@aibyzero/byz 0.0.0 → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.1 - 2026-08-27
+
+### Added
+
+- Established the BYZ distribution package on a pinned Pi upstream baseline.
+- Added the `byz` CLI identity and isolated `.byz` configuration directory.
+- Bundled the pinned public CM Workflow so users do not install or update it separately.
+- Added an opt-in, separately pinned CM Plugin Workflow installation that remains outside the public package.
+- Added `byz update`, which reads only the BYZ npm release channel and updates only `@aibyzero/byz`.
+- Added maintainer-only commands for reviewing and applying Pi base upgrades and CM workflow revisions.
+- Added a BYZ-only npm release workflow with tag, package identity, tarball, private-source, and external-install gates.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,10 +1,153 @@
-# BYZ bootstrap placeholder
+# BYZ
 
-This version exists only to establish the npm package identity before BYZ
-trusted publishing is configured. It is not a usable BYZ release.
+BYZ is a business-first coding agent by Zero, built on the Pi coding-agent
+runtime. The command is `byz`; user configuration is stored under `.byz` rather
+than `.pi`.
 
-Install the current supported release with:
+Status: initial public release. The public `cm-workflow` package is bundled and
+loaded by default. The private `cm-plugin-workflow` package remains separately
+installed and is available only to users with repository access.
+
+## Install and update
+
+Install the current public package from npm:
+
+```bash
+npm install -g --ignore-scripts @aibyzero/byz
+byz --version
+byz
+```
+
+An npm-managed global installation updates through BYZ's own npm release
+channel:
+
+```bash
+byz update
+```
+
+This command updates only `@aibyzero/byz`. It never calls Pi's release channel,
+promotes the Pi source baseline, or updates workflow packages independently.
+When a new public CM version is accepted into BYZ, it ships in a new BYZ
+version. Users receive it through the same `byz update` command.
+
+Workflows do not have an end-user update or rollback command. Every BYZ release
+selects one CM version and one compatible CM Plugin version; users run the
+versions selected by their installed BYZ release.
+
+## Workflows
+
+```bash
+byz workflow list
+byz workflow check cm
+byz --workflow cm
+byz --workflow none
+```
+
+CM Plugin stays private and is not included in the public BYZ package:
+
+```bash
+export BYZ_CM_PLUGIN_WORKFLOW_SOURCE='git:git@github.com:OWNER/PRIVATE_REPO@<40-character-commit-sha>'
+byz workflow install cm-plugin
+byz workflow check cm-plugin
+byz --workflow cm-plugin
+```
+
+The private source is supplied by the authorized user and is never shipped in
+BYZ's public lock file. `workflow install` requires a full commit SHA and stores
+the package with Pi autoload disabled; BYZ injects it only when
+`--workflow cm-plugin` is selected. BYZ therefore loads at most one managed
+workflow per session. Local development can override package roots with
+`BYZ_CM_WORKFLOW_ROOT` or
+`BYZ_CM_PLUGIN_WORKFLOW_ROOT`; the two roots must remain distinct.
+
+## Development
 
 ```bash
-npm install -g @aibyzero/byz@latest
+npm ci --ignore-scripts
+npm run build:byz
+node packages/byz/dist/cli.js --version
+node packages/byz/dist/cli.js --help
 ```
+
+BYZ preserves Pi's MIT-licensed runtime and records the exact upstream baseline
+in `upstream.json`. Public workflow versions, source commits, licenses, and
+bundle boundaries are recorded in `workflows.lock.json`. Private source identity
+stays in the authorized user's `.byz` package configuration.
+
+Repository maintainers inspect a clean workflow checkout, then explicitly apply
+its version and Pi resource manifest to the next BYZ release branch:
+
+```bash
+npm run byz:sync-cm -- --root /path/to/cm-workflow
+npm run byz:sync-cm -- --root /path/to/cm-workflow --apply
+
+npm run byz:sync-cm-plugin -- --root /path/to/cm-plugin-workflow
+npm run byz:sync-cm-plugin -- --root /path/to/cm-plugin-workflow --apply
+```
+
+These repository commands never commit, push, open a pull request, tag, or
+publish. The CM command refreshes the root lockfile with lifecycle scripts
+disabled. The private CM Plugin command writes only its public-safe version and
+resource contract; it never persists the private checkout path or source.
+
+## Releasing BYZ
+
+BYZ releases are independent from Pi's lockstep release scripts. From a built
+checkout, validate the single-package release contract without publishing:
+
+```bash
+npm run build:byz:offline
+npm run release:byz -- --tag byz-v0.1.1
+```
+
+The dedicated GitHub Actions workflow publishes only `packages/byz` when an
+explicit matching `byz-v*` tag is pushed from `main`. The npm trusted publisher
+must be bound to `.github/workflows/byz-release.yml` before the first tag is
+pushed. Do not run the root Pi `release:*` commands for a BYZ release.
+
+Rollback does not delete an npm version. If a release is broken, move npm's
+`latest` dist-tag back to the last verified BYZ version, then publish a forward
+patch after the fix passes the same gates.
+
+## Upgrading the Pi base
+
+This is a repository-maintainer operation. It is not an end-user BYZ update
+command.
+
+From a clean `main` that exactly matches `origin/main`, check the latest stable
+Pi tag without changing the checkout:
+
+```bash
+npm run byz:upgrade-pi
+```
+
+An explicit target can also be inspected without applying it:
+
+```bash
+npm run byz:upgrade-pi -- --to v0.85.0
+```
+
+After reviewing that target, create a local upgrade branch, merge Pi, update
+`upstream.json`, and run the required verification gates:
+
+```bash
+npm run byz:upgrade-pi -- --to v0.85.0 --apply
+```
+
+When the target changes dependency metadata, the inspection output adds an
+explicit authorization flag. Review the target first, then run the exact
+suggested command, for example:
+
+```bash
+npm run byz:upgrade-pi -- --to v0.85.0 --apply --allow-lockfile-change
+```
+
+`--to` accepts an upstream tag or a full 40-character commit SHA. The apply
+flow refuses dirty, divergent, downgraded, unrelated, or non-upstream targets.
+It never pushes, opens a PR, merges `main`, publishes BYZ, or resolves conflicts.
+On a conflict, resolve it on the generated `upgrade/pi-*` branch or run
+`git merge --abort`.
+
+Pi upgrade PRs must be merged with a real merge commit so Git retains Pi's
+upstream ancestry. Do not squash these PRs. This exception does not change the
+merge policy for normal BYZ feature PRs.

