@bivy/bivy 0.12.0-staging.405 → 0.12.0-staging.407

package/bin/bivy.mjs

@@ -3621,8 +3621,9 @@ async function cmdSetup(args = []) {
     // If self-host endpoints are already provided via the environment, default to
     // self-hosted so a scripted or self-hosted install doesn't have to re-pick it
     // (BIVY_CONTROL_PLANE_URL / BIVY_RELAY_URL then pre-fill the URL prompts below).
-    const selfHostEnv = Boolean((process.env.BIVY_CONTROL_PLANE_URL || "").trim() || (process.env.BIVY_RELAY_URL || "").trim());
-    const syncChoice = await askChoice(
+    const nodeClaimCode = process.env.BIVY_NODE_CLAIM_CODE?.trim();
+    const selfHostEnv = !nodeClaimCode && Boolean((process.env.BIVY_CONTROL_PLANE_URL || "").trim() || (process.env.BIVY_RELAY_URL || "").trim());
+    const syncChoice = nodeClaimCode ? "h" : await askChoice(
       "Remote access",
       [
         { key: "h", label: "hosted (recommended — sign in with GitHub or email; nothing caps your local usage)" },
@@ -3644,29 +3645,33 @@ async function cmdSetup(args = []) {
     }
 
     if (syncChoice !== "l") {
-      const loginChoice = await askChoice(
-        "Remote login",
-        [
-          { key: "g", label: "GitHub" },
-          { key: "e", label: "email sign-in link (open or scan on any device)" },
-        ],
-        "g",
-      );
-      if (loginChoice === "e") {
-        const email = await ask("  Your account email:", config.env.BIVY_EMAIL || "");
-        if (email.trim()) relayArgs.push("--email", email.trim());
-        else relayArgs.push("--github");
-      } else {
-        relayArgs.push("--github");
+      if (!nodeClaimCode) {
+        const loginChoice = await askChoice(
+          "Remote login",
+          [
+            { key: "g", label: "GitHub" },
+            { key: "e", label: "email sign-in link (open or scan on any device)" },
+          ],
+          "g",
+        );
+        if (loginChoice === "e") {
+          const email = await ask("  Your account email:", config.env.BIVY_EMAIL || "");
+          if (email.trim()) relayArgs.push("--email", email.trim());
+          else relayArgs.push("--github");
+        } else {
+          relayArgs.push("--github");
+        }
       }
 
       const useGithub = relayArgs.includes("--github");
       try { fs.rmSync(setupSessionPath, { force: true }); } catch { /* best effort */ }
       let relayOk;
       for (;;) {
-        console.log(c.dim(useGithub
-          ? "  We'll open GitHub in your browser (or print the URL on a headless server). Authorize, and setup continues automatically."
-          : "  We'll email you a sign-in link. Open it in any browser and setup continues automatically."));
+        console.log(c.dim(nodeClaimCode
+          ? "  Using the one-time machine claim from your Bivy account; no additional sign-in is required."
+          : useGithub
+            ? "  We'll open GitHub in your browser (or print the URL on a headless server). Authorize, and setup continues automatically."
+            : "  We'll email you a sign-in link. Open it in any browser and setup continues automatically."));
         rl.pause();
         const code = await run(nodeBin, [...nodeScriptArgs(relaySetupEntry), ...relayArgs, "--emit-session", setupSessionPath], {
           cwd: repoRoot,

