open-managed-agents 0.1.1 → 0.2.0

package/README.md

@@ -12,17 +12,35 @@ files, and sandboxes live on your machines, under your policies.
 > self-hosted baseline. The orchestration/persistence layer (multi-agent
 > runtime, memory stores,
 > scheduled deployments, webhooks, outcomes) is deliberately deferred. See
-> **[PARITY.md](PARITY.md)** for the full domain-by-domain scorecard and the
-> active parity worklist, and **[ALPHA.md](ALPHA.md)** for the first-user
+> **[PARITY.md](https://github.com/oneryalcin/open-managed-agents/blob/main/PARITY.md)** for the full domain-by-domain scorecard and the
+> active parity worklist, and **[ALPHA.md](https://github.com/oneryalcin/open-managed-agents/blob/main/ALPHA.md)** for the first-user
 > alpha readiness plan.
 
 ## Quickstart
 
-Start with the canonical source-checkout guide:
+> **Public onboarding preview:** the one-command path is shipped, but its
+> three-minute warm-path target has not yet completed the real-user timing
+> study. Docker image downloads are explicitly outside that warm-path target.
 
-**[Getting Started](docs/getting-started.md)**
+Prerequisites: Node.js 22.19 or newer and a running Docker-compatible daemon.
+Then run:
 
-The alpha path is:
+```bash
+npx --yes open-managed-agents@latest
+```
+
+The guided terminal checks local prerequisites, asks which model provider to
+use, reads the API key through a masked prompt, starts an authenticated
+loopback appliance, creates or reuses a starter agent/environment/session, and
+opens that session in the console. The appliance stays attached to the command;
+press Ctrl-C to stop it. State and provider credentials persist under `~/.oma`.
+
+If the pinned sandbox image is not cached, OMA names the image and asks before
+pulling it. Rerunning the same command while its onboarding-owned appliance is
+alive reopens the existing starter session rather than creating duplicates.
+
+For the full source-checkout diagnostics and deterministic smoke tests, use
+the **[Getting Started guide](https://github.com/oneryalcin/open-managed-agents/blob/main/docs/getting-started.md)**:
 
 ```bash
 git clone https://github.com/oneryalcin/open-managed-agents.git
@@ -45,7 +63,8 @@ events, and cleanup.
 Docker-local egress boundary: npm, uv/PyPI, and GitHub must work under the
 reviewed preset while an unrelated HTTPS destination remains denied.
 
-`oma up` starts the durable local appliance in the foreground, stores data
+In the advanced source-checkout flow, `oma up` starts the durable local appliance
+in the foreground, stores data
 under `~/.oma`, and prints the console URL plus the first workspace API key
 once. Docker deployments have the pinned approved-HTTPS sidecar capability,
 but every environment remains offline unless its immutable allowlist selects a
@@ -57,6 +76,12 @@ mint another while the server is running:
 oma keys mint
 ```
 
+When using the public package without a global install, the equivalent is:
+
+```bash
+npx --yes open-managed-agents@latest keys mint
+```
+
 Interactive, air-gap-safe OpenAPI documentation is served at `/docs/`, with
 the same schema available to tools at `/openapi.json`. The documentation lists
 only routes OMA currently ships; workspace and admin credentials entered in the
@@ -69,7 +94,7 @@ import anthropic
 
 client = anthropic.Anthropic(
     base_url="http://127.0.0.1:4180",
-    api_key="oma_...",  # printed on first boot
+    api_key="oma_...",  # returned by `oma keys mint`
     default_headers={"anthropic-beta": "managed-agents-2026-04-01"},
 )
 

package/dist/scripts/alpha-smoke.mjs

@@ -226,9 +226,17 @@ async function main() {
   if (state.fixture !== undefined) ok("Observed exact custom provider/model routing across both model requests");
 
   step("Best-effort cleanup");
-  await bestEffort(() => requestJson(baseUrl, apiKey, `/v1/sessions/${session.id}`, { method: "DELETE" }));
+  let deleteError;
+  try {
+    await requestJson(baseUrl, apiKey, `/v1/sessions/${session.id}`, { method: "DELETE" });
+  } catch (error) {
+    deleteError = error;
+  }
   await bestEffort(() => requestJson(baseUrl, apiKey, `/v1/agents/${agent.id}/archive`, { method: "POST" }));
   if (egressSmoke) {
+    // The egress smoke asserts teardown, so a failed delete is the first thing
+    // to know when resources remain; elsewhere cleanup stays best-effort.
+    if (deleteError !== undefined) fail(`Session delete failed: ${deleteError.message}`);
     await assertNoSessionDockerResources(session.id);
     ok("No session sandbox, sidecar, or internal network remained after delete");
   }
@@ -360,6 +368,34 @@ async function startTemporaryOma(sandboxProvider, model, localFixtureBaseUrl, eg
   throw new Error(`Timed out waiting for OMA startup logs.\n${logs.trim()}`);
 }
 
