osborn 0.9.223 → 0.9.226

package/dist/boot-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * boot-secrets.ts — side-effect module that hydrates user secrets from the Fly
+ * volume into process.env at the EARLIEST possible point.
+ *
+ * Why a separate module instead of a call in index.ts: ES module imports are
+ * hoisted and their bodies run in source order BEFORE any statement in the
+ * importing module. Some consumers read their keys at module-load time
+ * (recall-client.ts reads RECALL_REGION into a top-level const; claude-auth is
+ * called later but still expects env present). Importing THIS module
+ * immediately after `dotenv/config` — and before every other agent import —
+ * guarantees hydrateSecretsIntoEnv() runs before those bodies evaluate, so the
+ * volume-persisted user keys win over machine-env defaults.
+ *
+ * Keep this import positioned second in index.ts (right after dotenv/config).
+ */
+export {};

package/dist/boot-secrets.js

@@ -0,0 +1,17 @@
+/**
+ * boot-secrets.ts — side-effect module that hydrates user secrets from the Fly
+ * volume into process.env at the EARLIEST possible point.
+ *
+ * Why a separate module instead of a call in index.ts: ES module imports are
+ * hoisted and their bodies run in source order BEFORE any statement in the
+ * importing module. Some consumers read their keys at module-load time
+ * (recall-client.ts reads RECALL_REGION into a top-level const; claude-auth is
+ * called later but still expects env present). Importing THIS module
+ * immediately after `dotenv/config` — and before every other agent import —
+ * guarantees hydrateSecretsIntoEnv() runs before those bodies evaluate, so the
+ * volume-persisted user keys win over machine-env defaults.
+ *
+ * Keep this import positioned second in index.ts (right after dotenv/config).
+ */
+import { hydrateSecretsIntoEnv } from './secrets-store.js';
+hydrateSecretsIntoEnv();

package/dist/claude-llm.js

@@ -2231,9 +2231,16 @@ class ClaudeLLMStream extends llm.LLMStream {
                                         if (!fromSubagent && sid && this.#opts.workingDirectory) {
                                             this.#llmRef.triggerStoreUpdate(sid, this.#opts.workingDirectory);
                                         }
+                                        // Recall injection is best-effort and must NEVER approach the SDK's 30s hook
+                                        // budget. Cap it hard at 1.5s — if the store is momentarily busy (e.g. a large
+                                        // ingest sweep still draining), we skip recall for this turn rather than block
+                                        // the prompt. The keyword/vector layers catch up on the next turn.
                                         const recalled = fromSubagent
                                             ? ''
-                                            : await buildRecallInjection(sid, this.#opts.workingDirectory, String(input?.prompt || ''));
+                                            : await Promise.race([
+                                                buildRecallInjection(sid, this.#opts.workingDirectory, String(input?.prompt || '')),
+                                                new Promise((res) => setTimeout(() => res(''), 1500)),
+                                            ]);
                                         const additionalContext = recalled ? `${reminder}\n\n${recalled}` : reminder;
                                         console.log(`📌 UserPromptSubmit: injected turn-shape reminder (${reminder.length} chars)${recalled ? ` + recall (${recalled.length} chars)` : ''} for prompt="${promptPreview}..." [tool budget reset to 0/${TOOL_CALL_BUDGET}]`);
                                         return {

