@bivy/bivy 0.18.11-staging.2 → 0.18.11-staging.3

package/bin/bivy.mjs

@@ -2472,7 +2472,7 @@ async function cmdApp(args = []) {
        bivy app remove <app-id> [--session <id>]
        bivy app shot [app-id] [--widths 390,1280] [--themes light,dark] [--path /page] [--session <id>]
        bivy app present [view] [--path /page] [--note "…"] [--session <id>]
-       bivy app share [app-id] [--view <view>] [--session <id>]
+       bivy app share [app-id] [--view <view>] [--for 1h|1d|7d] [--view-only] [--session <id>]
        bivy app notes [app-id] [--view <view>] [--since <time>] [--session <id>]
        bivy app run [--name <name>] [--restart-on-change] [--session <id>] -- <command> [args…]
        bivy app click <x> <y> [--right|--middle] [--double] [--app <app>]
@@ -2518,9 +2518,10 @@ the chat with the app at phone width (and before/after), and it opens the live
 preview. Use it when you finish a visible change, or when the user asks to see
 it. [view] is an app or view name or ID (default: the one opened last).
 "share" mints a reusable link to one web view and prints its URL and expiry
-(24 hours, or until Revoke access in Apps, the app is removed or the machine
-restarts). [app-id] is an app ID or name, --view a view ID or name (default: the
-one opened last). Anyone who has the link can use the app, including a live
+(--for: 1h, 1d or 7d, default 1d; sooner if the user stops sharing in Apps, the
+app is removed or the machine restarts). [app-id] is an app ID or name, --view
+a view ID or name (default: the one opened last). --view-only leaves out the
+reviewer tools (Point, Draw, notes): people see just the app. Anyone who has the link can use the app, including a live
 server's backend, until it expires or is revoked: only post it where everyone
 who can read it may use the app.
 "notes" prints the notes people left through share links (Leave a note), as
@@ -2557,6 +2558,17 @@ Web previews require operator setup; see docs/apps.md.`);
       rest.splice(i, 2);
     }
   }
+  if (action === "share") {
+    const i = rest.indexOf("--for");
+    if (i >= 0) {
+      const value = rest[i + 1];
+      if (!["1h", "1d", "7d"].includes(value)) throw new Error("--for takes 1h, 1d or 7d.");
+      shot.duration = value;
+      rest.splice(i, 2);
+    }
+    const viewOnly = rest.indexOf("--view-only");
+    if (viewOnly >= 0) { shot.controls = false; rest.splice(viewOnly, 1); }
+  }
   if (action === "notes") {
     const i = rest.indexOf("--since");
     if (i >= 0) {
@@ -2656,7 +2668,7 @@ async function appRequest(action, body, { print = true } = {}) {
   if (action === "share") {
     const { type: _type, requestId: _requestId, ...link } = result;
     console.log(JSON.stringify({ ...link, expires: new Date(link.expiresAt).toISOString() }, null, 2));
-    console.error("Anyone with this link can use the app, including its live backend, until it expires or you revoke it (Apps → Revoke access).");
+    console.error("Anyone with this link can use the app, including its live backend, until it expires or the user stops sharing (Apps → Share → Stop sharing).");
     return;
   }
   if (print) console.log(JSON.stringify(result, null, 2));

