@bivy/bivy 0.16.21-staging.2 → 0.16.21-staging.4

package/bin/bivy.mjs

@@ -5054,6 +5054,7 @@ ${c.bold("bivy")} — Bivy node CLI
   ${c.cyan("bivy login")}      Sign this machine into a Bivy account (GitHub or email)
   ${c.cyan("bivy logout")}     Sign this machine out (alias: signout)
   ${c.cyan("bivy provider login")}  Sign into a model provider (alias: model login)
+  ${c.cyan("bivy auth import")}     Import local Claude, Codex, or Grok logins into the vault
   ${c.cyan("bivy update")}     Update Bivy + install deps + restart service (waits for active sessions to finish a turn; --force to skip)
   ${c.cyan("bivy update:log")} Show output of the last (or in-progress) update
   ${c.cyan("bivy agent add")}        Connect an existing user-owned agent
@@ -5200,6 +5201,7 @@ Unlike 'bivy run', these commands operate on governed background Runs with check
       process.exit(await run(nodeBin, [...nodeScriptArgs(configEntry), ...args], { cwd: process.cwd(), env: process.env }));
       break;
     }
+    case "auth":
     case "credentials":
     case "creds": {
       if (!(await ensureDeps())) process.exit(1);

package/dist/controllers/credential-commands.js

@@ -9,10 +9,41 @@
 // the handful of daemon bits (credsDir, event emit, and the post-auth refresh /
 // provider-list helpers) as composition deps.
 import { testProviderCredential } from "../runtime/credentials.js";
+import { NativeAuthPreviewService } from "../runtime/native-auth-preview.js";
 import { exportAccountApiKeys, exportAccountOAuthCredentials, importAccountOAuthCredentials, exportRecordTombstones, listCredentialRecords, removeProviderCredential, setProviderApiKeyLabeled, setProviderReferenceLabeled, setCredentialSync, setCredentialUnattended, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, } from "../credentials/api.js";
 export function createCredentialCommands(deps) {
     const { credsDir } = deps;
+    const nativeAuth = new NativeAuthPreviewService(credsDir);
     return {
+        async "credentials.native.preview"(msg, ctx) {
+            try {
+                ctx.reply({ type: "credentials.native.preview.ok", requestId: msg.requestId, ...await nativeAuth.preview(msg.label) });
+            }
+            catch {
+                ctx.reply({ type: "credentials.native.preview.error", requestId: msg.requestId, httpStatus: 400, error: "Could not scan native logins. Check the label and machine permissions, then retry." });
+            }
+        },
+        async "credentials.native.import"(msg, ctx) {
+            try {
+                const result = await nativeAuth.import(msg.previewId, msg.agents, msg.sync);
+                if (result.items.some((item) => item.status === "imported")) {
+                    try {
+                        await deps.pushModelAuthToControlPlane();
+                        await deps.refreshSessionAfterAuth();
+                        deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
+                        deps.broadcast({ type: "providers.list", providers: await deps.listProvidersUnified() });
+                    }
+                    catch {
+                        result.warning = "Saved on this machine, but sync or runtime refresh could not be confirmed. Check machine connectivity.";
+                    }
+                }
+                ctx.reply({ type: "credentials.native.import.ok", requestId: msg.requestId, ...result });
+            }
+            catch {
+                // Filesystem/parse errors may include secrets; never return raw errors.
+                ctx.reply({ type: "credentials.native.import.error", requestId: msg.requestId, httpStatus: 400, error: "Import could not complete. Scan again and check the results before retrying; existing credentials will not be replaced." });
+            }
+        },
         async "credentials.list"() {
             deps.sendEvent({ type: "credentials.records", records: await listCredentialRecords(credsDir) });
         },

