@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/repo-workspace.js

@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import fs from "node:fs";
+import path from "node:path";
+import { resolveSecret } from "./secrets.js";
+import { cleanRemoteUrl, credConfigArgs, gitNonInteractiveEnv, configureRepoCredentialHelper } from "./git-auth.js";
+const exec = promisify(execFile);
+/** Parse "owner/repo" (also tolerates a full github.com URL or trailing .git). */
+export function parseRepo(input) {
+    const cleaned = String(input)
+        .trim()
+        .replace(/^https?:\/\/github\.com\//i, "")
+        .replace(/^git@github\.com:/i, "")
+        .replace(/\.git$/i, "")
+        .replace(/\/+$/, "");
+    const m = cleaned.match(/^([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)$/);
+    return m ? { owner: m[1], repo: m[2], slug: `${m[1]}/${m[2]}` } : undefined;
+}
+/** Parse a GitHub owner/repo slug from a git remote URL. */
+export function parseGitHubRemote(input) {
+    const value = String(input).trim();
+    const https = value.match(/^https?:\/\/(?:[^/@]+(?::[^/@]*)?@)?github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+    if (https)
+        return parseRepo(`${https[1]}/${https[2]}`);
+    const ssh = value.match(/^(?:ssh:\/\/)?git@github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+    if (ssh)
+        return parseRepo(`${ssh[1]}/${ssh[2]}`);
+    return undefined;
+}
+/** Infer owner/repo from a workspace's origin remote, if it is a GitHub checkout. */
+export async function inferGitHubRepoFromWorkspace(workspace) {
+    try {
+        const { stdout } = await exec("git", ["-C", workspace, "remote", "get-url", "origin"]);
+        return parseGitHubRemote(stdout);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A GitHub token from env or the local `gh` login, or undefined (public only). */
+export async function resolveGitHubToken(env = process.env) {
+    const fromEnv = env.BIVY_GITHUB_TOKEN?.trim();
+    if (fromEnv) {
+        if (fromEnv.startsWith("secret://") || fromEnv.startsWith("op://") || fromEnv.startsWith("env://"))
+            return resolveSecret(fromEnv);
+        return fromEnv;
+    }
+    try {
+        const { stdout } = await exec("gh", ["auth", "token"]);
+        return stdout.trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Refresh the remote-tracking refs so a session branches off the CURRENT state
+ * of `origin`, not whatever the local checkout last saw. Best-effort: an offline
+ * node (or a checkout with no reachable origin) keeps its existing refs and the
+ * caller branches off those. `cloneOrUpdateRepo` already fetches on the clone
+ * path, so this is for the "workspace is an existing local checkout" path, which
+ * otherwise never pulls the latest origin before cutting a branch.
+ */
+export async function fetchOrigin(repoDir) {
+    try {
+        await exec("git", ["-C", repoDir, "fetch", "origin", "--prune"], { timeout: 120_000 });
+    }
+    catch {
+        // offline / no origin / no rights — branch off the refs we already have.
+    }
+}
+/**
+ * Resolve the ref a new branch should be cut from: the remote's default branch
+ * (`origin/main`, `origin/master`, …). Falls back to `origin/main` when the
+ * remote HEAD isn't recorded. Used so a repo-backed session branches off the
+ * upstream default rather than whatever the shared checkout happens to be on.
+ */
+export async function resolveDefaultBaseRef(repoDir) {
+    // origin/HEAD points at the remote's default branch when it's been recorded.
+    try {
+        const { stdout } = await exec("git", ["-C", repoDir, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+        const ref = stdout.trim();
+        if (ref)
+            return ref; // e.g. "origin/main"
+    }
+    catch {
+        // origin/HEAD is often unset on a fresh clone — record it, then retry.
+    }
+    try {
+        await exec("git", ["-C", repoDir, "remote", "set-head", "origin", "--auto"]);
+        const { stdout } = await exec("git", ["-C", repoDir, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+        const ref = stdout.trim();
+        if (ref)
+            return ref;
+    }
+    catch {
+        // best effort
+    }
+    return "origin/main";
+}
+/**
+ * Resolve the ref to branch a new session from when the caller (the composer's
+ * branch pill) requested a SPECIFIC remote branch instead of the repo's
+ * default. `cloneOrUpdateRepo`/`fetchOrigin` have already brought every remote
+ * branch's tracking ref down before this runs, so this only needs to verify
+ * `origin/<branch>` actually exists — surfacing a clear error instead of
+ * silently falling back to the default when the requested branch is missing
+ * (e.g. typo'd, deleted upstream since the picker's list was fetched).
