT_BYTES)
+            throw new Error(`${name} exceeds the 10 MiB attachment limit`);
+        totalBytes += actualBytes;
+        if (totalBytes > MAX_PROMPT_ATTACHMENTS_BYTES)
+            throw new Error("Attachments exceed the 40 MiB per-message limit");
         if (attachment.kind === "image" && typeof attachment.data === "string") {
             const imgMime = mimeType ?? "image/png";
             images.push({ type: "image", data: attachment.data, mimeType: imgMime });
@@ -2179,14 +2221,58 @@ function eventLogPath(sessionId) {
 // whole history: overlay detail (reasoning + tool activity) AND the base transcript,
 // the latter as bounded delta/reset records. Written on every event; read via
 // eventLog.deriveHistory. `redactSecrets` scrubs credentials at the single flush
-// choke point before anything lands on the synced-to-PWA disk.
-const eventLog = new EventLog(eventLogDir, eventLogPath, redactSecrets);
+// choke point before anything lands on the synced-to-PWA disk. I/O/corruption
+// failures are never silently converted into empty history: keep a diagnostic,
+// log loudly, and notify the owning live session while pending appends remain
+// queued for retry.
+const eventLogIssues = new Map();
+const eventLog = new EventLog(eventLogDir, eventLogPath, redactSecrets, 500, (issue) => {
+    eventLogIssues.set(issue.sessionId, { operation: issue.operation, message: issue.message, at: issue.at });
+    console.error(`[event-log] ${issue.operation} failed for ${issue.sessionId}: ${issue.message}`);
+    const record = openSessions.get(issue.sessionId);
+    if (!record)
+        return;
+    const warning = `Session history storage problem (${issue.operation}): ${issue.message}`;
+    if (record.warning === warning)
+        return;
+    record.warning = warning;
+    broadcast({ type: "session.notice", sessionId: record.id, level: "error", message: warning });
+});
 // Global content-addressed store for message attachments (images + files). Unlike
 // the per-session `.bivy-attachments/` worktree copy (kept so the agent can open
 // files with its tools), this is durable, session-independent, and re-findable:
 // the transcript references blobs by hash, and clients rehydrate thumbnails by
 // hash after a reload or on another device. See src/session/attachment-store.ts.
-const attachmentStore = new AttachmentStore(path.join(appDir, "attachments"));
+const positiveEnvNumber = (name, fallback) => {
+    const value = Number(process.env[name]);
+    return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+};
+const attachmentStore = new AttachmentStore(path.join(appDir, "attachments"), {
+    maxFileBytes: positiveEnvNumber("BIVY_ATTACHMENT_MAX_FILE_BYTES", 25 * 1024 * 1024),
+    maxStoreBytes: positiveEnvNumber("BIVY_ATTACHMENT_STORE_MAX_BYTES", 2 * 1024 * 1024 * 1024),
+    retentionMs: positiveEnvNumber("BIVY_ATTACHMENT_RETENTION_MS", 30 * 24 * 60 * 60 * 1000),
+});
+let attachmentGcStats = attachmentStore.stats();
+function referencedAttachmentHashes() {
+    // If transcript history is unreadable, collecting nothing would make its
+    // still-referenced blobs look orphaned. Fail closed and skip destructive GC.
+    if (!eventLog.health().ok)
+        return null;
+    const hashes = new Set();
+    const ids = new Set(metadata.listSessions().map((session) => session.id));
+    for (const record of new Set(openSessions.values()))
+        ids.add(record.id);
+    for (const id of ids) {
+        for (const entry of eventLog.entries(id)) {
+            if (entry.bivyKind === "attachment")
+                for (const ref of entry.refs)
+                    hashes.add(ref.hash);
+            else if (entry.bivyKind === "outbound-attachment" || entry.bivyKind === "inline-image")
+                hashes.add(entry.ref.hash);
+        }
+    }
+    return eventLog.health().ok ? hashes : null;
+}
 // --- Warm session replication (docs/session-replication.md) -----------------
 // A standby's replica repo lives under appDir/replicas/<id>: a self-contained git
 // repo that receives checkpoint bundles and is checked out on promotion. Created
@@ -2536,6 +2622,14 @@ const RELAY_COMMANDS = {
     ping(msg, ctx) {
         ctx.reply({ type: "pong", requestId: typeof msg.requestId === "string" ? msg.requestId : undefined });
     },
+    // Kick off `bivy update` on this node from the app's version-mismatch banner
+    // (see runBivyUpdate). The node restarts itself when the update lands, so the
+    // client just sees the socket reconnect on the new build; a failure to even
+    // start reports back so the banner can show the manual command.
+    "node.update"(_msg, ctx) {
+        const result = runBivyUpdate();
+        ctx.reply({ type: "node.update.result", ok: result.ok, error: result.error });
+    },
     // Fetch a stored attachment's bytes by content hash. The relay client (a phone
     // not on the LAN) can't reach the GET /api/attachment endpoint, so it fetches
     // over the encrypted tunnel instead; the relay framing chunks the base64 payload
@@ -2601,6 +2695,30 @@ const RELAY_COMMANDS = {
             ctx.reply({ type: "session.error", sessionId: record.id, error: error instanceof Error ? error.message : String(error) });
         }
     },
+    async "session.revert_file"(msg, ctx) {
+        // C3d — revert ONE changed file to its pre-turn content without rewinding the
+        // whole turn. `content` is the file's pre-turn text (or null when the turn
+        // added it). Path-confined to the session's worktree by revertFile.
+        const record = resolveSession(msg.sessionId);
+        const relPath = String(msg.path ?? "").trim();
+        if (!record || !relPath)
+            return;
+        if (sessionBusy(record)) {
+            ctx.reply({ type: "session.error", sessionId: record.id, error: "Stop the current turn before reverting a file." });
+            return;
+        }
+        const content = typeof msg.content === "string" ? msg.content : null;
+        const result = revertFile(harnessDirFor(record), relPath, content);
+        if (!result.ok) {
+            ctx.reply({ type: "session.error", sessionId: record.id, error: `Could not revert ${relPath}: ${result.error ?? "unknown error"}` });
+            return;
+        }
+        // Recompute the turn's diff against the (unchanged) baseline so the review
+        // surface drops the reverted file immediately.
