@bivy/bivy 0.16.25-staging.4 → 0.16.25-staging.41

package/README.md

@@ -206,6 +206,10 @@ answer questions, approve supported tool calls, or stop the agent.
 
 - Send screenshots, images, logs, and other files from your phone.
 - Download reports and artifacts the agent creates.
+- Publish [session apps](docs/apps.md) with web and CLI/TUI views using
+  `bivy app publish bivy.app.json`. Linked machines automatically discover web
+  preview delivery through Bivy's relay—no per-machine domains, certificates or
+  public ports. Terminal views use the existing connection.
 - Use voice input and read-aloud where supported; provider-backed voice may
   send audio or text to the selected provider.
 - Keep a native terminal workflow or use structured chat, depending on the agent.

package/bin/acp-shim.mjs

@@ -313,6 +313,13 @@ function onSessionUpdate(params) {
     if (!content) return "";
     if (typeof content === "string") return content;
     if (Array.isArray(content)) return content.map(textOf).join("");
+    // ACP's ToolCallContent wraps a ContentBlock: `{ type: "content", content:
+    // { type: "text", text } }`. Unwrap it (recursively) so a tool's real output
+    // — a command's stdout, a fetched document, a read's text — isn't dropped,
+    // which collapsed the tool_result to the bare status ("completed"). opencode
+    // and most spec-compliant ACP agents deliver tool output in this wrapped
+    // shape, so reading only the bare `{type:"text"}` form lost it in production.
+    if (content.type === "content" && content.content != null) return textOf(content.content);
     if (content.type === "text" && typeof content.text === "string") return content.text;
     if (typeof content.text === "string") return content.text;
     return "";

package/bin/agent-manifest.json

@@ -22,7 +22,7 @@
       "hidden": false,
       "supportTier": "supported",
       "certification": "release-tested",
-      "testedVersion": "1.18.30",
+      "testedVersion": "1.18.31",
       "headlessFlags": [
         "run",
         "-s"

package/bin/bivy.mjs

@@ -2418,6 +2418,57 @@ async function cmdAttach(args = []) {
   console.log(c.green(`Attached ${body.name} (${body.kind}, ${body.size} bytes) to the chat.`));
 }
 
