@bivy/bivy 0.16.17 → 0.16.18-staging.10

package/dist/agents/pi/runtime.js

@@ -423,7 +423,7 @@ export class PiRuntime {
                 modelsPath: path.join(piDir, "models.json"),
                 allowModelNetwork,
             })
-            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork });
+            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork, workspace: sessionManager.getCwd() || options.workspace });
         const backgroundShells = new BackgroundShellTracker();
         const createRuntime = async ({ cwd, agentDir, sessionManager, sessionStartEvent }) => {
             const sessionId = sessionManager.getSessionId();

package/dist/credentials/resolver.js

@@ -10,23 +10,12 @@
 //
 // This keeps Bivy's hot credential path decoupled from Pi: Pi is just another
 // agent that reads the same store.
-import path from "node:path";
 import { createCredentialVault } from "./store.js";
-import { resolveCredential } from "./records.js";
+import { selectCredential } from "./selection.js";
+export { projectIdsFromWorkspace } from "./selection.js";
 import { loadPresets, defaultPresetsPath } from "./presets.js";
 /** Refresh an OAuth token this many ms before it expires (clock-skew guard). */
 const OAUTH_REFRESH_SKEW_MS = 60_000;
-/** Stable project identifiers discoverable without importing repo/session code. */
-export function projectIdsFromWorkspace(workspace) {
-    const resolved = path.resolve(workspace);
-    const ids = new Set([resolved, path.basename(resolved)]);
-    for (const part of resolved.split(path.sep)) {
-        const split = part.indexOf("__");
-        if (split > 0 && split < part.length - 2)
-            ids.add(`${part.slice(0, split)}/${part.slice(split + 2)}`);
-    }
-    return [...ids];
-}
 /** Resolver over Bivy's credential store, with OAuth refresh-on-read via the bridge. */
 export class NodeCredentialResolver {
     credsDir;
@@ -59,14 +48,7 @@ export class NodeCredentialResolver {
         // than guessing.
         const records = await this.store.listRecords().catch(() => []);
         const presets = this.presets();
-        // Project assignments are ordinary preset mappings named `project:<id>`.
-        // Bivy-managed clones encode owner/repo as owner__repo in their workspace
-        // path; direct local workspaces also match their absolute path/basename.
-        const explicitProject = context?.project?.trim();
-        const workspace = context?.workspace?.trim();
-        const projectCandidates = [explicitProject, ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter((value) => Boolean(value));
-        const projectPreset = projectCandidates.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
-        const selection = resolveCredential(id, records, presets, { ...(projectPreset ? { preset: projectPreset } : {}), ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}) });
+        const selection = selectCredential(id, records, presets, context);
         if (!selection)
             return undefined;
         const source = selection.record.source;

package/dist/credentials/selected-store.js

@@ -0,0 +1,35 @@
+import { defaultPresetsPath, loadPresets } from "./presets.js";
+import { selectCredential } from "./selection.js";
+/** A provider-addressed view of the vault for consumers without labeled accounts.
+ * Resolve on every operation; never copy a work credential into the default slot.
+ * Refresh writes stay attached to the selected record's label and metadata.
+ */
+export function selectedCredentialStore(store, credsDir, context) {
+    const select = async (provider) => selectCredential(provider, await store.listRecords(), loadPresets(defaultPresetsPath(credsDir)), context)?.record;
+    return {
+        async read(provider) {
+            const record = await select(provider);
+            if (record?.source.kind !== "stored")
+                return undefined;
+            const { updatedAt: _updatedAt, ...credential } = record.source.cred;
+            return credential;
+        },
+        async list() {
+            const records = await store.listRecords();
+            const presets = loadPresets(defaultPresetsPath(credsDir));
+            return [...new Set(records.map((r) => r.provider))].flatMap((providerId) => {
+                const record = selectCredential(providerId, records, presets, context)?.record;
+                if (record?.source.kind !== "stored")
+                    return [];
+                const credential = record.source.cred;
+                return [{ providerId, type: credential.type, ...(credential.type === "oauth" ? { expiresAt: credential.expires } : {}) }];
+            });
+        },
+        async modify(provider, fn) {
+            const record = await select(provider);
+            if (!record)
+                throw new Error(`No account selected for ${provider}`);
+            return store.modifyRecord(provider, record.label, fn);
+        },
+    };
+}