+        const event = { type: "session.file_reverted", sessionId: record.id, path: relPath, status: result.status };
+        ctx.reply(event);
+        ctx.broadcast(event);
+    },
     async "session.pr.refresh"(msg, ctx) {
         // Force a refresh regardless of live/attached state — resume the session if
         // the node dropped it from memory, so a finished/detached session can still
@@ -2966,6 +3084,7 @@ const RELAY_COMMANDS = {
     },
     async "models.list"(msg) {
         const requestedSessionId = typeof msg.sessionId === "string" && msg.sessionId ? msg.sessionId : undefined;
+        const wantedRuntimeId = typeof msg.runtimeId === "string" && msg.runtimeId ? msg.runtimeId : undefined;
         let record;
         try {
             record = requestedSessionId ? await resolveOrResumeSession(requestedSessionId, msg.path) : active;
@@ -2978,7 +3097,12 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "session.error", sessionId: requestedSessionId, error: "Session not found" });
             return;
         }
-        record ??= await sessionForModelQuery();
+        // On a draft (no session id), a runtime hint from the composer takes
+        // precedence so an agent switch previews *that* agent's models even if a
+        // stale `active` on another runtime lingers on the node.
+        if (!requestedSessionId && wantedRuntimeId && record?.runtimeId !== wantedRuntimeId)
+            record = null;
+        record ??= await sessionForModelQuery(wantedRuntimeId);
         const session = record.session;
         const current = session.getCurrentModel();
         const models = await publicModelsList(session, current);
@@ -2990,6 +3114,17 @@ const RELAY_COMMANDS = {
         // (e.g. Claude) — the "Claude shows Codex models" bug.
         relay?.sendEvent({ type: "models.list", sessionId: record.id, runtimeId: record.runtimeId, current: current ? publicModel(current, current) : null, models, thinking });
     },
+    "models.prefetch"(msg) {
+        // The composer's agent picker opened: warm the scratch session for each
+        // offered agent in the background so the first switch to any of them answers
+        // instantly. Fire-and-forget — no reply; the follow-up models.list carries
+        // the result. Ignore anything but a bounded string[] of runtime ids.
+        const ids = Array.isArray(msg.runtimeIds)
+            ? msg.runtimeIds.filter((id) => typeof id === "string" && !!id).slice(0, 16)
+            : [];
+        if (ids.length)
+            prefetchModels(ids);
+    },
     async "model.select"(msg) {
         const requestedSessionId = typeof msg.sessionId === "string" && msg.sessionId ? msg.sessionId : undefined;
         let record;
@@ -3407,7 +3542,7 @@ const RELAY_COMMANDS = {
             record.lastPrompt = agentPrompt;
             record.lastPromptOptions = promptOptionsFor(record, msg.streamingBehavior, images);
             record.reroute?.beginTurn();
-            await record.session.prompt(agentPrompt, record.lastPromptOptions);
+            await promptWithWatchdog(record, agentPrompt, record.lastPromptOptions);
         }).catch((error) => {
             // Mirror the HTTP path (see the /prompt route): a rejected turn after
             // the runtime marked the session working emits no agent_end, so without
@@ -3442,6 +3577,7 @@ const RELAY_COMMANDS = {
                 source: rec.source,
                 title: rec.session.getName(),
                 model: rec.session.getCurrentModel()?.name,
+                sandbox: rec.sandbox,
             };
             let dirtyPatch;
             if (rec.worktree) {
@@ -3450,6 +3586,14 @@ const RELAY_COMMANDS = {
                 }
                 catch { /* best effort — omit dirty state */ }
             }
+            // Publish the source branch so a cross-node fork's COMMITTED work travels
+            // via origin (the destination adopts `origin/<branch>`; see
+            // resolveAdoptBaseRef). Uncommitted work rides the dirtyPatch above. Only
+            // for a genuine cross-node fork — a same-node cross-agent fork adopts the
+            // LOCAL branch and needs no push. Best-effort: a no-token/offline node just
+            // falls back to the default base downstream.
+            if (msg.crossNode === true)
+                await pushForkSourceBranch(rec);
             // Refresh the account model-auth vault so the destination node can pull
             // this session's model credentials during import (fork credential-move,
             // docs/session-fork-plan.md). Best-effort: local-only nodes just skip it.
@@ -3530,6 +3674,7 @@ const RELAY_COMMANDS = {
                 source: rec.source,
                 title: rec.session.getName(),
                 model: rec.session.getCurrentModel()?.name,
+                sandbox: rec.sandbox,
             };
             // Carry uncommitted work: capture from the SOURCE worktree; standUpFork
             // re-applies it into the fork's fresh worktree. Local git ops only.
@@ -4481,16 +4626,26 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
         // evidence trail — the branch/PR references and a bounded summary only,
         // never file lists or error details (those stay in `message`/`extra`,
         // which are broadcast to the live session but never sent to onEvidence).
-        const kind = stage === "pr_opened" ? "pull_request" : stage === "started" ? "branch" : stage === "failed" ? "completed" : undefined;
+        const kind = stage === "pr_opened" ? "pull_request"
+            : stage === "started" || stage === "pushed" ? "branch"
+                : stage === "failed" || stage === "checks_failed" || stage === "no_changes" ? "completed"
+                    : undefined;
         if (kind) {
+            const summary = stage === "pr_opened" ? "Pull request opened."
+                : stage === "started" ? "Working branch and session created."
+                    : stage === "pushed" ? "Changes pushed; no pull request is open."
+                        : stage === "no_changes" ? "Run completed with no file changes."
+                            : stage === "checks_failed" ? "Deterministic validation checks failed."
+                                : "Execution failed. Detailed diagnostics remain on the node.";
             void overrides.onEvidence?.({
                 output: { sessionId: record.id, branch, prUrl: typeof extra.prUrl === "string" ? extra.prUrl : undefined },
                 events: [{
                         at: new Date().toISOString(),
                         kind,
-                        summary: stage === "pr_opened" ? "Pull request opened." : stage === "started" ? "Working branch and session created." : "Execution failed. Detailed diagnostics remain on the node.",
+                        summary,
                         ref: branch,
                         url: typeof extra.prUrl === "string" ? extra.prUrl : undefined,
+                        ...(stage === "checks_failed" || stage === "failed" ? { status: "failed" } : {}),
                     }],
             });
         }
@@ -4503,7 +4658,7 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
     // which now adopts the existing remote branch rather than colliding.
     const existing = findIssueSession(source);
     if (existing?.worktree && fs.existsSync(existing.worktree.path)) {
-        return runIssueFollowUp(cfg, issue, existing, emit);
+        return runIssueFollowUp(cfg, issue, existing, emit, overrides);
     }
     // Idempotency guard against the duplicate-PR regression: if this issue's
     // deterministic branch already produced a *merged* pull request, the change has
@@ -4585,8 +4740,8 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
     try {
         emit(record, "started", `Started work on ${cfg.owner}/${cfg.repo}#${issue.number}.`);
         await runSessionTurn(record, buildTaskPrompt(issue, nodeGithubIssuePrompt()));
-        emit(record, "agent_done", `Agent finished issue #${issue.number}; checking for changes.`);
-        await reportIssueOutcome(cfg, issue, record, emit, { followUp: false });
+        emit(record, "agent_done", `Agent finished issue #${issue.number}; running deterministic checks.`);
+        await reportIssueOutcome(cfg, issue, record, emit, { followUp: false, onEvidence: overrides.onEvidence });
     }
     catch (error) {
         emit(record, "failed", `GitHub issue #${issue.number} failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -4599,7 +4754,7 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
  * the new comment as another turn in the same worktree, then report the outcome
  * the same way a fresh pickup does.
