@bivy/bivy 0.17.2-staging.1 → 0.17.2-staging.3

package/dist/apps/gateway.js

@@ -16,6 +16,8 @@ const COOKIE = "__Host-bivy-preview";
 const OPEN_PATH = "/__bivy/open";
 const REDEEM_PATH = "/__bivy/redeem";
 const HOUR = 60 * 60_000;
+/** Copied links are reusable until revoked, capped so a forgotten one lapses. */
+export const SHARE_TTL = 24 * HOUR;
 const HOP = new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
 /** Separate per-app origins are mandatory. TLS terminates at the deployment's
  * preview ingress. Delivery reaches only this gateway, never the node API. */
@@ -85,9 +87,7 @@ export class AppGateway {
     origin(id) { return this.template.replace("{app}", id); }
     shellOrigin(id) { return this.template.replace("{app}", `view-${id}`); }
     open(id, returnTo) {
-        const entry = this.registry.getView(id);
-        if (entry?.view.kind !== "web")
-            throw new Error("Web view not found.");
+        const entry = this.requireWeb(id);
         if (returnTo) {
             const url = new URL(returnTo);
             const safeScheme = url.protocol === "https:" || (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
@@ -97,13 +97,15 @@ export class AppGateway {
                 throw new Error("Invalid return-to-chat URL.");
             returnTo = url.href;
         }
-        this.sweep();
-        if (this.tickets.size >= 500 || this.sessions.size >= 500)
-            throw new Error("Too many preview grants. Try again later.");
-        const ticket = randomBytes(32).toString("hex");
-        this.tickets.set(ticket, { appId: id, expires: Date.now() + 60_000, returnTo });
         // Fragment never reaches reverse-proxy access logs or the application.
-        return `${this.shellOrigin(id)}${OPEN_PATH}#${ticket}`;
+        return `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: Date.now() + 60_000, returnTo })}`;
+    }
+    /** A reusable link straight to the app origin (no shell frame), so it opens
+     * in any browser and can be inspected. Valid until revoked or SHARE_TTL. */
+    share(id) {
+        this.requireWeb(id);
+        const expiresAt = Date.now() + SHARE_TTL;
+        return { url: `${this.origin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true })}`, expiresAt };
     }
     revoke(id) {
         for (const map of [this.tickets, this.sessions])
@@ -122,6 +124,20 @@ export class AppGateway {
         this.server.close();
         this.server.closeAllConnections();
     }
+    requireWeb(id) {
+        const entry = this.registry.getView(id);
+        if (entry?.view.kind !== "web")
+            throw new Error("Web view not found.");
+        return entry;
+    }
+    grant(grant) {
+        this.sweep();
+        if (this.tickets.size >= 500 || this.sessions.size >= 500)
+            throw new Error("Too many preview grants. Try again later.");
+        const ticket = randomBytes(32).toString("hex");
+        this.tickets.set(ticket, grant);
+        return ticket;
+    }
     sweep() {
         for (const map of [this.tickets, this.sessions])
             for (const [key, grant] of map)
@@ -247,10 +263,13 @@ export class AppGateway {
                 res.end();
                 return;
             }
-            this.tickets.delete(body);
+            if (!grant.reusable)
+                this.tickets.delete(body);
+            // A browser session never outlives the link that created it.
+            const expires = Math.min(Date.now() + HOUR, grant.expires);
             const token = randomBytes(32).toString("hex");
-            this.sessions.set(token, { appId: id, expires: Date.now() + HOUR });
-            res.setHeader("Set-Cookie", `${COOKIE}=${token}; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600`);
+            this.sessions.set(token, { appId: id, expires });
+            res.setHeader("Set-Cookie", `${COOKIE}=${token}; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=${Math.max(1, Math.floor((expires - Date.now()) / 1000))}`);
             res.writeHead(204);
             res.end();
             return;

package/dist/apps/remote-preview.js

@@ -59,6 +59,11 @@ export class RemotePreview {
             throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
         return this.gateway.open(id, returnTo);
     }
+    share(id) {
+        if (!this.available)
+            throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
+        return this.gateway.share(id);
+    }
     revoke(id) { this.gateway?.revoke(id); }
     disconnect() {
         this.online = false;

