@bivy/bivy 0.10.1-staging.291 → 0.10.1-staging.293

package/dist/server.js

@@ -100,6 +100,7 @@ import { AttachmentStore, isValidAttachmentHash } from "./session/attachment-sto
 import { planAttachment, isAttachPlanError, MAX_AGENT_ATTACHMENT_BYTES } from "./session/attach-to-chat.js";
 import { ReplicationService } from "./session/replication-service.js";
 import { createSessionNewDedupe } from "./session/session-new-dedupe.js";
+import { computeSessionContract } from "./session/session-contract.js";
 import { SecretVault, resolveSecret } from "./secrets.js";
 import { deviceFlowClientId, requestDeviceCode, pollAccessTokenOnce, REPO_CONNECT_SCOPE } from "./github-device-auth.js";
 import { InstallationTokenCache, createAppJwt, resolveInstallationId } from "./github-app-auth.js";
@@ -2120,6 +2121,7 @@ const RELAY_COMMANDS = {
                 approvalMode: rec?.approvalMode,
                 ephemeral: rec?.ephemeral,
                 executionProfile: rec ? (rec.ephemeral ? "isolated_customer_cloud" : "trusted_workstation") : undefined,
+                contract: rec?.contract ?? meta?.contract,
                 auditHealth: rec ? auditLog.health() : undefined,
                 eventLogHealth: rec ? eventLogHealthForSession(rec.id) : undefined,
                 prUrl: rec?.prUrl ?? meta?.prUrl,
@@ -2996,6 +2998,29 @@ const RELAY_COMMANDS = {
         const workspaceInput = typeof msg.workspace === "string" ? msg.workspace.trim() : "";
         const title = typeof msg.title === "string" ? msg.title : undefined;
         const requestId = typeof msg.requestId === "string" ? msg.requestId : undefined;
+        // Prevent silent downgrade: for a "supported" (certified) agent whose live
+        // protection would be degraded, require the client to have explicitly
+        // acknowledged it (the picker's confirm-to-continue step) before this
+        // request is allowed to launch a session — checked before any side-effecting
+        // work (repo clone / worktree allocation) so a rejection is cheap. Gating
+        // facts (protectionLevel, executionMode, capabilities, supportTier) are all
+        // runtime-level, not workspace-policy-dependent, so this pre-creation check
+        // stays correct regardless of what per-workspace sandbox/approval policy
+        // resolves to afterward.
+        const acknowledgeReducedProtections = msg.acknowledgeReducedProtections === true;
+        const gateNow = new Date().toISOString();
+        const rt = getRuntime(agentFrom(msg) ?? defaultRuntimeId);
+        const gateContract = computeSessionContract({ runtime: rt, preview: false, sandbox: sandboxFrom(msg), acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
+        if (gateContract.requiresAcknowledgement) {
+            relay?.sendEvent({
+                type: "session.error",
+                code: "reduced_protections_ack_required",
+                error: `${rt.displayName || rt.id} would run this session with reduced protections for a certified profile. Confirm to continue.`,
+                contract: gateContract,
+                requestId,
+            });
+            return;
+        }
         let record;
         try {
             // Deduped by requestId so a client's post-reconnect retry adopts the
@@ -3025,6 +3050,11 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
             return;
         }
+        // Resolve once from the session's actual, now-known launch facts (final
+        // sandbox/approval after per-workspace policy) and store it — never
+        // live-recomputed later, so it can't silently "improve" behind the user.
+        record.contract = computeSessionContract({ runtime: getRuntime(record.runtimeId), preview: false, sandbox: record.sandbox, approvalMode: record.approvalMode, acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
+        persistSessionMetadata(record);
         relay?.sendEvent({
             ...transcripts.buildHistoryEvent({
                 sessionId: record.id,
@@ -6049,6 +6079,7 @@ function bivySessionEnvelope(record) {
         approvalMode: record.approvalMode,
         ephemeral: record.ephemeral,
         executionProfile: record.ephemeral ? "isolated_customer_cloud" : "trusted_workstation",
+        contract: record.contract,
         auditHealth: auditLog.health(),
         eventLogHealth: eventLogHealthForSession(record.id),
         repoSlug: gh.repoSlug,
@@ -6094,6 +6125,7 @@ function persistSessionMetadata(record, status = sessionStatus(record)) {
         runtimeId: record.runtimeId,
         sandbox: record.sandbox,
         agentName: getRuntime(record.runtimeId).displayName,
+        contract: record.contract,
         status,
         branch: record.worktree?.branch,
         worktree: record.worktree?.path,
@@ -6140,6 +6172,7 @@ function bivySessionEnvelopeFromSummary(s, rec, meta) {
         // `rec` is undefined here (the live path returned above via bivySessionEnvelope),
         // so the tier comes from the persisted metadata row.