package/dist/embedder.d.ts

@@ -1,23 +1,28 @@
 /**
- * embedder.ts — Local text→vector embedder for the semantic (vec) layer of session-store.
+ * embedder.ts — Text→vector embedder for the semantic (vec) layer of session-store.
  *
- * Uses all-MiniLM-L6-v2 (384-dim) via @xenova/transformers, running fully local (no API,
- * no per-write network cost). Output is L2-normalized float32, quantized to int8[384]
- * (×127) to match the sqlite-vec `int8[384]` column — 4× smaller than float32 with
- * ~98–99% recall.
+ * CLOUD-FIRST (OpenRouter, OpenAI-compatible embeddings endpoint).
+ * Previously this ran all-MiniLM-L6-v2 locally via @xenova/transformers. That model
+ * inference is CPU-bound and SYNCHRONOUS on the single Node thread — during a large
+ * backfill it monopolized the event loop and starved voice, the SDK's time-boxed
+ * UserPromptSubmit hook, and fast-brain. Embedding over the network is async I/O:
+ * `await fetch(...)` frees the thread while the request is in flight, so the whole
+ * class of event-loop starvation from embedding is gone.
  *
  * DESIGN FOR RELIABILITY:
- *   • Lazy — the model is loaded on first use, never at import (startup stays fast).
- *   • Best-effort — if the package or model can't load, getEmbedder() returns null and
- *     the store runs keyword-only. Embeddings never block the keyword write path.
- *   • Gated — set OSBORN_EMBED=0 to force keyword-only (e.g. on machines without the
- *     model cached, or to avoid the first-run model download).
- *
- * Model cache honors TRANSFORMERS_CACHE / HF_HOME so it can be baked into the image.
+ *   • Best-effort — if the key is missing or a request fails/times out, the returned
+ *     embedder yields null and the store runs keyword-only. Embeddings never block
+ *     (or break) the keyword write/read path.
+ *   • Gated — OSBORN_EMBED=0 forces keyword-only.
+ *   • Consistent vectors — output is L2-normalized float→int8[EMBED_DIM] (×127) to
+ *     match the sqlite-vec `int8[EMBED_DIM]` column. Qwen3-Embedding is Matryoshka
+ *     (MRL) trained, so we ask for `dimensions: EMBED_DIM` AND defensively truncate
+ *     the returned vector to EMBED_DIM and re-normalize — correct whether or not the
+ *     API honors the `dimensions` passthrough.
  */
 import { type Embedder } from './session-store.js';
 /**
- * Returns an Embedder, or null if embeddings are unavailable/disabled.
- * The returned function itself also degrades to null on runtime failure.
+ * Returns an Embedder, or null if embeddings are disabled or no key is configured.
+ * The returned function degrades to null on any per-call failure (keyword-only recall).
  */
 export declare function getEmbedder(): Promise<Embedder | null>;