package/dist/cli.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+import { main } from "./runtime/bundle/index.js";
+import { handleByzUpdate } from "./update.js";
+import {
+	getWorkflowInstallRequest,
+	handleWorkflowCommand,
+	installWorkflowPackage,
+	parseWorkflowOption,
+	prepareWorkflowRuntimeArgs,
+} from "./workflows.js";
+
+process.title = "byz";
+process.env.BYZ_CODING_AGENT = "true";
+process.env.PI_CODING_AGENT = "true";
+process.env.AI_AGENT = "byz";
+process.env.PI_SKIP_VERSION_CHECK = "1";
+process.env.PI_TELEMETRY = "0";
+
+const args = process.argv.slice(2);
+
+function shouldLoadWorkflow(runtimeArgs) {
+	const terminatorIndex = runtimeArgs.indexOf("--");
+	const optionArgs = runtimeArgs.slice(0, terminatorIndex === -1 ? runtimeArgs.length : terminatorIndex);
+	if (optionArgs.some((arg) => ["--help", "-h", "--version", "-v", "--export", "--list-models"].includes(arg))) {
+		return false;
+	}
+	return !["auth", "config", "install", "list", "remove", "uninstall", "update"].includes(optionArgs[0]);
+}
+
+try {
+	const parsedWorkflow = parseWorkflowOption(args);
+	const commandArgs = parsedWorkflow.forwardedArgs;
+	const isRootHelp = commandArgs.length === 1 && (commandArgs[0] === "--help" || commandArgs[0] === "-h");
+	if (isRootHelp) {
+		console.error("BYZ updates: byz update (npm-managed global installations only)");
+		console.error("BYZ workflows: --workflow <cm|cm-plugin|none> (default: BYZ_WORKFLOW or cm)");
+		console.error("Commands: byz workflow <list|status|check|install> [cm|cm-plugin]");
+	}
+
+	const installRequest = await getWorkflowInstallRequest(commandArgs);
+	if (installRequest) {
+		await installWorkflowPackage(installRequest);
+	} else if (await handleWorkflowCommand(commandArgs)) {
+		// BYZ-owned command handled without starting the Pi runtime.
+	} else if (await handleByzUpdate(commandArgs)) {
+		// BYZ release metadata and package target stay independent from Pi.
+	} else {
+		const prepared = await prepareWorkflowRuntimeArgs(args, { load: shouldLoadWorkflow(commandArgs) });
+		await main(prepared.args);
+	}
+} catch (error) {
+	console.error(error instanceof Error ? error.message : String(error));
+	process.exitCode = 1;
+}

