@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/bin/shim-path.mjs

@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Managed shell-rc PATH block for `bivy shim`.
+//
+// Installing a shim into `~/.local/bin` only helps if that directory wins over
+// the real binary on the user's interactive PATH. It usually does NOT: version
+// managers (mise/asdf/nvm/pyenv) inject their bin dirs via shell-init hooks that
+// run *during* interactive startup and prepend to PATH — after any static
+// `export PATH="$HOME/.local/bin:$PATH"` the user may have set. So the real
+// agent keeps winning and the shim never fires (see the original report).
+//
+// The reliable fix is a small, clearly-marked block that Bivy manages at the END
+// of the user's rc file (`.zshrc`/`.bashrc`) — i.e. AFTER the version-manager
+// init — that force-moves the shim dir(s) to the front of PATH. This module is
+// the pure, unit-tested core: render the block, and idempotently upsert/remove
+// it inside arbitrary rc-file text. `bin/bivy.mjs` does the file IO.
+//
+// The block is written to be valid in both bash and zsh (the shells whose rc we
+// touch). It deliberately avoids `for d in $PATH` word-splitting — which behaves
+// differently in zsh — and instead rewrites PATH with parameter substitution.
+
+import os from "node:os";
+import path from "node:path";
+
+export const MANAGED_BLOCK_START = "# >>> bivy shim path >>>";
+export const MANAGED_BLOCK_END = "# <<< bivy shim path <<<";
+
+// Render a directory as a shell expression for the rc file. Directories under
+// $HOME are emitted as "$HOME/…" so the block stays portable across machines
+// that sync dotfiles; anything else is an absolute, double-quoted literal. In
+// both forms the value is double-quoted, so spaces are handled and the leading
+// `$HOME` still expands.
+export function shimDirToRcExpr(dir, home = os.homedir()) {
+  const resolved = path.resolve(dir);
+  const h = path.resolve(home);
+  const esc = (s) => s.replace(/(["\\$`])/g, "\\$1");
+  if (resolved === h) return '"$HOME"';
+  if (resolved.startsWith(h + path.sep)) {
+    return `"$HOME${esc(resolved.slice(h.length))}"`;
+  }
+  return `"${esc(resolved)}"`;
+}
+
+// Render the managed block for one or more shim directories. Later-listed dirs
+// are prepended first so the FIRST directory in `dirs` ends up frontmost on
+// PATH (highest priority).
+export function renderManagedBlock(dirs, { home = os.homedir() } = {}) {
+  const unique = [...new Set(dirs.map((d) => path.resolve(d)))];
+  const exprs = unique
+    .slice()
+    .reverse()
+    .map((d) => shimDirToRcExpr(d, home))
+    .join(" ");
+  return [
+    MANAGED_BLOCK_START,
+    "# Keeps Bivy's agent-shim dir(s) ahead of version-manager bins so that a",
+    "# shimmed agent resolves to its Bivy shim, not the real binary. Managed by",
+    "# `bivy shim`: regenerated on install, removed when the last shim is gone.",
+    "# Do not edit — your changes will be overwritten. (Valid in bash and zsh.)",
+    `for __bivy_dir in ${exprs}; do`,
+    '  [ -d "$__bivy_dir" ] || continue',
+    '  case ":$PATH:" in',
+    '    *":$__bivy_dir:"*)',
+    '      PATH=":$PATH:"',
+    '      PATH="${PATH//:$__bivy_dir:/:}"',
+    '      PATH="${PATH#:}"; PATH="${PATH%:}" ;;',
+    "  esac",
+    '  PATH="$__bivy_dir${PATH:+:$PATH}"',
+    "done",
+    "unset __bivy_dir",
+    "export PATH",
+    MANAGED_BLOCK_END,
+  ].join("\n");
+}
+
+// True if `content` already contains a managed block.
+export function hasManagedBlock(content) {
+  return typeof content === "string" && content.includes(MANAGED_BLOCK_START);
+}
+
+// Return `content` with any managed block removed. Line-based so it tolerates
+// leading/trailing whitespace on the marker lines, and collapses the blank-line
+// gap the block leaves behind so repeated upsert/remove cycles don't accrete
+// blank lines.
