@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/github-connect-repo.js

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { connectRepoScope, deviceFlowClientId } from "./github-device-auth.js";
+import { SecretVault } from "./secrets.js";
+import { openBrowser } from "./browser-open.js";
+/**
+ * `bivy github:connect` — staged repo-scope authorization (C3).
+ *
+ * Runs GitHub's device flow ON THIS NODE to obtain a `repo`-scoped token (only
+ * now, when the user is connecting a repo to the work queue — not at sign-in),
+ * and stores it in Bivy's node secret vault, with `.bivy/cli.json`
+ * `env.BIVY_GITHUB_TOKEN` holding only a `secret://github.repo-token` reference
+ * so both foreground runs and the background service pick it up. The control plane is never
+ * involved, so it never sees the token.
+ */
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, "..");
+const appDir = process.env.BIVY_DATA_DIR ?? path.join(repoRoot, ".bivy");
+const cliConfigPath = path.join(appDir, "cli.json");
+function loadCliConfig() {
+    try {
+        return JSON.parse(fs.readFileSync(cliConfigPath, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function saveToken(token, repo) {
+    const config = loadCliConfig();
+    const env = (config.env && typeof config.env === "object" ? config.env : {});
+    new SecretVault(appDir).setLocal("github.repo-token", token, "GitHub repo/work-queue token");
+    env.BIVY_GITHUB_TOKEN = "secret://github.repo-token";
+    if (repo)
+        env.BIVY_GITHUB_REPO = repo;
+    config.env = env;
+    fs.mkdirSync(appDir, { recursive: true });
+    fs.writeFileSync(cliConfigPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    try {
+        fs.chmodSync(cliConfigPath, 0o600);
+    }
+    catch {
+        // best effort
+    }
+}
+async function main() {
+    const clientId = deviceFlowClientId();
+    if (!clientId) {
+        console.error("Set BIVY_GITHUB_OAUTH_CLIENT_ID to the GitHub OAuth app (with device flow enabled) before connecting a repo.");
+        process.exit(1);
+    }
+    const repoArg = process.argv.slice(2).find((a) => !a.startsWith("-"));
+    console.log("Connecting a GitHub repo grants Bivy push + pull-request access on this machine only.\n");
+    const token = await connectRepoScope(clientId, {
+        openBrowser,
+        onPrompt: ({ userCode, verificationUri }) => {
+            console.log(`Open ${verificationUri} and enter this code:\n\n    ${userCode}\n`);
+            console.log("Waiting for you to authorize…");
+        },
+    });
+    saveToken(token, repoArg);
+    console.log(`\n✓ Authorized. Stored a repo-scoped token in Bivy's local secret vault.`);
+    console.log(`  ${cliConfigPath} contains only a secret:// reference.`);
+    if (repoArg)
+        console.log(`  Issue pickup is set for ${repoArg}. Restart the node to apply.`);
+    else
+        console.log("  Set BIVY_GITHUB_REPO (or re-run with owner/repo) to enable issue pickup.");
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/github-device-auth.js

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+/**
+ * GitHub OAuth Device Flow for STAGED repo scope (C3).
+ *
+ * At sign-in the control plane asks GitHub for only `read:user user:email`
+ * (minimal scope — see services/control-plane C1). The broader `repo` scope
+ * (push branches, open PRs) is requested LATER and only when the user actually
+ * connects a repo to the work queue.
+ *
+ * Crucially this runs on the NODE and talks straight to GitHub's device-flow
+ * endpoints — the control plane is never in the loop, so it never sees the
+ * repo-scoped token (invariant #3: the control plane stores metadata only). The
+ * node keeps the token in its own config and uses it for issue→PR work.
+ *
+ * Device flow uses a PUBLIC client id (no client secret), which is exactly the
+ * right shape for an app the user installs. Set BIVY_GITHUB_OAUTH_CLIENT_ID to
+ * the OAuth app that has "Device flow" enabled.