package/dist/apps/gateway.js

@@ -132,6 +132,8 @@ const poll=async()=>{try{const r=await fetch(location.href,{method:'HEAD',cache:
 }
 /** Copied links are reusable until revoked, capped so a forgotten one lapses. */
 export const SHARE_TTL = 24 * HOUR;
+/** The longest a copied link may be asked to last. */
+export const SHARE_TTL_MAX = 7 * 24 * HOUR;
 /** Bivy's packaged apps load the client from their own scheme, so a preview
  * framed there has this ancestor instead of a web origin. (Node's URL gives
  * these "null" origins, so they cannot be configured as return origins.) */
@@ -204,9 +206,13 @@ export class AppGateway {
         ["/__bivy/styles.css", readFileSync(new URL("./styles.css", import.meta.url))],
     ]);
     /** `reviewer`: the browser session came from a copied (shared) link.
+     *  `viewOnly`: that link came without the reviewer tools.
      *  `embedded`: it runs framed inside a Bivy client (a third-party frame). */
     sessions = new Map();
     sockets = new Map();
+    /** Connections opened by people with a copied link, so Stop sharing can end
+     * theirs and leave the owner's. */
+    shared = new WeakSet();
     captureAfter = 0;
     capturing = false;
     displays = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: false });
@@ -255,11 +261,33 @@ export class AppGateway {
         return `${this.origin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: Date.now() + 60_000 })}`;
     }
     /** Public reviewers use the same isolated controls as the owner, but can
-     * only submit notes. Valid until revoked or SHARE_TTL. */
-    share(id) {
+     * only submit notes; without `controls` they only see the app. Valid until
+     * revoked, sharing stops, or `ttl` (SHARE_TTL by default). */
+    share(id, { ttl = SHARE_TTL, controls = true } = {}) {
         this.requireWeb(id);
-        const expiresAt = Date.now() + SHARE_TTL;
-        return { url: `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true })}`, expiresAt };
+        if (!Number.isFinite(ttl) || ttl <= 0 || ttl > SHARE_TTL_MAX)
+            throw new Error("A share link can last at most 7 days.");
+        const expiresAt = Date.now() + ttl;
+        return { url: `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true, ...(controls ? {} : { viewOnly: true }) })}`, expiresAt, controls };
+    }
+    /** Copied links that still work: how many, and when the last one lapses. */
+    sharing(id) {
+        this.sweep();
+        const links = [...this.tickets.values()].filter((grant) => grant.appId === id && grant.reusable);
+        return links.length ? { links: links.length, expiresAt: Math.max(...links.map((grant) => grant.expires)) } : undefined;
+    }
+    /** Ends every copied link and the browser sessions and connections opened
+     * from them. The owner's own previews keep working. */
+    unshare(id) {
+        for (const [key, grant] of this.tickets)
+            if (grant.appId === id && grant.reusable)
+                this.tickets.delete(key);
+        for (const [key, session] of this.sessions)
+            if (session.appId === id && session.reviewer)
+                this.sessions.delete(key);
+        for (const socket of this.sockets.get(id) ?? [])
+            if (this.shared.has(socket))
+                socket.destroy();
     }
     revoke(id) {
         for (const map of [this.tickets, this.sessions])
@@ -313,13 +341,15 @@ export class AppGateway {
         const session = token ? this.sessions.get(token) : undefined;
         return session?.appId === id ? session : undefined;
     }
-    authorize(req, id) { return this.session(req, id)?.expires; }
-    track(id, socket, expires) {
+    track(id, socket, session) {
+        const expires = session.expires;
         let sockets = this.sockets.get(id);
         if (!sockets) {
             sockets = new Set();
             this.sockets.set(id, sockets);
         }
+        if (session.reviewer)
+            this.shared.add(socket);
         if (sockets.has(socket))
             return;
         sockets.add(socket);
@@ -369,7 +399,7 @@ export class AppGateway {
             res.setHeader("Content-Type", "application/json");
             // Someone opening a shared link sees "Made with Bivy" under the app; the owner doesn't.
             const badge = grant.reusable && this.badge ? await this.badge().catch(() => true) : false;
-            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(grant.reusable ? { reviewer: true } : {}), ...(badge ? { badge: true } : {}), ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
+            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(grant.reusable ? { reviewer: true } : {}), ...(grant.viewOnly ? { controls: false } : {}), ...(badge ? { badge: true } : {}), ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
             return;
         }
         res.writeHead(404);
