@bivy/bivy 0.10.1-staging.183 → 0.10.1-staging.185

package/dist/credentials/index.js

@@ -16,8 +16,8 @@
 export { DEFAULT_LABEL, normalizeProvider, normalizeLabel, credKey, parseCredKey, agentNativeLabel, defaultSyncFor, inferReferenceBackend, resolveCredential, missingPresetLabels, } from "./records.js";
 // --- The v3 document engine: schema, migration, merge (new, pure) -----------
 export { emptyDocument, recordFromStored, preferIncomingRecord, tombstoneWinsRecord, migrateToV3, mergeDocuments, } from "./document.js";
-// --- Selection presets (config-as-code) -------------------------------------
-export { parsePresets, loadPresets, defaultPresetsPath, PRESETS_FILENAME } from "./presets.js";
+// --- Selection presets + ingest policy (config-as-code) ---------------------
+export { parsePresets, loadPresets, defaultPresetsPath, PRESETS_FILENAME, parseIngestPolicy, loadIngestPolicy, } from "./presets.js";
 // --- The vault (source of truth) — re-exported from its current home --------
 export { createCredentialVault, migrateVaultDir, preferIncomingCredential, tombstoneWins, BivyCredentialStore, } from "../runtime/credential-store.js";
 // --- The node resolver + agent env representation ---------------------------
@@ -25,4 +25,4 @@ export { createCredentialStore, buildAgentCredentialEnv, apiKeyEnvVar, NodeCrede
 // --- The daemon credential API (ours — currently named pi-auth.ts) ----------
 // Phase 5 renames the file to `src/credentials/api.ts`; the facade keeps the
 // import path stable so call sites don't churn when it moves.
-export { listProviders, exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, } from "../runtime/pi-auth.js";
+export { listProviders, exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, } from "../runtime/pi-auth.js";

package/dist/credentials/presets.js

@@ -73,3 +73,23 @@ export function loadPresets(filePath) {
         return {};
     }
 }
+/** Read `ingest.policy` from a parsed config; anything unrecognized → `merge`. */
+export function parseIngestPolicy(raw) {
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        const ingest = raw.ingest;
+        if (ingest && typeof ingest === "object" && !Array.isArray(ingest)) {
+            if (ingest.policy === "separate")
+                return "separate";
+        }
+    }
+    return "merge";
+}
+/** Load the ingest policy from the config file; missing/malformed → `merge`. */
+export function loadIngestPolicy(filePath) {
+    try {
+        return parseIngestPolicy(JSON.parse(fs.readFileSync(filePath, "utf8")));
+    }
+    catch {
+        return "merge";
+    }
+}

