heyquilt 0.3.90 → 0.3.106

package/src/ui-server.js

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { Readable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
-import { runSession, decodeInvite, newConn, readConfig, recentSessions, forgetRecent, rememberWorkspace, forgetWorkspace } from './runner.js'
+import { runSession, decodeInvite, encodeInvite, newConn, readConfig, recentSessions, forgetRecent, rememberWorkspace, forgetWorkspace } from './runner.js'
 import { MAX_SHARED_FILE_BYTES } from './protocol.js'
 import { getSettings, saveSettings, unsupportedRelay, relayUrl } from './settings.js'
 import { PICKUP_MODES, pickupMode } from './tasks.js'
@@ -21,18 +21,20 @@ import { installedEditors, openIn, copyToClipboard } from './editors.js'
 import { autowork, autoConfig, publicConfig, AUTO_MODES } from './autowork.js'
 import { migrateDir } from './legacy.js'
 import { writePrivateJson } from './private-file.js'
-import { readAccount, saveAccount, workspaceGithub, setWorkspaceGithub, removeWorkspaceGithub, setOrgGithub, clearAccount, clearAccountIf, resumeAccount, startLink, waitForLink, fetchMe, signOut, revokeToken, accountFromProfile, renameSession, createAgentInvite, listAgents, listAccessTypes, listCollaborators, listGrants, putGrant, deleteGrant, inviteToSession, listSessionInvites, cancelSessionInvite, listWorkspaces, listOrgs, createWorkspace, getWorkspace, updateWorkspace, deleteWorkspace, putWorkspaceMember, removeWorkspaceMember, getAgentPlacement, putAgentPlacement, listOrgAgents, putWorkspaceAgent, deleteWorkspaceAgent, createWorkspaceAgentInvite, excludeSessionAgent, listExcludedSessionAgents, listSessionAgents, includeSessionAgent, setSessionWorkspace, moveSessionToWorkspace, listWorkspaceInvites, inviteToWorkspace, cancelWorkspaceInvite, listMyInvites, answerMyInvite, announceSessionStarted, announceWhenReported, listWorkspaceFiles, createWorkspaceFile, confirmWorkspaceFile, workspaceFileDownload, updateWorkspaceFile, deleteWorkspaceFile, createWorkspaceFolder, listWorkspaceFileVersions, githubStatus, githubConnectUrl, aiVmFollow, aiVmUnfollow, aiVmStatus, aiVmConnect, aiVmUpdate, aiVmSignIn, aiVmWake, aiVmDisconnect } from './account.js'
+import { readAccount, saveAccount, workspaceGithub, setWorkspaceGithub, removeWorkspaceGithub, setOrgGithub, clearAccount, clearAccountIf, resumeAccount, startLink, waitForLink, fetchMe, signOut, revokeToken, accountFromProfile, renameSession, createAgentInvite, listAgents, listAccessTypes, listCollaborators, listGrants, putGrant, deleteGrant, inviteToSession, listSessionInvites, cancelSessionInvite, listWorkspaces, listOrgs, createWorkspace, getWorkspace, updateWorkspace, deleteWorkspace, putWorkspaceMember, removeWorkspaceMember, getAgentPlacement, putAgentPlacement, listOrgAgents, putWorkspaceAgent, deleteWorkspaceAgent, createWorkspaceAgentInvite, excludeSessionAgent, listExcludedSessionAgents, listSessionAgents, includeSessionAgent, setSessionWorkspace, moveSessionToWorkspace, listWorkspaceInvites, inviteToWorkspace, cancelWorkspaceInvite, listMyInvites, answerMyInvite, announceSessionStarted, announceWhenReported, listWorkspaceFiles, createWorkspaceFile, confirmWorkspaceFile, workspaceFileDownload, updateWorkspaceFile, deleteWorkspaceFile, createWorkspaceFolder, listWorkspaceFileVersions, githubStatus, githubConnectUrl, listSandboxKeys, createSandboxKey, rotateSandboxKey, revokeSandboxKey, removeSandboxKey, aiVmFollow, aiVmUnfollow, aiVmStatus, aiVmConnect, aiVmUpdate, aiVmSignIn, aiVmWake, aiVmDisconnect, apiUrl } from './account.js'
 import { personaName } from './persona.js'
 import { CLOUD_LABEL } from './cloud-ai.js'
 import { effectiveAccess, builtinType } from './session-access.js'
 import { cleanSessionName, BAD_SESSION_NAME, SESSION_NAME_MAX } from './session-name.js'
-import { personPasses } from './pass-source.js'
+import { personPasses, personApiAuth } from './pass-source.js'
 import { INVALID_INVITE } from './ui/invite.js'
 import { loadIdentity } from './identity.js'
 import { currentVersion, localReleases, latestRelease, compareVersions, downloadUrl, seenVersion, markSeen, hiddenUpdate, hideUpdate } from './releases.js'
 import { createReporter } from './report.js'
 import { queryHistory } from './history.js'
 import { contentDisposition } from './api/file-paths.js'
+import { getSecrets, putSecretSettings, setSecretWho, deleteSecret, secretUses, saveSecrets, secretAsks, answerAsk } from './secrets-client.js'
+import { envFilesIn, knownEnvFile, envValues } from './secret-import.js'
 