+// Universal app publishing: every agent that can write JSON and run a command
+// uses the same contract. Relative static directories are manifest-relative.
+async function cmdApp(args = []) {
+  const [action, ...rest] = args;
+  if (!action || rest.some((arg) => arg === "--help" || arg === "-h") || ["help", "--help", "-h"].includes(action)) {
+    console.log(`Usage: bivy app publish <manifest.json> [--session <id>]
+       bivy app list [--session <id>]
+       bivy app remove <app-id> [--session <id>]
+
+Manifest: {"version":1,"name":"My app","views":[
+  {"kind":"web","name":"Website","source":{"kind":"service","port":3000}},
+  {"kind":"terminal","name":"Console","command":"bin/rails","args":["console"]}
+]}
+
+Static web source: {"kind":"static","directory":"./dist"}
+Publishing does not start commands. Open Apps in the session menu to view or run.
+Terminal commands run with the node user's permissions, not in a new sandbox.
+Web previews require operator setup; see docs/apps.md.`);
+    return;
+  }
+  if (!["publish", "list", "remove"].includes(action)) throw new Error("Unknown app command. Run bivy app --help.");
+  const sessionIndex = rest.indexOf("--session");
+  if (sessionIndex >= 0 && (!rest[sessionIndex + 1] || rest[sessionIndex + 1].startsWith("--"))) throw new Error("--session requires an id.");
+  const sessionId = resolveAttachSessionId({ sessionFlag: sessionIndex >= 0 ? rest[sessionIndex + 1] : undefined, env: process.env });
+  if (!sessionId) throw new Error("Set --session <id> or run inside a Bivy agent session.");
+  const positional = rest.filter((_, i) => i !== sessionIndex && (sessionIndex < 0 || i !== sessionIndex + 1));
+  if (positional.some((a) => a.startsWith("-")) || positional.length !== (action === "list" ? 0 : 1)) throw new Error("Invalid arguments. Run bivy app --help.");
+  const body = { sessionId };
+  if (action === "publish") {
+    const file = path.resolve(positional[0]);
+    if (fs.statSync(file).size > 64 * 1024) throw new Error("App manifest exceeds 64 KiB.");
+    const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!manifest || typeof manifest !== "object") throw new Error("App manifest must be a JSON object.");
+    if (Array.isArray(manifest.views)) for (const view of manifest.views) {
+      if (view?.kind === "web" && view.source?.kind === "static" && typeof view.source.directory === "string") {
+        view.source.directory = path.resolve(path.dirname(file), view.source.directory);
+      }
+    }
+    body.manifest = manifest;
+  } else if (action === "remove") body.appId = positional[0];
+  const config = loadConfig();
+  if (!(await ensureNodeRunning(config))) throw new Error("Could not reach the Bivy node.");
+  const token = await localDeviceToken(config);
+  const response = await fetch(`${url(config)}/api/apps/${action}`, {
+    method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify(body),
+  });
+  const result = await response.json();
+  if (!response.ok || result.error) throw new Error(result.error || `App command failed (${response.status}).`);
+  console.log(JSON.stringify(result, null, 2));
+}
+
 // Map a saved session's runtime id to the `bivy run` agent whose native CLI can
 // resume it in a terminal. Only agents with a real native resume qualify; other
 // runtimes (generic-cli, SDK-only) have no terminal resume and open in the web app.
@@ -5045,6 +5096,7 @@ ${c.bold("bivy")} — Bivy node CLI
   ${c.cyan("bivy token")}       Print a device token for this node (for 'bivy nodes add' elsewhere)
   ${c.cyan("bivy sessions")}     List recent sessions (live + saved) and resume one (alias: ls)
   ${c.cyan("bivy resume")} [n|id] Resume a session directly (default: most recent)
+  ${c.cyan("bivy app")}             Publish and list session apps (web and terminal views)
   ${c.cyan("bivy send <id>")} "..."  Send a prompt to an existing session and stream the reply
   ${c.cyan("bivy kill <id>")}    Stop a session/terminal (--delete also removes a saved session)
   ${c.cyan("bivy prune")}         Delete old sessions/workspaces/worktrees (--keep N, --older-than 7d, --dry-run)
@@ -5167,6 +5219,9 @@ An agent's own --help passes through, e.g. 'bivy run claude --help'.`);
     case "send":
       await cmdSend(args);
       break;
+    case "app":
+      await cmdApp(args);
+      break;
     case "attach":
       await cmdAttach(args);
       break;

package/bin/codex-app-server-shim.mjs

@@ -415,6 +415,16 @@ function onNotification(m) {
       bivy({ type: "session.status", status: "working" });
       return;
     case "turn/completed": {
+      // The completion event is authoritative about a terminal failure: a turn
+      // that hit a usage limit (or any provider error) arrives here as
+      // `status: "failed"` carrying `turn.error`. Capture it directly instead of
+      // depending on a separate `error` notification landing first — otherwise a
+      // completion that omits that notification seals as session.done and the
+      // user sees a silent empty turn (fail loud, never swallow the error).
+      const turnError =
+        params?.turn?.error?.message ||
+        (params?.turn?.status === "failed" ? params?.error?.message || params?.message || "Codex turn failed" : undefined);
+      if (turnError && !sawError) sawError = turnError;
       // Codex 0.147 can publish turn/completed just before the final
       // collabAgentToolCall item/completed notification. Sealing immediately
       // leaves the sub-agent card running forever and drops its persisted

package/bin/patch-pi-dependencies.mjs

@@ -37,8 +37,8 @@ const piPackage = findDependency(path.join("@earendil-works", "pi-coding-agent")
 if (!piPackage) process.exit(0);
 