package/dist/runtime/credential-ingest.js

@@ -13,6 +13,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createCredentialVault } from "./credential-store.js";
+import { agentNativeLabel } from "../credentials/records.js";
+import { loadIngestPolicy, defaultPresetsPath } from "../credentials/presets.js";
 import { resolveCodexHome } from "./codex-auth.js";
 import { grokAuthEntryKey, resolveGrokHome, GROK_OIDC_ISSUER } from "./grok-auth.js";
 import { claudeCredentialFiles } from "./anthropic-preflight.js";
@@ -30,6 +32,32 @@ function jwtExpiryMs(token) {
         return undefined;
     }
 }
+/**
+ * Fold one mapped agent-native login into the vault per the node's ingest policy
+ * (`credentials.config.json` → `ingest.policy`; default `merge`):
+ *  - `merge`: merge into the provider's `default` slot (historical behavior) — a
+ *    native login updates the provider's synced Bivy credential, rotation-safe.
+ *  - `separate`: land as a distinct, node-local credential under a reserved
+ *    agent-derived label (with the account id when the login carries one), so it
+ *    never overwrites a Bivy key and is selectable via a preset.
+ */
+async function foldIngested(credsDir, agent, mapped) {
+    const store = createCredentialVault(credsDir);
+    const policy = loadIngestPolicy(defaultPresetsPath(credsDir));
+    if (policy !== "separate") {
+        return store.importAll({ [mapped.providerId]: mapped.credential });
+    }
+    const rawAccount = mapped.credential.accountId;
+    const accountId = typeof rawAccount === "string" ? rawAccount : undefined;
+    const record = {
+        provider: mapped.providerId,
+        label: agentNativeLabel(agent, accountId),
+        source: { kind: "stored", cred: mapped.credential },
+        origin: "agent-native",
+        sync: "node",
+    };
+    return store.importRecords([record]);
+}
 /** Map Codex's `~/.codex/auth.json` into a Bivy credential (provider id → credential). */
 export function codexAuthToCredential(raw) {
     if (!raw || typeof raw !== "object")
@@ -64,7 +92,7 @@ export async function ingestCodexCredentials(credsDir) {
     const mapped = codexAuthToCredential(raw);
     if (!mapped)
         return 0;
-    return createCredentialVault(credsDir).importAll({ [mapped.providerId]: mapped.credential });
+    return foldIngested(credsDir, "codex", mapped);
 }
 /** Map the Claude CLI's `.credentials.json` (`claudeAiOauth`) into a Bivy credential. */
 export function claudeAuthToCredential(raw) {
@@ -91,7 +119,7 @@ export async function ingestClaudeCredentials(credsDir) {
         }
         const mapped = claudeAuthToCredential(raw);
         if (mapped)
-            return createCredentialVault(credsDir).importAll({ [mapped.providerId]: mapped.credential });
+            return foldIngested(credsDir, "claude", mapped);
     }
     return 0;
 }
@@ -139,7 +167,7 @@ export async function ingestGrokCredentials(credsDir) {
     const mapped = grokAuthToCredential(raw);
     if (!mapped)
         return 0;
-    return createCredentialVault(credsDir).importAll({ [mapped.providerId]: mapped.credential });
+    return foldIngested(credsDir, "grok", mapped);
 }
 /**
  * Ingest an agent's native credential store into Bivy's vault. Called when a

package/dist/runtime/credential-store.js

@@ -299,6 +299,84 @@ export class BivyCredentialStore {
     async listRecords() {
         return Object.values(this.readDocument().credentials);
     }
+    /** Read one credential record by its `provider:label` identity. */
+    async readRecord(provider, label = DEFAULT_LABEL) {
+        const id = providerId(provider);
+        if (!id)
+            return undefined;
+        return this.readDocument().credentials[credKey(id, label)];
+    }
+    /**
+     * Authoritatively upsert a record at its `provider:label` — the record-addressed
+     * write behind the multi-credential API (add/label a specific account). Stamps
+     * the store-owned `updatedAt` and clears any tombstone for that slot. Use
+     * `importRecords()` (merge) for ingest/sync, where a fresher local login must win.
+     */
+    async putRecord(record) {
+        const id = providerId(record.provider);
+        if (!id)
+            throw new Error("Provider is required");
+        const label = normalizeLabel(record.label);
+        const key = credKey(id, label);
+        await this.enqueue(id, async () => {
+            await this.acquireLock();
+            try {
+                const document = this.readDocument();
+                document.credentials[key] = { ...record, provider: id, label, updatedAt: Date.now() };
+                delete document.deletedAt[key];
+                this.writeDocument(document);
+            }
+            finally {
+                await this.releaseLock();
+            }
+        });
+    }
+    /** Forget one record by `provider:label`, leaving a tombstone for convergence. */
+    async deleteRecord(provider, label = DEFAULT_LABEL) {
+        const id = providerId(provider);
+        if (!id)
+            return;
+        const key = credKey(id, label);
+        await this.enqueue(id, async () => {
+            await this.acquireLock();
+            try {
+                const document = this.readDocument();
+                const had = key in document.credentials;
+                delete document.credentials[key];
+                const deletedAt = Date.now();
+                if (!had && (document.deletedAt[key] ?? 0) >= deletedAt)
+                    return;
+                document.deletedAt[key] = deletedAt;
+                this.writeDocument(document);
+            }
+            finally {
+                await this.releaseLock();
+            }
+        });
+    }
+    /**
+     * Merge record snapshots into the vault, record-addressed and non-destructive
+     * (freshest-OAuth-wins, rotation-safe, tombstone-newer-wins — see document.ts).
+     * This is the record-level counterpart to `importAll`, for agent-native ingest
+     * under reserved labels and (later) record-shaped cross-node sync. Returns the
+     * number of newly-added records.
+     */
+    async importRecords(records, deletedAt = {}) {
+        await this.acquireLock();
+        try {
+            const document = this.readDocument();
+            const incoming = {};
+            for (const record of records)
+                incoming[credKey(record.provider, record.label)] = record;
+            const result = mergeDocuments(document, incoming, deletedAt);
+            if (result.changed)
+                this.writeDocument(result.document);
+            return result.imported;
+        }
+        finally {
+            await this.releaseLock();
+        }
+    }
     /** The plaintext `auth.json` path an agent's own CLI/TUI reads (`<plaintextDir>/auth.json`). */
     get legacyAuthPath() {
         return this.legacyFile;