+export function removeManagedBlock(content) {
+  if (typeof content !== "string" || content === "") return content ?? "";
+  const lines = content.split("\n");
+  const out = [];
+  let inBlock = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!inBlock && trimmed === MANAGED_BLOCK_START) {
+      inBlock = true;
+      continue;
+    }
+    if (inBlock) {
+      if (trimmed === MANAGED_BLOCK_END) inBlock = false;
+      continue;
+    }
+    out.push(line);
+  }
+  // Collapse 2+ trailing blank lines (left where the block used to be) to a
+  // single trailing newline.
+  return out.join("\n").replace(/\n{2,}$/, "\n");
+}
+
+// Idempotently place `block` at the END of `content` (after version-manager
+// init). Any existing managed block is removed first, so re-running never
+// duplicates it and always re-anchors the block last.
+export function upsertManagedBlock(content, block) {
+  const cleaned = removeManagedBlock(content || "").replace(/\s*$/, "");
+  if (cleaned === "") return `${block}\n`;
+  return `${cleaned}\n\n${block}\n`;
+}
+
+// Resolve which rc file to manage for a given login shell. Returns
+// `{ file, shell }` for shells whose rc we understand (zsh/bash), or `null`
+// when we can't safely auto-manage (caller should print manual instructions).
+export function rcFileForShell(shellPath, home = os.homedir()) {
+  const shell = path.basename(String(shellPath || "")).toLowerCase();
+  if (shell.includes("zsh")) return { file: path.join(home, ".zshrc"), shell: "zsh" };
+  // Interactive bash terminals source ~/.bashrc (login shells chain to it from
+  // ~/.bash_profile on most setups); that's where the interactive PATH lives.
+  if (shell.includes("bash")) return { file: path.join(home, ".bashrc"), shell: "bash" };
+  return null;
+}

package/bin/uninstall-paths.mjs

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Pure(ish) filesystem helper for `bivy uninstall`, extracted so it can be
+// unit-tested without executing the CLI (bin/bivy.mjs runs main() on import).
+//
+// Background: `bivy uninstall --keep-sessions` used to move the raw pi
+// transcripts aside to a one-off `~/bivy-sessions-<timestamp>` folder that
+// nothing ever restored, and deleted the durable session index
+// (`.bivy/metadata.json`) regardless of the flag — so both the CLI and the
+// React app showed nothing after a fresh reinstall (issue #461).
+// `removeExcept` instead deletes everything under the app's state dir except
+// the paths the caller says to keep, leaving them exactly where they already
+// are — the path a rerun of a dev checkout, or install.sh's own `.bivy`
+// carry-forward on a packaged reinstall, already looks for them.
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * Delete everything under `root` except the given absolute paths, pruning
+ * (but not removing) the directory chain needed to reach them. With no `keep`
+ * entries this is equivalent to `rm -rf root`.
+ */
+export function removeExcept(root, keep) {
+  if (!keep.length) {
+    fs.rmSync(root, { recursive: true, force: true });
+    return;
+  }
+  const keepResolved = keep.map((p) => path.resolve(p));
+  const isAncestorOfKept = (dir) => keepResolved.some((k) => k === dir || k.startsWith(dir + path.sep));
+  const walk = (dir) => {
+    let ents;
+    try {
+      ents = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const ent of ents) {
+      const full = path.resolve(path.join(dir, ent.name));
+      if (keepResolved.includes(full)) continue;
+      if (ent.isDirectory() && isAncestorOfKept(full)) {
+        walk(full);
+        continue;
+      }
+      fs.rmSync(full, { recursive: true, force: true });
+    }
+  };
+  walk(root);
+}

package/dist/approval.js

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { randomUUID } from "node:crypto";
+/** Cap on retained resolved/expired approvals so a long-lived daemon can't grow
+ * history (and every /api/approvals + session-list scan) without bound. */
+const MAX_HISTORY = 200;
+export class ApprovalManager {
+    pending = new Map();
+    history = [];
+    listeners = new Set();
