@lumi.ai/runner 0.15.11 → 0.15.13

package/dist/cli.js

@@ -6,11 +6,11 @@ import { Command } from "commander";
 // src/daemon.ts
 import os4 from "node:os";
 import {
-  collection as collection6,
+  collection as collection7,
   deleteField as deleteField2,
-  doc as doc7,
-  getDoc as getDoc6,
-  getDocs as getDocs5,
+  doc as doc8,
+  getDoc as getDoc7,
+  getDocs as getDocs6,
   onSnapshot as onSnapshot2,
   orderBy as orderBy4,
   query as query4,
@@ -287,6 +287,17 @@ var COLLECTIONS = {
   events: "events",
   /** `ships/{shipId}/secrets/{docId}` — runner creds + MCP token hash (see secrets.ts). */
   secrets: "secrets",
+  /**
+   * `ships/{shipId}/credentials/{credId}` — the AI accounts this crew thinks with (PRD §15.62;
+   * see credentials.ts). NON-SECRET metadata only — the token is `secrets/cred_{credId}`, which no
+   * rule releases to anybody but an enrolled runner. Same split as `mcp_servers`.
+   *
+   * A single lowercase word, which matters for the reason `mcp_servers` documents: the
+   * purge-completeness oracle finds Ship subcollections by regexing firestore.rules for
+   * `match /([a-z_]+)/{`, so a camelCase name would be invisible to the one test that exists to
+   * catch a forgotten credential-bearing collection.
+   */
+  credentials: "credentials",
   /** `ships/{shipId}/integrations/{docId}` — 3rd-party connectors (GitHub App; see github.ts). */
   integrations: "integrations",
   /**
@@ -314,6 +325,24 @@ var COLLECTIONS = {
    * MCP connection splits from `secrets/mcp_srv_{key}`.
    */
   oauthGrants: "oauth_grants",
+  /**
+   * `ships/{shipId}/webhooks/{hookId}` — one inbound endpoint (PRD §15.56). NON-SECRET metadata;
+   * the signing secret is `secrets/webhook_{hookId}`, which no rule releases to anybody.
+   *
+   * SNAKE_CASE-safe as a single word, which matters for the reason `mcp_servers` documents: the
+   * purge-completeness oracle finds Ship subcollections by regexing firestore.rules for
+   * `match /([a-z_]+)/{`, so a camelCase name would be invisible to the one test that exists to
+   * catch a forgotten credential-bearing collection.
+   */
+  webhooks: "webhooks",
+  /**
+   * `ships/{shipId}/webhook_deliveries/{key}` — the idempotency ledger (PRD §15.56).
+   *
+   * One document per accepted delivery, created transactionally: `tx.create` FAILING because the
+   * document exists IS the lock, so there is no read-then-write race for two concurrent retries to
+   * slip through. Swept by TTL rather than kept, since its only job is to be present.
