@bivy/bivy 0.10.1-staging.209 → 0.10.1-staging.211

package/bin/bivy.mjs

@@ -1681,7 +1681,7 @@ function cmdCompletions(args = []) {
   const commands = [
     "run", "sessions", "ls", "resume", "promote", "rename", "nodes", "agent", "agents", "agents:install", "shim", "takeover", "token", "exec",
     "send", "attach", "kill", "setup", "start", "stop", "restart", "status", "doctor", "diagnostics", "logs", "login",
-    "update", "update:log", "automation", "config", "plugin", "open", "service", "secrets", "voice", "link", "relay:setup",
+    "update", "update:log", "audit", "automation", "config", "plugin", "open", "service", "secrets", "voice", "link", "relay:setup",
     "github:connect", "github:app-create", "github:app-connect", "github:app-sync", "prune", "uninstall", "help", "version",
   ];
   const agents = [...AGENT_INTEGRATIONS.keys()];
@@ -4088,6 +4088,38 @@ async function runUpdate(args = []) {
   console.log(c.dim(`=== bivy update finished ${new Date().toISOString()} ===`));
 }
 
+// Show the node's governance audit trail (moat #1): the append-only record of
+// tool-call decisions (and, as it grows, network/approval events) the node made,
+// attributed per session + agent. Reads the JSONL directly — the daemon need not
+// be running. Decisions + metadata only; never tool payloads.
+function cmdAudit(args = []) {
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log("Usage: bivy audit [--session <id>] [--kind <kind>] [--limit <n>] [--json]\n\nShow the node's governance audit trail (tool-call decisions, …).");
+    return;
+  }
+  const file = path.join(appDir, "audit", "audit.jsonl");
+  let raw;
+  try { raw = fs.readFileSync(file, "utf8"); }
+  catch { console.log("No audit events recorded yet."); return; }
+  const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
+  const session = flag("--session");
+  const kind = flag("--kind");
+  const limit = Number(flag("--limit")) || 0;
+  let events = raw.split("\n").map((l) => l.trim()).filter(Boolean)
+    .map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+  if (session) events = events.filter((e) => e.session === session);
+  if (kind) events = events.filter((e) => e.kind === kind);
+  if (limit > 0) events = events.slice(-limit);
+  if (args.includes("--json")) { console.log(JSON.stringify(events, null, 2)); return; }
+  if (!events.length) { console.log("No matching audit events."); return; }
+  for (const e of events) {
+    const when = new Date(e.ts).toISOString();
+    const cols = [when, e.kind, e.agent || "-", e.session ? String(e.session).slice(0, 8) : "-", e.tool || e.host || "", e.decision || ""].filter((p) => p !== "");
+    console.log(cols.join("  "));
+    if (e.reason) console.log(`    reason: ${e.reason}`);
+  }
+}
+
 // Print the update log (default: the tail; `-f`/`--follow` streams new output).
 // After a `bivy update` detaches and this terminal reconnects, this is how you
 // confirm the background update succeeded.
@@ -4607,6 +4639,9 @@ An agent's own --help passes through, e.g. 'bivy run claude --help'.`);
     case "update:log":
       cmdUpdateLog(args);
       break;
+    case "audit":
+      cmdAudit(args);
+      break;
     case "agents:install":
     case "runtimes:install":
       if (args.includes("-h") || args.includes("--help")) {

