@bivy/bivy 0.16.25-staging.39 → 0.16.25-staging.40

package/dist/automation-cli.js

@@ -10,6 +10,8 @@ import { PairingStore } from "./device-registry.js";
 import { NodeIdentity } from "./identity.js";
 import { seal } from "./e2e.js";
 import { readNodeConfig } from "./node-config.js";
+import { encodeAutomationTemplate } from "./automation-template.js";
+import { AutomationFilterError, runAutomationFilter, webhookFilterInput } from "./automation-filter.js";
 import { loadProjectPolicy, resolveProjectSafety } from "./project-policy.js";
 function value(args, flag) {
     const exact = args.indexOf(flag);
@@ -29,6 +31,7 @@ Commands:
   validate [path]             Parse and validate without network access
   plan [path] [--json]        Show triggers, routing, and effective safety
   test [path] --event <file>  Simulate an event and explain the first match
+  test-filter [path] --id <key> --event <json>  Execute a trusted filter locally
   apply [path] [--prune]      Encrypt instructions and reconcile the control plane
 
 Run commands (normally invoked as 'bivy runs ...'):
@@ -53,7 +56,7 @@ ciphertext only.`);
 function configPath(args) {
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
-        if (arg === "--event") {
+        if (arg === "--event" || arg === "--id") {
             i += 1;
             continue;
         }
@@ -194,7 +197,7 @@ function appliedInput(entry, configOrder, nodeId, nodeName, roomKey) {
         name: entry.name,
         enabled: entry.enabled,
         trigger: entry.trigger,
-        templateCiphertext: `bivy-room-v1:${nodeId}:${seal(roomKey, entry.instructions)}`,
+        templateCiphertext: `bivy-room-v1:${nodeId}:${seal(roomKey, encodeAutomationTemplate(entry.instructions, {}, entry.filter))}`,
         schedule: entry.schedule,
         repo: entry.repo,
         repos: entry.repos,
@@ -405,6 +408,7 @@ async function main() {
                 id: a.id, action: "reconcile", enabled: a.enabled, trigger: a.trigger,
                 route: { node: a.routing.node ?? "applying node", agent: a.routing.agent ?? "node default", model: a.routing.model ?? "agent default", ephemeral: a.routing.ephemeral ?? false },
                 safety: { approval: safety.approval, sandbox: safety.sandbox, requestedApproval: a.safety.approval, requestedSandbox: a.safety.sandbox, maxAttempts: a.safety.maxAttempts, checks: a.trigger === "schedule" || a.trigger === "webhook" || a.trigger === "github" || a.trigger === "linear" ? "project test/lint/typecheck when declared" : "project defaults" },
+                filter: a.filter,
                 workspace: a.repo ?? (a.repos?.length ? a.repos.join(", ") : "from event"),
             };
         });
@@ -416,10 +420,27 @@ async function main() {
                 console.log(`  route   ${item.route.node} · ${item.route.agent} · ${item.route.model}${item.route.ephemeral ? " · ephemeral" : ""}`);
                 console.log(`  safety  ${item.safety.sandbox} · approvals ${item.safety.approval} · at most ${item.safety.maxAttempts} attempt(s)`);
                 console.log(`  checks  ${item.safety.checks}`);
+                if (item.filter)
+                    console.log(`  filter  ${JSON.stringify(item.filter.command)} in ${item.filter.cwd} (${item.filter.timeoutSeconds}s)`);
             }
         }
         return;
     }
+    if (command === "test-filter") {
+        const id = value(args, "--id");
+        const eventFile = value(args, "--event");
+        if (!id || !eventFile)
+            throw new Error("--id <automation-key> and --event <payload.json> are required");
+        const entry = config.automations.find(a => a.id === id);
+        if (!entry?.filter)
+            throw new Error(`No filter configured for ${id}`);
+        const payload = JSON.parse(fs.readFileSync(path.resolve(eventFile), "utf8"));
+        const result = await runAutomationFilter(entry.filter, webhookFilterInput(payload, "local-test"));
+        if (result.diagnostics)
+            process.stderr.write(result.diagnostics);
+        console.log(JSON.stringify({ decision: result.decision, ...(result.reason === undefined ? {} : { reason: result.reason }) }));
+        return;
+    }
     if (command === "test") {
         const eventFile = value(args, "--event");
         if (!eventFile)
@@ -437,7 +458,7 @@ async function main() {
             return;
         }
         const a = result.matched;
-        console.log(`\nWould run ${a.name}`);
+        console.log(`\nWould run ${a.name}${a.filter ? " (subject to filter; use test-filter to execute it)" : ""}`);
         console.log(`  node: ${a.routing.node ?? "applying node"}`);
         console.log(`  agent: ${a.routing.agent ?? "node default"}`);
         const safety = effectiveSafety(a, file);
@@ -497,6 +518,8 @@ async function main() {
     throw new Error(`Unknown automation command: ${command}`);
 }
 main().catch((error) => {
+    if (error instanceof AutomationFilterError && error.diagnostics)
+        process.stderr.write(error.diagnostics);
     console.error(`Automation error: ${error instanceof Error ? error.message : String(error)}`);
     process.exit(1);
 });

