@bivy/bivy 0.17.2-staging.3 → 0.17.2-staging.5

package/dist/runtime/model-catalog.js

@@ -134,3 +134,16 @@ export function mergeProviderCatalog(base, catalog) {
     }
     return [...byId.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
+/**
+ * Reply to a models.list query. A catalog read failure must never answer with
+ * silence: the client (notably a Cloud launch validating its saved model) could
+ * only time out without a cause. Name the real reason on the session instead.
+ */
+export async function catalogReplyEvent(load, sessionId) {
+    try {
+        return await load();
+    }
+    catch (error) {
+        return { type: "session.error", sessionId, error: `Couldn't read this machine's model catalog: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}

package/dist/server.js

@@ -3,6 +3,7 @@
 import fs from "node:fs";
 import { createNodeUpdateChecker, updateRegistryUrl } from "./node-update.js";
 import { createRemoteSessionAdmission, RemoteSessionAdmissionError } from "./session/remote-session-admission.js";
+import { requiresExistingSession, resolveTargetSession } from "./session/target-session.js";
 import path from "node:path";
 import os from "node:os";
 import { spawn, spawnSync } from "node:child_process";
@@ -33,7 +34,7 @@ import { AppService } from "./apps/service.js";
 import { createAppCommands } from "./controllers/app-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
-import { aggregateModelCatalog, mergeProviderCatalog } from "./runtime/model-catalog.js";
+import { aggregateModelCatalog, catalogReplyEvent, mergeProviderCatalog } from "./runtime/model-catalog.js";
 import { RuntimeHost, enforcementLevelFor, remoteRuntimeEnabled } from "./runtime/host.js";
 import { RemoteRuntime, RemoteRuntimeSession } from "./runtime/remote.js";
 import { InMemorySessionLocationRegistry } from "./runtime/session-location.js";
@@ -1743,8 +1744,10 @@ function referencedAttachmentHashes() {
     const ids = new Set(metadata.listSessions().map((session) => session.id));
     for (const record of new Set(openSessions.values()))
         ids.add(record.id);
+    // `scan`, not `entries`: this visits every session ever created, and must not pin
+    // each one's full log in the event-log cache.
     for (const id of ids) {
-        for (const entry of eventLog.entries(id)) {
+        for (const entry of eventLog.scan(id, ["attachment", "outbound-attachment", "inline-image"])) {
             if (entry.bivyKind === "attachment")
                 for (const ref of entry.refs)
                     hashes.add(ref.hash);
@@ -2453,18 +2456,8 @@ const RELAY_COMMANDS = {
         // this a models.list answered for one agent (e.g. Codex's models) could
         // linger on the composer/picker after the user switched to another agent
         // (e.g. Claude) — the "Claude shows Codex models" bug.
-        let event;
-        try {
-            event = await modelsListEventFor(record);
-        }
-        catch (error) {
-            // A catalog read failure must never answer with silence: the generic
-            // relay catch would swallow the rejection and the client (notably a
-            // Cloud launch waiting to validate its saved model) could only guess
-            // via timeout. Name the real reason on the session instead.
-            relay?.sendEvent({ type: "session.error", sessionId: requestedSessionId ?? record.id, error: `Couldn't read this machine's model catalog: ${error instanceof Error ? error.message : String(error)}` });
-            return;
-        }
+        // A catalog read failure answers with the real error, never silence.
+        const event = await catalogReplyEvent(() => modelsListEventFor(record), requestedSessionId ?? record.id);
         relay?.sendEvent(event);
     },
     "models.prefetch"(msg) {
@@ -4915,31 +4908,13 @@ function assertSessionAccounts(record, labels) {
     }
 }
 async function continueCorrelatedSession(item, prompt, report, opts) {
-    if (item.targetKind !== "existing_session" || !item.targetSessionId)
-        return false;
-    let record = openSessions.get(item.targetSessionId);
-    if (!record && opts?.resumeOnMissing) {
-        // Same-node resume: reopen a closed session from its durable metadata +
-        // transcript — exactly how a prompt to an old session from the app is
-        // handled (resolveOrResumeSession). Best-effort: an unresolvable session
-        // falls through to the snapshot restore / fail handling below.
-        record = await resolveOrResumeSession(item.targetSessionId).catch(() => undefined);
-    }
-    if (!record) {
-        const restored = await restoreSessionFromSnapshot(item.targetSessionId);
-        if (restored)
-            record = await resolveOrResumeSession(item.targetSessionId).catch(() => undefined);
-    }
-    if (!record) {
-        // Strict mode (a scheduled message to a specific session): the session must
-        // be resumed in place, so a genuinely-unavailable one is surfaced as a
-        // failed run rather than silently starting a new session. Everything else
-        // keeps the established best-effort fall-through to a fresh pickup.
-        if (opts?.resumeOnMissing) {
-            throw new Error(`This Run could not continue session ${item.targetSessionId}: the session is not available on this Machine`);
-        }
+    const record = await resolveTargetSession(item, {
+        open: (id) => openSessions.get(id),
+        resume: (id) => resolveOrResumeSession(id),
+        restoreSnapshot: async (id) => Boolean(await restoreSessionFromSnapshot(id)),
+    }, opts?.resumeOnMissing === true);
+    if (!record)
         return false;
-    }
     assertSessionAccounts(record, opts?.credentialLabels);
     const branch = record.worktree?.branch;
     if (opts?.resumeOnMissing) {
@@ -5189,7 +5164,7 @@ async function executeWorkItem(item, report, signal) {
     // Scheduled runs targeting an existing session are STRICT: the message must
     // land in that session (resumed from disk if needed), never silently in a new
     // one — so a session that can't be resumed fails the run instead.
-    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: item.source === "schedule" || item.targetKind === "existing_session", isMessage, signal, credentialLabels }))
+    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: requiresExistingSession(item), isMessage, signal, credentialLabels }))
         return;
     const requestedSandbox = normalizeSandboxTier(item.sandbox);
     // Prepare an explicit repository before resolving its policy. Otherwise a

