@lumi.ai/runner 0.15.12 → 0.15.14

package/dist/cli.js

@@ -6,11 +6,11 @@ import { Command } from "commander";
 // src/daemon.ts
 import os4 from "node:os";
 import {
-  collection as collection6,
+  collection as collection7,
   deleteField as deleteField2,
-  doc as doc7,
-  getDoc as getDoc6,
-  getDocs as getDocs5,
+  doc as doc8,
+  getDoc as getDoc7,
+  getDocs as getDocs6,
   onSnapshot as onSnapshot2,
   orderBy as orderBy4,
   query as query4,
@@ -277,6 +277,34 @@ var COLLECTIONS = {
   /** ROOT collection (§15.44): one liveness document per relay instance, overwritten each
    *  report. Not a Ship subcollection — a relay serves every Ship and belongs to none. */
   browserRelays: "browserRelays",
+  /**
+   * ROOT (§15.64): `crew_stripe_events/{eventId}` — the webhook idempotency ledger.
+   *
+   * Root rather than Ship-scoped because a Stripe event is addressed to an ACCOUNT, and the Ship
+   * it concerns is read out of its metadata AFTER the duplicate check. Scoping it under a Ship
+   * would mean resolving the Ship before knowing whether the event had already been handled,
+   * which is the wrong order — and would strand the ledger row when that Ship is purged.
+   */
+  crewStripeEvents: "crewStripeEvents",
+  /**
+   * ROOT (§15.64): `crewBillingAccounts/{uid}` — one person's subscription, entire.
+   *
+   * Keyed by auth uid, not by Ship, because ONE PERSON HAS ONE SUBSCRIPTION covering every
+   * workspace they own. That is the whole of §15.64's second shape: a workspace is free, a seat is
+   * paid, and the seat count is pooled across the account — so the subscription cannot live on a
+   * Ship without being copied onto each of them, and N copies of one fact is N chances for a stale
+   * one.
+   *
+   * What a Ship still carries is only what `firestore.rules` and the triggers must read without a
+   * network call: `billing.status` and `billing.trialEnd`. Everything else — customer, subscription
+   * id, seats, interval, period end, the seat-sync error — is here, once.
+   *
+   * Deny-all to clients. Writable it is an account-takeover primitive (point your uid at somebody
+   * else's customer and the Portal session minted for you opens their card); readable it leaks who
+   * is a customer. The app never touches it — the Billing page gets its numbers from
+   * `crewBillingPreview`, which asks Stripe.
+   */
+  crewBillingAccounts: "crewBillingAccounts",
   /** `ships/{shipId}/notifications/{id}` — per-member in-app notifications. */
   notifications: "notifications",
   /** `ships/{shipId}/usage_daily/{yyyy-mm-dd}` — token-tracking aggregates. */
@@ -287,6 +315,17 @@ var COLLECTIONS = {
   events: "events",
   /** `ships/{shipId}/secrets/{docId}` — runner creds + MCP token hash (see secrets.ts). */
   secrets: "secrets",
+  /**
+   * `ships/{shipId}/credentials/{credId}` — the AI accounts this crew thinks with (PRD §15.62;
+   * see credentials.ts). NON-SECRET metadata only — the token is `secrets/cred_{credId}`, which no
+   * rule releases to anybody but an enrolled runner. Same split as `mcp_servers`.
+   *
+   * A single lowercase word, which matters for the reason `mcp_servers` documents: the
+   * purge-completeness oracle finds Ship subcollections by regexing firestore.rules for
+   * `match /([a-z_]+)/{`, so a camelCase name would be invisible to the one test that exists to
+   * catch a forgotten credential-bearing collection.
