@bivy/bivy 0.10.1-staging.331 → 0.10.1-staging.332

package/dist/runtime/oauth/oauth-node-open.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { getModelOAuthProvider } from "./model-oauth-providers.js";
+/**
+ * Open only the provider authorization URL generated for an active ceremony.
+ * The URL is checked against Bivy's owned provider registry before reaching the
+ * injected desktop opener, so this can never become an arbitrary remote-URL API.
+ */
+export function openOAuthLoginOnNode(login, opener) {
+    if (!login?.authUrl || login.status !== "waiting")
+        return { opened: false, error: "Login is no longer waiting for authorization." };
+    const provider = getModelOAuthProvider(login.provider);
+    if (!provider?.authorizeUrl)
+        return { opened: false, error: "Provider does not use a browser authorization page." };
+    let actual;
+    let expected;
+    try {
+        actual = new URL(login.authUrl);
+        expected = new URL(provider.authorizeUrl);
+    }
+    catch {
+        return { opened: false, error: "Authorization URL is invalid." };
+    }
+    if (actual.protocol !== "https:" || actual.origin !== expected.origin || actual.pathname !== expected.pathname) {
+        return { opened: false, error: "Authorization URL did not match the provider." };
+    }
+    return opener(actual.toString())
+        ? { opened: true }
+        : { opened: false, error: "This machine cannot open a graphical browser." };
+}

package/dist/server.js

@@ -52,6 +52,8 @@ import { execEphemeralRequest } from "./ephemeral-exec.js";
 import { ApprovalManager } from "./approval.js";
 import { QuestionManager, validQuestions, isAskUserQuestionTool, formatQuestionResult } from "./question.js";
 import { NodeIdentity } from "./identity.js";
+import { canOpenBrowser, openBrowser } from "./browser-open.js";
+import { openOAuthLoginOnNode } from "./runtime/oauth/oauth-node-open.js";
 import { collectNodeStats } from "./node-stats.js";
 import { SessionEventCoalescer } from "./session-event-coalescer.js";
 import { authMiddleware, resolveAuth, isAuthorized, requestOriginAllowed } from "./auth.js";
@@ -2883,6 +2885,8 @@ const RELAY_COMMANDS = {
                 instructions: state.instructions,
                 deviceCode: state.deviceCode,
                 usesCallbackServer: state.usesCallbackServer,
+                canOpenOnNode: canOpenBrowser(),
+                nodeName: identity.name,
                 error: state.error,
             });
         }
@@ -2890,6 +2894,21 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "session.error", error: error instanceof Error ? error.message : String(error) });
         }
     },
+    // Open only the authorization URL generated inside this active ceremony. The
+    // remote client never supplies an arbitrary URL, so this cannot become a
+    // general remote-browser-launch primitive.
+    "provider.oauth.open_on_node"(msg, ctx) {
+        const requestId = String(msg.requestId ?? "");
+        const state = oauthLogins.get(String(msg.id ?? ""));
+        if (state?.openedOnNode) {
+            ctx.reply({ type: "provider.oauth.open_on_node.result", requestId, opened: true, alreadyOpened: true });
+            return;
+        }
+        const result = openOAuthLoginOnNode(state, openBrowser);
+        if (result.opened && state)
+            state.openedOnNode = true;
+        ctx.reply({ type: "provider.oauth.open_on_node.result", requestId, ...result });
+    },
     // Paste-back step for providers that return a redirect URL/code instead of a
     // pollable device code.
     "provider.oauth.code"(msg) {
@@ -9492,13 +9511,22 @@ app.post("/api/auth/native-login", async (_req, res, next) => {
 app.post("/api/auth/oauth/start", async (req, res, next) => {
     try {
         const provider = String(req.body?.provider ?? "openai-codex").trim();
-        const state = await startOAuthLogin(provider);
-        res.json({ ok: true, id: state.id, provider: state.provider, status: state.status, authUrl: state.authUrl, instructions: state.instructions, deviceCode: state.deviceCode, usesCallbackServer: state.usesCallbackServer, error: state.error });
+        const state = await startOAuthLogin(provider, String(req.body?.label ?? "default"));
+        res.json({ ok: true, id: state.id, provider: state.provider, status: state.status, authUrl: state.authUrl, instructions: state.instructions, deviceCode: state.deviceCode, usesCallbackServer: state.usesCallbackServer, canOpenOnNode: canOpenBrowser(), nodeName: identity.name, error: state.error });
     }
     catch (error) {
         next(error);
     }
 });
+app.post("/api/auth/oauth/:id/open-on-node", (req, res) => {
+    const state = oauthLogins.get(req.params.id);
+    if (state?.openedOnNode)
+        return res.json({ opened: true, alreadyOpened: true });
+    const result = openOAuthLoginOnNode(state, openBrowser);
+    if (result.opened && state)
+        state.openedOnNode = true;
+    res.json(result);
+});
 app.post("/api/auth/oauth/:id/manual-code", (req, res) => {
     const state = oauthLogins.get(req.params.id);
     if (!state)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.331",
+  "version": "0.10.1-staging.332",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",