+// Which leftover is it: the sandbox or the egress sidecar, and was it still
+// running or being created? Distinguishes "teardown never ran" from
+// "something was created after delete".
+function describeSessionDockerResources(sessionId) {
+  const filter = `label=open-managed-agents.session-id=${sessionId}`;
+  const ids = (resource) => {
+    const args = resource === "container" ? ["ps", "-aq", "--filter", filter] : ["network", "ls", "-q", "--filter", filter];
+    return spawnSync("docker", args, { encoding: "utf8" }).stdout.split("\n").filter(Boolean);
+  };
+  const inspect = (args) => {
+    const result = spawnSync("docker", args, { encoding: "utf8" });
+    return result.status === 0 ? result.stdout.trim() : `inspect failed: ${(result.stderr || "").trim()}`;
+  };
+  const containerFormat = [
+    '{{if index .Config.Labels "open-managed-agents.egress-sidecar"}}egress-sidecar{{else}}sandbox{{end}}',
+    "name={{.Name}}",
+    "status={{.State.Status}}",
+    "created={{.Created}}",
+    "started={{.State.StartedAt}}",
+    "finished={{.State.FinishedAt}}",
+  ].join(" ");
+  const lines = [
+    ...ids("container").map((id) => `  container ${id}: ${inspect(["inspect", "--format", containerFormat, id])}`),
+    ...ids("network").map((id) => `  network ${id}: ${inspect(["network", "inspect", "--format", "name={{.Name}} created={{.Created}}", id])}`),
+  ];
+  return `Leftover resources (checked at ${new Date().toISOString()}):\n${lines.join("\n")}`;
+}
+
 async function assertNoSessionDockerResources(sessionId) {
   const filters = ["container", "network"];
   const deadline = Date.now() + 10_000;
@@ -375,7 +411,9 @@ async function assertNoSessionDockerResources(sessionId) {
     }
     if (remaining.length === 0) return;
     if (Date.now() >= deadline) {
-      throw new Error(`Docker resources remain for ${sessionId}: ${remaining.join("; ")}`);
+      throw new Error(
+        `Docker resources remain for ${sessionId}: ${remaining.join("; ")}\n${describeSessionDockerResources(sessionId)}`,
+      );
     }
     await delay(100);
   }

package/dist/scripts/oma-doctor.js

@@ -33,7 +33,7 @@ export async function inspectOma(options, runtime = { env: process.env }) {
             throw new Error("Pi configuration paths are not safe to read");
         }
         const authData = readAuthSnapshot(deployment.authPath);
-        const catalog = createReadOnlyPiModelCatalog({
+        const catalog = await createReadOnlyPiModelCatalog({
             allowedProviders: deployment.allowedProviders,
             defaultModel: deployment.defaultModel,
             authPath: deployment.authPath,