 const patches = [
-  { name: "brace-expansion", version: "5.0.9" },
-  { name: "undici", version: "8.10.0" },
+  { name: "brace-expansion", version: "5.0.12" },
+  { name: "undici", version: "8.10.2" },
 ];
 
 for (const patch of patches) {

package/dist/agents/claude-code/integration.js

@@ -4,13 +4,21 @@ import { defineAgentIntegration } from "../definition.js";
 import { withExactCapabilitySurface } from "../../runtime/types.js";
 import { createCredentialStore } from "../../runtime/credentials.js";
 import { ClaudeCodeRuntime, claudeRuntimeFromEnv, claudeSdkInstalled, } from "./runtime.js";
-export const CLAUDE_TESTED_VERSION = "0.3.270";
+export const CLAUDE_TESTED_VERSION = "0.3.278";
 const CLAUDE_CAPABILITIES = withExactCapabilitySurface({
     toolInterception: true,
     modelSelection: true,
     packages: false,
     resume: true,
     fork: true,
+    // Must mirror ClaudeCodeRuntime.capabilities (runtime.ts): the catalog is a
+    // consumed source of truth (the fork-fidelity matrix and any fork-target
+    // fidelity preview read these), so under-reporting here makes Claude look
+    // like a seeded-only fork target when its runtime actually delivers a
+    // byte-exact same-runtime fork (forkTransport) and a full cross-runtime
+    // transcript replay INTO it (forkHistoryImport, via importHistoryForFork).
+    forkTransport: true,
+    forkHistoryImport: true,
     usageReporting: true,
     nativeSessionDiscovery: true,
     nativeSessionAdoption: true,

package/dist/agents/codex/integration.js

@@ -9,7 +9,7 @@ import { codexCredentialPreflight } from "../../runtime/codex-preflight.js";
 import { deleteCodexSession, discoverNativeCodexSessions, loadCodexTranscript, writeCodexRollout, exportCodexRollout, importCodexRollout, } from "../../runtime/codex-sessions.js";
 import { ProtocolRuntime } from "../../runtime/protocol.js";
 import { codexSlashCommands } from "../../runtime/slash-commands.js";
-export const CODEX_TESTED_VERSION = "0.154.0";
+export const CODEX_TESTED_VERSION = "0.155.1";
 const CODEX_AVAILABLE_CACHE = new Map();
 function codexCommand() {
     return process.env.BIVY_CODEX_BIN?.trim() || "codex";
@@ -146,6 +146,14 @@ export function codexIntegration(origin) {
                     resume: true,
                     packages: false,
                     fork: true,
+                    // Mirror the ProtocolRuntime this integration builds (createCodexRuntime
+                    // above wires exportForFork+importForFork and writeHistory, which flip
+                    // capabilities.forkTransport/forkHistoryImport on). The catalog is a
+                    // consumed source of truth (fork-fidelity matrix / fork-target preview),
+                    // so omitting these made Codex look seeded-only when its runtime does a
+                    // byte-exact codex→codex fork and a full transcript replay INTO it.
+                    forkTransport: true,
+                    forkHistoryImport: true,
                     usageReporting: true,
                     interactiveTui: installed,
                     nativeSessionDiscovery: true,

package/dist/agents/pi/integration.js

@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import { defineAgentIntegration } from "../definition.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
-export const PI_TESTED_VERSION = "0.85.1";
+export const PI_TESTED_VERSION = "0.86.1";
 export function piAgentDir() {
     return process.env.PI_CODING_AGENT_DIR?.trim() || path.join(os.homedir(), ".pi", "agent");
 }

