@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/runtime/credential-provisioning.js

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Unified credential provisioning — one login in Bivy, every agent works.
+//
+// Bivy holds the single source of truth (the encrypted vault) and *projects* it
+// into whatever form each native agent consumes when that agent runs:
+//   - env vars (ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, …) for agents that
+//     read the environment;
+//   - a native on-disk store for agents that read their own file (Pi's auth.json,
+//     Codex's ~/.codex/auth.json).
+// Every projection is refreshed-before-use, so agents receive a fresh access
+// token and rarely need to self-refresh — which keeps Bivy the single OAuth
+// refresh authority (rotating refresh tokens are single-use; two agents
+// refreshing the same credential would invalidate each other).
+//
+// This is the seam behind `bivy run <agent>`, `bivy shim`, and the chat→native
+// TUI hand-off. Claude Code manages its own env projection (claude-code.ts) and
+// is intentionally left as-is.
+import { createCredentialVault } from "./credential-store.js";
+import { buildAgentCredentialEnv, createCredentialStore } from "./credentials.js";
+import { ensureCodexAuth, ensureCodexTrusted } from "./codex-auth.js";
+import { refreshModelOAuth } from "./oauth/model-oauth.js";
+import { isNativeOAuthProvider } from "./oauth/model-oauth-providers.js";
+/**
+ * Refresh any stored OAuth credential that is already expired, centrally, so a
+ * projection hands the agent a fresh access token. No-op for fresh tokens and
+ * non-OAuth providers; runs under the store lock (single-flight).
+ */
+export async function refreshExpiringOAuth(credsDir) {
+    const infos = await createCredentialVault(credsDir).list().catch(() => []);
+    await Promise.all(infos
+        .filter((info) => info.type === "oauth" && isNativeOAuthProvider(info.providerId))
+        .map((info) => refreshModelOAuth(credsDir, info.providerId).catch(() => undefined)));
+}
+/**
+ * Environment variables that project Bivy's unified logins onto an agent
+ * process. Refreshes expiring OAuth first. This is how `bivy run <agent>` and
+ * the TUI hand-off make one Bivy sign-in serve any agent that reads env vars.
+ */
+export async function provisionAgentEnv(credsDir, providers) {
+    await refreshExpiringOAuth(credsDir);
+    return buildAgentCredentialEnv(createCredentialStore(credsDir), providers);
+}
+/**
+ * Materialize Pi's plaintext auth.json from the shared vault with fresh tokens,
+ * for Pi's own CLI/TUI (which reads its file store in `piDir`). Pair with the
+ * daemon's auth.json watcher (ingestPlaintext), which folds any TUI-time
+ * login/refresh back in.
+ */
+export async function provisionPiAuthJson(credsDir, piDir) {
+    await refreshExpiringOAuth(credsDir);
+    createCredentialVault(credsDir, piDir).materializePlaintext();
+}
+/**
+ * Full projection for a native `bivy run <agent>` launch: env vars for every
+ * agent, plus the native on-disk store for agents that need one. Returns the env
+ * to set on the PTY (may include CODEX_HOME). `credsDir` is the shared vault;
+ * `piDir` is Pi's own dir (used only for Pi's plaintext auth.json).
+ */
+export async function provisionAgentRun(credsDir, piDir, agentId, workspace) {
+    const env = await provisionAgentEnv(credsDir);
+    if (agentId === "pi") {
+        await provisionPiAuthJson(credsDir, piDir).catch((error) => {
+            console.warn("[provision] pi auth.json materialization failed:", error.message);
+        });
+    }
+    else if (agentId === "codex") {
+        // Codex reads OPENAI_API_KEY (already in env) or its own auth.json; mint the
+        // latter from a connected ChatGPT subscription when present.
+        const home = await ensureCodexAuth(credsDir).catch(() => undefined);
+        if (home)
+            env.CODEX_HOME = home;
+        // Pre-trust the run workspace so Codex doesn't stall on its first-run trust
+        // prompt (which blocks it from writing the rollout takeover relies on).