package/dist/scripts/oma-models.js

@@ -25,20 +25,20 @@ export async function runModelsCli(argv, runtime) {
     try {
         switch (command) {
             case "providers-status":
-                return ok(providersStatus(loadCatalog(runtime.env)));
+                return ok(providersStatus(await loadCatalog(runtime.env)));
             case "models-list": {
                 const options = parseModelsListArgs(args);
-                return ok(modelsList(loadCatalog(runtime.env), options));
+                return ok(modelsList(await loadCatalog(runtime.env), options));
             }
             case "models-validate":
-                return ok(modelsValidate(runtime.env, parseModelsValidateArgs(args)));
+                return ok(await modelsValidate(runtime.env, parseModelsValidateArgs(args)));
             case "auth-set":
                 return ok(await authSet(runtime, args));
             case "auth-remove":
-                return ok(authRemove(runtime.env, args));
+                return ok(await authRemove(runtime.env, args));
             case "auth-status":
                 assertAuthStatusArgs(args);
-                return ok(authStatus(loadCatalog(runtime.env), args));
+                return ok(await authStatus(await loadCatalog(runtime.env), args));
             default:
                 return fail(`Unknown command: ${command}\n\n${USAGE}`);
         }
@@ -47,13 +47,13 @@ export async function runModelsCli(argv, runtime) {
         return fail(err instanceof Error ? err.message : String(err));
     }
 }
-function loadCatalog(env, overrides = {}) {
+async function loadCatalog(env, overrides = {}) {
     const deployment = parseModelDeploymentConfigFromEnv(env);
     const config = {
         ...deployment,
         ...(overrides.modelsPath === undefined ? {} : { modelsPath: overrides.modelsPath }),
     };
-    const catalog = createPiModelCatalog({
+    const catalog = await createPiModelCatalog({
         allowedProviders: config.allowedProviders,
         defaultModel: config.defaultModel,
         authPath: config.authPath,
@@ -108,8 +108,8 @@ function modelsList(catalog, options) {
     }
     return `${lines.join("\n")}\n`;
 }
-function modelsValidate(env, options) {
-    const catalog = loadCatalog(env, options.file === undefined ? {} : { modelsPath: options.file });
+async function modelsValidate(env, options) {
+    const catalog = await loadCatalog(env, options.file === undefined ? {} : { modelsPath: options.file });
     const warnings = catalog.securityReport.warnings.map((warning) => `Warning: ${warning}`);
     return [
         ...warnings,
@@ -121,7 +121,7 @@ function modelsValidate(env, options) {
 }
 async function authSet(runtime, args) {
     const parsed = parseAuthSetArgs(args);
-    const catalog = loadCatalog(runtime.env);
+    const catalog = await loadCatalog(runtime.env);
     assertEnabledProvider(catalog, parsed.provider);
     const key = parsed.stdin
         ? await (runtime.readStdin ?? readAllStdin)()
@@ -129,21 +129,25 @@ async function authSet(runtime, args) {
     const trimmed = key.trim();
     if (trimmed === "")
         throw new Error("API key must not be empty");
-    catalog.authStorage.set(parsed.provider, { type: "api_key", key: trimmed });
+    if (trimmed.startsWith("!") && !parseModelDeploymentConfigFromEnv(runtime.env).allowModelAuthCommands) {
+        throw new Error("Command-backed keys (starting with \"!\") require OMA_ALLOW_MODEL_AUTH_COMMANDS=true");
+    }
+    await catalog.credentials.modify(parsed.provider, async () => ({ type: "api_key", key: trimmed }));
     return (`Stored API key for ${parsed.provider}.\n` +
         `The key was not printed. Restart \`oma up\` for a running appliance to observe this change.\n`);
 }
-function authRemove(env, args) {
+async function authRemove(env, args) {
     if (args.length !== 1)
         throw new Error("Usage: oma auth remove <provider>");
     const [provider] = args;
     assertProviderName(provider);
-    const catalog = loadCatalog(env);
-    catalog.authStorage.remove(provider);
+    const catalog = await loadCatalog(env);
+    await catalog.credentials.delete(provider);
     return `Removed stored API key for ${provider} if one existed. Restart \`oma up\` for a running appliance to observe this change.\n`;
 }
-function authStatus(catalog, args) {
+async function authStatus(catalog, args) {
     const providers = args.length === 1 ? [args[0]] : [...catalog.allowedProviders].sort();
+    const stored = new Set((await catalog.credentials.list()).map((entry) => entry.providerId));
     const lines = ["provider\tstored\tready_models\ttotal_models"];
     for (const provider of providers) {
         assertProviderName(provider);
@@ -152,7 +156,7 @@ function authStatus(catalog, args) {
         const ready = models.filter((model) => catalog.hasConfiguredAuth(model));
         lines.push([
             provider,
-            catalog.authStorage.has(provider) ? "true" : "false",
+            stored.has(provider) ? "true" : "false",
             String(ready.length),
             String(models.length),
         ].join("\t"));