package/dist/credential-import-command.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { createCredentialVault } from "./runtime/credential-store.js";
+import { discoverNativeAuth, nativeAuthSources } from "./runtime/native-auth-import.js";
+import { normalizeLabel } from "./credentials/records.js";
+export async function importNativeAuthCommand(credsDir, args) {
+    let sync;
+    let yes = false;
+    let dryRun = false;
+    let label = "default";
+    const agents = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--yes")
+            yes = true;
+        else if (arg === "--dry-run")
+            dryRun = true;
+        else if (arg === "--sync") {
+            const value = args[++i];
+            if (value !== "node" && value !== "account")
+                throw new Error("--sync requires node or account");
+            sync = value;
+        }
+        else if (arg === "--label") {
+            const value = args[++i];
+            if (!value?.trim() || value.startsWith("--"))
+                throw new Error("--label requires a name");
+            label = normalizeLabel(value);
+        }
+        else if (Object.hasOwn(nativeAuthSources, arg))
+            agents.push(arg);
+        else
+            throw new Error("Usage: bivy auth import [claude codex grok] [--sync node|account] [--label name] [--yes] [--dry-run]");
+    }
+    const selected = [...new Set(agents.length ? agents : Object.keys(nativeAuthSources))];
+    const found = selected.map(discoverNativeAuth);
+    const vault = createCredentialVault(credsDir);
+    const candidates = [];
+    for (const item of found) {
+        if (item.status !== "found") {
+            console.log(`${item.agent}: ${item.status} credential file (keychain-only logins are not supported).`);
+            continue;
+        }
+        const existing = await vault.readRecord(item.provider, label);
+        console.log(`${item.agent}: ${item.provider}:${label} (${item.credential.type === "oauth" ? "OAuth" : "API key"})${existing ? " — skipped: slot already exists; use --label to keep both" : " — ready to import"}`);
+        if (!existing)
+            candidates.push(item);
+    }
+    console.log("Subscription logins work only with compatible providers/runtimes; access has not been verified.");
+    console.log("Native logins are left unchanged. Concurrent OAuth refresh by native CLIs or other machines may require re-login.");
+    if (dryRun || !candidates.length)
+        return;
+    if (!stdin.isTTY && (!yes || !sync))
+        throw new Error("Non-interactive import requires --yes and --sync node|account. Use --dry-run to preview.");
+    if (yes && !sync)
+        throw new Error("--yes requires an explicit --sync node|account.");
+    if (!yes) {
+        const rl = createInterface({ input: stdin, output: stdout });
+        try {
+            if (!sync) {
+                const answer = (await rl.question("Store on this node, or E2E sync across your account nodes? [node/account] (node): ")).trim().toLowerCase();
+                if (answer && answer !== "node" && answer !== "account")
+                    throw new Error("Expected node or account; nothing imported.");
+                sync = answer === "account" ? "account" : "node";
+            }
+            const answer = await rl.question(`Import ${candidates.length} credential(s), scope ${sync}? [y/N] `);
+            if (!/^y(es)?$/i.test(answer.trim())) {
+                console.log("Cancelled; nothing imported.");
+                return;
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    for (const item of candidates) {
+        const inserted = await vault.putRecordIfAbsent({
+            provider: item.provider, label, origin: "agent-native", sync: sync,
+            source: { kind: "stored", cred: item.credential },
+        });
+        console.log(`${item.provider}:${label}: ${inserted ? `imported (${sync})` : "skipped: slot changed during import"}.`);
+    }
+    console.log(sync === "account"
+        ? "Eligible for E2E account sync when the enrolled Bivy daemon is running; delivery is not yet confirmed."
+        : "Stored locally. Use 'bivy credentials sync <provider> <label> account' to enable account sync later.");
+    if (label !== "default")
+        console.log("Select this label with 'bivy credentials preset set <preset> <provider> <label>' and 'bivy credentials preset use <preset>'.");
+    console.log("Agent-managed auth is unchanged; compatible runtimes must use Bivy-managed auth to consume the vault.");
+}