package/dist/relay-setup.js

@@ -197,19 +197,29 @@ async function main() {
     const clientBaseUrl = (arg("client", process.env.BIVY_CLIENT_BASE_URL) ?? controlPlaneUrl).replace(/\/$/, "") || controlPlaneUrl;
     const email = arg("email", process.env.BIVY_EMAIL);
     const sessionToken = arg("session-token", process.env.BIVY_SESSION_TOKEN);
+    const nodeClaimCode = process.env.BIVY_NODE_CLAIM_CODE?.trim();
     // GitHub is the primary sign-in: used when --github is passed, or by default
-    // when neither an email nor an existing session token is supplied.
-    const useGithub = process.argv.includes("--github") || process.env.BIVY_AUTH === "github" || (!email && !sessionToken);
+    // when neither an email, an existing session token, nor a one-time machine
+    // claim is supplied. Claims authorize enrollment only and never mint a user
+    // session token.
+    const useGithub = process.argv.includes("--github") || process.env.BIVY_AUTH === "github" || (!email && !sessionToken && !nodeClaimCode);
     const identity = NodeIdentity.load(appDir);
     console.log(`Node: ${identity.name} (${identity.nodeId})`);
     console.log(`Control plane: ${controlPlaneUrl}`);
     console.log(`Relay:         ${relayUrl}`);
     await checkControlPlane(controlPlaneUrl);
-    const token = sessionToken ?? (useGithub ? await githubDeviceLogin(controlPlaneUrl) : await deviceLogin(controlPlaneUrl, email));
+    const token = nodeClaimCode ? undefined
+        : sessionToken ?? (useGithub ? await githubDeviceLogin(controlPlaneUrl) : await deviceLogin(controlPlaneUrl, email));
     async function enrollNode() {
-        return fetchJson(`${controlPlaneUrl}/nodes/enroll`, {
+        const url = nodeClaimCode
+            ? `${controlPlaneUrl}/claim/${encodeURIComponent(nodeClaimCode)}/enroll`
+            : `${controlPlaneUrl}/nodes/enroll`;
+        return fetchJson(url, {
             method: "POST",
-            headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+            headers: {
+                "content-type": "application/json",
+                ...(token ? { authorization: `Bearer ${token}` } : {}),
+            },
             body: JSON.stringify({ nodeId: identity.nodeId, name: identity.name }),
         });
     }
@@ -247,7 +257,7 @@ async function main() {
     // read once and deleted by setup. We skip it when the caller supplied a session
     // token only via --session-token/env with no --emit-session, i.e. non-setup use.
     const emitSession = arg("emit-session");
-    if (emitSession) {
+    if (emitSession && token) {
         try {
             const handoff = JSON.stringify({ session: token, nodeId: identity.nodeId });
             fs.writeFileSync(emitSession, `${handoff}\n`, { mode: 0o600 });
@@ -257,7 +267,7 @@ async function main() {
             // best effort — setup falls back to opening the plain remote app URL
         }
     }
-    console.log(`\n✓ Signed in and enrolled this node. Wrote ${filePath}`);
+    console.log(`\n✓ ${nodeClaimCode ? "Claimed and enrolled" : "Signed in and enrolled"} this node. Wrote ${filePath}`);
     console.log('Run "bivy link" to pair a phone, or use "Link remote device" in the app (bivy open).');
 }
 main().catch((error) => {

package/dist/server.js

@@ -4625,18 +4625,23 @@ function invalidateGitHubApps() {
 // token nor an app key. When BIVY_HOSTED_MINT is set they mint a fresh,
 // short-lived token from the control plane per git op — cached until ~5 min
 // before expiry so a burst of git ops is a single round trip. This is the final
-// fallback rung after local apps and BIVY_GITHUB_TOKEN.
-let hostedMintCache;
-async function hostedMintToken() {
+// fallback rung after local apps and BIVY_GITHUB_TOKEN. Passing the repo lets
+// the control plane pick the matching central-app installation and scope the
+// token down to that repo, so the cache is keyed per repo.
+const hostedMintCache = new Map();
+async function hostedMintToken(repo) {
     if (!process.env.BIVY_HOSTED_MINT || !sessionAdvertiseTarget)
         return undefined;
+    const cacheKey = repo ?? "";
     const now = Date.now();
-    if (hostedMintCache && hostedMintCache.expiresAt - now > 5 * 60 * 1000)
-        return hostedMintCache.token;
+    const cached = hostedMintCache.get(cacheKey);
+    if (cached && cached.expiresAt - now > 5 * 60 * 1000)
+        return cached.token;
     try {
         const res = await fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}/node/hosted-git-credential`, {
             method: "POST",
-            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}` },
+            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}`, "content-type": "application/json" },
+            body: JSON.stringify(repo ? { repo } : {}),
         });
         if (!res.ok)
             return undefined;
@@ -4644,7 +4649,7 @@ async function hostedMintToken() {
         if (!data.token)
             return undefined;
         const parsed = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
-        hostedMintCache = { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 };
+        hostedMintCache.set(cacheKey, { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 });
         return data.token;
     }
     catch {
@@ -4668,7 +4673,7 @@ async function resolveTokenForWorkItem(item) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(item.repo));
 }
 /**
  * The token for interactive repo operations (clone/fetch/push/PR) on `owner/repo`.
@@ -4716,7 +4721,7 @@ async function resolveTokenForRepo(owner, repo) {
             }
         }
     }
-    return (await resolveGitHubToken()) ?? (await hostedMintToken());
+    return (await resolveGitHubToken()) ?? (await hostedMintToken(`${owner}/${repo}`));
 }
 /** The session source a Linear-issue pickup advertises, keyed by the issue's
  *  provider-native id so the control plane can correlate a re-dispatch to it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.12.0-staging.405",
+  "version": "0.12.0-staging.407",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",