@bivy/bivy 0.10.1-staging.313 → 0.10.1-staging.314

package/dist/certification/generated.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Generated from certification/agents.json by scripts/certification.mjs. Do not edit.
+export const CERTIFICATION_MATRIX = {
+    schemaVersion: 1,
+    agents: [
+        { id: "claude-code-sdk", status: "active", executionMode: "protocol", pinnedVersion: "0.3.220", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "codex-approvals", status: "active", executionMode: "protocol", pinnedVersion: "0.147.0", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "pi", status: "active", executionMode: "protocol", pinnedVersion: "0.83.0", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "opencode", status: "active", executionMode: "protocol", pinnedVersion: "1.18.13", capabilities: ["toolInterception", "modelSelection", "resume"] },
+    ]
+};

package/dist/certification/harness.js

@@ -0,0 +1,54 @@
+export class CertificationHarness {
+    fixture;
+    constructor(fixture) {
+        this.fixture = fixture;
+    }
+    async run(scenario, signal) {
+        const events = this.fixture.scenarios[scenario];
+        if (!events)
+            throw new Error(`Missing certification scenario ${scenario} for ${this.fixture.agentId}`);
+        if (signal?.aborted)
+            throw signal.reason ?? new Error("Certification run cancelled");
+        // Yield once so callers can exercise independent adapters concurrently and
+        // cancellation can race deterministically without subprocess timing flakes.
+        await Promise.resolve();
+        if (signal?.aborted)
+            throw signal.reason ?? new Error("Certification run cancelled");
+        const transcript = JSON.stringify(events);
+        if (transcript.includes(this.fixture.secretSentinel)) {
+            throw new Error(`Secret leakage detected in ${this.fixture.agentId}/${scenario}`);
+        }
+        this.assertScenario(scenario, events);
+        return { scenario, events: structuredClone(events), transcript };
+    }
+    assertScenario(scenario, events) {
+        const has = (type, predicate = () => true) => events.some((event) => event.type === type && predicate(event));
+        const valid = scenario === "probe-install" ? has("probe.result", (event) => event.ok === true)
+            : scenario === "auth-handoff" ? has("auth.ready", (event) => event.environment === "<redacted>")
+                : scenario === "first-turn" ? has("session.started") && has("message.delta") && has("session.done")
+                    : scenario === "structured-streaming" ? events.filter((event) => event.type === "message.delta").length >= 2 && has("session.done")
+                        : scenario === "approval" ? has("tool.decision", (event) => event.decision === "allow") && has("tool.result", (event) => event.status === "ok")
+                            : scenario === "denial" ? has("tool.decision", (event) => event.decision === "deny") && has("tool.result", (event) => event.status === "denied")
+                                : scenario === "cancellation" ? has("session.cancelled")
+                                    : scenario === "resume" ? has("session.resumed") && has("session.done")
+                                        : scenario === "attachments" ? has("prompt.received", (event) => Array.isArray(event.attachments) && event.attachments.length > 0)
+                                            : scenario === "token-refresh" ? has("auth.refresh", (event) => event.token === "<redacted>") && has("auth.ready")
+                                                : scenario === "malformed-output" ? has("protocol.error", (event) => event.code === "malformed_output")
+                                                    : scenario === "version-drift" ? has("probe.result", (event) => event.ok === false && event.code === "unsupported_version")
+                                                        : false;
+        if (!valid)
+            throw new Error(`Certification scenario ${scenario} did not satisfy its contract for ${this.fixture.agentId}`);
+    }
+}
+/** Copies only an explicit allowlist and never logs or returns secret values. */
+export function prepareAuthHandoff(source, allowed) {
+    const environment = {};
+    const redactedAudit = {};
+    for (const name of allowed) {
+        if (source[name] === undefined)
+            continue;
+        environment[name] = source[name];
+        redactedAudit[name] = "<redacted>";
+    }
+    return { environment, redactedAudit };
+}

package/dist/certification/index.js

@@ -0,0 +1,27 @@
+import { CERTIFICATION_MATRIX } from "./generated.js";
+export function certificationEntry(id) {
+    return CERTIFICATION_MATRIX.agents.find((entry) => entry.id === id);
+}
+/**
+ * The paid Supported promise is derived from certification, never merely copied
+ * from a profile. A suspended/missing entry, wrong adapter mode, stale pin, or
+ * missing required runtime capability is downgraded to Beta in the picker.
+ */
+export function applyCertification(runtime) {
+    if (runtime.supportTier !== "supported")
+        return runtime;
+    const entry = certificationEntry(runtime.id);
+    const eligible = entry?.status === "active"
+        && runtime.executionMode === entry.executionMode
+        && runtime.testedVersion === entry.pinnedVersion
+        && entry.capabilities.every((capability) => runtime.capabilities[capability] === true);
+    if (!eligible) {
+        return {
+            ...runtime,
+            supportTier: "beta",
+            certification: "adapter-tested",
+            notes: `${runtime.notes ? `${runtime.notes} ` : ""}This configured path is not the release-certified execution mode.`,
+        };
+    }
+    return { ...runtime, certification: "release-tested", testedVersion: entry.pinnedVersion };
+}

package/dist/runtime/index.js

@@ -15,6 +15,7 @@ import { deleteOpenCodeSession, loadOpenCodeTranscript, writeOpenCodeHistory } f
 import { discoverNativeGrokSessions, listGrokSessions } from "./grok-sessions.js";
 import { createCredentialStore } from "./credentials.js";
 import { AgentRegistry } from "../agents/registry.js";
+import { applyCertification } from "../certification/index.js";
 import { AGENT_PROFILES, AGENT_PROFILE_IDS, isAgentProfileId, } from "../agents/profiles.js";
 // Args that continue an existing Codex session each prompt. Codex assigns its own
 // session id (no launch-time pin), so a resumed run threads it via `exec resume`.
@@ -975,7 +976,7 @@ function agentRegistry(pluginDataDir) {
 }
 /** All registered contributions, including hidden/planned rows, for diagnostics. */
 export function listRegisteredAgents() {
-    return agentRegistry().list().map((entry) => entry.describe());
+    return agentRegistry().list().map((entry) => applyCertification(entry.describe()));
 }
 /** Resolve an id or historical alias through the authoritative registry. */
 export function canonicalAgentId(id) {
@@ -986,6 +987,11 @@ export function agentInstallSpec(id, prefix) {
     return agentRegistry().get(id.toLowerCase())?.install?.(prefix);
 }
 function runtimeCertification(runtime) {
+    if (runtime.certification)
+        return {
+            certification: runtime.certification,
+            ...(runtime.testedVersion ? { testedVersion: runtime.testedVersion } : {}),
+        };
     if (runtime.testedVersion)
         return { certification: "release-tested", testedVersion: runtime.testedVersion };
     return { certification: runtime.supportTier === "beta" ? "adapter-tested" : "unverified" };
@@ -1025,7 +1031,7 @@ export function listRuntimes(currentId) {
         // Keep the current runtime visible even if hidden, so a session pinned to a
         // hidden contribution still renders its selection instead of an empty picker.
         .filter((entry) => entry.visible || entry.id === selected)
-        .map((entry) => entry.describe())
+        .map((entry) => applyCertification(entry.describe()))
         .map((runtime) => ({
         ...runtime,
         ...runtimeProtection(runtime),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.313",
+  "version": "0.10.1-staging.314",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",