 const TOOL_NAMES = ['Claude Code', 'Cursor', 'Codex', 'xAI', 'Windsurf', 'GitHub Copilot', 'Zed', 'Aider', 'Other']
 const MAX_WS_FILE_BYTES = 500 * 1024 * 1024
@@ -150,7 +152,6 @@ export const STATIC = {
   '/tool-logo.js': ['tool-logo.js', 'text/javascript; charset=utf-8'],
   '/tree.js': ['tree.js', 'text/javascript; charset=utf-8'],
   '/fileview.js': ['fileview.js', 'text/javascript; charset=utf-8'],
-  '/merges.js': ['merges.js', 'text/javascript; charset=utf-8'],
   '/catchup.js': ['catchup.js', 'text/javascript; charset=utf-8'],
   '/home.js': ['home.js', 'text/javascript; charset=utf-8'],
   '/signin.js': ['signin.js', 'text/javascript; charset=utf-8'],
@@ -176,7 +177,12 @@ export const STATIC = {
   '/sounds.js': ['sounds.js', 'text/javascript; charset=utf-8'],
   '/git-rule.js': ['git-rule.js', 'text/javascript; charset=utf-8'],
   '/cloud-ai.js': ['cloud-ai.js', 'text/javascript; charset=utf-8'],
-  '/cloud-ai-model.js': ['cloud-ai-model.js', 'text/javascript; charset=utf-8']
+  '/cloud-ai-model.js': ['cloud-ai-model.js', 'text/javascript; charset=utf-8'],
+  '/sandbox-keys.js': ['sandbox-keys.js', 'text/javascript; charset=utf-8'],
+  '/sandbox-keys-model.js': ['sandbox-keys-model.js', 'text/javascript; charset=utf-8'],
+  '/secrets.js': ['secrets.js', 'text/javascript; charset=utf-8'],
+  '/secrets-view.js': ['secrets-view.js', 'text/javascript; charset=utf-8'],
+  '/secret-rules.js': ['secret-rules.js', 'text/javascript; charset=utf-8']
 }
 
 // The page's Content-Security-Policy: scripts only from our own files (no inline script or
@@ -421,6 +427,8 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
         prefer: prefer === 'local' ? 'local' : 'remote',
         inviteServer,
         passes: sessionPasses,
+        // Secrets (`quilt run` in this folder): the API as this computer's account.
+        apiAuth: personApiAuth,
         // A new session is named after its folder (the owner can rename it later).
         startName: mode === 'create' ? cleanSessionName([...path.basename(dir)].slice(0, SESSION_NAME_MAX).join('')) || '' : '',
         // Your default for what agents may commit, set on the new room once the relay makes you its owner.
@@ -525,11 +533,27 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
       if (has) log('☁️  your cloud AI is joining this session too')
     }, (err) => log(`could not tell your cloud AI about this session: ${err.message}`))
   }
+  // Sessions handed to the cloud AI since it was connected (rooms), so each is handed over once.
+  const handed = new Set()
+  /**
+   * The sessions open now that the cloud AI isn't in, handed to it: one connected while sessions
+   * were already open joins them too, not only the ones started after.
+   */
+  const followOpen = (vm) => {
+    const inIt = new Set((vm.sessions || []).map((x) => x.room))
+    for (const entry of runs.values()) {
+      const room = entry.run && entry.run.session && entry.run.session.room
+      if (!room || !entry.run.invite || inIt.has(room) || handed.has(room)) continue
+      handed.add(room)
+      followWithCloudAi(entry.run.invite)
+    }
+  }
   // Settings → Your AI: the person's cloud AI, as this computer's account. `vm` is null without one.
   const CLOUD_TOOLS = ['Claude Code', 'Codex', 'Cursor']
   const cloudView = (vm) => {
     hasCloudAi = !!vm
-    if (!vm) return { vm: null }
+    if (!vm) { handed.clear(); return { vm: null } }
+    followOpen(vm)
     const person = readAccount()?.account?.name || profile().name || 'You'
     return { vm: { ...vm, name: personaName(person, CLOUD_LABEL) } }
   }
@@ -601,6 +625,24 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
   const needInviteId = (id) => { if (!/^[0-9a-f-]{36}$/i.test(String(id || ''))) throw httpError(400, 'Which invite?'); return String(id) }
   const needWorkspaceId = (id) => { if (!/^[0-9a-f-]{36}$/i.test(String(id || ''))) throw httpError(400, 'Which workspace?'); return id }
   const needAgentId = (id) => { if (!/^[0-9a-f-]{36}$/i.test(String(id || ''))) throw httpError(400, 'Which agent?'); return id }
+  const needKeyId = (id) => { if (!/^[0-9a-f-]{36}$/i.test(String(id || ''))) throw httpError(400, 'Which key?'); return String(id) }
+  /**
+   * Sessions on this computer a sandbox key can be made for: open ones, then recent ones, each with
+   * its invite link (read from its folder; the page never gets it). { value, room, name, link }.
+   */
+  const localSessions = () => {
+    const seen = new Set()
+    const out = []
+    const add = (dir, link, name) => {
+      const c = readConfig(dir)
+      if (!c || !c.room || seen.has(c.room) || !(link || c.secret)) return
+      seen.add(c.room)
+      out.push({ value: `local:${idFor(dir)}`, room: c.room, name: name || path.basename(dir), link: link || encodeInvite({ server: c.inviteServer || c.server, room: c.room, secret: c.secret }) })
+    }
+    for (const r of runs.values()) add(r.run.dir, r.run.invite, r.run.session.status().sessionName)
+    for (const r of recentList()) if (!r.unsupported) add(r.dir, '', '')
+    return out
+  }
   const needOrgSlug = (slug) => { if (!/^[a-z0-9][a-z0-9-]{0,63}$/i.test(String(slug || ''))) throw httpError(400, 'Which org?'); return slug }
   const ofWorkspace = (id) => ({
     running: [...runs.keys()].filter((k) => (readConfig(runs.get(k).run.dir) || {}).workspace === id),
@@ -720,8 +762,60 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
     })
   }
 