+    /** Append to history, trimming to the most recent MAX_HISTORY entries. */
+    record(request) {
+        this.history.push(request);
+        if (this.history.length > MAX_HISTORY) {
+            this.history.splice(0, this.history.length - MAX_HISTORY);
+        }
+    }
+    onRequest(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    list() {
+        return [...this.history, ...[...this.pending.values()].map((p) => p.request)];
+    }
+    async request(input) {
+        const request = {
+            id: randomUUID(),
+            sessionId: input.sessionId,
+            toolName: input.toolName,
+            input: input.toolInput,
+            reason: input.reason,
+            risk: input.risk,
+            workspace: input.workspace,
+            repo: input.repo,
+            branch: input.branch,
+            createdAt: Date.now(),
+            status: "pending",
+        };
+        const approved = await new Promise((resolve) => {
+            const timeout = setTimeout(() => {
+                const pending = this.pending.get(request.id);
+                if (!pending)
+                    return;
+                pending.request.status = "expired";
+                this.pending.delete(request.id);
+                this.record(pending.request);
+                resolve(false);
+            }, input.timeoutMs ?? 5 * 60_000);
+            this.pending.set(request.id, { request, resolve, timeout });
+            for (const listener of this.listeners)
+                listener(request);
+        });
+        return approved;
+    }
+    resolve(id, approved) {
+        const pending = this.pending.get(id);
+        if (!pending)
+            return false;
+        clearTimeout(pending.timeout);
+        pending.request.status = approved ? "approved" : "rejected";
+        this.pending.delete(id);
+        this.record(pending.request);
+        pending.resolve(approved);
+        return true;
+    }
+    /** Cancel (deny) any pending approvals for a session being torn down, so a
+     * killed/closed session's ApprovalCard doesn't linger on connected clients
+     * until its 5-minute timeout. Mirrors QuestionManager.cancelForSession. */
+    cancelForSession(sessionId) {
+        for (const [id, pending] of this.pending) {
+            if (pending.request.sessionId === sessionId)
+                this.resolve(id, false);
+        }
+    }
+    resolveAll(approved) {
+        const ids = [...this.pending.keys()];
+        const resolved = [];
+        for (const id of ids) {
+            const pending = this.pending.get(id);
+            if (!pending)
+                continue;
+            this.resolve(id, approved);
+            resolved.push(pending.request);
+        }
+        return resolved;
+    }
+}

package/dist/attach.js

@@ -0,0 +1,248 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { StringDecoder } from "node:string_decoder";
+import { WebSocket } from "ws";
+/**
+ * Raw-TTY bridge for `bivy run` and `bivy resume`.
+ *
+ * The agent's PTY lives in the node daemon; this process is just a client that
+ * binds the local terminal to it: local keystrokes become `terminal.input`, the
+ * daemon's output is written raw to stdout, and window resizes are forwarded.
+ * Because the PTY is daemon-owned, detaching here (Ctrl-\ twice, or losing the
+ * connection) leaves the session running so you can rejoin it later from another
+ * terminal (`bivy resume`), a phone, or the web app.
+ *
+ * Modes:
+ *   --run <specJson>   open a fresh run-terminal for a resolved agent command
+ *   --attach <termId>  bind to an existing run-terminal (replays scrollback)
+ */
+const c = {
+    dim: (s) => `\x1b[2m${s}\x1b[22m`,
+    bold: (s) => `\x1b[1m${s}\x1b[22m`,
+    red: (s) => `\x1b[31m${s}\x1b[39m`,
+    green: (s) => `\x1b[32m${s}\x1b[39m`,
+    cyan: (s) => `\x1b[36m${s}\x1b[39m`,
+};
+/**
+ * Undo the terminal modes a full-screen TUI (Claude Code, Codex, vim) turns on:
+ * leave the alternate screen, re-show the cursor, and switch off bracketed
+ * paste, focus reporting, mouse tracking, application cursor/keypad keys and
+ * any kitty keyboard-protocol flags.
