@bivy/bivy 0.10.1-staging.262 → 0.10.1-staging.263

package/dist/audit/receipt-evidence.js

@@ -32,3 +32,31 @@ export function receiptEvidenceFromAudit(events, storageReadable) {
         },
     };
 }
+/** Add only node-observed execution facts to the already bounded audit summary. */
+export function receiptEvidenceForRun(events, storageReadable, context) {
+    const audit = receiptEvidenceFromAudit(events, storageReadable);
+    const enforcement = context.runtimeEnforcement || "unavailable";
+    const sandboxClass = enforcement === "native-sandbox" ? "enforced"
+        : enforcement === "tool-controls" ? "observed" : "unavailable";
+    return {
+        ...audit,
+        execution: {
+            profile: context.profile,
+            controller: context.controller,
+            ...(context.agentVersion ? { agentVersion: context.agentVersion } : {}),
+            modelVersionStatus: "unknown",
+        },
+        protection: {
+            effective: {
+                executionProfile: context.profile,
+                ...(context.sandboxTier ? { sandboxTier: context.sandboxTier } : {}),
+                ...(context.approvalMode ? { approvalMode: context.approvalMode } : {}),
+                runtimeEnforcement: enforcement,
+            },
+            capabilities: [
+                { capability: "sandbox", evidenceClass: sandboxClass, mechanism: enforcement },
+                { capability: "approval", evidenceClass: context.toolInterception ? "enforced" : "unavailable", mechanism: context.toolInterception ? "runtime tool interception" : "not observed" },
+            ],
+        },
+    };
+}

package/dist/server.js

@@ -16,7 +16,7 @@ import { SessionRerouteController } from "./policy/session-reroute.js";
 import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
 import { createAuditLog, readAuditEvents } from "./audit/index.js";
-import { receiptEvidenceFromAudit } from "./audit/receipt-evidence.js";
+import { receiptEvidenceForRun } from "./audit/receipt-evidence.js";
 import { createWorkspaceController } from "./controllers/workspaces.js";
 import { createModelController } from "./controllers/models.js";
 import { Type } from "typebox";
@@ -3979,6 +3979,7 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
         if (kind) {
             const terminal = stage === "failed" || stage === "checks_failed" || stage === "no_changes" || stage === "pr_opened";
             const auditEvents = terminal ? readAuditEvents(auditLog.file, { session: record.id }) : [];
+            const runtimeInfo = runtimeList(record.runtimeId).find((runtime) => runtime.id === record.runtimeId);
             const summary = stage === "pr_opened" ? "Pull request opened."
                 : stage === "started" ? "Working branch and session created."
                     : stage === "pushed" ? "Changes pushed; no pull request is open."
@@ -3995,7 +3996,14 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
                         url: typeof extra.prUrl === "string" ? extra.prUrl : undefined,
                         ...(stage === "checks_failed" || stage === "failed" ? { status: "failed" } : {}),
                     }],
-                ...(terminal ? { receiptEvidence: receiptEvidenceFromAudit(auditEvents, fs.existsSync(auditLog.file)) } : {}),
+                ...(terminal ? { receiptEvidence: receiptEvidenceForRun(auditEvents, fs.existsSync(auditLog.file), {
+                        profile: record.ephemeral ? "isolated_customer_cloud" : "trusted_workstation",
+                        controller: record.ephemeral ? "bivy_hosted_provisioning" : "customer",
+                        sandboxTier: record.sandbox,
+                        approvalMode: record.approvalMode,
+                        runtimeEnforcement: runtimeInfo?.protectionLevel,
+                        toolInterception: runtimeInfo?.capabilities?.toolInterception === true,
+                    }) } : {}),
             });
         }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.262",
+  "version": "0.10.1-staging.263",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",