+  // Secrets (src/ui/secrets.js): names and settings through the accounts API; a typed or imported
+  // value goes from here straight to the vault with a write ticket, and is never kept or logged.
+  const SECRET_SCOPE_ID = { org: /^[a-z0-9][a-z0-9-]{0,63}$/i, workspace: /^[0-9a-f-]{36}$/i, session: /^[A-Za-z0-9_-]{1,64}$/ }
+  const secretsApi = (token) => ({ api: apiUrl(), token })
+  async function secretsRoute (method, scope, id, rest, body) {
+    if (!SECRET_SCOPE_ID[scope] || !SECRET_SCOPE_ID[scope].test(id)) throw httpError(400, 'Which secrets?')
+    return asAccount(async (token) => {
+      const c = secretsApi(token)
+      if (method === 'GET' && rest === '') return getSecrets(c, scope, id)
+      if (method === 'GET' && rest === '/uses') return secretUses(c, scope, id)
+      if (method === 'POST' && rest === '/settings') return putSecretSettings(c, scope, id, Object.fromEntries(['inheritOff', 'agentsOn', 'agents'].filter((k) => k in body).map((k) => [k, body[k]])))
+      if (method === 'POST' && rest === '/who') return setSecretWho(c, scope, id, String(body.name || ''), String(body.who || ''))
+      if (method === 'POST' && rest === '/delete') return deleteSecret(c, scope, id, String(body.name || ''))
+      if (method === 'POST' && rest === '/save') {
+        const values = body.values && typeof body.values === 'object' ? Object.fromEntries(Object.entries(body.values).map(([k, v]) => [k, String(v ?? '')])) : {}
+        return saveSecrets(c, scope, id, Array.isArray(body.entries) ? body.entries : [], values)
+      }
+      throw httpError(404, 'not found')
+    })
+  }
+  /** The folders whose .env files a card may import: one session's, or a workspace's sessions' on this computer. */
+  const envDirs = (b) => {
+    if (b && b.sessionId) { const r = runs.get(String(b.sessionId)); return r ? [r.run.dir] : [] }
+    if (b && b.workspaceId) { const w = ofWorkspace(needWorkspaceId(b.workspaceId)); return [...w.running.map((k) => runs.get(k)?.run.dir), ...w.recent.map((r) => r.dir)] }
+    return []
+  }
+
   const api = {
     'GET /api/account': () => accountState(),
+    // Which optional parts the accounts API has on (secrets): public there; off when it can't be reached.
+    'GET /api/features': async () => {
+      try {
+        const res = await fetch(`${apiUrl()}/v1/features`, { signal: AbortSignal.timeout(5000) })
+        const f = res.ok ? await res.json() : {}
+        return { secrets: !!f.secrets, workspaces: !!f.workspaces }
+      } catch { return { secrets: false, workspaces: false } }
+    },
+    'POST /api/secrets/env-scan': (b) => {
+      const dirs = envDirs(b)
+      if (!dirs.length) return { files: [], empty: 'Open this session (or one of the workspace\'s) on this computer to import its .env files.' }
+      return { files: envFilesIn(dirs) }
+    },
+    'POST /api/secrets/env-import': (b) => {
+      const f = knownEnvFile(envFilesIn(envDirs(b)), b.file)
+      const entries = (Array.isArray(b.entries) ? b.entries : []).filter((e) => f.entries.some((x) => x.name === e.name && !x.skip))
+      if (!entries.length) throw httpError(400, 'Pick the secrets to save.')
+      if (!SECRET_SCOPE_ID[b.scope] || !SECRET_SCOPE_ID[b.scope].test(String(b.id || ''))) throw httpError(400, 'Which secrets?')
+      return asAccount((token) => saveSecrets(secretsApi(token), b.scope, String(b.id), entries, envValues(f.path, entries.map((e) => e.name))))
+    },
+    'POST /api/secrets/env-delete': (b) => {
+      const f = knownEnvFile(envFilesIn(envDirs(b)), b.file)
+      fs.rmSync(f.path, { force: true })
+      return { ok: true }
+    },
     'GET /api/access-types': () => asAccount(async (token) => ({ types: await listAccessTypes({ token }) })),
     // Quilt's GitHub App: whether this account connected GitHub, and the link that connects it (opened in the browser).
     ...cloudRoutes,
@@ -754,6 +848,20 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
     'POST /api/workspaces/:id/members': (b, id) => asAccount(async (token) => ({ member: await putWorkspaceMember({ token, id: needWorkspaceId(id), account: String(b.account || ''), access: String(b.access || ''), sessions: b.sessions === undefined ? undefined : String(b.sessions) }) })),
     // Where agents work: an agent's placement (yours), an org's agents, a workspace's say over
     // an agent placed there, and a link for a new agent that joins the workspace.
+    // An agent's sandbox keys (sandbox-keys.js): the API's list, plus this computer's sessions for New key.
+    'GET /api/agents/:id/sandbox-keys': (b, id) => asAccount(async (token) => ({ ...(await listSandboxKeys({ token, id: needAgentId(id) })), local: localSessions().map(({ link, ...s }) => s) })),
+    // `session`: local:<id> (a session on this computer: its link is read here) or room:<room> (one a key already has); or `link`, pasted.
+    'POST /api/agents/:id/sandbox-keys': (b, id) => asAccount(async (token) => {
+      const pick = String(b.session || '')
+      const local = pick.startsWith('local:') ? localSessions().find((s) => s.value === pick) : null
+      if (pick.startsWith('local:') && !local) throw httpError(404, 'That session is not on this computer any more.')
+      const where = local ? { session: local.link, sessionName: local.name } : pick.startsWith('room:') ? { room: pick.slice(5) } : { session: String(b.link || '').trim() }
+      const r = await createSandboxKey({ token, id: needAgentId(id), name: String(b.name || '').trim(), ...where })
+      return { envKey: r.envKey, key: r.key }
+    }),
+    'POST /api/agents/:id/sandbox-keys/rotate': (b, id) => asAccount(async (token) => { const r = await rotateSandboxKey({ token, id: needAgentId(id), keyId: needKeyId(b.keyId) }); return { envKey: r.envKey, key: r.key } }),
+    'POST /api/agents/:id/sandbox-keys/revoke': (b, id) => asAccount(async (token) => { await revokeSandboxKey({ token, id: needAgentId(id), keyId: needKeyId(b.keyId) }); return { ok: true } }),
+    'POST /api/agents/:id/sandbox-keys/remove': (b, id) => asAccount(async (token) => { await removeSandboxKey({ token, id: needAgentId(id), keyId: needKeyId(b.keyId) }); return { ok: true } }),
     'GET /api/agents/:id/placement': (b, id) => asAccount(async (token) => ({ placement: await getAgentPlacement({ token, id: needAgentId(id) }) })),
     'POST /api/agents/:id/placement': (b, id) => asAccount(async (token) => ({ placement: await putAgentPlacement({ token, id: needAgentId(id), placement: { reach: b.reach, workspaceIds: b.workspaceIds, sessions: b.sessions, access: b.access, scopes: b.scopes } }) })),
     'GET /api/orgs/:slug/agents': (b, slug) => asAccount(async (token) => ({ agents: await listOrgAgents({ token, slug: needOrgSlug(slug) }) })),
@@ -817,21 +925,6 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
     // Gathering the project's AI rules into AGENTS.md (project-rules.js): look first, then apply what was shown.
     'GET /api/sessions/:id/rules/gather': (b, id) => get(id).rulesGatherPlan(),
     'POST /api/sessions/:id/rules/gather': (b, id) => get(id).applyRulesGather(String(b.key || '')),
-    'POST /api/sessions/:id/merges/resolve': async (b, id) => { const r = await get(id).settleMerge(String(b.id || ''), { how: b.how }); pushStatus(id); return r },
-    'POST /api/sessions/:id/merges/send': async (b, id) => {
-      const s = get(id)
-      const mergeId = String(b.id || '')
-      const { prompt } = await s.sendMerge(mergeId)
-      pushStatus(id)
-      const app = String(b.app || '')
-      // Your AI, working on its own (autowork.js): the run says how it went in chat.
-      if (app === 'auto') {
-        const rec = s.mergeList().find((m) => m.id === mergeId)
-        return { ...autowork().sendMerge(s, { id: mergeId, path: rec ? rec.path : '', prompt }), app }
-      }
-      const { copied, filled } = await openIn(app, s.root, { prompt })
-      return { copied, filled: !!filled, app }
-    },
     'POST /api/sessions/:id/stop': (b, id) => stop(id).then(() => ({ ok: true })),
     'POST /api/sessions/:id/say': (b, id) => get(id).say(b.text, { to: b.to || null }),
     'POST /api/sessions/:id/focus': (b, id) => { get(id).setFocus(b.text); return { ok: true } },
@@ -1034,12 +1127,25 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
       let m = url.pathname.match(/^\/api\/sessions\/([a-f0-9]+)\/send$/)
       if (req.method === 'POST' && m) return json(200, await receiveUpload(req, get(m[1])))
       m = url.pathname.match(/^\/api\/sessions\/([a-f0-9]+)\/files\/([a-f0-9]+)$/)
-      if (req.method === 'GET' && m) return await serveFile(res, get(m[1]), m[2])
+      if (req.method === 'GET' && m) return await serveFile(res, get(m[1]), m[2], url.searchParams.get('inline') === '1')
       const wu = url.pathname.match(/^\/api\/workspaces\/([^/]+)\/upload$/)
       if (req.method === 'PUT' && wu) return json(200, await receiveWorkspaceUpload(req, wu[1]))
       const wd = url.pathname.match(/^\/api\/workspaces\/([^/]+)\/files\/([^/]+)\/data$/)
       if (req.method === 'GET' && wd) return await streamWorkspaceFile(req, res, wd[1], wd[2])
 