+ */
+export async function resolveBranchBaseRef(repoDir, branch) {
+    const ref = `origin/${branch}`;
+    try {
+        await exec("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", ref]);
+        return ref;
+    }
+    catch {
+        throw new Error(`Branch "${branch}" was not found on the remote.`);
+    }
+}
+/**
+ * Whether an existing Bivy-owned checkout at `dest` can be reused as-is, i.e. it
+ * has a `.git` entry AND `git rev-parse` accepts it as a real repository. A
+ * `.git` can survive an interrupted/corrupt clone, so presence alone is not
+ * enough — callers that reuse on presence alone hand a broken directory to the
+ * worktree flow, which then fails with "Not a git repository". Exported for
+ * tests.
+ */
+export async function isReusableCheckout(dest) {
+    if (!fs.existsSync(path.join(dest, ".git")))
+        return false;
+    try {
+        await exec("git", ["-C", dest, "rev-parse", "--show-toplevel"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure a working clone of the repo exists under `root` and return its path.
+ * Clones on first use; on later use fetches the latest. One checkout per repo.
+ */
+// The remote URL is now token-free — auth goes through the daemon credential
+// helper (see src/git-auth.ts), so no token is written into `.git/config`.
+// Still tighten `.git/config` to 0600 (git writes it 0644 by default): it holds
+// the credential-helper config and other local settings, and a least-readable
+// posture is cheap insurance. Best-effort.
+function hardenGitConfigPerms(dest) {
+    try {
+        fs.chmodSync(path.join(dest, ".git", "config"), 0o600);
+    }
+    catch {
+        // no .git/config yet, or a filesystem without POSIX modes — ignore
+    }
+}
+export async function cloneOrUpdateRepo(opts) {
+    const dest = path.join(opts.root, `${opts.owner}__${opts.repo}`);
+    // Keep the remote URL token-free; auth flows through the daemon credential
+    // helper (see src/git-auth.ts), which fetches a fresh token on demand — so no
+    // token is written into this clone's `.git/config`, where an agent (or
+    // `git remote -v` / a log / a screenshot) could read it.
+    const url = cleanRemoteUrl(opts.owner, opts.repo);
+    const env = gitNonInteractiveEnv();
+    const cc = credConfigArgs();
+    // Reuse the existing checkout only if it is a REAL git repository. A `.git`
+    // entry can survive a clone that was interrupted (network drop, killed
+    // process) or otherwise left corrupt — the directory exists and has a `.git`,
+    // but `git rev-parse` rejects it. Trusting `.git`'s mere presence took the
+    // fetch path and returned that broken directory, so every later "new session
+    // on this repo" failed downstream in createWorktree with "Not a git
+    // repository" — permanently, because the wipe-and-reclone repair below only
+    // ran when `.git` was entirely absent. Validate first; if it's broken, fall
+    // through and rebuild it.
+    if (await isReusableCheckout(dest)) {
+        try {
+            // Rewrite origin to the clean URL. This also MIGRATES any pre-existing
+            // clone whose remote still carries an embedded token from before this fix.
+            await exec("git", ["-C", dest, "remote", "set-url", "origin", url]);
+            await configureRepoCredentialHelper((a) => exec("git", a), dest);
+            await exec("git", ["-C", dest, ...cc, "fetch", "--all", "--prune"], { timeout: 120_000, env });
+            // Re-point origin/HEAD at the remote's CURRENT default branch. Without
+            // this a cached checkout keeps whatever default it recorded at first
+            // clone, so if the repo's default later changed (e.g. main → master) a new
+            // session would branch off the stale remote default. --auto is best-effort
+            // and only rewrites the local origin/HEAD pointer, never a branch.
+            await exec("git", ["-C", dest, "remote", "set-head", "origin", "--auto"]);
+        }
+        catch {
+            // offline / fetch failed — reuse the existing checkout as-is
+        }
+        hardenGitConfigPerms(dest);
+        return dest;
+    }
+    fs.mkdirSync(opts.root, { recursive: true });
+    // A failed/interrupted/corrupt clone can leave a non-repository (or broken
+    // repository) directory behind; because this path is Bivy-owned
+    // (<root>/<owner>__<repo>), repair it instead of letting every later "new repo
+    // session" fail with "destination exists" or "Not a git repository".