package/dist/credentials/store.js

@@ -351,18 +351,28 @@ export class BivyCredentialStore {
      * `importRecords()` (merge) for ingest/sync, where a fresher local login must win.
      */
     async putRecord(record) {
+        await this.writeRecord(record, false);
+    }
+    /** Import only into an empty slot; the existence check shares the vault lock. */
+    async putRecordIfAbsent(record) {
+        return this.writeRecord(record, true);
+    }
+    async writeRecord(record, ifAbsent) {
         const id = providerId(record.provider);
         if (!id)
             throw new Error("Provider is required");
         const label = normalizeLabel(record.label);
         const key = credKey(id, label);
-        await this.enqueue(id, async () => {
+        return this.enqueue(id, async () => {
             await this.acquireLock();
             try {
                 const document = this.readDocument();
+                if (ifAbsent && document.credentials[key])
+                    return false;
                 document.credentials[key] = { ...record, provider: id, label, updatedAt: Date.now() };
                 delete document.deletedAt[key];
                 this.writeDocument(document);
+                return true;
             }
             finally {
                 await this.releaseLock();

package/dist/credentials-cli.js

@@ -13,6 +13,7 @@ import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 import { listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, setCredentialSync, getCredentialPresets, setActiveCredentialPreset, setCredentialPresetMapping, getCredentialIngestPolicy, setCredentialIngestPolicy, } from "./credentials/api.js";
 import { defaultPresetsPath, inferReferenceBackend } from "./credentials/index.js";
+import { importNativeAuthCommand } from "./credential-import-command.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, "..");
 const appDir = process.env.BIVY_DATA_DIR ?? path.join(repoRoot, ".bivy");
@@ -35,6 +36,9 @@ Presets (which labeled key a project uses):
   bivy credentials preset clear <name> <provider>    Remove a provider's mapping from a preset
 
 Agent-native logins:
+  bivy auth import [claude codex grok] [--sync node|account] [--label name] [--yes] [--dry-run]
+                                                     Import local credential files (alias: credentials import).
+                                                     Preview first; existing slots are never replaced.
   bivy credentials ingest [merge|separate]           Show or set the ingest policy
 
 Config file (${path.relative(process.cwd(), configPath) || configPath}):
@@ -199,6 +203,7 @@ async function main() {
         return;
     }
     switch (command) {
+        case "import": return importNativeAuthCommand(credsDir, args);
         case "list": return cmdList();
         case "add": return cmdAdd(args[0], args[1], args[2]);
         case "remove":

package/dist/protocol/client-command-routes.js

@@ -3,6 +3,8 @@
 /** Direct-mode adapters for operations whose canonical implementation is the
  * client command registry. Relay and HTTP now differ only in framing. */
 export const CLIENT_COMMAND_ROUTES = [
+    { method: "post", path: "/api/auth/credentials/native-preview", kind: "credentials.native.preview" },
+    { method: "post", path: "/api/auth/credentials/native-import", kind: "credentials.native.import" },
     { method: "post", path: "/api/session/pause", kind: "session.pause" },
     { method: "post", path: "/api/session/resume", kind: "session.resume" },
     { method: "post", path: "/api/session/question/answer", kind: "session.question.answer" },

package/dist/protocol/client-command-schemas.js

@@ -8,6 +8,13 @@ const optionalSession = { sessionId: Type.Optional(Type.String()) };
  * this table remains migration-compatible; adding validation is one data row. */
 export const CLIENT_COMMAND_SCHEMAS = {
     ping: Type.Object(request),
+    "credentials.native.preview": Type.Object({ ...request, label: Type.Optional(Type.String({ maxLength: 100 })) }),
+    "credentials.native.import": Type.Object({
+        ...request,
+        previewId: Type.String({ minLength: 1, maxLength: 100 }),
+        agents: Type.Array(Type.Union([Type.Literal("claude"), Type.Literal("codex"), Type.Literal("grok")]), { minItems: 1, maxItems: 3, uniqueItems: true }),
+        sync: Type.Union([Type.Literal("node"), Type.Literal("account")]),
+    }),
     "attachment.fetch": Type.Object({ ...request, hash: Type.String() }),
     "session.pause": Type.Object(session),
     "session.resume": Type.Object(session),