+   */
+  credentials: "credentials",
   /** `ships/{shipId}/integrations/{docId}` — 3rd-party connectors (GitHub App; see github.ts). */
   integrations: "integrations",
   /**
@@ -418,6 +457,17 @@ function autonomyRule(agent) {
 }
 var ASK_GUIDANCE = "If the task says who should approve \u2014 in its description, or because a particular person owns that area \u2014 name them in the request's `ask` so it reaches them rather than everyone.";
 
+// ../shared/dist/credentials.js
+function resolveAgentCredential(agent, credentials, defaultEngine) {
+  const engine = agent.engine ?? defaultEngine;
+  if (agent.credentialId) {
+    return credentials.find((c) => c.id === agent.credentialId) ?? null;
+  }
+  const forEngine = credentials.filter((c) => c.engine === engine);
+  const oldest = [...forEngine].sort((a, b) => a.createdAt - b.createdAt)[0];
+  return oldest ?? void 0;
+}
+
 // ../shared/dist/engineLimit.js
 function isEngineLimited(limit3, now) {
   return !!limit3 && limit3.resetsAt > now;
@@ -839,6 +889,7 @@ var WEBHOOK_ACK_REASONS = {
   duplicate: "Already delivered \u2014 this is a retry of a delivery that was accepted.",
   noListener: "No enabled playbook on this Ship is listening to this hook.",
   rateLimited: "Deliveries are arriving faster than one per second; this one was dropped.",
+  shipPaused: "This Ship's subscription is not active, so the delivery was accepted and no agent was woken.",
   fanout: `Woke the first ${MAX_WEBHOOK_FANOUT} playbooks listening; the rest were skipped.`
 };
 
@@ -968,7 +1019,7 @@ function mcpUrl(config2) {
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.15.12" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.15.14" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";
@@ -2668,11 +2719,56 @@ async function loadRunnerSecrets(db, shipId) {
   return snap.exists() ? snap.data() : null;
 }
 
+// src/jobs/credentials.ts
+import { collection as collection4, doc as doc5, getDoc as getDoc5, getDocs as getDocs4 } from "firebase/firestore";
+async function loadShipCredentials(db, shipId) {
+  const snap = await withFirestoreRetry(
+    () => getDocs4(collection4(db, COLLECTIONS.ships, shipId, COLLECTIONS.credentials))
+  );
+  return snap.docs.map((d) => ({ id: d.id, ...d.data() }));
+}
+async function loadCredentialToken(db, shipId, credentialId) {
+  const snap = await withFirestoreRetry(
+    () => getDoc5(doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, credentialId))
+  );
+  if (!snap.exists()) return null;
+  const token = snap.data().token;
+  return typeof token === "string" && token.trim() ? token : null;
+}
+async function resolveJobSecrets(input) {
+  const { agent, credentials, runnerSecrets } = input;
+  const engineId = agentEngine(agent);
+  const resolved = resolveAgentCredential(agent, credentials, DEFAULT_ENGINE_ID);
+  if (resolved === void 0) return { secrets: runnerSecrets };
+  if (resolved === null) {
+    return {
+      secrets: runnerSecrets,
+      problem: `This agent is set to an AI credential that no longer exists on the Ship. Point it at another one in Settings \u203A AI credentials, or add the credential back.`
+    };
+  }
+  const token = await loadCredentialToken(input.db, input.shipId, resolved.id);
+  if (!token) {
+    return {
+      secrets: runnerSecrets,
+      problem: `The AI credential "${resolved.label}" has no token stored. Erase it in Settings \u203A AI credentials and add it again.`
+    };
+  }
+  const key = getEngine(engineId).requiredSecrets[0]?.key;
+  if (!key) return { secrets: runnerSecrets };
+  return {
+    secrets: {
+      ...runnerSecrets ?? { updatedAt: resolved.updatedAt, updatedBy: resolved.createdBy },
+      [key]: token,
+      [`${key}Tail`]: resolved.tail
+    }
+  };
+}
+
 // src/jobs/engineLimits.ts
 import {
-  collection as collection4,
+  collection as collection5,
   deleteDoc,
-  doc as doc5,
+  doc as doc6,
   onSnapshot,
   setDoc
 } from "firebase/firestore";
@@ -2701,7 +2797,7 @@ function nextResetAt(limits, now) {
   return soonest;
 }
 function limitRef(db, shipId, engineId) {
-  return doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
+  return doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
 }
 async function noteEngineLimit(db, shipId, engineId, limit3, runnerId) {
   await setDoc(limitRef(db, shipId, engineId), {
@@ -2718,7 +2814,7 @@ async function clearEngineLimit(db, shipId, engineId) {
 }
 function subscribeEngineLimits(db, shipId, cb, onError) {
   return onSnapshot(
-    collection4(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits),
+    collection5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits),
     (snap) => cb(snap.docs.map((d) => ({ id: d.id, ...d.data() }))),