         sandbox: normalizeSandboxTier(meta?.sandbox),
+        contract: meta?.contract,
         repoSlug,
         issueNumber: gh.issueNumber,
         issueUrl,
@@ -7760,7 +7793,22 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // bump it to now (only real activity should reorder the sidebar). A brand-new
     // session legitimately starts "active now".
     const resumedLastActive = requestedSessionFile ? metaLastActiveMs(storedMeta) : undefined;
-    const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: sessionSafety.approval, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral, workspaceState: runGit(["status", "--porcelain", "--untracked-files=normal"], sessionWorkspace) ? "dirty" : "clean" };
+    // Rehydrate the persisted contract on resume/reopen (not recomputed — a
+    // stored contract reflects what the original launch actually got, per
+    // session-contract.ts). Brand-new sessions (no storedMeta) start undefined
+    // here; session.new stamps a freshly computed one right after creation.
+    // Rehydrating (rather than leaving this undefined for a resumed session)
+    // also avoids a persistSessionMetadata call later silently clobbering the
+    // stored contract with undefined via its `{...prev, ...input}` merge.
+    const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: sessionSafety.approval, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, contract: storedMeta?.contract, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral, workspaceState: runGit(["status", "--porcelain", "--untracked-files=normal"], sessionWorkspace) ? "dirty" : "clean" };
+    // Migration: a session resumed/reopened from before this feature (or from a
+    // node that predates it) has no stored contract. Stamp an honest one now
+    // from currently-observed facts rather than leaving it blank forever or
+    // inventing what launch actually got years ago — the same "don't fabricate
+    // history" rule session-contract.ts applies elsewhere.
+    if (!record.contract) {
+        record.contract = computeSessionContract({ runtime: getRuntime(rt.id), preview: false, sandbox: sessionSandbox, approvalMode: sessionSafety.approval }, new Date().toISOString());
+    }
     // Apply this session's sandbox network policy as a per-session egress proxy
     // (its own proxy/decider, never the node-global one). Opt-in via BIVY_SANDBOX_NET:
     // a read-only session then actually blocks outbound network even for a CLI agent
@@ -9540,6 +9588,21 @@ app.post("/api/session", async (req, res, next) => {
             if (!parsed)
                 return res.status(400).json({ error: `Invalid repository "${repoInput}" — use owner/repo.` });
         }
+        // Same downgrade gate as the relay session.new handler — this direct API
+        // route (CLI/scripted callers, no picker in front of it) must not launch a
+        // "supported" profile with degraded live protection any more silently than
+        // the PWA can.
+        const acknowledgeReducedProtections = req.body?.acknowledgeReducedProtections === true;
+        const gateNow = new Date().toISOString();
+        const rt = getRuntime(agentFrom(req.body ?? {}) ?? defaultRuntimeId);
+        const gateContract = computeSessionContract({ runtime: rt, preview: false, sandbox: sandboxFrom(req.body ?? {}), acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
+        if (gateContract.requiresAcknowledgement) {
+            return res.status(409).json({
+                error: `${rt.displayName || rt.id} would run this session with reduced protections for a certified profile. Pass acknowledgeReducedProtections: true to confirm.`,
+                code: "reduced_protections_ack_required",
+                contract: gateContract,
+            });
+        }
         let session;
         try {
             // Deduped by requestId so a direct client's post-reconnect retry adopts the
@@ -9558,6 +9621,8 @@ app.post("/api/session", async (req, res, next) => {
                 return res.status(502).json({ error: `Could not clone ${parsed.slug}: ${error instanceof Error ? error.message : String(error)}` });
             throw error;
         }
+        session.contract = computeSessionContract({ runtime: getRuntime(session.runtimeId), preview: false, sandbox: session.sandbox, approvalMode: session.approvalMode, acknowledgedAt: acknowledgeReducedProtections ? gateNow : undefined }, gateNow);
+        persistSessionMetadata(session);
         res.json({ id: session.id, workspace: session.workspace, source: session.source, branch: session.worktree?.branch, prUrl: session.prUrl, sessionFile: session.sessionFile, name: session.session.getName(), runtimeId: session.runtimeId, agentName: getRuntime(session.runtimeId).displayName, model: publicModel(session.session.getCurrentModel(), session.session.getCurrentModel()), sessionState: sessionState(session) });
     }
     catch (error) {

package/dist/session/session-contract.js

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// The Effective Session Contract — what a launched session actually got
+// (detected agent/version, resolved execution mode, model/auth source,
+// resume support, structured streaming, tool interception/approval
+// semantics, sandbox enforcement) as distinct from the catalog-level
+// `RuntimeInfo` promise. An observation report, not an attestation — same
+// discipline as `src/audit/receipt-evidence.ts`: report only what was
+// observed, keep "requested" and "effective" distinct, and turn every gap
+// into a typed, honest reason instead of a silent absence or an invented
+// default.
