@bivy/bivy 0.16.18-staging.6 → 0.16.18-staging.7

package/dist/agents/pi/runtime.js

@@ -423,7 +423,7 @@ export class PiRuntime {
                 modelsPath: path.join(piDir, "models.json"),
                 allowModelNetwork,
             })
-            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork });
+            : await createPiModelRuntime({ credsDir, piDir, allowModelNetwork, workspace: sessionManager.getCwd() || options.workspace });
         const backgroundShells = new BackgroundShellTracker();
         const createRuntime = async ({ cwd, agentDir, sessionManager, sessionStartEvent }) => {
             const sessionId = sessionManager.getSessionId();

package/dist/credentials/resolver.js

@@ -10,23 +10,12 @@
 //
 // This keeps Bivy's hot credential path decoupled from Pi: Pi is just another
 // agent that reads the same store.
-import path from "node:path";
 import { createCredentialVault } from "./store.js";
-import { resolveCredential } from "./records.js";
+import { selectCredential } from "./selection.js";
+export { projectIdsFromWorkspace } from "./selection.js";
 import { loadPresets, defaultPresetsPath } from "./presets.js";
 /** Refresh an OAuth token this many ms before it expires (clock-skew guard). */
 const OAUTH_REFRESH_SKEW_MS = 60_000;
-/** Stable project identifiers discoverable without importing repo/session code. */
-export function projectIdsFromWorkspace(workspace) {
-    const resolved = path.resolve(workspace);
-    const ids = new Set([resolved, path.basename(resolved)]);
-    for (const part of resolved.split(path.sep)) {
-        const split = part.indexOf("__");
-        if (split > 0 && split < part.length - 2)
-            ids.add(`${part.slice(0, split)}/${part.slice(split + 2)}`);
-    }
-    return [...ids];
-}
 /** Resolver over Bivy's credential store, with OAuth refresh-on-read via the bridge. */
 export class NodeCredentialResolver {
     credsDir;
@@ -59,14 +48,7 @@ export class NodeCredentialResolver {
         // than guessing.
         const records = await this.store.listRecords().catch(() => []);
         const presets = this.presets();
-        // Project assignments are ordinary preset mappings named `project:<id>`.
-        // Bivy-managed clones encode owner/repo as owner__repo in their workspace
-        // path; direct local workspaces also match their absolute path/basename.
-        const explicitProject = context?.project?.trim();
-        const workspace = context?.workspace?.trim();
-        const projectCandidates = [explicitProject, ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter((value) => Boolean(value));
-        const projectPreset = projectCandidates.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
-        const selection = resolveCredential(id, records, presets, { ...(projectPreset ? { preset: projectPreset } : {}), ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}) });
+        const selection = selectCredential(id, records, presets, context);
         if (!selection)
             return undefined;
         const source = selection.record.source;

package/dist/credentials/selected-store.js

@@ -0,0 +1,35 @@
+import { defaultPresetsPath, loadPresets } from "./presets.js";
+import { selectCredential } from "./selection.js";
+/** A provider-addressed view of the vault for consumers without labeled accounts.
+ * Resolve on every operation; never copy a work credential into the default slot.
+ * Refresh writes stay attached to the selected record's label and metadata.
+ */
+export function selectedCredentialStore(store, credsDir, context) {
+    const select = async (provider) => selectCredential(provider, await store.listRecords(), loadPresets(defaultPresetsPath(credsDir)), context)?.record;
+    return {
+        async read(provider) {
+            const record = await select(provider);
+            if (record?.source.kind !== "stored")
+                return undefined;
+            const { updatedAt: _updatedAt, ...credential } = record.source.cred;
+            return credential;
+        },
+        async list() {
+            const records = await store.listRecords();
+            const presets = loadPresets(defaultPresetsPath(credsDir));
+            return [...new Set(records.map((r) => r.provider))].flatMap((providerId) => {
+                const record = selectCredential(providerId, records, presets, context)?.record;
+                if (record?.source.kind !== "stored")
+                    return [];
+                const credential = record.source.cred;
+                return [{ providerId, type: credential.type, ...(credential.type === "oauth" ? { expiresAt: credential.expires } : {}) }];
+            });
+        },
+        async modify(provider, fn) {
+            const record = await select(provider);
+            if (!record)
+                throw new Error(`No account selected for ${provider}`);
+            return store.modifyRecord(provider, record.label, fn);
+        },
+    };
+}

package/dist/credentials/selection.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import path from "node:path";
+import { resolveCredential } from "./records.js";
+/** Stable project identifiers discoverable without importing repo/session code. */
+export function projectIdsFromWorkspace(workspace) {
+    const resolved = path.resolve(workspace);
+    const ids = new Set([resolved, path.basename(resolved)]);
+    for (const part of resolved.split(path.sep)) {
+        const split = part.indexOf("__");
+        if (split > 0 && split < part.length - 2)
+            ids.add(`${part.slice(0, split)}/${part.slice(split + 2)}`);
+    }
+    return [...ids];
+}
+export function selectCredential(provider, records, presets, context) {
+    const id = provider.trim().toLowerCase();
+    const workspace = context?.workspace?.trim();
+    const projects = [context?.project?.trim(), ...(workspace ? projectIdsFromWorkspace(workspace) : [])].filter(Boolean);
+    const projectPreset = projects.map((value) => `project:${value}`).find((name) => presets.presets?.[name]?.[id]);
+    return resolveCredential(id, records, presets, {
+        ...(projectPreset ? { preset: projectPreset } : {}),
+        ...(context?.preferLabel ? { preferLabel: context.preferLabel } : {}),
+    });
+}

package/dist/runtime/pi-oauth.js

@@ -11,6 +11,7 @@
 import path from "node:path";
 import { createCredentialVault } from "./credential-store.js";
 import { isNativeOAuthProvider } from "./oauth/model-oauth-providers.js";
+import { selectedCredentialStore } from "../credentials/selected-store.js";
 /** Adapt Bivy's store to pi-ai's structurally-identical CredentialStore for injection. */
 export function piCredentialStore(store) {
     return store;
@@ -26,7 +27,7 @@ export async function createPiModelRuntime(opts) {
     const store = opts.store ?? createCredentialVault(opts.credsDir);
     const { ModelRuntime } = await import("@earendil-works/pi-coding-agent");
     return ModelRuntime.create({
-        credentials: piCredentialStore(store),
+        credentials: piCredentialStore(selectedCredentialStore(store, opts.credsDir, { workspace: opts.workspace })),
         modelsPath: path.join(opts.piDir, "models.json"),
         allowModelNetwork: opts.allowModelNetwork ?? false,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.18-staging.6",
+  "version": "0.16.18-staging.7",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",