  */
-async function runIssueFollowUp(cfg, issue, record, emit) {
+async function runIssueFollowUp(cfg, issue, record, emit, overrides = {}) {
     const wt = record.worktree;
     if (!wt)
         throw new Error("issue session has no worktree");
@@ -4628,8 +4783,8 @@ async function runIssueFollowUp(cfg, issue, record, emit) {
             }
         }
         await runSessionTurn(record, buildFollowUpPrompt(issue));
-        emit(record, "agent_done", `Agent handled the follow-up on issue #${issue.number}; checking for changes.`);
-        await reportIssueOutcome(cfg, issue, record, emit, { followUp: true });
+        emit(record, "agent_done", `Agent handled the follow-up on issue #${issue.number}; running deterministic checks.`);
+        await reportIssueOutcome(cfg, issue, record, emit, { followUp: true, onEvidence: overrides.onEvidence });
     }
     catch (error) {
         emit(record, "failed", `GitHub issue #${issue.number} follow-up failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -4655,6 +4810,26 @@ async function reportIssueOutcome(cfg, issue, record, emit, opts) {
     const wt = record.worktree;
     if (!wt)
         throw new Error("issue session has no worktree");
+    // Customer success is not `agent_end`. Run the repository's declared standard
+    // checks under local time/output bounds and report only privacy-safe metadata
+    // (name/hash/status/exit), never command text or output, to the control plane.
+    const checks = runRequiredAutomationChecks(wt.path);
+    if (checks.length > 0) {
+        const failed = checks.filter((check) => check.status === "failed");
+        await opts.onEvidence?.({
+            checks,
+            events: [{
+                    at: new Date().toISOString(),
+                    kind: "completed",
+                    summary: failed.length ? `${failed.length} deterministic check(s) failed.` : `${checks.length} deterministic check(s) passed.`,
+                    status: failed.length ? "failed" : "passed",
+                }],
+        });
+        if (failed.length) {
+            emit(record, "checks_failed", `${failed.map((check) => check.name).join(", ")} failed; the run needs review.`);
+            throw new Error(`Required checks failed: ${failed.map((check) => check.name).join(", ")}`);
+        }
+    }
     const commitMessage = opts.followUp ? `Follow-up on #${issue.number}` : `${issue.title} (#${issue.number})`;
     await commitAll(wt.path, commitMessage);
     await fetchOrigin(wt.path);
@@ -4740,7 +4915,7 @@ async function runSessionTurn(record, prompt) {
             }
         });
     });
-    await record.session.prompt(prompt);
+    await promptWithWatchdog(record, prompt);
     await finished;
 }
 /** Set + persist + broadcast a session's display name (used by issue pickup). */
@@ -5050,6 +5225,47 @@ async function resolveTokenForRepo(owner, repo) {
     }
     return (await resolveGitHubToken()) ?? (await hostedMintToken());
 }
+/** The session source a Linear-issue pickup advertises, keyed by the issue's
+ *  provider-native id so the control plane can correlate a re-dispatch to it
+ *  (findSessionByExternalId → "linear:<externalId>"). The Linear analogue of the
+ *  GitHub `issue:owner/repo#N` source. */
+function linearSessionSource(externalId) {
+    return `linear:${externalId}`;
+}
+/**
+ * Case B for a queued follow-up the control plane correlated to an existing
+ * session (`targetKind === "existing_session"`): if that session is still live on
+ * this node, continue it as a normal chat — run `prompt` as a follow-up turn and
+ * re-publish its branch/PR — so a channel reply lands in the same thread. The
+ * provider-agnostic analogue of the GitHub issue follow-up (`runIssueFollowUp`);
+ * used by both the Linear and the generic (Slack) pickup paths. When the session
+ * isn't live here (its machine was torn down), best-effort restore its snapshot so
+ * the caller's fresh pickup continues its branch/transcript instead of cold-
+ * starting, and return false so the caller falls through. Returns true only when
+ * it fully handled the item.
+ */
+async function continueCorrelatedSession(item, prompt, report) {
+    if (item.targetKind !== "existing_session" || !item.targetSessionId)
+        return false;
+    const record = openSessions.get(item.targetSessionId);
+    if (!record) {
+        await restoreSessionFromSnapshot(item.targetSessionId).catch((e) => console.warn(`[case-b] snapshot restore for ${item.targetSessionId} failed:`, e.message));
+        return false;
+    }
+    const branch = record.worktree?.branch;
+    await runSessionTurn(record, prompt);
+    if (record.worktree) {
+        await maybePushWorktreeBranch(record);
+        await maybeDetectPullRequest(record);
+    }
+    await report({
+        output: { sessionId: record.id, branch, prUrl: record.prUrl },
+        events: record.prUrl
+            ? [{ at: new Date().toISOString(), kind: "pull_request", summary: "Pull request updated.", ref: branch, url: record.prUrl }]
+            : undefined,
+    });
+    return true;
+}
 async function runWorkItem(item, report) {
     if ((item.source === "schedule" || item.source === "manual") && item.body?.startsWith("bivy-room-v1:")) {
         const [, nodeId, ...payload] = item.body.split(":");
@@ -5128,6 +5344,10 @@ async function runWorkItem(item, report) {
         const parsed = parseRepo(repoSlug);
         if (!parsed)
             throw new Error(`Linear work item has an invalid repo "${repoSlug}"`);
+        // Case B: a re-dispatch the control plane correlated to an existing session
+        // continues it as a normal chat instead of starting cold (mirrors GitHub).
+        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue), report))
+            return;
         const githubToken = await resolveGitHubToken();
         if (!githubToken)
             throw new Error("no GitHub token available to clone the Linear issue repository");
@@ -5138,7 +5358,7 @@ async function runWorkItem(item, report) {
         const record = await createSession(repoDir, undefined, {
             worktree: { branch, base },
             makeActive: false,
-            source: "queue:linear:issue",
+            source: linearSessionSource(item.externalId),
             runtimeId: item.runtimeId || nodeConfiguredDefaultAgent(),
             sandbox: normalizeSandboxTier(item.sandbox),
             approvalMode: approvalModeFrom(item.approvalMode),
@@ -5164,6 +5384,13 @@ async function runWorkItem(item, report) {
     const parsedRepo = item.repo ? parseRepo(item.repo) : undefined;
     if (item.repo && !parsedRepo)
         throw new Error(`work item ${item.id} has an invalid repo "${item.repo}"`);
+    const request = item.body ? `${item.title}\n\n${item.body}` : item.title;
+    // Case B (provider-agnostic): a follow-up the control plane correlated to an
+    // existing session continues it as a normal chat. Reached by Slack the moment a
+    // reply carries a thread identity the control plane can correlate; a one-shot
+    // slash command has none, so it simply falls through to a fresh session.