package/dist/src/control-plane/app.js

@@ -1,6 +1,7 @@
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -43,6 +44,7 @@ import { sessionsRoutes } from "./sessions/routes.js";
 import { DefaultSessionService } from "./sessions/service.js";
 import { SqliteSessionStore } from "./sessions/store.js";
 import { vaultsRoutes } from "./vaults/routes.js";
+import { ConsoleMcpOauthService } from "./vaults/console-mcp-oauth.js";
 import { DefaultVaultService } from "./vaults/service.js";
 import { SqliteVaultStore } from "./vaults/store.js";
 import { createFileMountResolver, createSkillSnapshotsProvider, createSessionEgressBundleResolver, createStoreBackedAgentRevisionProvider, createStoreBackedCustomToolsProvider, } from "./wiring.js";
@@ -338,6 +340,65 @@ function registerConsoleSessionRoutes(app, services) {
         c.header("cache-control", "no-store");
         return c.body(null, 204);
     });
+    const mcpOauth = services.consoleMcpOauth;
+    if (mcpOauth !== undefined) {
+        app.post("/console/mcp-oauth/flows", async (c) => {
+            if (!sameOriginForCookieWrite(c))
+                return c.text("Forbidden\n", 403);
+            const workspaceId = consoleWorkspaceId(c, services);
+            c.header("cache-control", "no-store");
+            return c.json(await mcpOauth.startConnect(workspaceId, await parseJsonBody(c.req), new URL("/console/mcp-oauth/callback", c.req.url).toString()), 200);
+        });
+        app.post("/console/mcp-oauth/reauthorize", async (c) => {
+            if (!sameOriginForCookieWrite(c))
+                return c.text("Forbidden\n", 403);
+            const workspaceId = consoleWorkspaceId(c, services);
+            c.header("cache-control", "no-store");
+            return c.json(await mcpOauth.startReauthorize(workspaceId, await parseJsonBody(c.req), new URL("/console/mcp-oauth/callback", c.req.url).toString()), 200);
+        });
+        app.get("/console/mcp-oauth/flows/:flowId", (c) => {
+            const workspaceId = consoleWorkspaceId(c, services);
+            c.header("cache-control", "no-store");
+            return c.json(mcpOauth.status(workspaceId, c.req.param("flowId")), 200);
+        });
+        app.get("/console/mcp-oauth/callback", async (c) => {
+            c.header("cache-control", "no-store");
+            const scriptNonce = randomBytes(18).toString("base64url");
+            c.header("content-security-policy", `default-src 'none'; script-src 'nonce-${scriptNonce}'; style-src 'unsafe-inline'`);
+            let flowId;
+            let ok = false;
+            try {
+                const result = c.req.query("error") !== undefined
+                    ? mcpOauth.deny(c.req.query("state"))
+                    : await mcpOauth.complete(c.req.query("state"), c.req.query("code"));
+                flowId = result.flowId;
+                ok = result.ok;
+            }
+            catch {
+                ok = false;
+            }
+            return c.html(consoleMcpOauthCallbackHtml(ok, flowId, scriptNonce), ok ? 200 : 400);
+        });
+    }
+}
+function consoleWorkspaceId(c, services) {
+    if (services.auth === undefined)
+        return DEFAULT_WORKSPACE_ID;
+    const token = getCookie(c, CONSOLE_WORKSPACE_COOKIE);
+    const workspaceId = token === undefined
+        ? undefined
+        : services.consoleSessionAuth?.service.authenticateWorkspace(token);
+    if (workspaceId === undefined)
+        throw authenticationFailed();
+    return workspaceId;
+}
+function consoleMcpOauthCallbackHtml(ok, flowId, scriptNonce) {
+    const payload = JSON.stringify({ type: "oma:mcp-oauth", ok, flowId: flowId ?? null });
+    const title = ok ? "MCP connected" : "MCP connection failed";
+    const detail = ok
+        ? "Authorization completed. You can close this window."
+        : "Return to OMA and start Connect again.";