package/dist/embedder.js

@@ -1,30 +1,48 @@
 /**
- * embedder.ts — Local text→vector embedder for the semantic (vec) layer of session-store.
+ * embedder.ts — Text→vector embedder for the semantic (vec) layer of session-store.
  *
- * Uses all-MiniLM-L6-v2 (384-dim) via @xenova/transformers, running fully local (no API,
- * no per-write network cost). Output is L2-normalized float32, quantized to int8[384]
- * (×127) to match the sqlite-vec `int8[384]` column — 4× smaller than float32 with
- * ~98–99% recall.
+ * CLOUD-FIRST (OpenRouter, OpenAI-compatible embeddings endpoint).
+ * Previously this ran all-MiniLM-L6-v2 locally via @xenova/transformers. That model
+ * inference is CPU-bound and SYNCHRONOUS on the single Node thread — during a large
+ * backfill it monopolized the event loop and starved voice, the SDK's time-boxed
+ * UserPromptSubmit hook, and fast-brain. Embedding over the network is async I/O:
+ * `await fetch(...)` frees the thread while the request is in flight, so the whole
+ * class of event-loop starvation from embedding is gone.
  *
  * DESIGN FOR RELIABILITY:
- *   • Lazy — the model is loaded on first use, never at import (startup stays fast).
- *   • Best-effort — if the package or model can't load, getEmbedder() returns null and
- *     the store runs keyword-only. Embeddings never block the keyword write path.
- *   • Gated — set OSBORN_EMBED=0 to force keyword-only (e.g. on machines without the
- *     model cached, or to avoid the first-run model download).
- *
- * Model cache honors TRANSFORMERS_CACHE / HF_HOME so it can be baked into the image.
+ *   • Best-effort — if the key is missing or a request fails/times out, the returned
+ *     embedder yields null and the store runs keyword-only. Embeddings never block
+ *     (or break) the keyword write/read path.
+ *   • Gated — OSBORN_EMBED=0 forces keyword-only.
+ *   • Consistent vectors — output is L2-normalized float→int8[EMBED_DIM] (×127) to
+ *     match the sqlite-vec `int8[EMBED_DIM]` column. Qwen3-Embedding is Matryoshka
+ *     (MRL) trained, so we ask for `dimensions: EMBED_DIM` AND defensively truncate
+ *     the returned vector to EMBED_DIM and re-normalize — correct whether or not the
+ *     API honors the `dimensions` passthrough.
  */
 import { EMBED_DIM, EMBED_MODEL } from './session-store.js';
+const OPENROUTER_URL = process.env.OPENROUTER_EMBED_URL || 'https://openrouter.ai/api/v1/embeddings';
 const MODEL_ID = EMBED_MODEL;
-let pipelinePromise = null;
+const MAX_BATCH = 64; // inputs per request (OpenAI-compatible arrays)
+const REQUEST_TIMEOUT_MS = Number(process.env.OSBORN_EMBED_TIMEOUT_MS || 20_000);
 let disabled = false;
-/** Quantize a normalized float32 embedding to int8[dim] (×127, clamped). */
-function quantizeInt8(floats) {
-    const out = new Int8Array(EMBED_DIM);
+function apiKey() {
+    return process.env.OPENROUTER_API_KEY || process.env.OPENROUTER_WORKSPACE_API_KEY;
+}
+/**
+ * L2-normalize the first EMBED_DIM components of a float embedding, then quantize to
+ * int8[EMBED_DIM] (×127, clamped). Truncating a Matryoshka vector to a prefix and
+ * re-normalizing is a valid lower-dim embedding in the same space.
+ */
+function normalizeAndQuantize(floats) {
     const n = Math.min(EMBED_DIM, floats.length);
+    let sum = 0;
+    for (let i = 0; i < n; i++)
+        sum += floats[i] * floats[i];
+    const inv = sum > 0 ? 1 / Math.sqrt(sum) : 0;
+    const out = new Int8Array(EMBED_DIM);
     for (let i = 0; i < n; i++) {
-        let v = Math.round(floats[i] * 127);
+        let v = Math.round(floats[i] * inv * 127);
         if (v > 127)
             v = 127;
         else if (v < -128)
@@ -33,66 +51,77 @@ function quantizeInt8(floats) {
     }
     return out;
 }
-async function loadPipeline() {
-    if (disabled)
-        return null;
-    if (process.env.OSBORN_EMBED === '0') {
-        disabled = true;
-        return null;
-    }
-    if (!pipelinePromise) {
-        pipelinePromise = (async () => {
-            // Lazy import — @xenova/transformers is heavy and optional.
-            const mod = await import('@xenova/transformers').catch(() => null);
-            if (!mod)
-                throw new Error('@xenova/transformers not installed');
-            if (mod.env) {
-                mod.env.allowLocalModels = true;
-                // Avoid noisy multi-thread wasm issues in the agent process.
-                if (mod.env.backends?.onnx?.wasm)
-                    mod.env.backends.onnx.wasm.numThreads = 1;
-            }
-            return mod.pipeline('feature-extraction', MODEL_ID);
-        })().catch((err) => {
-            disabled = true;
-            pipelinePromise = null;
-            throw err;
+/** Embed one batch (≤ MAX_BATCH inputs). Returns aligned int8 vectors, or null on any failure. */
+async function embedBatch(inputs, key) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(OPENROUTER_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${key}`,
+                'Content-Type': 'application/json',
+                'HTTP-Referer': 'https://voice-native.com',
+                'X-Title': 'osborn',
+            },
+            body: JSON.stringify({
+                model: MODEL_ID,
+                input: inputs,
+                dimensions: EMBED_DIM, // MRL reduce; defensively truncated below if ignored
+                encoding_format: 'float',
+            }),
+            signal: controller.signal,
         });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        const data = json?.data;
+        if (!Array.isArray(data) || !data.length)
+            return null;
+        // OpenAI-compatible: each entry carries its input `index`; align by it.
+        const byIndex = new Array(inputs.length).fill(null);
+        for (const d of data) {
+            const idx = typeof d?.index === 'number' ? d.index : -1;
+            const emb = d?.embedding;
+            if (idx >= 0 && idx < inputs.length && Array.isArray(emb)) {
+                byIndex[idx] = normalizeAndQuantize(emb);
+            }
+        }
+        if (byIndex.some((v) => v == null))
+            return null; // malformed / partial response
+        return byIndex;
+    }
+    catch {
+        return null; // network error, timeout/abort, bad JSON — degrade to keyword-only
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return pipelinePromise;
 }
 /**
- * Returns an Embedder, or null if embeddings are unavailable/disabled.
- * The returned function itself also degrades to null on runtime failure.
+ * Returns an Embedder, or null if embeddings are disabled or no key is configured.
+ * The returned function degrades to null on any per-call failure (keyword-only recall).
  */
 export async function getEmbedder() {
-    if (process.env.OSBORN_EMBED === '0')
+    if (process.env.OSBORN_EMBED === '0' || disabled)
         return null;
-    let pipe;
-    try {
-        pipe = await loadPipeline();
-    }
-    catch {
+    const key = apiKey();
+    if (!key) {
+        disabled = true; // no key on this machine — don't retry every turn
         return null;
     }
-    if (!pipe)
-        return null;
     const embed = async (texts) => {
-        try {
-            if (!texts.length)
-                return [];
-            const out = [];
-            // Transformers.js handles batching internally; do them one-by-one to keep
-            // memory bounded on long tool outputs.
-            for (const t of texts) {
-                const res = await pipe(t || ' ', { pooling: 'mean', normalize: true });
-                out.push(quantizeInt8(res.data));
-            }
-            return out;
-        }
-        catch {
-            return null;
+        if (!texts.length)
+            return [];
+        const out = [];
+        for (let i = 0; i < texts.length; i += MAX_BATCH) {
+            const chunk = texts.slice(i, i + MAX_BATCH).map((t) => t || ' ');
+            const vecs = await embedBatch(chunk, key);
+            if (!vecs)
+                return null; // any failure → keyword-only for this call
+            out.push(...vecs);
         }
+        return out;
     };
     return embed;
 }