+        if (workspace)
+            ensureCodexTrusted(workspace);
+    }
+    return env;
+}

package/dist/runtime/credential-store.js

@@ -0,0 +1,435 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Bivy's app-owned credential store — the source of truth for model credentials.
+//
+// This module is deliberately PI-FREE (no import from any @earendil-works
+// package, not even a type). Bivy owns the storage, the credential shape, the
+// encryption, and the locking. Pi consumes this store as just another agent
+// (see pi-oauth.ts, which adapts it to pi-ai's structurally-identical
+// CredentialStore interface for injection into ModelRuntime).
+//
+// At rest the vault is encrypted (AES-256-GCM via the repo's own seal/open — no
+// third crypto implementation) under a 0600 key minted once. Writes are
+// serialized twice over: an in-process per-provider promise chain, and a
+// cross-process mkdir lock (the `bivy login` CLI writes the same file as the
+// running daemon). `modify()` is the only write path, so every mutation is a
+// read-modify-write under the lock — the ordering OAuth refresh depends on
+// (rotated refresh tokens are single-use; a read-then-write loses that race).
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { seal, open } from "../e2e.js";
+const LOCK_STALE_MS = 30_000;
+const LOCK_RETRY_MS = 25;
+const LOCK_TIMEOUT_MS = 10_000;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function isStoredCredential(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const type = value.type;
+    return type === "api_key" || type === "oauth";
+}
+/** Normalize a provider id the way every path expects (trimmed, lowercased). */
+function providerId(id) {
+    return String(id ?? "").trim().toLowerCase();
+}
+/**
+ * Encrypted, cross-process-locked credential vault backed by `<vaultDir>/auth.enc`.
+ *
+ * `vaultDir` is the node's shared, agent-neutral credential directory
+ * (`.bivy/credentials`) — NOT any one agent's directory. The optional
+ * `plaintextDir` is where the decrypted `auth.json` projection is written for an
+ * agent whose native CLI/TUI reads a plaintext store (Pi's own dir); it defaults
+ * to `vaultDir` for callers that never materialize plaintext.
+ *
+ * The public surface intentionally matches pi-ai's `CredentialStore`
+ * (`read`/`list`/`modify`/`delete`) so pi-oauth.ts can inject it into a
+ * `ModelRuntime` with a single structural cast — plus Bivy-owned `exportAll` /
+ * `importAll` for cross-node sync. Nothing here depends on pi.
+ */
+export class BivyCredentialStore {
+    vaultDir;
+    blobFile;
+    keyFile;
+    legacyFile;
+    lockDir;
+    plaintextDir;
+    chains = new Map();
+    migrated = false;
+    constructor(vaultDir, plaintextDir) {
+        this.vaultDir = vaultDir;
+        this.blobFile = path.join(vaultDir, "auth.enc");
+        this.keyFile = path.join(vaultDir, "auth.key");
+        this.lockDir = path.join(vaultDir, "auth.enc.lock");
+        // The plaintext projection is an agent-specific concern (an agent whose CLI
+        // reads its own `auth.json`), so it can live in a different dir than the
+        // shared encrypted vault.
+        this.plaintextDir = plaintextDir ?? vaultDir;
+        this.legacyFile = path.join(this.plaintextDir, "auth.json");
+    }
+    // --- pi-ai CredentialStore surface ---------------------------------------
+    async read(provider) {
+        const id = providerId(provider);
+        if (!id)
+            return undefined;
+        return this.readBlob()[id];
+    }
+    async list() {
+        return Object.entries(this.readBlob()).map(([id, cred]) => ({
+            providerId: id,
+            type: cred.type,
+            ...(cred.type === "oauth" ? { expiresAt: cred.expires } : {}),
+        }));
+    }
+    /**
+     * Serialized read-modify-write — the only write path. `fn` sees the credential
+     * as of this write (not as of when the caller decided to write), so a refresh
+     * cannot be clobbered by a concurrent import. Returns the post-write
+     * credential; `fn` returning undefined leaves the entry unchanged.