package/dist/automation-config.js

@@ -8,6 +8,7 @@
  */
 import { parse as parseYaml } from "yaml";
 import { matchFirst } from "./automation/index.js";
+import { parseAutomationFilter } from "./automation-template.js";
 export const AUTOMATION_CONFIG_VERSION = 1;
 export const DEFAULT_AUTOMATION_CONFIG_PATH = ".bivy/automations.yaml";
 const GITHUB_EVENTS = new Set(["issues", "issue_comment", "pull_request", "pull_request_review_comment", "workflow_run"]);
@@ -110,7 +111,7 @@ function parseEntry(value, index, errors, warnings) {
         errors.push(`${at} must be an object`);
         return undefined;
     }
-    rejectUnknown(o, ["id", "name", "enabled", "instructions", "trigger", "schedule", "repo", "repos", "labels", "on", "routing", "safety"], at, errors);
+    rejectUnknown(o, ["id", "name", "enabled", "instructions", "trigger", "schedule", "repo", "repos", "labels", "on", "routing", "safety", "filter"], at, errors);
     const id = typeof o.id === "string" ? o.id.trim() : "";
     const name = typeof o.name === "string" ? o.name.trim() : "";
     const instructions = typeof o.instructions === "string" ? o.instructions.trim() : "";
@@ -144,6 +145,17 @@ function parseEntry(value, index, errors, warnings) {
         warnings.push(`${id || at}: GitHub trigger has no on rules; it will use the default bivy label contract`);
     if (trigger !== "github" && on)
         errors.push(`${at}.on is only valid for github triggers`);
+    let filter;
+    if (o.filter !== undefined) {
+        try {
+            filter = parseAutomationFilter(o.filter);
+        }
+        catch (error) {
+            errors.push(`${at}.${error.message}`);
+        }
+        if (trigger !== "webhook")
+            errors.push(`${at}.filter is only valid for webhook triggers`);
+    }
     const routingRaw = o.routing === undefined ? {} : obj(o.routing);
     if (!routingRaw)
         errors.push(`${at}.routing must be an object`);
@@ -184,7 +196,7 @@ function parseEntry(value, index, errors, warnings) {
     if (!id || !name || !instructions || !trigger)
         return undefined;
     return {
-        id, name, enabled: o.enabled !== false, instructions, trigger, schedule, repo, repos, labels, on,
+        id, name, enabled: o.enabled !== false, instructions, trigger, schedule, repo, repos, labels, on, filter,
         routing: {
             node,
             agent: typeof routing.agent === "string" ? routing.agent.trim() || undefined : undefined,