+    return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${title}</title><style>body{background:#181a1f;color:#eee;font:16px system-ui;margin:0;display:grid;min-height:100vh;place-items:center}.card{max-width:34rem;padding:2rem;border:1px solid #343840;border-radius:12px}p{color:#aaa}</style></head><body><main class="card"><h1>${title}</h1><p>${detail}</p></main><script nonce="${scriptNonce}">if(window.opener){window.opener.postMessage(${payload},window.location.origin)}setTimeout(()=>window.close(),600)</script></body></html>`;
 }
 function consoleWorkspace(workspaceId, auth) {
     return { id: workspaceId, name: auth.workspaceName(workspaceId) ?? workspaceId };
@@ -377,14 +438,14 @@ function sameOriginForCookieWrite(c) {
         return false;
     }
 }
-export function createDeploymentControlPlaneApp(env = process.env, opts = {}) {
-    return createDeploymentControlPlane(env, opts, { backgroundWorkers: false }).app;
+export async function createDeploymentControlPlaneApp(env = process.env, opts = {}) {
+    return (await createDeploymentControlPlane(env, opts, { backgroundWorkers: false })).app;
 }
 // Same wiring as createDeploymentControlPlaneApp, but hands back the stores
 // so a caller that owns the process lifecycle (the appliance entrypoint,
 // tests that boot twice against one OMA_HOME) can close them and release the
 // .oma.lock instead of leaking them until process exit.
-export function createDeploymentControlPlane(env = process.env, opts = {}, internal = {}) {
+export async function createDeploymentControlPlane(env = process.env, opts = {}, internal = {}) {
     if (opts.consoleBootstrap !== undefined && !isLoopbackHost(env.OMA_HOST)) {
         throw new Error("Console bootstrap is available only on a loopback appliance bind");
     }
@@ -507,7 +568,7 @@ export function createDeploymentControlPlane(env = process.env, opts = {}, inter
         : undefined;
     let modelCatalog;
     try {
-        modelCatalog = opts.runner?.modelCatalog ?? createPiModelCatalog({
+        modelCatalog = opts.runner?.modelCatalog ?? await createPiModelCatalog({
             allowedProviders: modelConfig.allowedProviders,
             defaultModel: modelConfig.defaultModel,
             authBackend: createOmaAuthStorageBackend(modelConfig.authPath),
@@ -676,6 +737,14 @@ export function createDeploymentControlPlane(env = process.env, opts = {}, inter
             secureCookies: tlsTerminated,
             ...(opts.consoleBootstrap === undefined ? {} : { bootstrap: opts.consoleBootstrap }),
         },
+        ...(runtimeConfig.mcp === undefined
+            ? {}
+            : {
+                consoleMcpOauth: new ConsoleMcpOauthService(vaultService, mcpRuntime.fetch, {
+                    operationTimeoutMs: runtimeConfig.mcp.operationTimeoutMs ??
+                        DEFAULT_MCP_OPERATION_TIMEOUT_MS,
+                }),
+            }),
         ...(openapiRoot === undefined ? {} : { openapi: { root: openapiRoot } }),
         ...(authMode === "api-key"
             ? {
@@ -703,6 +772,7 @@ export function createDeploymentControlPlane(env = process.env, opts = {}, inter
             }),
         sessions: new DefaultSessionService(stores.sessions, stores.agents, stores.environments, stores.files, {
             assertDeletable: sessionEvents.assertSessionDeletable.bind(sessionEvents),
+            awaitDeletable: sessionEvents.waitForPostIdleRuntimeSettle.bind(sessionEvents),
             runtime: runner,
             modelAvailability,
             skills: stores.skills,
@@ -841,6 +911,7 @@ export function createInMemoryControlPlaneApp(opts = {}) {
         vaults: vaultService,
         sessions: new DefaultSessionService(sessionStore, agentStore, environmentStore, fileStorage, {
             assertDeletable: sessionEvents.assertSessionDeletable.bind(sessionEvents),
+            awaitDeletable: sessionEvents.waitForPostIdleRuntimeSettle.bind(sessionEvents),
             ...(opts.runtime?.runner ? { runtime: opts.runtime.runner } : {}),
             skills: skillsStore,
             vaults: vaultService,

