@bivy/bivy 0.10.1-staging.185 → 0.10.1-staging.187

package/dist/{runtime/pi-auth.js → credentials/api.js}

@@ -1,22 +1,26 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
-// Model-provider auth surface for the daemon (the "Models & providers" screen).
+// The daemon credential API — Bivy's OWN model-provider auth surface (the
+// "Models & providers" screen). This is the one entry every mutation flows
+// through, so the CLI and PWA can't drift.
 //
-// Storage is Bivy's own (credential-store.ts): set / remove / export / import all
-// operate directly on the encrypted vault with no Pi involvement. The one thing
-// that legitimately comes from Pi is the model-provider *catalog* — the list of
-// providers and their display names / OAuth capability — which the isolated
-// pi-oauth bridge supplies (Bivy has no model catalog of its own).
-import { createCredentialVault } from "./credential-store.js";
-import { listPiProviders } from "./pi-oauth.js";
-import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "../credentials/records.js";
+// Deliberately Pi-FREE: every function here operates on Bivy's own encrypted
+// vault (credential-store.ts) with zero Pi involvement, so the service compiles
+// and tests without Pi. The one thing that legitimately comes from Pi — the
+// model-provider *catalog* (Bivy has none of its own) — is INJECTED:
+// `joinProviderCatalog` takes the catalog as a parameter, and the thin
+// `runtime/provider-catalog.ts` bridge supplies Pi's. See
+// docs/credentials-service-plan.md §3.1.
+import { createCredentialVault } from "../runtime/credential-store.js";
+import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "./records.js";
 /**
- * Enumerate model providers with their current auth status. The catalog + status
- * come from Pi's provider list (joined with our injected store); the stored
- * credential `kind` comes from Bivy's vault.
+ * Join a provider catalog with the vault's stored auth status → the "Models &
+ * providers" rows. Pure w.r.t. Pi: the catalog is passed in (see
+ * `runtime/provider-catalog.ts`, which supplies Pi's). The stored credential
+ * `kind`/`expiresAt` come from Bivy's own vault.
  */
-export async function listProviders(credsDir, piDir) {
-    const [catalog, stored] = await Promise.all([listPiProviders(credsDir, piDir), createCredentialVault(credsDir).list()]);
+export async function joinProviderCatalog(credsDir, catalog) {
+    const stored = await createCredentialVault(credsDir).list();
     const infoById = new Map(stored.map((info) => [info.providerId, info]));
     return catalog.map((provider) => ({
         id: provider.id,
@@ -28,10 +32,18 @@ export async function listProviders(credsDir, piDir) {
         expiresAt: infoById.get(provider.id)?.expiresAt,
     }));
 }
-/** Export configured model-provider credentials, keyed by provider id. */
+/** Export configured model-provider credentials, keyed by provider id (all local). */
 export async function exportProviderAuth(credsDir) {
     return createCredentialVault(credsDir).exportAll();
 }
+/**
+ * Export only the credentials eligible for cross-node sync (`sync: "account"`) —
+ * the snapshot pushed to peers. A credential the user opted to `sync: "node"`
+ * stays local. Use this for the sync push; use `exportProviderAuth` for local reads.
+ */
+export async function exportSyncableProviderAuth(credsDir) {
+    return createCredentialVault(credsDir).exportSyncable();
+}
 /** Export provider revocations for cross-node convergence. */
 export async function exportProviderAuthTombstones(credsDir) {
     return createCredentialVault(credsDir).exportTombstones();

package/dist/credentials/index.js

@@ -22,7 +22,7 @@ export { parsePresets, loadPresets, defaultPresetsPath, PRESETS_FILENAME, parseI
 export { createCredentialVault, migrateVaultDir, preferIncomingCredential, tombstoneWins, BivyCredentialStore, } from "../runtime/credential-store.js";
 // --- The node resolver + agent env representation ---------------------------
 export { createCredentialStore, buildAgentCredentialEnv, apiKeyEnvVar, NodeCredentialResolver, } from "../runtime/credentials.js";
-// --- The daemon credential API (ours — currently named pi-auth.ts) ----------
-// Phase 5 renames the file to `src/credentials/api.ts`; the facade keeps the
-// import path stable so call sites don't churn when it moves.
-export { listProviders, exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, } from "../runtime/pi-auth.js";
+// --- The daemon credential API (ours — Pi-free) -----------------------------
+export { exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, joinProviderCatalog, } from "./api.js";
+// --- The Pi-catalog bridge (the one Pi-coupled provider listing) ------------
+export { listProviders } from "../runtime/provider-catalog.js";