@@ -433,7 +463,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             // A browser session never outlives the link that created it.
             const expires = Math.min(Date.now() + HOUR, grant.expires);
             const token = randomBytes(32).toString("hex");
-            this.sessions.set(token, { appId: id, expires, reviewer: grant.reusable === true, ...(embedded ? { embedded } : {}) });
+            this.sessions.set(token, { appId: id, expires, reviewer: grant.reusable === true, ...(grant.viewOnly ? { viewOnly: true } : {}), ...(embedded ? { embedded } : {}) });
             // Framed inside Bivy, the cookie is third-party: it must be SameSite=None,
             // and Partitioned keys it to Bivy's top-level site so no other site can use it.
             const scope = embedded ? "SameSite=None; Partitioned" : "SameSite=Lax";
@@ -442,16 +472,16 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             res.end();
             return;
         }
-        const session = this.session(req, id), expires = session?.expires;
+        const session = this.session(req, id);
         // A home-screen visit without access goes through Bivy to sign in, then
         // comes back to the same page. Framed loads keep the plain message.
-        const signIn = !expires && req.method === "GET" && req.headers["sec-fetch-dest"] === "document" && req.url?.startsWith("/") ? this.signIn?.(entry, req.url) : undefined;
+        const signIn = !session && req.method === "GET" && req.headers["sec-fetch-dest"] === "document" && req.url?.startsWith("/") ? this.signIn?.(entry, req.url) : undefined;
         if (signIn) {
             res.writeHead(303, { location: signIn });
             res.end();
             return;
         }
-        if (!expires) {
+        if (!session) {
             res.writeHead(401);
             res.end("Preview access expired. Open a new preview link from Bivy.");
             return;
@@ -472,7 +502,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             res.end();
             return;
         }
-        this.track(id, req.socket, expires);
+        this.track(id, req.socket, session);
         if (req.url.startsWith(`${REVISION_PATH}?`) && req.method === "GET") {
             this.revision(req, res, entry);
             return;
@@ -483,10 +513,16 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         }
         if (req.url === INSPECTOR_PATH && req.method === "GET") {
             res.writeHead(200, { "content-type": "text/javascript; charset=utf-8", "cache-control": "no-store" });
-            res.end(inspectorScript(this.shellOrigin(id), session?.reviewer === true, session?.embedded === true));
+            res.end(inspectorScript(this.shellOrigin(id), session.reviewer === true && !session.viewOnly, session.embedded === true));
             return;
         }
         if (req.url === NOTES_PATH && req.method === "POST") {
+            // A view-only link shows the app and nothing else.
+            if (session.viewOnly) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
             await this.note(req, res, entry);
             return;
         }
@@ -880,13 +916,13 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
     }
     upgrade(req, socket, head) {
         const entry = this.entry(req);
-        const expires = entry && this.authorize(req, entry.view.id);
+        const session = entry && this.session(req, entry.view.id);
         const display = entry?.target.kind === "display";
-        if (!entry || !expires || (entry.target.kind !== "service" && !(display && req.url === DISPLAY_SOCKET_PATH)) || req.headers.origin !== this.origin(entry.view.id) || req.headers.upgrade?.toLowerCase() !== "websocket" || !req.url?.startsWith("/") || req.url.startsWith("//")) {
+        if (!entry || !session || (entry.target.kind !== "service" && !(display && req.url === DISPLAY_SOCKET_PATH)) || req.headers.origin !== this.origin(entry.view.id) || req.headers.upgrade?.toLowerCase() !== "websocket" || !req.url?.startsWith("/") || req.url.startsWith("//")) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
             return;
         }
-        this.track(entry.view.id, socket, expires);
+        this.track(entry.view.id, socket, session);
         if (display) {
             this.displaySocket(req, socket, head, entry);
             return;
@@ -898,7 +934,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         upstream.setTimeout(10_000, () => upstream.destroy());
         upstream.on("upgrade", (response, peer, upstreamHead) => {
             peer.setTimeout(0);
-            this.track(entry.view.id, peer, expires);
+            this.track(entry.view.id, peer, session);
             const headers = cleanHeaders(response.headers);
             delete headers["set-cookie"];
             socket.write(`HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n${Object.entries(headers).filter(([, value]) => value !== undefined).map(([key, value]) => `${key}: ${value}\r\n`).join("")}\r\n`);