+     */
+    async modify(provider, fn) {
+        const id = providerId(provider);
+        if (!id)
+            throw new Error("Provider is required");
+        return this.enqueue(id, async () => {
+            await this.acquireLock();
+            try {
+                const vault = this.readBlob();
+                const next = await fn(vault[id]);
+                if (next === undefined)
+                    return vault[id];
+                if (!isStoredCredential(next))
+                    throw new Error(`Invalid credential for "${id}"`);
+                vault[id] = next;
+                this.writeBlob(vault);
+                return next;
+            }
+            finally {
+                await this.releaseLock();
+            }
+        });
+    }
+    async delete(provider) {
+        const id = providerId(provider);
+        if (!id)
+            return;
+        await this.enqueue(id, async () => {
+            await this.acquireLock();
+            try {
+                const vault = this.readBlob();
+                if (!(id in vault))
+                    return;
+                delete vault[id];
+                this.writeBlob(vault);
+            }
+            finally {
+                await this.releaseLock();
+            }
+        });
+    }
+    // --- Bivy-owned convenience ---------------------------------------------
+    /** Store an API key (the common non-OAuth login). */
+    async setApiKey(provider, key) {
+        const apiKey = String(key ?? "").trim();
+        if (!apiKey)
+            throw new Error("API key cannot be empty");
+        await this.modify(provider, async () => ({ type: "api_key", key: apiKey }));
+    }
+    /** Every stored credential, keyed by provider id — the cross-node snapshot. */
+    async exportAll() {
+        return this.readBlob();
+    }
+    /** The plaintext `auth.json` path an agent's own CLI/TUI reads (`<plaintextDir>/auth.json`). */
+    get legacyAuthPath() {
+        return this.legacyFile;
+    }
+    /**
+     * Write the decrypted vault to `<plaintextDir>/auth.json` so a subprocess that
+     * reads a plaintext store (e.g. Pi's own interactive TUI) can use the same
+     * logins.
+     * Synchronous, 0600. This is the bridge for the native-TUI hand-off; daemon
+     * agents get credentials via env injection and never see this file. Pair with
+     * `ingestPlaintext()` to fold TUI-time logins back into the vault.
+     */
+    materializePlaintext() {
+        const vault = this.readBlob();
+        const next = `${JSON.stringify(vault, null, 2)}\n`;
+        // Write only when the projection actually changes. This keeps the file's
+        // mtime stable so a live re-materialize (on a vault change while a native Pi
+        // TUI is running) can't ping-pong with the auth.json watcher's ingest.
+        try {
+            if (fs.readFileSync(this.legacyFile, "utf8") === next)
+                return this.legacyFile;
+        }
+        catch { /* missing/unreadable — fall through and write */ }
+        fs.mkdirSync(this.plaintextDir, { recursive: true, mode: 0o700 });
+        const tmp = `${this.legacyFile}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, next, { mode: 0o600 });
+        fs.renameSync(tmp, this.legacyFile);
+        try {
+            fs.chmodSync(this.legacyFile, 0o600);
+        }
+        catch { /* best effort */ }
+        return this.legacyFile;
+    }
+    /** Fold any credentials in the plaintext `auth.json` (e.g. a TUI login) back into the vault. */
+    async ingestPlaintext() {
+        let legacy;
+        try {
+            legacy = JSON.parse(fs.readFileSync(this.legacyFile, "utf8"));
+        }
+        catch {
+            return 0;
+        }
+        return this.importAll(normalizeMap(legacy));
+    }
+    /**
+     * Merge an account snapshot into the vault. Merge, never destroy: a lagging
+     * snapshot that omits a provider must not delete a fresh local login, and a
+     * locally-fresher OAuth token must win over an older one in the snapshot
+     * (rotated refresh tokens are single-use — importing a stale one breaks the
+     * next refresh). Runs under the lock so it can't race a refresh.