+    if (await continueCorrelatedSession(item, request, report))
+        return;
     const sessionOpts = {
         makeActive: false,
         title: item.title,
@@ -5184,7 +5411,6 @@ async function runWorkItem(item, report) {
         }
         catch { }
     }
-    const request = item.body ? `${item.title}\n\n${item.body}` : item.title;
     const prompt = parsedRepo || record.worktree
         ? [
             request,
@@ -5711,6 +5937,48 @@ async function applyRequestedModel(record, model) {
         broadcast({ type: "session.error", sessionId: record.id, error: error instanceof Error ? error.message : "Selected model is not available on this node." });
     }
 }
+// Serialize clone + worktree work per repo directory. Two forks (or a fork and
+// a GitHub pickup) hitting the same shared clone concurrently race on
+// `git worktree add`/`remove` and the `.bivy/worktrees` dir — the loser used to
+// see "already exists"/"already checked out" or, worse, `createWorktree`'s
+// adopt-path `rmSync` clearing a sibling's tree. A lightweight per-key async
+// mutex removes the race without a filesystem lock.
+const repoWorktreeLocks = new Map();
+async function withRepoLock(key, fn) {
+    const prev = repoWorktreeLocks.get(key) ?? Promise.resolve();
+    // Chain the map's tail on the PREVIOUS holder settling (never rejecting), so a
+    // failing fork doesn't poison the next waiter's gate. Each caller still awaits
+    // its own `run` and gets its own result/exception. Bounded by repo count.
+    const gate = prev.then(() => { }, () => { });
+    const run = gate.then(fn);
+    repoWorktreeLocks.set(key, run.then(() => { }, () => { }));
+    return run;
+}
+/**
+ * Best-effort push of a fork SOURCE's branch to origin before the bundle leaves
+ * the node, so a cross-node fork's committed work travels via origin (the
+ * destination bases its adopted worktree on `origin/<branch>` — see
+ * `resolveAdoptBaseRef`). Guarded by a token + repo backing; a failure just
+ * means the destination falls back to the default base and the dirty patch.
+ */
+async function pushForkSourceBranch(rec) {
+    const parts = repoSessionParts(rec);
+    if (!parts)
+        return;
+    const { wt, parsed } = parts;
+    try {
+        const token = await resolveTokenForRepo(parsed.owner, parsed.repo);
+        if (!token)
+            return;
+        const cfg = { token, owner: parsed.owner, repo: parsed.repo, repoDir: wt.repoRoot, label: "bivy", claimLabel: "bivy:in-progress", pollMs: 60_000 };
+        await pushBranch(cfg, wt.path, wt.branch);
+        rec.branchPushed = true;
+    }
+    catch {
+        // offline / no rights / protected branch — committed work may not reach a
+        // cross-node destination, but the fork still proceeds from the best base.
+    }
+}
 /**
  * Stand a forked session up on THIS node from a `ForkBundle`: credential-move,
  * (optional) prerequisite detection, repo/worktree reconstruction, transcript
@@ -5721,8 +5989,10 @@ async function applyRequestedModel(record, model) {
  */
 async function standUpFork(opts) {
     const { bundle, targetRuntimeId } = opts;
-    const targetRuntime = getRuntime(targetRuntimeId);
     const fallback = opts.fallback ?? { workspace: defaultWorkspace, cwd: defaultWorkspace };
+    // Carry the source's sandbox tier so a sandboxed session forks into a
+    // sandboxed one, rather than defaulting to this node's tier (fork.ts).
+    const forkSandbox = normalizeSandboxTier(bundle.record.sandbox);
     // Credential-move: if the chosen model's provider isn't logged in on this node,
     // pull the account model-auth vault (a login done on another node carries over),
     // then re-check. Best-effort — a local-only node just skips it.
@@ -5734,41 +6004,64 @@ async function standUpFork(opts) {
         modelConfigured = await providerConfigured();
     }
     // Prerequisite detection. A missing AGENT is a hard blocker — stop before any
-    // clone/worktree work. Skipped for a same-node local fork.
+    // clone/worktree work. Skipped for a same-node local fork. Read the agent's
+    // availability + display name from the runtime REGISTRY (which never throws)
+    // rather than resolving the runtime up front: `getRuntime` throws for a
+    // known-but-not-installed agent, which — called eagerly — surfaced a raw
+    // "not available" string with an empty `missing[]` instead of this friendly
+    // install checklist. An unknown id (no registry entry) is treated as
+    // unavailable so it, too, degrades to the checklist rather than a getRuntime throw.
     const agentInfo = listRuntimes().find((r) => r.id === targetRuntimeId);
-    const agentAvailable = agentInfo ? agentInfo.status === "available" : true;
+    const agentAvailable = agentInfo ? agentInfo.status === "available" : false;
+    const agentDisplayName = agentInfo?.displayName ?? targetRuntimeId;
     const prereqInput = {
-        agent: { id: targetRuntimeId, displayName: targetRuntime.displayName, available: agentAvailable },
+        agent: { id: targetRuntimeId, displayName: agentDisplayName, available: agentAvailable },
         ...(modelProvider ? { model: { provider: modelProvider, configured: Boolean(modelConfigured) } } : {}),
     };
     if (opts.detectPrereqs) {
         const early = evaluateForkPrereqs(prereqInput);
         if (blockingForkPrereqs(early).length > 0) {
-            return { ok: false, error: `${targetRuntime.displayName} is not installed on the destination node.`, missing: missingForkPrereqs(early) };
+            return { ok: false, error: `${agentDisplayName} is not installed on the destination node.`, missing: missingForkPrereqs(early) };
         }
     }
+    // Safe now: the agent is available (or this is a same-node local fork whose
+    // agent is self-evidently present). The per-session sandbox tier bakes into
+    // the runtime's launch flags.
+    const targetRuntime = getRuntime(targetRuntimeId, forkSandbox);
     // Reconstruct repo + worktree when the source was repo-backed.
     let workspace = fallback.workspace;
     let cwd = fallback.cwd;
     let repoReachable;
     let worktree;
+    let dirtyWarning;
     const parsed = bundle.record.repoSlug ? parseRepo(bundle.record.repoSlug) : undefined;
     if (parsed) {
         const token = await resolveTokenForRepo(parsed.owner, parsed.repo);
         repoReachable = Boolean(token);
         const repoDir = await cloneOrUpdateRepo({ owner: parsed.owner, repo: parsed.repo, token, root: reposRoot });
         const srcBranch = bundle.record.branch;
-        let wt;
-        if (opts.worktree === "fresh") {
-            // Cut a new branch from the source branch (or the repo's default base).