+   */
+  webhookDeliveries: "webhook_deliveries",
   /** Top-level `users/{uid}/...` — per-user docs (runner machine registry). */
   users: "users",
   /** Top-level `githubInstallStates/{stateId}` — single-use install-flow nonces (backend only). */
@@ -400,6 +429,17 @@ function autonomyRule(agent) {
 }
 var ASK_GUIDANCE = "If the task says who should approve \u2014 in its description, or because a particular person owns that area \u2014 name them in the request's `ask` so it reaches them rather than everyone.";
 
+// ../shared/dist/credentials.js
+function resolveAgentCredential(agent, credentials, defaultEngine) {
+  const engine = agent.engine ?? defaultEngine;
+  if (agent.credentialId) {
+    return credentials.find((c) => c.id === agent.credentialId) ?? null;
+  }
+  const forEngine = credentials.filter((c) => c.engine === engine);
+  const oldest = [...forEngine].sort((a, b) => a.createdAt - b.createdAt)[0];
+  return oldest ?? void 0;
+}
+
 // ../shared/dist/engineLimit.js
 function isEngineLimited(limit3, now) {
   return !!limit3 && limit3.resetsAt > now;
@@ -814,6 +854,16 @@ var EMPTY_USAGE_BY_AGENT = {
   jobs: 0
 };
 
+// ../shared/dist/webhook.js
+var MAX_WEBHOOK_FANOUT = 5;
+var WEBHOOK_ACK_REASONS = {
+  disabled: "This hook is switched off, so the delivery was accepted and dropped.",
+  duplicate: "Already delivered \u2014 this is a retry of a delivery that was accepted.",
+  noListener: "No enabled playbook on this Ship is listening to this hook.",
+  rateLimited: "Deliveries are arriving faster than one per second; this one was dropped.",
+  fanout: `Woke the first ${MAX_WEBHOOK_FANOUT} playbooks listening; the rest were skipped.`
+};
+
 // ../shared/dist/workflow.js
 var WORKFLOW_SENTINELS = ["generic", "assigned", "activity", "chat"];
 function isWorkflowSentinel(id) {
@@ -940,7 +990,7 @@ function mcpUrl(config2) {
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.15.11" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.15.13" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";
@@ -2640,11 +2690,56 @@ async function loadRunnerSecrets(db, shipId) {
   return snap.exists() ? snap.data() : null;
 }
 
+// src/jobs/credentials.ts
+import { collection as collection4, doc as doc5, getDoc as getDoc5, getDocs as getDocs4 } from "firebase/firestore";
+async function loadShipCredentials(db, shipId) {
+  const snap = await withFirestoreRetry(
+    () => getDocs4(collection4(db, COLLECTIONS.ships, shipId, COLLECTIONS.credentials))
+  );
+  return snap.docs.map((d) => ({ id: d.id, ...d.data() }));
+}
+async function loadCredentialToken(db, shipId, credentialId) {
+  const snap = await withFirestoreRetry(
+    () => getDoc5(doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, credentialId))
+  );
+  if (!snap.exists()) return null;
+  const token = snap.data().token;
+  return typeof token === "string" && token.trim() ? token : null;
+}
+async function resolveJobSecrets(input) {
+  const { agent, credentials, runnerSecrets } = input;
+  const engineId = agentEngine(agent);
+  const resolved = resolveAgentCredential(agent, credentials, DEFAULT_ENGINE_ID);
+  if (resolved === void 0) return { secrets: runnerSecrets };
+  if (resolved === null) {
+    return {
+      secrets: runnerSecrets,
+      problem: `This agent is set to an AI credential that no longer exists on the Ship. Point it at another one in Settings \u203A AI credentials, or add the credential back.`
+    };
+  }
+  const token = await loadCredentialToken(input.db, input.shipId, resolved.id);
+  if (!token) {
+    return {
+      secrets: runnerSecrets,
+      problem: `The AI credential "${resolved.label}" has no token stored. Erase it in Settings \u203A AI credentials and add it again.`
+    };
+  }
+  const key = getEngine(engineId).requiredSecrets[0]?.key;
+  if (!key) return { secrets: runnerSecrets };
+  return {
+    secrets: {
+      ...runnerSecrets ?? { updatedAt: resolved.updatedAt, updatedBy: resolved.createdBy },
+      [key]: token,
+      [`${key}Tail`]: resolved.tail
+    }
+  };
+}
+
 // src/jobs/engineLimits.ts
 import {
-  collection as collection4,
+  collection as collection5,
   deleteDoc,
-  doc as doc5,
+  doc as doc6,
   onSnapshot,
   setDoc
 } from "firebase/firestore";
@@ -2673,7 +2768,7 @@ function nextResetAt(limits, now) {
   return soonest;
 }
 function limitRef(db, shipId, engineId) {
-  return doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
+  return doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
 }
 async function noteEngineLimit(db, shipId, engineId, limit3, runnerId) {
   await setDoc(limitRef(db, shipId, engineId), {
@@ -2690,7 +2785,7 @@ async function clearEngineLimit(db, shipId, engineId) {
 }
 function subscribeEngineLimits(db, shipId, cb, onError) {
   return onSnapshot(
-    collection4(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits),