package/dist/agents/pi/runtime.js

@@ -268,8 +268,29 @@ class PiSession {
      * reload. Async because that resolution reads the store.
      */
     async getModels() {
-        const models = await this.session.modelRuntime.getAvailable();
-        return models.map((model) => toModelInfo(model, true));
+        const runtime = this.session.modelRuntime;
+        try {
+            const models = await runtime.getAvailable();
+            return models.map((model) => toModelInfo(model, true));
+        }
+        catch (error) {
+            // The runtime's availability refresh is a Promise.all across every
+            // provider's auth check, so one broken provider (an unreachable custom
+            // endpoint, a single failing credential read) rejects the whole catalog
+            // and the picker shows nothing. Degrade to per-provider listing and
+            // skip only the broken ones; rethrow only when truly nothing survives.
+            const models = [];
+            for (const provider of runtime.getProviders()) {
+                try {
+                    for (const model of await runtime.getAvailable(provider.id))
+                        models.push(toModelInfo(model, true));
+                }
+                catch { /* this provider is broken — the rest still list */ }
+            }
+            if (models.length)
+                return models;
+            throw error instanceof Error ? error : new Error(String(error));
+        }
     }
     /**
      * Every model Pi knows about — built-in and custom, regardless of whether
@@ -281,7 +302,10 @@ class PiSession {
     async getAllModels() {
         const runtime = this.session.modelRuntime;
         // Refresh availability first so `hasConfiguredAuth` reflects current creds.
-        await runtime.getAvailable();
+        // Best-effort: a failed refresh (one broken provider rejects the shared
+        // Promise.all) must not blank the full catalog — the flags then reflect
+        // the last successful refresh, which the picker can still act on.
+        await runtime.getAvailable().catch(() => { });
         return runtime.getModels().map((model) => toModelInfo(model, runtime.hasConfiguredAuth(model.provider)));
     }
     /** Reload the projected models.json in-place so a live session immediately

package/dist/agents/profiles.js

@@ -43,7 +43,7 @@ export const AGENT_PROFILES = {
         // Approve/Deny + session/load resume + a real model picker), the same bar Pi,
         // Claude Code, and Codex clear. See `acp` below for the version fallback.
         supportTier: "supported",
-        testedVersion: "1.18.30",
+        testedVersion: "1.18.31",
         blurb: "The most widely used open-source coding harness (OpenCode CLI).",
         // `opencode run -s <id> "<prompt>"` continues a prior session by its own id
         // (`-s, --session  session id to continue`, per `opencode run --help`).
@@ -398,13 +398,21 @@ export const AGENT_PROFILES = {
             flag: "-m",
             models: [
                 // Official Grok CLI (1.x) advertises grok-4.6 as the default subscription
-                // model (verified against `grok models`); the older grok-4.5 / grok-4-latest
-                // / grok-code-fast-1 ids now return "unknown model id". Keep the list
-                // honest; operators can override with BIVY_GROK_MODELS if their install
-                // exposes more.
+                // model (verified against the authenticated `~/.grok/models_cache.json`,
+                // origin cli-chat-proxy.grok.com/v1/models); the older grok-4.5 /
+                // grok-4-latest / grok-code-fast-1 ids now return "unknown model id".
+                // Keep the list honest; operators can override with BIVY_GROK_MODELS if
+                // their install exposes more.
                 { id: "grok-4.6", name: "Grok 4.6", provider: "xai" },
             ],
         },
+        // Grok's reasoning models expose a `--reasoning-effort <EFFORT>` flag
+        // (verified against `grok --help`, 1.0.0); the authenticated model catalog
+        // lists low/medium/high/xhigh with `high` as the default. `{level}` fills
+        // the value; insertAt: 0 keeps the trailing `-p` prompt flag last so the
+        // prompt still lands as its value. Threads through the resume path too, so a
+        // continued turn keeps the chosen effort. Override with BIVY_GROK_THINKING.
+        thinking: { levels: ["low", "medium", "high", "xhigh"], default: "high", template: ["--reasoning-effort", "{level}"], insertAt: 0 },
         promptMode: "argv",
         install: {
             kind: "curl",