package/dist/automation-filter-gate.js

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { AutomationFilterError, runAutomationFilter, webhookFilterInput } from "./automation-filter.js";
+/** Returns false for an intentional skip; failures park the run, never start an agent. */
+export async function passWebhookFilter(filter, item, report, signal) {
+    let result;
+    try {
+        let payload;
+        try {
+            payload = JSON.parse(item.eventContext ?? "");
+        }
+        catch {
+            throw new AutomationFilterError("Webhook filter requires structured event context; manual runs without a payload are not supported");
+        }
+        result = await runAutomationFilter(filter, webhookFilterInput(payload, item.id), signal);
+    }
+    catch (error) {
+        const failure = error instanceof AutomationFilterError ? error : new AutomationFilterError("Invalid webhook filter configuration");
+        // Raw stderr stays on the node, not in control-plane evidence.
+        if (failure.diagnostics)
+            console.warn(`[automation-filter:${item.id}] ${failure.diagnostics}`);
+        throw failure;
+    }
+    if (result.diagnostics)
+        console.warn(`[automation-filter:${item.id}] ${result.diagnostics}`);
+    await report({
+        checks: [{ name: "webhook-filter", status: result.decision === "accept" ? "passed" : "skipped" }],
+        events: [{ at: new Date().toISOString(), kind: "checkpoint",
+                summary: `Webhook filter ${result.decision === "accept" ? "accepted" : "skipped"} delivery${result.reason ? `: ${result.reason}` : "."}`,
+            }],
+    });
+    return result.decision === "accept";
+}

package/dist/automation-filter.js

@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { spawn } from "node:child_process";
+import { parseAutomationFilter } from "./automation-template.js";
+export class AutomationFilterError extends Error {
+    diagnostics;
+    constructor(message, diagnostics = "") {
+        super(message);
+        this.diagnostics = diagnostics;
+        this.name = "AutomationFilterError";
+    }
+}
+/** The same input contract is used by local tests and live deliveries. No headers. */
+export function webhookFilterInput(payload, deliveryId) {
+    if (!payload || typeof payload !== "object")
+        throw new AutomationFilterError("Filter payload must be a JSON object or array");
+    return { version: 1, event: { type: "webhook", payload: payload }, delivery: { id: deliveryId } };
+}
+const INPUT_LIMIT = 256 * 1024;
+const OUTPUT_LIMIT = 16 * 1024;
+/** Trusted operator code, NOT a sandbox. No shell or inherited credentials. */
+export async function runAutomationFilter(config, input, signal) {
+    const filter = parseAutomationFilter(config);
+    if (signal?.aborted)
+        throw new AutomationFilterError("Filter cancelled");
+    const serialized = JSON.stringify(input);
+    if (Buffer.byteLength(serialized) > INPUT_LIMIT)
+        throw new AutomationFilterError("Filter input exceeds 256 KiB");
+    return new Promise((resolve, reject) => {
+        const child = spawn(filter.command[0], filter.command.slice(1), {
+            cwd: filter.cwd,
+            shell: false,
+            detached: process.platform !== "win32",
+            env: {
+                PATH: process.env.PATH ?? "/usr/bin:/bin",
+                ...(process.platform === "win32" && process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+                LANG: "C.UTF-8",
+            },
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = Buffer.alloc(0);
+        let stderr = Buffer.alloc(0);
+        let settled = false;
+        const kill = () => {
+            try {
+                if (process.platform !== "win32" && child.pid)
+                    process.kill(-child.pid, "SIGKILL");
+                else
+                    child.kill("SIGKILL");
+            }
+            catch { /* already exited */ }
+        };
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            // Also reap descendants that outlive a successful parent.
+            kill();
+            child.stdin.destroy();
+            child.stdout.destroy();
+            child.stderr.destroy();
+        };
+        const fail = (message) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(new AutomationFilterError(message, stderr.toString("utf8")));
+        };
+        const abort = () => fail("Filter cancelled");
+        const timer = setTimeout(() => fail(`Filter timed out after ${filter.timeoutSeconds}s`), filter.timeoutSeconds * 1000);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        child.on("error", () => fail("Could not start filter executable or open its working directory"));
+        // Early stdin closure is legal for filters that don't need the payload.
+        child.stdin.on("error", () => { });
+        child.stdout.on("data", (chunk) => {
+            if (stdout.length + chunk.length > OUTPUT_LIMIT) {
+                fail("Filter stdout exceeds 16 KiB");
+                return;
+            }
+            stdout = Buffer.concat([stdout, chunk]);
+        });
+        child.stderr.on("data", (chunk) => {
+            if (stderr.length + chunk.length > OUTPUT_LIMIT) {
+                fail("Filter stderr exceeds 16 KiB");
+                return;
+            }
+            stderr = Buffer.concat([stderr, chunk]);
+        });
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            if (code !== 0) {
+                fail(`Filter exited unsuccessfully (${code ?? "signal"})`);
+                return;
+            }
+            let data;
+            try {
+                data = JSON.parse(stdout.toString("utf8"));
+            }
+            catch {
+                fail("Filter stdout must be one JSON decision object");
+                return;
+            }
+            if (!data || typeof data !== "object" || Array.isArray(data) ||
+                Object.keys(data).some(key => !["decision", "reason"].includes(key)) ||
+                (data.decision !== "accept" && data.decision !== "skip") ||
+                (data.reason !== undefined && (typeof data.reason !== "string" || data.reason.length > 500))) {
+                fail("Filter output requires decision accept/skip and optional reason (at most 500 characters)");
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve({ decision: data.decision, reason: data.reason, diagnostics: stderr.toString("utf8") });
+        });
+        child.stdin.end(serialized);
+    });
+}

