@goodfish/jarvy 0.6.0 → 0.7.0

package/dist/server/cli.js

@@ -1,18 +1,21 @@
 #!/usr/bin/env node
 
 // src/server/cli.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { createInterface } from "node:readline/promises";
-import { dirname as dirname8, join as join11 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname as dirname9, join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/server/api/server.ts
 import { createServer } from "node:http";
+import { createServer as createSecureServer } from "node:https";
+import { createServer as createListener } from "node:net";
+import { networkInterfaces } from "node:os";
 import { getRequestListener } from "@hono/node-server";
 
 // src/server/api/app.ts
-import { Hono as Hono10 } from "hono";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { Hono as Hono12 } from "hono";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/server/api/middleware/security.ts
@@ -153,22 +156,22 @@ function textField(input, key, fallback) {
 }
 
 // src/server/api/routes/account.ts
-function sessionCookie(c, name2, value2, maxAge) {
-  const secure = !!c.env.incoming.socket.encrypted;
-  setCookie(c, name2, value2, { httpOnly: true, sameSite: "Strict", path: "/", maxAge, secure });
+var encrypted = (c) => !!c.env.incoming.socket.encrypted;
+function sessionCookie(c, name3, value2, maxAge) {
+  setCookie(c, name3, value2, { httpOnly: true, sameSite: "Strict", path: "/", maxAge, secure: encrypted(c) });
 }
 function installAuthentication(api, account) {
-  const COOKIE = `jarvy_session_${account.instance}`;
+  const BASE = `jarvy_session_${account.instance}`, cookie = (c) => encrypted(c) ? `${BASE}_tls` : BASE;
   api.post("/login", jsonBody, async (c) => {
     const input = await readJson(c);
     const result = account.login(input.username, input.password, c.env.incoming.socket.remoteAddress ?? "unknown");
     if (result.type === "limited") throw new HTTPException4(429, { message: "Too many login attempts; try again later" });
     if (result.type === "invalid") throw new HTTPException4(401, { message: "Invalid username or password" });
-    sessionCookie(c, COOKIE, result.token, 7 * 24 * 60 * 60);
+    sessionCookie(c, cookie(c), result.token, 7 * 24 * 60 * 60);
     return c.json({ username: result.username });
   });
   api.use("*", async (c, next) => {
-    const token = getCookie(c, COOKIE);
+    const token = getCookie(c, cookie(c));
     if (!account.authenticated(token)) throw new HTTPException4(401, { message: "Login required" });
     c.set("sessionToken", token);
     c.set("actorId", account.identity().id);
@@ -177,7 +180,7 @@ function installAuthentication(api, account) {
   api.get("/me", (c) => c.json({ username: account.identity().username }));
   api.post("/logout", (c) => {
     account.logout(c.get("sessionToken"));
-    sessionCookie(c, COOKIE, "", 0);
+    sessionCookie(c, cookie(c), "", 0);
     return c.json({ ok: true });
   });
 }
@@ -198,7 +201,7 @@ function botStatusView(status) {
     errorCode: status.error?.code ?? null,
     error: status.error?.message ?? null,
     ...status.error?.params ? { errorParams: status.error.params } : {},
-    ...status.context ? { context: { tokens: status.context.tokens, contextWindow: status.context.limit, percent: status.context.tokens === null ? null : status.context.tokens / status.context.limit * 100 } } : {}
+    ...status.context ? { context: { tokens: status.context.tokens, contextWindow: status.context.limit, percent: status.context.tokens === null ? null : status.context.tokens / status.context.limit * 100, stale: status.context.stale } } : {}
   };
 }
 
@@ -228,12 +231,12 @@ function clipMarked(content2, length) {
 function replyExcerpt(reply) {
   return reply.content ? previewQuotes(reply.content, reply.quotes).slice(0, 200) : "(attachment)";
 }
-function expandQuotes(content2, quotes, name2) {
+function expandQuotes(content2, quotes, name3) {
   if (!quotes.length) return content2;
   return content2.replace(/[ \t]*\[\[q(\d+)\]\][ \t]*/g, (mark, n, offset, whole) => {
     const quote = quotes[Number(n) - 1];
     if (!quote) return mark;
-    const head = `${name2(quote.senderId)}${quote.messageId ? ` (${quote.messageId})` : ""}: `;
+    const head = `${name3(quote.senderId)}${quote.messageId ? ` (${quote.messageId})` : ""}: `;
     const block = `${head}${clipQuote(quote.text).trim()}`.split("\n").map((line) => `> ${line}`).join("\n");
     const end = offset + mark.length;
     return `${offset > 0 && whole[offset - 1] !== "\n" ? "\n" : ""}${block}${end < whole.length && whole[end] !== "\n" ? "\n" : ""}`;
@@ -496,16 +499,16 @@ function chatRoutes({ chats, bots }) {
     return c.json(messageView(message));
   });
   routes.post("/:id/attachments", attachmentBody, async (c) => {
-    let name2;
+    let name3;
     try {
-      name2 = decodeURIComponent(c.req.header("x-file-name") ?? "");
+      name3 = decodeURIComponent(c.req.header("x-file-name") ?? "");
     } catch {
       throw new HTTPException8(400, { message: "Invalid filename" });
     }
     const data = Buffer.from(await c.req.arrayBuffer());
     if (!data.length) throw new HTTPException8(400, { message: "Empty attachment" });
     const mime = (c.req.header("content-type") ?? "application/octet-stream").slice(0, 100);
-    return c.json(chats.upload(c.get("actorId"), c.req.param("id"), name2, mime, data), 201);
+    return c.json(chats.upload(c.get("actorId"), c.req.param("id"), name3, mime, data), 201);
   });
   routes.delete("/:id", async (c) => {
     const id = c.req.param("id");
@@ -537,8 +540,8 @@ function attachmentRoutes(chats) {
   routes.get("/:id/run", (c) => {
     const attachment = chats.download(c.get("actorId"), c.req.param("id"));
     if (!attachment) throw new HTTPException8(404, { message: "Attachment not found" });
-    const { name: name2, mimeType } = attachment.file;
-    if (!/\.html?$/i.test(name2) && mimeType !== "text/html") throw new HTTPException8(415, { message: "Only HTML attachments can run" });
+    const { name: name3, mimeType } = attachment.file;
+    if (!/\.html?$/i.test(name3) && mimeType !== "text/html") throw new HTTPException8(415, { message: "Only HTML attachments can run" });
     c.set("sandboxedDocument", true);
     return c.body(new Uint8Array(attachment.data), 200, { "Content-Type": "text/html; charset=utf-8", "Content-Length": String(attachment.data.length) });
   });
@@ -786,13 +789,68 @@ data: ${JSON.stringify(data)}
   return routes;
 }
 
+// src/server/api/routes/connection.ts
+import { Hono as Hono10 } from "hono";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
+function rootCertificateRoute(connection) {
+  const routes = new Hono10();
+  routes.get("/connection/root.crt", (c) => {
+    const der = connection.rootCertificate();
+    if (!der) throw new HTTPException10(404, { message: "Jarvy serves HTTPS only when it listens beyond this machine" });
+    return c.body(new Uint8Array(der), 200, { "Content-Type": "application/x-x509-ca-cert", "Content-Disposition": 'attachment; filename="jarvy-root.crt"' });
+  });
+  return routes;
+}
+function connectionRoutes(connection) {
+  const routes = new Hono10();
+  routes.get("/connection", (c) => c.json(connection.info()));
+  routes.put("/connection", jsonBody, async (c) => {
+    const input = await readJson(c);
+    if (typeof input.allowHttp !== "boolean") throw new HTTPException10(400, { message: "allowHttp must be true or false" });
+    return c.json(connection.setAllowHttp(input.allowHttp));
+  });
+  return routes;
+}
+
+// src/server/api/routes/secrets.ts
+import { Hono as Hono11 } from "hono";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
+function secretRoutes(secrets) {
+  const routes = new Hono11();
+  routes.get("/", (c) => c.json(secrets.list()));
+  routes.post("/", jsonBody, async (c) => {
+    const input = await readJson(c);
+    return c.json(secrets.create({ name: input.name, description: input.description, value: input.value }), 201);
+  });
+  routes.put("/:id", jsonBody, async (c) => {
+    const input = await readJson(c);
+    return c.json(secrets.update(c.req.param("id"), { description: input.description, value: input.value }));
+  });
+  routes.delete("/:id", (c) => {
+    secrets.delete(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  routes.put("/:id/grants/:botId", jsonBody, async (c) => {
+    const input = await readJson(c);
+    if (typeof input.granted !== "boolean") throw new HTTPException11(400, { message: "granted must be true or false" });
+    return c.json(secrets.grant(c.req.param("id"), c.req.param("botId"), input.granted));
+  });
+  routes.get("/:id/uses", (c) => c.json({ uses: secrets.uses(c.req.param("id")) }));
+  routes.post("/requests/:chatId/:messageId", jsonBody, async (c) => {
+    const input = await readJson(c);
+    return c.json(messageView(secrets.fulfil(c.get("actorId"), c.req.param("chatId"), c.req.param("messageId"), { value: input.value, scope: input.scope })));
+  });
+  return routes;
+}
+
 // src/server/api/app.ts
 function createHttpApp(services, webRoot) {
-  const app = new Hono10();
+  const app = new Hono12();
   app.use("*", headers);
   app.onError(handleError);
-  const api = new Hono10();
+  const api = new Hono12();
   api.use("*", apiSecurity);
+  api.route("/", rootCertificateRoute(services.connection));
   installAuthentication(api, services.account);
   api.route("/bots", botRoutes(services.bots));
   api.route("/", channelRoutes(services));
@@ -801,8 +859,10 @@ function createHttpApp(services, webRoot) {
   api.route("/", modelRoutes(services.models));
   api.route("/", eventRoutes(services));
   api.route("/", liveRoutes(services));
+  api.route("/", connectionRoutes(services.connection));
+  api.route("/secrets", secretRoutes(services.secrets));
   api.all("*", () => {
-    throw new HTTPException10(404, { message: "API route not found" });
+    throw new HTTPException12(404, { message: "API route not found" });
   });
   app.route("/api", api);
   app.get("*", serveStatic({ root: webRoot, onFound: (path, c) => {
@@ -812,16 +872,72 @@ function createHttpApp(services, webRoot) {
     c.header("Cache-Control", "no-store");
   } }));
   app.all("*", (c) => {
-    if (c.req.method !== "GET" && c.req.method !== "HEAD") throw new HTTPException10(405, { message: "Method not allowed" });
-    throw new HTTPException10(404, { message: "Web assets missing; run npm run build" });
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") throw new HTTPException12(405, { message: "Method not allowed" });
+    throw new HTTPException12(404, { message: "Web assets missing; run npm run build" });
   });
   return app;
 }
 
 // src/server/api/server.ts
-function createJarvyServer(services, webRoot) {
+var own = { at: 0, addresses: /* @__PURE__ */ new Set() };
+function fromThisMachine(address = "") {
+  const plain2 = address.replace(/^::ffff:/, "");
+  if (/^127\./.test(plain2) || plain2 === "::1") return true;
+  if (Date.now() - own.at > 6e4) own = { at: Date.now(), addresses: new Set(Object.values(networkInterfaces()).flatMap((list) => (list ?? []).map((item) => item.address))) };
+  return own.addresses.has(plain2);
+}
+function createJarvyServer(services, webRoot, tls) {
   const app = createHttpApp(services, webRoot);
-  return createServer(getRequestListener((request, bindings) => app.fetch(request, bindings), { overrideGlobalObjects: false }));
+  const handle = getRequestListener((request, bindings) => app.fetch(request, bindings), { overrideGlobalObjects: false });
+  const plain2 = createServer((request, response) => {
+    if (tls && !fromThisMachine(request.socket.remoteAddress) && !services.connection.allowHttp()) {
+      response.writeHead(308, { Location: `https://${request.headers.host ?? ""}${request.url ?? "/"}`, "Cache-Control": "no-store" }).end();
+      return;
+    }
+    void handle(request, response);
+  });
+  if (!tls) return {
+    listen: (port, host) => new Promise((resolve5, reject) => {
+      plain2.once("error", reject);
+      plain2.listen(port, host, () => {
+        plain2.off("error", reject);
+        resolve5();
+      });
+    }),
+    close: () => {
+      plain2.close();
+      plain2.closeAllConnections();
+    }
+  };
+  const secure = createSecureServer({ key: tls.key, cert: tls.cert }, (request, response) => void handle(request, response));
+  const front = createListener({ pauseOnConnect: true }, (socket) => {
+    socket.on("error", () => socket.destroy());
+    socket.setTimeout(6e4, () => socket.destroy());
+    socket.once("readable", () => {
+      const head = socket.read(1);
+      if (!head) {
+        socket.destroy();
+        return;
+      }
+      socket.setTimeout(0);
+      socket.unshift(head);
+      (head[0] === 22 ? secure : plain2).emit("connection", socket);
+    });
+  });
+  return {
+    listen: (port, host) => new Promise((resolve5, reject) => {
+      front.once("error", reject);
+      front.listen(port, host, () => {
+        front.off("error", reject);
+        resolve5();
+      });
+    }),
+    close: () => {
+      front.close();
+      plain2.closeAllConnections();
+      secure.closeAllConnections();
+    }
+  };
 }
 
 // src/server/shared/models.ts
@@ -829,10 +945,10 @@ var BOT_COLORS = ["gray", "blue", "green", "amber", "rose", "violet"];
 var AGENT_BOT_ID = "00000000-0000-4000-8000-000000000001";
 
 // src/server/infra/storage/store.ts
-import { createHash, randomBytes, randomInt as randomInt3, randomUUID as randomUUID8, scryptSync, timingSafeEqual } from "node:crypto";
-import { chmodSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname as dirname2, join as join2, resolve } from "node:path";
+import { createHash, randomBytes as randomBytes3, randomInt as randomInt3, randomUUID as randomUUID9, scryptSync, timingSafeEqual } from "node:crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join3, resolve } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 
 // src/server/infra/storage/migrations/composition-schema.ts
@@ -957,10 +1073,10 @@ function migrateChannels(db) {
     const rename3 = db.prepare("UPDATE bots SET name=? WHERE id=?");
     for (const bot of db.prepare("SELECT id,name FROM bots ORDER BY created_at,id").all()) {
       const base = bot.name.replace(/@/g, "").trim() || "Bot";
-      let name2 = base;
-      for (let suffix = 2; taken.has(name2.toLowerCase()); suffix++) name2 = `${base} ${suffix}`;
-      taken.add(name2.toLowerCase());
-      if (name2 !== bot.name) rename3.run(name2, bot.id);
+      let name3 = base;
+      for (let suffix = 2; taken.has(name3.toLowerCase()); suffix++) name3 = `${base} ${suffix}`;
+      taken.add(name3.toLowerCase());
+      if (name3 !== bot.name) rename3.run(name3, bot.id);
     }
     db.exec("PRAGMA user_version=12; COMMIT;");
   } catch (error) {
@@ -1166,6 +1282,86 @@ function migrateEnvironments(db) {
   }
 }
 
+// src/server/infra/vault/cipher.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "node:crypto";
+var PREFIX = "enc:v1:";
+var Cipher = class _Cipher {
+  constructor(load, log = console.log) {
+    this.load = load;
+    this.log = log;
+  }
+  loaded = null;
+  get master() {
+    if (!this.loaded) {
+      this.loaded = this.load();
+      if (this.loaded.created) this.log(`[vault] made a new master key at ${this.loaded.location}; back it up with the data directory`);
+    }
+    return this.loaded;
+  }
+  location() {
+    return this.master.location;
+  }
+  static sealed(text3) {
+    return text3.startsWith(PREFIX);
+  }
+  seal(plain2, context2) {
+    const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", this.master.key, iv);
+    cipher.setAAD(Buffer.from(context2));
+    const body = Buffer.concat([cipher.update(plain2, "utf8"), cipher.final()]);
+    return PREFIX + Buffer.concat([iv, body, cipher.getAuthTag()]).toString("base64");
+  }
+  /** The plain text, or null when it does not open under this key (another installation's key, or damaged). */
+  open(sealed, context2) {
+    if (!_Cipher.sealed(sealed)) return null;
+    try {
+      const raw = Buffer.from(sealed.slice(PREFIX.length), "base64");
+      const decipher = createDecipheriv("aes-256-gcm", this.master.key, raw.subarray(0, 12));
+      decipher.setAAD(Buffer.from(context2));
+      decipher.setAuthTag(raw.subarray(raw.length - 16));
+      return Buffer.concat([decipher.update(raw.subarray(12, raw.length - 16)), decipher.final()]).toString("utf8");
+    } catch {
+      return null;
+    }
+  }
+  /** A short keyed fingerprint for people and logs: it tells values apart without letting anyone test guesses. */
+  fingerprint(plain2) {
+    return createHmac("sha256", this.master.key).update(plain2).digest("hex").slice(0, 8);
+  }
+};
+
+// src/server/infra/storage/migrations/secret-schema.ts
+function migrateSecrets(db, cipher) {
+  const version = db.prepare("PRAGMA user_version").get().user_version;
+  if (version >= 21) return;
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    db.exec(`
+      CREATE TABLE secrets(id TEXT PRIMARY KEY, owner_id TEXT NOT NULL REFERENCES members(id), name TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK(kind IN ('value','ssh_key')), bot_id TEXT REFERENCES bots(id),
+        description TEXT NOT NULL DEFAULT '', value TEXT NOT NULL, fingerprint TEXT NOT NULL,
+        created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);
+      CREATE UNIQUE INDEX secrets_name ON secrets(owner_id, name) WHERE kind='value';
+      CREATE UNIQUE INDEX secrets_bot_key ON secrets(bot_id) WHERE kind='ssh_key';
+      CREATE TABLE secret_grants(secret_id TEXT NOT NULL REFERENCES secrets(id) ON DELETE CASCADE,
+        bot_id TEXT NOT NULL REFERENCES bots(id), scope TEXT NOT NULL CHECK(scope IN ('always','once')), run_id TEXT,
+        granted_by TEXT NOT NULL REFERENCES members(id), granted_at INTEGER NOT NULL, PRIMARY KEY(secret_id, bot_id));
+      CREATE TABLE secret_uses(id INTEGER PRIMARY KEY AUTOINCREMENT, secret_id TEXT REFERENCES secrets(id) ON DELETE SET NULL,
+        secret_name TEXT NOT NULL, bot_id TEXT NOT NULL REFERENCES bots(id), at INTEGER NOT NULL,
+        how TEXT NOT NULL CHECK(how IN ('command','ssh_sign')), environment_id TEXT, history_id INTEGER, tool_call_id TEXT,
+        detail TEXT NOT NULL DEFAULT '');
+      CREATE INDEX secret_uses_secret ON secret_uses(secret_id, at);
+    `);
+    const rows2 = db.prepare("SELECT connection_id AS id, credential_json AS json FROM provider_credentials").all();
+    const update = db.prepare("UPDATE provider_credentials SET credential_json=? WHERE connection_id=?");
+    for (const row of rows2) if (!Cipher.sealed(row.json)) update.run(cipher.seal(row.json, `credential:${row.id}`), row.id);
+    db.exec("PRAGMA user_version=21");
+    db.exec("COMMIT");
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+
 // src/server/infra/storage/migrations/schema.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
@@ -1286,9 +1482,9 @@ function migrateRuntime(db) {
 }
 
 // src/server/infra/storage/migrations/schema.ts
-function migrateDatabase(db) {
+function migrateDatabase(db, cipher) {
   const version = db.prepare("PRAGMA user_version").get().user_version;
-  if (version > 20) throw new Error(`Unsupported database version: ${version}`);
+  if (version > 21) throw new Error(`Unsupported database version: ${version}`);
   migratePrototype(db);
   if (version >= 5) {
     migrateRuntime(db);
@@ -1306,6 +1502,7 @@ function migrateDatabase(db) {
     migrateTitles(db);
     migrateAgent(db);
     migrateEnvironments(db);
+    migrateSecrets(db, cipher);
     return;
   }
   db.exec("PRAGMA foreign_keys=OFF; BEGIN IMMEDIATE");
@@ -1381,6 +1578,7 @@ function migrateDatabase(db) {
   migrateTitles(db);
   migrateAgent(db);
   migrateEnvironments(db);
+  migrateSecrets(db, cipher);
 }
 