     (e) => onError?.(e)
   );
@@ -2798,11 +2894,11 @@ function selectDispatch(input) {
 // src/jobs/finish.ts
 import {
   addDoc,
-  collection as collection5,
+  collection as collection6,
   deleteField,
-  doc as doc6,
-  getDoc as getDoc5,
-  getDocs as getDocs4,
+  doc as doc7,
+  getDoc as getDoc6,
+  getDocs as getDocs5,
   limit as fsLimit,
   orderBy as orderBy3,
   query as query3,
@@ -2847,10 +2943,10 @@ function backstopReportContent(resultText2) {
   return { report: report4, summary };
 }
 async function finalizeJob(db, shipId, job, input) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const jobRef = doc6(shipRef, COLLECTIONS.jobs, job.id);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const jobRef = doc7(shipRef, COLLECTIONS.jobs, job.id);
   const now = Date.now();
-  const usageRef = doc6(shipRef, COLLECTIONS.usageDaily, utcDay(now));
+  const usageRef = doc7(shipRef, COLLECTIONS.usageDaily, utcDay(now));
   await runTransaction(db, async (tx) => {
     const usageSnap = await tx.get(usageRef);
     const jobSnap = await tx.get(jobRef);
@@ -2912,7 +3008,7 @@ async function finalizeJob(db, shipId, job, input) {
 }
 async function requeueForRetry(db, shipId, job, error) {
   await runTransaction(db, async (tx) => {
-    tx.update(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+    tx.update(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
       status: "queued",
       attempt: job.attempt + 1,
       error: error.slice(0, 1500),
@@ -2922,7 +3018,7 @@ async function requeueForRetry(db, shipId, job, error) {
   });
 }
 async function releaseJob(db, shipId, job, reason) {
-  await updateDoc(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+  await updateDoc(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
     status: "queued",
     runnerId: "",
     startedAt: 0,
@@ -2938,13 +3034,13 @@ async function releaseJob(db, shipId, job, reason) {
   });
 }
 async function markTaskFailed(db, shipId, job, error, statuses) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const taskRef = doc6(shipRef, COLLECTIONS.tasks, job.taskId);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const taskRef = doc7(shipRef, COLLECTIONS.tasks, job.taskId);
   const now = Date.now();
   const failedStatus = firstStatusIn(statuses, "failed")?.id ?? "failed";
   await runTransaction(db, async (tx) => {
     tx.update(taskRef, { status: failedStatus, updatedAt: now });
-    tx.set(doc6(collection5(taskRef, COLLECTIONS.activity)), {
+    tx.set(doc7(collection6(taskRef, COLLECTIONS.activity)), {
       author: { type: "agent", id: job.agentId },
       createdAt: now,
       kind: "comment",
@@ -2958,9 +3054,9 @@ ${error.slice(0, 800)}
   });
 }
 async function markTaskStopped(db, shipId, job, stoppedBy) {
-  const taskRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
+  const taskRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
   const who = await actorName(db, shipId, stoppedBy);
-  await addDoc(collection5(taskRef, COLLECTIONS.activity), {
+  await addDoc(collection6(taskRef, COLLECTIONS.activity), {
     author: { type: "agent", id: job.agentId },
     createdAt: Date.now(),
     kind: "comment",
@@ -2969,7 +3065,7 @@ async function markTaskStopped(db, shipId, job, stoppedBy) {
 }
 async function actorName(db, shipId, actorId) {
   try {
-    const snap = await getDoc5(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
+    const snap = await getDoc6(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
     const m = snap.data();
     return m?.displayName || m?.email || actorId;
   } catch {
@@ -2977,10 +3073,10 @@ async function actorName(db, shipId, actorId) {
   }
 }
 async function markChatStopped(db, shipId, job, stoppedBy) {
-  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
   const who = await actorName(db, shipId, stoppedBy);
   const content = `Stopped by ${who} before I finished. Write again to start a fresh run.`;
-  await addDoc(collection5(chatRef, COLLECTIONS.chatMessages), {
+  await addDoc(collection6(chatRef, COLLECTIONS.chatMessages), {
     author: { type: "agent", id: job.agentId },
     content,
     chars: content.length,
@@ -2988,8 +3084,8 @@ async function markChatStopped(db, shipId, job, stoppedBy) {
   });
 }
 async function markChatFailed(db, shipId, job, error) {
-  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
-  const chatRef = doc6(shipRef, COLLECTIONS.chats, job.chatId);
+  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
+  const chatRef = doc7(shipRef, COLLECTIONS.chats, job.chatId);
   const now = Date.now();
   const content = `I could not finish replying \u2014 the run failed after ${job.attempt} attempt(s).