+     */
+    async importAll(snapshot) {
+        await this.acquireLock();
+        try {
+            const vault = this.readBlob();
+            let imported = 0;
+            let changed = false;
+            for (const [rawId, incoming] of Object.entries(snapshot ?? {})) {
+                const id = providerId(rawId);
+                if (!id || !isStoredCredential(incoming))
+                    continue;
+                const local = vault[id];
+                if (incoming.type === "oauth" && local?.type === "oauth") {
+                    const localExpires = Number(local.expires) || 0;
+                    const incomingExpires = Number(incoming.expires) || 0;
+                    if (localExpires > incomingExpires)
+                        continue;
+                }
+                if (!(id in vault))
+                    imported += 1;
+                // Only mark dirty on a real content change, so a snapshot that merely
+                // re-states what we already hold doesn't rewrite (and re-encrypt) the
+                // vault — which would needlessly bump auth.enc's mtime and re-fire the
+                // vault watcher (materialize → ingest → import loop protection).
+                if (JSON.stringify(local) !== JSON.stringify(incoming)) {
+                    vault[id] = incoming;
+                    changed = true;
+                }
+            }
+            if (changed)
+                this.writeBlob(vault);
+            return imported;
+        }
+        finally {
+            await this.releaseLock();
+        }
+    }
+    // --- storage internals ---------------------------------------------------
+    key() {
+        try {
+            const key = Buffer.from(fs.readFileSync(this.keyFile, "utf8").trim(), "base64");
+            if (key.length === 32)
+                return key;
+            // Present but malformed — surface it rather than mint a new key that makes
+            // every stored credential undecryptable.
+            throw new Error(`Credential key at ${this.keyFile} is invalid (expected 32 bytes)`);
+        }
+        catch (error) {
+            // Mint only when the key genuinely does not exist. A transient read
+            // failure (EMFILE, permission blip) must NOT regenerate the key.
+            if (error?.code !== "ENOENT")
+                throw error;
+        }
+        fs.mkdirSync(this.vaultDir, { recursive: true, mode: 0o700 });
+        const key = randomBytes(32);
+        fs.writeFileSync(this.keyFile, `${key.toString("base64")}\n`, { mode: 0o600 });
+        try {
+            fs.chmodSync(this.keyFile, 0o600);
+        }
+        catch { /* best effort */ }
+        return key;
+    }
+    readBlob() {
+        this.ensureMigrated();
+        let raw;
+        try {
+            raw = fs.readFileSync(this.blobFile, "utf8");
+        }
+        catch {
+            return {};
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(open(this.key(), raw.trim()));
+        }
+        catch {
+            // A truncated/corrupt/undecryptable vault is treated as empty rather than
+            // taking the node down: every caller already handles "no credential".
+            return {};
+        }
+        return normalizeMap(parsed);
+    }
+    writeBlob(vault) {
+        fs.mkdirSync(this.vaultDir, { recursive: true, mode: 0o700 });
+        const ciphertext = seal(this.key(), JSON.stringify(vault));
+        const tmp = `${this.blobFile}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, `${ciphertext}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, this.blobFile);
+        try {
+            fs.chmodSync(this.blobFile, 0o600);
+        }
+        catch { /* best effort */ }
+    }
+    /**
+     * One-time, best-effort import of a legacy plaintext `auth.json` when the
+     * encrypted vault does not exist yet. Dev convenience so an existing install
+     * keeps its logins across the upgrade; non-destructive (auth.json is left in
+     * place). Pre-users, so this is the only migration we owe.
+     */
+    ensureMigrated() {
+        if (this.migrated)
+            return;
+        this.migrated = true;
+        if (fs.existsSync(this.blobFile))
+            return;
+        let legacy;
+        try {
+            legacy = JSON.parse(fs.readFileSync(this.legacyFile, "utf8"));
+        }
+        catch {
+            return; // no legacy file / unreadable — nothing to import
+        }
+        const map = normalizeMap(legacy);
+        if (Object.keys(map).length === 0)
+            return;
+        try {
+            this.writeBlob(map);
+        }
+        catch {
+            // If we can't write the encrypted vault, fall back to reading legacy on
+            // the next call rather than crashing.