package/dist/apps/gateway.js

@@ -0,0 +1,357 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import http from "node:http";
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+import { readFileSync } from "node:fs";
+import { previewShell } from "./preview-shell.js";
+const MIME = {
+    ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8", ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png",
+    ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp", ".ico": "image/x-icon",
+    ".woff": "font/woff", ".woff2": "font/woff2", ".ttf": "font/ttf", ".wasm": "application/wasm",
+    ".txt": "text/plain; charset=utf-8", ".pdf": "application/pdf", ".mp4": "video/mp4", ".webm": "video/webm",
+};
+const COOKIE = "__Host-bivy-preview";
+const OPEN_PATH = "/__bivy/open";
+const REDEEM_PATH = "/__bivy/redeem";
+const HOUR = 60 * 60_000;
+const HOP = new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
+/** Separate per-app origins are mandatory. TLS terminates at the deployment's
+ * preview ingress. Delivery reaches only this gateway, never the node API. */
+export function previewOriginTemplate(raw) {
+    const parsed = new URL(raw.replace("{app}", "a"));
+    if (!/^https:\/\/\{app\}(?:-[a-f0-9]{24})?\.[a-z0-9.-]+\/?$/.test(raw) || raw.split("{app}").length !== 2 || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.port) {
+        throw new Error("BIVY_APPS_ORIGIN must be https://{app}.<dedicated-preview-domain> (no path or port).");
+    }
+    return raw.replace(/\/$/, "").toLowerCase();
+}
+function cleanHeaders(headers) {
+    const blocked = new Set([...HOP, ...(headers.connection ?? "").toLowerCase().split(",").map((s) => s.trim())]);
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => !blocked.has(key) && !key.startsWith("x-forwarded-") && key !== "forwarded"));
+}
+function upstreamHeaders(req, origin) {
+    const headers = cleanHeaders(req.headers);
+    // The preview credential is never disclosed to generated code/backends.
+    headers.cookie = (req.headers.cookie ?? "").split(";").filter((part) => part.trim().split("=", 1)[0] !== COOKIE).join(";");
+    headers.host = new URL(origin).host;
+    headers["x-forwarded-host"] = headers.host;
+    headers["x-forwarded-proto"] = "https";
+    return headers;
+}
+function responseHeaders(headers, shellOrigin) {
+    const result = cleanHeaders(headers);
+    if (headers["set-cookie"]) {
+        result["set-cookie"] = headers["set-cookie"].filter((cookie) => cookie.split("=", 1)[0].trim() !== COOKIE)
+            .map((cookie) => cookie.replace(/;\s*domain=[^;]*/ig, ""));
+    }
+    // Preview data must not become a shared proxy cache entry. Apps cannot frame
+    // Bivy, retain an opener, or cache an offline service-worker copy of the gate.
+    result["cache-control"] = "no-store";
+    result["referrer-policy"] = "no-referrer";
+    result["cross-origin-opener-policy"] = "same-origin";
+    result["x-content-type-options"] = "nosniff";
+    // The preview shell is the only allowed ancestor. Preserve the app's other
+    // CSP directives, but replace framing restrictions with this narrower host.
+    delete result["x-frame-options"];
+    const csp = result["content-security-policy"];
+    const policies = (Array.isArray(csp) ? csp : csp ? [String(csp)] : []).map((policy) => policy.replace(/(^|[;,])\s*frame-ancestors[^;,]*/gi, "$1"));
+    result["content-security-policy"] = [...policies, `frame-ancestors ${shellOrigin}; worker-src 'none'`].join(", ");
+    return result;
+}
+export class AppGateway {
+    registry;
+    returnOrigins;
+    server;
+    template;
+    tickets = new Map();
+    styles = new Map([
+        ["/__bivy/tokens.css", readFileSync(new URL("./tokens.css", import.meta.url))],
+        ["/__bivy/styles.css", readFileSync(new URL("./styles.css", import.meta.url))],
+    ]);
+    sessions = new Map();
+    sockets = new Map();
+    constructor(registry, originTemplate, returnOrigins = () => []) {
+        this.registry = registry;
+        this.returnOrigins = returnOrigins;
+        this.template = previewOriginTemplate(originTemplate);
+        this.server = http.createServer((req, res) => { void this.handle(req, res).catch(() => { if (!res.headersSent)
+            res.writeHead(502); res.end("Preview request failed."); }); });
