@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/auth.js

@@ -0,0 +1,258 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import os from "node:os";
+import { spawnSync } from "node:child_process";
+const NOLOGIN_SHELL = /\/(nologin|false|sync)$/;
+/** Count /etc/passwd entries that look like a real, loginable human account.
+ * System/service accounts (UID < 1000, or a nologin/false/sync shell) don't
+ * count — nearly every Linux box ships dozens of those even with a single
+ * human owner, so counting them would misclassify almost every ordinary
+ * machine as shared. */
+function countLinuxHumanAccounts(passwdText) {
+    let count = 0;
+    for (const line of passwdText.split("\n")) {
+        const fields = line.split(":");
+        if (fields.length < 7)
+            continue;
+        const uid = Number(fields[2]);
+        const shell = (fields[6] ?? "").trim();
+        if (!Number.isFinite(uid) || uid < 1000 || uid >= 65534)
+            continue;
+        if (!shell || NOLOGIN_SHELL.test(shell))
+            continue;
+        count++;
+    }
+    return count;
+}
+/** Count real macOS user accounts from `dscl . -list /Users UniqueID` output
+ * (one `<name> <uid>` pair per line). Apple's underscore-prefixed service
+ * accounts and root/daemon/nobody don't count; accounts created in System
+ * Settings get uid >= 500. */
+function countMacHumanAccounts(dsclOutput) {
+    let count = 0;
+    for (const line of dsclOutput.split("\n")) {
+        const match = /^(\S+)\s+(\d+)\s*$/.exec(line.trim());
+        if (!match)
+            continue;
+        const [, name, uidText] = match;
+        if (name.startsWith("_") || name === "root" || name === "nobody" || name === "daemon")
+            continue;
+        if (Number(uidText) >= 500)
+            count++;
+    }
+    return count;
+}
+function readDsclOutput() {
+    try {
+        const result = spawnSync("dscl", [".", "-list", "/Users", "UniqueID"], { encoding: "utf8", timeout: 2000 });
+        return result.status === 0 ? result.stdout : null;
+    }
+    catch {
+        return null;
+    }
+}
+function detectMultiUserHost(deps) {
+    const platform = deps.platform ?? os.platform();
+    try {
+        if (platform === "darwin") {
+            const out = deps.dsclOutput !== undefined ? deps.dsclOutput : readDsclOutput();
+            return out !== null && countMacHumanAccounts(out) > 1;
+        }
+        if (platform === "win32")
+            return false; // not detected today — loopback bypass still applies
+        const text = deps.passwdText ?? fs.readFileSync("/etc/passwd", "utf8");
+        return countLinuxHumanAccounts(text) > 1;
+    }
+    catch {
+        return false;
+    }
+}
+// The detection above touches the filesystem (or, on macOS, spawns a
+// subprocess) — cheap once, but `loopbackAllowed()` runs on every request, so
+// cache the real-environment result for the life of the process. Calls that
+// pass explicit `deps` (tests) always recompute.
+let cachedMultiUserHost = null;
+/**
+ * Best-effort detection of a shared, multi-user host: more than one human
+ * account can run processes here, so loopback alone is not isolation between
+ * them (see docs/security-model.md, "Local daemon exposure").
+ *
+ * Conservative by design: a false negative (a shared host we fail to detect)
+ * just keeps today's loopback-bypass behavior; a false positive would force
+ * token auth on an ordinary single-user laptop, which is worse. Override
+ * explicitly with `BIVY_MULTI_USER_HOST=1` / `=0` when detection is wrong for
+ * your box — `BIVY_REQUIRE_LOCAL_AUTH` (see `loopbackAllowed`) takes
+ * precedence over both.
+ */
+export function isMultiUserHost(deps = {}) {
+    const override = process.env.BIVY_MULTI_USER_HOST;
+    if (override === "1")
+        return true;
+    if (override === "0")
+        return false;
+    const hasOverrideDeps = Object.keys(deps).length > 0;
+    if (hasOverrideDeps)
+        return detectMultiUserHost(deps);
+    if (cachedMultiUserHost === null)
+        cachedMultiUserHost = detectMultiUserHost(deps);
+    return cachedMultiUserHost;
+}
+function loopbackAllowed() {
+    const override = process.env.BIVY_REQUIRE_LOCAL_AUTH;
+    if (override === "1")
+        return false;
+    if (override === "0")
+        return true;
+    return !isMultiUserHost();
+}
+export function isLoopbackAddress(address) {
+    if (!address)
+        return false;
+    const addr = address.replace(/^::ffff:/, "");
+    return addr === "127.0.0.1" || addr === "::1" || addr === "localhost";
+}
+export function extractToken(headerValue) {
+    if (!headerValue)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(headerValue.trim());
+    return match ? match[1].trim() : null;
+}
+/**
+ * Pull a token from an HTTP request: Authorization header first, then the
+ * `access_token` query param (used by WebSocket upgrades where headers are
+ * awkward to set from browsers).