package/dist/session/event-log.js

@@ -397,12 +397,12 @@ export function baseReplay(entries) {
     }
     return base;
 }
-function parseLogDetailed(body) {
+function parseLogDetailed(body, keep = () => true) {
     const records = [];
     let malformedLines = 0;
     for (const line of body.split("\n")) {
         const trimmed = line.trim();
-        if (!trimmed)
+        if (!trimmed || !keep(trimmed))
             continue;
         try {
             const value = JSON.parse(trimmed);
@@ -429,6 +429,10 @@ export function parseLog(body) {
  * `throttleMs` per session (a burst of same-id deltas within a window collapses to
  * one appended line). Durability at boundaries is explicit `flush()` (turn-end,
  * close, delete, shutdown), mirroring `SidecarStore`.
+ *
+ * The in-memory copy of flushed records is an LRU capped at `maxCachedBytes`
+ * (measured as log-file size): an evicted session simply re-reads its file on next
+ * use, so memory tracks the sessions in use, not the node's whole history.
  */
 export class EventLog {
     dir;
@@ -436,7 +440,10 @@ export class EventLog {
     redact;
     throttleMs;
     onIssue;
+    maxCachedBytes;
     disk = new Map();
+    diskBytes = new Map();
+    cachedBytes = 0;
     pending = new Map();
     timers = new Map();
     lastFlush = new Map();
@@ -446,12 +453,13 @@ export class EventLog {
     // on first use of a session after a restart.
     baseKeys = new Map();
     lastIssue;
-    constructor(dir, pathFor, redact = (t) => t, throttleMs = 500, onIssue = (issue) => console.error(`[event-log] ${issue.operation} failed for ${issue.sessionId}: ${issue.message}`)) {
+    constructor(dir, pathFor, redact = (t) => t, throttleMs = 500, onIssue = (issue) => console.error(`[event-log] ${issue.operation} failed for ${issue.sessionId}: ${issue.message}`), maxCachedBytes = 64 * 1024 * 1024) {
         this.dir = dir;
         this.pathFor = pathFor;
         this.redact = redact;
         this.throttleMs = throttleMs;
         this.onIssue = onIssue;
+        this.maxCachedBytes = maxCachedBytes;
     }
     report(id, operation, error) {
         const issue = {
@@ -493,23 +501,64 @@ export class EventLog {
         }
         return { files, bytes };
     }
-    load(id) {
-        const cached = this.disk.get(id);
-        if (cached)
-            return cached;
-        let data = [];
+    /** Read + parse a session's log file (lines passing `keep`), reporting problems. */
+    readLog(id, keep) {
         try {
-            const parsed = parseLogDetailed(fs.readFileSync(this.pathFor(id), "utf8"));
-            data = parsed.records;
+            const body = fs.readFileSync(this.pathFor(id), "utf8");
+            const parsed = parseLogDetailed(body, keep);
             if (parsed.malformedLines > 0)
                 this.report(id, "parse", new Error(`${parsed.malformedLines} malformed record(s); valid history was recovered`));
+            return { records: parsed.records, bytes: body.length };
         }
         catch (error) {
             if (error?.code !== "ENOENT")
                 this.report(id, "read", error);
+            return { records: [], bytes: 0 };
+        }
+    }
+    load(id) {
+        const cached = this.disk.get(id);
+        if (cached) {
+            // Re-insert to mark most-recently-used (Map iterates in insertion order).
+            this.disk.delete(id);
+            this.disk.set(id, cached);
+            return cached;
         }
-        this.disk.set(id, data);
-        return data;
+        const { records, bytes } = this.readLog(id);
+        this.cache(id, records, bytes);
+        return records;
+    }
+    /** Store a session's flushed records, then evict least-recently-used others past the cap. */
+    cache(id, records, bytes) {
+        this.uncache(id);
+        this.disk.set(id, records);
+        this.diskBytes.set(id, bytes);
+        this.cachedBytes += bytes;
+        for (const oldest of this.disk.keys()) {
+            if (this.cachedBytes <= this.maxCachedBytes || oldest === id)
+                break;
+            this.uncache(oldest);
+        }
+    }
+    uncache(id) {
+        this.cachedBytes -= this.diskBytes.get(id) ?? 0;
+        this.diskBytes.delete(id);
+        this.disk.delete(id);
+    }
+    /**
+     * The session's records of the given kinds, read WITHOUT caching the log. For
+     * whole-store sweeps (attachment GC) that visit every session, where `load` would
+     * pin every log in memory. Uses the cached copy when there is one, and always
+     * includes pending records so unflushed writes are never missed. Off the cache only
+     * candidate lines are parsed: those naming a wanted kind, plus torn lines (not
+     * ending in `}`) so a truncated write is still reported and callers can fail closed.
+     */
+    scan(id, kinds) {
+        const wanted = new Set(kinds);
+        const markers = kinds.map((kind) => `"bivyKind":${JSON.stringify(kind)}`);
+        const flushed = this.disk.get(id) ?? this.readLog(id, (line) => !line.endsWith("}") || markers.some((m) => line.includes(m))).records;
+        const pending = this.pending.get(id)?.values() ?? [];
+        return [...flushed, ...pending].filter((record) => wanted.has(record.bivyKind));
     }
     /** Allocate a unique synthetic coalescing key (for id-less records). */
     syntheticKey(id) {
@@ -681,9 +730,16 @@ export class EventLog {
         const lines = [...batch.values()];
         try {
             fs.mkdirSync(this.dir, { recursive: true });
-            fs.appendFileSync(this.pathFor(id), this.redact(lines.map((e) => JSON.stringify(e)).join("\n") + "\n"));
-            const disk = this.load(id);
-            disk.push(...lines);
+            const body = this.redact(lines.map((e) => JSON.stringify(e)).join("\n") + "\n");
+            fs.appendFileSync(this.pathFor(id), body);
+            // Extend the cached copy only if it is still cached: an evicted session re-reads
+            // the file (which now holds these lines) on next use, so loading here would
+            // double-count them.
+            const cached = this.disk.get(id);
+            if (cached) {
+                cached.push(...lines);
+                this.cache(id, cached, (this.diskBytes.get(id) ?? 0) + body.length);
+            }
             batch.clear();
             this.lastFlush.set(id, Date.now());
         }
@@ -708,10 +764,10 @@ export class EventLog {
         }
         this.pending.delete(id);
         this.baseKeys.delete(id);
-        this.disk.set(id, copy);
+        const body = copy.length ? copy.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
+        this.cache(id, copy, body.length);
         try {
             fs.mkdirSync(this.dir, { recursive: true });
-            const body = copy.length ? copy.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
             fs.writeFileSync(this.pathFor(id), this.redact(body));
             this.lastFlush.set(id, Date.now());
         }
@@ -726,7 +782,7 @@ export class EventLog {
             clearTimeout(timer);
             this.timers.delete(id);
         }
-        this.disk.delete(id);
+        this.uncache(id);
         this.pending.delete(id);
         this.lastFlush.delete(id);
         this.counters.delete(id);