package/dist/runtime/bun/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/runtime/bun/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/bun/cli.ts"],"names":[],"mappings":"","sourcesContent":["#!/usr/bin/env node\nimport { registerBunOAuthFlows } from \"@earendil-works/pi-ai/bun-oauth\";\nimport { APP_NAME } from \"../config.ts\";\n\nprocess.title = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nregisterBunOAuthFlows();\n\nimport { restoreSandboxEnv } from \"./restore-sandbox-env.ts\";\n\nrestoreSandboxEnv();\n\nawait import(\"./register-bedrock.ts\");\nawait import(\"../cli.ts\");\n"]}

package/dist/runtime/bun/cli.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { registerBunOAuthFlows } from "@earendil-works/pi-ai/bun-oauth";
+import { APP_NAME } from "../config.js";
+process.title = APP_NAME;
+process.emitWarning = (() => { });
+registerBunOAuthFlows();
+import { restoreSandboxEnv } from "./restore-sandbox-env.js";
+restoreSandboxEnv();
+await import("./register-bedrock.js");
+await import("../cli.js");
+//# sourceMappingURL=cli.js.map

package/dist/runtime/bun/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/bun/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AACzB,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAA+B,CAAC;AAE/D,qBAAqB,EAAE,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,iBAAiB,EAAE,CAAC;AAEpB,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;AACtC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { registerBunOAuthFlows } from \"@earendil-works/pi-ai/bun-oauth\";\nimport { APP_NAME } from \"../config.ts\";\n\nprocess.title = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nregisterBunOAuthFlows();\n\nimport { restoreSandboxEnv } from \"./restore-sandbox-env.ts\";\n\nrestoreSandboxEnv();\n\nawait import(\"./register-bedrock.ts\");\nawait import(\"../cli.ts\");\n"]}

package/dist/runtime/bun/register-bedrock.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=register-bedrock.d.ts.map

package/dist/runtime/bun/register-bedrock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-bedrock.d.ts","sourceRoot":"","sources":["../../src/bun/register-bedrock.ts"],"names":[],"mappings":"","sourcesContent":["import { bedrockProviderModule } from \"@earendil-works/pi-ai/bedrock-provider\";\nimport { setBedrockProviderModule } from \"@earendil-works/pi-ai/compat\";\n\nsetBedrockProviderModule(bedrockProviderModule);\n"]}

package/dist/runtime/bun/register-bedrock.js

@@ -0,0 +1,4 @@
+import { bedrockProviderModule } from "@earendil-works/pi-ai/bedrock-provider";
+import { setBedrockProviderModule } from "@earendil-works/pi-ai/compat";
+setBedrockProviderModule(bedrockProviderModule);
+//# sourceMappingURL=register-bedrock.js.map

package/dist/runtime/bun/register-bedrock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-bedrock.js","sourceRoot":"","sources":["../../src/bun/register-bedrock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,wBAAwB,CAAC,qBAAqB,CAAC,CAAC","sourcesContent":["import { bedrockProviderModule } from \"@earendil-works/pi-ai/bedrock-provider\";\nimport { setBedrockProviderModule } from \"@earendil-works/pi-ai/compat\";\n\nsetBedrockProviderModule(bedrockProviderModule);\n"]}

package/dist/runtime/bun/restore-sandbox-env.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Workaround for https://github.com/oven-sh/bun/issues/27802
+ *
+ * Bun compiled binaries have an empty `process.env` when running inside
+ * sandbox environments (e.g. nono on Linux/macOS). On Linux we can recover
+ * the environment from `/proc/self/environ`.
+ *
+ * Keep this in sync with getBunSandboxEnvValue() in
+ * packages/ai/src/utils/provider-env.ts. The ai package duplicates the lookup
+ * for direct consumers that do not go through this coding-agent entrypoint.
+ */
+/**
+ * Restore environment variables from `/proc/self/environ` when running
+ * inside a sandbox where Bun's `process.env` is empty.
+ */
+export declare function restoreSandboxEnv(): void;
+//# sourceMappingURL=restore-sandbox-env.d.ts.map

