@bivy/bivy 0.12.0-staging.405 → 0.12.0-staging.406

package/dist/server.js

@@ -4625,18 +4625,23 @@ function invalidateGitHubApps() {
 // token nor an app key. When BIVY_HOSTED_MINT is set they mint a fresh,
 // short-lived token from the control plane per git op — cached until ~5 min
 // before expiry so a burst of git ops is a single round trip. This is the final
-// fallback rung after local apps and BIVY_GITHUB_TOKEN.
-let hostedMintCache;
-async function hostedMintToken() {
+// fallback rung after local apps and BIVY_GITHUB_TOKEN. Passing the repo lets
+// the control plane pick the matching central-app installation and scope the
+// token down to that repo, so the cache is keyed per repo.
+const hostedMintCache = new Map();
+async function hostedMintToken(repo) {
     if (!process.env.BIVY_HOSTED_MINT || !sessionAdvertiseTarget)
         return undefined;
+    const cacheKey = repo ?? "";
     const now = Date.now();
-    if (hostedMintCache && hostedMintCache.expiresAt - now > 5 * 60 * 1000)
-        return hostedMintCache.token;
+    const cached = hostedMintCache.get(cacheKey);
+    if (cached && cached.expiresAt - now > 5 * 60 * 1000)
+        return cached.token;
     try {
         const res = await fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}/node/hosted-git-credential`, {
             method: "POST",
-            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}` },
+            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}`, "content-type": "application/json" },
+            body: JSON.stringify(repo ? { repo } : {}),
         });
         if (!res.ok)
             return undefined;
@@ -4644,7 +4649,7 @@ async function hostedMintToken() {
         if (!data.token)
             return undefined;
         const parsed = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
-        hostedMintCache = { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 };
+        hostedMintCache.set(cacheKey, { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 });
         return data.token;
     }
     catch {
@@ -4668,7 +4673,7 @@ async function resolveTokenForWorkItem(item) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(item.repo));
 }
 /**
  * The token for interactive repo operations (clone/fetch/push/PR) on `owner/repo`.
@@ -4716,7 +4721,7 @@ async function resolveTokenForRepo(owner, repo) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(`${owner}/${repo}`));
 }
 /** The session source a Linear-issue pickup advertises, keyed by the issue's
  *  provider-native id so the control plane can correlate a re-dispatch to it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.12.0-staging.405",
+  "version": "0.12.0-staging.406",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",