-            const forkBranch = `${srcBranch ?? "fork"}-fork-${randomBytes(4).toString("hex")}`;
-            wt = await createWorktree({ repoDir, id: forkBranch, branch: forkBranch, base: srcBranch ?? await resolveDefaultBaseRef(repoDir) });
-        }
-        else {
-            // Adopt the source branch, or a fresh random worktree when it had none.
-            wt = await createWorktree({ repoDir, id: srcBranch ?? `fork-${randomBytes(6).toString("hex")}`, branch: srcBranch, base: srcBranch ? undefined : await resolveDefaultBaseRef(repoDir) });
-        }
-        applyDirtyPatch(wt.path, bundle.dirtyPatch);
+        // Serialize clone-adjacent worktree ops on this repo so concurrent forks /
+        // pickups don't race on `git worktree add` or clobber each other's trees.
+        const wt = await withRepoLock(repoDir, async () => {
+            if (opts.worktree === "fresh") {
+                // Same-node fork: cut a NEW branch from the source's LOCAL branch (which
+                // holds its latest, possibly-unpushed commits) or the repo default.
+                const forkBranch = `${srcBranch ?? "fork"}-fork-${randomBytes(4).toString("hex")}`;
+                return createWorktree({ repoDir, id: forkBranch, branch: forkBranch, base: srcBranch ?? await resolveDefaultBaseRef(repoDir) });
+            }
+            // Cross-node adopt: the source branch has no LOCAL ref here. Base the
+            // adopted branch on the pushed `origin/<branch>` so committed work travels
+            // (was: undefined → the destination's DEFAULT branch, silently dropping
+            // every commit). Give the worktree DIR a unique suffix so a same-branch
+            // adopt never reuses — or, via createWorktree's stale-dir cleanup, deletes
+            // — another live session's tree.
+            const dirId = `${srcBranch ?? "fork"}-${randomBytes(4).toString("hex")}`;
+            const base = srcBranch ? await resolveAdoptBaseRef(repoDir, srcBranch) : await resolveDefaultBaseRef(repoDir);
+            return createWorktree({ repoDir, id: dirId, branch: srcBranch, base });
+        });
+        const applied = applyDirtyPatch(wt.path, bundle.dirtyPatch);
+        if (applied.warning)
+            dirtyWarning = applied.warning;
         workspace = repoDir;
         cwd = wt.path;
         worktree = wt;
@@ -5782,8 +6075,10 @@ async function standUpFork(opts) {
         const forkRepoRoot = await gitRepoRoot(cwd);
         if (forkRepoRoot) {
             const forkBranch = `bivy/fork-${randomBytes(6).toString("hex")}`;
-            const wt = await createWorktree({ repoDir: forkRepoRoot, id: forkBranch, branch: forkBranch });
-            applyDirtyPatch(wt.path, bundle.dirtyPatch);
+            const wt = await withRepoLock(forkRepoRoot, () => createWorktree({ repoDir: forkRepoRoot, id: forkBranch, branch: forkBranch }));
+            const applied = applyDirtyPatch(wt.path, bundle.dirtyPatch);
+            if (applied.warning)
+                dirtyWarning = applied.warning;
             workspace = forkRepoRoot;
             cwd = wt.path;
             worktree = wt;
@@ -5793,8 +6088,8 @@ async function standUpFork(opts) {
     // transcript (full) or a fresh session the caller seeds with plan.seedPrompt.
     const plan = await materializeFork({ bundle, targetRuntime, ctx: { workspace, cwd }, seed: { transcriptUrl: opts.transcriptUrl } });
     const record = plan.kind === "resume"
-        ? await createSession(cwd, plan.sessionFile, { runtimeId: targetRuntimeId, source: bundle.record.source, makeActive: false })
-        : await createSession(cwd, undefined, { runtimeId: targetRuntimeId, source: bundle.record.source, makeActive: false });
+        ? await createSession(cwd, plan.sessionFile, { runtimeId: targetRuntimeId, source: bundle.record.source, sandbox: forkSandbox, makeActive: false })
+        : await createSession(cwd, undefined, { runtimeId: targetRuntimeId, source: bundle.record.source, sandbox: forkSandbox, makeActive: false });
     // Mark the new session as a fork of its source, so the run card can show
     // "Forked from …" and the lineage survives a reload (persisted below). Just
     // the parent's session id — an identifier, not content, so it's safe to
@@ -5813,6 +6108,10 @@ async function standUpFork(opts) {
     }
     if (bundle.record.title && !record.session.getName())
         record.session.setName(bundle.record.title);
+    // Surface a non-fatal note when the source's uncommitted changes didn't apply
+    // cleanly, so the fork isn't silently missing work-in-progress.
+    if (dirtyWarning)
+        broadcast({ type: "session.notice", sessionId: record.id, message: dirtyWarning });
     await applyRequestedModel(record, opts.model ?? nodeDefaultModel() ?? undefined);
     persistSessionMetadata(record);
     scheduleAdvertise();
@@ -6324,6 +6623,14 @@ async function sweepDiskGuardrails() {
     await cleanupOldWorktrees();
     evictSharedDepCacheIfNeeded();
     warnOversizedWorktrees();
+    const attachmentRefs = referencedAttachmentHashes();
+    if (attachmentRefs)
+        attachmentGcStats = attachmentStore.gc(attachmentRefs);
+    else
+        console.warn("[attachments] skipping garbage collection because event-log references are not healthy");
+    if ((attachmentGcStats.overCapBytes ?? 0) > 0) {
+        console.warn(`[attachments] store remains ${attachmentGcStats.overCapBytes} bytes over cap because referenced history is retained`);
+    }
 }
 /**
  * Prune "ghost" sessions: metadata rows for a path-based runtime (pi) whose
@@ -6465,6 +6772,9 @@ function closeSessionRecord(record, reason = "closed") {
     sessionEvents.clear(record.id);
     record.session.dispose();
     harness.detach(record.id);
+    // Tear down this session's own egress proxy, if it started one (read-only /
+    // workflow network policy). No-op for the default path.