 // src/server/infra/storage/chat-repository.ts
@@ -1431,10 +1629,10 @@ var ChannelRepository = class {
   section(ownerId, id) {
     return this.db.prepare(`SELECT ${SECTION_COLUMNS} FROM sections WHERE id=? AND owner_id=?`).get(id, ownerId) ?? null;
   }
-  createSection(ownerId, name2) {
+  createSection(ownerId, name3) {
     const id = randomUUID3(), now = Date.now();
     const position = this.db.prepare("SELECT COALESCE(MAX(position),0)+1 AS next FROM sections WHERE owner_id=?").get(ownerId).next;
-    this.db.prepare("INSERT INTO sections(id,owner_id,name,position,created_at,updated_at) VALUES(?,?,?,?,?,?)").run(id, ownerId, name2, position, now, now);
+    this.db.prepare("INSERT INTO sections(id,owner_id,name,position,created_at,updated_at) VALUES(?,?,?,?,?,?)").run(id, ownerId, name3, position, now, now);
     return this.section(ownerId, id);
   }
   updateSection(ownerId, id, change) {
@@ -1519,13 +1717,13 @@ var ChannelRepository = class {
     this.chats.assertAccess(memberId, chatId);
     this.db.prepare(`INSERT INTO chat_states(chat_id,member_id,read_sequence) VALUES(:chat,:member,MIN(:sequence,COALESCE((SELECT MAX(sequence) FROM messages WHERE chat_id=:chat),0)))
       ON CONFLICT(chat_id,member_id) DO UPDATE SET read_sequence=MAX(read_sequence,excluded.read_sequence)`).run({ chat: chatId, member: memberId, sequence });
-    const read = this.chats.unread(memberId, chatId).readSequence;
+    const read3 = this.chats.unread(memberId, chatId).readSequence;
     if (this.chats.member(memberId)?.kind === "user") {
       this.db.prepare(`UPDATE inbox SET state='told',told_at=? WHERE member_id=? AND kind='message' AND state='pending'
-        AND chat_id=? AND message_id IN (SELECT id FROM messages WHERE chat_id=? AND sequence<=?)`).run(Date.now(), memberId, chatId, chatId, read);
+        AND chat_id=? AND message_id IN (SELECT id FROM messages WHERE chat_id=? AND sequence<=?)`).run(Date.now(), memberId, chatId, chatId, read3);
       this.chats.interactions.seenIn(memberId, chatId);
     }
-    return read;
+    return read3;
   }
   /** Subscribing: every new message in this channel or thread is delivered to the member,
    * @ or not. Subscribing to a thread also follows it; unsubscribing keeps following. */
@@ -1576,9 +1774,9 @@ function threadTitle(content2, names, file = "") {
   let rest = line;
   for (; ; ) {
     rest = rest.trimStart();
-    const name2 = rest.startsWith("@") ? sorted.find((item) => rest.toLowerCase().startsWith(`@${item.toLowerCase()}`)) : void 0;
-    if (!name2) break;
-    rest = rest.slice(name2.length + 1);
+    const name3 = rest.startsWith("@") ? sorted.find((item) => rest.toLowerCase().startsWith(`@${item.toLowerCase()}`)) : void 0;
+    if (!name3) break;
+    rest = rest.slice(name3.length + 1);
   }
   return (rest.trim() || line || file).slice(0, 60);
 }
@@ -1651,8 +1849,8 @@ var ThreadRepository = class {
     return this.db.prepare(`SELECT c.id,c.title,c.status,(SELECT count(*) FROM messages WHERE chat_id=c.id) AS replies,
       (SELECT MAX(created_at) FROM messages WHERE chat_id=c.id) AS lastReplyAt FROM chats c WHERE c.root_message_id=?`).get(rootMessageId) ?? null;
   }
-  assertThread(actorId, threadId, write = false) {
-    this.chats.assertAccess(actorId, threadId, write);
+  assertThread(actorId, threadId, write2 = false) {
+    this.chats.assertAccess(actorId, threadId, write2);
     if (!this.db.prepare("SELECT 1 FROM chats WHERE id=? AND type='thread'").get(threadId)) throw new ChatError(404, "Thread not found");
   }
 };
@@ -1795,10 +1993,10 @@ var ChatRepository = class {
   }
   /** A thread has no member list of its own: reading and writing follow its parent channel (A37). The owner may
    * read (never write) a DM between two of its Bots. */
-  canAccess(actorId, chatId, write = false) {
+  canAccess(actorId, chatId, write2 = false) {
     return !!this.db.prepare(`SELECT 1 FROM chats c JOIN chat_members cm ON cm.chat_id=COALESCE(c.parent_id,c.id)
       WHERE c.id=:chat AND cm.member_id=:actor AND cm.can_read=1 AND (:write=0 OR cm.can_write=1)
-      UNION ALL SELECT 1 FROM chats c WHERE c.id=:chat AND c.type='dm' AND c.owner_id=:actor AND :write=0`).get({ chat: chatId, actor: actorId, write: write ? 1 : 0 });
+      UNION ALL SELECT 1 FROM chats c WHERE c.id=:chat AND c.type='dm' AND c.owner_id=:actor AND :write=0`).get({ chat: chatId, actor: actorId, write: write2 ? 1 : 0 });
   }
   /** Unread count, unread @-mentions of the member (every unread message in a DM) and read position.
    * A thread counts only for its followers. */
@@ -1806,21 +2004,21 @@ var ChatRepository = class {
     const params = { chat: chatId, member: memberId };
     const thread = this.db.prepare("SELECT type FROM chats WHERE id=?").get(chatId)?.type === "thread";
     if (thread && !this.threads.isFollowing(memberId, chatId)) {
-      const read2 = this.db.prepare("SELECT read_sequence AS n FROM chat_states WHERE chat_id=? AND member_id=?").get(chatId, memberId);
-      return { unread: 0, mentions: 0, readSequence: read2?.n ?? 0 };
+      const read4 = this.db.prepare("SELECT read_sequence AS n FROM chat_states WHERE chat_id=? AND member_id=?").get(chatId, memberId);
+      return { unread: 0, mentions: 0, readSequence: read4?.n ?? 0 };
     }
     const unread = this.db.prepare(`SELECT count(*) AS n ${UNREAD}`).get(params).n;
     const mentions = this.db.prepare(`SELECT count(*) AS n ${UNREAD} AND ((SELECT type FROM chats WHERE id=:chat)='dm'
       OR EXISTS(SELECT 1 FROM message_mentions mm WHERE mm.message_id=m.id AND mm.member_id=:member))`).get(params).n;
-    const read = this.db.prepare("SELECT read_sequence AS n FROM chat_states WHERE chat_id=? AND member_id=?").get(chatId, memberId);
-    return { unread, mentions, readSequence: read?.n ?? 0 };
+    const read3 = this.db.prepare("SELECT read_sequence AS n FROM chat_states WHERE chat_id=? AND member_id=?").get(chatId, memberId);
+    return { unread, mentions, readSequence: read3?.n ?? 0 };
   }
   note(chatId) {
     const row = this.db.prepare("SELECT text,updated_by AS updatedBy,updated_at AS updatedAt,version FROM chat_notes WHERE chat_id=?").get(chatId);
     return row ? { ...row, updatedBy: this.member(row.updatedBy) } : null;
   }
-  assertAccess(actorId, chatId, write = false) {
-    if (!this.canAccess(actorId, chatId, write)) throw new ChatError(404, "Chat not found");
+  assertAccess(actorId, chatId, write2 = false) {
+    if (!this.canAccess(actorId, chatId, write2)) throw new ChatError(404, "Chat not found");
   }
   getChat(actorId, id) {
     if (!this.canAccess(actorId, id)) return null;
@@ -2071,10 +2269,10 @@ var ChatRepository = class {
   expirePendingQuestions() {
     this.db.prepare(`UPDATE messages SET question=json_set(question,'$.state','ignored','$.settledAt',?) WHERE json_extract(question,'$.state')='pending'`).run(Date.now());
   }
-  createAttachment(actorId, chatId, name2, mimeType, data) {
+  createAttachment(actorId, chatId, name3, mimeType, data) {
     this.assertAccess(actorId, chatId, true);
-    const file = { id: randomUUID5(), name: name2, mimeType, size: data.length };
-    this.db.prepare("INSERT INTO attachments(id,chat_id,message_id,uploaded_by,name,mime_type,size,data,created_at) VALUES(?,?,NULL,?,?,?,?,?,?)").run(file.id, chatId, actorId, name2, mimeType, data.length, data, Date.now());
+    const file = { id: randomUUID5(), name: name3, mimeType, size: data.length };
+    this.db.prepare("INSERT INTO attachments(id,chat_id,message_id,uploaded_by,name,mime_type,size,data,created_at) VALUES(?,?,NULL,?,?,?,?,?,?)").run(file.id, chatId, actorId, name3, mimeType, data.length, data, Date.now());
     return file;
   }
   attachment(actorId, id) {
@@ -2350,21 +2548,34 @@ function credentialValue(value2) {
   throw new RuntimeFault("invalid_credential", "The credential format isn't valid.");
 }
 var CredentialRepository = class {
-  constructor(db) {
+  constructor(db, cipher) {
     this.db = db;
+    this.cipher = cipher;
   }
-  read(ownerId, connectionId) {
+  /** The text to store for a credential. */
+  stored(connectionId, value2) {
+    return this.cipher.seal(JSON.stringify(credentialValue(value2)), `credential:${connectionId}`);
+  }
+  /** Like `read`, but a value that doesn't open under this installation's key comes back as null, so it can be replaced. */
+  current(ownerId, connectionId) {
     const row = this.db.prepare(`SELECT p.credential_json AS json FROM provider_credentials p JOIN provider_connections c ON c.id=p.connection_id
       WHERE c.id=? AND c.owner_id=?`).get(connectionId, ownerId);
-    return row ? { value: credentialValue(JSON.parse(row.json)), revision: row.json } : null;
+    if (!row) return null;
+    const plain2 = Cipher.sealed(row.json) ? this.cipher.open(row.json, `credential:${connectionId}`) : row.json;
+    return { value: plain2 === null ? null : credentialValue(JSON.parse(plain2)), revision: row.json };
+  }
+  read(ownerId, connectionId) {
+    const row = this.current(ownerId, connectionId);
+    if (row && !row.value) throw new RuntimeFault("credential_unreadable", "The saved credential can't be decrypted with this installation's master key; enter it again in Settings.");
+    return row;
   }
   replace(ownerId, connectionId, prior, value2) {
-    const next = JSON.stringify(credentialValue(value2));
+    const next = this.stored(connectionId, value2);
     this.db.exec("BEGIN IMMEDIATE");
     try {
       if (!this.db.prepare("SELECT 1 FROM provider_connections WHERE id=? AND owner_id=?").get(connectionId, ownerId))
         throw new RuntimeFault("connection_missing", "Connection not found", 404);
-      const current = this.read(ownerId, connectionId);
+      const current = this.current(ownerId, connectionId);
       if ((current?.revision ?? null) !== prior) throw new RuntimeFault("credential_changed", "The credential changed. Please try again.");
       this.db.prepare(`INSERT INTO provider_credentials(connection_id,type,credential_json,updated_at) VALUES(?,?,?,?)
         ON CONFLICT(connection_id) DO UPDATE SET type=excluded.type,credential_json=excluded.credential_json,updated_at=excluded.updated_at`).run(connectionId, value2.type, next, Date.now());
@@ -2393,15 +2604,15 @@ var AgentRepository = class {
     if (row && row.deletedAt === null) return;
     const taken = this.db.prepare(`SELECT 1 FROM account WHERE lower(username)=lower(:name)
       UNION ALL SELECT 1 FROM bots WHERE lower(name)=lower(:name) AND deleted_at IS NULL LIMIT 1`);
-    let name2 = "Jarvy";
-    for (let n = 2; taken.get({ name: name2 }); n++) name2 = `Jarvy ${n}`;
+    let name3 = "Jarvy";
+    for (let n = 2; taken.get({ name: name3 }); n++) name3 = `Jarvy ${n}`;
     this.db.exec("BEGIN IMMEDIATE");
     try {
       if (row) this.db.prepare(`UPDATE bots SET deleted_at=NULL,name=?,description='',system_prompt='',connection_id=NULL,model_id='',thinking_level='auto'
-        WHERE id=?`).run(name2, AGENT_BOT_ID);
+        WHERE id=?`).run(name3, AGENT_BOT_ID);
       else {
         this.db.prepare("INSERT OR IGNORE INTO members VALUES(?,'bot')").run(AGENT_BOT_ID);
-        this.db.prepare("INSERT INTO bots(id,name,description,system_prompt,model_id,created_at,owner_id,thinking_level,color) VALUES(?,?,'','','',?,?,'auto',?)").run(AGENT_BOT_ID, name2, Date.now(), this.ownerId(), BOT_COLORS[randomInt2(BOT_COLORS.length)]);
+        this.db.prepare("INSERT INTO bots(id,name,description,system_prompt,model_id,created_at,owner_id,thinking_level,color) VALUES(?,?,'','','',?,?,'auto',?)").run(AGENT_BOT_ID, name3, Date.now(), this.ownerId(), BOT_COLORS[randomInt2(BOT_COLORS.length)]);
       }
       this.db.prepare("DELETE FROM settings WHERE key='agent_onboarded'").run();
       this.db.exec("COMMIT");
@@ -2504,8 +2715,158 @@ var EnvironmentRepository = class {
   }
 };
 