package/dist/env-keys.d.ts

@@ -25,3 +25,16 @@ export declare const AGENT_ENV_KEYS: AgentEnvKey[];
 export declare const REQUIRED_AGENT_ENV_KEYS: string[];
 /** Return the required keys that are missing from the given env (default process.env). */
 export declare function missingRequiredEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * Keys a user may add/rotate live (mid-session, no reboot) via the /secrets
+ * endpoint. These are read by osborn's OWN code (not baked into a plugin SDK at
+ * import time), so writing process.env[KEY] + persisting to the volume takes
+ * effect on the next read — see secrets-store.ts. This is the allowlist: the
+ * /secrets endpoint rejects any key not in this set, so a user can never inject
+ * platform/infra keys (FLY_*, LIVEKIT_*, SMITHERY_API_KEY, tokens, etc.).
+ *
+ * Mirrors the scope:'user' entries in frontend/src/lib/platform-env.ts.
+ */
+export declare const USER_SECRET_KEYS: string[];
+/** True if `key` is a user-manageable secret (allowlisted for /secrets writes). */
+export declare function isUserSecretKey(key: string): boolean;

package/dist/env-keys.js

@@ -45,3 +45,23 @@ export const REQUIRED_AGENT_ENV_KEYS = AGENT_ENV_KEYS
 export function missingRequiredEnv(env = process.env) {
     return REQUIRED_AGENT_ENV_KEYS.filter((k) => !env[k]);
 }
+/**
+ * Keys a user may add/rotate live (mid-session, no reboot) via the /secrets
+ * endpoint. These are read by osborn's OWN code (not baked into a plugin SDK at
+ * import time), so writing process.env[KEY] + persisting to the volume takes
+ * effect on the next read — see secrets-store.ts. This is the allowlist: the
+ * /secrets endpoint rejects any key not in this set, so a user can never inject
+ * platform/infra keys (FLY_*, LIVEKIT_*, SMITHERY_API_KEY, tokens, etc.).
+ *
+ * Mirrors the scope:'user' entries in frontend/src/lib/platform-env.ts.
+ */
+export const USER_SECRET_KEYS = [
+    'ANTHROPIC_API_KEY',
+    'OPENROUTER_API_KEY',
+    'RECALL_API_KEY',
+    'RECALL_REGION',
+];
+/** True if `key` is a user-manageable secret (allowlisted for /secrets writes). */
+export function isUserSecretKey(key) {
+    return USER_SECRET_KEYS.includes(key);
+}

package/dist/index.d.ts

@@ -1 +1,2 @@
 import 'dotenv/config';
+import './boot-secrets.js';

