Add hosted phone 2FA and multi-user isolation

[rsproule]

Summary

• add explicit local and hosted deployment modes; local remains zero-config and authentication-free outside Vercel
• use Better Auth phone/password credentials with mandatory SMS OTP as the second factor; email, social, TOTP, backup-code, and trusted-device paths are unavailable
• scope manager settings, connections, vault metadata, encrypted secrets, Eve sessions, task history, models, tools, and Kernel credentials by a stable per-user workspace
• keep SQLite and macOS Keychain for local installs; use Postgres plus AES-256-GCM secret encryption when hosted
• migrate existing local SQLite rows into the stable local:personal workspace without requiring sign-in
• add hosted sign-in/sign-up/sign-out UI and namespace browser task state per workspace

Hosted configuration

Hosted mode requires BETTER_AUTH_SECRET, BETTER_AUTH_URL, BETTER_AUTH_INFRA_API_KEY, a Postgres DATABASE_URL, and a base64-encoded 32-byte HOSTED_SECRET_ENCRYPTION_KEY. Better Auth tables are migrated on first hosted auth use. Vercel selects hosted mode automatically; LOCAL_VAULT_ASSISTANT_MODE can select either mode explicitly.

Local compatibility

Local mode short-circuits before session or database checks, does not render the auth account client, returns 404 from the Better Auth API, and never sends SMS. The app and manager continue to work without an account.

Verification

• pnpm check:foundation
• pnpm build
• 20 Vitest tests pass, including the mandatory phone-verification + 2FA authorization gate and cross-workspace isolation
• local HTTP smoke: app returns 200, sign-in redirects home, and the auth API returns 404
• lint, TypeScript, formatting, knip, Merit UI conformance, foundation conformance, and Turbo boundaries pass

Known repository baseline

pnpm check reaches 7 of 8 tasks and fails only ui:integrity because six existing, untouched components/ai-elements files differ from their Merit registry sources: conversation, message, prompt-input, reasoning, shimmer, and tool. This branch has no diff in those files.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-kernel	Ready	Preview	Aug 26, 2026 10:55pm
local-vault-assistant	Error		Aug 26, 2026 10:55pm