+//
+// `resolveSessionContract` here mirrors `packages/core/src/session-contract.ts`
+// field-for-field. Not a shared import: the node (src/) intentionally does
+// not depend on @bivy/core (a browser/client package — see
+// src/session/inline-image-fetch.ts's comment for the same convention). Kept
+// in lock-step by comment instead. If you change one, change the other.
+export const SESSION_CONTRACT_SCHEMA_VERSION = "session-contract.v1";
+const LIMITATIONS = {
+    agent_version_unknown: "The running agent's build/version was not reported; capability guarantees fall back to the pinned default.",
+    execution_mode_unstructured: "The agent is driven over a raw text pipe, not a structured message/event stream — tool-call and turn boundaries are inferred, not reported.",
+    execution_mode_unknown: "The session's communication mode has not been resolved yet.",
+    auth_unknown: "The credential kind backing this session was not identified.",
+    auth_unconfigured: "No credential is configured for this provider.",
+    resume_unsupported: "This agent cannot resume a persisted session; a stopped session restarts from a seeded continuation instead.",
+    tool_interception_unavailable: "Tool calls are not intercepted by Bivy's approval gate; the agent runs unmoderated.",
+    tool_interception_mcp_only: "Only this agent's MCP tool calls are gated by Bivy's approval flow — its built-in tools are not.",
+    sandbox_unavailable: "No sandbox or tool-control enforcement was observed; the agent runs with the OS user's full permissions.",
+    sandbox_observed_only: "Containment relies on Bivy's own tool controls rather than the agent's native sandbox — observed, not independently enforced.",
+};
+function degradedReason(area, code) {
+    return { area, code, message: LIMITATIONS[code] ?? code };
+}
+const PROTECTION_AREAS = new Set(["auth", "resume", "toolInterception", "sandbox"]);
+/**
+ * Resolve an Effective Session Contract from already-observed facts. Never
+ * infers a fact the caller didn't supply — an absent input becomes an honest
+ * "unknown"/"unavailable" state plus a typed reason, never a guess.
+ */
+export function resolveSessionContract(input) {
+    const degradedReasons = [];
+    const versionSource = input.detectedVersion
+        ? (input.versionSource ?? "reported")
+        : "unknown";
+    if (versionSource === "unknown")
+        degradedReasons.push(degradedReason("agent", "agent_version_unknown"));
+    const agent = {
+        id: input.agentId,
+        ...(input.agentDisplayName ? { displayName: input.agentDisplayName } : {}),
+        ...(input.detectedVersion ? { detectedVersion: input.detectedVersion } : {}),
+        versionSource,
+    };
+    const effectiveMode = input.executionMode ?? "unknown";
+    const structuredStreaming = effectiveMode === "protocol" || effectiveMode === "structured-pipe";
+    const executionModeState = effectiveMode === "unknown" ? "unavailable" : structuredStreaming ? "guaranteed" : "degraded";
+    if (executionModeState === "degraded")
+        degradedReasons.push(degradedReason("executionMode", "execution_mode_unstructured"));
+    if (executionModeState === "unavailable")
+        degradedReasons.push(degradedReason("executionMode", "execution_mode_unknown"));
+    const executionMode = { effective: effectiveMode, structuredStreaming, state: executionModeState };
+    const model = {
+        ...(input.provider ? { provider: input.provider } : {}),
+        ...(input.modelId ? { modelId: input.modelId } : {}),
+        configured: input.modelConfigured ?? false,
+    };
+    const authKind = input.authKind ?? "unknown";
+    const authState = authKind === "unknown" || authKind === "none" ? "unavailable" : "guaranteed";
+    if (authKind === "unknown")
+        degradedReasons.push(degradedReason("auth", "auth_unknown"));
+    if (authKind === "none")
+        degradedReasons.push(degradedReason("auth", "auth_unconfigured"));
+    const auth = { kind: authKind, origin: input.authOrigin ?? "unknown", state: authState };
+    const resumeAdvertised = input.resumeAdvertised ?? false;
+    const resumeState = resumeAdvertised ? "guaranteed" : "unavailable";
+    if (!resumeAdvertised)
+        degradedReasons.push(degradedReason("resume", "resume_unsupported"));