package/dist/automation-template.js

@@ -1,10 +1,23 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Wire format mirrored in src/automation-template.ts (node has no core dependency).
 const PREFIX = "bivy-automation-v1\n";
+export function parseAutomationFilter(value) {
+    const o = value;
+    if (!o || typeof o !== "object" || Array.isArray(o) ||
+        Object.keys(o).some(key => !["command", "cwd", "timeoutSeconds"].includes(key)) ||
+        !Array.isArray(o.command) || !o.command.length || o.command.length > 64 ||
+        o.command.some(arg => typeof arg !== "string" || arg.length > 4096 || arg.includes("\u0000")) ||
+        !o.command[0]?.trim() || typeof o.cwd !== "string" || o.cwd.length > 4096 ||
+        o.cwd.includes("\u0000") || !/^(\/|[A-Za-z]:[\\/])/.test(o.cwd) ||
+        (o.timeoutSeconds !== undefined && (!Number.isInteger(o.timeoutSeconds) || o.timeoutSeconds < 1 || o.timeoutSeconds > 60))) {
+        throw new Error("filter requires command (non-empty argv list), cwd (absolute trusted directory), and optional timeoutSeconds (1-60)");
+    }
+    return { command: [...o.command], cwd: o.cwd, timeoutSeconds: o.timeoutSeconds ?? 5 };
+}
 /** Account labels, never credentials, travel inside the encrypted template. */
-export function encodeAutomationTemplate(instructions, credentialLabels) {
-    return Object.keys(credentialLabels).length || instructions.startsWith(PREFIX)
-        ? PREFIX + JSON.stringify({ instructions, credentialLabels })
+export function encodeAutomationTemplate(instructions, credentialLabels, filter) {
+    return filter || Object.keys(credentialLabels).length || instructions.startsWith(PREFIX)
+        ? PREFIX + JSON.stringify({ instructions, credentialLabels, ...(filter ? { filter: parseAutomationFilter(filter) } : {}) })
         : instructions;
 }
 /** Legacy plaintext templates remain valid. Malformed structured templates fail closed. */
@@ -17,5 +30,6 @@ export function decodeAutomationTemplate(value) {
         Object.entries(data.credentialLabels).some(([provider, label]) => !provider.trim() || provider !== provider.trim().toLowerCase() || typeof label !== "string" || !label.trim())) {
         throw new Error("Invalid automation account selections");
     }
-    return { instructions: data.instructions, credentialLabels: data.credentialLabels };
+    return { instructions: data.instructions, credentialLabels: data.credentialLabels,
+        ...(data.filter === undefined ? {} : { filter: parseAutomationFilter(data.filter) }) };
 }