package/dist/index.js

@@ -1,5 +1,9 @@
 // Load environment variables FIRST before any other imports
 import 'dotenv/config';
+// Then hydrate volume-persisted user secrets into process.env, BEFORE any
+// module that reads its keys at load time (recall-client's RECALL_REGION const,
+// claude-auth fallback). Side-effect import — must stay right after dotenv.
+import './boot-secrets.js';
 import { voice, initializeLogger } from '@livekit/agents';
 import { CloudTurnDetector } from './turn-detector-shim.js';
 import { Room, RoomEvent, } from '@livekit/rtc-node';
@@ -41,6 +45,7 @@ import { MCP_CATALOG } from './config.js';
 import { getRecallClient } from './recall-client.js';
 import { MeetingTranscriptPoller } from './meeting-transcript-poller.js';
 import { missingRequiredEnv } from './env-keys.js';
+import { listSecretStatus, setSecrets, deleteSecret } from './secrets-store.js';
 import { llm } from '@livekit/agents';
 // ============================================================
 // PIPELINE MODE: STT (Deepgram) → Claude Agent SDK → TTS
@@ -304,6 +309,7 @@ const AGENT_ROUTE_PREFIXES = [
     '/canvas-stream', '/events', '/room-code', '/connect-room', '/leave-room',
     '/report-bug', '/restart', '/tts', '/webhook', '/sessions/export',
     '/sessions/import', '/sessions/manifest',
+    '/secrets',
     '/editor',
 ];
 // Set true when code-server is confirmed ready; false when stopped/not running.
@@ -501,8 +507,10 @@ function startApiServer(workingDir, port) {
     const server = createServer(async (req, res) => {
         // CORS headers for cloud frontend
         res.setHeader('Access-Control-Allow-Origin', '*');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+        // Authorization is required for /secrets (Bearer OSBORN_SYNC_TOKEN); without it in the
+        // allow-list the browser preflight fails and the dashboard can't read/manage keys.
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
         if (req.method === 'OPTIONS') {
             res.writeHead(204);
             res.end();
@@ -1519,6 +1527,65 @@ function startApiServer(workingDir, port) {
             }
             return;
         }
+        // ── /secrets ── user-manageable API keys (live, no reboot) ───────────────
+        // GET  → status of each user key (set?/masked/source) — NEVER raw values.
+        // POST → { KEY: value, ... } set/rotate; empty string deletes. Allowlist-
+        //        filtered (USER_SECRET_KEYS); writes the volume store + process.env.
+        // DELETE ?key=KEY → remove one key.
+        // Auth is REQUIRED here (unlike the soft export/import gate): if the machine
+        // has no OSBORN_SYNC_TOKEN we refuse rather than expose an open write path.
+        if (url.pathname === '/secrets') {
+            if (!syncToken) {
+                res.writeHead(503, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Secrets endpoint unavailable: no sync token configured' }));
+                return;
+            }
+            const authHeader = req.headers['authorization'] ?? '';
+            if (authHeader !== `Bearer ${syncToken}`) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized' }));
+                return;
+            }
+            if (req.method === 'GET') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ secrets: listSecretStatus() }));
+                return;
+            }
+            if (req.method === 'POST') {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk.toString(); });
+                req.on('end', () => {
+                    try {
+                        const parsed = JSON.parse(body || '{}');
+                        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Body must be a JSON object of { KEY: value }' }));
+                            return;
+                        }
+                        const result = setSecrets(parsed);
+                        console.log(`🔑 /secrets POST — set:[${result.set.join(',')}] deleted:[${result.deleted.join(',')}] rejected:[${result.rejected.join(',')}]`);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ...result, secrets: listSecretStatus() }));
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+                    }
+                });
+                return;
+            }
+            if (req.method === 'DELETE') {
+                const key = url.searchParams.get('key') ?? '';
+                const existed = deleteSecret(key);
+                console.log(`🔑 /secrets DELETE ${key} — ${existed ? 'removed' : 'not present / not allowed'}`);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ deleted: existed, key, secrets: listSecretStatus() }));
+                return;
+            }
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
         // ── /editor entry point ──────────────────────────────────────────────────
         // Explicit door into the IDE. When code-server is ready this route mints the
         // osborn_ide session cookie and 302s to / (where the proxy then forwards). If

package/dist/pipeline-fastbrain.js

@@ -333,7 +333,16 @@ export async function askPipelineFastBrain(workingDir, sessionId, question, opts
     ];
     try {
         let rounds = 0;
+        // Overall wall-clock cap. The per-request fetch timeout doesn't bound the whole
+        // tool loop; if the event loop is briefly busy (large ingest sweep) a search could
+        // otherwise stretch to 40–130s. Bail with whatever we have past this deadline.
+        const FASTBRAIN_DEADLINE_MS = 8000;
+        const startTime = Date.now();
         while (rounds < MAX_TOOL_ROUNDS) {
+            if (Date.now() - startTime > FASTBRAIN_DEADLINE_MS) {
+                console.warn(`🧠⚡ [pipeline-fb] deadline hit after ${rounds} rounds`);
+                break;
+            }
             rounds++;
             const data = await callOpenRouter(messages, tools, apiKey);
             const choice = data.choices?.[0];