+    collection5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits),
     (snap) => cb(snap.docs.map((d) => ({ id: d.id, ...d.data() }))),
     (e) => onError?.(e)
   );
@@ -2770,11 +2865,11 @@ function selectDispatch(input) {
 // src/jobs/finish.ts
 import {
   addDoc,
-  collection as collection5,
+  collection as collection6,
   deleteField,
-  doc as doc6,
-  getDoc as getDoc5,
-  getDocs as getDocs4,
+  doc as doc7,
+  getDoc as getDoc6,
+  getDocs as getDocs5,
   limit as fsLimit,
   orderBy as orderBy3,
   query as query3,
@@ -2819,10 +2914,10 @@ function backstopReportContent(resultText2) {
   return { report: report4, summary };
 }
 async function finalizeJob(db, shipId, job, input) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const jobRef = doc6(shipRef, COLLECTIONS.jobs, job.id);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const jobRef = doc7(shipRef, COLLECTIONS.jobs, job.id);
   const now = Date.now();
-  const usageRef = doc6(shipRef, COLLECTIONS.usageDaily, utcDay(now));
+  const usageRef = doc7(shipRef, COLLECTIONS.usageDaily, utcDay(now));
   await runTransaction(db, async (tx) => {
     const usageSnap = await tx.get(usageRef);
     const jobSnap = await tx.get(jobRef);
@@ -2884,7 +2979,7 @@ async function finalizeJob(db, shipId, job, input) {
 }
 async function requeueForRetry(db, shipId, job, error) {
   await runTransaction(db, async (tx) => {
-    tx.update(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+    tx.update(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
       status: "queued",
       attempt: job.attempt + 1,
       error: error.slice(0, 1500),
@@ -2894,7 +2989,7 @@ async function requeueForRetry(db, shipId, job, error) {
   });
 }
 async function releaseJob(db, shipId, job, reason) {
-  await updateDoc(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+  await updateDoc(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
     status: "queued",
     runnerId: "",
     startedAt: 0,
@@ -2910,13 +3005,13 @@ async function releaseJob(db, shipId, job, reason) {
   });
 }
 async function markTaskFailed(db, shipId, job, error, statuses) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const taskRef = doc6(shipRef, COLLECTIONS.tasks, job.taskId);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const taskRef = doc7(shipRef, COLLECTIONS.tasks, job.taskId);
   const now = Date.now();
   const failedStatus = firstStatusIn(statuses, "failed")?.id ?? "failed";
   await runTransaction(db, async (tx) => {
     tx.update(taskRef, { status: failedStatus, updatedAt: now });
-    tx.set(doc6(collection5(taskRef, COLLECTIONS.activity)), {
+    tx.set(doc7(collection6(taskRef, COLLECTIONS.activity)), {
       author: { type: "agent", id: job.agentId },
       createdAt: now,
       kind: "comment",
@@ -2930,9 +3025,9 @@ ${error.slice(0, 800)}
   });
 }
 async function markTaskStopped(db, shipId, job, stoppedBy) {
-  const taskRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
+  const taskRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
   const who = await actorName(db, shipId, stoppedBy);
-  await addDoc(collection5(taskRef, COLLECTIONS.activity), {
+  await addDoc(collection6(taskRef, COLLECTIONS.activity), {
     author: { type: "agent", id: job.agentId },
     createdAt: Date.now(),
     kind: "comment",
@@ -2941,7 +3036,7 @@ async function markTaskStopped(db, shipId, job, stoppedBy) {
 }
 async function actorName(db, shipId, actorId) {
   try {
-    const snap = await getDoc5(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
+    const snap = await getDoc6(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
     const m = snap.data();
     return m?.displayName || m?.email || actorId;
   } catch {
@@ -2949,10 +3044,10 @@ async function actorName(db, shipId, actorId) {
   }
 }
 async function markChatStopped(db, shipId, job, stoppedBy) {
-  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
   const who = await actorName(db, shipId, stoppedBy);
   const content = `Stopped by ${who} before I finished. Write again to start a fresh run.`;
-  await addDoc(collection5(chatRef, COLLECTIONS.chatMessages), {
+  await addDoc(collection6(chatRef, COLLECTIONS.chatMessages), {
     author: { type: "agent", id: job.agentId },
     content,
     chars: content.length,
@@ -2960,8 +3055,8 @@ async function markChatStopped(db, shipId, job, stoppedBy) {
   });
 }
 async function markChatFailed(db, shipId, job, error) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const chatRef = doc6(shipRef, COLLECTIONS.chats, job.chatId);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const chatRef = doc7(shipRef, COLLECTIONS.chats, job.chatId);
   const now = Date.now();
   const content = `I could not finish replying \u2014 the run failed after ${job.attempt} attempt(s).