+      // Secrets: /api/secrets/<scope>/<id>[/<what>], and the asks for people-only secrets.
+      const sec = url.pathname.match(/^\/api\/secrets\/(org|workspace|session)\/([^/]+)(\/(?:uses|settings|who|delete|save))?$/)
+      const askOne = url.pathname.match(/^\/api\/secret-asks\/([0-9a-f-]{36})$/i)
+      if (sec || askOne || url.pathname === '/api/secret-asks') {
+        let raw = ''
+        for await (const chunk of req) raw += chunk
+        const body = raw ? JSON.parse(raw) : {}
+        if (sec) return json(200, await secretsRoute(req.method, sec[1], decodeURIComponent(sec[2]), sec[3] || '', body))
+        if (askOne && req.method === 'POST') return json(200, await asAccount((token) => answerAsk(secretsApi(token), askOne[1], body.allow === true)))
+        if (!askOne && req.method === 'GET') return json(200, await asAccount((token) => secretAsks(secretsApi(token), { wait: url.searchParams.get('wait') === '1' })))
+        return json(404, { error: 'not found' })
+      }
+
       let pathKey = url.pathname
         .replace(/^\/api\/sessions\/[a-f0-9]+/, '/api/sessions/:id')
         .replace(/^\/api\/workspaces\/[^/]+/, '/api/workspaces/:id')
@@ -1134,14 +1240,17 @@ export async function startUi ({ port = 7420, onShutdown, preview = false, repor
     }
   }
 