+ */
+export function tokenFromRequest(req) {
+    const header = extractToken(req.headers["authorization"]);
+    if (header)
+        return header;
+    try {
+        const url = new URL(req.url ?? "", "http://localhost");
+        return url.searchParams.get("access_token");
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve auth for any incoming request (HTTP or WS upgrade). `loopback` is
+ * the raw physical fact (independent of `loopbackAllowed()`'s policy), so
+ * loopback-gated-by-secret endpoints (`/api/git-credential`,
+ * `/api/auth/bootstrap`) can rely on it even when the general bypass in
+ * `isAuthorized` is off. */
+export function resolveAuth(identity, req) {
+    const loopback = isLoopbackAddress(req.socket?.remoteAddress);
+    const deviceId = identity.verifyToken(tokenFromRequest(req));
+    return { deviceId, loopback };
+}
+export function isAuthorized(ctx) {
+    return ctx.deviceId !== null || (ctx.loopback && loopbackAllowed());
+}
+/**
+ * Cross-origin / DNS-rebinding guard for the node's actionable surface (/api,
+ * /ws). The daemon runs shell and edits files, and by default it authorizes any
+ * loopback caller without a token — so without this guard, (a) any web page the
+ * user visits could open a cross-origin WebSocket to ws://localhost:4317/ws and
+ * drive the agent, and (b) DNS rebinding (attacker domain → 127.0.0.1) would
+ * defeat the browser's same-origin protections entirely.
+ *
+ * Direct inbound connections to the node are only ever local/LAN: a direct-mode
+ * web client (?local=1), a LAN device browsing the node directly, or CLI/native
+ * clients (no Origin).
+ * Remote phones reach the node through the relay, which the node dials
+ * *outbound* — those never arrive here as inbound upgrades. So we allow only
+ * local/private hostnames and reject a public Host (rebinding) or public Origin
+ * (cross-site). Escape hatches: BIVY_ALLOWED_HOSTS (comma-separated extra
+ * hostnames, e.g. a reverse-proxy domain) and BIVY_ALLOW_ANY_ORIGIN=1.
+ */
+function hostnameIsLocal(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/^::ffff:/, "");
+    if (h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "0.0.0.0")
+        return true;
+    if (h.endsWith(".localhost") || h.endsWith(".local") || h.endsWith(".ts.net") || h.endsWith(".internal"))
+        return true;
+    const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+    if (v4) {
+        const a = Number(v4[1]);
+        const b = Number(v4[2]);
+        if (a === 10)
+            return true; // 10.0.0.0/8 private
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16 private
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12 private
+        if (a === 169 && b === 254)
+            return true; // 169.254.0.0/16 link-local
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // 100.64.0.0/10 CGNAT (Tailscale)
+        return false;
+    }
+    if (/^f[cd][0-9a-f]{2}:/.test(h))
+        return true; // fc00::/7 unique-local IPv6
+    if (/^fe[89ab][0-9a-f]:/.test(h))
+        return true; // fe80::/10 link-local IPv6
+    return false;
+}
+/** Extract the hostname from a `Host`/`Origin`-style `host[:port]` value. */
+function hostnameOf(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    if (trimmed.startsWith("["))
+        return trimmed.slice(0, trimmed.indexOf("]") + 1); // [::1]:4317 → [::1]
+    const colon = trimmed.lastIndexOf(":");
+    return colon > 0 && /^\d+$/.test(trimmed.slice(colon + 1)) ? trimmed.slice(0, colon) : trimmed;
+}
+function allowedExtraHosts() {
+    return new Set((process.env.BIVY_ALLOWED_HOSTS ?? "")
+        .split(",")
+        .map((h) => h.trim().toLowerCase())
+        .filter(Boolean));
+}
+/**
+ * True when a request may touch the actionable surface. Rejects a public Host
+ * header (DNS rebinding) or a public browser Origin (cross-site). Requests with
+ * no Origin (CLI/native/curl) are allowed through the Host check only.