+ *
+ * Needed because the daemon-side PTY can die without the TUI restoring the
+ * terminal itself: a "continue as chat" takeover kills the agent's PTY, and
+ * TerminalManager.close() deliberately drops its final output — the very chunk
+ * that would have carried the TUI's own restore sequences. The same applies to
+ * a Ctrl-\ detach, where the TUI keeps running remotely and never resets the
+ * local terminal. Without this, the user's original terminal is left in those
+ * modes and every mouse move, focus change or paste smears escape garbage over
+ * the shell prompt. Each sequence is a no-op when its mode was never enabled.
+ */
+const TTY_MODE_RESET = "\x1b[?1049l" + // leave the alternate screen
+    "\x1b[?2004l" + // bracketed paste off
+    "\x1b[?1004l" + // focus reporting off
+    "\x1b[?1000l\x1b[?1002l\x1b[?1003l\x1b[?1006l" + // mouse tracking off
+    "\x1b[<u" + // pop kitty keyboard-protocol flags (no-op if never pushed)
+    "\x1b[?1l\x1b>" + // cursor keys + keypad back to normal mode
+    "\x1b[?25h" + // cursor visible
+    "\x1b[0m"; // reset colors/attributes
+function parseArgs(argv) {
+    let url = process.env.BIVY_URL || `http://localhost:${process.env.PORT || "4317"}`;
+    let token = process.env.BIVY_DEVICE_TOKEN || undefined;
+    let mode = "attach";
+    let run;
+    let termId;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--url" && argv[i + 1])
+            url = argv[++i];
+        else if (arg.startsWith("--url="))
+            url = arg.slice("--url=".length);
+        else if (arg === "--token" && argv[i + 1])
+            token = argv[++i];
+        else if (arg.startsWith("--token="))
+            token = arg.slice("--token=".length);
+        else if (arg === "--run" && argv[i + 1]) {
+            mode = "run";
+            run = JSON.parse(argv[++i]);
+        }
+        else if (arg === "--attach" && argv[i + 1]) {
+            mode = "attach";
+            termId = argv[++i];
+        }
+    }
+    return { url: url.replace(/\/+$/, ""), token, mode, run, termId };
+}
+function wsUrl(baseUrl, token) {
+    const u = new URL(baseUrl);
+    u.protocol = u.protocol === "https:" ? "wss:" : "ws:";
+    u.pathname = "/ws";
+    u.search = token ? `?access_token=${encodeURIComponent(token)}` : "";
+    return u.toString();
+}
+function termSize() {
+    return { cols: process.stdout.columns || 80, rows: process.stdout.rows || 24 };
+}
+/**
+ * Bind the local TTY to a daemon-owned terminal until it exits or the user
+ * detaches. `open` sends the message that starts/attaches the terminal once the
+ * socket is ready; the returned promise resolves with the process exit code.
+ */
+function bridge(args, open) {
+    return new Promise((resolve) => {
+        const socket = new WebSocket(wsUrl(args.url, args.token));
+        let termId = args.termId;
+        let bound = false;
+        let detachArmed = 0;
+        let settled = false;
+        const inputDecoder = new StringDecoder("utf8");
+        const stdin = process.stdin;
+        const wasRaw = stdin.isTTY ? stdin.isRaw : false;
+        let modesReset = false;
+        // Reset TUI terminal modes exactly once, and only if a terminal was ever
+        // bound (before that, no TUI output has touched this terminal). Callers on
+        // the message paths invoke this BEFORE printing their exit message so the
+        // message lands on the primary screen, not the alternate screen the reset
+        // just left (where it would vanish).
+        const resetModes = () => {
+            if (modesReset || !bound)
+                return;
+            modesReset = true;
+            process.stdout.write(TTY_MODE_RESET);
+        };
+        const restore = () => {
+            resetModes();
+            try {
+                if (stdin.isTTY)
+                    stdin.setRawMode(wasRaw);
+            }
+            catch { }
+            stdin.pause();
+            stdin.removeListener("data", onInput);
+            process.stdout.removeListener("resize", onResize);
+        };
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            restore();
+            try {
+                socket.close();
+            }
+            catch { }
+            resolve(code);
+        };
+        const send = (payload) => {
+            if (socket.readyState === WebSocket.OPEN)
+                socket.send(JSON.stringify(payload));
+        };
+        const onInput = (data) => {
+            // Ctrl-\ (0x1c) twice in a row detaches, leaving the daemon session alive.