+            this.migrated = false;
+        }
+    }
+    // --- locking -------------------------------------------------------------
+    enqueue(id, task) {
+        const prior = this.chains.get(id) ?? Promise.resolve();
+        // Chain off settlement, not value: one caller's rejection must not cancel
+        // the next caller's write.
+        const next = prior.then(task, task);
+        this.chains.set(id, next.catch(() => undefined));
+        return next;
+    }
+    async acquireLock() {
+        const deadline = Date.now() + LOCK_TIMEOUT_MS;
+        for (;;) {
+            try {
+                fs.mkdirSync(this.vaultDir, { recursive: true, mode: 0o700 });
+                fs.mkdirSync(this.lockDir);
+                return;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                if (this.breakIfStale())
+                    continue;
+                if (Date.now() > deadline) {
+                    throw new Error(`Timed out waiting for the credential lock at ${this.lockDir}`);
+                }
+                await sleep(LOCK_RETRY_MS);
+            }
+        }
+    }
+    /** Remove a lock whose owner died mid-write. Returns true if it broke one. */
+    breakIfStale() {
+        try {
+            const age = Date.now() - fs.statSync(this.lockDir).mtimeMs;
+            if (age < LOCK_STALE_MS)
+                return false;
+            fs.rmdirSync(this.lockDir);
+            return true;
+        }
+        catch {
+            // Lost the race to another breaker, or it was released under us — the next
+            // mkdir attempt is the source of truth.
+            return false;
+        }
+    }
+    async releaseLock() {
+        await fsp.rmdir(this.lockDir).catch(() => { });
+    }
+}
+/** Coerce arbitrary parsed JSON into a `{ [id]: StoredCredential }` map. */
+function normalizeMap(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return {};
+    const out = {};
+    for (const [id, value] of Object.entries(parsed)) {
+        if (isStoredCredential(value))
+            out[providerId(id)] = value;
+    }
+    return out;
+}
+/**
+ * Build the node's shared credential vault at `<vaultDir>/auth.enc`. Pass
+ * `plaintextDir` when an agent's native CLI reads a plaintext `auth.json` in a
+ * different directory (e.g. Pi's own dir); it defaults to `vaultDir`.
+ */
+export function createCredentialVault(vaultDir, plaintextDir) {
+    return new BivyCredentialStore(vaultDir, plaintextDir);
+}
+/**
+ * One-time, best-effort relocation of the encrypted vault (`auth.enc` +
+ * `auth.key`) from a legacy directory to the node's dedicated credentials dir.
+ * This is the migration for installs created before the vault was split out of an
+ * agent's own directory — so an existing user keeps their logins across the
+ * upgrade instead of re-authenticating.
+ *
+ * Idempotent: it only runs when the destination has no vault yet and the source
+ * does. The key is moved before the ciphertext, so a crash mid-move leaves the
+ * destination without an `auth.enc` (the guard re-runs the move next boot) rather
+ * than an undecryptable one. The plaintext `auth.json` is intentionally NOT moved
+ * — it stays in the agent's own dir, where its native CLI/TUI reads it.
+ * Returns true if it moved a vault.
+ */
+export function migrateVaultDir(fromDir, toDir) {
+    if (fromDir === toDir)
+        return false;
+    try {
+        // Guard: never overwrite a vault already in place at the destination, and do
+        // nothing when there is no legacy vault to move.
+        if (fs.existsSync(path.join(toDir, "auth.enc")) || !fs.existsSync(path.join(fromDir, "auth.enc")))
+            return false;
+        fs.mkdirSync(toDir, { recursive: true, mode: 0o700 });
+        // Move the key first, then the ciphertext (see doc-comment ordering rationale).
+        for (const name of ["auth.key", "auth.enc"]) {
+            const from = path.join(fromDir, name);
+            const to = path.join(toDir, name);
+            if (!fs.existsSync(from) || fs.existsSync(to))
+                continue;
+            try {
+                fs.renameSync(from, to);
+            }
+            catch {
+                // Cross-device or transient failure — copy then unlink the source.
