@bivy/bivy 0.10.1-staging.199 → 0.10.1-staging.201

package/dist/protocol/command-spec.js

@@ -0,0 +1,16 @@
+import { Check, Errors } from "typebox/value";
+/**
+ * Validate a raw message against a schema. No schema → pass through unchecked
+ * (migration-friendly). On failure, returns bounded, path-qualified messages
+ * suitable for a `*.error` reply — never throws.
+ */
+export function validateInput(schema, msg) {
+    if (!schema)
+        return { ok: true, value: msg };
+    if (Check(schema, msg))
+        return { ok: true, value: msg };
+    // typebox v1's validation-error type doesn't surface `path` on its public
+    // type, so read it via a narrow cast — matching src/policy/ruleset.ts.
+    const errors = [...Errors(schema, msg)].slice(0, 20).map((e) => `${e.path || "/"}: ${e.message}`);
+    return { ok: false, errors: errors.length ? errors : ["invalid input"] };
+}

package/dist/protocol/version.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Command/event protocol versioning (platform modularization Phase 2 — the
+// "formalize the contract" slice; see docs/internal/platform-modularization-plan.md).
+//
+// The command/event surface is becoming the public API behind every client
+// (CLI, PWA, TUI, SDK), so peers must be able to evolve without silently
+// breaking one another. This module owns the version scalar and the
+// compatibility policy; it is a pure leaf (no imports) so any transport can use
+// it and it is trivially testable.
+/** The wire protocol version this node speaks. Bump when the command/event
+ *  surface changes in a way clients must be able to detect. */
+export const PROTOCOL_VERSION = 1;
+/** Peers that predate version negotiation present as v0 (today's surface). */
+export const LEGACY_PROTOCOL_VERSION = 0;
+/**
+ * Compatibility policy: **serve a compatible subset** (decided 2026-08-11).
+ *
+ * A newer node does not reject an older client; it serves exactly the
+ * operations introduced at or before the client's negotiated version, and
+ * withholds newer ones. Legacy (unversioned) clients negotiate to v0 and are
+ * served every op with `since <= 0` — i.e. today's surface, unchanged.
+ */
+export function isServedTo(op, clientVersion) {
+    return op.since <= clientVersion;
+}
+/**
+ * Meet the client where it is. The node speaks up to `PROTOCOL_VERSION`, so the
+ * negotiated version is the client's request clamped to [LEGACY, PROTOCOL].
+ * A missing/invalid/negative request negotiates to legacy (v0) rather than
+ * failing — consistent with the compatible-subset policy.
+ */
+export function negotiateVersion(clientVersion) {
+    if (typeof clientVersion !== "number" || !Number.isFinite(clientVersion)) {
+        return LEGACY_PROTOCOL_VERSION;
+    }
+    const requested = Math.trunc(clientVersion);
+    if (requested <= LEGACY_PROTOCOL_VERSION)
+        return LEGACY_PROTOCOL_VERSION;
+    return Math.min(requested, PROTOCOL_VERSION);
+}
+/** Filter a set of versioned operations to the subset a client is served. */
+export function compatibleSubset(ops, clientVersion) {
+    const out = new Map();
+    for (const [kind, op] of ops) {
+        if (isServedTo(op, clientVersion))
+            out.set(kind, op);
+    }
+    return out;
+}

package/dist/server.js

@@ -17,6 +17,8 @@ import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
 import { createWorkspaceController } from "./controllers/workspaces.js";
 import { createModelController } from "./controllers/models.js";
+import { Type } from "typebox";
+import { validateInput } from "./protocol/command-spec.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
 import { aggregateModelCatalog, mergeProviderCatalog } from "./runtime/model-catalog.js";
 import { RuntimeHost, enforcementLevelFor, remoteRuntimeEnabled } from "./runtime/host.js";
@@ -1687,8 +1689,16 @@ const dedupeSessionNew = (requestId, create) => sessionNewDedupe.run(requestId,
 const promptDedupe = createSessionNewDedupe();
 const dedupePrompt = (clientMessageId, run) => promptDedupe.run(clientMessageId, run);
 const RELAY_COMMANDS = {
-    ping(msg, ctx) {
-        ctx.reply({ type: "pong", requestId: typeof msg.requestId === "string" ? msg.requestId : undefined });
+    // First command to adopt boundary validation (the spec form). `requestId` is
+    // the only declared field; typebox permits additional properties by default,
+    // so real pings always pass — this exercises the schema path end-to-end
+    // without changing behavior. Other commands adopt schemas one at a time.
+    ping: {
+        since: 0,
+        schema: Type.Object({ requestId: Type.Optional(Type.String()) }),
+        handler(msg, ctx) {
+            ctx.reply({ type: "pong", requestId: typeof msg.requestId === "string" ? msg.requestId : undefined });
+        },
     },
     // Kick off `bivy update` on this node from the app's version-mismatch banner
     // (see runBivyUpdate). The node restarts itself when the update lands, so the
@@ -2930,9 +2940,22 @@ const relayCtx = { reply: (event) => relay?.sendEvent(event), broadcast };
 const RELAY_CLIENT_ID = "relay";
 async function handleRelayMessage(msg) {
     try {
-        const command = RELAY_COMMANDS[msg.kind];
-        if (command) {
-            await command(msg, relayCtx);
+        const entry = RELAY_COMMANDS[msg.kind];
+        if (entry) {
+            const handler = typeof entry === "function" ? entry : entry.handler;
+            const schema = typeof entry === "function" ? undefined : entry.schema;
+            if (schema) {
+                const check = validateInput(schema, msg);
+                if (!check.ok) {
+                    relayCtx.reply({
+                        type: `${msg.kind}.error`,
+                        requestId: typeof msg.requestId === "string" ? msg.requestId : undefined,
+                        error: `Invalid ${msg.kind}: ${check.errors.join("; ")}`,
+                    });
+                    return;
+                }
+            }
+            await handler(msg, relayCtx);
             return;
         }
         // Fallthrough for kinds not in RELAY_COMMANDS: terminal.* frames go to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.199",
+  "version": "0.10.1-staging.201",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",