package/dist/apps/service.js

@@ -48,6 +48,19 @@ export class AppService {
             throw error;
         }
     }
+    share(sessionId, appId, viewId) {
+        if (this.registry.requireView(sessionId, appId, viewId).view.kind !== "web")
+            throw new Error("Only web views have preview links.");
+        if (!this.gateway)
+            throw new Error("Bivy's preview service is unavailable on this connection.");
+        return this.gateway.share(viewId);
+    }
+    /** Ends every link, browser session and open connection for one view; the app stays. */
+    revoke(sessionId, appId, viewId) {
+        this.registry.requireView(sessionId, appId, viewId);
+        this.gateway?.revoke(viewId);
+        return { ok: true };
+    }
     remove(sessionId, appId) {
         const app = this.registry.require(sessionId, appId);
         this.registry.remove(sessionId, appId);

package/dist/apps/styles.css

@@ -2954,7 +2954,9 @@ select.picker-search { appearance: auto; }
 .app-views-heading { display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); }
 .app-views-heading .artifact-name, .app-message .artifact-name { white-space: normal; overflow-wrap: anywhere; }
 .app-view-row { flex-wrap: wrap; }
-.app-view-row > .btn, .app-views-heading > .btn { min-block-size: var(--space-7); flex-shrink: 0; }
+.app-views-heading > .btn, .app-view-actions .btn { min-block-size: var(--space-7); flex-shrink: 0; }
+.app-view-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: var(--space-2); margin-inline-start: auto; }
+.app-view-notice { display: flex; flex-direction: column; gap: var(--space-2); flex-basis: 100%; min-width: 0; }
 .app-terminal-status { padding: var(--space-2) var(--space-4); margin: 0; color: var(--muted); font-size: var(--text-sm); }
 .app-view-command { overflow-wrap: anywhere; white-space: pre-wrap; font-size: var(--text-xs); color: var(--muted); }
 .app-view-row .artifact-main { flex-basis: 60%; }

package/dist/controllers/app-commands.js

@@ -11,6 +11,8 @@ export function createAppCommands(service, workspaceFor, published = () => { })
             return { app };
         },
         "apps.open": (msg) => service.open(String(msg.sessionId), String(msg.appId), String(msg.viewId), typeof msg.returnTo === "string" ? msg.returnTo : undefined),
+        "apps.share": (msg) => service.share(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
+        "apps.revoke": (msg) => service.revoke(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.remove": (msg) => { service.remove(String(msg.sessionId), String(msg.appId)); return { ok: true }; },
     };
     return Object.fromEntries(Object.entries(operations).map(([kind, execute]) => [kind, async (msg, ctx) => {

package/dist/protocol/client-command-routes.js

@@ -3,7 +3,7 @@
 /** Direct-mode adapters for operations whose canonical implementation is the
  * client command registry. Relay and HTTP now differ only in framing. */
 export const CLIENT_COMMAND_ROUTES = [
-    ...["list", "publish", "open", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
+    ...["list", "publish", "open", "share", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
     { method: "post", path: "/api/auth/credentials/native-preview", kind: "credentials.native.preview" },
     { method: "post", path: "/api/auth/credentials/native-import", kind: "credentials.native.import" },
     { method: "post", path: "/api/session/pause", kind: "session.pause" },

package/dist/protocol/client-command-schemas.js

@@ -11,6 +11,8 @@ export const CLIENT_COMMAND_SCHEMAS = {
     "apps.list": Type.Object({ ...request, ...session }),
     "apps.publish": Type.Object({ ...request, ...session, manifest: Type.Unknown() }),
     "apps.open": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String(), returnTo: Type.Optional(Type.String({ maxLength: 2048 })) }),
+    "apps.share": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
+    "apps.revoke": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.remove": Type.Object({ ...request, ...session, appId: Type.String() }),
     "credentials.native.preview": Type.Object({ ...request, label: Type.Optional(Type.String({ maxLength: 100 })) }),
     "credentials.native.import": Type.Object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.17.2-staging.1",
+  "version": "0.17.2-staging.3",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",