Persist Agent runtime choices per Session

[luokerenx4]

Summary

• persist a secret-free, immutable runtime binding on each product Session identity
• require every Agent adapter (Claude, Codex, OpenCode, and Pi) to project credentials, model, and effort for interactive, WebPi, headless, and resumed launches
• resolve vault secrets only at launch time while preserving native global login behavior and preventing Workspace mutation
• migrate existing Session records, expose safe Session metadata, and package the Pi provider extension

Why

Workspace-level injection was too coarse for scheduled work and exact Session recovery. A resumed Session could otherwise inherit a different credential, model, or effort from whatever the Workspace happened to contain later. This makes the runtime selection a standard Session parameter and makes adapter support explicit.

Verification

• npx tsc --noEmit
• cd ui && npx tsc -b
• pnpm test (475 files passed, 1 skipped; 3935 tests passed, 9 skipped)
• targeted Session binding / ResumeRegistry / adapter contract specs
• real pnpm dev browser walk of Issues and Chat
• CSC_IDENTITY_AUTO_DISCOVERY=false pnpm electron:smoke:workspace (packaged Pi scheduled run, resume identity capture, reply, side effect, completion, cleanup)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Building	Preview	Aug 4, 2026 6:41pm