+    void stopSessionEgress(record.id);
     record.mcpRestore?.();
     openSessions.delete(record.id);
     if (record.sessionFile)
@@ -6699,6 +7009,64 @@ setTimeout(() => void sweepDiskGuardrails(), 30_000).unref?.();
 // One sweep shortly after boot clears ghosts left by a previous run before any
 // client paints its sidebar; the idle timer keeps it clean thereafter.
 setTimeout(pruneGhostSessions, 10_000).unref?.();
+const turnTimeoutMs = configuredTurnTimeoutMs();
+if (turnTimeoutMs > 0)
+    console.log(`[turn-watchdog] armed: timeout=${turnTimeoutMs}ms`);
+else
+    console.warn("[turn-watchdog] disabled by BIVY_TURN_TIMEOUT_MS=0");
+function turnTimeoutMessage() {
+    return `Agent turn timed out after ${Math.round(turnTimeoutMs / 60_000)} minutes and was stopped.`;
+}
+function clearTurnWatchdog(record) {
+    if (record.turnWatchdog)
+        clearTimeout(record.turnWatchdog);
+    record.turnWatchdog = undefined;
+    record.turnTimeoutSignal = undefined;
+    record.turnTimeoutResolve = undefined;
+}
+function armTurnWatchdog(record) {
+    clearTurnWatchdog(record);
+    record.turnTimedOut = false;
+    if (turnTimeoutMs <= 0)
+        return;
+    record.turnTimeoutSignal = new Promise((resolve) => { record.turnTimeoutResolve = resolve; });
+    record.turnWatchdog = setTimeout(() => {
+        record.turnWatchdog = undefined;
+        record.turnTimedOut = true;
+        record.lastFailureAt = Date.now();
+        const message = turnTimeoutMessage();
+        record.turnTimeoutResolve?.();
+        record.turnTimeoutResolve = undefined;
+        // Clear/persist first so the session and an ephemeral runner cannot remain
+        // pinned in a false working state if the runtime's abort path fails to emit
+        // agent_end. abort() is still invoked to kill the underlying process group.
+        clearSessionWorking(record);
+        metadata.touchSession(record.id, "failed");
+        broadcast({ type: "session.outcome", sessionId: record.id, status: "timed_out", completedAt: new Date().toISOString(), error: message });
+        broadcast({ type: "session.error", sessionId: record.id, error: message });
+        void record.session.abort().catch((error) => {
+            console.error(`[turn-watchdog] abort failed for ${record.id}:`, error);
+        }).finally(() => evaluateEphemeralTeardown());
+    }, turnTimeoutMs);
+    record.turnWatchdog.unref?.();
+}
+async function promptWithWatchdog(record, prompt, options) {
+    armTurnWatchdog(record);
+    const timeoutSignal = record.turnTimeoutSignal;
+    try {
+        await Promise.race([
+            record.session.prompt(prompt, options),
+            ...(timeoutSignal ? [timeoutSignal.then(() => { throw new Error(turnTimeoutMessage()); })] : []),
+        ]);
+    }
+    catch (error) {
+        // The timeout callback already cleared/persisted the session. For an ordinary
+        // prompt failure, disarm here and let the caller publish its actionable error.
+        if (!record.turnTimedOut)
+            clearTurnWatchdog(record);
+        throw error;
+    }
+}
 function markSessionWorking(record, activity) {
     touchSession(record);
     const wasWorking = record.isWorking;
@@ -6712,6 +7080,7 @@ function markSessionWorking(record, activity) {
         scheduleAdvertise(); // idle → working transition
 }
 function clearSessionWorking(record) {
+    clearTurnWatchdog(record);
     touchSession(record);
     record.isWorking = false;
     record.lastActivity = undefined;
@@ -6950,7 +7319,7 @@ function attachSessionListeners(record) {
                     getCurrentModelName: () => record.session.getCurrentModel()?.name,
                     setModel: (p, i) => record.session.setModel(p, i),
                     reprompt: async () => {
-                        await record.session.prompt(record.lastPrompt, record.lastPromptOptions);
+                        await promptWithWatchdog(record, record.lastPrompt, record.lastPromptOptions);
                     },
                 });
             }
@@ -7458,7 +7827,7 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
         if (makeActive)
             active = existing;
         broadcast({ type: "session.created", sessionId: existing.id, name: existing.session.getName(), workspace: existing.workspace, sessionFile: existing.sessionFile, source: existing.source, branch: existing.worktree?.branch, prUrl: existing.prUrl, runtimeId: existing.runtimeId, agentName: getRuntime(existing.runtimeId).displayName, bivySession: bivySessionEnvelope(existing), capabilities: capabilitiesWithCommands(existing.runtimeId, existing.session) });
-        void maybeNotifyBivyUpdate(existing);
+        void maybeNotifyBivyUpdate();
         return existing;
     }
     // Pick the agent for this session (fixed for its life). Resuming a tagged
@@ -7585,6 +7954,12 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // session legitimately starts "active now".
     const resumedLastActive = requestedSessionFile ? metaLastActiveMs(storedMeta) : undefined;
     const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: opts.approvalMode, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral };
+    // Apply this session's sandbox network policy as a per-session egress proxy
+    // (its own proxy/decider, never the node-global one). Opt-in via BIVY_SANDBOX_NET:
+    // a read-only session then actually blocks outbound network even for a CLI agent
+    // whose own sandbox doesn't (opencode/aider/goose). No-op otherwise. Fire-and-
+    // forget — a slow proxy listen never delays session creation.
+    void applySessionSandboxEgress(record.id, sessionSandbox, (event) => broadcast({ type: "node.egress", event }));
     // Stage 2 slice 4: a re-attached session recovers its still-running TUI
     // terminal link (the PTY survives a detach) from the session→terminal registry.
     if (attached) {
@@ -7647,7 +8022,7 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     if (makeActive)
         active = record;
     broadcast({ type: "session.created", sessionId, name: record.session.getName(), workspace: sessionWorkspace, sessionFile: record.sessionFile, source: record.source, branch: worktree?.branch, prUrl: record.prUrl, runtimeId: rt.id, agentName: rt.displayName, modelFallbackMessage, bivySession: bivySessionEnvelope(record), capabilities: capabilitiesWithCommands(rt.id, record.session) });
-    void maybeNotifyBivyUpdate(record);
+    void maybeNotifyBivyUpdate();
     scheduleAdvertise();
     return record;
 }
@@ -7757,32 +8132,75 @@ async function resolveOrResumeSession(sessionId, sessionPath) {
 // races the runtime.select that switches the default agent, pin the pill to the
 // *previous* runtime (the reported agent-switching bug). Mirror how session.new/
 // session.open already refuse to touch `active` for remote clients: reuse a
-// single non-active scratch session on the current default runtime instead of
-// spawning a fresh runtime process on every picker read.
-let modelQueryScratch;
-let modelQueryScratchPending;
-async function sessionForModelQuery() {
-    if (active)
+// non-active scratch session per runtime instead of spawning a fresh runtime
+// process on every picker read.
+//
+// Keyed by runtime id, not a single slot: switching agents (Claude → Codex →
+// Claude) used to evict and re-spawn the one scratch on every switch — the
+// "switching agent takes a long time before models appear" bug. A map keeps one
+// warm scratch per runtime so a switch back to an agent already viewed this
+// session answers from the live session with no re-spawn, and `prefetchModels`
+// can warm several ahead of the first pick.