+                fs.copyFileSync(from, to);
+                try {
+                    fs.unlinkSync(from);
+                }
+                catch { /* leave the source; the guard stops a re-copy */ }
+            }
+            try {
+                fs.chmodSync(to, 0o600);
+            }
+            catch { /* best effort */ }
+        }
+        return fs.existsSync(path.join(toDir, "auth.enc"));
+    }
+    catch {
+        // Best-effort: a failed migration just means the user re-authenticates.
+        return false;
+    }
+}

package/dist/runtime/credentials.js

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Shared credential resolver for agent env injection.
+//
+// A node-level resolver so every agent runtime can reuse the model-provider
+// logins the user did once, instead of re-authenticating per agent. It reads
+// Bivy's own credential store (credential-store.ts) DIRECTLY — api keys and
+// non-expired OAuth tokens need no Pi at all. Only an expired OAuth token
+// touches Pi, via the isolated pi-oauth bridge, to run the provider's refresh.
+//
+// This keeps Bivy's hot credential path decoupled from Pi: Pi is just another
+// agent that reads the same store.
+import { createCredentialVault } from "./credential-store.js";
+import { refreshModelOAuth } from "./oauth/model-oauth.js";
+/** Refresh an OAuth token this many ms before it expires (clock-skew guard). */
+const OAUTH_REFRESH_SKEW_MS = 60_000;
+/** Resolver over Bivy's credential store, with OAuth refresh-on-read via the bridge. */
+export class NodeCredentialResolver {
+    credsDir;
+    store;
+    constructor(credsDir) {
+        this.credsDir = credsDir;
+        this.store = createCredentialVault(credsDir);
+    }
+    async getCredential(provider) {
+        const id = provider.trim().toLowerCase();
+        if (!id)
+            return undefined;
+        const cred = await this.store.read(id).catch(() => undefined);
+        if (!cred)
+            return undefined;
+        if (cred.type === "api_key") {
+            const token = typeof cred.key === "string" ? cred.key : "";
+            if (!token)
+                return undefined;
+            return { provider: id, kind: "api_key", token, ...(cred.env ? { env: cred.env } : {}) };
+        }
+        // OAuth: use the stored access token while it's fresh; otherwise ask Pi to
+        // run the provider's refresh (which rotates + persists back into our store
+        // under the store lock).
+        let token = typeof cred.access === "string" ? cred.access : "";
+        const expires = Number(cred.expires) || 0;
+        if (!token || expires <= Date.now() + OAUTH_REFRESH_SKEW_MS) {
+            const refreshed = await refreshModelOAuth(this.credsDir, id).catch(() => undefined);
+            if (refreshed)
+                token = refreshed;
+        }
+        if (!token)
+            return undefined;
+        const env = cred.env;
+        return { provider: id, kind: "oauth", token, ...(env ? { env } : {}) };
+    }
+    /** Providers with a stored credential — the vault's contents (not ambient env). */
+    async listConfigured() {
+        const infos = await this.store.list().catch(() => []);
+        return infos.map((info) => info.providerId);
+    }
+}
+/** Build the shared credential resolver from the node's credential vault dir. */
+export function createCredentialStore(credsDir) {
+    return new NodeCredentialResolver(credsDir);
+}
+// Conventional environment variables agent CLIs/SDKs read for each provider. This
+// is how a login the user did once inside Bivy reaches an arbitrary agent process:
+// the agent doesn't know about Bivy's vault, but it does read these env vars.