+    if (fs.existsSync(dest))
+        fs.rmSync(dest, { recursive: true, force: true });
+    await exec("git", [...cc, "clone", url, dest], { timeout: 600_000, env });
+    // Persist the helper config so agent-run git in this clone authenticates too.
+    await configureRepoCredentialHelper((a) => exec("git", a), dest);
+    hardenGitConfigPerms(dest);
+    return dest;
+}

package/dist/runtime/adoption.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+/**
+ * The agent service's `attach` op replies "No detached session to attach: <id>"
+ * (see agent-service.ts handleStart) when it is reachable but has no such live
+ * session — the only DEFINITIVE "gone" signal. Every other failure (connection
+ * refused / reset / closed-during-start / timeout) is transient: the service may
+ * be down or restarting, so the child may well still exist.
+ */
+export function classifyAttachFailure(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return /no detached session to attach/i.test(message) ? "gone" : "transient";
+}
+/**
+ * Attempt to re-attach to each adoptable session concurrently, applying the
+ * failure policy. Never throws — a single session's failure only affects its own
+ * classification. Callers should PRE-RECORD every row's address into the durable
+ * location registry BEFORE calling this, so a racing `advertiseSessions()` (the
+ * replace-all-per-node POST) preserves the addresses even while attaches are still
+ * in flight — otherwise the first advert would wipe the very column adoption reads.
+ */
+export async function attachAdoptedSessions(rows, deps) {
+    const adopted = [];
+    const kept = [];
+    const forgotten = [];
+    await Promise.all(rows.map(async (location) => {
+        try {
+            await deps.attach(location);
+            adopted.push(location.sessionId);
+            deps.log?.(`adopted ${location.sessionId} at ${location.agentServiceAddress}`);
+        }
+        catch (error) {
+            if (classifyAttachFailure(error) === "gone") {
+                forgotten.push(location.sessionId);
+                await deps.forget(location.sessionId).catch(() => { });
+                deps.log?.(`forgot definitively-gone session ${location.sessionId}`);
+            }
+            else {
+                kept.push(location.sessionId);
+                deps.log?.(`kept unreachable session ${location.sessionId} (${location.agentServiceAddress}) — will retry`);
+            }
+        }
+    }));
+    return { adopted, kept, forgotten };
+}

package/dist/runtime/agent-service-bin.js

@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+/**
+ * Agent service entry point — runs the real agent runtimes in a process
+ * SEPARATE from the node daemon and exposes them over the RPC protocol
+ * (src/runtime/rpc-protocol.ts). Launch it beside a daemon and point the daemon
+ * at it with BIVY_REMOTE_RUNTIME=1 + BIVY_REMOTE_RUNTIME_ADDR (see
+ * docs/agent-runtime-rpc.md).
+ *
+ *   BIVY_AGENT_SERVICE_LISTEN            where to listen: "unix:/path.sock" | "PORT" | "host:PORT"
+ *   BIVY_DATA_DIR                        data dir (defaults to <cwd>/.bivy), same as the daemon
+ *   BIVY_REMOTE_RUNTIME_DETACH_REAP_MS   optional: reap a detached, idle session after this many ms (off by default)
+ *
+ * Dev:  tsx src/runtime/agent-service-bin.ts
+ * Prod: node dist/runtime/agent-service-bin.js
+ *
+ * The service must have the same agent binaries on PATH and credential access
+ * the in-process daemon would (the Claude SDK execs the `claude` CLI internally),
+ * because the child now runs HERE, not in the daemon.
+ */
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { AgentService } from "./agent-service.js";
+import { encodeFrame, FrameDecoder } from "./rpc-protocol.js";
+import { parseRemoteAddress } from "./remote.js";
+import { makeRuntime } from "./index.js";
+import { defaultDataDir } from "../data-dir.js";
+/** Adapt a raw socket to the transport-agnostic ServiceConnection. */
+export function socketConnection(socket) {
+    const decoder = new FrameDecoder();
+    let onMessage;
+    let onClose;
+    socket.on("data", (chunk) => {
+        let messages;
+        try {
+            messages = decoder.push(chunk);
+        }
+        catch {
+            socket.destroy();
+            return;
+        }
+        if (onMessage)
+            for (const message of messages)
+                onMessage(message);
+    });
+    socket.on("error", () => {
+        // A 'close' event always follows; teardown happens there.