+ */
+const DEVICE_CODE_URL = "https://github.com/login/device/code";
+const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+/** Default repo-connect scope: branch push + PRs + issue read/write. */
+export const REPO_CONNECT_SCOPE = "repo";
+/** Resolve the device-flow client id (public). Returns undefined if unset. */
+export function deviceFlowClientId(env = process.env) {
+    return env.BIVY_GITHUB_OAUTH_CLIENT_ID?.trim() || undefined;
+}
+/** Step 1: ask GitHub for a device + user code. */
+export async function requestDeviceCode(clientId, scope = REPO_CONNECT_SCOPE) {
+    const res = await fetch(DEVICE_CODE_URL, {
+        method: "POST",
+        headers: { accept: "application/json", "content-type": "application/json" },
+        body: JSON.stringify({ client_id: clientId, scope }),
+    });
+    if (!res.ok)
+        throw new Error(`GitHub device-code request failed (${res.status})`);
+    const data = (await res.json().catch(() => ({})));
+    if (!data.device_code || !data.user_code)
+        throw new Error("GitHub returned no device code (is device flow enabled on the OAuth app?)");
+    return {
+        deviceCode: String(data.device_code),
+        userCode: String(data.user_code),
+        verificationUri: String(data.verification_uri ?? "https://github.com/login/device"),
+        intervalSec: Math.max(Number(data.interval) || 5, 1),
+        expiresInSec: Number(data.expires_in) || 900,
+    };
+}
+/**
+ * Interpret a GitHub access-token poll response. Pure, so the (otherwise
+ * timing-dependent) state machine is unit-testable.
+ */
+export function interpretTokenResponse(data) {
+    if (typeof data.access_token === "string" && data.access_token) {
+        return { status: "ok", token: data.access_token };
+    }
+    switch (data.error) {
+        case "authorization_pending":
+            return { status: "pending" };
+        case "slow_down":
+            return { status: "slow_down", intervalSec: Number(data.interval) || undefined };
+        case "access_denied":
+            return { status: "denied" };
+        case "expired_token":
+            return { status: "expired" };
+        default:
+            return { status: "error", error: String(data.error_description ?? data.error ?? "unknown error") };
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Step 2: poll until the user authorizes (or the code expires). */
+export async function pollForAccessToken(clientId, device, signal) {
+    let intervalMs = device.intervalSec * 1000;
+    const deadline = Date.now() + device.expiresInSec * 1000;
+    while (Date.now() < deadline) {
+        if (signal?.aborted)
+            throw new Error("Cancelled");
+        await sleep(intervalMs);
+        const res = await fetch(ACCESS_TOKEN_URL, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/json" },
+            body: JSON.stringify({ client_id: clientId, device_code: device.deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" }),
+            signal,
+        });
+        const data = (await res.json().catch(() => ({})));
+        const poll = interpretTokenResponse(data);
+        if (poll.status === "ok")
+            return poll.token;
+        if (poll.status === "slow_down")
+            intervalMs += (poll.intervalSec ? poll.intervalSec * 1000 : 5000);
+        else if (poll.status === "denied")
+            throw new Error("Authorization was denied.");
+        else if (poll.status === "expired")
+            throw new Error("The code expired before authorization. Try again.");
+        else if (poll.status === "error")
+            throw new Error(`GitHub authorization failed: ${poll.error}`);
+        // "pending": keep polling.
+    }
+    throw new Error("Timed out waiting for GitHub authorization.");
+}
+/**
+ * Full staged-scope connect: request a device code, prompt the user, and return
+ * the repo-scoped token. The caller persists it in the node's own config.
+ */
+export async function connectRepoScope(clientId, cb) {
+    const device = await requestDeviceCode(clientId, REPO_CONNECT_SCOPE);
+    cb.openBrowser?.(device.verificationUri);
+    cb.onPrompt({ userCode: device.userCode, verificationUri: device.verificationUri });
+    return pollForAccessToken(clientId, device, cb.signal);
+}