package/dist/runtime/bun/restore-sandbox-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-sandbox-env.d.ts","sourceRoot":"","sources":["../../src/bun/restore-sandbox-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAiBxC","sourcesContent":["/**\n * Workaround for https://github.com/oven-sh/bun/issues/27802\n *\n * Bun compiled binaries have an empty `process.env` when running inside\n * sandbox environments (e.g. nono on Linux/macOS). On Linux we can recover\n * the environment from `/proc/self/environ`.\n *\n * Keep this in sync with getBunSandboxEnvValue() in\n * packages/ai/src/utils/provider-env.ts. The ai package duplicates the lookup\n * for direct consumers that do not go through this coding-agent entrypoint.\n */\n\nimport { readFileSync } from \"node:fs\";\n\n/**\n * Restore environment variables from `/proc/self/environ` when running\n * inside a sandbox where Bun's `process.env` is empty.\n */\nexport function restoreSandboxEnv(): void {\n\tif (!process.versions?.bun) return;\n\n\t// If process.env already has entries, nothing to fix.\n\tif (Object.keys(process.env).length > 0) return;\n\n\ttry {\n\t\tconst data = readFileSync(\"/proc/self/environ\", \"utf-8\");\n\t\tfor (const entry of data.split(\"\\0\")) {\n\t\t\tconst idx = entry.indexOf(\"=\");\n\t\t\tif (idx > 0) {\n\t\t\t\tprocess.env[entry.slice(0, idx)] = entry.slice(idx + 1);\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// /proc/self/environ may not be readable; ignore.\n\t}\n}\n"]}

package/dist/runtime/bun/restore-sandbox-env.js

@@ -0,0 +1,36 @@
+/**
+ * Workaround for https://github.com/oven-sh/bun/issues/27802
+ *
+ * Bun compiled binaries have an empty `process.env` when running inside
+ * sandbox environments (e.g. nono on Linux/macOS). On Linux we can recover
+ * the environment from `/proc/self/environ`.
+ *
+ * Keep this in sync with getBunSandboxEnvValue() in
+ * packages/ai/src/utils/provider-env.ts. The ai package duplicates the lookup
+ * for direct consumers that do not go through this coding-agent entrypoint.
+ */
+import { readFileSync } from "node:fs";
+/**
+ * Restore environment variables from `/proc/self/environ` when running
+ * inside a sandbox where Bun's `process.env` is empty.
+ */
+export function restoreSandboxEnv() {
+    if (!process.versions?.bun)
+        return;
+    // If process.env already has entries, nothing to fix.
+    if (Object.keys(process.env).length > 0)
+        return;
+    try {
+        const data = readFileSync("/proc/self/environ", "utf-8");
+        for (const entry of data.split("\0")) {
+            const idx = entry.indexOf("=");
+            if (idx > 0) {
+                process.env[entry.slice(0, idx)] = entry.slice(idx + 1);
+            }
+        }
+    }
+    catch {
+        // /proc/self/environ may not be readable; ignore.
+    }
+}
+//# sourceMappingURL=restore-sandbox-env.js.map

package/dist/runtime/bun/restore-sandbox-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-sandbox-env.js","sourceRoot":"","sources":["../../src/bun/restore-sandbox-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,GAAS;IACzC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG;QAAE,OAAO;IAEnC,sDAAsD;IACtD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEhD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,kDAAkD;IACnD,CAAC;AAAA,CACD","sourcesContent":["/**\n * Workaround for https://github.com/oven-sh/bun/issues/27802\n *\n * Bun compiled binaries have an empty `process.env` when running inside\n * sandbox environments (e.g. nono on Linux/macOS). On Linux we can recover\n * the environment from `/proc/self/environ`.\n *\n * Keep this in sync with getBunSandboxEnvValue() in\n * packages/ai/src/utils/provider-env.ts. The ai package duplicates the lookup\n * for direct consumers that do not go through this coding-agent entrypoint.\n */\n\nimport { readFileSync } from \"node:fs\";\n\n/**\n * Restore environment variables from `/proc/self/environ` when running\n * inside a sandbox where Bun's `process.env` is empty.\n */\nexport function restoreSandboxEnv(): void {\n\tif (!process.versions?.bun) return;\n\n\t// If process.env already has entries, nothing to fix.\n\tif (Object.keys(process.env).length > 0) return;\n\n\ttry {\n\t\tconst data = readFileSync(\"/proc/self/environ\", \"utf-8\");\n\t\tfor (const entry of data.split(\"\\0\")) {\n\t\t\tconst idx = entry.indexOf(\"=\");\n\t\t\tif (idx > 0) {\n\t\t\t\tprocess.env[entry.slice(0, idx)] = entry.slice(idx + 1);\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// /proc/self/environ may not be readable; ignore.\n\t}\n}\n"]}