 
@@ -2998,7 +3094,7 @@ ${error.slice(0, 500)}
 \`\`\`
 
 Write again to start a fresh run.`;
-  await addDoc(collection5(chatRef, COLLECTIONS.chatMessages), {
+  await addDoc(collection6(chatRef, COLLECTIONS.chatMessages), {
     author: { type: "agent", id: job.agentId },
     content,
     chars: content.length,
@@ -3016,9 +3112,9 @@ function backstopReplyContent(resultText2) {
   return `${text.slice(0, MAX_CHAT_MESSAGE_CHARS - marker.length)}${marker}`;
 }
 async function ensureChatReply(db, shipId, job, resultText2) {
-  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
-  const messagesCol = collection5(chatRef, COLLECTIONS.chatMessages);
-  const snap = await getDocs4(
+  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const messagesCol = collection6(chatRef, COLLECTIONS.chatMessages);
+  const snap = await getDocs5(
     query3(
       messagesCol,
       where3("createdAt", ">=", job.startedAt || 0),
@@ -3841,7 +3937,7 @@ async function startDaemon() {
   const warnedUnapproved = /* @__PURE__ */ new Set();
   const shipRunnerRef = (shipId) => {
     const session = sess(shipId);
-    return doc7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
+    return doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
   };
   const needsRefill = /* @__PURE__ */ new Set();
   let beating = false;
@@ -3852,7 +3948,7 @@ async function startDaemon() {
     try {
       for (const shipId of [...serving]) {
         try {
-          const snap = await getDoc6(shipRunnerRef(shipId));
+          const snap = await getDoc7(shipRunnerRef(shipId));
           if (!snap.exists()) {
             forgetShipLocally(shipId, "a captain removed this machine on the Daemons page");
             continue;
@@ -3909,9 +4005,9 @@ async function startDaemon() {
       needsRefill.delete(shipId);
       if (!serving.has(shipId) || approved.get(shipId) !== true) continue;
       try {
-        const snap = await getDocs5(
+        const snap = await getDocs6(
           query4(
-            collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+            collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
             where4("status", "==", "queued"),
             orderBy4("createdAt", "asc")
           )
@@ -3943,7 +4039,7 @@ async function startDaemon() {
   };
   for (const shipId of serving) {
     const q = query4(
-      collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+      collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
       where4("status", "==", "queued"),
       orderBy4("createdAt", "asc")
     );
@@ -3966,7 +4062,7 @@ async function startDaemon() {
       ),
       // Agents, purely so the claim gate can resolve a queued job's engine without a read.
       onSnapshot2(
-        collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
+        collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
         (snap) => {
           for (const d of snap.docs) {
             agentEngines.set(`${shipId}/${d.id}`, agentEngine(d.data()));
@@ -3988,7 +4084,7 @@ async function startDaemon() {
        * what happens. Testing is somebody's decision, and `doctor` is where it is made on purpose.