package/dist/runtime/native-auth-import.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// Explicit native-login discovery. Reading never changes the source login.
+import fs from "node:fs";
+import path from "node:path";
+import { claudeCredentialFiles } from "./anthropic-preflight.js";
+import { resolveCodexHome } from "./codex-auth.js";
+import { resolveGrokHome } from "./grok-auth.js";
+import { claudeAuthToCredential, codexAuthToCredential, grokAuthToCredential } from "./credential-ingest.js";
+export const nativeAuthSources = {
+    claude: { files: claudeCredentialFiles, map: claudeAuthToCredential },
+    codex: { files: () => [path.join(resolveCodexHome(), "auth.json")], map: codexAuthToCredential },
+    grok: { files: () => [path.join(resolveGrokHome(), "auth.json")], map: grokAuthToCredential },
+};
+export function discoverNativeAuth(agent) {
+    const source = nativeAuthSources[agent];
+    let status = "missing";
+    for (const file of source.files()) {
+        try {
+            const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+            const mapped = source.map(raw);
+            if (mapped)
+                return { agent, status: "found", provider: mapped.providerId, credential: mapped.credential };
+            status = "unsupported";
+        }
+        catch (error) {
+            // Never report raw parse errors: they can contain credential material.
+            if (error.code !== "ENOENT")
+                status = "unreadable";
+        }
+    }
+    return { agent, status };
+}

package/dist/runtime/native-auth-preview.js

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { createHash, randomUUID } from "node:crypto";
+import { createCredentialVault } from "./credential-store.js";
+import { discoverNativeAuth, nativeAuthSources } from "./native-auth-import.js";
+import { normalizeLabel } from "../credentials/records.js";
+const fingerprint = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** Bounded, expiring previews. No tokens or token hashes are sent to the browser.
+ * Confirmation re-reads the source, refusing logins changed since the preview. */
+export class NativeAuthPreviewService {
+    credsDir;
+    previews = new Map();
+    constructor(credsDir) {
+        this.credsDir = credsDir;
+    }
+    async preview(rawLabel) {
+        if (rawLabel !== undefined && (typeof rawLabel !== "string" || rawLabel.length > 100))
+            throw new Error("Invalid credential label.");
+        const label = normalizeLabel(rawLabel);
+        const vault = createCredentialVault(this.credsDir);
+        const items = [];
+        const fingerprints = new Map();
+        for (const agent of Object.keys(nativeAuthSources)) {
+            const found = discoverNativeAuth(agent);
+            if (found.status !== "found") {
+                items.push({ agent, status: found.status });
+                continue;
+            }
+            const conflict = Boolean(await vault.readRecord(found.provider, label));
+            items.push({ agent, provider: found.provider, kind: found.credential.type, status: conflict ? "conflict" : "ready" });
+            if (!conflict)
+                fingerprints.set(agent, fingerprint(found));
+        }
+        for (const [id, entry] of this.previews)
+            if (entry.expires < Date.now())
+                this.previews.delete(id);
+        if (this.previews.size >= 32)
+            this.previews.delete(this.previews.keys().next().value);
+        const previewId = randomUUID();
+        this.previews.set(previewId, { label, expires: Date.now() + 5 * 60_000, fingerprints });
+        return { previewId, label, items };
+    }
+    async import(previewId, agents, sync) {
+        if (sync !== "node" && sync !== "account")
+            throw new Error("Choose node or account availability.");
+        const preview = typeof previewId === "string" ? this.previews.get(previewId) : undefined;
+        if (!preview || preview.expires < Date.now())
+            throw new Error("Preview expired or belongs to another machine. Scan again.");
+        if (!Array.isArray(agents) || !agents.length || agents.length > 3 || agents.some((agent) => !preview.fingerprints.has(agent)))
+            throw new Error("Select logins from the preview.");
+        this.previews.delete(previewId);
+        const vault = createCredentialVault(this.credsDir);
+        const items = [];
+        for (const agent of new Set(agents)) {
+            const found = discoverNativeAuth(agent);
+            if (found.status !== "found" || fingerprint(found) !== preview.fingerprints.get(agent)) {
+                items.push({ agent, status: "changed" });
+                continue;
+            }
+            const inserted = await vault.putRecordIfAbsent({ provider: found.provider, label: preview.label,
+                sync, origin: "agent-native", source: { kind: "stored", cred: found.credential } });
+            items.push({ agent, status: inserted ? "imported" : "conflict" });
+        }
+        return { items };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.21-staging.2",
+  "version": "0.16.21-staging.4",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",