+    const resume = { advertised: resumeAdvertised, refIsPath: input.resumeRefIsPath ?? false, state: resumeState };
+    const toolEnforced = input.toolInterceptionEnforced ?? false;
+    const mcpOnly = !toolEnforced && Boolean(input.mcpToolApprovalsOnly);
+    const toolState = toolEnforced ? "guaranteed" : mcpOnly ? "degraded" : "unavailable";
+    if (toolState === "degraded")
+        degradedReasons.push(degradedReason("toolInterception", "tool_interception_mcp_only"));
+    if (toolState === "unavailable")
+        degradedReasons.push(degradedReason("toolInterception", "tool_interception_unavailable"));
+    const toolInterception = {
+        enforced: toolEnforced,
+        mcpOnly,
+        ...(input.approvalMode ? { approvalMode: input.approvalMode } : {}),
+        state: toolState,
+    };
+    const runtimeEnforcement = input.runtimeEnforcement ?? "none";
+    const evidenceClass = runtimeEnforcement === "native-sandbox" ? "enforced" : runtimeEnforcement === "tool-controls" ? "observed" : "unavailable";
+    const sandboxState = evidenceClass === "enforced" ? "guaranteed" : evidenceClass === "observed" ? "degraded" : "unavailable";
+    if (sandboxState === "degraded")
+        degradedReasons.push(degradedReason("sandbox", "sandbox_observed_only"));
+    if (sandboxState === "unavailable")
+        degradedReasons.push(degradedReason("sandbox", "sandbox_unavailable"));
+    const sandbox = {
+        ...(input.sandboxTier ? { tier: input.sandboxTier } : {}),
+        runtimeEnforcement,
+        evidenceClass,
+        state: sandboxState,
+    };
+    const supportTier = input.supportTier ?? "experimental";
+    const hasProtectionDegradation = degradedReasons.some((r) => PROTECTION_AREAS.has(r.area));
+    const requiresAcknowledgement = supportTier === "supported" && hasProtectionDegradation && !input.acknowledgedAt;
+    return {
+        schemaVersion: SESSION_CONTRACT_SCHEMA_VERSION,
+        resolvedAt: input.now,
+        preview: input.preview,
+        supportTier,
+        certification: input.certification ?? "unverified",
+        agent,
+        executionMode,
+        model,
+        auth,
+        resume,
+        toolInterception,
+        sandbox,
+        degradedReasons,
+        requiresAcknowledgement,
+        ...(input.acknowledgedAt ? { acknowledgedAt: input.acknowledgedAt } : {}),
+    };
+}
+/**
+ * Map real node-side facts (a resolved `RuntimeInfo`, the chosen sandbox
+ * tier/approval mode, and whatever credential facts the caller has) into an
+ * Effective Session Contract. `authKind` defaults to "unknown" rather than
+ * guessing from `authOwner` — origin (bivy vault vs. the agent's own login)
+ * is a structural fact `authOwner` already reports honestly; the specific
+ * credential *kind* (api_key vs oauth) is not yet threaded through from
+ * every runtime's credential resolution and must not be invented.
+ */
+export function computeSessionContract(facts, now) {
+    const runtime = facts.runtime;
+    const caps = runtime.capabilities ?? {};
+    const authOrigin = runtime.authOwner === "bivy" ? "bivy" : runtime.authOwner === "agent" ? "agent-native" : "unknown";
+    return resolveSessionContract({
+        now,
+        preview: facts.preview,
+        agentId: runtime.id,
+        agentDisplayName: runtime.displayName,
+        detectedVersion: runtime.testedVersion,
+        versionSource: runtime.testedVersion ? "tested-pin" : undefined,
+        supportTier: runtime.supportTier,
+        certification: runtime.certification,
+        executionMode: runtime.executionMode,
+        provider: facts.provider,
+        modelId: facts.modelId,
+        modelConfigured: facts.modelConfigured,
+        authKind: facts.authKind,
+        authOrigin,
+        resumeAdvertised: caps.resume === true,
+        resumeRefIsPath: caps.sessionRefIsPath === true,
+        toolInterceptionEnforced: caps.toolInterception === true,
+        mcpToolApprovalsOnly: caps.mcpToolApprovals === true,
+        approvalMode: facts.approvalMode,
+        sandboxTier: facts.sandbox,
+        runtimeEnforcement: runtime.protectionLevel,
+        acknowledgedAt: facts.acknowledgedAt,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.291",
+  "version": "0.10.1-staging.293",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",