+// src/server/infra/storage/settings-repository.ts
+var SettingsRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  get(key) {
+    const row = this.db.prepare("SELECT value FROM settings WHERE key=?").get(key);
+    return row?.value ?? null;
+  }
+  set(key, value2) {
+    if (value2 === null) this.db.prepare("DELETE FROM settings WHERE key=?").run(key);
+    else this.db.prepare("INSERT INTO settings(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(key, value2);
+  }
+};
+
+// src/server/infra/storage/secret-repository.ts
+import { randomUUID as randomUUID8 } from "node:crypto";
+
+// src/server/shared/secret.ts
+var SECRET_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+
+// src/server/infra/storage/secret-repository.ts
+var COLUMNS2 = `s.id, s.name, s.kind, s.bot_id AS botId, s.description, s.value, s.fingerprint, s.created_at AS createdAt, s.updated_at AS updatedAt,
+  (SELECT count(*) FROM secret_uses u WHERE u.secret_id=s.id) AS uses, (SELECT max(at) FROM secret_uses u WHERE u.secret_id=s.id) AS lastUsedAt`;
+var MAX_VALUE = 16 * 1024;
+var SecretRepository = class {
+  constructor(db, cipher, ownerId) {
+    this.db = db;
+    this.cipher = cipher;
+    this.ownerId = ownerId;
+  }
+  toRecord(row) {
+    const grants = this.db.prepare(`SELECT bot_id AS botId, scope, granted_at AS grantedAt FROM secret_grants g WHERE secret_id=?
+      AND (scope='always' OR EXISTS(SELECT 1 FROM bot_runs r WHERE r.id=g.run_id AND r.ended_at IS NULL)) ORDER BY granted_at`).all(row.id).map((grant) => ({ ...grant }));
+    const { value: value2, ...rest } = row;
+    return { ...rest, readable: this.cipher.open(value2, `secret:${row.id}`) !== null, grants };
+  }
+  list() {
+    this.purge();
+    return this.db.prepare(`SELECT ${COLUMNS2} FROM secrets s WHERE s.owner_id=? ORDER BY s.kind, lower(s.name)`).all(this.ownerId()).map((row) => this.toRecord(row));
+  }
+  get(id) {
+    const row = this.db.prepare(`SELECT ${COLUMNS2} FROM secrets s WHERE s.id=? AND s.owner_id=?`).get(id, this.ownerId());
+    return row ? this.toRecord(row) : null;
+  }
+  checkValue(value2) {
+    if (typeof value2 !== "string" || !value2) throw new ValidationError("A secret needs a value", "secret_value_missing");
+    if (value2.length > MAX_VALUE) throw new ValidationError("The value is too long", "secret_value_too_long");
+    return value2;
+  }
+  checkDescription(value2) {
+    if (value2 === void 0 || value2 === null) return "";
+    if (typeof value2 !== "string" || value2.length > 200 || /[\n\r]/.test(value2)) throw new ValidationError("The description must be one line of up to 200 characters", "secret_description_invalid");
+    return value2.trim();
+  }
+  create(input) {
+    if (typeof input.name !== "string" || !SECRET_NAME.test(input.name)) throw new ValidationError("Names use capital letters, digits and underscores, and start with a letter", "secret_name_invalid");
+    const description = this.checkDescription(input.description), value2 = this.checkValue(input.value);
+    if (this.db.prepare("SELECT 1 FROM secrets WHERE owner_id=? AND kind='value' AND name=?").get(this.ownerId(), input.name)) throw new ConflictError("Another secret has this name", "secret_name_taken");
+    const id = randomUUID8(), now = Date.now();
+    this.db.prepare("INSERT INTO secrets(id,owner_id,name,kind,bot_id,description,value,fingerprint,created_at,updated_at) VALUES(?,?,?,'value',NULL,?,?,?,?,?)").run(id, this.ownerId(), input.name, description, this.cipher.seal(value2, `secret:${id}`), this.cipher.fingerprint(value2), now, now);
+    return this.get(id);
+  }
+  update(id, input) {
+    if (!this.get(id)) return null;
+    if (input.description !== void 0) this.db.prepare("UPDATE secrets SET description=?, updated_at=? WHERE id=?").run(this.checkDescription(input.description), Date.now(), id);
+    if (input.value !== void 0) {
+      const value2 = this.checkValue(input.value);
+      this.db.prepare("UPDATE secrets SET value=?, fingerprint=?, updated_at=? WHERE id=?").run(this.cipher.seal(value2, `secret:${id}`), this.cipher.fingerprint(value2), Date.now(), id);
+    }
+    return this.get(id);
+  }
+  /** The grants go with it; its uses stay, under its name. */
+  delete(id) {
+    return Number(this.db.prepare("DELETE FROM secrets WHERE id=? AND owner_id=?").run(id, this.ownerId()).changes) > 0;
+  }
+  grant(id, botId, scope, runId) {
+    this.db.prepare(`INSERT INTO secret_grants(secret_id,bot_id,scope,run_id,granted_by,granted_at) VALUES(?,?,?,?,?,?)
+      ON CONFLICT(secret_id,bot_id) DO UPDATE SET scope=excluded.scope, run_id=excluded.run_id, granted_at=excluded.granted_at`).run(id, botId, scope, runId, this.ownerId(), Date.now());
+  }
+  revoke(id, botId) {
+    return Number(this.db.prepare("DELETE FROM secret_grants WHERE secret_id=? AND bot_id=?").run(id, botId).changes) > 0;
+  }
+  uses(id, limit = 100) {
+    return this.db.prepare(`SELECT id, secret_name AS secretName, bot_id AS botId, at, how, environment_id AS environmentId, history_id AS historyId,
+      tool_call_id AS toolCallId, detail FROM secret_uses WHERE secret_id=? ORDER BY at DESC, id DESC LIMIT ?`).all(id, limit).map((use) => ({ ...use }));
+  }
+  /** Every value the owner keeps that opens, for masking. */
+  values() {
+    return this.db.prepare("SELECT id, name, value FROM secrets WHERE owner_id=? AND kind='value'").all(this.ownerId()).map((row) => ({ name: row.name, value: this.cipher.open(row.value, `secret:${row.id}`) })).filter((row) => row.value !== null);
+  }
+  /** The secrets a Bot may use: granted until revoked, or for the run that is still going. */
+  grantedTo(botId) {
+    return this.db.prepare(`SELECT s.id, s.name, s.description, g.scope FROM secrets s JOIN secret_grants g ON g.secret_id=s.id
+      WHERE g.bot_id=? AND s.owner_id=? AND s.kind='value' AND (g.scope='always' OR EXISTS(SELECT 1 FROM bot_runs r WHERE r.id=g.run_id AND r.ended_at IS NULL))
+      ORDER BY s.name`).all(botId, this.ownerId()).map((row) => ({ ...row }));
+  }
+  /** The Bot's run in progress, which a "this time only" grant lasts for. */
+  currentRun(botId) {
+    return this.db.prepare("SELECT id FROM bot_runs WHERE bot_id=? AND ended_at IS NULL ORDER BY created_at DESC LIMIT 1").get(botId)?.id ?? null;
+  }
+  byName(name3) {
+    const row = this.db.prepare("SELECT id FROM secrets WHERE owner_id=? AND kind='value' AND name=?").get(this.ownerId(), name3);
+    return row ? this.get(row.id) : null;
+  }
+  /** "This time only" grants whose run has ended. */
+  purge() {
+    this.db.prepare("DELETE FROM secret_grants WHERE scope='once' AND NOT EXISTS(SELECT 1 FROM bot_runs r WHERE r.id=secret_grants.run_id AND r.ended_at IS NULL)").run();
+  }
+  record(use) {
+    this.db.prepare("INSERT INTO secret_uses(secret_id,secret_name,bot_id,at,how,environment_id,tool_call_id,detail) VALUES(?,?,?,?,?,?,?,?)").run(use.secretId, use.name, use.botId, Date.now(), use.how, use.environmentId, use.toolCallId, use.detail.slice(0, 4e3));
+  }
+  /** The plain value, for a command that uses it; null when it does not open. */
+  value(id) {
+    const row = this.db.prepare("SELECT value FROM secrets WHERE id=?").get(id);
+    return row ? this.cipher.open(row.value, `secret:${id}`) : null;
+  }
+};
+
+// src/server/infra/vault/master-key.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+function keyDirectory() {
+  const base = process.env.XDG_CONFIG_HOME || (process.platform === "win32" ? process.env.APPDATA ?? join2(homedir(), "AppData", "Roaming") : join2(homedir(), ".config"));
+  return join2(base, "jarvy");
+}
+function read(location) {
+  const key = Buffer.from(readFileSync(location, "utf8").trim(), "base64");
+  if (key.length !== 32) throw new Error(`The master key at ${location} is damaged`);
+  return { key, location, created: false };
+}
+function masterKey(installationId) {
+  if (!/^[A-Za-z0-9-]+$/.test(installationId)) throw new Error("Invalid installation id");
+  const dir = keyDirectory(), location = join2(dir, `${installationId}.key`);
+  if (existsSync(location)) return read(location);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const key = randomBytes2(32);
+  try {
+    writeFileSync(location, `${key.toString("base64")}
+`, { mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST") return read(location);
+    throw error;
+  }
+  chmodSync(location, 384);
+  return { key, location, created: true };
+}
+
 // src/server/infra/storage/store.ts
-var defaultDataDir = () => process.env.JARVY_DATA_DIR || join2(homedir(), ".jarvy");
+var defaultDataDir = () => process.env.JARVY_DATA_DIR || join3(homedir2(), ".jarvy");
 var DATABASE_FILENAME = "jarvy.db";
 var SESSION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1e3;
 function passwordHash(password, salt) {
@@ -2533,7 +2894,7 @@ function normalizeModel(value2) {
   if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) throw new ValidationError("Invalid model");
   const input = value2;
   const id = requireText(input.id, "Model ID", 200);
-  const name2 = input.name === void 0 ? id : optionalText(input.name, "Model name", 200) || id;
+  const name3 = input.name === void 0 ? id : optionalText(input.name, "Model name", 200) || id;
   if (input.reasoning !== void 0 && typeof input.reasoning !== "boolean") throw new ValidationError("Invalid reasoning capability");
   const capabilities2 = input.input === void 0 ? ["text"] : input.input;
   if (!Array.isArray(capabilities2) || !capabilities2.length || !capabilities2.includes("text") || capabilities2.some((item) => item !== "text" && item !== "image")) throw new ValidationError("Invalid input capabilities");
@@ -2554,7 +2915,7 @@ function normalizeModel(value2) {
   const { thinkingFormat: _format, ...compat } = rawCompat;
   return {
     id,
-    name: name2,
+    name: name3,
     ...input.api ? { api: input.api } : {},
     headerNames: Object.keys(input.headers ?? {}),
     reasoning: input.reasoning === true,
@@ -2575,24 +2936,31 @@ var Store = class {
   credentials;
   agent;
   environments;
+  settings;
+  secrets;
+  /** Seals secrets and model credentials under the master key (A52). */
+  cipher;
   constructor(dataDir = defaultDataDir()) {
     const root = resolve(dataDir);
-    mkdirSync(root, { recursive: true, mode: 448 });
-    this.path = join2(root, DATABASE_FILENAME);
+    mkdirSync2(root, { recursive: true, mode: 448 });
+    this.path = join3(root, DATABASE_FILENAME);
     this.db = new DatabaseSync(this.path);
-    chmodSync(this.path, 384);
+    chmodSync2(this.path, 384);
     this.db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;");
+    this.cipher = new Cipher(() => masterKey(this.installationDeviceId()));
     try {
-      migrateDatabase(this.db);
+      migrateDatabase(this.db, this.cipher);
     } catch (error) {
       this.db.close();
       throw error;
     }
     this.chats = new ChatRepository(this.db);
     this.runtime = new RuntimeRepository(this.db);
-    this.credentials = new CredentialRepository(this.db);
+    this.credentials = new CredentialRepository(this.db, this.cipher);
     this.agent = new AgentRepository(this.db, () => this.userMemberId());
     this.environments = new EnvironmentRepository(this.db, () => this.userMemberId());
+    this.settings = new SettingsRepository(this.db);
+    this.secrets = new SecretRepository(this.db, this.cipher, () => this.userMemberId());
     this.agent.ensure();
   }
   close() {
@@ -2602,7 +2970,7 @@ var Store = class {
   installationDeviceId() {
     const row = this.db.prepare("SELECT device_id FROM installation WHERE id=1").get();
     if (row) return row.device_id;
-    const id = randomUUID8();
+    const id = randomUUID9();
     this.db.prepare("INSERT INTO installation(id,device_id) VALUES(1,?)").run(id);
     return id;
   }
@@ -2617,14 +2985,14 @@ var Store = class {
     return this.db.prepare("SELECT username FROM account WHERE id=1").get()?.username ?? null;
   }
   initialize(username, password) {
-    const name2 = requireText(username, "Username", 64);
+    const name3 = requireText(username, "Username", 64);
     if (typeof password !== "string" || password.length < 8 || password.length > 256) throw new ValidationError("Password must be 8-256 characters");
-    const salt = randomBytes(16).toString("hex");
+    const salt = randomBytes3(16).toString("hex");
     const digest = passwordHash(password, salt);
     this.db.exec("BEGIN IMMEDIATE");
     try {
       if (this.isInitialized()) throw new ConflictError("Account is already initialized");
-      this.db.prepare("INSERT INTO account(id,username,password_salt,password_hash,member_id) VALUES(1,?,?,?,?)").run(name2, salt, digest, this.userMemberId());
+      this.db.prepare("INSERT INTO account(id,username,password_salt,password_hash,member_id) VALUES(1,?,?,?,?)").run(name3, salt, digest, this.userMemberId());
       this.db.exec("COMMIT");
     } catch (error) {
       this.db.exec("ROLLBACK");
@@ -2637,7 +3005,7 @@ var Store = class {
     const candidate = Buffer.from(passwordHash(password, row.password_salt), "hex");
     const expected = Buffer.from(row.password_hash, "hex");
     if (!timingSafeEqual(candidate, expected) || username !== row.username) return null;
-    const token = randomBytes(32).toString("base64url");
+    const token = randomBytes3(32).toString("base64url");
     this.db.prepare("DELETE FROM auth_sessions WHERE expires_at<?").run(Date.now());
     this.db.prepare("INSERT INTO auth_sessions VALUES (?,?)").run(tokenHash(token), Date.now() + SESSION_LIFETIME_MS);
     return token;
@@ -2650,8 +3018,8 @@ var Store = class {
     if (token) this.db.prepare("DELETE FROM auth_sessions WHERE token_hash=?").run(tokenHash(token));
   }
   botFromRow(row) {
-    const workspacePath = join2(dirname2(this.path), "bots", row.id, "workspace");
-    mkdirSync(join2(workspacePath, "temp"), { recursive: true, mode: 448 });
+    const workspacePath = join3(dirname2(this.path), "bots", row.id, "workspace");
+    mkdirSync2(join3(workspacePath, "temp"), { recursive: true, mode: 448 });
     return { ...row, workspacePath };
   }
   listBots() {
@@ -2663,9 +3031,9 @@ var Store = class {
     return row ? this.botFromRow(row) : null;
   }
   /** Member names are unique across people and Bots, ignoring case, so "@name" in a message is unambiguous (A37). */
-  nameTaken(name2, exceptBotId) {
+  nameTaken(name3, exceptBotId) {
     return !!this.db.prepare(`SELECT 1 FROM account WHERE lower(username)=lower(:name)
-      UNION ALL SELECT 1 FROM bots WHERE lower(name)=lower(:name) AND id<>:except AND deleted_at IS NULL LIMIT 1`).get({ name: name2, except: exceptBotId ?? "" });
+      UNION ALL SELECT 1 FROM bots WHERE lower(name)=lower(:name) AND id<>:except AND deleted_at IS NULL LIMIT 1`).get({ name: name3, except: exceptBotId ?? "" });
   }
   /** Deletes a Bot: its DMs (with anyone), channel memberships and states, queued deliveries,
    * notices and session row go; the member row stays, marked deleted, so messages it left in channels keep their
@@ -2679,6 +3047,7 @@ var Store = class {
       for (const table of ["chat_members", "chat_states", "inbox"]) this.db.prepare(`DELETE FROM ${table} WHERE member_id=?`).run(id);
       this.db.prepare("DELETE FROM bot_sessions WHERE bot_id=?").run(id);
       this.db.prepare("DELETE FROM environment_grants WHERE bot_id=?").run(id);
+      this.db.prepare("DELETE FROM secret_grants WHERE bot_id=?").run(id);
       this.db.exec("COMMIT");
     } catch (error) {
       this.db.exec("ROLLBACK");
@@ -2687,15 +3056,15 @@ var Store = class {
     return true;
   }
   botName(value2, exceptBotId) {
-    const name2 = requireText(value2, "Bot name", 80);
-    if (name2.includes("@") || /[\n\r]/.test(name2)) throw new ValidationError("Bot name cannot contain @ or line breaks");
-    if (this.nameTaken(name2, exceptBotId)) throw new ConflictError("Another member already has this name", "name_taken");
-    return name2;
+    const name3 = requireText(value2, "Bot name", 80);
+    if (name3.includes("@") || /[\n\r]/.test(name3)) throw new ValidationError("Bot name cannot contain @ or line breaks");
+    if (this.nameTaken(name3, exceptBotId)) throw new ConflictError("Another member already has this name", "name_taken");
+    return name3;
   }
   /** The caller names the Bot (A45: the interface picks a free default in its own language). */
-  createBot(name2) {
-    const clean = this.botName(name2);
-    const id = randomUUID8(), createdAt = Date.now();
+  createBot(name3) {
+    const clean = this.botName(name3);
+    const id = randomUUID9(), createdAt = Date.now();
     this.db.exec("BEGIN IMMEDIATE");
     try {
       this.db.prepare("INSERT INTO members VALUES(?,'bot')").run(id);
@@ -2709,10 +3078,10 @@ var Store = class {
   }
   updateBot(id, input) {
     if (!this.getBot(id)) return null;
-    const name2 = this.botName(input.name, id);
+    const name3 = this.botName(input.name, id);
     const description = optionalText(input.description, "Description", 1e3);
     const systemPrompt = optionalText(input.systemPrompt, "Persona", 16e3);
-    if (!this.db.prepare("UPDATE bots SET name=?,description=?,system_prompt=? WHERE id=?").run(name2, description, systemPrompt, id).changes) return null;
+    if (!this.db.prepare("UPDATE bots SET name=?,description=?,system_prompt=? WHERE id=?").run(name3, description, systemPrompt, id).changes) return null;
     return this.getBot(id);
   }
   validateSelection(id, input) {
@@ -2767,11 +3136,11 @@ var Store = class {
     }
     const key = input.apiKey === void 0 ? null : requireText(input.apiKey, "API Key", 8192);
     if (key && authType !== "api_key") throw new ValidationError("Invalid credential type");
-    const id = randomUUID8(), now = Date.now();
+    const id = randomUUID9(), now = Date.now();
     this.db.exec("BEGIN IMMEDIATE");
     try {
       this.db.prepare("INSERT INTO provider_connections(id,provider_name,display_name,kind,auth_type,base_url,api,created_at,updated_at,owner_id) VALUES(?,?,?,?,?,?,?,?,?,?)").run(id, providerName, displayName, kind, authType, baseUrl, api, now, now, this.userMemberId());
-      if (key) this.db.prepare("INSERT INTO provider_credentials(connection_id,type,credential_json,updated_at) VALUES(?,'api_key',?,?)").run(id, JSON.stringify({ type: "api_key", key }), now);
+      if (key) this.db.prepare("INSERT INTO provider_credentials(connection_id,type,credential_json,updated_at) VALUES(?,'api_key',?,?)").run(id, this.credentials.stored(id, { type: "api_key", key }), now);
       this.db.exec("COMMIT");
     } catch (error) {
       this.db.exec("ROLLBACK");
@@ -2779,8 +3148,8 @@ var Store = class {
     }
     return this.getModelConnection(id);
   }
-  checkCustomName(name2, except = "") {
-    if (this.db.prepare("SELECT 1 FROM provider_connections WHERE owner_id=? AND kind='custom' AND provider_name=? AND id<>?").get(this.userMemberId(), name2, except)) throw new ValidationError("A provider with this name already exists", "provider_name_taken");
+  checkCustomName(name3, except = "") {
+    if (this.db.prepare("SELECT 1 FROM provider_connections WHERE owner_id=? AND kind='custom' AND provider_name=? AND id<>?").get(this.userMemberId(), name3, except)) throw new ValidationError("A provider with this name already exists", "provider_name_taken");
   }
   updateModelConnection(id, input) {
     const current = this.getModelConnection(id);
@@ -2788,7 +3157,7 @@ var Store = class {
     const providerName = current.kind === "custom" && input.providerName !== void 0 ? requireText(input.providerName, "Provider name", 80).toLowerCase() : current.providerName;
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(providerName)) throw new ValidationError("Invalid provider name");
     if (current.kind === "custom") this.checkCustomName(providerName, id);
-    const name2 = requireText(input.displayName, "Connection name", 100);
+    const name3 = requireText(input.displayName, "Connection name", 100);
     const baseUrl = optionalText(input.baseUrl, "Base URL", 2048);
     if (baseUrl) {
       const url = new URL(baseUrl);
@@ -2796,7 +3165,7 @@ var Store = class {
     }
     const api = requireText(input.api, "API", 80);
     if (!MODEL_APIS.has(api)) throw new ValidationError("Unsupported API protocol");
-    this.db.prepare("UPDATE provider_connections SET display_name=?,base_url=?,api=?,updated_at=?,provider_name=? WHERE id=?").run(name2, baseUrl, api, Date.now(), providerName, id);
+    this.db.prepare("UPDATE provider_connections SET display_name=?,base_url=?,api=?,updated_at=?,provider_name=? WHERE id=?").run(name3, baseUrl, api, Date.now(), providerName, id);
     return this.getModelConnection(id);
   }
   deleteModelConnection(id) {
@@ -2812,7 +3181,7 @@ var Store = class {
     else if (input.apiKey !== void 0) {
       const key = requireText(input.apiKey, "API Key", 8192);
       this.db.prepare(`INSERT INTO provider_credentials(connection_id,type,credential_json,updated_at) VALUES(?,'api_key',?,?)
-        ON CONFLICT(connection_id) DO UPDATE SET type='api_key',credential_json=excluded.credential_json,updated_at=excluded.updated_at`).run(id, JSON.stringify({ type: "api_key", key }), Date.now());
+        ON CONFLICT(connection_id) DO UPDATE SET type='api_key',credential_json=excluded.credential_json,updated_at=excluded.updated_at`).run(id, this.credentials.stored(id, { type: "api_key", key }), Date.now());
     }
     return this.getModelConnection(id);
   }
@@ -2828,15 +3197,15 @@ var Store = class {
     const updates = raw.headerUpdates;
     if (updates !== void 0) {
       if (!updates || typeof updates !== "object" || Array.isArray(updates)) throw new ValidationError("Invalid headers");
-      for (const [name2, value2] of Object.entries(updates)) {
-        if (value2 === null) headers2.delete(name2);
-        else if (typeof value2 === "string") headers2.set(name2, value2);
+      for (const [name3, value2] of Object.entries(updates)) {
+        if (value2 === null) headers2.delete(name3);
+        else if (typeof value2 === "string") headers2.set(name3, value2);
         else throw new ValidationError("Invalid header value");
       }
     }
     const literalHeaders = {};
-    headers2.forEach((value2, name2) => {
-      literalHeaders[name2] = value2;
+    headers2.forEach((value2, name3) => {
+      literalHeaders[name3] = value2;
     });
     const stored = { ...model, headers: literalHeaders };
     this.db.exec("BEGIN IMMEDIATE");
@@ -2869,6 +3238,186 @@ var Store = class {
   }
 };
 