package/dist/audit/index.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Node audit trail — the governance record (moat work #1). One append-only
+// JSONL stream of GOVERNANCE events (tool-call decisions, network attempts,
+// approvals, …) that Bivy already intercepts at the substrate, attributed per
+// session + agent, uniformly across every agent. This is distinct from the
+// per-session transcript (`session/event-log.ts`, which is UI history): the
+// audit trail answers "what did agents do on this node, and did Bivy allow it",
+// and is queryable/exportable via `bivy audit`.
+//
+// REDACTION IS THE CALLER'S CONTRACT: this writer records exactly the fields it
+// is handed, so callers pass DECISIONS + bounded METADATA (tool name, allow/deny,
+// host:port) and NEVER payloads (tool args/results, request bodies, source).
+// Payload capture stays opt-in and separate (see runtime/tool-trace.ts).
+//
+// Pure fs leaf: imports nothing from the kernel; the daemon constructs one
+// AuditLog and hands `record` to the guardian / egress / approval seams.
+import fs from "node:fs";
+import path from "node:path";
+/** Build the node's audit log under `<dir>/audit.jsonl` (dir created lazily). */
+export function createAuditLog(dir) {
+    const file = path.join(dir, "audit.jsonl");
+    let ensured = false;
+    return {
+        file,
+        record(event) {
+            try {
+                if (!ensured) {
+                    fs.mkdirSync(dir, { recursive: true });
+                    ensured = true;
+                }
+                fs.appendFileSync(file, `${JSON.stringify({ ts: Date.now(), ...event })}\n`);
+            }
+            catch {
+                /* best-effort: audit failure must never break a session */
+            }
+        },
+    };
+}
+/** Read + filter the audit trail. Malformed lines are skipped, not thrown. */
+export function readAuditEvents(file, opts = {}) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (opts.session && event.session !== opts.session)
+            continue;
+        if (opts.kind && event.kind !== opts.kind)
+            continue;
+        out.push(event);
+    }
+    return opts.limit && opts.limit > 0 ? out.slice(-opts.limit) : out;
+}

package/dist/server.js

@@ -15,6 +15,7 @@ import { DEFAULT_BACKOFF } from "./policy/ruleset.js";
 import { SessionRerouteController } from "./policy/session-reroute.js";
 import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
+import { createAuditLog } from "./audit/index.js";
 import { createWorkspaceController } from "./controllers/workspaces.js";
 import { createModelController } from "./controllers/models.js";
 import { Type } from "typebox";
@@ -319,6 +320,11 @@ function publishBootstrapSecret() {
     }
 }
 const approvals = new ApprovalManager();
+// Node audit trail (moat #1): one append-only, redaction-aware record of the
+// governance events Bivy already intercepts — tool-call decisions today,
+// network/approval events next — attributed per session + agent, queryable via
+// `bivy audit`. Distinct from the per-session transcript (session/event-log.ts).
+const auditLog = createAuditLog(path.join(appDir, "audit"));
 // Bivy owns the AskUserQuestion → question-card feature at the guardian layer,
 // runtime-agnostically (see src/question.ts). The manager holds every pending
 // clarifying question across sessions; the guardian interceptor below raises
@@ -5297,14 +5303,35 @@ const guardianInterceptorImpl = async ({ sessionId, toolName, input, signal }) =
 // boundary (policy + approvals + questions), so if any of it throws — a bug in
 // rule evaluation, a rejected approval promise, an aborted signal — the tool
 // must be BLOCKED, never allowed to fall through to the SDK's default outcome.
+// Record the guardian's decision for every governed tool call — the core of the
+// node audit trail. AskUserQuestion is a Bivy interaction (handled), not a
+// governed side effect, so it is skipped. Records the tool NAME + allow/deny
+// decision only — never the tool payload (redaction contract; see src/audit).
+function recordToolCallAudit(params, outcome) {
+    const o = outcome;
+    if (o?.handled)
+        return;
+    const agent = openSessions.get(params.sessionId)?.runtimeId;
+    auditLog.record({
+        kind: "tool.call",
+        session: params.sessionId,
+        ...(agent ? { agent } : {}),
+        tool: params.toolName,
+        decision: o?.block ? "blocked" : "allowed",
+        ...(o?.block && typeof o.reason === "string" ? { reason: o.reason } : {}),
+    });
+}
 const guardianInterceptor = async (params) => {
     try {
-        return await guardianInterceptorImpl(params);
+        const outcome = await guardianInterceptorImpl(params);
+        recordToolCallAudit(params, outcome);
+        return outcome;
     }
     catch (error) {
         broadcast({ type: "tool.blocked", sessionId: params.sessionId, toolName: params.toolName, reason: "internal approval error" });
         if (process.env.BIVY_DEBUG)
             console.error("guardianInterceptor error:", error);
+        recordToolCallAudit(params, { block: true, reason: "internal approval error" });
         return { block: true, reason: "internal approval error" };
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.209",
+  "version": "0.10.1-staging.211",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",