+const modelQueryScratch = new Map();
+const modelQueryScratchPending = new Map();
+async function sessionForModelQuery(runtimeId) {
+    const wanted = resolveRuntimeId(runtimeId);
+    // A live active session answers for itself — but only when it IS the runtime
+    // being queried, so a prefetch/draft read for a *different* agent doesn't get
+    // the active session's (wrong-runtime) model list.
+    if (active && active.runtimeId === wanted)
         return active;
-    const wanted = resolveRuntimeId();
-    if (modelQueryScratch &&
-        openSessions.has(modelQueryScratch.id) &&
-        modelQueryScratch.runtimeId === wanted &&
-        !sessionBusy(modelQueryScratch)) {
-        touchSession(modelQueryScratch);
-        return modelQueryScratch;
-    }
-    // De-dupe concurrent picker reads. Without this, a WS models.list and an HTTP
-    // GET /api/models fired together on page load both miss the reuse guard above
-    // (the scratch assignment only lands after createSession resolves ~0.3s later)
-    // and each stand up a session, leaving two empty rows a fraction of a second
-    // apart. Collapse concurrent builds onto one promise, mirroring resumingSessions.
-    if (modelQueryScratchPending)
-        return modelQueryScratchPending;
-    modelQueryScratchPending = createSession(defaultWorkspace, undefined, { makeActive: false, ephemeral: true })
-        .then((rec) => { modelQueryScratch = rec; return rec; })
-        .finally(() => { modelQueryScratchPending = undefined; });
-    return modelQueryScratchPending;
+    const cached = modelQueryScratch.get(wanted);
+    if (cached && openSessions.has(cached.id) && cached.runtimeId === wanted && !sessionBusy(cached)) {
+        touchSession(cached);
+        return cached;
+    }
+    // De-dupe concurrent picker reads per runtime. Without this, a WS models.list
+    // and an HTTP GET /api/models fired together on page load both miss the reuse
+    // guard above (the scratch assignment only lands after createSession resolves
+    // ~0.3s later) and each stand up a session, leaving two empty rows a fraction
+    // of a second apart. Collapse concurrent builds onto one promise per runtime,
+    // mirroring resumingSessions.
+    const inflight = modelQueryScratchPending.get(wanted);
+    if (inflight)
+        return inflight;
+    const build = createSession(defaultWorkspace, undefined, { makeActive: false, ephemeral: true, runtimeId: wanted })
+        .then((rec) => { modelQueryScratch.set(wanted, rec); return rec; })
+        .finally(() => { modelQueryScratchPending.delete(wanted); });
+    modelQueryScratchPending.set(wanted, build);
+    return build;
+}
+/**
+ * Warm the model-query scratch for one or more runtimes in the background so the
+ * first agent switch to any of them answers instantly instead of paying the
+ * runtime spin-up on the critical path. Fired when the agent picker opens (see
+ * the `models.prefetch` command). Best-effort and de-duped: a runtime already
+ * warm (or being warmed) is a no-op, and a spin-up failure is swallowed — the
+ * normal models.list path will surface any real error when the user picks it.
+ */
+function prefetchModels(runtimeIds) {
+    const wanted = [];
+    for (const id of runtimeIds) {
+        let resolved;
+        try {
+            resolved = resolveRuntimeId(id);
+        }
+        catch {
+            continue; // unknown/uninstalled agent — nothing to warm
+        }
+        if (wanted.includes(resolved))
+            continue;
+        const cached = modelQueryScratch.get(resolved);
+        if (cached && openSessions.has(cached.id) && !sessionBusy(cached))
+            continue;
+        if (modelQueryScratchPending.has(resolved))
+            continue;
+        wanted.push(resolved);
+    }
+    // Warm serially, not in a burst: spinning up every agent subprocess at once
+    // would spike a small node's memory/CPU right as the user is interacting. Each
+    // build is cached (and de-duped) so this cost is paid at most once per runtime.
+    void wanted.reduce((chain, id) => chain.then(() => sessionForModelQuery(id).then(() => undefined, () => undefined)), Promise.resolve());
 }
 async function createRepoSession(parsed, opts = {}) {
     const token = await resolveTokenForRepo(parsed.owner, parsed.repo);
@@ -8334,6 +8752,9 @@ app.delete("/api/devices/:id", (req, res) => {
     res.json({ ok: true, devices: pairingStore.listDevices() });
 });
 app.get("/api/node/info", (_req, res) => {
+    const selectedRuntimeId = active?.runtimeId ?? defaultRuntimeId;
+    const runtimeInfo = runtimeList(selectedRuntimeId).find((runtime) => runtime.id === selectedRuntimeId);
+    const structuredControls = runtimeInfo?.protectionLevel === "native-sandbox" || runtimeInfo?.protectionLevel === "tool-controls";
     res.json({
         nodeId: identity.nodeId,
         name: identity.name,
@@ -8344,15 +8765,31 @@ app.get("/api/node/info", (_req, res) => {
         guardrails: {
             mode: approvalMode,
             defaultAllow: approvalMode === "autonomous" || approvalMode === "never",
-            workspaceBoundary: "Writes outside the active workspace/worktree are denied.",
-            denyList: "Catastrophic/destructive commands and privilege escalation are blocked or require approval.",
-            strictApprovalOptIn: "Set approval mode to risky or always for prompt-heavy review.",
+            enforcementLevel: runtimeInfo?.protectionLevel ?? "user-permissions",
+            protection: runtimeInfo?.protectionLabel ?? "Runs as your user",
+            workspaceBoundary: structuredControls
+                ? "Structured file tools are checked against the active workspace; shell commands are not an OS isolation boundary."
+                : "Not guaranteed by Bivy for this runtime. Run it in a container/VM when isolation is required.",
+            denyList: structuredControls
+                ? "Known catastrophic shell commands are heuristically blocked; this catches accidents, not adversarial bypasses."
+                : "No universal Bivy command interception is available for this runtime.",
+            strictApprovalOptIn: "Set approval mode to risky or always for prompt-heavy review where this runtime exposes tool controls.",
         },
-        runtime: runtimeSummary(getRuntime(active?.runtimeId ?? defaultRuntimeId)),
+        runtime: { ...runtimeSummary(getRuntime(selectedRuntimeId)), ...runtimeInfo },
         defaultRuntimeId,
         sandbox: sandboxInfo(),
     });
 });
+// One-tap "Update this node" from the app's version-mismatch banner, for
+// direct/LAN clients (the relay path uses the RELAY_COMMANDS "node.update"
+// handler). Both call the same runBivyUpdate.
+app.post("/api/node/update", (_req, res) => {
+    const result = runBivyUpdate();
+    if (result.ok)
+        res.json({ ok: true });
+    else
+        res.status(500).json({ ok: false, error: result.error });
+});
 // Build collectNodeStats() options, resolving the optional session so the panel
 // can attribute a session-scoped tier (its live agent process + workspace size).
 function nodeStatsOptsFor(sessionId) {
@@ -8386,8 +8823,38 @@ function sandboxInfo() {
         tier: sandboxTier(),
     };
 }
+// Redacted diagnostics bundle (B4d) — a shareable support export with no secrets,
+// prompts, transcripts, diffs, or repo content: versions, health counters, a
+// whitelisted set of config flags, and the activation stage record.