+// src/server/infra/tls/certificates.ts
+import { X509Certificate as X509Certificate2 } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { hostname, networkInterfaces as networkInterfaces2 } from "node:os";
+import { join as join4 } from "node:path";
+
+// src/server/infra/tls/x509.ts
+import { createHash as createHash2, createPrivateKey, generateKeyPairSync, randomBytes as randomBytes4, sign, X509Certificate } from "node:crypto";
+import { isIPv4, isIPv6 } from "node:net";
+var tlv = (tag, content2) => {
+  const n = content2.length;
+  const length = n < 128 ? Buffer.from([n]) : (() => {
+    const bytes = [];
+    for (let v = n; v > 0; v >>= 8) bytes.unshift(v & 255);
+    return Buffer.from([128 | bytes.length, ...bytes]);
+  })();
+  return Buffer.concat([Buffer.from([tag]), length, content2]);
+};
+var seq = (...items) => tlv(48, Buffer.concat(items));
+var set = (...items) => tlv(49, Buffer.concat(items));
+var integer2 = (bytes) => tlv(2, bytes[0] & 128 ? Buffer.concat([Buffer.from([0]), bytes]) : bytes);
+var bits = (bytes, unused = 0) => tlv(3, Buffer.concat([Buffer.from([unused]), bytes]));
+var octets = (bytes) => tlv(4, bytes);
+var utf8 = (text3) => tlv(12, Buffer.from(text3, "utf8"));
+var TRUE = tlv(1, Buffer.from([255]));
+function oid(text3) {
+  const [a, b, ...rest] = text3.split(".").map(Number);
+  const out = [a * 40 + b];
+  for (const value2 of rest) {
+    const chunk = [value2 & 127];
+    for (let v = value2 >>> 7; v > 0; v >>>= 7) chunk.unshift(128 | v & 127);
+    out.push(...chunk);
+  }
+  return tlv(6, Buffer.from(out));
+}
+function time(date) {
+  const iso3 = date.toISOString().replace(/[-:T]/g, "").slice(0, 14) + "Z";
+  return date.getUTCFullYear() < 2050 ? tlv(23, Buffer.from(iso3.slice(2))) : tlv(24, Buffer.from(iso3));
+}
+var ECDSA_SHA256 = seq(oid("1.2.840.10045.4.3.2"));
+var name = (common) => seq(set(seq(oid("2.5.4.10"), utf8("Jarvy"))), set(seq(oid("2.5.4.3"), utf8(common))));
+var extension = (id, value2, critical = false) => seq(oid(id), ...critical ? [TRUE] : [], octets(value2));
+var keyId = (key) => createHash2("sha1").update(key.export({ type: "spki", format: "der" })).digest();
+function ipBytes(address) {
+  if (isIPv4(address)) return Buffer.from(address.split(".").map(Number));
+  if (!isIPv6(address) || address.includes(".")) return null;
+  const [head, tail] = address.split("::");
+  const groups = (part) => part ? part.split(":") : [];
+  const left = groups(head), right = groups(tail);
+  const all = tail === void 0 ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  return all.length === 8 ? Buffer.concat(all.map((group) => {
+    const b = Buffer.alloc(2);
+    b.writeUInt16BE(parseInt(group, 16));
+    return b;
+  })) : null;
+}
+var altNames = (names) => seq(...names.map((entry) => {
+  const ip = ipBytes(entry);
+  return ip ? tlv(135, ip) : tlv(130, Buffer.from(entry, "ascii"));
+}));
+function issue(subject, signer, fields) {
+  const serial = randomBytes4(16);
+  serial[0] &= 127;
+  serial[0] |= 64;
+  const notBefore = new Date(Date.now() - 24 * 36e5), notAfter = new Date(Date.now() + fields.days * 24 * 36e5);
+  const tbs = seq(
+    tlv(160, integer2(Buffer.from([2]))),
+    integer2(serial),
+    ECDSA_SHA256,
+    name(fields.issuer),
+    seq(time(notBefore), time(notAfter)),
+    name(fields.subject),
+    subject.export({ type: "spki", format: "der" }),
+    tlv(163, seq(...fields.extensions))
+  );
+  const der = seq(tbs, ECDSA_SHA256, bits(sign("sha256", tbs, signer)));
+  return `-----BEGIN CERTIFICATE-----
+${der.toString("base64").replace(/.{64}/g, "$&\n").replace(/\n?$/, "\n")}-----END CERTIFICATE-----
+`;
+}
+var pair = () => generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+var pem = (key) => key.export({ type: "pkcs8", format: "pem" });
+function makeRoot(label) {
+  const { publicKey, privateKey } = pair(), subject = `Jarvy local root (${label})`;
+  const certPem = issue(publicKey, privateKey, { subject, issuer: subject, days: 3650, extensions: [
+    extension("2.5.29.19", seq(TRUE, integer2(Buffer.from([0]))), true),
+    extension("2.5.29.15", bits(Buffer.from([6]), 1), true),
+    extension("2.5.29.14", octets(keyId(publicKey)))
+  ] });
+  return { keyPem: pem(privateKey), certPem };
+}
+function makeServer(root, names) {
+  const rootCert = new X509Certificate(root.certPem), rootKey = rootCert.publicKey;
+  const { publicKey, privateKey } = pair();
+  const issuer = rootCert.subject.split("\n").find((line) => line.startsWith("CN=")).slice(3);
+  const certPem = issue(publicKey, createPrivateKey(root.keyPem), { subject: names[0], issuer, days: 397, extensions: [
+    extension("2.5.29.19", seq(), true),
+    extension("2.5.29.15", bits(Buffer.from([128]), 7), true),
+    extension("2.5.29.37", seq(oid("1.3.6.1.5.5.7.3.1"))),
+    extension("2.5.29.17", altNames(names)),
+    extension("2.5.29.14", octets(keyId(publicKey))),
+    extension("2.5.29.35", seq(tlv(128, keyId(rootKey))))
+  ] });
+  const check = new X509Certificate(certPem);
+  if (!check.checkIssued(rootCert) || !check.verify(rootKey)) throw new Error("The server certificate does not verify against Jarvy's root");
+  return { keyPem: pem(privateKey), certPem };
+}
+
+// src/server/infra/tls/certificates.ts
+var RENEW_MS = 30 * 24 * 36e5;
+var isLoopbackHost = (host) => host === "localhost" || host === "::1" || /^127\./.test(host);
+var VIRTUAL = /^(docker|br-|veth|virbr|vmnet|vboxnet|vhs|lxc|lxd|cni|flannel|cali|tun|utun|meta|clash)/i;
+var TUNNEL = /^198\.1[89]\./;
+var rank = (name3, family) => (/^(en|eth|wl|bond)/.test(name3) ? 0 : 2) + (family === "IPv4" ? 0 : 1);
+var reachable = () => Object.entries(networkInterfaces2()).filter(([name3]) => !VIRTUAL.test(name3)).flatMap(([name3, list]) => (list ?? []).filter((item) => !item.internal && !TUNNEL.test(item.address) && (item.family === "IPv4" || !item.address.startsWith("fe80"))).map((item) => ({ address: item.address, order: rank(name3, item.family) }))).sort((a, b) => a.order - b.order).map((item) => item.address);
+function lanAddresses(host) {
+  if (host !== "0.0.0.0" && host !== "::") return isLoopbackHost(host) ? [] : [host];
+  return reachable();
+}
+function coveredNames(host) {
+  const machine = hostname().toLowerCase(), label = /^[a-z0-9-]+$/.test(machine) ? [machine, `${machine}.local`] : [];
+  return [.../* @__PURE__ */ new Set([...label, "localhost", "127.0.0.1", "::1", ...reachable(), ...host === "0.0.0.0" || host === "::" ? [] : [host]])];
+}
+var canonical = (entry) => ipBytes(entry)?.toString("hex") ?? entry.toLowerCase();
+function read2(dir, file) {
+  const path = join4(dir, file);
+  return existsSync2(path) ? readFileSync2(path, "utf8") : null;
+}
+function write(dir, file, text3, secret) {
+  writeFileSync2(join4(dir, file), text3, { mode: secret ? 384 : 420 });
+}
+function readKey(dir, name3, cipher, log) {
+  const plain2 = read2(dir, `${name3}.pem`);
+  if (plain2) {
+    writeKey(dir, name3, plain2, cipher);
+    rmSync(join4(dir, `${name3}.pem`));
+    return plain2;
+  }
+  const sealed = read2(dir, `${name3}.sealed`);
+  if (!sealed) return null;
+  const opened = cipher.open(sealed.trim(), `tls:${name3}`);
+  if (opened === null) log(`[tls] ${name3} doesn't open with this installation's master key; making a new one`);
+  return opened;
+}
+function writeKey(dir, name3, pem2, cipher) {
+  write(dir, `${name3}.sealed`, `${cipher.seal(pem2, `tls:${name3}`)}
+`, true);
+}
+function certificates(dataDir, host, cipher, log = console.log) {
+  const dir = join4(dataDir, "tls");
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  let root = null;
+  const rootKey = readKey(dir, "root-key", cipher, log), rootCert = read2(dir, "root.pem");
+  if (rootKey && rootCert && new X509Certificate2(rootCert).validToDate.getTime() - Date.now() > RENEW_MS) root = { keyPem: rootKey, certPem: rootCert };
+  const names = coveredNames(host);
+  let server = null;
+  if (root) {
+    const key = readKey(dir, "server-key", cipher, log), cert = read2(dir, "server.pem");
+    if (key && cert) {
+      const parsed = new X509Certificate2(cert);
+      const covers = new Set((parsed.subjectAltName ?? "").split(", ").map((entry) => canonical(entry.replace(/^(DNS|IP Address):/, ""))));
+      const fresh = parsed.validToDate.getTime() - Date.now() > RENEW_MS && parsed.checkIssued(new X509Certificate2(root.certPem));
+      if (fresh && names.every((entry) => covers.has(canonical(entry)))) server = { keyPem: key, certPem: cert };
+    }
+  } else {
+    root = makeRoot(hostname());
+    writeKey(dir, "root-key", root.keyPem, cipher);
+    write(dir, "root.pem", root.certPem, false);
+    log("[tls] made a new root certificate; devices need to trust it once");
+  }
+  if (!server) {
+    server = makeServer(root, names);
+    writeKey(dir, "server-key", server.keyPem, cipher);
+    write(dir, "server.pem", server.certPem, false);
+    log(`[tls] signed a server certificate for ${names.join(", ")}`);
+  }
+  const parsedRoot = new X509Certificate2(root.certPem);
+  return { key: server.keyPem, cert: server.certPem, rootDer: parsedRoot.raw, fingerprint: parsedRoot.fingerprint256, names };
+}
+
 // src/server/service/account/service.ts
 var AccountService = class {
   /** `instance` tells apart Jarvy data directories served from the same host (see the session cookie). */
@@ -3019,16 +3568,16 @@ var ConnectionCredentials = class {
   }
   async list(options) {
     options?.signal?.throwIfAborted();
-    const row = this.repository.read(this.ownerId, this.connectionId);
-    return row ? [{ providerId: this.providerName, type: row.value.type }] : [];
+    const row = this.repository.current(this.ownerId, this.connectionId);
+    return row?.value ? [{ providerId: this.providerName, type: row.value.type }] : [];
   }
   async modify(providerId, fn, options) {
     if (providerId !== this.providerName) throw new RuntimeFault("credential_scope", "The credential belongs to another connection.");
     return this.coordinator.exclusive(this.connectionId, async () => {
-      const prior = this.repository.read(this.ownerId, this.connectionId);
-      const next = await fn(prior?.value);
+      const prior = this.repository.current(this.ownerId, this.connectionId);
+      const next = await fn(prior?.value ?? void 0);
       if (next) this.repository.replace(this.ownerId, this.connectionId, prior?.revision ?? null, credentialValue(next));
-      return next ?? prior?.value;
+      return next ?? prior?.value ?? void 0;
     }, options?.signal);
   }
   async delete(providerId, options) {
@@ -3335,7 +3884,7 @@ var ModelService = class {
 };
 
 // src/server/infra/pi/auth.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { ModelRuntime as ModelRuntime2 } from "@earendil-works/pi-coding-agent";
 var CredentialLogins = class {
   constructor(store, credentials, changed) {
@@ -3383,7 +3932,7 @@ var CredentialLogins = class {
   prompt(flow, prompt) {
     const signal = prompt.signal ? AbortSignal.any([flow.controller.signal, prompt.signal]) : flow.controller.signal;
     signal.throwIfAborted();
-    const id = randomUUID9();
+    const id = randomUUID10();
     flow.state.prompt = {
       id,
       type: prompt.type,
@@ -3468,9 +4017,9 @@ var User = class extends Member {
 };
 
 // src/server/application.ts
-import { createHash as createHash6 } from "node:crypto";
-import { mkdir as mkdir5, realpath } from "node:fs/promises";
-import { join as join9, resolve as resolve3 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { mkdir as mkdir6, realpath } from "node:fs/promises";
+import { join as join12, resolve as resolve3 } from "node:path";
 import lockfile from "proper-lockfile";
 
 // src/server/service/chat/mentions.ts
@@ -3481,10 +4030,10 @@ function findMentions(source2, candidates2) {
   for (let at2 = lower.indexOf("@"); at2 >= 0; at2 = lower.indexOf("@", at2 + 1)) {
     if (at2 > 0 && WORD.test(text3[at2 - 1])) continue;
     const match = sorted.find((candidate) => {
-      const name2 = candidate.name.toLowerCase();
-      if (!name2 || !lower.startsWith(name2, at2 + 1)) return false;
-      const next = text3[at2 + 1 + name2.length];
-      return !(next && WORD.test(next) && WORD.test(name2.at(-1)));
+      const name3 = candidate.name.toLowerCase();
+      if (!name3 || !lower.startsWith(name3, at2 + 1)) return false;
+      const next = text3[at2 + 1 + name3.length];
+      return !(next && WORD.test(next) && WORD.test(name3.at(-1)));
     });
     if (match && !found.includes(match)) found.push(match);
   }
@@ -3524,7 +4073,7 @@ var POLICY = {
   onboard: { setup: "interrupt" },
   // What the agent Bot changed about a Bot rides along with that Bot's next batch, without waking it. The owner moving
   // a Bot to another work environment stops its running turn like an @, so it doesn't go on in the old place (A50); a
-  // Bot not running, and a change of access alone, hear of it with their next batch instead (fish m1012-m1015).
+  // Bot not running, and a change of access alone, hear of it with their next batch instead.
   change: { agent: "digest", owner: "interrupt" }
 };
 function urgencyOf(kind, reason) {
@@ -3668,7 +4217,7 @@ var ChatMembers = class {
 };
 
 // src/server/service/chat/messages.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var ChatMessages = class {
   constructor(id, actor, repository) {
     this.id = id;
@@ -3676,13 +4225,13 @@ var ChatMessages = class {
     this.repository = repository;
   }
   async append(sender, message, deliveries, mentions = []) {
-    const payload = message.files === void 0 ? [this.id, message.content, message.attachmentIds] : [this.id, message.content, message.files.map((file) => [file.name, createHash2("sha256").update(file.data).digest("hex")])];
+    const payload = message.files === void 0 ? [this.id, message.content, message.attachmentIds] : [this.id, message.content, message.files.map((file) => [file.name, createHash3("sha256").update(file.data).digest("hex")])];
     if (message.source) payload.push(message.source);
     if (message.question) payload.push(message.question);
     if (message.alsoToChannel) payload.push("alsoToChannel");
     if (message.replyTo) payload.push({ replyTo: message.replyTo });
     if (message.quotes?.length) payload.push({ quotes: message.quotes });
-    const hash = createHash2("sha256").update(JSON.stringify(payload)).digest("hex");
+    const hash = createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
     return this.repository.append(sender.id, this.id, message, hash, message.files, deliveries, mentions);
   }
   async read(id) {
@@ -3720,9 +4269,15 @@ function questionSpec(input) {
     ...input.detail === void 0 ? {} : { detail: input.detail.trim() },
     options: parsed,
     multiple: input.multiple === true,
-    allowCustom: input.allowCustom === true
+    allowCustom: input.allowCustom === true,
+    ...input.secret === void 0 ? {} : { secret: secretAsk(input.secret) }
   };
 }
+function secretAsk(value2) {
+  const ask = value2;
+  if (!ask || typeof ask !== "object" || typeof ask.name !== "string" || !/^[A-Z][A-Z0-9_]{0,63}$/.test(ask.name) || !text(ask.purpose, 300) || typeof ask.exists !== "boolean" || typeof ask.needsValue !== "boolean") throw new ChatError(400, "Invalid secret request");
+  return { name: ask.name, purpose: ask.purpose.trim(), exists: ask.exists, needsValue: ask.needsValue };
+}
 function answerOf(question, input) {
   const selected = input.selected ?? [], custom = input.custom === void 0 || input.custom === null || input.custom === "" ? null : input.custom;
   if (!Array.isArray(selected) || new Set(selected).size !== selected.length || !selected.every((index) => Number.isInteger(index) && index >= 0 && index < question.options.length)) throw new ChatError(400, "Invalid selection");
@@ -3748,7 +4303,7 @@ var ChatQuestions = class {
     if (!question) return Promise.reject(new ChatError(409, "Not a question"));
     if (question.state === "answered") return Promise.resolve(resultOf(question, question.answer));
     if (question.state === "dismissed") return Promise.resolve({ status: "dismissed" });
-    if (question.state === "ignored") return Promise.reject(new ChatError(409, "The question has expired", "question_expired"));
+    if (question.state === "ignored") return Promise.reject(new ChatError(409, "The question is no longer waiting for an answer", "question_expired"));
     return new Promise((resolve5, reject) => {
       const stop = () => {
         this.waiting.delete(message.id);
@@ -3766,6 +4321,10 @@ var ChatQuestions = class {
       });
     });
   }
+  /** Whether the asking tool call still waits for this card. */
+  waitingFor(messageId) {
+    return this.waiting.has(messageId);
+  }
   respond(actorId, chatId, messageId, input) {
     const message = this.repository.message(actorId, messageId);
     if (!message || message.chatId !== chatId || !message.question) throw new ChatError(404, "Question not found");
@@ -3775,7 +4334,7 @@ var ChatQuestions = class {
     if (question.state !== "pending") throw new ChatError(409, "The question is already settled", "question_closed");
     if (!waiter) {
       if (this.repository.settleQuestion(messageId, "ignored", null)) this.changed(chatId);
-      throw new ChatError(409, "The question has expired", "question_expired");
+      throw new ChatError(409, "The question is no longer waiting for an answer", "question_expired");
     }
     const dismissed = input.action === "dismiss";
     if (!dismissed && input.action !== "answer") throw new ChatError(400, "Invalid question action");
@@ -3796,9 +4355,9 @@ function text2(value2, label, max, required = false) {
 }
 var optional = (value2, label, max) => value2 === void 0 ? void 0 : text2(value2, label, max);
 var nameOf = (value2, label) => {
-  const name2 = text2(value2, label, 80, true);
-  if (/[\n\r]/.test(name2)) throw new ChatError(400, `Invalid ${label}`);
-  return name2;
+  const name3 = text2(value2, label, 80, true);
+  if (/[\n\r]/.test(name3)) throw new ChatError(400, `Invalid ${label}`);
+  return name3;
 };
 var ChatChannels = class {
   constructor(repository, saved, sectionsChanged, delivered = () => {
@@ -4330,7 +4889,7 @@ function activityPage(messages, history, limit) {
 }
 
 // src/server/service/bot/service.ts
-import { dirname as dirname7, join as join8 } from "node:path";
+import { dirname as dirname8, join as join11 } from "node:path";
 import { rm as rm3 } from "node:fs/promises";
 
 // src/server/infra/pi/history.ts
@@ -4395,8 +4954,8 @@ var PiHistoryAdapter = class {
       if (m.role === "system") {
         if (m.sections) {
           const sections = {};
-          for (const [name2, text3] of Object.entries(m.sections)) {
-            sections[name2] = text3 === null ? null : message.content.length;
+          for (const [name3, text3] of Object.entries(m.sections)) {
+            sections[name3] = text3 === null ? null : message.content.length;
             if (text3 !== null) message.content.push({ type: "text", text: text3 });
           }
           pi.sections = sections;
@@ -4404,9 +4963,9 @@ var PiHistoryAdapter = class {
         if (m.toolsAdded) {
           const toolProtocol = {};
           message.tools = m.toolsAdded.map((tool, index) => {
-            const { name: name2, description, parameters, ...specific } = tool;
+            const { name: name3, description, parameters, ...specific } = tool;
             if (Object.keys(specific).length) toolProtocol[index] = value(specific);
-            return { name: name2, description, parameters: value(parameters) };
+            return { name: name3, description, parameters: value(parameters) };
           });
           if (Object.keys(toolProtocol).length) pi.tools = toolProtocol;
         }
@@ -4446,11 +5005,30 @@ var PiHistoryAdapter = class {
 };
 
 // src/server/infra/pi/session.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
-import { dirname as dirname3, join as join3, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname3, join as join5, resolve as resolve2, sep } from "node:path";
 import { createAgentSession, createCodemodeExtension, DefaultResourceLoader, ModelRuntime as ModelRuntime3, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
 
+// src/server/infra/pi/context.ts
+var reported = (usage) => usage ? usage.totalTokens || (usage.input ?? 0) + (usage.output ?? 0) + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0) : 0;
+function reportedContext(branch) {
+  let stale = false;
+  for (let i = branch.length - 1; i >= 0; i--) {
+    const entry = branch[i];
+    if (entry.type === "compaction") return { tokens: null, stale: false };
+    if (entry.type === "context_edit") {
+      stale = true;
+      continue;
+    }
+    const message = entry.type === "message" ? entry.message : void 0;
+    if (message?.role !== "assistant" || message.stopReason === "error" || message.stopReason === "aborted") continue;
+    const tokens = reported(message.usage);
+    if (tokens > 0) return { tokens, stale };
+  }
+  return { tokens: null, stale: false };
+}
+
 // src/server/infra/pi/http.ts
 import { EventEmitter } from "node:events";
 import * as undici from "undici";
@@ -4545,6 +5123,77 @@ import { readFile as readLocal, rm } from "node:fs/promises";
 import { basename } from "node:path";
 import { createBashToolDefinition, createEditToolDefinition, createReadToolDefinition, createWriteToolDefinition } from "@earendil-works/pi-coding-agent";
 