package/dist/credentials/selection.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import path from "node:path";
+import { resolveCredential } from "./records.js";
+/** Stable project identifiers discoverable without importing repo/session code. */
+export function projectIdsFromWorkspace(workspace) {
+    const resolved = path.resolve(workspace);
+    const ids = new Set([resolved, path.basename(resolved)]);
+    for (const part of resolved.split(path.sep)) {
+        const split = part.indexOf("__");
+        if (split > 0 && split < part.length - 2)
+            ids.add(`${part.slice(0, split)}/${part.slice(split + 2)}`);
+    }
+    return [...ids];
+}
+export function selectCredential(provider, records, presets, context) {
+    const id = provider.trim().toLowerCase();
+    const workspace = context?.workspace?.trim();
+    const projects = [context?.project?.trim(), ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter(Boolean);
+    const projectPreset = projects.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
+    return resolveCredential(id, records, presets, {
+        ...(projectPreset ? { preset: projectPreset } : {}),
+        ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}),
+    });
+}

package/dist/runtime/oauth/model-oauth-providers.js

@@ -7,8 +7,8 @@
 // not guesses. Owning these lets Bivy run the OAuth login + token refresh itself,
 // so no credential operation depends on Pi.
 //
-// Covered (fully Bivy-owned): Anthropic (Claude Pro/Max), OpenAI Codex (ChatGPT),
-// xAI (Grok). GitHub Copilot (two-stage token + dynamic base URL entangled with
+// Covered (fully Bivy-owned): Anthropic (Claude Pro/Max), OpenAI Codex (ChatGPT;
+// device-code), xAI (Grok). GitHub Copilot (two-stage token + dynamic base URL entangled with
 // Pi's request layer) and Radius (self-describing gateway) are intentionally not
 // reimplemented here.
 /** Anthropic uses a JSON token body; OpenAI/xAI use form-encoded. */
@@ -17,12 +17,16 @@ export const MODEL_OAUTH_PROVIDERS = {
         id: "anthropic",
         displayName: "Anthropic (Claude Pro/Max)",
         clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
-        scopes: "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",
+        // Claude Code's `setup-token` flow avoids localhost entirely: Anthropic hosts
+        // the callback page and shows a code the user can paste back into Bivy. The
+        // resulting long-lived token is inference-only, which is exactly what agent
+        // model requests need and works well from a remote PWA/headless node.
+        scopes: "user:inference",
         flow: "auth_code",
         tokenEncoding: "json",
-        authorizeUrl: "https://claude.ai/oauth/authorize",
+        authorizeUrl: "https://claude.com/cai/oauth/authorize",
         tokenUrl: "https://platform.claude.com/v1/oauth/token",
-        callback: { port: 53692, path: "/callback", redirectHost: "localhost" },
+        redirectUri: "https://platform.claude.com/oauth/code/callback",
         authorizeParams: { code: "true" },
         stateIsVerifier: true,
         refreshSkewMs: 5 * 60 * 1000,
@@ -33,11 +37,13 @@ export const MODEL_OAUTH_PROVIDERS = {
         displayName: "OpenAI (ChatGPT Plus/Pro)",
         clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
         scopes: "openid profile email offline_access",
-        flow: "auth_code",
+        flow: "openai_codex_device_code",
         tokenEncoding: "form",
         authorizeUrl: "https://auth.openai.com/oauth/authorize",
         tokenUrl: "https://auth.openai.com/oauth/token",
         callback: { port: 1455, path: "/auth/callback", redirectHost: "localhost" },
+        deviceAuthUrl: "https://auth.openai.com/api/accounts/deviceauth/usercode",
+        deviceTokenUrl: "https://auth.openai.com/api/accounts/deviceauth/token",
         authorizeParams: {
             id_token_add_organizations: "true",
             codex_cli_simplified_flow: "true",