package/dist/secrets-store.d.ts

@@ -0,0 +1,61 @@
+/**
+ * secrets-store.ts — volume-persisted store for user-manageable API keys.
+ *
+ * Osborn's platform keys (LiveKit, Deepgram, Smithery, Fly infra) are injected
+ * as machine env by the frontend and only change on reboot — fine, they rarely
+ * rotate. But a *user* adding their own Anthropic / OpenRouter / Recall key
+ * mid-conversation must take effect WITHOUT a reboot (the OS can't hot-inject
+ * env into a running process). So those keys live here instead of in machine
+ * env: a JSON file on the Fly volume (`~/.osborn/secrets.json` →
+ * `/workspace/.osborn/secrets.json`, survives restart AND recreate) that we
+ * ALSO mirror into process.env so osborn's own code (which reads process.env)
+ * picks them up on the next read.
+ *
+ * Security:
+ *   • Writes are allowlist-filtered by USER_SECRET_KEYS — a user can never set
+ *     a platform/infra key (FLY_*, LIVEKIT_*, tokens…) through this path.
+ *   • File is written mode 0600.
+ *   • Secret VALUES are never returned by listSecretStatus() — status only.
+ *
+ * Keep the allowlist in sync with env-keys.ts (USER_SECRET_KEYS) and the
+ * frontend platform-env.ts scope:'user' entries.
+ */
+export interface SecretStatus {
+    key: string;
+    /** true if a non-empty value is currently set (in the store or process.env). */
+    set: boolean;
+    /** true if this key holds a credential (masked); false = plain config (e.g. region). */
+    secret: boolean;
+    /** masked preview — never the raw value; empty string when unset. */
+    masked: string;
+    /** where the current value came from, for the UI. */
+    source: 'store' | 'env' | 'none';
+}
+export interface SetSecretsResult {
+    set: string[];
+    deleted: string[];
+    rejected: string[];
+}
+/** Return the current store (allowlist-filtered), without touching env. */
+export declare function loadSecrets(): Record<string, string>;
+/**
+ * Copy stored user secrets into process.env so osborn's own code sees them.
+ * Call ONCE at bootstrap, BEFORE applyAuthFallback() and before recall-client
+ * is imported (both read these keys at module/boot time). Store values win over
+ * pre-existing machine env only when non-empty. Returns the keys hydrated.
+ */
+export declare function hydrateSecretsIntoEnv(): string[];
+/**
+ * Set (or delete) user secrets. An empty-string value deletes the key.
+ * Writes the volume file AND mirrors into process.env for live effect.
+ * Keys not in USER_SECRET_KEYS are rejected (never written).
+ */
+export declare function setSecrets(entries: Record<string, unknown>): SetSecretsResult;
+/** Delete a single user secret. */
+export declare function deleteSecret(key: string): boolean;
+/**
+ * Report which user keys are set — WITHOUT returning raw values. Considers both
+ * the store and the live process.env (so a key injected as machine env still
+ * shows as "set", sourced 'env'). Values are masked.
+ */
+export declare function listSecretStatus(): SecretStatus[];