+// src/server/shared/secret-mask.ts
+import { StringDecoder } from "node:string_decoder";
+var placeholder = (name3) => `{{secret:${name3}}}`;
+var MIN_MASKED = 4;
+var MIN_FRAGMENT = 8;
+var xml = (text3) => text3.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+function base64Fragments(value2) {
+  const bytes = Buffer.from(value2, "utf8"), found = [];
+  for (const offset of [0, 1, 2]) {
+    const encoded = Buffer.concat([Buffer.alloc(offset), bytes]).toString("base64");
+    const fragment = encoded.slice(Math.ceil(offset * 8 / 6), Math.floor((offset + bytes.length) * 8 / 6));
+    if (fragment.length >= MIN_FRAGMENT) found.push(fragment, fragment.replaceAll("+", "-").replaceAll("/", "_"));
+  }
+  return found;
+}
+function forms(value2) {
+  return [value2, JSON.stringify(value2).slice(1, -1), encodeURIComponent(value2), xml(value2), ...base64Fragments(value2)];
+}
+var Masker = class {
+  /** Longest form first, so a form inside another is not replaced first. */
+  pairs;
+  /** The longest form: streamed output holds back one less than this. */
+  longest;
+  constructor(secrets) {
+    const pairs = /* @__PURE__ */ new Map();
+    for (const { name: name3, value: value2 } of secrets) if (value2.length >= MIN_MASKED) {
+      for (const form of forms(value2)) if (!pairs.has(form)) pairs.set(form, name3);
+    }
+    this.pairs = [...pairs].map(([form, name3]) => ({ form, name: name3 })).sort((a, b) => b.form.length - a.form.length);
+    this.longest = this.pairs[0]?.form.length ?? 0;
+  }
+  get empty() {
+    return this.pairs.length === 0;
+  }
+  mask(text3) {
+    let result = text3;
+    for (const { form, name: name3 } of this.pairs) if (result.includes(form)) result = result.split(form).join(placeholder(name3));
+    return result;
+  }
+  /** Every string inside a JSON-like value. */
+  maskDeep(value2) {
+    if (this.empty) return value2;
+    if (typeof value2 === "string") return this.mask(value2);
+    if (Array.isArray(value2)) return value2.map((item) => this.maskDeep(item));
+    if (value2 && typeof value2 === "object" && Object.getPrototypeOf(value2) === Object.prototype)
+      return Object.fromEntries(Object.entries(value2).map(([key, item]) => [key, this.maskDeep(item)]));
+    return value2;
+  }
+};
+var StreamMask = class {
+  constructor(masker, emit) {
+    this.masker = masker;
+    this.emit = emit;
+  }
+  pending = "";
+  decoder = new StringDecoder("utf8");
+  push(chunk) {
+    this.pending = this.masker.mask(this.pending + this.decoder.write(chunk));
+    const keep = Math.max(0, this.masker.longest - 1), cut = Math.max(0, this.pending.length - keep);
+    if (cut > 0) {
+      this.emit(Buffer.from(this.pending.slice(0, cut)));
+      this.pending = this.pending.slice(cut);
+    }
+  }
+  end() {
+    const rest = this.masker.mask(this.pending + this.decoder.end());
+    this.pending = "";
+    if (rest) this.emit(Buffer.from(rest));
+  }
+};
+
 // src/server/infra/pi/image-kind.ts
 var IMAGE_SNIFF_BYTES = 4100;
 function imageKind(bytes) {
@@ -4575,16 +5224,16 @@ function isBmp(bytes) {
   if (size !== 0 && size < 26) return false;
   if (pixels < 14 + header) return false;
   if (size !== 0 && pixels >= size) return false;
-  let planes, bits;
+  let planes, bits2;
   if (header === 12) {
     planes = u16le(bytes, 22);
-    bits = u16le(bytes, 24);
+    bits2 = u16le(bytes, 24);
   } else if (header >= 40 && header <= 124) {
     if (bytes.length < 30) return false;
     planes = u16le(bytes, 26);
-    bits = u16le(bytes, 28);
+    bits2 = u16le(bytes, 28);
   } else return false;
-  return planes === 1 && [1, 4, 8, 16, 24, 32].includes(bits);
+  return planes === 1 && [1, 4, 8, 16, 24, 32].includes(bits2);
 }
 var at = (bytes, offset) => bytes[offset] ?? 0;
 var u16le = (bytes, offset) => at(bytes, offset) + (at(bytes, offset + 1) << 8);
@@ -4597,29 +5246,150 @@ function ascii(bytes, offset, text3) {
   return true;
 }
 
+// src/server/infra/pi/secret-placeholders.ts
+var PLACEHOLDER = /\{\{secret:([A-Za-z0-9_]{1,64})\}\}/y;
+var secretVariable = (name3) => `JARVY_SECRET_${name3}`;
+function rewritePlaceholders(command) {
+  if (!command.includes("{{secret:")) return { command, names: [] };
+  let out = "", i = 0, state = "plain";
+  const names = /* @__PURE__ */ new Set(), heredocs = [];
+  const word = (i2) => i2 === 0 || /[\s;&|()<>]/.test(command[i2 - 1]);
+  while (i < command.length) {
+    PLACEHOLDER.lastIndex = i;
+    const match = PLACEHOLDER.exec(command);
+    if (match) {
+      const name3 = match[1], variable = `\${${secretVariable(name3)}}`;
+      if (!/^[A-Z][A-Z0-9_]*$/.test(name3)) return { error: `"${name3}" isn't a secret name: names are capital letters, digits and underscores, starting with a letter` };
+      names.add(name3);
+      out += state === "plain" ? `"${variable}"` : state === "double" ? variable : state === "single" ? `'"${variable}"'` : `'"${variable}"$'`;
+      i += match[0].length;
+      continue;
+    }
+    const char = command[i];
+    if (state === "single") {
+      out += char;
+      i++;
+      if (char === "'") state = "plain";
+      continue;
+    }
+    if (state === "ansi") {
+      if (char === "\\" && i + 1 < command.length) {
+        out += command.slice(i, i + 2);
+        i += 2;
+        continue;
+      }
+      out += char;
+      i++;
+      if (char === "'") state = "plain";
+      continue;
+    }
+    if (char === "\\" && i + 1 < command.length) {
+      out += command.slice(i, i + 2);
+      i += 2;
+      continue;
+    }
+    if (state === "double") {
+      out += char;
+      i++;
+      if (char === '"') state = "plain";
+      continue;
+    }
+    if (char === "'") {
+      state = "single";
+      out += char;
+      i++;
+      continue;
+    }
+    if (char === '"') {
+      state = "double";
+      out += char;
+      i++;
+      continue;
+    }
+    if (char === "$" && command[i + 1] === "'") {
+      state = "ansi";
+      out += "$'";
+      i += 2;
+      continue;
+    }
+    if (char === "#" && word(i)) {
+      const end = command.indexOf("\n", i);
+      const stop = end < 0 ? command.length : end;
+      out += command.slice(i, stop);
+      i = stop;
+      continue;
+    }
+    if (char === "<" && command.startsWith("<<", i) && command[i + 2] !== "<") {
+      const found = /^<<(-?)[ \t]*((?:'[^'\n]*'|"[^"\n]*"|\\?[^\s;&|()<>'"]+)+)/.exec(command.slice(i));
+      if (found) {
+        const raw = found[2];
+        heredocs.push({ delimiter: raw.replace(/['"\\]/g, ""), quoted: /['"\\]/.test(raw), tabs: found[1] === "-" });
+        out += found[0];
+        i += found[0].length;
+        continue;
+      }
+    }
+    if (char === "\n" && heredocs.length) {
+      out += char;
+      i++;
+      for (const doc of heredocs.splice(0)) {
+        while (i < command.length) {
+          const end = command.indexOf("\n", i), stop = end < 0 ? command.length : end;
+          const line = command.slice(i, stop), next = end < 0 ? command.length : end + 1;
+          if ((doc.tabs ? line.replace(/^\t+/, "") : line) === doc.delimiter) {
+            out += command.slice(i, next);
+            i = next;
+            break;
+          }
+          if (doc.quoted && /\{\{secret:[A-Za-z0-9_]{1,64}\}\}/.test(line)) return { error: `A placeholder in a quoted heredoc (<<'${doc.delimiter}') stays literal. Use an unquoted heredoc, or pass the value another way. To write the placeholder itself into a file, use write or edit, which keep it as written.` };
+          out += line.replace(/\{\{secret:([A-Za-z0-9_]{1,64})\}\}/g, (_, name3) => {
+            names.add(name3);
+            return `\${${secretVariable(name3)}}`;
+          }) + command.slice(stop, next);
+          i = next;
+        }
+      }
+      continue;
+    }
+    out += char;
+    i++;
+  }
+  return { command: out, names: [...names] };
+}
+
 // src/server/infra/pi/environment-tools.ts
-function environmentTools(lookup) {
+function environmentTools(lookup, secrets) {
   const pinned = new AsyncLocalStorage();
-  const current = () => pinned.getStore() ?? lookup();
+  const current = () => pinned.getStore()?.env ?? lookup();
   const access = async (path) => {
     if (!await current().exists(path)) throw Object.assign(new Error(`ENOENT: no such file or directory, access '${path}'`), { code: "ENOENT" });
   };
-  const readFile3 = (path) => current().readFile(path), writeFile4 = (path, content2) => current().writeFile(path, content2);
+  const readFile3 = (path) => current().readFile(path), writeFile5 = (path, content2) => current().writeFile(path, content2);
   const cwd = current().cwd;
   const definitions2 = [
     relocated(createBashToolDefinition(cwd, { operations: {
-      exec: (command, dir, { onData, signal, timeout, env }) => current().exec(command, {
-        cwd: dir,
-        onData,
-        ...signal ? { signal } : {},
-        ...timeout ? { timeout } : {},
-        ...env ? { env: defined(env) } : {}
-      })
+      exec: async (command, dir, { onData, signal, timeout, env }) => {
+        const where2 = current(), prepared = withSecrets(command, secrets);
+        if (prepared.names.length) secrets.record(prepared.names, { environmentId: where2.id, toolCallId: pinned.getStore()?.toolCallId ?? null, detail: command });
+        const masker = secrets?.masker(), stream = masker && !masker.empty ? new StreamMask(masker, onData) : null;
+        try {
+          return await where2.exec(prepared.command, {
+            cwd: dir,
+            onData: stream ? (chunk) => stream.push(chunk) : onData,
+            ...signal ? { signal } : {},
+            ...timeout ? { timeout } : {},
+            ...env ? { env: defined(env) } : {},
+            ...prepared.values ? { secrets: prepared.values } : {}
+          });
+        } finally {
+          stream?.end();
+        }
+      }
     } }), current),
     // Pictures go to the model as pictures; the kind comes from a file's first bytes, as Pi's local read does.
     createReadToolDefinition(cwd, { operations: { readFile: readFile3, access, detectImageMimeType: async (path) => imageKind(await current().head(path, IMAGE_SNIFF_BYTES)) } }),
-    createWriteToolDefinition(cwd, { operations: { writeFile: writeFile4, mkdir: (path) => current().mkdir(path) } }),
-    createEditToolDefinition(cwd, { operations: { readFile: readFile3, writeFile: writeFile4, access } })
+    createWriteToolDefinition(cwd, { operations: { writeFile: writeFile5, mkdir: (path) => current().mkdir(path) } }),
+    createEditToolDefinition(cwd, { operations: { readFile: readFile3, writeFile: writeFile5, access } })
   ];
   return definitions2.map((definition) => inside(definition, lookup, pinned));
 }
@@ -4628,9 +5398,17 @@ function inside(definition, lookup, pinned) {
   return { ...definition, execute: ((...args) => {
     const env = lookup(), ctx = args[4];
     if (ctx && typeof ctx === "object") args[4] = new Proxy(ctx, { get: (target2, key) => key === "cwd" ? env.cwd : Reflect.get(target2, key, target2) });
-    return pinned.run(env, () => execute(...args));
+    return pinned.run({ env, toolCallId: typeof args[0] === "string" ? args[0] : null }, () => execute(...args));
   }) };
 }
+function withSecrets(command, secrets) {
+  const rewritten = rewritePlaceholders(command);
+  if ("error" in rewritten) throw new Error(rewritten.error);
+  if (!rewritten.names.length) return { command, names: [] };
+  const resolved = secrets?.resolve(rewritten.names) ?? { refused: rewritten.names };
+  if ("refused" in resolved) throw new Error(`You have no secret named ${resolved.refused.join(", ")}. secrets.list in the chat gateway shows the ones you may use. If you need another, use secrets.request; never ask for a value in the chat.`);
+  return { command: rewritten.command, names: rewritten.names, values: Object.fromEntries(Object.entries(resolved.values).map(([name3, value2]) => [secretVariable(name3), value2])) };
+}
 function relocated(definition, current) {
   const execute = definition.execute.bind(definition);
   return { ...definition, execute: (async (...args) => {
@@ -4690,7 +5468,9 @@ var PiSession = class _PiSession {
   translator = new LiveTranslator();
   get context() {
     const usage = this.session.getContextUsage();
-    return usage ? { tokens: usage.tokens, contextWindow: usage.contextWindow, percent: usage.percent } : void 0;
+    if (!usage) return void 0;
+    const { tokens, stale } = reportedContext(this.session.sessionManager.getBranch());
+    return { tokens, contextWindow: usage.contextWindow, percent: tokens === null ? null : tokens / usage.contextWindow * 100, stale };
   }
   get thinkingLevel() {
     return this.session.thinkingLevel;
@@ -4703,18 +5483,18 @@ var PiSession = class _PiSession {
   }
   static async create(options) {
     const { bot, store, reference, selection } = options;
-    const agentDir = join3(dirname3(bot.workspacePath), "agent", "pi"), sessionsDir = join3(agentDir, "sessions");
+    const agentDir = join5(dirname3(bot.workspacePath), "agent", "pi"), sessionsDir = join5(agentDir, "sessions");
     await mkdir2(sessionsDir, { recursive: true, mode: 448 });
     const expected = resolve2(sessionsDir) + sep;
     if (!resolve2(reference.file).startsWith(expected) || dirname3(resolve2(reference.file)) !== resolve2(sessionsDir))
       throw new RuntimeFault("session_path", "The session file path isn't valid.");
-    const exists = existsSync(reference.file);
+    const exists = existsSync3(reference.file);
     if (!exists && (reference.persisted || store.runtime.runs(bot.id).some((run) => run.state === "unknown")))
       throw new RuntimeFault("session_missing", "The session file is missing; check the run records before recovering.");
     if (exists) {
       let header;
       try {
-        header = JSON.parse(readFileSync(reference.file, "utf8").split("\n")[0]);
+        header = JSON.parse(readFileSync3(reference.file, "utf8").split("\n")[0]);
       } catch {
         throw new RuntimeFault("session_corrupt", "The session file can't be read.");
       }
@@ -4756,7 +5536,7 @@ var PiSession = class _PiSession {
           parameters: Type.Unsafe(tool.parameters),
           executionMode: "sequential",
           execute: async (toolCallId, args, signal) => {
-            const output = await tool.execute(args, { toolCallId, signal });
+            const output = await tool.execute(options.secrets ? options.secrets.masker().maskDeep(args) : args, { toolCallId, signal });
             if (isToolMedia(output)) return { content: [
               { type: "text", text: output.text },
               ...output.images.map((image) => ({ type: "image", data: image.data, mimeType: image.mimeType }))
@@ -4765,6 +5545,20 @@ var PiSession = class _PiSession {
           }
         });
         api.on("before_agent_start", () => ({ systemPrompt: options.systemPrompt() }));
+        api.on("tool_result", (event) => {
+          const masker = options.secrets?.masker();
+          if (!masker || masker.empty) return void 0;
+          let changed = false;
+          const content2 = event.content.map((part) => {
+            if (part.type !== "text") return part;
+            const text3 = masker.mask(part.text);
+            if (text3 === part.text) return part;
+            changed = true;
+            return { ...part, text: text3 };
+          });
+          if (!changed) return void 0;
+          return { content: content2, ...event.structuredContent !== void 0 ? { structuredContent: masker.maskDeep(event.structuredContent) } : {} };
+        });
       }]
     });
     await resourceLoader.reload();
@@ -4778,11 +5572,11 @@ var PiSession = class _PiSession {
       model,
       thinkingLevel: resolveThinking(model, selection.thinkingLevel),
       tools,
-      customTools: environmentTools(options.environment)
+      customTools: environmentTools(options.environment, options.secrets)
     });
     adapter.session = result.session;
     adapter.settings = settingsManager;
-    if (result.extensionsResult.errors.length || !tools.every((name2) => adapter.session.getActiveToolNames().includes(name2))) {
+    if (result.extensionsResult.errors.length || !tools.every((name3) => adapter.session.getActiveToolNames().includes(name3))) {
       adapter.session.dispose();
       throw new RuntimeFault("tools_missing", "Couldn't load the run's tools.");
     }
@@ -4801,10 +5595,14 @@ var PiSession = class _PiSession {
         }
       });
     }
-    store.runtime.recordSession(bot.id, adapter.sessionId, existsSync(adapter.sessionFile));
+    store.runtime.recordSession(bot.id, adapter.sessionId, existsSync3(adapter.sessionFile));
     adapter.signature = JSON.stringify([{ connectionId: selection.connectionId, modelId: selection.modelId }, connection.providerName, connection.api, connection.baseUrl, configured2, store.modelHeaders(connection.id, configured2.id)]);
     return adapter;
   }
+  /** A batch never carries a secret's value, even one a person pasted into the chat. */
+  masked(xml2) {
+    return this.options.secrets?.masker().mask(xml2) ?? xml2;
+  }
   onEvent(event) {
     if (event.type === "agent_start") {
       this.started = true;
@@ -4838,7 +5636,8 @@ var PiSession = class _PiSession {
       }
     );
     if (event.type === "message_end" && event.message.role === "assistant") this.result = this.classify(event.message);
-    if (this.options.live) for (const live of this.translator.translate(event)) this.options.live(live);
+    if (this.options.live) for (const live of this.translator.translate(event))
+      this.options.live(live.type === "tool_end" && this.options.secrets ? { ...live, output: this.options.secrets.masker().mask(live.output) } : live);
     this.maybeAbort();
   }
   /** The last assistant message decides the prompt (a later retry success replaces an earlier error).
@@ -4861,9 +5660,9 @@ var PiSession = class _PiSession {
   }
   /** A notice rides along with the running turn. Pi keeps queued steering messages across an abort, so a
    * notice steered just before a new message interrupts the turn is delivered at the start of the next one. */
-  steer(xml) {
+  steer(xml2) {
     if (!this.promptActive || this.session.isIdle) return false;
-    void this.session.steer(xml, void 0, { source: "extension" }).catch((error) => {
+    void this.session.steer(this.masked(xml2), void 0, { source: "extension" }).catch((error) => {
       console.error("[pi] steer failed", { botId: this.options.bot.id, error: error instanceof Error ? error.message : String(error) });
     });
     return true;
@@ -4872,7 +5671,7 @@ var PiSession = class _PiSession {
     this.wantsAbort = true;
     this.maybeAbort();
   }
-  async prompt(xml) {
+  async prompt(xml2) {
     this.promptActive = true;
     this.started = false;
     this.settled = false;
@@ -4886,13 +5685,13 @@ var PiSession = class _PiSession {
     let outcome = "failed";
     try {
       try {
-        await this.session.prompt(xml, { expandPromptTemplates: false });
+        await this.session.prompt(this.masked(xml2), { expandPromptTemplates: false });
       } finally {
         await this.session.waitForIdle();
         if (this.started && !this.settled) await settled;
         this.promptActive = false;
         await this.abortTask;
-        this.options.store.runtime.recordSession(this.options.bot.id, this.sessionId, existsSync(this.sessionFile));
+        this.options.store.runtime.recordSession(this.options.bot.id, this.sessionId, existsSync3(this.sessionFile));
       }
       if (this.abortFailure) throw this.abortFailure;
       outcome = this.result.outcome;
@@ -4937,11 +5736,11 @@ var PiSession = class _PiSession {
 
 // src/server/infra/env/docker.ts
 import { execFile, spawn } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { createWriteStream } from "node:fs";
 import { mkdir as mkdir3, mkdtemp, readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join6 } from "node:path";
 import { Connection, RemoteExecutionEnv, packagedDaemon } from "@earendil-works/pi-env";
 