+app.get("/api/diagnostics", (_req, res) => {
+    const relayConfig = loadRelayConfig(appDir);
+    const selectedRuntimeId = active?.runtimeId ?? defaultRuntimeId;
+    const runtimeInfo = runtimeList(selectedRuntimeId).find((runtime) => runtime.id === selectedRuntimeId);
+    const report = buildDiagnosticsReport({
+        version: currentVersion() ?? undefined,
+        platform: process.platform,
+        nodeVersion: process.version,
+        relayConfigured: Boolean(relayConfig),
+        health: {
+            sessionsOpen: new Set(openSessions.values()).size,
+            sessionsIndexed: metadata.listSessions().length,
+            enforcementLevel: runtimeInfo?.protectionLevel ?? "user-permissions",
+            approvalMode,
+            relayConnected: Boolean(relay?.connected),
+        },
+        env: process.env,
+        // The node knows it is online and which runtime is selectable; the client's
+        // setup readiness fills the rest. This baseline still records the golden path.
+        activation: activationRecord({ nodeOnline: true, runtimeReady: Boolean(runtimeInfo) }),
+        generatedAt: new Date().toISOString(),
+    });
+    res.json(report);
+});
 app.get("/api/status", (_req, res) => {
     const relayConfig = loadRelayConfig(appDir);
+    const selectedRuntimeId = active?.runtimeId ?? defaultRuntimeId;
+    const runtimeInfo = runtimeList(selectedRuntimeId).find((runtime) => runtime.id === selectedRuntimeId);
+    const workspaceBoundary = runtimeInfo?.protectionLevel === "native-sandbox" || runtimeInfo?.protectionLevel === "tool-controls";
     res.json({
         ok: true,
         nodeId: identity.nodeId,
@@ -8402,7 +8869,9 @@ app.get("/api/status", (_req, res) => {
         approvalMode,
         guardrails: {
             autonomousDefault: approvalMode === "autonomous",
-            workspaceBoundary: true,
+            workspaceBoundary,
+            enforcementLevel: runtimeInfo?.protectionLevel ?? "user-permissions",
+            protection: runtimeInfo?.protectionLabel ?? "Runs as your user",
             strictApprovalOptIn: true,
         },
         relay: {
@@ -8424,6 +8893,9 @@ app.get("/api/status", (_req, res) => {
         },
         devices: { paired: pairingStore.listDevices().length, localTokens: identity.listDevices().length },
         approvals: { pending: approvals.list().filter((a) => a.status === "pending").length, recent: metadata.listApprovals(20) },
+        eventLog: { ...eventLog.diskUsage(), ...eventLog.health(), affectedSessions: eventLogIssues.size },
+        attachments: attachmentGcStats,
+        turnWatchdog: { enabled: turnTimeoutMs > 0, timeoutMs: turnTimeoutMs },
         updatedAt: new Date().toISOString(),
     });
 });
@@ -8619,10 +9091,13 @@ app.get("/api/models", async (req, res, next) => {
     try {
         const requestedSessionId = typeof req.query.sessionId === "string" && req.query.sessionId ? req.query.sessionId : undefined;
         const requestedPath = typeof req.query.path === "string" ? req.query.path : undefined;
+        const wantedRuntimeId = typeof req.query.runtimeId === "string" && req.query.runtimeId ? req.query.runtimeId : undefined;
         let record = requestedSessionId ? await resolveOrResumeSession(requestedSessionId, requestedPath) : active;
         if (requestedSessionId && !record)
             return res.status(404).json({ error: "Session not found" });
-        record ??= await sessionForModelQuery();
+        if (!requestedSessionId && wantedRuntimeId && record?.runtimeId !== wantedRuntimeId)
+            record = undefined;
+        record ??= await sessionForModelQuery(wantedRuntimeId);
         const session = record.session;
         const current = session.getCurrentModel();
         const models = await publicModelsList(session, current);
@@ -8633,6 +9108,17 @@ app.get("/api/models", async (req, res, next) => {
         next(error);
     }
 });
+// Warm the per-runtime model-query scratch ahead of the first agent switch (see
+// prefetchModels). Fire-and-forget: returns immediately while the runtimes spin
+// up in the background, so the picker never blocks on it.
+app.post("/api/models/prefetch", (req, res) => {
+    const ids = Array.isArray(req.body?.runtimeIds)
+        ? req.body.runtimeIds.filter((id) => typeof id === "string" && !!id).slice(0, 16)
+        : [];
+    if (ids.length)
+        prefetchModels(ids);
+    res.json({ ok: true });
+});
 app.post("/api/models/select", async (req, res, next) => {
     try {
         const requestedSessionId = typeof req.body?.sessionId === "string" && req.body.sessionId ? req.body.sessionId : undefined;
@@ -9934,7 +10420,7 @@ app.post("/api/session/prompt", async (req, res, next) => {
             broadcast({ type: "session.user_message", sessionId: record.id, text: promptText, clientMessageId: req.body?.clientMessageId });
             void maybeNameSession(record, promptText);
             harnessBeginTurn(record);
-            await session.prompt(agentPrompt, promptOptionsFor(record, req.body?.streamingBehavior, images));
+            await promptWithWatchdog(record, agentPrompt, promptOptionsFor(record, req.body?.streamingBehavior, images));
         }).catch((error) => {
             clearSessionWorking(record);
             broadcast({ type: "session.error", sessionId: record.id, error: String(error?.stack ?? error) });
@@ -10218,6 +10704,14 @@ wss.on("connection", (socket, req) => {
     // sharing a PTY size it to their min (see TerminalManager.setClientSize).
     const clientTerminalId = `sock-${randomUUID()}`;
     socket.send(JSON.stringify({ type: "hello", activeSessionId: active?.id, activeSession: active ? { id: active.id, isStreaming: sessionBusy(active), lastActivity: active.lastActivity, workingStartedAt: active.workingStartedAt } : null }));
+    // Authoritative version status on every connect: `latest` set means this node
+    // is behind (banner shows); absent means up to date (banner + any "Updating…"
+    // state clear — this is how the banner disappears after an update lands and
+    // the socket reconnects on the new build). Then (re)run the throttled check so
+    // a freshly-opened app surfaces a newly-available update without waiting for a
+    // session turn.
+    socket.send(JSON.stringify({ type: "node.update", current: currentVersion() ?? "", latest: pendingBivyUpdate?.latest }));
+    void checkBivyUpdate();
     socket.on("message", (raw) => {
         let msg;
         try {