package/dist/runtime/pi-auth.js

@@ -9,7 +9,7 @@
 // pi-oauth bridge supplies (Bivy has no model catalog of its own).
 import { createCredentialVault } from "./credential-store.js";
 import { listPiProviders } from "./pi-oauth.js";
-import { inferReferenceBackend } from "../credentials/records.js";
+import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "../credentials/records.js";
 /**
  * Enumerate model providers with their current auth status. The catalog + status
  * come from Pi's provider list (joined with our injected store); the stored
@@ -104,3 +104,67 @@ export async function removeProvider(credsDir, provider) {
         throw new Error("Provider is required");
     await createCredentialVault(credsDir).delete(id);
 }
+/** Every stored credential as a non-secret summary (never exposes key material). */
+export async function listCredentialRecords(credsDir) {
+    const records = await createCredentialVault(credsDir).listRecords();
+    return records.map((record) => {
+        const source = record.source;
+        if (source.kind === "reference") {
+            return { provider: record.provider, label: record.label, kind: "reference", sync: record.sync, origin: record.origin, ref: source.ref };
+        }
+        const cred = source.cred;
+        const summary = { provider: record.provider, label: record.label, kind: cred.type, sync: record.sync, origin: record.origin };
+        if (cred.type === "oauth")
+            summary.expiresAt = cred.expires;
+        return summary;
+    });
+}
+/**
+ * Preserve an existing record's sync/origin when re-setting it (editing the key of
+ * a credential the user opted node-local must not silently re-enable sync), else
+ * default to a Bivy-first, opt-out-sync credential.
+ */
+async function labeledMeta(credsDir, provider, label) {
+    const existing = await createCredentialVault(credsDir).readRecord(provider, label);
+    return { sync: existing?.sync ?? defaultSyncFor("bivy"), origin: existing?.origin ?? "bivy" };
+}
+/** Store an API key under a specific label (multi-account). */
+export async function setProviderApiKeyLabeled(credsDir, provider, label, key) {
+    const id = provider.trim().toLowerCase();
+    if (!id)
+        throw new Error("Provider is required");
+    const apiKey = String(key ?? "").trim();
+    if (!apiKey)
+        throw new Error("API key cannot be empty");
+    const meta = await labeledMeta(credsDir, id, label);
+    await createCredentialVault(credsDir).putRecord({
+        provider: id,
+        label: normalizeLabel(label),
+        source: { kind: "stored", cred: { type: "api_key", key: apiKey } },
+        ...meta,
+    });
+}
+/** Store a reference (op:// / env://) under a specific label (multi-account). */
+export async function setProviderReferenceLabeled(credsDir, provider, label, ref) {
+    const id = provider.trim().toLowerCase();
+    if (!id)
+        throw new Error("Provider is required");
+    const pointer = String(ref ?? "").trim();
+    const backend = inferReferenceBackend(pointer);
+    if (!backend)
+        throw new Error("Reference must be an op:// or env:// pointer");
+    const meta = await labeledMeta(credsDir, id, label);
+    await createCredentialVault(credsDir).putRecord({
+        provider: id,
+        label: normalizeLabel(label),
+        source: { kind: "reference", ref: pointer, backend },
+        ...meta,
+    });
+}
+/** Forget a single labeled credential (`provider:label`). */
+export async function removeProviderCredential(credsDir, provider, label = DEFAULT_LABEL) {
+    const id = provider.trim().toLowerCase();
+    if (!id)
+        throw new Error("Provider is required");
+    await createCredentialVault(credsDir).deleteRecord(id, label);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.183",
+  "version": "0.10.1-staging.185",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",