 // src/server/infra/env/computer-image.ts
@@ -4975,7 +5774,7 @@ function overDurable(id, kind, env, options) {
     async exec(command, exec) {
       const result = await env.exec(command, {
         cwd: exec.cwd,
-        ...options.passEnv && exec.env ? { env: exec.env, inheritEnv: false } : { inheritEnv: true },
+        ...options.passEnv && exec.env ? { env: { ...exec.env, ...exec.secrets }, inheritEnv: false } : { ...exec.secrets ? { env: exec.secrets } : {}, inheritEnv: true },
         ...exec.timeout ? { timeout: exec.timeout } : {},
         onOutput: (text3) => exec.onData(Buffer.from(text3))
       }, context(exec.signal));
@@ -5047,7 +5846,7 @@ async function dockerAvailable() {
   }
 }
 function computerImage(uid, gid) {
-  return `jarvy-computer:${createHash3("sha256").update(`${COMPUTER_DOCKERFILE}
+  return `jarvy-computer:${createHash4("sha256").update(`${COMPUTER_DOCKERFILE}
 ${uid}:${gid}`).digest("hex").slice(0, 12)}`;
 }
 async function pruneImages(keep) {
@@ -5071,9 +5870,9 @@ async function imageExists(tag) {
   }
 }
 async function buildImage(tag, uid, gid, logFile) {
-  const dir = await mkdtemp(join4(tmpdir(), "jarvy-computer-"));
+  const dir = await mkdtemp(join6(tmpdir(), "jarvy-computer-"));
   try {
-    await writeFile2(join4(dir, "Dockerfile"), COMPUTER_DOCKERFILE);
+    await writeFile2(join6(dir, "Dockerfile"), COMPUTER_DOCKERFILE);
     const log = createWriteStream(logFile, { flags: "w", mode: 384 });
     const code = await new Promise((resolve5, reject) => {
       const child = spawn(
@@ -5095,14 +5894,14 @@ async function containerStates(label) {
   const out = await docker(["ps", "-a", "--filter", `label=${label}`, "--format", "{{.Names}}	{{.State}}"]);
   const states = /* @__PURE__ */ new Map();
   for (const line of out.split("\n").filter(Boolean)) {
-    const [name2, state] = line.split("	");
-    if (name2) states.set(name2, state === "running" ? "running" : "stopped");
+    const [name3, state] = line.split("	");
+    if (name3) states.set(name3, state === "running" ? "running" : "stopped");
   }
   return states;
 }
-async function containerState(name2) {
+async function containerState(name3) {
   try {
-    return await docker(["inspect", "--format", "{{.State.Running}}", name2]) === "true" ? "running" : "stopped";
+    return await docker(["inspect", "--format", "{{.State.Running}}", name3]) === "true" ? "running" : "stopped";
   } catch (error) {
     if (/no such (object|container)/i.test(error.message)) return "missing";
     throw error;
@@ -5131,19 +5930,19 @@ async function runContainer(spec) {
     "infinity"
   ], 12e4);
 }
-async function startContainer(name2) {
-  await docker(["start", name2], 6e4);
+async function startContainer(name3) {
+  await docker(["start", name3], 6e4);
 }
-async function homeAtWorkspace(name2) {
-  const home = await docker(["exec", name2, "sh", "-c", "getent passwd bot | cut -d: -f6"], 3e4);
-  if (home !== COMPUTER_CWD) await docker(["exec", "-u", "root", name2, "usermod", "-d", COMPUTER_CWD, "bot"], 3e4);
+async function homeAtWorkspace(name3) {
+  const home = await docker(["exec", name3, "sh", "-c", "getent passwd bot | cut -d: -f6"], 3e4);
+  if (home !== COMPUTER_CWD) await docker(["exec", "-u", "root", name3, "usermod", "-d", COMPUTER_CWD, "bot"], 3e4);
 }
-async function stopContainer(name2) {
-  await docker(["stop", "--time", "5", name2], 6e4);
+async function stopContainer(name3) {
+  await docker(["stop", "--time", "5", name3], 6e4);
 }
-async function removeContainer(name2) {
+async function removeContainer(name3) {
   try {
-    await docker(["rm", "--force", name2], 6e4);
+    await docker(["rm", "--force", name3], 6e4);
   } catch (error) {
     if (!/no such (object|container)/i.test(error.message)) throw error;
   }
@@ -5151,7 +5950,7 @@ async function removeContainer(name2) {
 async function syncDaemon(dir) {
   const arch = process.arch === "arm64" ? "arm64" : "x64";
   const wanted = await readFile2(packagedDaemon({ platform: "linux", arch }));
-  const target2 = join4(dir, "pi-env");
+  const target2 = join6(dir, "pi-env");
   const current = await readFile2(target2).catch(() => null);
   if (current?.equals(wanted)) return;
   await mkdir3(dir, { recursive: true, mode: 448 });
@@ -5213,9 +6012,9 @@ var BotEnvironments = class {
   }
   /** A Bot's environments as other Bots see them in bots.list. */
   summary(botId) {
-    const name2 = (record3) => record3.kind === "host" ? "owner's computer" : record3.botId === botId ? "own sandbox" : "another Bot's sandbox";
+    const name3 = (record3) => record3.kind === "host" ? "owner's computer" : record3.botId === botId ? "own sandbox" : "another Bot's sandbox";
     const { home, current } = this.store.environments.placement(botId);
-    return { default: name2(home), current: name2(current), usable: this.usable(botId).map(name2) };
+    return { default: name3(home), current: name3(current), usable: this.usable(botId).map(name3) };
   }
   /** The Bot's default environment, which its instructions describe. */
   home(botId, workspacePath) {
@@ -5314,14 +6113,14 @@ var BotEnvironments = class {
 };
 
 // src/server/service/bot/computers.ts
-import { createHash as createHash4 } from "node:crypto";
-import { dirname as dirname4, join as join5 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { dirname as dirname4, join as join7 } from "node:path";
 var SWEEP_MS = 6e4;
 var Computers = class {
   constructor(deps) {
     this.deps = deps;
     this.dataDir = dirname4(deps.store.path);
-    this.tag = createHash4("sha256").update(this.dataDir).digest("hex").slice(0, 12);
+    this.tag = createHash5("sha256").update(this.dataDir).digest("hex").slice(0, 12);
   }
   docker = null;
   probing = null;
@@ -5346,7 +6145,7 @@ var Computers = class {
     this.docker = await dockerAvailable();
     if (!this.docker) return;
     try {
-      await syncDaemon(join5(this.dataDir, "computers", "bin"));
+      await syncDaemon(join7(this.dataDir, "computers", "bin"));
     } catch (error) {
       this.docker = false;
       this.log(`computers disabled: ${error.message}`);
@@ -5432,8 +6231,8 @@ var Computers = class {
         if (state === "missing") await runContainer({
           name: container,
           image,
-          workspace: join5(this.dataDir, "bots", botId, "workspace"),
-          daemonDir: join5(this.dataDir, "computers", "bin"),
+          workspace: join7(this.dataDir, "bots", botId, "workspace"),
+          daemonDir: join7(this.dataDir, "computers", "bin"),
           uid: this.uid,
           gid: this.gid,
           labels: { "jarvy.data": this.tag, "jarvy.bot": botId }
@@ -5492,7 +6291,7 @@ var Computers = class {
       const tag = computerImage(this.uid, this.gid);
       if (!await imageExists(tag)) {
         this.log(`building ${tag}`);
-        await buildImage(tag, this.uid, this.gid, join5(this.dataDir, "computers", "build.log"));
+        await buildImage(tag, this.uid, this.gid, join7(this.dataDir, "computers", "build.log"));
         void pruneImages(tag).then((removed) => {
           if (removed.length) this.log(`removed ${removed.join(", ")}`);
         }).catch(() => {
@@ -5521,9 +6320,9 @@ var Computers = class {
     const states = await containerStates(`jarvy.data=${this.tag}`);
     const computers = this.deps.store.environments.computers();
     const owned = new Set(computers.map((computer) => computer.spec.container));
-    for (const name2 of states.keys()) if (!owned.has(name2)) {
-      this.log(`removing ${name2}, which no Bot has`);
-      await removeContainer(name2).catch((error) => this.log(`removing ${name2} failed: ${error.message}`));
+    for (const name3 of states.keys()) if (!owned.has(name3)) {
+      this.log(`removing ${name3}, which no Bot has`);
+      await removeContainer(name3).catch((error) => this.log(`removing ${name3} failed: ${error.message}`));
     }
     for (const computer of computers) {
       const botId = computer.botId;
@@ -5544,7 +6343,7 @@ var Computers = class {
 
 // src/server/infra/storage/history-repository.ts
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 var json = (value2) => value2 == null ? null : JSON.stringify(value2);
 var CALL = "EXISTS (SELECT 1 FROM json_each(history.message, '$.content') b WHERE json_extract(b.value, '$.type')=? AND json_extract(b.value, '$.tool_call_id')=?)";
@@ -5557,9 +6356,9 @@ var SUMMARY = `SELECT id,timestamp,role,model,
 var HistoryRepository = class {
   db;
   constructor(path) {
-    mkdirSync2(dirname5(path), { recursive: true, mode: 448 });
+    mkdirSync4(dirname5(path), { recursive: true, mode: 448 });
     this.db = new DatabaseSync2(path);
-    chmodSync2(path, 384);
+    chmodSync3(path, 384);
     const version = this.db.prepare("PRAGMA user_version").get().user_version;
     if (version === 0) this.db.exec(`BEGIN; CREATE TABLE history (
       id INTEGER PRIMARY KEY, timestamp INTEGER NOT NULL, role TEXT NOT NULL,
@@ -5606,7 +6405,7 @@ var HistoryRepository = class {
     return rows2.map(({ priced, cost, ...row }) => ({ ...row, cost: priced ? cost : null }));
   }
   decodeSummary(row) {
-    const tools = JSON.parse(row.tools).map(({ kind, name: name2, error }) => error ? { kind, name: name2, error: true } : { kind, name: name2 });
+    const tools = JSON.parse(row.tools).map(({ kind, name: name3, error }) => error ? { kind, name: name3, error: true } : { kind, name: name3 });
     return { ...row, model: row.model === null ? null : JSON.parse(row.model), preview: row.preview.replace(/\s+/g, " ").trim(), tools };
   }
   read(id) {
@@ -5686,7 +6485,7 @@ var Memory = class {
 };
 
 // src/server/service/bot/bot.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var Bot = class extends Member {
   kind = "bot";
   identity;
@@ -5777,7 +6576,7 @@ var Bot = class extends Member {
       ...message.question ? { question: message.question } : {},
       ...message.alsoToChannel ? { alsoToChannel: true } : {},
       ...message.replyTo ? { replyTo: message.replyTo } : {},
-      clientMessageId: source2 ? createHash5("sha256").update(JSON.stringify([this.id, source2.historyId, source2.toolCallId])).digest("hex") : void 0
+      clientMessageId: source2 ? createHash6("sha256").update(JSON.stringify([this.id, source2.historyId, source2.toolCallId])).digest("hex") : void 0
     });
   }
   /** 由 Bot 协调配置与运行实例；配置在应用成功后提交。执行中切换从下一次模型请求生效（A28）。 */
@@ -5873,53 +6672,105 @@ import { posix } from "node:path";
 
 // src/server/infra/files/workspace.ts
 import { mkdir as mkdir4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
 var LocalWorkspace = class {
   constructor(cwd) {
     this.cwd = cwd;
   }
   get tempDir() {
-    return join6(this.cwd, "temp");
+    return join8(this.cwd, "temp");
   }
   async prepare() {
     await mkdir4(this.tempDir, { recursive: true, mode: 448 });
   }
-  async writeTempFile(name2, content2, signal) {
+  async writeTempFile(name3, content2, signal) {
     await this.prepare();
-    const path = join6(this.tempDir, name2);
+    const path = join8(this.tempDir, name3);
     await writeFile3(path, content2, { encoding: "utf8", flag: "wx", mode: 384, signal });
     return path;
   }
 };
 
+// src/server/infra/files/skills.ts
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4 } from "node:fs";
+import { mkdir as mkdir5, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname6, join as join9 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/server/shared/skill.ts
+var skillPath = (name3) => `skills/${name3}/SKILL.md`;
+
+// src/server/infra/files/skills.ts
+function builtinSkills() {
+  const dir = skillsDir();
+  if (!dir) return [];
+  const skills = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const file = join9(dir, entry.name, "SKILL.md");
+    if (!existsSync4(file)) continue;
+    const skill = parseSkill(entry.name, readFileSync4(file, "utf8"));
+    if (skill) skills.push(skill);
+    else console.warn(`Jarvy: skipped the skill in ${entry.name}: SKILL.md needs a name matching its folder and a description`);
+  }
+  return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function installSkills(workspace, skills) {
+  for (const skill of skills) {
+    const file = join9(workspace, skillPath(skill.name));
+    await mkdir5(dirname6(file), { recursive: true });
+    await writeFile4(file, skill.content, "utf8");
+  }
+}
+function skillsDir() {
+  let dir = dirname6(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth++) {
+    if (existsSync4(join9(dir, "package.json"))) return existsSync4(join9(dir, "skills")) ? join9(dir, "skills") : null;
+    const parent = dirname6(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function parseSkill(folder, content2) {
+  const head = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/.exec(content2);
+  if (!head) return null;
+  const field2 = (key) => new RegExp(`^${key}:\\s*(.+)$`, "m").exec(head[1])?.[1]?.trim() ?? "";
+  const name3 = field2("name"), description = field2("description");
+  if (name3 !== folder || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name3) || !description) return null;
+  return { name: name3, description, content: content2 };
+}
+
 // src/server/service/bot/workspace.ts
 var MAX_FILE = 10 * 1024 * 1024;
 var Workspace = class {
-  constructor(cwd, current, home) {
+  constructor(cwd, current, home, skills = []) {
     this.current = current;
     this.home = home;
+    this.skills = skills;
     this.local = new LocalWorkspace(cwd);
   }
   local;
-  prepare() {
-    return this.local.prepare();
+  async prepare() {
+    await this.local.prepare();
+    await installSkills(this.local.cwd, this.skills);
   }
   /** A file in the temporary directory of the environment the Bot works in, by the path it sees there. */
-  async writeTempFile(name2, content2, signal) {
+  async writeTempFile(name3, content2, signal) {
     const env = this.current();
-    if (env.kind === "host") return this.local.writeTempFile(name2, content2, signal);
-    const path = `${env.cwd}/temp/${name2}`;
+    if (env.kind === "host") return this.local.writeTempFile(name3, content2, signal);
+    const path = `${env.cwd}/temp/${name3}`;
     await env.writeFile(path, content2);
     return path;
   }
   /** Puts a chat file into the Bot's environment: at `path`, or in temp/files/ under its own name (with part of its
    * id when another file has that name). Returns where it went. */
-  async put(name2, id, data, path) {
+  async put(name3, id, data, path) {
     const env = this.current();
-    let target2 = path ? posix.resolve(env.cwd, path) : `${env.cwd}/temp/files/${plain(name2)}`;
+    let target2 = path ? posix.resolve(env.cwd, path) : `${env.cwd}/temp/files/${plain(name3)}`;
     if (!path && await env.exists(target2)) {
-      const dot = plain(name2).lastIndexOf("."), stem = dot > 0 ? plain(name2).slice(0, dot) : plain(name2), extension = dot > 0 ? plain(name2).slice(dot) : "";
-      target2 = `${env.cwd}/temp/files/${stem}-${id.slice(0, 8)}${extension}`;
+      const dot = plain(name3).lastIndexOf("."), stem = dot > 0 ? plain(name3).slice(0, dot) : plain(name3), extension2 = dot > 0 ? plain(name3).slice(dot) : "";
+      target2 = `${env.cwd}/temp/files/${stem}-${id.slice(0, 8)}${extension2}`;
     }
     await env.mkdir(posix.dirname(target2));
     await env.writeFile(target2, data);
@@ -5944,8 +6795,8 @@ var Workspace = class {
     return { type: "local", cwd: this.local.cwd, tempDir: this.local.tempDir };
   }
 };
-function plain(name2) {
-  const cleaned = name2.replace(/[/\\\0]/g, "_").trim();
+function plain(name3) {
+  const cleaned = name3.replace(/[/\\\0]/g, "_").trim();
   return cleaned && cleaned !== "." && cleaned !== ".." ? cleaned : "file";
 }
 
@@ -5970,7 +6821,7 @@ import { Type as Type5 } from "typebox";
 import { Value } from "typebox/value";
 
 // src/server/service/bot/history-read.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { Type as Type2 } from "typebox";
 
 // src/server/service/bot/history-format.ts
@@ -6050,8 +6901,8 @@ async function readHistory(memory, workspace, input, signal) {
   const rendered = formatHistory(result, format);
   signal?.throwIfAborted();
   if (!input.to_file) return rendered;
-  const name2 = `history-${randomUUID10()}.${format === "json" ? "json" : "md"}`;
-  return workspace.writeTempFile(name2, rendered, signal);
+  const name3 = `history-${randomUUID11()}.${format === "json" ? "json" : "md"}`;
+  return workspace.writeTempFile(name3, rendered, signal);
 }
 
 // src/server/service/bot/file-view.ts
@@ -6087,8 +6938,8 @@ function asText(data) {
 }
 