 
@@ -2970,7 +3065,7 @@ ${error.slice(0, 500)}
 \`\`\`
 
 Write again to start a fresh run.`;
-  await addDoc(collection5(chatRef, COLLECTIONS.chatMessages), {
+  await addDoc(collection6(chatRef, COLLECTIONS.chatMessages), {
     author: { type: "agent", id: job.agentId },
     content,
     chars: content.length,
@@ -2988,9 +3083,9 @@ function backstopReplyContent(resultText2) {
   return `${text.slice(0, MAX_CHAT_MESSAGE_CHARS - marker.length)}${marker}`;
 }
 async function ensureChatReply(db, shipId, job, resultText2) {
-  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
-  const messagesCol = collection5(chatRef, COLLECTIONS.chatMessages);
-  const snap = await getDocs4(
+  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const messagesCol = collection6(chatRef, COLLECTIONS.chatMessages);
+  const snap = await getDocs5(
     query3(
       messagesCol,
       where3("createdAt", ">=", job.startedAt || 0),
@@ -3813,7 +3908,7 @@ async function startDaemon() {
   const warnedUnapproved = /* @__PURE__ */ new Set();
   const shipRunnerRef = (shipId) => {
     const session = sess(shipId);
-    return doc7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
+    return doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
   };
   const needsRefill = /* @__PURE__ */ new Set();
   let beating = false;
@@ -3824,7 +3919,7 @@ async function startDaemon() {
     try {
       for (const shipId of [...serving]) {
         try {
-          const snap = await getDoc6(shipRunnerRef(shipId));
+          const snap = await getDoc7(shipRunnerRef(shipId));
           if (!snap.exists()) {
             forgetShipLocally(shipId, "a captain removed this machine on the Daemons page");
             continue;
@@ -3881,9 +3976,9 @@ async function startDaemon() {
       needsRefill.delete(shipId);
       if (!serving.has(shipId) || approved.get(shipId) !== true) continue;
       try {
-        const snap = await getDocs5(
+        const snap = await getDocs6(
           query4(
-            collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+            collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
             where4("status", "==", "queued"),
             orderBy4("createdAt", "asc")
           )
@@ -3915,7 +4010,7 @@ async function startDaemon() {
   };
   for (const shipId of serving) {
     const q = query4(
-      collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+      collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
       where4("status", "==", "queued"),
       orderBy4("createdAt", "asc")
     );
@@ -3938,7 +4033,7 @@ async function startDaemon() {
       ),
       // Agents, purely so the claim gate can resolve a queued job's engine without a read.
       onSnapshot2(
-        collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
+        collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
         (snap) => {
           for (const d of snap.docs) {
             agentEngines.set(`${shipId}/${d.id}`, agentEngine(d.data()));
@@ -3960,7 +4055,7 @@ async function startDaemon() {
        * what happens. Testing is somebody's decision, and `doctor` is where it is made on purpose.
