@bivy/bivy 0.10.1-staging.200 → 0.10.1-staging.201

package/dist/server.js

@@ -17,6 +17,8 @@ import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
 import { createWorkspaceController } from "./controllers/workspaces.js";
 import { createModelController } from "./controllers/models.js";
+import { Type } from "typebox";
+import { validateInput } from "./protocol/command-spec.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
 import { aggregateModelCatalog, mergeProviderCatalog } from "./runtime/model-catalog.js";
 import { RuntimeHost, enforcementLevelFor, remoteRuntimeEnabled } from "./runtime/host.js";
@@ -1687,8 +1689,16 @@ const dedupeSessionNew = (requestId, create) => sessionNewDedupe.run(requestId,
 const promptDedupe = createSessionNewDedupe();
 const dedupePrompt = (clientMessageId, run) => promptDedupe.run(clientMessageId, run);
 const RELAY_COMMANDS = {
-    ping(msg, ctx) {
-        ctx.reply({ type: "pong", requestId: typeof msg.requestId === "string" ? msg.requestId : undefined });
+    // First command to adopt boundary validation (the spec form). `requestId` is
+    // the only declared field; typebox permits additional properties by default,
+    // so real pings always pass — this exercises the schema path end-to-end
+    // without changing behavior. Other commands adopt schemas one at a time.
+    ping: {
+        since: 0,
+        schema: Type.Object({ requestId: Type.Optional(Type.String()) }),
+        handler(msg, ctx) {
+            ctx.reply({ type: "pong", requestId: typeof msg.requestId === "string" ? msg.requestId : undefined });
+        },
     },
     // Kick off `bivy update` on this node from the app's version-mismatch banner
     // (see runBivyUpdate). The node restarts itself when the update lands, so the
@@ -2930,9 +2940,22 @@ const relayCtx = { reply: (event) => relay?.sendEvent(event), broadcast };
 const RELAY_CLIENT_ID = "relay";
 async function handleRelayMessage(msg) {
     try {
-        const command = RELAY_COMMANDS[msg.kind];
-        if (command) {
-            await command(msg, relayCtx);
+        const entry = RELAY_COMMANDS[msg.kind];
+        if (entry) {
+            const handler = typeof entry === "function" ? entry : entry.handler;
+            const schema = typeof entry === "function" ? undefined : entry.schema;
+            if (schema) {
+                const check = validateInput(schema, msg);
+                if (!check.ok) {
+                    relayCtx.reply({
+                        type: `${msg.kind}.error`,
+                        requestId: typeof msg.requestId === "string" ? msg.requestId : undefined,
+                        error: `Invalid ${msg.kind}: ${check.errors.join("; ")}`,
+                    });
+                    return;
+                }
+            }
+            await handler(msg, relayCtx);
             return;
         }
         // Fallthrough for kinds not in RELAY_COMMANDS: terminal.* frames go to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.200",
+  "version": "0.10.1-staging.201",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",