 // src/server/service/bot/chat-views.ts
-var iso = (time) => new Date(time).toISOString();
-var name = (chats) => (memberId) => chats.member(memberId)?.name ?? memberId;
+var iso = (time2) => new Date(time2).toISOString();
+var name2 = (chats) => (memberId) => chats.member(memberId)?.name ?? memberId;
 function chatRows(chats, botId) {
   const sections = new Map(chats.channels.sections(botId).map((section) => [section.id, section.name]));
   const row = (chat) => ({
@@ -6122,7 +6973,7 @@ function chatDetail(chats, botId, chat) {
       parent: chat.parentId,
       status: chat.status,
       following: chat.following,
-      root: root ? { id: root.id, from: root.sender.name, content: expandQuotes(root.content, root.quotes, name(chats)), at: iso(root.createdAt) } : null
+      root: root ? { id: root.id, from: root.sender.name, content: expandQuotes(root.content, root.quotes, name2(chats)), at: iso(root.createdAt) } : null
     } : {},
     members,
     notice: chat.note ? { text: chat.note.text, version: chat.note.version, by: chat.note.updatedBy.name, at: iso(chat.note.updatedAt) } : null,
@@ -6152,7 +7003,7 @@ function messageRow(chats, botId, message, attachments, chat) {
     ...chat ? { chat: { id: chat.id, type: chat.type, title: chat.title } } : {},
     from: message.sender.name,
     at: iso(message.createdAt),
-    text: expandQuotes(message.content, message.quotes, name(chats)),
+    text: expandQuotes(message.content, message.quotes, name2(chats)),
     ...attachments.length ? { attachments } : {},
     ...message.mentions.length ? { mentions: message.mentions.map((id) => chats.member(id)?.name ?? id) } : {},
     ...message.thread ? { thread: { id: message.thread.id, title: message.thread.title, status: message.thread.status, replies: message.thread.replies } } : {},
@@ -6191,7 +7042,7 @@ var ChatTools = class {
   /** Members by name (case-insensitive, a leading @ allowed); unknown names are an error that lists them. */
   members(names) {
     const directory = this.chats.channels.directory(this.bot);
-    const found = names.map((name2) => ({ name: name2, member: directory.find((member) => same(name2, member.name)) }));
+    const found = names.map((name3) => ({ name: name3, member: directory.find((member) => same(name3, member.name)) }));
     const missing = found.filter((item) => !item.member).map((item) => item.name);
     if (missing.length) throw new ChatError(404, `No member named: ${missing.join(", ")} (see members.list)`);
     return found.map((item) => item.member);
@@ -6416,6 +7267,15 @@ var definitions = {
     description: "Move your file and command tools (bash, read, write, edit) to another work environment from environments.list, like cd one level up: you stay there, across turns, until you switch back. The result has your directory there and what you can do there. Commands already running finish where they started.",
     schema: Type3.Object({ id: Type3.String({ minLength: 1, maxLength: 80, description: "The environment's id from environments.list" }) }, { additionalProperties: false })
   },
+  "secrets.request": {
+    description: 'Ask your owner for a secret you need (a token, password or key) on a card in a chat with them, and wait for the answer, as messages.ask does. They enter the value on the card, which never shows it in the chat, and let you use it until they revoke it or only until this run ends, or decline. It returns {status:"granted", placeholder, until} or {status:"declined"}; if you may already use it, it returns at once. Then write the placeholder in bash.',
+    schema: Type3.Object({
+      chatId: Type3.String(),
+      name: Type3.String({ pattern: "^[A-Z][A-Z0-9_]{0,63}$", description: "Capital letters, digits and underscores, such as GITHUB_TOKEN" }),
+      purpose: Type3.String({ minLength: 1, maxLength: 300, description: "What you need it for, in your owner's language; shown on the card" })
+    }, { additionalProperties: false })
+  },
+  "secrets.list": { description: "List the secrets (tokens, passwords) your owner lets you use: each name, its placeholder and what it is for, never the value. To use one, write its placeholder, such as {{secret:GITHUB_TOKEN}}, in a bash command: it is filled in for that command only and shown masked in the output.", schema: None },
   "files.view": {
     description: "Look at a file from a message without putting it anywhere: a picture (PNG, JPEG, GIF or WebP, up to 4 MB) is shown to you, and a text file up to 64 KB comes back as text. Anything else needs files.get.",
     schema: Type3.Object({ id: FileId }, { additionalProperties: false })
@@ -6425,7 +7285,7 @@ var definitions = {
     schema: Type3.Object({ messageId: MessageId, emoji: Type3.String({ minLength: 1, maxLength: 32, description: "A single emoji, such as \u{1F44D}" }), on: Type3.Optional(Type3.Boolean()) }, { additionalProperties: false })
   },
   "messages.ask": {
-    description: `Post a multiple-choice card in a chat you are in and wait for the person's answer. It returns {status:"answered", selected:[{label,value}], custom}, or {status:"dismissed"} if they closed the question without answering. Use it when someone needs to choose or confirm (a plan, a preference, whether to go on with something risky); ask open questions with messages.send. options: 1\u20136; multiple allows several choices; allowCustom lets them write their own answer (custom). If, while you wait, the person sends a new message, cancels this turn or stops the Bot, the call is interrupted and the new message arrives in the next batch. Only people can answer, so it can't be used in chats without one (such as a DM between Bots). Never use it to ask for passwords or keys.`,
+    description: `Post a multiple-choice card in a chat you are in and wait for the person's answer. It returns {status:"answered", selected:[{label,value}], custom}, or {status:"dismissed"} if they closed the question without answering. If the chat had messages you hadn't read, before the card or while it waited, it also gives their count (unread) and a note on where to read them. Use it when someone needs to choose or confirm (a plan, a preference, whether to go on with something risky); ask open questions with messages.send. options: 1\u20136; multiple allows several choices; allowCustom lets them write their own answer (custom). If, while you wait, the person sends a new message, cancels this turn or stops the Bot, the call is interrupted and the new message arrives in the next batch. Only people can answer, so it can't be used in chats without one (such as a DM between Bots). Never use it to ask for passwords, tokens or keys: use secrets.request.`,
     schema: Type3.Object({
       chatId: Type3.String(),
       question: Type3.String({ minLength: 1, maxLength: 500 }),
@@ -6436,7 +7296,7 @@ var definitions = {
     }, { additionalProperties: false })
   },
   "messages.send": {
-    description: "Send a message, with files from your environment if you like (path there, absolute or relative to your directory, and the name people see). Give chatId or to, not both: to is a member's name and sends them a DM (a person or a Bot; the first time creates the DM). Only messages sent successfully are visible in the chat. In channels and threads, only the members whose @name is in the text and the members subscribed there receive it; DMs need no @. The result lists who was @-mentioned (notified), who got it through a subscription (subscribers), and the names that aren't in the channel and weren't told. thread: the ID of a message in the channel, to reply in that message's thread (created if it has none; chatId is the channel). replyTo: the ID of a message in the same chat, to reply to it as a quote; this tells its author, like an @. When replying in a thread, alsoToChannel=true also posts a copy to the channel.",
+    description: "Send a message, with files from your environment if you like (path there, absolute or relative to your directory, and the name people see). Give chatId or to, not both: to is a member's name and sends them a DM (a person or a Bot; the first time creates the DM). Only messages sent successfully are visible in the chat. In channels and threads, only the members whose @name is in the text and the members subscribed there receive it; DMs need no @. The result lists who was @-mentioned (notified), who got it through a subscription (subscribers), and the names that aren't in the channel and weren't told. If the chat had messages you hadn't read, it also gives their count (unread) and a note on where to read them: sending marks them read, so read from the after it names. thread: the ID of a message in the channel, to reply in that message's thread (created if it has none; chatId is the channel). replyTo: the ID of a message in the same chat, to reply to it as a quote; this tells its author, like an @. When replying in a thread, alsoToChannel=true also posts a copy to the channel.",
     schema: Type3.Object({
       chatId: Type3.Optional(Type3.String()),
       to: Type3.Optional(Type3.String({ minLength: 1, maxLength: 80 })),
@@ -6501,8 +7361,8 @@ var AgentTools = class {
     if (chat.type !== "channel") throw new ChatError(400, "Not a channel");
     return chat;
   }
-  async call(name2, args, ask) {
-    switch (name2) {
+  async call(name3, args, ask) {
+    switch (name3) {
       case "models.list":
         return this.ops.models();
       case "bots.create": {
@@ -6518,7 +7378,7 @@ var AgentTools = class {
       case "bots.start":
       case "bots.stop": {
         const bot = this.ops.bot(args.bot);
-        return { name: bot.name, status: await this.ops.run(bot, name2 === "bots.start" ? "start" : "stop") };
+        return { name: bot.name, status: await this.ops.run(bot, name3 === "bots.start" ? "start" : "stop") };
       }
       case "bots.usage": {
         const input = args, bot = this.ops.bot(input.bot);
@@ -6651,6 +7511,17 @@ var Tools = class {
       if (!signal?.aborted) this.scope.asking?.(false);
     }
   }
+  /** Where the Bot had read up to in a chat, and how many messages it hadn't, before it writes there (A53). Sending
+   * moves its read position past them, so this is taken first. A thread counts only itself. */
+  readState(chatId) {
+    const chat = this.scope.chats.get(this.scope.botId, chatId);
+    return { unread: chat?.unread ?? 0, after: chat?.readSequence ?? 0 };
+  }
+  /** Others' messages it hadn't read (delivered ones arrive in its batches anyway), and where to read them from. */
+  unreadHint(count, after2) {
+    const one = count === 1;
+    return count ? { unread: count, note: `${count} message${one ? "" : "s"} here you hadn't read. Read ${one ? "it" : "them"} with messages.read (chatId, after=${after2}), which may also bring back messages you already have, and follow up if ${one ? "it changes" : "they change"} where things stand.` } : {};
+  }
   bindSend(send) {
     this.send = send;
   }
@@ -6664,19 +7535,19 @@ var Tools = class {
         signal?.throwIfAborted();
         if (raw.action === "list") {
           if (raw.tool !== void 0 || raw.args !== void 0) throw new ChatError(400, "list does not accept tool or args");
-          return Object.entries(this.catalog).map(([name3, tool]) => ({ name: name3, description: tool.description }));
+          return Object.entries(this.catalog).map(([name4, tool]) => ({ name: name4, description: tool.description }));
         }
         if (!raw.tool || !Object.hasOwn(this.catalog, raw.tool)) throw new ChatError(400, "Unknown chat tool; use list first");
-        const name2 = raw.tool, definition = this.catalog[name2];
+        const name3 = raw.tool, definition = this.catalog[name3];
         if (raw.action === "describe") {
           if (raw.args !== void 0) throw new ChatError(400, "describe does not accept args");
-          return { name: name2, description: definition.description, parameters: definition.schema };
+          return { name: name3, description: definition.description, parameters: definition.schema };
         }
         const args = raw.args;
         if (!args || !Value.Check(definition.schema, args)) throw new ChatError(400, "Invalid tool arguments; use describe for the parameter schema");
-        if (this.agent && Object.hasOwn(agentDefinitions, name2))
-          return this.agent.call(name2, args, (chatId, question) => this.ask(chatId, question, toolCallId, signal));
-        switch (name2) {
+        if (this.agent && Object.hasOwn(agentDefinitions, name3))
+          return this.agent.call(name3, args, (chatId, question) => this.ask(chatId, question, toolCallId, signal));
+        switch (name3) {
           case "history.read":
             return readHistory(this.scope.memory, this.scope.workspace, args, signal);
           case "chats.list":
@@ -6696,6 +7567,23 @@ var Tools = class {
             return this.scope.places.list();
           case "environments.switch":
             return this.scope.places.switch(args.id);
+          case "secrets.list":
+            return this.scope.secrets.list();
+          case "secrets.request": {
+            const parsed = args;
+            if (!this.tools.chat(parsed.chatId).memberIds.some((id) => this.scope.chats.member(id)?.kind === "user")) throw new ChatError(400, "No person in this chat to answer; ask in a chat with your owner");
+            const prepared = this.scope.secrets.prepare(parsed.name, parsed.purpose.trim());
+            if ("granted" in prepared) return { status: "granted", name: parsed.name, placeholder: placeholder(parsed.name), note: "You may already use it" };
+            const result = await this.ask(parsed.chatId, prepared.question, toolCallId, signal);
+            if (result.status !== "answered") return { messageId: result.messageId, status: "declined", note: "Your owner declined. Don't ask for the value in the chat; go on without it, or ask what they would like instead." };
+            return {
+              messageId: result.messageId,
+              status: "granted",
+              name: parsed.name,
+              placeholder: placeholder(parsed.name),
+              until: result.selected[0]?.value === "once" ? "this run ends" : "your owner revokes it"
+            };
+          }
           case "chats.create":
             return this.tools.create(args);
           case "chats.update":
@@ -6752,6 +7640,7 @@ var Tools = class {
               if (!root || root.chatId !== chatId) throw new ChatError(404, "Message not found in this channel");
               chatId = this.scope.chats.threads.open(this.scope.botId, parsed.thread).id;
             }
+            const before = this.readState(chatId);
             const sent = await this.send(chatId, {
               content: parsed.message,
               attachments: parsed.attachments,
@@ -6761,17 +7650,18 @@ var Tools = class {
               signal
             });
             const chat = this.scope.chats.get(this.scope.botId, chatId);
-            if (!chat || chat.type === "dm") return { messageId: sent.id, chatId: sent.chatId, sequence: sent.sequence };
+            if (!chat || chat.type === "dm") return { messageId: sent.id, chatId: sent.chatId, sequence: sent.sequence, ...this.unreadHint(before.unread, before.after) };
             const report = this.scope.chats.channels.mentionReport(this.scope.botId, chatId, parsed.message);
-            const notified = sent.mentions.map((id) => this.scope.chats.member(id)?.name).filter((name3) => !!name3);
-            const subscribers = this.scope.chats.channels.subscribers(this.scope.botId, chatId).map((member) => member.name).filter((name3) => name3 !== this.scope.chats.member(this.scope.botId)?.name && !notified.includes(name3));
+            const notified = sent.mentions.map((id) => this.scope.chats.member(id)?.name).filter((name4) => !!name4);
+            const subscribers = this.scope.chats.channels.subscribers(this.scope.botId, chatId).map((member) => member.name).filter((name4) => name4 !== this.scope.chats.member(this.scope.botId)?.name && !notified.includes(name4));
             return {
               messageId: sent.id,
               chatId: sent.chatId,
               sequence: sent.sequence,
               notified,
               ...subscribers.length ? { subscribers } : {},
-              ...report.notInChannel.length ? { notInChannel: report.notInChannel } : {}
+              ...report.notInChannel.length ? { notInChannel: report.notInChannel } : {},
+              ...this.unreadHint(before.unread, before.after)
             };
           }
           case "messages.ask": {
@@ -6784,7 +7674,9 @@ var Tools = class {
               multiple: parsed.multiple === true,
               allowCustom: parsed.allowCustom === true
             };
-            return this.ask(parsed.chatId, question, toolCallId, signal);
+            const chatId = this.tools.chat(parsed.chatId).id, before = this.readState(chatId);
+            const answer = await this.ask(chatId, question, toolCallId, signal);
+            return { ...answer, ...this.unreadHint(before.unread + this.readState(chatId).unread, before.after) };
           }
         }
       }
@@ -6793,7 +7685,7 @@ var Tools = class {
 };
 
 // src/server/service/bot/inbox.ts
-import { join as join7, dirname as dirname6 } from "node:path";
+import { join as join10, dirname as dirname7 } from "node:path";
 
 // src/server/shared/agent.ts
 var WELCOME_LANGUAGES = { en: "English", zh: "Chinese" };
@@ -6805,9 +7697,9 @@ function escape(value2) {
   if (INVALID_XML.test(value2)) throw new Error("Invalid XML character");
   return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\r/g, "&#13;");
 }
-function attribute(name2, value2) {
-  if (!value2.trim()) throw new Error(`Missing ${name2}`);
-  return ` ${name2}="${escape(value2).replace(/"/g, "&quot;").replace(/\n/g, "&#10;").replace(/\t/g, "&#9;")}"`;
+function attribute(name3, value2) {
+  if (!value2.trim()) throw new Error(`Missing ${name3}`);
+  return ` ${name3}="${escape(value2).replace(/"/g, "&quot;").replace(/\n/g, "&#10;").replace(/\t/g, "&#9;")}"`;
 }
 function remember(map, id, definition) {
   const old = map.get(id);
@@ -6815,7 +7707,7 @@ function remember(map, id, definition) {
   map.set(id, definition);
 }
 var environmentLine = (place) => place ? `<environment${attribute("name", place.name)}${attribute("directory", place.directory)}/>` : "";
-var iso2 = (time) => new Date(time).toISOString().replace(".000Z", "Z");
+var iso2 = (time2) => new Date(time2).toISOString().replace(".000Z", "Z");
 var welcome = (owner, language) => `${owner} has just set up Jarvy and picked your model. You are their agent Bot. In this DM, welcome them in ${WELCOME_LANGUAGES[language]}, the language of their interface: say in a few sentences what Jarvy is and how you can help, such as building a team of Bots for their work and running Jarvy for them. Then ask what they want to get done: a software project, writing, research or something else.`;
 function encodeNoticeBatch(botId, notices, environment) {
   if (!notices.length) throw new Error("Empty notice batch");
@@ -6885,7 +7777,7 @@ var BotInbox = class {
   }
   reference(workspace) {
     if (this.repository.hasUncertainModel(this.botId)) throw new RuntimeFault("model_switch_uncertain", "The model switch didn't finish. Pick the model again.");
-    return this.repository.ensureSession(this.botId, join7(dirname6(workspace), "agent", "pi", "sessions", `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.jsonl`));
+    return this.repository.ensureSession(this.botId, join10(dirname7(workspace), "agent", "pi", "sessions", `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.jsonl`));
   }
   /** XML for the claimed messages plus the tail (other deliveries not told yet, unread); `notices` are told once
    * the batch is submitted. */
@@ -6957,7 +7849,7 @@ var AgentRuntime = class {
   }
   update(patch) {
     const context2 = this.session?.context;
-    this.status = { ...this.status, ...patch, context: context2 ? { tokens: context2.tokens, limit: context2.contextWindow } : null };
+    this.status = { ...this.status, ...patch, context: context2 ? { tokens: context2.tokens, limit: context2.contextWindow, stale: context2.stale } : null };
     this.setup?.onStatus(this.status);
   }
   activity(phase) {
@@ -7058,7 +7950,7 @@ var AgentRuntime = class {
           repository.releaseUnsubmitted(batch.run.id);
           continue;
         }
-        const { xml, notices } = prepared;
+        const { xml: xml2, notices } = prepared;
         if (this.stopping || this.pauses || version !== this.inputVersion) {
           repository.releaseUnsubmitted(batch.run.id);
           continue;
@@ -7067,7 +7959,7 @@ var AgentRuntime = class {
         submitted = true;
         this.prompting = true;
         this.inbox.acknowledge(notices);
-        this.promptTask = session.prompt(xml);
+        this.promptTask = session.prompt(xml2);
         const result = await this.promptTask;
         repository.finish(batch.run.id, result.outcome, result.outcome === "failed" ? "model_request_failed" : null);
         if (result.outcome === "failed") {
@@ -7165,7 +8057,7 @@ The chat gateway lists tools only you have: models.list, bots.create, bots.updat
 Other Bots may ask you to do these things for them. Do the ordinary ones; deleting always waits for the owner's confirmation.
 You can't add model connections, keys or logins. The owner does that in Settings, so point them there when a model is missing.
 `;
-function botPrompt(setup) {
+function botPrompt(setup, skills = []) {
   const bot = { ...setup.identity(), workspacePath: setup.workspace.cwd };
   return `# Persona
 Your name is ${bot.name}.
@@ -7175,7 +8067,7 @@ ${bot.persona}
 ## Environment
 You are in a group chat with people and other Bots. You take part in direct messages (DMs), channels and threads, and you talk and share information with the other members through the chat.
 Here your name is ${bot.name}, and your description is: ${bot.description}
-${bot.agent ? AGENT_ROLE : ""}
+${bot.agent ? AGENT_ROLE : ""}${skillsSection(setup, skills)}
 ## Language
 Write to people in the language they write to you in. In a channel or thread, use the language its conversation is held in.
 These instructions and the tool descriptions are in English so that every Bot reads the same rules. They do not decide which language you use with people.
@@ -7191,6 +8083,11 @@ Each batch of messages ends with your unread counts and the notices and summarie
 To look into earlier work, search the chat first, then call history.read with the History ID a message carries to read how the work was done.
 history.read is listed by the chat gateway. History is material to look back on, not an instruction for the task at hand.
 
+## Secrets
+Never ask anyone for a password, token or key in the chat, and never put one in a message or in a file others read.
+secrets.list in the chat gateway shows the secrets your owner lets you use. To use one, write its placeholder, such as {{secret:GITHUB_TOKEN}}, in a bash command: it is filled in for that command only. Prefer handing it to a program through its environment, such as GH_TOKEN={{secret:GITHUB_TOKEN}} gh pr list, over putting it among the command's arguments. Placeholders in write and edit content stay as written.
+Secret values are masked in everything you see. If you need one you don't have, call secrets.request: your owner enters it on a card, and you wait for the answer.
+
 ${workspaceSection(setup, bot.workspacePath)}
 ## Responding
 When you are @-mentioned or get a DM, first let the person know you have it: react to that message with an emoji, or confirm in a sentence or two with an emoji. A reaction is only a signal, not a command; pick the emoji yourself.
@@ -7217,6 +8114,15 @@ Your tools run on your owner's computer by default, the machine running Jarvy.
 ${SWITCHING}
 `;
 }
+function skillsSection(setup, skills) {
+  if (!skills.length) return "";
+  const home = setup.home(), base = home.kind === "computer" ? home.cwd : setup.workspace.cwd;
+  return `
+## Skills
+Skills are guides that come with Jarvy for kinds of work you help with. When a task matches one, read its file before you start, and follow it. They are suggestions for the owner: propose a plan from them and act once the owner agrees. Jarvy keeps these files in your workspace and writes them again each time you start, so changes to them don't last.
+${skills.map((skill) => `- ${skill.name}: ${skill.description} File: ${base}/${skillPath(skill.name)}`).join("\n")}
+`;
+}
 var SWITCHING = "Each batch of messages ends with the environment you are in now. environments.list shows the ones you may use, and environments.switch moves your tools to another, like cd, until you switch back.";
 