        */
       onSnapshot2(
-        collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers),
+        collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers),
         (snap) => {
           const servers = snap.docs.map(
             (d) => ({ id: d.id, ...d.data() })
@@ -4169,7 +4264,7 @@ async function startDaemon() {
       pending.set(`${shipId}/${job.id}`, { shipId, job });
       return null;
     }
-    const jobRef = doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
+    const jobRef = doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
     try {
       let claimed = null;
       await runTransaction2(sess(shipId).fb.db, async (tx) => {
@@ -4192,7 +4287,7 @@ async function startDaemon() {
   }
   async function setAgentStatus(shipId, agentId, status) {
     try {
-      await updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
+      await updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
     } catch (e) {
       log2(`agent status update failed: ${e instanceof Error ? e.message : e}`);
     }
@@ -4239,8 +4334,8 @@ async function startDaemon() {
       void (async () => {
         if (slot.stop) return;
         try {
-          const snap = await getDoc6(
-            doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+          const snap = await getDoc7(
+            doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
           );
           const fresh = snap.data();
           if (!fresh?.stopRequestedAt || slot.stop) return;
@@ -4280,7 +4375,7 @@ async function startDaemon() {
     let statuses = DEFAULT_TASK_STATUSES;
     let knownSecrets = [];
     const progress = createProgressWriter({
-      write: (p) => updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+      write: (p) => updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
         progress: p
       }),
       secrets: () => knownSecrets,
@@ -4294,8 +4389,8 @@ async function startDaemon() {
       onDenied: () => {
         void (async () => {
           try {
-            const snap = await getDoc6(
-              doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+            const snap = await getDoc7(
+              doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
             );
             const fresh = snap.data();
             if (!fresh || fresh.status !== "running" || fresh.runnerId !== sess(shipId).runnerId) {
@@ -4310,7 +4405,7 @@ async function startDaemon() {
     });
     progress.push({ kind: "start", label: "Starting up" });
     try {
-      const secrets = await loadSecrets(shipId);
+      let secrets = await loadSecrets(shipId);
       const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(sess(shipId).fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(sess(shipId).fb.db, shipId, { ...job, taskId: target.taskId }) };
       if (packed.kind === "task" && !isWorkflowSentinel(job.workflowId) && !packed.ctx.workflow) {
         log2(
@@ -4321,6 +4416,17 @@ async function startDaemon() {
       engineId = agentEngine(agent);
       usage = { ...usage, engine: engineId };
       statuses = shipTaskStatuses(ship2);
+      const resolvedSecrets = await resolveJobSecrets({
+        db: sess(shipId).fb.db,
+        shipId,
+        agent,
+        runnerSecrets: secrets,
+        credentials: await loadShipCredentials(sess(shipId).fb.db, shipId).catch(() => [])
+      });
+      if (resolvedSecrets.problem) {
+        throw new Error(resolvedSecrets.problem);
+      }
+      secrets = resolvedSecrets.secrets;
       const missing = missingSecretsFor(engineId, secrets);
       if (missing.length > 0 && !process.env.CREW_CLAUDE_BIN) {
         throw new Error(
@@ -5119,7 +5225,7 @@ function setParallel(config2, value, ship2) {
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import path8 from "node:path";
-import { collection as collection7, doc as doc8, getDoc as getDoc7, getDocs as getDocs6 } from "firebase/firestore";
+import { collection as collection8, doc as doc9, getDoc as getDoc8, getDocs as getDocs7 } from "firebase/firestore";
 
 // src/cli/session.ts
 async function openShipSession(shipId) {
@@ -5288,8 +5394,8 @@ async function checkShips(config2) {
       continue;
     }
     try {
-      const snap = await getDoc7(
-        doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
+      const snap = await getDoc8(
+        doc9(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
       );
       if (!snap.exists()) {
         checks.push(
@@ -5330,7 +5436,7 @@ async function checkShips(config2) {
     }
     let agents = [];
     try {
-      const snap = await getDocs6(collection7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
+      const snap = await getDocs7(collection8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
       agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     } catch {
     }
@@ -5340,13 +5446,33 @@ async function checkShips(config2) {
     if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
     try {
       const secrets = await loadRunnerSecrets(session.fb.db, shipId);
-      const missing = [...new Set([...shipEngines].flatMap((id) => missingSecretsFor(id, secrets)))];
+      const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
+      const missing = [
+        ...new Set(
+          [...shipEngines].flatMap((id) => {
+            if (credentials.some((c) => c.engine === id)) return [];
+            return missingSecretsFor(id, secrets);
+          })
+        )
+      ];
+      const orphaned = agents.filter(
+        (agent) => resolveAgentCredential(agent, credentials, DEFAULT_ENGINE_ID) === null
+      );
       checks.push(
-        missing.length === 0 ? ok(`secrets:${shipId}`, `Ship ${shipId} \u2014 credentials`, "All required secrets are saved.") : fail(
+        missing.length > 0 ? fail(
           `secrets:${shipId}`,
           `Ship ${shipId} \u2014 credentials`,
           `Missing: ${missing.join(", ")}.`,
-          "A captain saves these in Ship Settings \u2192 Runner credentials."
