@bivy/bivy 0.16.25-staging.19 → 0.16.25-staging.20

package/dist/hosted-custody.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// One pure policy decision: does THIS daemon hold only control-plane-custodied
+// credentials (the separately escrowed unattended snapshot), or is it a normal
+// personal node that owns its vault?
+//
+// The distinction matters everywhere model-auth sync branches: a custody node
+// never pushes/pulls the account vault, never publishes the unattended escrow,
+// and treats the control plane's filtered snapshot as an authoritative set
+// (reconcile deletes what a newer snapshot omits). Getting this wrong on a
+// personal node silently breaks credential sync AND makes the unattended-runs
+// toggle a no-op — the "Allowed — encrypted cloud copy enabled" UI then lies,
+// and every Bivy Cloud session fails with "credential didn't reach Bivy Cloud".
+/**
+ * True when this daemon must run with hosted-custody semantics:
+ *  - `BIVY_HOSTED_CREDENTIAL_CUSTODY` — the dedicated flag the provisioner sets
+ *    on managed (Bivy Cloud) machines; always authoritative.
+ *  - `BIVY_GITHUB_HOSTED_TASKS` + `BIVY_EPHEMERAL` — back-compat for
+ *    provisioned user-owned queue runners that predate the dedicated flag.
+ *
+ * `BIVY_GITHUB_HOSTED_TASKS` ALONE is not custody: it is persisted onto any
+ * long-lived personal node when a GitHub App is connected (it only means "poll
+ * the hosted task queue"). Such a node owns its own logins and must keep full
+ * personal-vault semantics — account sync, escrow publishing, loud toggles.
+ */
+export function hostedCustodyNode(env = process.env) {
+    if (env.BIVY_HOSTED_CREDENTIAL_CUSTODY)
+        return true;
+    return Boolean(env.BIVY_GITHUB_HOSTED_TASKS && env.BIVY_EPHEMERAL);
+}

package/dist/server.js

@@ -80,6 +80,7 @@ import { forceAbortTurn } from "./session/abort-recovery.js";
 import { runRequiredAutomationChecks } from "./automation-checks.js";
 import { configToLegacySettings, mergeLegacyIntoNodeConfig, readNodeConfig, writeNodeConfig } from "./node-config.js";
 import { loadProjectPolicy, resolveProjectSafety } from "./project-policy.js";
+import { hostedCustodyNode } from "./hosted-custody.js";
 import { PolicyEngine } from "./policy/policy-engine.js";
 import { SessionAllowRules } from "./policy/session-allow.js";
 import { TerminalManager } from "./terminal.js";
@@ -3079,7 +3080,11 @@ const hostedImportedRecordsPath = path.join(appDir, "model-auth-hosted-records.j
 let lastPushedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthCiphertext = "";
 let lastPushedHostedModelAuthRevision = -1;
-const isHostedCustodyNode = () => Boolean(process.env.BIVY_HOSTED_CREDENTIAL_CUSTODY || process.env.BIVY_GITHUB_HOSTED_TASKS);
+// Custody semantics are keyed on the dedicated flag (plus an ephemeral
+// back-compat case) — see src/hosted-custody.ts. A persistent personal node
+// that polls the hosted GitHub queue is NOT a custody guest: it owns its
+// logins and must keep account sync and unattended-escrow publishing.
+const isHostedCustodyNode = () => hostedCustodyNode();
 function readLocalModelAuthVaultKey() {
     try {
         const parsed = JSON.parse(fs.readFileSync(modelAuthVaultKeyPath, "utf8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.25-staging.19",
+  "version": "0.16.25-staging.20",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",