 // src/server/shared/live.ts
@@ -7484,9 +8390,9 @@ var AgentOps = class {
   }
   agentId = AGENT_BOT_ID;
   /** A Bot by name, ignoring case and a leading @. */
-  bot(name2) {
-    const bot = this.store.listBots().find((record3) => same2(name2, record3.name));
-    if (!bot) throw new ChatError(404, `No Bot named ${name2} (see bots.list)`);
+  bot(name3) {
+    const bot = this.store.listBots().find((record3) => same2(name3, record3.name));
+    if (!bot) throw new ChatError(404, `No Bot named ${name3} (see bots.list)`);
     return bot;
   }
   /** Connected models and their thinking levels; never credentials. */
@@ -7604,6 +8510,8 @@ var BotService = class {
   started = false;
   /** What only the agent Bot does (A48). */
   agent;
+  /** The skills that ship with Jarvy, for the agent Bot (A55). */
+  skills = builtinSkills();
   listChanged() {
     this.deps.listChanged?.();
   }
@@ -7613,7 +8521,7 @@ var BotService = class {
     if (!record3) throw new RuntimeFault("bot_missing", "Bot not found", 404);
     let bot = this.bots.get(id);
     if (bot) return bot;
-    const { store, chats, files, credentials } = this.deps, live = this.live(id);
+    const { store, chats, files, credentials } = this.deps, live = this.live(id), skills = id === AGENT_BOT_ID ? this.skills : [];
     const here = () => {
       const place = this.environments.here(id, record3.workspacePath);
       return { name: place.name, directory: place.directory };
@@ -7625,17 +8533,18 @@ var BotService = class {
       reference,
       credentials,
       tools: setup.tools,
-      systemPrompt: () => botPrompt(setup),
+      systemPrompt: () => botPrompt(setup, skills),
       onHistory: setup.onHistory,
       activity,
       live: (event) => live.event(event),
-      environment: () => this.environments.current(id, record3.workspacePath)
+      environment: () => this.environments.current(id, record3.workspacePath),
+      secrets: this.deps.secrets.forBot(id)
     }));
     const workspace = new Workspace(record3.workspacePath, () => this.environments.current(id, record3.workspacePath), () => {
       const place = this.environments.home(id, record3.workspacePath);
       return { kind: place.kind === "sandbox" ? "computer" : "host", cwd: place.directory };
-    });
-    const memory = new Memory(join8(dirname7(record3.workspacePath), "history.db"));
+    }, skills);
+    const memory = new Memory(join11(dirname8(record3.workspacePath), "history.db"));
     bot = new Bot(id, {
       identity: new Identity(id, store),
       model: new Model(id, store, resolveThinking),
@@ -7654,6 +8563,7 @@ var BotService = class {
           switch: (environmentId) => this.environments.switch(id, environmentId, record3.workspacePath),
           summary: (botId) => this.environments.summary(botId)
         },
+        secrets: { list: () => this.deps.secrets.listFor(id), prepare: (name3, purpose) => this.deps.secrets.prepareRequest(id, name3, purpose) },
         ...id === AGENT_BOT_ID ? { agent: this.agent } : {}
       }),
       agentRuntime: runtime,
@@ -7708,10 +8618,10 @@ var BotService = class {
     return this.deps.store.listBots().map((record3) => this.details(record3));
   }
   /** A new Bot works in its sandbox when this machine has Docker, unless asked for the owner's computer (A50). */
-  create(name2, environment) {
+  create(name3, environment) {
     const kind = environment ?? (this.computers.available ? "computer" : "host");
     if (kind === "computer" && !this.computers.available) throw new RuntimeFault("docker_unavailable", "Docker is not available on this machine.", 409);
-    const record3 = this.deps.store.createBot(name2);
+    const record3 = this.deps.store.createBot(name3);
     this.environments.setHome(record3.id, kind, record3.workspacePath);
     return this.details(record3);
   }
@@ -7731,7 +8641,7 @@ var BotService = class {
   }
   /** Tells a Bot what its owner changed about where it works (A41, A50). A move interrupts a running turn, as an
    * @-mention does, so the Bot doesn't go on in the old place; a Bot not running, or a change of access alone, is
-   * told with its next batch (fish m1012–m1015). */
+   * told with its next batch. */
   tellOwner(id, changes, move) {
     if (!this.record(id).connectionId) return;
     const owner = this.deps.store.userMemberId(), chatId = this.deps.chats.openDirect(owner, id).id;
@@ -7854,7 +8764,7 @@ var BotService = class {
     this.lives.delete(id);
     await this.environments.release(id);
     if (!this.deps.store.deleteBot(id)) throw new RuntimeFault("bot_missing", "Bot not found", 404);
-    if (!keepFiles) await rm3(dirname7(workspacePath), { recursive: true, force: true });
+    if (!keepFiles) await rm3(dirname8(workspacePath), { recursive: true, force: true });
   }
   async close() {
     if (this.closed) return;
@@ -7866,6 +8776,152 @@ var BotService = class {
 };
 var where = (moved) => `${moved.to.name}, in ${moved.to.directory}`;
 
+// src/server/service/connection.ts
+var ALLOW_HTTP = "allow_http";
+var ConnectionService = class {
+  constructor(store, dataDir) {
+    this.store = store;
+    this.dataDir = dataDir;
+  }
+  material = null;
+  listening = null;
+  /** Called once before listening: the certificate to serve, or null when Jarvy stays on this machine. */
+  prepare(host, port) {
+    this.listening = { host, port };
+    this.material = isLoopbackHost(host) ? null : certificates(this.dataDir, host, this.store.cipher);
+    return this.material;
+  }
+  allowHttp() {
+    return this.store.settings.get(ALLOW_HTTP) === "1";
+  }
+  setAllowHttp(allow) {
+    this.store.settings.set(ALLOW_HTTP, allow ? "1" : null);
+    return this.info();
+  }
+  info() {
+    const listening = this.listening, material = this.material;
+    const addresses = listening && material ? lanAddresses(listening.host).map((address) => `https://${address.includes(":") ? `[${address}]` : address}:${listening.port}`) : [];
+    return { https: !!material, allowHttp: this.allowHttp(), addresses, fingerprint: material?.fingerprint ?? null };
+  }
+  /** The root certificate (DER) for devices to install, when serving HTTPS. */
+  rootCertificate() {
+    return this.material?.rootDer ?? null;
+  }
+};
+
+// src/server/service/secrets.ts
+var SCOPES = ["always", "once"];
+var SecretService = class {
+  constructor(store, chats) {
+    this.store = store;
+    this.chats = chats;
+  }
+  /** Built from every value on first need, again after any change. */
+  cached = null;
+  list() {
+    return { secrets: this.store.secrets.list(), keyLocation: this.store.cipher.location() };
+  }
+  create(input) {
+    const made = this.store.secrets.create(input);
+    this.cached = null;
+    return made;
+  }
+  update(id, input) {
+    const updated = this.store.secrets.update(id, input) ?? this.missing();
+    this.cached = null;
+    return updated;
+  }
+  delete(id) {
+    if (!this.store.secrets.delete(id)) this.missing();
+    this.cached = null;
+  }
+  /** Grants until revoked, from Settings; a card's "this time only" comes with the request card. */
+  grant(id, botId, granted) {
+    const secret = this.store.secrets.get(id) ?? this.missing();
+    if (secret.kind !== "value") throw new RuntimeFault("secret_missing", "No secret with this id", 404);
+    if (!this.store.getBot(botId)) throw new RuntimeFault("bot_missing", "Bot not found", 404);
+    if (granted) this.store.secrets.grant(id, botId, "always", null);
+    else this.store.secrets.revoke(id, botId);
+    return this.store.secrets.get(id);
+  }
+  uses(id) {
+    if (!this.store.secrets.get(id)) this.missing();
+    return this.store.secrets.uses(id);
+  }
+  masker() {
+    return this.cached ??= new Masker(this.store.secrets.values());
+  }
+  /** secrets.list: what the Bot may use, never a value. */
+  listFor(botId) {
+    const secrets = this.store.secrets.grantedTo(botId).map(({ name: name3, description, scope }) => ({
+      name: name3,
+      placeholder: placeholder(name3),
+      ...description ? { description } : {},
+      ...scope === "once" ? { until: "this run ends" } : {}
+    }));
+    return { secrets, ...secrets.length ? {} : { note: "None yet. If you need one, use secrets.request; never ask for a value in the chat." } };
+  }
+  /** secrets.request: nothing to ask when the Bot may already use it; else the card to post. */
+  prepareRequest(botId, name3, purpose) {
+    if (!SECRET_NAME.test(name3)) throw new ChatError(400, "Secret names are capital letters, digits and underscores, starting with a letter, such as GITHUB_TOKEN");
+    const existing = this.store.secrets.byName(name3), readable = !!existing?.readable;
+    if (readable && this.store.secrets.grantedTo(botId).some((secret) => secret.name === name3)) return { granted: true };
+    return { question: {
+      question: purpose,
+      options: [{ label: "Keep allowing", value: "always" }, { label: "This time only", value: "once" }],
+      multiple: false,
+      allowCustom: false,
+      secret: { name: name3, purpose, exists: !!existing, needsValue: !readable }
+    } };
+  }
+  /** The owner's answer on a request card: saves the value when one is given (a new secret, or a new value for it),
+   * grants it to the Bot that asked, then settles the card. The value never enters the message. */
+  fulfil(actorId, chatId, messageId, input) {
+    const message = this.chats.message(actorId, messageId);
+    const ask = message?.question?.secret;
+    if (!message || message.chatId !== chatId || !ask || message.question?.state !== "pending") throw new ChatError(409, "The question is already settled", "question_closed");
+    if (!this.chats.questions.waitingFor(messageId)) throw new ChatError(409, "The question has expired", "question_expired");
+    const scope = SCOPES.find((item) => item === input.scope);
+    if (!scope) throw new ChatError(400, "scope must be always or once");
+    const botId = message.sender.id, value2 = input.value === void 0 || input.value === "" ? void 0 : input.value;
+    let secret = this.store.secrets.byName(ask.name);
+    if (!secret) secret = this.store.secrets.create({ name: ask.name, description: ask.purpose.replace(/\s+/g, " ").slice(0, 200), value: value2 ?? "" });
+    else if (value2 !== void 0) secret = this.store.secrets.update(secret.id, { value: value2 });
+    else if (!secret.readable) throw new ChatError(400, "A secret needs a value", "secret_value_missing");
+    this.cached = null;
+    this.store.secrets.grant(secret.id, botId, scope, scope === "once" ? this.store.secrets.currentRun(botId) : null);
+    return this.chats.questions.respond(actorId, chatId, messageId, { action: "answer", selected: [SCOPES.indexOf(scope)] });
+  }
+  /** One Bot's access, for its runs. */
+  forBot(botId) {
+    return {
+      resolve: (names) => {
+        const granted = new Map(this.store.secrets.grantedTo(botId).map((secret) => [secret.name, secret.id]));
+        const refused = names.filter((name3) => !granted.has(name3));
+        if (refused.length) return { refused };
+        const values = {};
+        for (const name3 of names) {
+          const value2 = this.store.secrets.value(granted.get(name3));
+          if (value2 === null) return { refused: [name3] };
+          values[name3] = value2;
+        }
+        return { values };
+      },
+      record: (names, use) => {
+        const granted = new Map(this.store.secrets.grantedTo(botId).map((secret) => [secret.name, secret.id]));
+        for (const name3 of names) {
+          const secretId = granted.get(name3);
+          if (secretId) this.store.secrets.record({ secretId, name: name3, botId, how: "command", ...use });
+        }
+      },
+      masker: () => this.masker()
+    };
+  }
+  missing() {
+    throw new RuntimeFault("secret_missing", "No secret with this id", 404);
+  }
+};
+
 // src/server/application.ts
 var Application = class _Application {
   constructor(store, dataDir, release, factory) {
@@ -7888,17 +8944,20 @@ var Application = class _Application {
     );
     this.files = new ChatFiles(this.chats);
     store.runtime.recover();
+    this.secrets = new SecretService(store, this.chats);
     this.bots = new BotService({
       store,
       chats: this.chats,
       files: this.files,
       credentials: this.credentials,
+      secrets: this.secrets,
       changed: (id) => this.events.publish({ kind: "bot", id, status: this.bots.status(id) }),
       listChanged: () => this.events.publish({ kind: "bots" }),
       factory
     });
     this.auth = new CredentialLogins(store, this.credentials, (id) => this.bots.connectionChanged(id));
-    this.account = new AccountService(store, createHash6("sha256").update(dataDir).digest("hex").slice(0, 10));
+    this.connection = new ConnectionService(store, dataDir);
+    this.account = new AccountService(store, createHash7("sha256").update(dataDir).digest("hex").slice(0, 10));
     this.models = new ModelService(store, this.credentials, this.auth, (id) => this.bots.connectionChanged(id), new ModelCatalog(dataDir));
   }
   events = new Changes();
@@ -7910,9 +8969,11 @@ var Application = class _Application {
   auth;
   account;
   models;
+  connection;
+  secrets;
   closing;
   static async open(dataDir, options = {}) {
-    await mkdir5(resolve3(dataDir), { recursive: true, mode: 448 });
+    await mkdir6(resolve3(dataDir), { recursive: true, mode: 448 });
     const root = await realpath(resolve3(dataDir));
     let app;
     let release;
@@ -7921,7 +8982,7 @@ var Application = class _Application {
         retries: 0,
         stale: 3e4,
         update: 1e4,
-        lockfilePath: join9(root, ".runtime.lock"),
+        lockfilePath: join12(root, ".runtime.lock"),
         onCompromised: () => {
           console.error("[runtime] data lock compromised");
           options.onCompromised?.();
@@ -7961,27 +9022,27 @@ var Application = class _Application {
 
 // src/server/daemon.ts
 import { spawn as spawn2 } from "node:child_process";
-import { closeSync, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { join as join10, resolve as resolve4 } from "node:path";
-var pidPath = (dir) => join10(resolve4(dir), "jarvy.pid");
-var logPath = (dir) => join10(resolve4(dir), "jarvy.log");
+import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join13, resolve as resolve4 } from "node:path";
+var pidPath = (dir) => join13(resolve4(dir), "jarvy.pid");
+var logPath = (dir) => join13(resolve4(dir), "jarvy.log");
 function writePidFile(dir, url) {
   const record3 = { pid: process.pid, startToken: startToken(process.pid), url, startedAt: Date.now() };
-  writeFileSync(pidPath(dir), JSON.stringify(record3), { mode: 384 });
+  writeFileSync3(pidPath(dir), JSON.stringify(record3), { mode: 384 });
 }
 function removePidFile(dir) {
-  if (readRecord(dir)?.pid === process.pid) rmSync(pidPath(dir), { force: true });
+  if (readRecord(dir)?.pid === process.pid) rmSync2(pidPath(dir), { force: true });
 }
 function readRecord(dir) {
   try {
-    return JSON.parse(readFileSync2(pidPath(dir), "utf8"));
+    return JSON.parse(readFileSync5(pidPath(dir), "utf8"));
   } catch {
     return null;
   }
 }
 function startToken(pid) {
   try {
-    return readFileSync2(`/proc/${pid}/stat`, "utf8").split(") ").pop().split(" ")[19] ?? "";
+    return readFileSync5(`/proc/${pid}/stat`, "utf8").split(") ").pop().split(" ")[19] ?? "";
   } catch {
     return "";
   }
@@ -7999,13 +9060,13 @@ function runningServer(dir) {
   if (!record3) return null;
   const token = alive(record3.pid) ? startToken(record3.pid) : null;
   if (token === null || token && record3.startToken && token !== record3.startToken) {
-    rmSync(pidPath(dir), { force: true });
+    rmSync2(pidPath(dir), { force: true });
     return null;
   }
   return record3;
 }
 function startBackground(script, runArgs, dir) {
-  mkdirSync3(resolve4(dir), { recursive: true, mode: 448 });
+  mkdirSync5(resolve4(dir), { recursive: true, mode: 448 });
   const log = openSync(logPath(dir), "a", 384);
   const child = spawn2(process.execPath, [...process.execArgv, script, "run", ...runArgs], { detached: true, stdio: ["ignore", log, log, "ipc"] });
   closeSync(log);
@@ -8024,7 +9085,7 @@ function startBackground(script, runArgs, dir) {
 }
 function lastLogLine(dir) {
   try {
-    return readFileSync2(logPath(dir), "utf8").slice(-4e3).trim().split("\n").reverse().find((line) => line.startsWith("Jarvy: "))?.slice(7) ?? null;
+    return readFileSync5(logPath(dir), "utf8").slice(-4e3).trim().split("\n").reverse().find((line) => line.startsWith("Jarvy: "))?.slice(7) ?? null;
   } catch {
     return null;
   }
@@ -8040,7 +9101,7 @@ async function stopServer(dir, waitMs = 3e4) {
   process.kill(record3.pid, "SIGTERM");
   for (const deadline = Date.now() + waitMs; Date.now() < deadline; ) {
     if (!alive(record3.pid)) {
-      rmSync(pidPath(dir), { force: true });
+      rmSync2(pidPath(dir), { force: true });
       return "stopped";
     }
     await new Promise((done) => setTimeout(done, 200));
@@ -8106,19 +9167,21 @@ async function initialize(store) {
   store.initialize(username, password);
   console.log(`Account ${username} initialized.`);
 }
-function bindWarning(host) {
-  if (host === "0.0.0.0" || host === "::") return "WARNING: public bind over plain HTTP exposes passwords and API keys on untrusted networks. Use a trusted LAN or TLS reverse proxy.";
-  if (host !== "127.0.0.1" && host !== "localhost" && host !== "::1") return "WARNING: plain HTTP does not encrypt passwords or API keys. Use TLS for remote access.";
-  return null;
+function reachNotes(host, port, allowHttp) {
+  if (isLoopbackHost(host)) return { info: [], warning: null };
+  const info = lanAddresses(host).map((address) => `On your network: https://${address.includes(":") ? `[${address}]` : address}:${port}`);
+  info.push("To trust Jarvy on other devices, install its certificate from Settings \u2192 Network.");
+  return { info, warning: allowHttp ? "WARNING: HTTP access is allowed in Settings \u2192 Network, so passwords and conversations reach other devices unencrypted." : null };
 }
 function listenOptions(args) {
   const host = option(args, "--host", "127.0.0.1");
   const port = Number(option(args, "--port", "8080"));
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Port must be between 1 and 65535");
-  return { host, port, url: `http://${host === "0.0.0.0" || host === "::" ? "localhost" : host}:${port}` };
+  const wildcard = host === "0.0.0.0" || host === "::";
+  return { host, port, url: wildcard || isLoopbackHost(host) ? `http://${wildcard ? "localhost" : host}:${port}` : `https://${host}:${port}` };
 }
 async function startDetached(args, dir) {
-  const { host } = listenOptions(args);
+  const { host, port } = listenOptions(args);
   const running = runningServer(dir);
   const offCommand = `jarvy off${dir === defaultDataDir() ? "" : ` --data-dir ${dir}`}`;
   if (running) {
@@ -8126,17 +9189,20 @@ async function startDetached(args, dir) {
     return;
   }
   const app = await Application.open(dir);
+  let allowHttp = false;
   try {
     if (!app.store.isInitialized()) await initialize(app.store);
+    allowHttp = app.connection.allowHttp();
   } finally {
     await app.close();
   }
   const started = await startBackground(process.argv[1], args.slice(1), dir);
   console.log(`Jarvy running in background at ${started.url} (pid ${started.pid}, listening on ${host})`);
+  const notes = reachNotes(host, port, allowHttp);
+  for (const line of notes.info) console.log(line);
   console.log(`Log: ${logPath(dir)}
 Stop with: ${offCommand}`);
-  const warning = bindWarning(host);
-  if (warning) console.warn(warning);
+  if (notes.warning) console.warn(notes.warning);
 }
 async function stopDetached(dir) {
   const result = await stopServer(dir);
@@ -8183,33 +9249,24 @@ async function main() {
   try {
     if (!store.isInitialized()) await initialize(store);
     const { host, port, url } = listenOptions(args);
-    const webRoot = join11(dirname8(fileURLToPath(import.meta.url)), "../web");
-    if (!existsSync2(join11(webRoot, "index.html"))) throw new Error("Web build missing. Run npm run build first");
-    const server = createJarvyServer(app, webRoot);
-    closeHttp = () => {
-      server.close();
-      server.closeAllConnections();
-    };
-    await new Promise((resolve5, reject) => {
-      server.once("error", reject);
-      server.listen(port, host, () => {
-        server.off("error", reject);
-        resolve5();
-      });
-    });
+    const webRoot = join14(dirname9(fileURLToPath2(import.meta.url)), "../web");
+    if (!existsSync5(join14(webRoot, "index.html"))) throw new Error("Web build missing. Run npm run build first");
+    const server = createJarvyServer(app, webRoot, app.connection.prepare(host, port));
+    closeHttp = () => server.close();
+    await server.listen(port, host);
     app.start();
     writePidFile(dir, url);
     console.log(`Jarvy running at ${url} (listening on ${host}, pid ${process.pid})`);
+    const notes = reachNotes(host, port, app.connection.allowHttp());
+    for (const line of notes.info) console.log(line);
     console.log(`Data: ${store.path}`);
-    const warning = bindWarning(host);
-    if (warning) console.warn(warning);
+    if (notes.warning) console.warn(notes.warning);
     signalReady(url);
     let shuttingDown = false;
     const shutdown = () => {
       if (shuttingDown) return;
       shuttingDown = true;
       server.close();
-      server.closeAllConnections();
       void app.close().then(() => {
         removePidFile(dir);
         console.log("Jarvy stopped.");