-  async function serveFile (res, session, msgId) {
+  // A chat file the page shows as a picture (?inline=1); anything else is a download.
+  const CHAT_IMAGES = { '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp' }
+
+  async function serveFile (res, session, msgId, inline = false) {
     const msg = session.messages({ limit: 500, markRead: false }).find((m) => m.id === msgId)
     if (!msg || !msg.file) throw httpError(404, 'No such file.')
     const local = msg.file.localPath ? path.join(session.root, msg.file.localPath) : await session.fetchFile(msgId)
-    res.writeHead(200, {
-      'content-type': 'application/octet-stream',
-      'content-disposition': `attachment; filename="${msg.file.name.replace(/[^\w.\- ]/g, '_')}"`
-    })
+    const image = inline && CHAT_IMAGES[path.extname(msg.file.name).toLowerCase()]
+    res.writeHead(200, image
+      ? { 'content-type': image, 'x-content-type-options': 'nosniff', 'content-security-policy': 'sandbox', 'content-disposition': 'inline' }
+      : { 'content-type': 'application/octet-stream', 'content-disposition': `attachment; filename="${msg.file.name.replace(/[^\w.\- ]/g, '_')}"` })
     fs.createReadStream(local).pipe(res)
   }
 

package/src/update-check.js

@@ -3,7 +3,7 @@
 // quilt_check_update answers for whatever image the agent names.
 import { currentVersion, latestRelease, compareVersions } from './releases.js'
 
-export const UPDATE_HOW = 'Update Quilt (the desktop app: Settings → About → Update Quilt; the CLI: npm i -g github:DanielCarmichaelGit/heyquilt, or on a Linux server run its install script again: curl -fsSL https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/install.sh | sh), then rejoin the session.'
+export const UPDATE_HOW = 'Update Quilt (the desktop app: Settings → About → Update Quilt; the CLI: npm i -g heyquilt, or on a Linux server run its install script again: curl -fsSL https://heyquilt.com/install.sh | sh), then rejoin the session.'
 
 /** True when `image` looks like a Quilt version. */
 export const validImage = (image) => /^v?\d+\.\d+\.\d+$/.test(String(image || '').trim())

package/src/upstream.js

@@ -3,13 +3,15 @@
 // running git pull. Quilt never merges git history: the branch only ever moves
 // forward to a commit it is behind. What it merges is the session's
 // uncommitted work into those commits' files, file by file, the way
-// `git pull --autostash` would, except nothing is written unless every file
-// merges cleanly.
+// `git pull --autostash` would, except that where both changed the same lines
+// Quilt combines them itself (combine, merge3.js mergeAuto): nobody is asked to
+// merge (docs/superpowers/specs/2026-10-18-automatic-merges.md). Only a file git
+// can't read holds a catch-up up.
 //
 // planCatchUp is pure: session.js reads git and the disk, asks for a plan,
 // and applies it (bringIn there).
 import crypto from 'node:crypto'
-import { mergeAdditive as merge3 } from './merge3.js'
+import { mergeAuto } from './merge3.js'
 
 const isText = (k) => typeof k === 'string' && !k.startsWith('bin:')
 
@@ -29,22 +31,6 @@ export const wasPublished = (published, rel, key) => {
   return !!ids && ids.includes(contentId(key))
 }
 
-/**
- * How the folder at commit `from` (its files on disk: the commit plus the
- * session's uncommitted work) becomes the folder at `to` with that work kept.
- *
- * - changes: Map path -> git status letter (A, M, D, T...) between the commits.
- * - base / theirs: Map path -> the file at `from` / at `to` (text, "bin:<sha1>",
- *   null when absent, undefined when git couldn't read it).
- * - disk(rel): the file in the folder now (same keys).
- * - moved: candidates for a file the session moved: Map path -> its text, for
- *   files on disk that `from` didn't have (new or moved here).
- * - emptied: folders the session emptied (had files at `from`, none on disk now).
- *
- * Returns { writes: Map path -> key (null: delete), moves: [{ from, to }],
- * conflicts: [{ path, why }], strays: [path] }. With conflicts, writes is empty:
- * a catch-up is all or nothing.
- */
 /** What the session published (relay commits), read from the room document: Map path -> [content ids]. */
 export function publishedOf (doc) {
   const out = new Map()
@@ -72,11 +58,63 @@ export function notePublishedIds (doc, entries, origin) {
   }, origin)
 }
 