+        this.server.maxConnections = 256;
+        this.server.headersTimeout = 15_000;
+        this.server.requestTimeout = 60_000;
+        this.server.on("upgrade", (req, socket, head) => this.upgrade(req, socket, head));
+    }
+    origin(id) { return this.template.replace("{app}", id); }
+    shellOrigin(id) { return this.template.replace("{app}", `view-${id}`); }
+    open(id, returnTo) {
+        const entry = this.registry.getView(id);
+        if (entry?.view.kind !== "web")
+            throw new Error("Web view not found.");
+        if (returnTo) {
+            const url = new URL(returnTo);
+            const safeScheme = url.protocol === "https:" || (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
+            if (!this.returnOrigins().includes(url.origin))
+                throw new Error("Return-to-chat origin is not configured on this machine. Set BIVY_APPS_RETURN_ORIGINS for an additional Bivy client origin.");
+            if (!safeScheme || url.username || url.password || url.search || url.hash || url.pathname !== `/sessions/${encodeURIComponent(entry.app.sessionId)}`)
+                throw new Error("Invalid return-to-chat URL.");
+            returnTo = url.href;
+        }
+        this.sweep();
+        if (this.tickets.size >= 500 || this.sessions.size >= 500)
+            throw new Error("Too many preview grants. Try again later.");
+        const ticket = randomBytes(32).toString("hex");
+        this.tickets.set(ticket, { appId: id, expires: Date.now() + 60_000, returnTo });
+        // Fragment never reaches reverse-proxy access logs or the application.
+        return `${this.shellOrigin(id)}${OPEN_PATH}#${ticket}`;
+    }
+    revoke(id) {
+        for (const map of [this.tickets, this.sessions])
+            for (const [key, grant] of map)
+                if (grant.appId === id)
+                    map.delete(key);
+        for (const socket of this.sockets.get(id) ?? [])
+            socket.destroy();
+        this.sockets.delete(id);
+    }
+    close() {
+        for (const id of this.sockets.keys())
+            this.revoke(id);
+        this.tickets.clear();
+        this.sessions.clear();
+        this.server.close();
+        this.server.closeAllConnections();
+    }
+    sweep() {
+        for (const map of [this.tickets, this.sessions])
+            for (const [key, grant] of map)
+                if (grant.expires <= Date.now())
+                    map.delete(key);
+    }
+    entry(req) {
+        const host = req.headers.host ?? "";
+        const id = /^([a-f0-9]{32})(?:[.-])/.exec(host)?.[1];
+        if (!id || host !== new URL(this.origin(id)).host)
+            return undefined;
+        const entry = this.registry.getView(id);
+        return entry?.view.kind === "web" ? entry : undefined;
+    }
+    authorize(req, id) {
+        this.sweep();
+        const token = (req.headers.cookie ?? "").split(";").map((part) => part.trim()).find((part) => part.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
+        const session = token && this.sessions.get(token);
+        return session && session.appId === id ? session.expires : undefined;
+    }
+    track(id, socket, expires) {
+        let sockets = this.sockets.get(id);
+        if (!sockets) {
+            sockets = new Set();
+            this.sockets.set(id, sockets);
+        }
+        if (sockets.has(socket))
+            return;
+        sockets.add(socket);
+        const timer = setTimeout(() => socket.destroy(), Math.max(1, expires - Date.now()));
+        timer.unref();
+        socket.once("close", () => { clearTimeout(timer); sockets.delete(socket); if (!sockets.size)
+            this.sockets.delete(id); });
+    }
+    async handleShell(req, res, id) {
+        const origin = this.shellOrigin(id);
+        const nonce = randomBytes(16).toString("hex");
+        res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+        res.setHeader("Content-Security-Policy", `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'self' 'nonce-${nonce}'; connect-src 'self'; frame-src ${this.origin(id)}; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`);
+        if (req.method === "GET" && this.styles.has(req.url ?? "")) {
+            res.setHeader("Content-Type", "text/css; charset=utf-8");
+            res.end(this.styles.get(req.url));