package/dist/src/control-plane/events/service.js

@@ -9,6 +9,9 @@ import { archiveGuardKey, requireActiveSession, requireExistingSession, sessionN
 import { eventPayload, hasToolResultForToolUseId, lostMcpToolConfirmationPayload, lostToolConfirmationPayload, parseSendRequest, sameCustomToolResult, sameCustomToolResultPayload, sameToolConfirmation, toSendResponseEvent, } from "./request.js";
 import { actionClosedWithoutResult, hasTerminalIdleDraft, isAcknowledgedInFlightAction, isRuntimeCustomToolUseEvent, isRuntimeLeaseExpired, isRuntimeMcpConnectionFailedEvent, isRuntimeMcpToolResultEvent, isRuntimeMcpToolUseEvent, isRuntimeMcpToolWithModelEndEvent, isRuntimeToolPermissionUseEvent, isRuntimeToolPermissionWithModelEndEvent, isRuntimeTurnClosed, leaseExpiresAt, runtimeErrorDraft, runtimeLeaseRetryDelayMs, runtimeTurnStillOwned, textFromContent, toError, unique, } from "./runtime-helpers.js";
 import { materializeMcpConnectionFailedRows, materializeMcpToolResultRows, materializeMcpToolUseRows, materializeToolPermissionUseRows, toolPermissionRuntimeChanges, } from "./tool-persistence.js";
+// Upper bound on how long DELETE waits for post-idle runtime work (output
+// collection, turn close) before falling back to the running-session 400.
+const POST_IDLE_SETTLE_TIMEOUT_MS = 10_000;
 export class DefaultSessionEventsService {
     events;
     sessions;
@@ -26,6 +29,14 @@ export class DefaultSessionEventsService {
     closedSessions = new Set();
     deletedSessions = new Set();
     activeRuntimeTasks = new Map();
+    // Sessions whose live runtime task has already published its terminal
+    // session.status_idle and is only doing post-idle work (output collection,
+    // turn close). A delete waits for these instead of rejecting them.
+    // Per session: how many live runtime tasks are post-idle. A delete waits
+    // only while every live task is post-idle; any genuinely running task means
+    // the session is running and gets the 400 without waiting.
+    postIdleRuntimeTasks = new Map();
+    runtimeSettledWaiters = new Map();
     interruptedCustomToolActions = new Map();
     pendingToolConfirmations = new Map();
     interruptedToolConfirmations = new Map();
@@ -397,6 +408,34 @@ export class DefaultSessionEventsService {
             throw sessionNotArchivable(sessionId, session.status);
         }
     }
+    // A client that saw session.status_idle may delete while the runtime task is
+    // still collecting outputs and closing the turn. Wait (bounded) for that
+    // post-idle work to finish so assertSessionDeletable sees a settled session;
+    // a genuinely running turn is not waited on and still gets the hosted 400.
+    async waitForPostIdleRuntimeSettle(workspaceId, sessionId, timeoutMs = POST_IDLE_SETTLE_TIMEOUT_MS) {
+        const key = sessionScopeKey(workspaceId, sessionId);
+        if (!this.allRuntimeTasksPostIdle(key))
+            return;
+        await new Promise((resolve) => {
+            // One cleanup for both outcomes: a timed-out waiter must not stay
+            // registered while post-idle work is stalled, or retried deletes leak.
+            const settle = () => {
+                clearTimeout(timer);
+                const waiters = this.runtimeSettledWaiters.get(key);
+                const index = waiters?.indexOf(settle) ?? -1;
+                if (index >= 0)
+                    waiters.splice(index, 1);
+                if (waiters?.length === 0)
+                    this.runtimeSettledWaiters.delete(key);
+                resolve();
+            };
+            const timer = setTimeout(settle, timeoutMs);
+            timer.unref?.();
+            const waiters = this.runtimeSettledWaiters.get(key) ?? [];
+            waiters.push(settle);
+            this.runtimeSettledWaiters.set(key, waiters);
+        });
+    }
     // Preflight for DELETE /v1/sessions/:id. Hosted CMA rejects a delete while the
     // session is running with a 400 (probe 38); we reuse the same running-detection
     // as archive so a session whose runtime task is live but whose row status lags
@@ -546,9 +585,9 @@ export class DefaultSessionEventsService {
                     this.terminalizeAbandonedRuntimeTurn(claimed, "Accepted runtime turn has no recoverable trigger event.");
                     continue;
                 }
-                this.beginRuntimeTask(workspaceId, claimed.session_id);
-                void this.runRuntimePrompts(workspaceId, claimed.session_id, prompts, undefined).finally(() => {
-                    this.finishRuntimeTask(workspaceId, claimed.session_id);
+                const task = this.beginRuntimeTask(workspaceId, claimed.session_id);