        */
       onSnapshot2(
-        collection6(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers),
+        collection7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers),
         (snap) => {
           const servers = snap.docs.map(
             (d) => ({ id: d.id, ...d.data() })
@@ -4197,7 +4293,7 @@ async function startDaemon() {
       pending.set(`${shipId}/${job.id}`, { shipId, job });
       return null;
     }
-    const jobRef = doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
+    const jobRef = doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
     try {
       let claimed = null;
       await runTransaction2(sess(shipId).fb.db, async (tx) => {
@@ -4220,7 +4316,7 @@ async function startDaemon() {
   }
   async function setAgentStatus(shipId, agentId, status) {
     try {
-      await updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
+      await updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
     } catch (e) {
       log2(`agent status update failed: ${e instanceof Error ? e.message : e}`);
     }
@@ -4267,8 +4363,8 @@ async function startDaemon() {
       void (async () => {
         if (slot.stop) return;
         try {
-          const snap = await getDoc6(
-            doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+          const snap = await getDoc7(
+            doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
           );
           const fresh = snap.data();
           if (!fresh?.stopRequestedAt || slot.stop) return;
@@ -4308,7 +4404,7 @@ async function startDaemon() {
     let statuses = DEFAULT_TASK_STATUSES;
     let knownSecrets = [];
     const progress = createProgressWriter({
-      write: (p) => updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+      write: (p) => updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
         progress: p
       }),
       secrets: () => knownSecrets,
@@ -4322,8 +4418,8 @@ async function startDaemon() {
       onDenied: () => {
         void (async () => {
           try {
-            const snap = await getDoc6(
-              doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+            const snap = await getDoc7(
+              doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
             );
             const fresh = snap.data();
             if (!fresh || fresh.status !== "running" || fresh.runnerId !== sess(shipId).runnerId) {
@@ -4338,7 +4434,7 @@ async function startDaemon() {
     });
     progress.push({ kind: "start", label: "Starting up" });
     try {
-      const secrets = await loadSecrets(shipId);
+      let secrets = await loadSecrets(shipId);
       const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(sess(shipId).fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(sess(shipId).fb.db, shipId, { ...job, taskId: target.taskId }) };
       if (packed.kind === "task" && !isWorkflowSentinel(job.workflowId) && !packed.ctx.workflow) {
         log2(
@@ -4349,6 +4445,17 @@ async function startDaemon() {
       engineId = agentEngine(agent);
       usage = { ...usage, engine: engineId };
       statuses = shipTaskStatuses(ship2);
+      const resolvedSecrets = await resolveJobSecrets({
+        db: sess(shipId).fb.db,
+        shipId,
+        agent,
+        runnerSecrets: secrets,
+        credentials: await loadShipCredentials(sess(shipId).fb.db, shipId).catch(() => [])
+      });
+      if (resolvedSecrets.problem) {
+        throw new Error(resolvedSecrets.problem);
+      }
+      secrets = resolvedSecrets.secrets;
       const missing = missingSecretsFor(engineId, secrets);
       if (missing.length > 0 && !process.env.CREW_CLAUDE_BIN) {
         throw new Error(
@@ -5147,7 +5254,7 @@ function setParallel(config2, value, ship2) {
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import path8 from "node:path";
-import { collection as collection7, doc as doc8, getDoc as getDoc7, getDocs as getDocs6 } from "firebase/firestore";
+import { collection as collection8, doc as doc9, getDoc as getDoc8, getDocs as getDocs7 } from "firebase/firestore";
 
 // src/cli/session.ts
 async function openShipSession(shipId) {
@@ -5316,8 +5423,8 @@ async function checkShips(config2) {
       continue;
     }
     try {
-      const snap = await getDoc7(
-        doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
+      const snap = await getDoc8(
+        doc9(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
       );
       if (!snap.exists()) {
         checks.push(
@@ -5358,7 +5465,7 @@ async function checkShips(config2) {
     }
     let agents = [];
     try {
-      const snap = await getDocs6(collection7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
+      const snap = await getDocs7(collection8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
       agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     } catch {
     }
@@ -5368,13 +5475,33 @@ async function checkShips(config2) {
     if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
     try {
       const secrets = await loadRunnerSecrets(session.fb.db, shipId);
-      const missing = [...new Set([...shipEngines].flatMap((id) => missingSecretsFor(id, secrets)))];
+      const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
+      const missing = [
+        ...new Set(
+          [...shipEngines].flatMap((id) => {
+            if (credentials.some((c) => c.engine === id)) return [];
+            return missingSecretsFor(id, secrets);
+          })
+        )
+      ];
+      const orphaned = agents.filter(
+        (agent) => resolveAgentCredential(agent, credentials, DEFAULT_ENGINE_ID) === null
+      );
       checks.push(
-        missing.length === 0 ? ok(`secrets:${shipId}`, `Ship ${shipId} \u2014 credentials`, "All required secrets are saved.") : fail(
+        missing.length > 0 ? fail(
           `secrets:${shipId}`,
           `Ship ${shipId} \u2014 credentials`,
           `Missing: ${missing.join(", ")}.`,
-          "A captain saves these in Ship Settings \u2192 Runner credentials."