+            return;
+        }
+        if (req.url === OPEN_PATH && req.method === "GET") {
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.end(previewShell(nonce));
+            return;
+        }
+        if (req.url === "/__bivy/launch" && req.method === "POST") {
+            if (req.headers.origin !== origin) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
+            let ticket = "";
+            for await (const chunk of req) {
+                ticket += chunk.toString();
+                if (ticket.length > 128) {
+                    res.writeHead(413);
+                    res.end();
+                    return;
+                }
+            }
+            this.sweep();
+            const grant = this.tickets.get(ticket);
+            const entry = this.registry.getView(id);
+            if (!grant || grant.appId !== id || !entry) {
+                res.writeHead(401);
+                res.end();
+                return;
+            }
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo }));
+            return;
+        }
+        res.writeHead(404);
+        res.end("Preview shell route not found.");
+    }
+    async handle(req, res) {
+        const entry = this.entry(req);
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        const shellId = /^view-([a-f0-9]{32})(?:[.-])/.exec(req.headers.host ?? "")?.[1];
+        if (shellId && req.headers.host === new URL(this.shellOrigin(shellId)).host) {
+            await this.handleShell(req, res, shellId);
+            return;
+        }
+        if (!entry) {
+            res.writeHead(404);
+            res.end("App unavailable. Republish from your Bivy session.");
+            return;
+        }
+        const id = entry.view.id;
+        if (req.url === OPEN_PATH && req.method === "GET") {
+            const nonce = randomBytes(16).toString("hex");
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+            res.setHeader("Content-Security-Policy", `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${this.shellOrigin(id)}; base-uri 'none'`);
+            res.end(`<!doctype html><html lang="en"><meta name="viewport" content="width=device-width"><title>Open Bivy preview</title><p id="status" role="status">Opening preview…</p><script nonce="${nonce}">const ticket=location.hash.slice(1);history.replaceState(null,'',location.pathname);fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body:ticket}).then(r=>{if(!r.ok)throw Error();location.replace('/');}).catch(()=>{document.getElementById('status').textContent='Preview link expired or cookies are blocked. Open a new link from Bivy.';});</script></html>`);
+            return;
+        }
+        if (req.url === REDEEM_PATH && req.method === "POST") {
+            if (req.headers.origin !== this.origin(id)) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
+            let body = "";
+            for await (const chunk of req) {
+                body += chunk.toString();
+                if (body.length > 128) {
+                    res.writeHead(413);
+                    res.end();
+                    return;
+                }
+            }
+            this.sweep();
+            const grant = this.tickets.get(body);
+            if (!grant || grant.appId !== id || this.sessions.size >= 500) {
+                res.writeHead(401);
+                res.end();
+                return;
+            }
+            this.tickets.delete(body);
+            const token = randomBytes(32).toString("hex");
+            this.sessions.set(token, { appId: id, expires: Date.now() + HOUR });
+            res.setHeader("Set-Cookie", `${COOKIE}=${token}; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600`);
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        const expires = this.authorize(req, id);
+        if (!expires) {
+            res.writeHead(401);
+            res.end("Preview access expired. Open a new preview link from Bivy.");
+            return;
+        }
+        // Block cross-site mutations even if a client sends the preview cookie.
+        if (!["GET", "HEAD"].includes(req.method ?? "") && req.headers.origin !== this.origin(id)) {
+            res.writeHead(403);
+            res.end("Forbidden origin.");
+            return;
+        }
+        if (req.headers["sec-fetch-dest"] === "serviceworker") {