package/dist/secrets-store.js

@@ -0,0 +1,168 @@
+/**
+ * secrets-store.ts — volume-persisted store for user-manageable API keys.
+ *
+ * Osborn's platform keys (LiveKit, Deepgram, Smithery, Fly infra) are injected
+ * as machine env by the frontend and only change on reboot — fine, they rarely
+ * rotate. But a *user* adding their own Anthropic / OpenRouter / Recall key
+ * mid-conversation must take effect WITHOUT a reboot (the OS can't hot-inject
+ * env into a running process). So those keys live here instead of in machine
+ * env: a JSON file on the Fly volume (`~/.osborn/secrets.json` →
+ * `/workspace/.osborn/secrets.json`, survives restart AND recreate) that we
+ * ALSO mirror into process.env so osborn's own code (which reads process.env)
+ * picks them up on the next read.
+ *
+ * Security:
+ *   • Writes are allowlist-filtered by USER_SECRET_KEYS — a user can never set
+ *     a platform/infra key (FLY_*, LIVEKIT_*, tokens…) through this path.
+ *   • File is written mode 0600.
+ *   • Secret VALUES are never returned by listSecretStatus() — status only.
+ *
+ * Keep the allowlist in sync with env-keys.ts (USER_SECRET_KEYS) and the
+ * frontend platform-env.ts scope:'user' entries.
+ */
+import { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { USER_SECRET_KEYS, isUserSecretKey } from './env-keys.js';
+const SECRETS_DIR = join(homedir(), '.osborn');
+const SECRETS_FILE = join(SECRETS_DIR, 'secrets.json');
+/** Keys whose values must be masked in any status readout (all except RECALL_REGION). */
+const NON_SECRET_KEYS = new Set(['RECALL_REGION']);
+/** Read the on-disk store. Returns {} if missing/unreadable. */
+function readStore() {
+    if (!existsSync(SECRETS_FILE))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(SECRETS_FILE, 'utf-8'));
+        if (parsed && typeof parsed === 'object')
+            return parsed;
+        return {};
+    }
+    catch (err) {
+        console.error(`❌ Failed to read secrets store: ${err.message}`);
+        return {};
+    }
+}
+/** Write the store atomically-ish with 0600 perms. */
+function writeStore(store) {
+    if (!existsSync(SECRETS_DIR)) {
+        mkdirSync(SECRETS_DIR, { recursive: true });
+    }
+    writeFileSync(SECRETS_FILE, JSON.stringify(store, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(SECRETS_FILE, 0o600);
+    }
+    catch {
+        // best-effort; some filesystems ignore chmod
+    }
+}
+/** Return the current store (allowlist-filtered), without touching env. */
+export function loadSecrets() {
+    const store = readStore();
+    const clean = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            clean[k] = v;
+    }
+    return clean;
+}
+/**
+ * Copy stored user secrets into process.env so osborn's own code sees them.
+ * Call ONCE at bootstrap, BEFORE applyAuthFallback() and before recall-client
+ * is imported (both read these keys at module/boot time). Store values win over
+ * pre-existing machine env only when non-empty. Returns the keys hydrated.
+ */
+export function hydrateSecretsIntoEnv() {
+    const store = loadSecrets();
+    const applied = [];
+    for (const [k, v] of Object.entries(store)) {
+        process.env[k] = v;
+        applied.push(k);
+    }
+    if (applied.length > 0) {
+        console.log(`🔑 Hydrated ${applied.length} user secret(s) from volume: ${applied.join(', ')}`);
+    }
+    return applied;
+}
+/**
+ * Set (or delete) user secrets. An empty-string value deletes the key.
+ * Writes the volume file AND mirrors into process.env for live effect.
+ * Keys not in USER_SECRET_KEYS are rejected (never written).
+ */
+export function setSecrets(entries) {
+    const store = readStore();
+    const result = { set: [], deleted: [], rejected: [] };
+    for (const [rawKey, rawVal] of Object.entries(entries)) {
+        const key = rawKey.trim();
+        if (!isUserSecretKey(key)) {
+            result.rejected.push(key);
+            continue;
+        }
+        const val = typeof rawVal === 'string' ? rawVal.trim() : '';
+        if (val.length === 0) {
+            // delete
+            delete store[key];
+            delete process.env[key];
+            result.deleted.push(key);
+        }
+        else {
+            store[key] = val;
+            process.env[key] = val;
+            result.set.push(key);
+        }
+    }
+    // Only persist allowlisted keys (drop any stale non-allowlisted entries too).
+    const persisted = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            persisted[k] = v;
+    }
+    writeStore(persisted);
+    return result;
+}
+/** Delete a single user secret. */
+export function deleteSecret(key) {
+    if (!isUserSecretKey(key))
+        return false;
+    const store = readStore();
+    const existed = key in store;
+    delete store[key];
+    delete process.env[key];
+    const persisted = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            persisted[k] = v;
+    }
+    writeStore(persisted);
+    return existed;
+}
+function mask(value) {
+    if (!value)
+        return '';
+    if (value.length <= 8)
+        return '••••';
+    return `${value.slice(0, 4)}••••${value.slice(-4)}`;
+}
+/**
+ * Report which user keys are set — WITHOUT returning raw values. Considers both
+ * the store and the live process.env (so a key injected as machine env still
+ * shows as "set", sourced 'env'). Values are masked.
+ */
+export function listSecretStatus() {
+    const store = readStore();
+    return USER_SECRET_KEYS.map((key) => {
+        const inStore = typeof store[key] === 'string' && store[key].length > 0;
+        const envVal = process.env[key];
+        const inEnv = typeof envVal === 'string' && envVal.length > 0;
+        const value = inStore ? store[key] : inEnv ? envVal : '';
+        const isSecret = !NON_SECRET_KEYS.has(key);
+        return {
+            key,
+            set: inStore || inEnv,
+            secret: isSecret,
+            // Non-secret config (region) can be shown in full; credentials are masked.
+            masked: value ? (isSecret ? mask(value) : value) : '',
+            source: inStore ? 'store' : inEnv ? 'env' : 'none',
+        };
+    });
+}

package/dist/session-store.d.ts

@@ -29,9 +29,13 @@
  */
 import Database from 'better-sqlite3';
 export declare const STORE_VERSION = 1;
-export declare const EMBED_DIM = 384;
-/** Canonical embed model id — the single source of truth (embedder.ts imports this).
- * Recorded in meta.embed_model so a model swap is detected as a stale store. */
+/** Vector width of the semantic layer. Qwen3-Embedding is Matryoshka-trained, so 1024
+ * is a valid MRL reduction of its native width — big enough for strong recall, small
+ * enough to keep int8 vectors ~1KB/row. Changing this rebuilds every store's vec table. */
+export declare const EMBED_DIM = 1024;
+/** Canonical embed model id — the single source of truth (embedder.ts imports this and
+ * sends it to OpenRouter). Recorded in meta.embed_model so a model swap is detected as a
+ * stale store and triggers a re-embed. */
 export declare const EMBED_MODEL: string;
 /** An embedder turns text into int8[EMBED_DIM] vectors (quantized, normalized). */
 export type Embedder = (texts: string[]) => Promise<Int8Array[] | null>;