package/dist/runtime/oauth/model-oauth.js

@@ -199,7 +199,7 @@ function startCallbackServer(host, port, pathName, expectedState, signal) {
 async function loginAuthCode(provider, interaction) {
     const { verifier, challenge } = createPkce();
     const state = provider.stateIsVerifier ? verifier : randomBytes(16).toString("hex");
-    const redirectUri = `http://${provider.callback.redirectHost}:${provider.callback.port}${provider.callback.path}`;
+    const redirectUri = provider.redirectUri ?? `http://${provider.callback.redirectHost}:${provider.callback.port}${provider.callback.path}`;
     const authorizeUrl = buildAuthorizeUrl(provider, { challenge, state, redirectUri });
     interaction.notify({
         type: "auth_url",
@@ -300,6 +300,88 @@ async function loginDeviceCode(provider, interaction) {
         return tokensFrom(provider, payload);
     }
 }
+async function postJsonObject(url, body, signal) {
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal,
+    });
+    const text = await res.text();
+    let payload = {};
+    try {
+        payload = JSON.parse(text);
+    }
+    catch { /* non-JSON error body */ }
+    return { status: res.status, ok: res.ok, payload, text };
+}
+function nestedOAuthErrorCode(payload) {
+    const error = payload.error;
+    if (typeof error === "string")
+        return error;
+    if (error && typeof error === "object") {
+        const code = error.code;
+        return typeof code === "string" ? code : "";
+    }
+    return "";
+}
+async function loginOpenAICodexDeviceCode(provider, interaction) {
+    const started = await postJsonObject(provider.deviceAuthUrl, { client_id: provider.clientId }, interaction.signal);
+    if (!started.ok)
+        throw new Error(`OpenAI Codex device authorization failed (${started.status}): ${started.text.slice(0, 200)}`);
+    const deviceAuthId = typeof started.payload.device_auth_id === "string" ? started.payload.device_auth_id : "";
+    const userCode = typeof started.payload.user_code === "string" ? started.payload.user_code : "";
+    const rawInterval = Number(started.payload.interval);
+    const interval = Number.isFinite(rawInterval) && rawInterval >= 0 ? rawInterval : 5;
+    if (!deviceAuthId || !userCode)
+        throw new Error(`Invalid OpenAI Codex device authorization response: ${JSON.stringify(started.payload)}`);
+    const expiresInSeconds = 15 * 60;
+    interaction.notify({
+        type: "device_code",
+        userCode,
+        verificationUri: "https://auth.openai.com/codex/device",
+        intervalSeconds: interval,
+        expiresInSeconds,
+    });
+    const deadline = Date.now() + expiresInSeconds * 1000;
+    let authorizationCode = "";
+    let codeVerifier = "";
+    let waitMs = interval * 1000;
+    await sleep(waitMs);
+    while (Date.now() <= deadline) {
+        if (interaction.signal?.aborted)
+            throw new Error("Login aborted");
+        const polled = await postJsonObject(provider.deviceTokenUrl, { device_auth_id: deviceAuthId, user_code: userCode }, interaction.signal);
+        if (polled.ok) {
+            authorizationCode = typeof polled.payload.authorization_code === "string" ? polled.payload.authorization_code : "";
+            codeVerifier = typeof polled.payload.code_verifier === "string" ? polled.payload.code_verifier : "";
+            if (!authorizationCode || !codeVerifier)
+                throw new Error(`Invalid OpenAI Codex device token response: ${JSON.stringify(polled.payload)}`);
+            break;
+        }
+        const errorCode = nestedOAuthErrorCode(polled.payload);
+        if (polled.status === 403 || polled.status === 404 || errorCode === "deviceauth_authorization_pending") {
+            await sleep(waitMs);
+            continue;
+        }
+        if (errorCode === "slow_down") {
+            waitMs += 5000;
+            await sleep(waitMs);
+            continue;
+        }
+        throw new Error(`OpenAI Codex device authorization failed (${polled.status}): ${polled.text.slice(0, 200)}`);
+    }
+    if (!authorizationCode || !codeVerifier)
+        throw new Error("OpenAI Codex device login timed out. Please try again.");
+    const payload = await postToken(provider.tokenUrl, provider.tokenEncoding, {
+        grant_type: "authorization_code",
+        client_id: provider.clientId,
+        code: authorizationCode,
+        code_verifier: codeVerifier,
+        redirect_uri: "https://auth.openai.com/deviceauth/callback",
+    });
+    return tokensFrom(provider, payload);
+}
 // --- Public API --------------------------------------------------------------
 /** Provider ids Bivy can natively drive a subscription login for. */
 export { isNativeOAuthProvider, nativeOAuthProviderIds } from "./model-oauth-providers.js";
@@ -312,7 +394,9 @@ export async function loginModelOAuth(credsDir, providerId, interaction, label =
     const provider = getModelOAuthProvider(providerId);
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
-    const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
+    const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction)
+        : provider.flow === "openai_codex_device_code" ? await loginOpenAICodexDeviceCode(provider, interaction)
+            : await loginAuthCode(provider, interaction);
     const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
     await createCredentialVault(credsDir).modifyRecord(providerId, label, async () => credential);
 }