+            res.writeHead(403);
+            res.end();
+            return;
+        }
+        if (!req.url?.startsWith("/") || req.url.startsWith("//")) {
+            res.writeHead(400);
+            res.end();
+            return;
+        }
+        this.track(id, req.socket, expires);
+        if (entry.target.kind === "static") {
+            if (!["GET", "HEAD"].includes(req.method ?? "")) {
+                res.writeHead(405, { Allow: "GET, HEAD" });
+                res.end();
+                return;
+            }
+            let file;
+            try {
+                file = decodeURIComponent(req.url.split("?")[0]);
+            }
+            catch {
+                res.writeHead(400);
+                res.end();
+                return;
+            }
+            if (file.endsWith("/"))
+                file += "index.html";
+            const data = entry.target.files.get(file);
+            if (!data) {
+                res.writeHead(404);
+                res.end("File not found.");
+                return;
+            }
+            const headers = responseHeaders({}, this.shellOrigin(id));
+            headers["content-type"] = MIME[path.extname(file).toLowerCase()] || "application/octet-stream";
+            res.writeHead(200, { ...headers, "content-length": data.length });
+            res.end(req.method === "HEAD" ? undefined : data);
+            return;
+        }
+        if (entry.target.kind !== "service") {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        const upstream = http.request({ hostname: "127.0.0.1", port: entry.target.port, path: req.url, method: req.method, headers: upstreamHeaders(req, this.origin(id)) }, (response) => {
+            res.writeHead(response.statusCode ?? 502, responseHeaders(response.headers, this.shellOrigin(id)));
+            response.on("error", () => res.destroy());
+            response.pipe(res);
+        });
+        upstream.setTimeout(60_000, () => upstream.destroy(new Error("Preview timed out")));
+        upstream.on("error", () => { if (!res.headersSent)
+            res.writeHead(502, { "content-type": "text/plain" }); res.end("App server unavailable. Start it on the registered port, then reload."); });
+        res.on("close", () => upstream.destroy());
+        req.pipe(upstream);
+    }
+    upgrade(req, socket, head) {
+        const entry = this.entry(req);
+        const expires = entry && this.authorize(req, entry.view.id);
+        if (!entry || !expires || entry.target.kind !== "service" || req.headers.origin !== this.origin(entry.view.id) || req.headers.upgrade?.toLowerCase() !== "websocket" || !req.url?.startsWith("/") || req.url.startsWith("//")) {
+            socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            return;
+        }
+        this.track(entry.view.id, socket, expires);
+        const upstream = http.request({ hostname: "127.0.0.1", port: entry.target.port, path: req.url, headers: { ...upstreamHeaders(req, this.origin(entry.view.id)), connection: "Upgrade", upgrade: "websocket" } });
+        upstream.setTimeout(10_000, () => upstream.destroy());
+        upstream.on("upgrade", (response, peer, upstreamHead) => {
+            peer.setTimeout(0);
+            this.track(entry.view.id, peer, expires);
+            const headers = cleanHeaders(response.headers);
+            delete headers["set-cookie"];
+            socket.write(`HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n${Object.entries(headers).filter(([, value]) => value !== undefined).map(([key, value]) => `${key}: ${value}\r\n`).join("")}\r\n`);
+            if (upstreamHead.length)
+                socket.write(upstreamHead);
+            if (head.length)
+                peer.write(head);
+            socket.on("error", () => peer.destroy());
+            peer.on("error", () => socket.destroy());
+            socket.on("close", () => peer.destroy());
+            peer.on("close", () => socket.destroy());
+            socket.pipe(peer).pipe(socket);
+        });
+        upstream.on("response", (response) => { response.resume(); socket.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n"); });
+        upstream.on("error", () => socket.destroy());
+        socket.on("close", () => upstream.destroy());
+        upstream.end();
+    }
+}