+                void this.runRuntimePrompts(workspaceId, claimed.session_id, prompts, undefined, task).finally(() => {
+                    this.finishRuntimeTask(workspaceId, claimed.session_id, task);
                 });
                 continue;
             }
@@ -741,24 +780,31 @@ export class DefaultSessionEventsService {
             return;
         if (prompts.length === 0)
             return;
-        this.beginRuntimeTask(workspaceId, sessionId);
-        void this.runRuntimePrompts(workspaceId, sessionId, prompts, signal)
+        const task = this.beginRuntimeTask(workspaceId, sessionId);
+        void this.runRuntimePrompts(workspaceId, sessionId, prompts, signal, task)
             .finally(() => {
-            this.finishRuntimeTask(workspaceId, sessionId);
+            this.finishRuntimeTask(workspaceId, sessionId, task);
         });
     }
     beginRuntimeTask(workspaceId, sessionId) {
         const key = sessionScopeKey(workspaceId, sessionId);
         this.activeRuntimeTasks.set(key, (this.activeRuntimeTasks.get(key) ?? 0) + 1);
+        return { postIdle: false };
     }
-    finishRuntimeTask(workspaceId, sessionId) {
+    finishRuntimeTask(workspaceId, sessionId, task) {
         const key = sessionScopeKey(workspaceId, sessionId);
+        // Both counts drop in the same synchronous step, so a woken delete never
+        // observes this task as still active.
+        if (task.postIdle)
+            this.adjustPostIdleRuntimeTasks(key, -1);
         const remaining = (this.activeRuntimeTasks.get(key) ?? 1) - 1;
         if (remaining > 0) {
             this.activeRuntimeTasks.set(key, remaining);
+            this.wakeSettleWaitersUnlessAllPostIdle(key);
             return;
         }
         this.activeRuntimeTasks.delete(key);
+        this.wakeSettleWaitersUnlessAllPostIdle(key);
         this.interruptedCustomToolActions.delete(key);
         this.interruptedToolConfirmations.delete(key);
         this.retireLifecycleGuardsIfIdle(workspaceId, sessionId);
@@ -770,10 +816,36 @@ export class DefaultSessionEventsService {
         this.closedSessions.delete(key);
         this.deletedSessions.delete(key);
     }
+    setRuntimeTaskPostIdle(workspaceId, sessionId, task, postIdle) {
+        if (task.postIdle === postIdle)
+            return;
+        task.postIdle = postIdle;
+        const key = sessionScopeKey(workspaceId, sessionId);
+        this.adjustPostIdleRuntimeTasks(key, postIdle ? 1 : -1);
+        if (!postIdle)
+            this.wakeSettleWaitersUnlessAllPostIdle(key);
+    }
+    adjustPostIdleRuntimeTasks(key, delta) {
+        const next = (this.postIdleRuntimeTasks.get(key) ?? 0) + delta;
+        if (next > 0)
+            this.postIdleRuntimeTasks.set(key, next);
+        else
+            this.postIdleRuntimeTasks.delete(key);
+    }
+    allRuntimeTasksPostIdle(key) {
+        const active = this.activeRuntimeTasks.get(key) ?? 0;
+        return active > 0 && (this.postIdleRuntimeTasks.get(key) ?? 0) === active;
+    }
+    wakeSettleWaitersUnlessAllPostIdle(key) {
+        if (this.allRuntimeTasksPostIdle(key))
+            return;
+        for (const settle of [...(this.runtimeSettledWaiters.get(key) ?? [])])
+            settle();
+    }
     activeRuntimeTaskCount(workspaceId, sessionId) {
         return this.activeRuntimeTasks.get(sessionScopeKey(workspaceId, sessionId)) ?? 0;
     }
-    async runRuntimePrompts(workspaceId, sessionId, prompts, signal) {
+    async runRuntimePrompts(workspaceId, sessionId, prompts, signal, task) {
         if (!this.runtimeRunner || !this.runtimeTranslator)
             return;
         let activePrompt;
@@ -782,6 +854,7 @@ export class DefaultSessionEventsService {
             for (const prompt of prompts) {
                 activePrompt = prompt;
                 activeOpenModelRequestStartIds = [];
+                this.setRuntimeTaskPostIdle(workspaceId, sessionId, task, false);
                 const stopRenewing = this.startRuntimeLeaseRenewal(workspaceId, sessionId, prompt);
                 try {
                     this.markRuntimeTurnState(workspaceId, sessionId, prompt.turnId, prompt.ownerId, prompt.ownerGeneration, "dispatching");
@@ -910,6 +983,7 @@ export class DefaultSessionEventsService {
                             activeOpenModelRequestStartIds.pop();
                         }
                         if (hasTerminalIdleDraft(drafts)) {
+                            this.setRuntimeTaskPostIdle(workspaceId, sessionId, task, true);
                             await this.indexSessionOutputsFromLiveRuntime(workspaceId, sessionId, prompt);
                         }
                     }