-export function planCatchUp ({ changes, base, theirs, disk, moved = new Map(), emptied = new Set(), published = null }) {
+/**
+ * Two versions of a file that both moved on from `base`, combined the way Quilt does it on its own
+ * (keys as planCatchUp's: text, "bin:<sha1>", null when absent): lines only one side changed are
+ * kept, lines both changed go to the newer side (`oursNewer`), an edit beats a deletion, and a binary
+ * file (or one both created, differently) is the newer version. Returns { key, lost, how }: `lost` as mergeAuto's ({ side, lines, kept,
+ * at }; a binary that lost has `binary: true` and no lines); `how` 'lines', 'kept-edit' or 'newer'.
+ */
+export function combine (base, ours, theirs, { oursNewer = true, union = false } = {}) {
+  if (ours === theirs || theirs === base) return { key: ours, lost: [], how: 'lines' }
+  if (ours === base) return { key: theirs, lost: [], how: 'lines' }
+  // Deleted on one side, edited on the other: the edit stays (a deletion is cheap to redo; lost work is not).
+  if (ours === null) return { key: theirs, lost: [], how: 'kept-edit', deleted: 'ours' }
+  if (theirs === null) return { key: ours, lost: [], how: 'kept-edit', deleted: 'theirs' }
+  if (base === null && isText(ours) && isText(theirs) && !union) {
+    // Created on both sides, differently: nothing to measure either from, so the newer file, and the other's lines it lacks are what lost.
+    const [won, lose] = oursNewer ? [ours, theirs] : [theirs, ours]
+    const left = new Map()
+    for (const l of won.split('\n')) left.set(l, (left.get(l) || 0) + 1)
+    const gone = lose.split('\n').filter((l) => { const n = left.get(l); if (n) { left.set(l, n - 1); return false } return l !== '' })
+    return { key: won, lost: gone.length ? [{ side: oursNewer ? 'theirs' : 'ours', lines: gone, kept: [], at: 0 }] : [], how: 'newer' }
+  }
+  if ((base === null || isText(base)) && isText(ours) && isText(theirs)) {
+    const r = mergeAuto(base ?? '', ours, theirs, { oursNewer, union })
+    return { key: r.text, lost: r.lost, how: 'lines' }
+  }
+  // A binary file (or one that became one): the newer version.
+  return { key: oursNewer ? ours : theirs, lost: [{ side: oursNewer ? 'theirs' : 'ours', lines: [], kept: [], at: 0, binary: true }], how: 'newer' }
+}
+
+/**
+ * How the folder at commit `from` (its files on disk: the commit plus the
+ * session's uncommitted work) becomes the folder at `to` with that work kept.
+ *
+ * - changes: Map path -> git status letter (A, M, D, T...) between the commits.
+ * - base / theirs: Map path -> the file at `from` / at `to` (text, "bin:<sha1>",
+ *   null when absent, undefined when git couldn't read it).
+ * - disk(rel): the file in the folder now (same keys).
+ * - moved: candidates for a file the session moved: Map path -> its text, for
+ *   files on disk that `from` didn't have (new or moved here).
+ * - emptied: folders the session emptied (had files at `from`, none on disk now).
+ *
+ * - oursNewer(rel): whether the session's (the folder's) edit of rel is newer than
+ *   the commits' (it keeps the lines both changed); union(rel): a merge=union file.
+ *
+ * Every file both sides changed is combined (combine): nothing clashes. Returns
+ * { writes: Map path -> key (null: delete), moves: [{ from, to }], conflicts:
+ * [{ path, why }] (only files git couldn't read), strays: [path], merged: [{ path,
+ * how, lost, oursNewer, deleted? }] (the files both changed, for the history and
+ * the notice to whoever's lines lost) }. With conflicts, writes is empty: a
+ * catch-up is all or nothing.
+ */
+export function planCatchUp ({ changes, base, theirs, disk, moved = new Map(), emptied = new Set(), published = null, oursNewer = () => true, union = () => false }) {
   const writes = new Map()
   const conflicts = []
   const moves = []
   const strays = []
+  const merged = []
   const taken = new Set()
   for (const rel of changes.keys()) {
     const b = base.get(rel)
@@ -91,33 +129,32 @@ export function planCatchUp ({ changes, base, theirs, disk, moved = new Map(), e
       if (b === null && t !== null && emptied.has(dirOf(rel))) strays.push(rel)
       continue
     }
-    if (o === t) continue // the session already has it
+    if (o === t || t === b) continue // the session already has it, or the commits didn't change it
     // The commits bring a version of this file the session itself published (an agent committed it
     // to a branch, and the branch was merged, squashed or rebased in): the session's copy is that
     // version or newer, so it stays as it is. Matched by content, so every merge strategy counts.
     if (o !== null && wasPublished(published, rel, t)) continue
+    const newer = !!oursNewer(rel)
     if (o === null && isText(b) && isText(t)) {
       // Gone here, changed there: the session may have moved it. Followed by content, as git
       // follows a rename, into the moved copy, which takes the commits' change.
       const to = findMove(rel, b, moved, taken)
       if (to) {
-        const r = merge3(b, moved.get(to), t)
-        if (!r.conflicts.length) { taken.add(to); moves.push({ from: rel, to }); if (r.text !== moved.get(to)) writes.set(to, r.text); continue }
-        conflicts.push({ path: rel, why: `moved to ${to} here, and changed in the same lines there` })
+        const r = mergeAuto(b, moved.get(to), t, { oursNewer: newer, union: !!union(to) })
+        taken.add(to)
+        moves.push({ from: rel, to })
+        if (r.text !== moved.get(to)) writes.set(to, r.text)
+        if (r.lost.length) merged.push({ path: to, how: 'lines', lost: r.lost, oursNewer: newer })
         continue
       }
-      conflicts.push({ path: rel, why: 'deleted here, changed in the new commits' })
-      continue
     }
-    if (t === null) { conflicts.push({ path: rel, why: 'changed here, deleted in the new commits' }); continue }
-    if (b === null) { conflicts.push({ path: rel, why: 'added both here and in the new commits, differently' }); continue }
-    if (!isText(b) || !isText(o) || !isText(t)) { conflicts.push({ path: rel, why: 'a binary file changed both here and in the new commits' }); continue }
-    const r = merge3(b, o, t)
-    if (r.conflicts.length) { conflicts.push({ path: rel, why: 'changed in the same lines here and in the new commits' }); continue }
-    if (r.text !== o) writes.set(rel, r.text)
+    // Both changed it: Quilt combines them (an edit beats a deletion; the newer edit keeps the lines both changed).
+    const r = combine(b, o, t, { oursNewer: newer, union: !!union(rel) })
+    if (r.key !== o) writes.set(rel, r.key)
+    merged.push({ path: rel, how: r.how, lost: r.lost, oursNewer: newer, ...(r.deleted ? { deleted: r.deleted } : {}) })
   }
-  if (conflicts.length) return { writes: new Map(), moves: [], conflicts, strays: [] }
-  return { writes, moves, conflicts, strays }
+  if (conflicts.length) return { writes: new Map(), moves: [], conflicts, strays: [], merged: [] }
+  return { writes, moves, conflicts, strays, merged }
 }
 
 const dirOf = (rel) => rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : ''
@@ -146,10 +183,10 @@ export function similarity (a, b) {
   return same / Math.max(la.length, lb.length, 1)
 }
 