package/dist/control-plane-tasks.js

@@ -19,6 +19,7 @@
 import { randomUUID } from "node:crypto";
 import { WorkResultOutbox } from "./work-result-outbox.js";
 import { RemoteSessionAdmissionError } from "./session/remote-session-admission.js";
+import { AutomationFilterError } from "./automation-filter.js";
 /** True when every required tag is among this node's declared capabilities.
  * A node that fails this must never attempt to claim the item — the hard
  * block happens locally, before any claim race, so an ineligible node never
@@ -487,6 +488,19 @@ export class ControlPlaneTaskPoller {
                 }
                 if (run.state !== "active")
                     return;
+                // Filter errors are operator/configuration failures, never provider retries.
+                if (error instanceof AutomationFilterError) {
+                    const now = new Date().toISOString();
+                    await report({
+                        checks: [{ name: "webhook-filter", status: "failed" }],
+                        events: [{ at: now, kind: "needs_attention", summary: `Webhook filter failed: ${error.message}`, attempt }],
+                        attention: { severity: "warning", reason: `Webhook filter failed: ${error.message}`, since: now },
+                    });
+                    if (run.state !== "active")
+                        return;
+                    await this.finishWork(item.id, 'needs-attention', run);
+                    return;
+                }
                 // Deployment admission is not an agent failure. Never reroute/retry it
                 // through a provider policy or mark the work successfully completed.
                 if (error instanceof RemoteSessionAdmissionError) {

package/dist/server.js

@@ -41,6 +41,7 @@ import { ControlPlaneSessionLocationRegistry, LayeredSessionLocationRegistry } f
 import { attachAdoptedSessions, classifyAttachFailure } from "./runtime/adoption.js";
 import { createCredentialStore, testProviderCredential } from "./runtime/credentials.js";
 import { decodeAutomationTemplate } from "./automation-template.js";
+import { passWebhookFilter } from "./automation-filter-gate.js";
 import { isModelAuthError, authProviderForSession, classifyModelAuthError } from "./runtime/auth-errors.js";
 import { createCredentialVault, migrateVaultDir } from "./runtime/credential-store.js";
 import { probeAnthropicAccess } from "./runtime/anthropic-preflight.js";
@@ -5013,6 +5014,7 @@ async function executeWorkItem(item, report, signal) {
     // on issue/Slack/Linear bodies, so decrypt whenever it's present regardless of
     // source.
     let credentialLabels;
+    let filter;
     if (item.body?.startsWith("bivy-room-v1:")) {
         const [, nodeId, ...payload] = item.body.split(":");
         if (nodeId !== identity.nodeId || payload.length === 0) {
@@ -5021,12 +5023,17 @@ async function executeWorkItem(item, report, signal) {
         try {
             const template = decodeAutomationTemplate(open(pairingStore.roomKey(), payload.join(":")));
             credentialLabels = template.credentialLabels;
+            filter = template.filter;
             item = { ...item, body: template.instructions };
         }
         catch {
             throw new Error("could not decrypt automation instructions on this node");
         }
     }
+    // Gate before any repository fetch, session continuation, or agent creation.
+    // A skip finishes this selected automation; it does not fall through to another.
+    if (filter && !await passWebhookFilter(filter, item, report, signal))
+        return;
     // A webhook trigger's event payload is untrusted. Append it AFTER the operator's
     // own (decrypted) instructions, clearly framed as data, so the agent treats it
     // as context rather than as commands to follow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.25-staging.39",
+  "version": "0.16.25-staging.40",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",