package/dist/src/control-plane/models/catalog.js

@@ -1,8 +1,11 @@
-import { AuthStorage, ModelRegistry, } from "@earendil-works/pi-coding-agent";
+import { ModelRegistry, ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { scanModelConfigSecurity } from "./config-security.js";
-export const PINNED_PI_MODEL_RUNTIME_VERSION = "0.80.6";
+import { InMemoryAuthStorageBackend, InMemoryModelsStore, OmaCredentialStore, } from "./credential-store.js";
+export const PINNED_PI_MODEL_RUNTIME_VERSION = "0.85.1";
 export function createPiModelCatalog(config) {
-    return createCatalog(config, AuthStorage.fromStorage(config.authBackend));
+    return createCatalog(config, new OmaCredentialStore(config.authBackend, {
+        commands: config.allowModelAuthCommands === true ? "execute" : "deny",
+    }));
 }
 /**
  * Read-only catalog construction for diagnostics. The caller supplies an
@@ -10,9 +13,10 @@ export function createPiModelCatalog(config) {
  * auth file. Runtime code must continue to use createPiModelCatalog().
  */
 export function createReadOnlyPiModelCatalog(config, authData = {}) {
-    return createCatalog(config, AuthStorage.inMemory(authData));
+    // Diagnostics must stay side-effect free: never run command-backed keys.
+    return createCatalog(config, new OmaCredentialStore(new InMemoryAuthStorageBackend(authData), { commands: "unresolved" }));
 }
-function createCatalog(config, authStorage) {
+async function createCatalog(config, credentials) {
     const allowedProviders = new Set(config.allowedProviders);
     if (allowedProviders.size !== config.allowedProviders.length) {
         throw new Error("OMA_MODEL_PROVIDERS must not contain duplicate providers");
@@ -20,17 +24,27 @@ function createCatalog(config, authStorage) {
     if (!allowedProviders.has(config.defaultModel.provider)) {
         throw new Error(`Default model provider ${config.defaultModel.provider} is not enabled on this deployment`);
     }
-    const securityReport = scanModelConfigSecurity({
+    const scan = () => scanModelConfigSecurity({
         modelsPath: config.modelsPath,
         authPath: config.authPath,
         allowedProviders,
         allowCommands: config.allowModelAuthCommands,
     });
-    const authErrors = authStorage.drainErrors();
-    if (authErrors.length > 0) {
-        throw new Error(`Failed to load model auth storage: ${authErrors.map((error) => error.message).join("; ")}`);
+    const securityReport = scan();
+    // Fail at startup on an unreadable or corrupt auth.json (Pi's own store
+    // would keep serving its last in-memory snapshot).
+    try {
+        await credentials.list();
     }
-    const modelRegistry = ModelRegistry.create(authStorage, config.modelsPath);
+    catch (error) {
+        throw new Error(`Failed to load model auth storage: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const modelRuntime = await ModelRuntime.create({
+        credentials,
+        modelsPath: config.modelsPath,
+        modelsStore: new InMemoryModelsStore(),
+    });
+    const modelRegistry = new ModelRegistry(modelRuntime);
     const registryError = modelRegistry.getError();
     if (registryError !== undefined) {
         throw new Error(registryError);
@@ -46,9 +60,13 @@ function createCatalog(config, authStorage) {
     return {
         defaultModel: { ...config.defaultModel },
         allowedProviders,
-        authStorage,
+        credentials,
+        modelRuntime,
         modelRegistry,
         securityReport,
+        assertConfigSecurity() {
+            scan();
+        },
         resolve(ref) {
             if (!allowedProviders.has(ref.provider))
                 return undefined;
@@ -63,8 +81,6 @@ function createCatalog(config, authStorage) {
             });
         },
         hasConfiguredAuth(model) {
-            // Deliberately model-scoped: provider status can report env credentials as
-            // configured:false in Pi 0.80.6 while the resolved model is usable.
             return modelRegistry.hasConfiguredAuth(model);
         },
         providerAuthMetadata(provider) {