package/dist/session/target-session.js

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Resolving the Session a durable Run targets. A Run aimed at an existing
+// Session (or any scheduled Run) is strict: it continues that Session, resumed
+// from disk or a snapshot if needed, or fails visibly. It never silently cold-
+// starts a new Session without the context the user pointed it at.
+/** Scheduled Runs and Runs aimed at an existing Session must land in that Session. */
+export function requiresExistingSession(item) {
+    return item.source === "schedule" || item.targetKind === "existing_session";
+}
+/**
+ * The targeted Session, or null when the item targets none or (non-strict) it is
+ * unavailable, in which case the caller falls through to a fresh pickup. Throws
+ * when a strict target cannot be continued.
+ */
+export async function resolveTargetSession(item, resolvers, strict) {
+    if (item.targetKind !== "existing_session" || !item.targetSessionId)
+        return null;
+    const id = item.targetSessionId;
+    let record = resolvers.open(id);
+    if (!record && strict)
+        record = await resolvers.resume(id).catch(() => undefined);
+    if (!record && await resolvers.restoreSnapshot(id))
+        record = await resolvers.resume(id).catch(() => undefined);
+    if (record)
+        return record;
+    if (strict)
+        throw new Error(`This Run could not continue session ${id}: the session is not available on this Machine`);
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.17.2-staging.3",
+  "version": "0.17.2-staging.5",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",