-/** One line for the AI and the log about why a catch-up waits. */
-export function catchUpAdvice ({ branch, upstream, behind, conflicts, diverged, ahead }) {
+/** One line for the AI and the log about why a catch-up waits. Nobody is told to pull or merge: Quilt combines what it can read. */
+export function catchUpAdvice ({ branch, upstream, behind, conflicts = [], diverged, ahead }) {
   const n = (k, w) => `${k} ${w}${k === 1 ? '' : 's'}`
-  if (diverged) return `${branch} and ${upstream} have both moved on (${n(ahead, 'commit')} here, ${n(behind, 'commit')} there). Quilt never merges git history: pull or rebase it yourself in this folder, and the session takes in whatever that changes.`
+  if (diverged) return `${branch} and ${upstream} have both moved on (${n(ahead, 'commit')} here, ${n(behind, 'commit')} there). Quilt never rewrites git history in this folder: the session's files take in ${upstream}'s changes, combined with yours, and your commits go to GitHub through the session.`
   const list = conflicts.slice(0, 4).map((c) => `${c.path} (${c.why})`).join('; ') + (conflicts.length > 4 ? `; and ${conflicts.length - 4} more` : '')
-  return `${branch} is ${n(behind, 'commit')} behind ${upstream}, and the session's uncommitted work clashes with them in ${list}. Quilt brought nothing in. Run git pull in this folder and resolve those; the session takes in the result.`
+  return `${branch} is ${n(behind, 'commit')} behind ${upstream}, and Quilt can't read ${list} to combine ${conflicts.length === 1 ? 'it' : 'them'} with the session's work, so it brought nothing in yet. A folder on ${branch} that can read ${conflicts.length === 1 ? 'it' : 'them'} brings the commits in; nothing to merge by hand.`
 }

package/src/vault/crypto.js

@@ -0,0 +1,96 @@
+// The vault's sealing (docs/superpowers/specs/2026-10-18-secrets.md). Each scope (a team, a
+// workspace, a session) has its own random data key; values are sealed with AES-256-GCM under
+// it, bound to their scope and name. Data keys are sealed by a root key behind a provider:
+// `env` (VAULT_ROOT_KEY, here) or `aws-kms` (kms.js). Only the vault runs this file.
+import crypto from 'node:crypto'
+
+const b64u = (buf) => Buffer.from(buf).toString('base64url')
+const unb64u = (s) => Buffer.from(String(s), 'base64url')
+const ALG = 'aes-256-gcm'
+
+/** A new data key: 32 random bytes. */
+export const newDataKey = () => crypto.randomBytes(32)
+
+const scopeOf = ({ scopeType, scopeId }) => `${scopeType}:${scopeId}`
+const valueAad = (ctx, name) => `quilt-secret:v1:${scopeOf(ctx)}:${name}`
+const keyAad = (ctx, version) => `quilt-data-key:v1:${scopeOf(ctx)}:${version}`
+
+function seal (key, aad, plain) {
+  const iv = crypto.randomBytes(12)
+  const c = crypto.createCipheriv(ALG, key, iv)
+  c.setAAD(Buffer.from(aad))
+  const ct = Buffer.concat([c.update(plain), c.final()])
+  return [b64u(iv), b64u(ct), b64u(c.getAuthTag())].join('.')
+}
+
+function open (key, aad, sealed) {
+  const [iv, ct, tag] = String(sealed).split('.')
+  if (!iv || ct === undefined || !tag) throw new Error('that sealed value is malformed')
+  const d = crypto.createDecipheriv(ALG, key, unb64u(iv))
+  d.setAAD(Buffer.from(aad))
+  d.setAuthTag(unb64u(tag))
+  return Buffer.concat([d.update(unb64u(ct)), d.final()])
+}
+
+/** A value sealed under its scope's data key: `v1.<iv>.<ciphertext>.<tag>`. */
+export function sealValue (dataKey, ctx, name, value) {
+  return `v1.${seal(dataKey, valueAad(ctx, name), Buffer.from(String(value), 'utf8'))}`
+}
+
+/** The value again; throws when the key, scope or name doesn't match. */
+export function openValue (dataKey, ctx, name, sealed) {
+  const s = String(sealed)
+  if (!s.startsWith('v1.')) throw new Error('unknown sealed value version')
+  return open(dataKey, valueAad(ctx, name), s.slice(3)).toString('utf8')
+}
+
+/** The digest the app shows: HMAC-SHA256 of the value under the vault's own digest key. */
+export function digestOf (digestKey, value) {
+  return crypto.createHmac('sha256', digestKey).update(String(value), 'utf8').digest('hex')
+}
+
+/** A 32-byte key from base64 (or base64url), or an error naming the variable. */
+export function keyFrom (value, name) {
+  const buf = Buffer.from(String(value || '').trim(), 'base64')
+  if (buf.length !== 32) throw new Error(`${name} must be 32 random bytes in base64 (openssl rand -base64 32)`)
+  return buf
+}
+
+/**
+ * The `env` provider: data keys sealed with AES-256-GCM under VAULT_ROOT_KEY, bound to their
+ * scope and version. Sealed keys look like `env1.<iv>.<ciphertext>.<tag>`.
+ */
+export function envKeyProvider ({ rootKey }) {
+  const key = keyFrom(rootKey, 'VAULT_ROOT_KEY')
+  return {
+    id: 'env',
+    prefix: 'env1.',
+    async wrap (dataKey, ctx) { return `env1.${seal(key, keyAad(ctx, ctx.version), dataKey)}` },
+    async unwrap (sealed, ctx) { return open(key, keyAad(ctx, ctx.version), String(sealed).slice(5)) }
+  }
+}
+
+/**
+ * Providers together: new keys are sealed by the first; a sealed key opens with whichever
+ * made it (its prefix), so switching to KMS leaves keys sealed under the root key readable.
+ * Opened keys are kept in memory for `cacheMs`.
+ */
+export function keyRing (providers, { cacheMs = 5 * 60 * 1000, now = Date.now } = {}) {
+  const list = providers.filter(Boolean)
+  if (!list.length) throw new Error('the vault has no root key: set VAULT_ROOT_KEY (or VAULT_KEY_PROVIDER=aws-kms)')
+  const cache = new Map() // sealed -> { key, at }
+  return {
+    primary: list[0].id,
+    async wrap (dataKey, ctx) { return list[0].wrap(dataKey, ctx) },
+    async unwrap (sealed, ctx) {
+      const hit = cache.get(sealed)
+      if (hit && now() - hit.at < cacheMs) return hit.key
+      const p = list.find((x) => String(sealed).startsWith(x.prefix))
+      if (!p) throw new Error('this data key was sealed by a key provider the vault does not have')
+      const key = await p.unwrap(sealed, ctx)
+      cache.set(sealed, { key, at: now() })
+      if (cache.size > 10_000) cache.delete(cache.keys().next().value)
+      return key
+    }
+  }
+}