+ */
+export function requestOriginAllowed(req) {
+    if (process.env.BIVY_ALLOW_ANY_ORIGIN === "1")
+        return true;
+    const extra = allowedExtraHosts();
+    const ok = (hostname) => !!hostname && (hostnameIsLocal(hostname) || extra.has(hostname.toLowerCase()));
+    const hostHeader = req.headers["host"];
+    if (typeof hostHeader === "string") {
+        const host = hostnameOf(hostHeader);
+        if (host && !ok(host))
+            return false;
+    }
+    const originHeader = req.headers["origin"];
+    const origin = Array.isArray(originHeader) ? originHeader[0] : originHeader;
+    if (origin && origin !== "null") {
+        let originHost = null;
+        try {
+            originHost = new URL(origin).hostname;
+        }
+        catch {
+            return false;
+        }
+        if (!ok(originHost))
+            return false;
+    }
+    return true;
+}
+/** Express middleware enforcing auth on /api routes. */
+export function authMiddleware(identity) {
+    return (req, res, next) => {
+        if (!requestOriginAllowed(req)) {
+            res.status(403).json({ error: "Forbidden origin" });
+            return;
+        }
+        const ctx = resolveAuth(identity, req);
+        if (!isAuthorized(ctx)) {
+            res.status(401).json({ error: "Unauthorized" });
+            return;
+        }
+        req.auth = ctx;
+        next();
+    };
+}

package/dist/bivy-login.js

@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import path from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { fileURLToPath } from "node:url";
+import { createCredentialVault } from "./runtime/credential-store.js";
+import { listPiProviders } from "./runtime/pi-oauth.js";
+import { loginModelOAuth } from "./runtime/oauth/model-oauth.js";
+import { openBrowser } from "./browser-open.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, "..");
+const dataDir = process.env.BIVY_DATA_DIR ?? path.join(repoRoot, ".bivy");
+const piDir = path.join(dataDir, "pi");
+// The shared, agent-neutral credential vault (not inside any agent's dir).
+const credsDir = path.join(dataDir, "credentials");
+const BEDROCK_PROVIDER_ID = "amazon-bedrock";
+async function makeProviders() {
+    const catalog = await listPiProviders(credsDir, piDir);
+    return catalog
+        .map((provider) => ({ id: provider.id, name: provider.name, authType: provider.oauth ? "oauth" : "api_key" }))
+        .sort((a, b) => `${a.name} ${a.authType}`.localeCompare(`${b.name} ${b.authType}`));
+}
+async function askLine(question) {
+    const rl = createInterface({ input, output });
+    try {
+        return await rl.question(question);
+    }
+    finally {
+        rl.close();
+    }
+}
+async function askHidden(question) {
+    if (!input.isTTY)
+        return askLine(question);
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const onData = (chunk) => {
+            const text = chunk.toString("utf8");
+            for (const char of text) {
+                if (char === "") {
+                    cleanup();
+                    output.write("\n");
+                    reject(new Error("Cancelled"));
+                    return;
+                }
+                if (char === "\r" || char === "\n") {
+                    cleanup();
+                    output.write("\n");
+                    resolve(value);
+                    return;
+                }
+                if (char === "\u007f" || char === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += char;
+            }
+        };
+        const cleanup = () => {
+            input.off("data", onData);
+            input.setRawMode(false);
+            input.pause();
+        };
+        output.write(question);
+        input.setRawMode(true);
+        input.resume();
+        input.on("data", onData);
+    });
+}
+async function choose(title, options) {
+    if (options.length === 1)
+        return options[0];
+    console.log(`\n${title}`);
+    options.forEach((option, index) => console.log(`  ${index + 1}. ${option.name} (${option.id})`));
+    while (true) {
+        const answer = (await askLine("Select: ")).trim();
+        const index = Number(answer) - 1;
+        if (Number.isInteger(index) && options[index])
+            return options[index];
+        const match = options.find((option) => option.id === answer || option.name.toLowerCase() === answer.toLowerCase());
+        if (match)
+            return match;
+        console.log("Enter a number or provider id.");
+    }
+}
+async function loginApiKey(provider) {
+    if (provider.id === BEDROCK_PROVIDER_ID) {
+        console.log("Amazon Bedrock uses AWS credentials instead of a single API key.");
+        console.log("Configure AWS_PROFILE, IAM keys, a Bedrock bearer token, or role-based credentials.");
+        return;
+    }
+    const apiKey = (await askHidden(`Enter API key for ${provider.name}: `)).trim();
+    if (!apiKey)
+        throw new Error("API key cannot be empty.");
+    await createCredentialVault(credsDir).setApiKey(provider.id, apiKey);
+    console.log(`Saved API key for ${provider.name} to Bivy's credential vault.`);
+}
+/** Bridge Pi's AuthInteraction to the terminal (prompt/notify). */
+function terminalInteraction(provider, signal) {
+    return {
+        signal,
+        notify(event) {
+            switch (event.type) {