package/dist/runtime/credential-store.js

@@ -157,10 +157,21 @@ export class BivyCredentialStore {
      * credential; `fn` returning undefined leaves the entry unchanged.
      */
     async modify(provider, fn) {
+        return this.modifyRecord(provider, DEFAULT_LABEL, fn);
+    }
+    /**
+     * Record-addressed read-modify-write over a specific `provider:label` slot —
+     * `modify()` is the `label="default"` case. This is what makes OAuth refresh
+     * safe with multiple accounts per provider: a refresh rotates the *selected*
+     * record under its own lock, so refreshing `anthropic:work` can't clobber
+     * `anthropic:personal` (rotated refresh tokens are single-use). `fn` operates on
+     * the record's stored credential; the record's label/sync/origin are preserved.
+     */
+    async modifyRecord(provider, label, fn) {
         const id = providerId(provider);
         if (!id)
             throw new Error("Provider is required");
-        const key = defaultKey(id);
+        const key = credKey(id, label);
         return this.enqueue(id, async () => {
             await this.acquireLock();
             try {
@@ -174,11 +185,11 @@ export class BivyCredentialStore {
                     throw new Error(`Invalid credential for "${id}"`);
                 const now = Date.now();
                 // Store the credential clean; the store-owned stamp lives on the record.
-                // Preserve the record's sync/origin/label when it already exists.
+                // Preserve the record's label/sync/origin when it already exists.
                 const clean = withoutStoreMetadata(next);
                 const record = existing
                     ? { ...existing, source: { kind: "stored", cred: clean }, updatedAt: now }
-                    : { ...recordFromStored(id, clean), updatedAt: now };
+                    : { ...recordFromStored(id, clean), label: normalizeLabel(label), updatedAt: now };
                 document.credentials[key] = record;
                 delete document.deletedAt[key];
                 this.writeDocument(document);
@@ -267,9 +278,23 @@ export class BivyCredentialStore {
      * a peer's merge can order it. (Non-default labels are not yet synced — phase 6.)
      */
     async exportAll() {
+        return this.projectDefaults(() => true);
+    }
+    /**
+     * The cross-node sync snapshot: only `provider:default` credentials the user
+     * has left on the account-sync tier (`sync: "account"`). A credential opted to
+     * `sync: "node"` is kept local — this is the per-credential opt-out. Reference
+     * records carry no syncable secret and are skipped either way. (Local reads that
+     * must see every credential — e.g. `provider.auth.get` — use `exportAll`.)
+     */
+    async exportSyncable() {
+        return this.projectDefaults((record) => record.sync === "account");
+    }
+    /** Shared projection of default-slot stored credentials to the provider-keyed wire. */
+    projectDefaults(include) {
         const out = {};
         for (const record of Object.values(this.readDocument().credentials)) {
-            if (record.label !== DEFAULT_LABEL)
+            if (record.label !== DEFAULT_LABEL || !include(record))
                 continue;
             const cred = storedOf(record);
             if (!cred)

package/dist/runtime/credentials.js

@@ -75,7 +75,9 @@ export class NodeCredentialResolver {
         let token = typeof cred.access === "string" ? cred.access : "";
         const expires = Number(cred.expires) || 0;
         if (!token || expires <= Date.now() + OAUTH_REFRESH_SKEW_MS) {
-            const refreshed = await refreshModelOAuth(this.credsDir, id).catch(() => undefined);
+            // Refresh the SELECTED record (its label), not just the provider default —
+            // so a second account on the same provider is left untouched.
+            const refreshed = await refreshModelOAuth(this.credsDir, id, selection.record.label).catch(() => undefined);
             if (refreshed)
                 token = refreshed;
         }

