@bivy/bivy 0.12.0-staging.404 → 0.12.0-staging.406

package/dist/server.js

@@ -2878,6 +2878,17 @@ const RELAY_COMMANDS = {
             });
             return;
         }
+        const remoteSessionRequestId = requestId ?? randomUUID();
+        const sessionAdmission = await admitRelaySessionCreate(remoteSessionRequestId);
+        if (!sessionAdmission.allowed) {
+            relay?.sendEvent({
+                type: "session.error",
+                code: sessionAdmission.code || "remote_session_limit",
+                error: sessionAdmission.error,
+                requestId,
+            });
+            return;
+        }
         let record;
         try {
             // Deduped by requestId so a client's post-reconnect retry adopts the
@@ -3131,6 +3142,24 @@ async function modelAuthFetch(pathname, init = {}) {
         headers.set("content-type", "application/json");
     return fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}${pathname}`, { ...init, headers });
 }
+async function admitRelaySessionCreate(idempotencyKey) {
+    // Self-hosted/direct deployments without an account extension stay unrestricted:
+    // the control plane answers allowed when no deployment extension is configured.
+    const res = await modelAuthFetch("/node/policy/check", {
+        method: "POST",
+        body: JSON.stringify({ operation: "session.create", idempotencyKey }),
+    });
+    if (!res)
+        return { allowed: true };
+    const decision = await res.json().catch(() => ({}));
+    if (res.ok && decision.allowed !== false)
+        return { allowed: true };
+    return {
+        allowed: false,
+        code: decision.code,
+        error: decision.reason || decision.error || "This account has reached its remote session allowance.",
+    };
+}
 // Debounced model-auth sync trigger. A relay wake (`work.available`) fires this
 // so peers answer a new node's vault-key request promptly (event-driven) instead
 // of on the steady 30s poll. Coalesces a burst of wakes into one sync.
@@ -4596,18 +4625,23 @@ function invalidateGitHubApps() {
 // token nor an app key. When BIVY_HOSTED_MINT is set they mint a fresh,
 // short-lived token from the control plane per git op — cached until ~5 min
 // before expiry so a burst of git ops is a single round trip. This is the final
-// fallback rung after local apps and BIVY_GITHUB_TOKEN.
-let hostedMintCache;
-async function hostedMintToken() {
+// fallback rung after local apps and BIVY_GITHUB_TOKEN. Passing the repo lets
+// the control plane pick the matching central-app installation and scope the
+// token down to that repo, so the cache is keyed per repo.
+const hostedMintCache = new Map();
+async function hostedMintToken(repo) {
     if (!process.env.BIVY_HOSTED_MINT || !sessionAdvertiseTarget)
         return undefined;
+    const cacheKey = repo ?? "";
     const now = Date.now();
-    if (hostedMintCache && hostedMintCache.expiresAt - now > 5 * 60 * 1000)
-        return hostedMintCache.token;
+    const cached = hostedMintCache.get(cacheKey);
+    if (cached && cached.expiresAt - now > 5 * 60 * 1000)
+        return cached.token;
     try {
         const res = await fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}/node/hosted-git-credential`, {
             method: "POST",
-            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}` },
+            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}`, "content-type": "application/json" },
+            body: JSON.stringify(repo ? { repo } : {}),
         });
         if (!res.ok)
             return undefined;
@@ -4615,7 +4649,7 @@ async function hostedMintToken() {
         if (!data.token)
             return undefined;
         const parsed = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
-        hostedMintCache = { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 };
+        hostedMintCache.set(cacheKey, { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 });
         return data.token;
     }
     catch {
@@ -4639,7 +4673,7 @@ async function resolveTokenForWorkItem(item) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(item.repo));
 }
 /**
  * The token for interactive repo operations (clone/fetch/push/PR) on `owner/repo`.
@@ -4687,7 +4721,7 @@ async function resolveTokenForRepo(owner, repo) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(`${owner}/${repo}`));
 }
 /** The session source a Linear-issue pickup advertises, keyed by the issue's
  *  provider-native id so the control plane can correlate a re-dispatch to it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.12.0-staging.404",
+  "version": "0.12.0-staging.406",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",