+const PROVIDER_ENV_KEYS = {
+    anthropic: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    openrouter: "OPENROUTER_API_KEY",
+    google: "GEMINI_API_KEY",
+    gemini: "GEMINI_API_KEY",
+    "google-vertex": "GOOGLE_API_KEY",
+    groq: "GROQ_API_KEY",
+    mistral: "MISTRAL_API_KEY",
+    deepseek: "DEEPSEEK_API_KEY",
+    xai: "XAI_API_KEY",
+    together: "TOGETHER_API_KEY",
+    fireworks: "FIREWORKS_API_KEY",
+    cohere: "COHERE_API_KEY",
+    perplexity: "PERPLEXITY_API_KEY",
+};
+/** Env var an api-key credential for `provider` should be exposed under. */
+export function apiKeyEnvVar(provider) {
+    return PROVIDER_ENV_KEYS[provider] ?? `${provider.replace(/[^a-z0-9]+/gi, "_").toUpperCase()}_API_KEY`;
+}
+// A custom endpoint's base URL is stored in its credential `env` under one of
+// these vars. When that endpoint is the session's ACTIVE provider we also alias
+// its key to the matching standard key var, so an agent that reads OPENAI_* /
+// AZURE_OPENAI_* / ANTHROPIC_* picks up the custom endpoint. Injected only for
+// the active provider — a global base-URL var would hijack the real provider.
+const BASE_URL_TO_KEY_VAR = {
+    OPENAI_BASE_URL: "OPENAI_API_KEY",
+    AZURE_OPENAI_BASE_URL: "AZURE_OPENAI_API_KEY",
+    ANTHROPIC_BASE_URL: "ANTHROPIC_API_KEY",
+};
+/**
+ * Map every credential the node holds (or a chosen subset) to the environment
+ * variables an agent process reads, so one sign-in inside Bivy serves whatever
+ * runtime/model the user selects — not just the Pi agent. Anthropic OAuth
+ * (Claude Pro/Max) is exposed as CLAUDE_CODE_OAUTH_TOKEN; every other credential
+ * is exposed as the provider's API-key var.
+ *
+ * Provider-scoped `env` (custom base URLs) is injected ONLY for `activeProvider`
+ * — the session's selected provider. Base-URL vars like OPENAI_BASE_URL are
+ * global to the agent process, so injecting a custom endpoint's base URL for a
+ * non-active provider would silently redirect the real provider. Best-effort: a
+ * provider that fails to resolve is skipped rather than failing the session.
+ */
+export async function buildAgentCredentialEnv(store, providers, activeProvider) {
+    const ids = providers ?? (store.listConfigured ? await store.listConfigured().catch(() => []) : []);
+    const active = activeProvider?.trim().toLowerCase() || undefined;
+    // Process the active provider LAST so its base URL and standard-key alias win
+    // over a same-named var from another provider (e.g. a real "openai" key var
+    // must not clobber an active custom endpoint's aliased OPENAI_API_KEY).
+    const ordered = active ? [...ids].sort((a, b) => Number(a === active) - Number(b === active)) : ids;
+    const env = {};
+    for (const id of ordered) {
+        let cred;
+        try {
+            cred = await store.getCredential(id);
+        }
+        catch {
+            continue;
+        }
+        if (!cred)
+            continue;
+        const isActive = !!active && cred.provider === active;
+        if (cred.kind === "oauth") {
+            // OAuth *subscription* tokens are provider-specific and are not accepted
+            // as a plain API key. Only Anthropic has a documented env var an external
+            // agent reads (Claude Code's OAuth token); other providers' subscription
+            // logins can't be handed off this way, so don't emit a misleading key.
+            if (cred.provider !== "anthropic")
+                continue;
+            Object.assign(env, cred.env ?? {});
+            env.CLAUDE_CODE_OAUTH_TOKEN = cred.token;
+        }
+        else {
+            env[apiKeyEnvVar(cred.provider)] = cred.token;
+            // A custom endpoint's base URL (and standard-key alias) is injected only
+            // when it's the active provider, so it can't hijack the real provider.
+            if (isActive && cred.env) {
+                Object.assign(env, cred.env);
+                for (const baseVar of Object.keys(cred.env)) {
+                    const keyVar = BASE_URL_TO_KEY_VAR[baseVar];
+                    if (keyVar && cred.token)
+                        env[keyVar] = cred.token;
+                }
+            }
+        }
+    }
+    return env;
+}