package/dist/runtime/oauth/model-oauth.js

@@ -13,6 +13,7 @@ import http from "node:http";
 import { randomBytes } from "node:crypto";
 import { createPkce } from "../../integrations/oauth.js";
 import { createCredentialVault } from "../credential-store.js";
+import { DEFAULT_LABEL } from "../../credentials/records.js";
 import { getModelOAuthProvider } from "./model-oauth-providers.js";
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 // --- HTTP helpers ------------------------------------------------------------
@@ -342,11 +343,13 @@ async function refreshTokens(provider, current) {
  * token — the single-flight guarantee. Returns undefined if the provider has no
  * stored OAuth credential or isn't natively supported.
  */
-export async function refreshModelOAuth(credsDir, providerId) {
+export async function refreshModelOAuth(credsDir, providerId, label = DEFAULT_LABEL) {
     const provider = getModelOAuthProvider(providerId);
     if (!provider)
         return undefined;
-    const result = await createCredentialVault(credsDir).modify(providerId, async (current) => {
+    // Record-addressed: refresh the SELECTED account's record, so a second account
+    // on the same provider (a different label) is never touched by this rotation.
+    const result = await createCredentialVault(credsDir).modifyRecord(providerId, label, async (current) => {
         if (!current || current.type !== "oauth")
             return current;
         // Someone else already refreshed while we waited for the lock — use theirs.

package/dist/runtime/provider-catalog.js

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// The Pi-catalog bridge: the single place the credential API's provider listing
+// is joined with Pi's model-provider catalog.
+//
+// The credential API (src/credentials/api.ts) is deliberately Pi-free and takes
+// the catalog as data (`joinProviderCatalog`). This thin module is the injection
+// point — it fetches Pi's catalog and hands it in. Swapping Pi for a Bivy-owned
+// catalog later is a change here and nowhere else.
+import { listPiProviders } from "./pi-oauth.js";
+import { joinProviderCatalog } from "../credentials/api.js";
+/** Enumerate model providers with their current auth status (catalog from Pi). */
+export async function listProviders(credsDir, piDir) {
+    return joinProviderCatalog(credsDir, await listPiProviders(credsDir, piDir));
+}

package/dist/server.js

@@ -35,7 +35,8 @@ import { decideOAuthLoginSweep } from "./runtime/oauth/oauth-login-sweep.js";
 import { listCodexSessions, loadCodexTranscript } from "./runtime/codex-sessions.js";
 import { dedupeSessionSummaries } from "./session-identity.js";
 import { deriveSessionState } from "./session/session-state.js";
-import { exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, listProviders, removeProvider, setProviderApiKey, setProviderCredential } from "./runtime/pi-auth.js";
+import { exportProviderAuth, exportSyncableProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, setProviderCredential } from "./credentials/api.js";
+import { listProviders } from "./runtime/provider-catalog.js";
 import { loadLocalModels, upsertLocalProvider, removeLocalProviderEntry, listLocalProviderSummaries, exportLocalModels, importLocalModels, toPiModelsConfig, normalizeProviderId, } from "./runtime/local-model-store.js";
 import { execEphemeralRequest } from "./ephemeral-exec.js";
 import { ApprovalManager } from "./approval.js";
@@ -3364,7 +3365,9 @@ async function pushModelAuthToControlPlane(rotateKey = false) {
     // versa.
     await pushProviderSummaryToControlPlane();
     try {
-        const providers = await exportProviderAuth(credsDir);
+        // Only push credentials on the account-sync tier; a `sync: "node"` credential
+        // stays local (per-credential opt-out). Tombstones still converge for all.
+        const providers = await exportSyncableProviderAuth(credsDir);
         const deletedAt = await exportProviderAuthTombstones(credsDir);
         const localModels = exportLocalModels(localModelsDir);
         const previousKey = readLocalModelAuthVaultKey();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.185",
+  "version": "0.10.1-staging.187",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",