+            if (data.length === 1 && data[0] === 0x1c) {
+                const now = Date.now();
+                if (now - detachArmed < 1500) {
+                    resetModes();
+                    process.stdout.write(c.dim("\r\n[detached — session still running; `bivy resume` to return]\r\n"));
+                    finish(0);
+                    return;
+                }
+                detachArmed = now;
+                return;
+            }
+            const text = inputDecoder.write(data);
+            if (termId && text)
+                send({ kind: "terminal.input", termId, data: text });
+        };
+        const onResize = () => {
+            if (!termId)
+                return;
+            const { cols, rows } = termSize();
+            send({ kind: "terminal.resize", termId, cols, rows });
+        };
+        const beginTty = () => {
+            if (bound)
+                return;
+            bound = true;
+            if (stdin.isTTY)
+                stdin.setRawMode(true);
+            stdin.resume();
+            stdin.on("data", onInput);
+            process.stdout.on("resize", onResize);
+        };
+        socket.on("open", () => open(socket));
+        socket.on("error", (err) => {
+            process.stderr.write(c.red(`\r\nConnection error: ${err instanceof Error ? err.message : String(err)}\r\n`));
+            finish(1);
+        });
+        socket.on("close", () => finish(settled ? 0 : 1));
+        socket.on("message", (raw) => {
+            let msg;
+            try {
+                msg = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            const type = msg.type;
+            if (type === "terminal.opened" && !termId) {
+                termId = String(msg.termId);
+                beginTty();
+                onResize();
+            }
+            else if (type === "terminal.attached" && (!termId || msg.termId === termId)) {
+                termId = String(msg.termId);
+                if (typeof msg.data === "string")
+                    process.stdout.write(msg.data);
+                beginTty();
+                onResize();
+            }
+            else if (type === "terminal.gone" && msg.termId === termId) {
+                resetModes();
+                process.stderr.write(c.red(`\r\nTerminal ${termId} is no longer running.\r\n`));
+                finish(1);
+            }
+            else if (type === "terminal.output" && msg.termId === termId) {
+                if (typeof msg.data === "string")
+                    process.stdout.write(msg.data);
+            }
+            else if ((type === "terminal.exit" || type === "terminal.closed") && msg.termId === termId) {
+                const code = typeof msg.code === "number" ? msg.code : 0;
+                resetModes();
+                process.stdout.write(c.dim(`\r\n[session ended]\r\n`));
+                finish(code);
+            }
+            else if (type === "terminal.error") {
+                process.stderr.write(c.red(`\r\n${String(msg.error || "Terminal error")}\r\n`));
+                if (!bound)
+                    finish(1);
+            }
+        });
+    });
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    if (args.mode === "run") {
+        const spec = args.run;
+        const { cols, rows } = termSize();
+        process.stdout.write(c.dim(`Starting ${c.cyan(spec.name || spec.label || spec.agent || spec.command)} — Ctrl-\\ Ctrl-\\ to detach\r\n`));
+        const code = await bridge(args, (ws) => ws.send(JSON.stringify({ kind: "terminal.open.run", agent: spec.agent, label: spec.label, name: spec.name, model: spec.model, command: spec.command, args: spec.args ?? [], workspace: spec.workspace, sessionId: spec.sessionId, cols, rows })));
+        process.exit(code);
+    }
+    // attach
+    if (!args.termId) {
+        process.stderr.write(c.dim("Nothing to attach to. Start one with `bivy run <agent>`, or pick one with `bivy resume`.\n"));
+        process.exit(1);
+    }
+    await attachById(args, args.termId);
+}
+// Bind the local TTY to an existing run-terminal by id (replays scrollback).
+async function attachById(args, termId) {
+    const { cols, rows } = termSize();
+    process.stdout.write(c.dim(`Attaching to ${c.cyan(termId)} — Ctrl-\\ Ctrl-\\ to detach\r\n`));
+    const code = await bridge({ ...args, termId }, (ws) => ws.send(JSON.stringify({ kind: "terminal.attach", termId, cols, rows })));
+    process.exit(code);
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.stack : String(error)}\n`);
+    process.exit(1);
+});