+          "A captain saves these in Ship Settings \u2192 AI credentials."
+        ) : orphaned.length > 0 ? fail(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          `${orphaned.length} agent(s) are set to a credential that no longer exists: ${orphaned.map((a) => a.name).join(", ")}.`,
+          "Point them at another one in Ship Settings \u2192 AI credentials."
+        ) : ok(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          "All required secrets are saved."
         )
       );
     } catch (e) {
@@ -5360,8 +5486,8 @@ async function checkShips(config2) {
       );
     }
     try {
-      const snap = await getDocs6(
-        collection7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers)
+      const snap = await getDocs7(
+        collection8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers)
       );
       const servers = snap.docs.map(
         (d) => ({ id: d.id, ...d.data() })
@@ -5810,7 +5936,7 @@ async function runUninstall(options) {
 }
 
 // src/cli/commands/ship.ts
-import { doc as doc9, getDoc as getDoc8 } from "firebase/firestore";
+import { doc as doc10, getDoc as getDoc9 } from "firebase/firestore";
 async function listMyShips() {
   const config2 = requireConfig();
   const ids = Object.keys(config2.shipKeys ?? {});
@@ -5818,7 +5944,7 @@ async function listMyShips() {
     ids.map(async (id) => {
       try {
         const { fb } = await openShipSession(id);
-        const snap = await getDoc8(doc9(fb.db, COLLECTIONS.ships, id));
+        const snap = await getDoc9(doc10(fb.db, COLLECTIONS.ships, id));
         return { id, ...snap.data() };
       } catch {
         return null;
@@ -5978,11 +6104,11 @@ async function runSetup(options) {
 
 // src/cli/commands/status.ts
 import {
-  collection as collection8,
-  doc as doc10,
+  collection as collection9,
+  doc as doc11,
   getCountFromServer as getCountFromServer2,
-  getDoc as getDoc9,
-  getDocs as getDocs7,
+  getDoc as getDoc10,
+  getDocs as getDocs8,
   query as query5,
   where as where5
 } from "firebase/firestore";
@@ -6019,22 +6145,22 @@ async function runStatus() {
       });
       continue;
     }
-    const shipRef = doc10(session.fb.db, COLLECTIONS.ships, shipId);
-    const mirrorSnap = await getDoc9(doc10(shipRef, COLLECTIONS.runners, session.runnerId));
+    const shipRef = doc11(session.fb.db, COLLECTIONS.ships, shipId);
+    const mirrorSnap = await getDoc10(doc11(shipRef, COLLECTIONS.runners, session.runnerId));
     const mirror = mirrorSnap.data();
     let queued = 0;
     try {
       const counted = await getCountFromServer2(
-        query5(collection8(shipRef, COLLECTIONS.jobs), where5("status", "==", "queued"))
+        query5(collection9(shipRef, COLLECTIONS.jobs), where5("status", "==", "queued"))
       );
       queued = counted.data().count;
     } catch {
       queued = 0;
     }
-    const usageSnap = await getDoc9(doc10(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
+    const usageSnap = await getDoc10(doc11(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
     const today = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
     const now = Date.now();
-    const limitsSnap = await getDocs7(collection8(shipRef, COLLECTIONS.engineLimits));
+    const limitsSnap = await getDocs8(collection9(shipRef, COLLECTIONS.engineLimits));
     const engineLimits = limitsSnap.docs.map((d) => ({ id: d.id, ...d.data() })).filter((l) => isEngineLimited(l, now));
     ships.push({
       shipId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.15.11",
+  "version": "0.15.13",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",