package/dist/apps/preview-shell.js

@@ -162,6 +162,8 @@ function show(data,launch){
     $('draft-text').maxLength=1000;
     $('send-errors').textContent='Leave a note…';
   }
+  // A view-only share link shows the app without Bivy's tools.
+  $('dock').hidden=data.controls===false;
   $('made-with').hidden=!data.badge;
   document.body.classList.toggle('badged',Boolean(data.badge));
   $('title').textContent=data.name;

package/dist/apps/remote-preview.js

@@ -65,11 +65,13 @@ export class RemotePreview {
             throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
         return this.gateway.open(id, returnTo);
     }
-    share(id) {
+    share(id, options) {
         if (!this.available)
             throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
-        return this.gateway.share(id);
+        return this.gateway.share(id, options);
     }
+    sharing(id) { return this.gateway?.sharing(id); }
+    unshare(id) { this.gateway?.unshare(id); }
     revoke(id) { this.gateway?.revoke(id); }
     address(id) { return this.available ? this.gateway.address(id) : undefined; }
     openDirect(id) {

package/dist/apps/service.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { SHARE_DURATIONS } from "./types.js";
 import { randomBytes } from "node:crypto";
 import { REVIEW_MODES, shouldReview, visualChange } from "./review.js";
 import fs from "node:fs";
@@ -73,6 +76,9 @@ export class AppService {
                     view.stats = structuredClone(entry.stats);
                 if (entry?.lastPath)
                     view.lastPath = entry.lastPath;
+                const sharing = this.gateway?.sharing?.(view.id);
+                if (sharing)
+                    view.sharing = sharing;
             }
         return { apps, previewAvailable: available };
     }
@@ -577,18 +583,21 @@ export class AppService {
         void server.pending?.then((termId) => this.terminals.close(termId)).catch(() => { });
         this.servers.delete(id);
     }
-    share(sessionId, appId, viewId) {
+    share(sessionId, appId, viewId, options = {}) {
         if (this.registry.requireView(sessionId, appId, viewId).view.kind !== "web")
             throw new Error("Only web views have preview links.");
         if (!this.gateway)
             throw new Error("Bivy's preview service is unavailable on this connection.");
-        return this.gateway.share(viewId);
+        const duration = options.duration === undefined ? undefined : SHARE_DURATIONS.find((row) => row.id === options.duration);
+        if (options.duration !== undefined && !duration)
+            throw new Error(`A share link lasts ${SHARE_DURATIONS.map((row) => row.id).join(", ")}.`);
+        return this.gateway.share(viewId, { ...(duration ? { ttl: duration.ms } : {}), controls: options.controls !== false });
     }
     /** `bivy app share`: mints a share link for a web view picked by app and/or
      * view ID or name, like `present` (default: the one opened last). */
     shareView(sessionId, input) {
         const entry = this.pickTarget(sessionId, input);
-        return { ...this.share(sessionId, entry.app.id, entry.view.id), appId: entry.app.id, viewId: entry.view.id, app: entry.app.name, view: entry.view.name };
+        return { ...this.share(sessionId, entry.app.id, entry.view.id, input), appId: entry.app.id, viewId: entry.view.id, app: entry.app.name, view: entry.view.name };
     }
     clearNotes(sessionId, appId, viewId) {
         this.registry.requireView(sessionId, appId, viewId);
@@ -623,6 +632,12 @@ export class AppService {
             throw new Error(`No web view called "${input.view}"${input.app ? ` in "${input.app}"` : ""}. Run bivy app list to see them.`);
         return found;
     }
+    /** Ends a view's share links and what people opened with them; the owner's previews and the app stay. */
+    unshare(sessionId, appId, viewId) {
+        this.registry.requireView(sessionId, appId, viewId);
+        this.gateway?.unshare?.(viewId);
+        return { ok: true };
+    }
     /** Ends every link, browser session and open connection for one view; the app stays. */
     revoke(sessionId, appId, viewId) {
         this.registry.requireView(sessionId, appId, viewId);

package/dist/apps/styles.css

@@ -3147,6 +3147,9 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .apps-empty strong { color: var(--ink); font-size: var(--text-base); }
 .apps-empty p { margin: 0; max-inline-size: 34ch; }
 .apps-foot { margin: 0; padding: 0 var(--space-1); color: var(--muted); font-size: var(--text-xs); line-height: var(--lh-xs); }
+/* Share sheet (AppAccess.tsx): the sharing status sits in the sheet, not at page edge. */
+.apps-sheet > .banner { border-radius: var(--radius-md); padding: var(--space-2) var(--space-3); }
+.apps-sheet > .settings-toggle-row { padding-inline: var(--space-1); }
 /* Peek: an app preview framed in a drawer over the chat (PreviewPeek.tsx). */
 .preview-peek { display: block; inline-size: 100%; block-size: 100%; border: 0; border-radius: var(--radius-md); background: var(--bg); }
 /* Share-sheet landing (ShareDestinationSheet.tsx): what was shared, then one