+                case "auth_url":
+                    console.log(`\nOpen this URL to login to ${provider.name}:\n${event.url}\n`);
+                    if (event.instructions)
+                        console.log(`${event.instructions}\n`);
+                    openBrowser(event.url);
+                    break;
+                case "device_code":
+                    console.log(`\nOpen: ${event.verificationUri}`);
+                    console.log(`Enter code: ${event.userCode}`);
+                    console.log("Waiting for authentication…\n");
+                    break;
+                case "info":
+                    console.log(event.message);
+                    for (const link of event.links ?? [])
+                        console.log(link.label ? `${link.label}: ${link.url}` : link.url);
+                    break;
+                case "progress":
+                    console.log(event.message);
+                    break;
+            }
+        },
+        async prompt(prompt) {
+            switch (prompt.type) {
+                case "secret":
+                    return (await askHidden(`${prompt.message} `)).trim();
+                case "select": {
+                    const selected = await choose(prompt.message, prompt.options.map((option) => ({ id: option.id, name: option.label })));
+                    return selected.id;
+                }
+                case "text":
+                case "manual_code":
+                default:
+                    return (await askLine(`${prompt.message} `)).trim();
+            }
+        },
+    };
+}
+async function loginOAuth(provider) {
+    const abort = new AbortController();
+    const onSigint = () => abort.abort();
+    process.once("SIGINT", onSigint);
+    try {
+        await loginModelOAuth(credsDir, provider.id, terminalInteraction(provider, abort.signal));
+        console.log(`Logged in to ${provider.name}. Credentials saved to Bivy's vault.`);
+    }
+    finally {
+        process.off("SIGINT", onSigint);
+    }
+}
+async function main() {
+    const requestedProvider = process.argv.slice(2).find((arg) => !arg.startsWith("-"));
+    const providers = await makeProviders();
+    if (providers.length === 0)
+        throw new Error("No login providers are available.");
+    let provider;
+    if (requestedProvider) {
+        provider = providers.find((candidate) => candidate.id === requestedProvider || candidate.name.toLowerCase() === requestedProvider.toLowerCase());
+        if (!provider)
+            throw new Error(`Unknown provider: ${requestedProvider}`);
+    }
+    else {
+        const authType = await choose("Authentication method", [
+            { id: "oauth", name: "Use a subscription" },
+            { id: "api_key", name: "Use an API key" },
+        ]);
+        provider = await choose("Provider", providers.filter((candidate) => candidate.authType === authType.id));
+    }
+    if (provider.authType === "oauth")
+        await loginOAuth(provider);
+    else
+        await loginApiKey(provider);
+}
+main().catch((error) => {
+    console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+});

package/dist/browser-open.js

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { spawn, spawnSync } from "node:child_process";
+/**
+ * Best-effort guess at whether this machine can actually open a browser.
+ * macOS and Windows always can; a Linux box needs a display server *and* an
+ * opener (`xdg-open`) — a headless server (the common case for a Bivy node)
+ * has neither, so callers should print instructions/URLs instead of silently
+ * spawning an opener that can't do anything.
+ *
+ * Mirrors the equivalent check in bin/bivy.mjs (kept separate since the CLI
+ * entrypoint doesn't import from src/).
+ */
+export function canOpenBrowser(env = process.env) {
+    if (process.platform === "darwin" || process.platform === "win32")
+        return true;
+    const hasDisplay = Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+    if (!hasDisplay)
+        return false;
+    const check = spawnSync("sh", ["-lc", 'command -v -- xdg-open >/dev/null 2>&1'], { env });
+    return check.status === 0;
+}
+/**
+ * Best-effort open a URL in the local browser. Returns false (and never
+ * spawns anything) when canOpenBrowser() is false, so a headless server never
+ * wastes a process trying to open a browser that isn't there — callers should
+ * print the URL regardless of the return value so the user can open it
+ * themselves (on this machine or any other device).
+ */
+export function openBrowser(target) {
+    if (!canOpenBrowser())
+        return false;
+    const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", target] : [target];
+    try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        // spawn reports a missing opener asynchronously via an 'error' event, not a
+        // synchronous throw — without a listener that becomes an unhandled error
+        // that crashes the process (see the crash this guarded against previously:
+        // canOpenBrowser() already filters out the common "no opener" case, but a
+        // race — the opener disappearing between the check and the spawn — is
+        // still possible). The URL is also printed by the caller either way.
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}