+    });
+    socket.on("close", () => onClose?.());
+    return {
+        send(message) {
+            try {
+                socket.write(encodeFrame(message));
+            }
+            catch {
+                // peer went away mid-write; 'close' will reap
+            }
+        },
+        onMessage(handler) {
+            onMessage = handler;
+        },
+        onClose(handler) {
+            onClose = handler;
+        },
+        close() {
+            socket.destroy();
+        },
+    };
+}
+/** Start a socket server that hands each connection to the AgentService. */
+export function startAgentServiceServer(options) {
+    const server = net.createServer((socket) => options.service.accept(socketConnection(socket)));
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(parseRemoteAddress(options.listen), () => {
+            server.removeListener("error", reject);
+            resolve(server);
+        });
+    });
+}
+/** Build the default runtime provider backed by the real runtime registry. */
+export function defaultRuntimeProvider() {
+    const appDir = defaultDataDir();
+    const piDir = path.join(appDir, "pi");
+    const sessionsDir = path.join(piDir, "sessions");
+    // The shared, agent-neutral credential vault (not inside any agent's dir).
+    const credsDir = path.join(appDir, "credentials");
+    // Build the runtime the daemon asked for directly via makeRuntime — NOT
+    // through RuntimeHost.resolveRuntimeId, whose picker/availability gate is the
+    // daemon's UI concern. The daemon already chose the id; the service just hosts
+    // it (makeRuntime still throws if the agent binary/SDK is missing here).
+    // Node-hosted tools (Bivy integrations / MCP) reach the runtime here via the
+    // per-session ToolProvider the daemon supplies over RPC (agent-agnostic), so
+    // the service needs no runtime-specific tool wiring of its own.
+    const factory = { credsDir, piDir, sessionsDir };
+    const cache = new Map();
+    return (runtimeId, sandbox) => {
+        const key = sandbox ? `${runtimeId}::sandbox=${sandbox}` : runtimeId;
+        let rt = cache.get(key);
+        if (!rt) {
+            rt = makeRuntime({ ...factory, runtime: runtimeId, sandbox: sandbox });
+            cache.set(key, rt);
+        }
+        return rt;
+    };
+}
+async function main() {
+    const listen = process.env.BIVY_AGENT_SERVICE_LISTEN?.trim();
+    if (!listen) {
+        console.error("[agent-service] BIVY_AGENT_SERVICE_LISTEN is required (e.g. unix:/tmp/bivy-agent.sock or 4711)");
+        process.exit(2);
+    }
+    // Idle-reaper for DETACHED sessions (Stage 3). Off by default; set
+    // BIVY_REMOTE_RUNTIME_DETACH_REAP_MS to bound how long a session the daemon
+    // evicted/lost persists here with no bound connection.
+    const detachReapMs = Number(process.env.BIVY_REMOTE_RUNTIME_DETACH_REAP_MS) || 0;
+    const service = new AgentService({ runtimeProvider: defaultRuntimeProvider(), log: (message) => console.error(`[agent-service] ${message}`), detachReapMs });
+    if (detachReapMs > 0)
+        console.error(`[agent-service] detached-session idle reaper: ${detachReapMs}ms`);
+    const server = await startAgentServiceServer({ service, listen });
+    console.error(`[agent-service] listening on ${listen} (pid ${process.pid}, host ${os.hostname()})`);
+    let shuttingDown = false;
+    const shutdown = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        console.error(`[agent-service] ${signal} — reaping ${service.sessionCount} session(s)`);
+        service.disposeAll(); // reap every child so the service leaves no orphans
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 3000).unref();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    // Crash net: this service process hosts detached agent sessions, so a stray
+    // unhandled rejection/exception must not tear all of them down. Log and keep
+    // running; a real supervisor restart remains the fallback.
+    process.on("unhandledRejection", (reason) => {
+        console.error("[bivy agent-service] unhandledRejection (kept running):", reason);
+    });
+    process.on("uncaughtException", (error) => {
+        console.error("[bivy agent-service] uncaughtException (kept running):", error);
+    });
+}
+// Run only when executed directly (not when imported by a test).
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    void main();
+}