package/dist/apps/types.js

@@ -24,3 +24,11 @@ export function isAppReference(value) {
     const ref = value;
     return typeof ref.appId === "string" && /^[a-f0-9]{32}$/.test(ref.appId) && typeof ref.sessionId === "string" && ref.sessionId.length > 0 && typeof ref.name === "string" && ref.name.length <= 100;
 }
+/** How long a new share link works. Links live in the machine's memory, so a
+ * restart ends them sooner. Adding a choice means adding a row. */
+export const SHARE_DURATIONS = [
+    { id: "1h", label: "1 hour", ms: 3_600_000 },
+    { id: "1d", label: "1 day", ms: 86_400_000 },
+    { id: "7d", label: "7 days", ms: 7 * 86_400_000 },
+];
+export const DEFAULT_SHARE_DURATION = "1d";

package/dist/controllers/app-commands.js

@@ -34,9 +34,13 @@ export function createAppCommands(service, workspaceFor, published = () => { })
         "apps.notes": (msg) => service.notes(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined, since: typeof msg.since === "number" ? msg.since : undefined }),
         "apps.logs": (msg) => service.logs(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         // The app UI passes exact IDs; `bivy app share` passes an app and/or view by ID or name.
-        "apps.share": (msg) => typeof msg.viewId === "string" && typeof msg.appId === "string"
-            ? service.share(String(msg.sessionId), msg.appId, msg.viewId)
-            : service.shareView(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined }),
+        "apps.share": (msg) => {
+            const options = { duration: msg.duration, controls: msg.controls !== false };
+            return typeof msg.viewId === "string" && typeof msg.appId === "string"
+                ? service.share(String(msg.sessionId), msg.appId, msg.viewId, options)
+                : service.shareView(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined, ...options });
+        },
+        "apps.unshare": (msg) => service.unshare(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.revoke": (msg) => service.revoke(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.remove": (msg) => { service.remove(String(msg.sessionId), String(msg.appId)); return { ok: true }; },
     };

package/dist/protocol/client-command-routes.js

@@ -3,7 +3,7 @@
 /** Direct-mode adapters for operations whose canonical implementation is the
  * client command registry. Relay and HTTP now differ only in framing. */
 export const CLIENT_COMMAND_ROUTES = [
-    ...["list", "publish", "offers", "adopt", "open", "logs", "shot", "input", "menu", "present", "showMe", "mute", "reviewMode", "annotate", "clearNotes", "agentNotes", "notes", "share", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
+    ...["list", "publish", "offers", "adopt", "open", "logs", "shot", "input", "menu", "present", "showMe", "mute", "reviewMode", "annotate", "clearNotes", "agentNotes", "notes", "share", "unshare", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
     { method: "post", path: "/api/artifacts/list", kind: "artifacts.list" },
     { method: "post", path: "/api/auth/credentials/native-preview", kind: "credentials.native.preview" },
     { method: "post", path: "/api/auth/credentials/native-import", kind: "credentials.native.import" },

package/dist/protocol/client-command-schemas.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
 import { Type } from "typebox";
+import { SHARE_DURATIONS } from "../apps/types.js";
 const request = { requestId: Type.Optional(Type.String()) };
 const session = { sessionId: Type.String() };
 const optionalSession = { sessionId: Type.Optional(Type.String()) };
@@ -31,7 +32,9 @@ export const CLIENT_COMMAND_SCHEMAS = {
     "apps.agentNotes": Type.Object({ ...request, ...session, appId: Type.String(), enabled: Type.Boolean() }),
     "apps.notes": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String({ maxLength: 200 })), view: Type.Optional(Type.String({ maxLength: 200 })), since: Type.Optional(Type.Number()) }),
     "apps.logs": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
-    "apps.share": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String({ maxLength: 200 })), viewId: Type.Optional(Type.String()), view: Type.Optional(Type.String({ maxLength: 200 })) }),
+    "apps.share": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String({ maxLength: 200 })), viewId: Type.Optional(Type.String()), view: Type.Optional(Type.String({ maxLength: 200 })),
+        duration: Type.Optional(Type.Union(SHARE_DURATIONS.map((row) => Type.Literal(row.id)))), controls: Type.Optional(Type.Boolean()) }),
+    "apps.unshare": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.revoke": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.remove": Type.Object({ ...request, ...session, appId: Type.String() }),
     "credentials.native.preview": Type.Object({ ...request, label: Type.Optional(Type.String({ maxLength: 100 })) }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.18.11-staging.2",
+  "version": "0.18.11-staging.3",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",