package/dist/runtime/pi-oauth.js

@@ -11,6 +11,7 @@
 import path from "node:path";
 import { createCredentialVault } from "./credential-store.js";
 import { isNativeOAuthProvider } from "./oauth/model-oauth-providers.js";
+import { selectedCredentialStore } from "../credentials/selected-store.js";
 /** Adapt Bivy's store to pi-ai's structurally-identical CredentialStore for injection. */
 export function piCredentialStore(store) {
     return store;
@@ -26,7 +27,7 @@ export async function createPiModelRuntime(opts) {
     const store = opts.store ?? createCredentialVault(opts.credsDir);
     const { ModelRuntime } = await import("@earendil-works/pi-coding-agent");
     return ModelRuntime.create({
-        credentials: piCredentialStore(store),
+        credentials: piCredentialStore(selectedCredentialStore(store, opts.credsDir, { workspace: opts.workspace })),
         modelsPath: path.join(opts.piDir, "models.json"),
         allowModelNetwork: opts.allowModelNetwork ?? false,
     });

package/dist/session/run-terminal.js

@@ -345,12 +345,14 @@ export function createRunTerminals(deps) {
         const discover = SESSION_DISCOVERY_BY_AGENT[agent];
         if (!discover)
             return undefined;
-        for (let attempt = 0; attempt < TAKEOVER_DISCOVERY_ATTEMPTS; attempt++) {
+        const attempts = Math.max(1, Math.floor(deps.takeoverDiscoveryAttempts ?? TAKEOVER_DISCOVERY_ATTEMPTS));
+        const delayMs = Math.max(0, Math.floor(deps.takeoverDiscoveryDelayMs ?? TAKEOVER_DISCOVERY_DELAY_MS));
+        for (let attempt = 0; attempt < attempts; attempt++) {
             const ref = await discover(workspace, createdAt);
             if (ref)
                 return ref;
-            if (attempt + 1 < TAKEOVER_DISCOVERY_ATTEMPTS) {
-                await new Promise((resolve) => setTimeout(resolve, TAKEOVER_DISCOVERY_DELAY_MS));
+            if (delayMs > 0 && attempt + 1 < attempts) {
+                await new Promise((resolve) => setTimeout(resolve, delayMs));
             }
         }
         return undefined;

package/dist/terminal.js

@@ -196,6 +196,8 @@ export class TerminalManager {
             env,
         });
         const now = Date.now();
+        let resolveExit;
+        const exitPromise = new Promise((resolve) => { resolveExit = resolve; });
         const entry = {
             proc,
             workspace: options.workspace,
@@ -209,6 +211,8 @@ export class TerminalManager {
             flushTimer: null,
             closed: false,
             onData: options.onData,
+            exitPromise,
+            resolveExit,
         };
         // Register the opener as a sized client so a later, smaller client shrinks
         // the PTY to the min of the two rather than clobbering the opener's size.
@@ -269,7 +273,12 @@ export class TerminalManager {
             flush();
             entry.closed = true;
             this.terminals.delete(id);
-            options.onExit(exitCode, signal, entry.buffer);
+            try {
+                options.onExit(exitCode, signal, entry.buffer);
+            }
+            finally {
+                entry.resolveExit();
+            }
         });
         return id;
     }
@@ -347,6 +356,19 @@ export class TerminalManager {
         const entry = this.terminals.get(id);
         if (!entry)
             return false;
+        this.closeEntry(id, entry);
+        return true;
+    }
+    /** Close a terminal and wait for the underlying PTY process to report exit. */
+    async closeAndWait(id, timeoutMs = 2000) {
+        const entry = this.terminals.get(id);
+        if (!entry)
+            return false;
+        this.closeEntry(id, entry);
+        await waitForExit(entry.exitPromise, timeoutMs);
+        return true;
+    }
+    closeEntry(id, entry) {
         this.terminals.delete(id);
         // Drop any queued output — the client asked to close, so don't emit a
         // trailing batch (which would fire onData for a terminal it has torn down).
@@ -363,7 +385,6 @@ export class TerminalManager {
         catch {
             // already gone
         }
-        return true;
     }
     has(id) {
         return this.terminals.has(id);
@@ -421,6 +442,28 @@ export class TerminalManager {
         for (const id of [...this.terminals.keys()])
             this.close(id);
     }
+    /** Kill every terminal and wait for node-pty to release its child handles. */
+    async disposeAllAndWait(timeoutMs = 2000) {
+        const exits = [];
+        for (const [id, entry] of [...this.terminals]) {
+            this.closeEntry(id, entry);
+            exits.push(waitForExit(entry.exitPromise, timeoutMs));
+        }
+        await Promise.all(exits);
+    }
+}
+async function waitForExit(exitPromise, timeoutMs) {
+    let timer;
+    try {
+        await Promise.race([
+            exitPromise,
+            new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
 }
 function clampDim(value, fallback) {
     const n = Math.floor(Number(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.17",
+  "version": "0.16.18-staging.10",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",