package/src/vault/kms.js

@@ -0,0 +1,61 @@
+// The `aws-kms` key provider: the vault's data keys sealed by an AWS KMS key, so the root key
+// never leaves AWS and every use of it is in AWS's own log. Switched on by the vault's
+// environment (VAULT_KEY_PROVIDER=aws-kms, VAULT_KMS_KEY_ID, AWS_REGION and the access keys).
+// Plain HTTPS with SigV4 (sigv4.js): no AWS SDK in the vault.
+import { signAws } from './sigv4.js'
+
+/** EncryptionContext for a scope's data key: KMS refuses to open it for any other. */
+const contextOf = (ctx) => ({ quilt_scope: `${ctx.scopeType}:${ctx.scopeId}`, quilt_version: String(ctx.version) })
+
+export function awsKmsProvider ({ keyId, region, credentials, endpoint = '', fetch: fetchImpl = globalThis.fetch, now = Date.now, timeoutMs = 10_000 }) {
+  if (!keyId) throw new Error('VAULT_KMS_KEY_ID is not set')
+  if (!region) throw new Error('AWS_REGION is not set')
+  if (!credentials?.accessKeyId || !credentials?.secretAccessKey) throw new Error('AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are not set')
+  const url = endpoint || `https://kms.${region}.amazonaws.com/`
+
+  async function call (target, payload) {
+    const body = JSON.stringify(payload)
+    const headers = { 'content-type': 'application/x-amz-json-1.1', 'x-amz-target': `TrentService.${target}` }
+    const signed = signAws({ method: 'POST', url, headers, body, region, service: 'kms', credentials, now })
+    let res
+    try {
+      res = await fetchImpl(url, { method: 'POST', headers: { ...headers, ...signed }, body, signal: AbortSignal.timeout(timeoutMs) })
+    } catch (err) { throw new Error(`AWS KMS did not answer: ${err.message}`) }
+    const out = await res.json().catch(() => ({}))
+    // KMS's errors name a type and a message, never key material.
+    if (!res.ok) throw new Error(`AWS KMS ${target} failed: ${out.__type || res.status} ${out.message || out.Message || ''}`.trim())
+    return out
+  }
+
+  return {
+    id: 'aws-kms',
+    prefix: 'kms1.',
+    async wrap (dataKey, ctx) {
+      const out = await call('Encrypt', { KeyId: keyId, Plaintext: Buffer.from(dataKey).toString('base64'), EncryptionContext: contextOf(ctx) })
+      return `kms1.${out.CiphertextBlob}`
+    },
+    async unwrap (sealed, ctx) {
+      const out = await call('Decrypt', { KeyId: keyId, CiphertextBlob: String(sealed).slice(5), EncryptionContext: contextOf(ctx) })
+      const key = Buffer.from(String(out.Plaintext || ''), 'base64')
+      if (key.length !== 32) throw new Error('AWS KMS gave back a key of the wrong size')
+      return key
+    }
+  }
+}
+
+/** The vault's key providers from its environment: KMS first when it is switched on, then the root key. */
+export async function providersFromEnv (env = process.env, { fetch: fetchImpl } = {}) {
+  const { envKeyProvider } = await import('./crypto.js')
+  const out = []
+  if (env.VAULT_KEY_PROVIDER === 'aws-kms') {
+    out.push(awsKmsProvider({
+      keyId: env.VAULT_KMS_KEY_ID,
+      region: env.AWS_REGION,
+      endpoint: env.VAULT_KMS_ENDPOINT || '',
+      credentials: { accessKeyId: env.AWS_ACCESS_KEY_ID, secretAccessKey: env.AWS_SECRET_ACCESS_KEY, sessionToken: env.AWS_SESSION_TOKEN || '' },
+      ...(fetchImpl ? { fetch: fetchImpl } : {})
+    }))
+  } else if (env.VAULT_KEY_PROVIDER && env.VAULT_KEY_PROVIDER !== 'env') throw new Error(`VAULT_KEY_PROVIDER must be env or aws-kms, not ${env.VAULT_KEY_PROVIDER}`)
+  if (env.VAULT_ROOT_KEY) out.push(envKeyProvider({ rootKey: env.VAULT_ROOT_KEY }))
+  return out
+}