+          "A captain saves these in Ship Settings \u2192 AI credentials."
+        ) : orphaned.length > 0 ? fail(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          `${orphaned.length} agent(s) are set to a credential that no longer exists: ${orphaned.map((a) => a.name).join(", ")}.`,
+          "Point them at another one in Ship Settings \u2192 AI credentials."
+        ) : ok(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          "All required secrets are saved."
         )
       );
     } catch (e) {
@@ -5388,8 +5515,8 @@ async function checkShips(config2) {
       );
     }
     try {
-      const snap = await getDocs6(
-        collection7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers)
+      const snap = await getDocs7(
+        collection8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers)
       );
       const servers = snap.docs.map(
         (d) => ({ id: d.id, ...d.data() })
@@ -5838,7 +5965,7 @@ async function runUninstall(options) {
 }
 
 // src/cli/commands/ship.ts
-import { doc as doc9, getDoc as getDoc8 } from "firebase/firestore";
+import { doc as doc10, getDoc as getDoc9 } from "firebase/firestore";
 async function listMyShips() {
   const config2 = requireConfig();
   const ids = Object.keys(config2.shipKeys ?? {});
@@ -5846,7 +5973,7 @@ async function listMyShips() {
     ids.map(async (id) => {
       try {
         const { fb } = await openShipSession(id);
-        const snap = await getDoc8(doc9(fb.db, COLLECTIONS.ships, id));
+        const snap = await getDoc9(doc10(fb.db, COLLECTIONS.ships, id));
         return { id, ...snap.data() };
       } catch {
         return null;
@@ -6006,11 +6133,11 @@ async function runSetup(options) {
 
 // src/cli/commands/status.ts
 import {
-  collection as collection8,
-  doc as doc10,
+  collection as collection9,
+  doc as doc11,
   getCountFromServer as getCountFromServer2,
-  getDoc as getDoc9,
-  getDocs as getDocs7,
+  getDoc as getDoc10,
+  getDocs as getDocs8,
   query as query5,
   where as where5
 } from "firebase/firestore";
@@ -6047,22 +6174,22 @@ async function runStatus() {
       });
       continue;
     }
-    const shipRef = doc10(session.fb.db, COLLECTIONS.ships, shipId);
-    const mirrorSnap = await getDoc9(doc10(shipRef, COLLECTIONS.runners, session.runnerId));
+    const shipRef = doc11(session.fb.db, COLLECTIONS.ships, shipId);
+    const mirrorSnap = await getDoc10(doc11(shipRef, COLLECTIONS.runners, session.runnerId));
     const mirror = mirrorSnap.data();
     let queued = 0;
     try {
       const counted = await getCountFromServer2(
-        query5(collection8(shipRef, COLLECTIONS.jobs), where5("status", "==", "queued"))
+        query5(collection9(shipRef, COLLECTIONS.jobs), where5("status", "==", "queued"))
       );
       queued = counted.data().count;
     } catch {
       queued = 0;
     }
-    const usageSnap = await getDoc9(doc10(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
+    const usageSnap = await getDoc10(doc11(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
     const today = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
     const now = Date.now();
-    const limitsSnap = await getDocs7(collection8(shipRef, COLLECTIONS.engineLimits));
+    const limitsSnap = await getDocs8(collection9(shipRef, COLLECTIONS.engineLimits));
     const engineLimits = limitsSnap.docs.map((d) => ({ id: d.id, ...d.data() })).filter((l) => isEngineLimited(l, now));
     ships.push({
       shipId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.15.12",
+  "version": "0.15.14",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",