package/dist/session-store.js

@@ -38,10 +38,14 @@ import { getSessionPaths, getSessionSubAgents, projectPathToSlug } from './sessi
 // CONFIG / TYPES
 // ============================================================
 export const STORE_VERSION = 1;
-export const EMBED_DIM = 384;
-/** Canonical embed model id — the single source of truth (embedder.ts imports this).
- * Recorded in meta.embed_model so a model swap is detected as a stale store. */
-export const EMBED_MODEL = process.env.OSBORN_EMBED_MODEL || 'Xenova/all-MiniLM-L6-v2';
+/** Vector width of the semantic layer. Qwen3-Embedding is Matryoshka-trained, so 1024
+ * is a valid MRL reduction of its native width — big enough for strong recall, small
+ * enough to keep int8 vectors ~1KB/row. Changing this rebuilds every store's vec table. */
+export const EMBED_DIM = 1024;
+/** Canonical embed model id — the single source of truth (embedder.ts imports this and
+ * sends it to OpenRouter). Recorded in meta.embed_model so a model swap is detected as a
+ * stale store and triggers a re-embed. */
+export const EMBED_MODEL = process.env.OSBORN_EMBED_MODEL || 'qwen/qwen3-embedding-8b';
 // ============================================================
 // PATHS
 // ============================================================
@@ -251,22 +255,44 @@ function countLines(filePath, upToBytes) {
             c++;
     return c;
 }
+/**
+ * Max bytes ingested from a single JSONL per sweep. A very large session file
+ * (100MB+) is drained gap-free across many turns instead of being read whole in
+ * one synchronous pass — that whole-file read + insert transaction is what pegged
+ * the single Node event loop and starved the SDK's time-boxed UserPromptSubmit hook.
+ */
+const MAX_INGEST_BYTES = 4 * 1024 * 1024;
 /**
  * Ingest new bytes from a single JSONL file into the store.
- * Reads only from `fromOffset` forward. Returns rows inserted + new offset.
+ * Reads only from `fromOffset` forward, at most `maxBytes` per call. Returns rows
+ * inserted + new offset (which advances by the bytes actually consumed, so the next
+ * sweep resumes exactly where this one stopped).
  */
-function ingestFile(db, filePath, source, fromOffset) {
+function ingestFile(db, filePath, source, fromOffset, maxBytes = MAX_INGEST_BYTES) {
     const inserted = [];
     if (!existsSync(filePath))
         return { inserted, newOffset: fromOffset, linesProcessed: 0 };
     const fileSize = statSync(filePath).size;
     if (fromOffset >= fileSize)
         return { inserted, newOffset: fromOffset, linesProcessed: 0 };
-    const buf = Buffer.alloc(fileSize - fromOffset);
+    const remaining = fileSize - fromOffset;
+    const reachedEof = remaining <= maxBytes;
+    const readLen = Math.min(remaining, maxBytes);
+    const buf = Buffer.alloc(readLen);
     const fd = openSync(filePath, 'r');
     readSync(fd, buf, 0, buf.length, fromOffset);
     closeSync(fd);
-    const rawLines = buf.toString('utf-8').split('\n');
+    // If we stopped short of EOF, trim back to the last complete line so a JSON record
+    // is never split across sweeps. If the window holds no newline at all (a single
+    // line longer than maxBytes), take it whole rather than stall forever.
+    let usable = buf;
+    if (!reachedEof) {
+        const lastNl = buf.lastIndexOf(10);
+        if (lastNl >= 0)
+            usable = buf.subarray(0, lastNl + 1);
+    }
+    const consumed = usable.length;
+    const rawLines = usable.toString('utf-8').split('\n');
     let lineNum = fromOffset === 0 ? 1 : countLines(filePath, fromOffset) + 1;
     let cursor = fromOffset;
     let linesProcessed = 0;
@@ -309,7 +335,7 @@ function ingestFile(db, filePath, source, fromOffset) {
         }
         lineNum++;
     }
-    return { inserted, newOffset: fileSize, linesProcessed };
+    return { inserted, newOffset: fromOffset + consumed, linesProcessed };
 }
 /**
  * Build or update the session store incrementally.
@@ -391,6 +417,8 @@ async function embedRows(db, rows, embed, onProgress) {
     const BATCH = 64;
     let done = 0;
     for (let i = 0; i < rows.length; i += BATCH) {
+        // embed() is now a network call (OpenRouter) — `await` already yields the event
+        // loop while the request is in flight, so no manual setImmediate pump is needed.
         const batch = rows.slice(i, i + BATCH);
         // Cap embedding input length — long tool outputs blow up the model with no recall gain.
         const vectors = await embed(batch.map(r => r.text.slice(0, 8000)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.223",
+  "version": "0.9.226",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {
@@ -46,7 +46,6 @@
     "@smithery/api": "^0.48.0",
     "@types/diff": "^8.0.0",
     "@vscode/ripgrep": "^1.17.1",
-    "@xenova/transformers": "^2.17.2",
     "better-sqlite3": "^13.0.3",
     "diff": "^8.0.4",
     "dotenv": "^16.4.0",