@bivy/bivy 0.18.4-staging.9 → 0.18.5-staging.1

package/bin/bivy.mjs

@@ -194,6 +194,9 @@ function commandPath(extraPath = "") {
     path.join(os.homedir(), ".local", "bin"),
     extraPath,
     process.env.PATH || "",
+    // npm global executables normally live beside the Node binary (including
+    // nvm/fnm installs). Services need this even without shell initialization.
+    path.dirname(process.execPath),
   ].filter(Boolean);
   return [...new Set(parts.flatMap((part) => String(part).split(path.delimiter)).filter(Boolean))].join(path.delimiter);
 }

package/dist/agents/claude-code/runtime.js

@@ -18,7 +18,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { withExactCapabilitySurface } from "../../runtime/types.js";
 import { mapToolCall, mapToolResult } from "../../runtime/tool-call-map.js";
-import { spawnSync } from "node:child_process";
+import { resolveExecutable } from "../../executable.js";
 import fs from "node:fs";
 import { depCacheEnv } from "../../harness/dep-cache.js";
 import os from "node:os";
@@ -33,23 +33,9 @@ import { bivySessionEnv } from "../../runtime/session-env.js";
 /** Binary names a live Claude Code process could be running under (see
  *  native-process-scan.ts's best-effort cwd match). */
 const CLAUDE_BIN_NAMES = ["claude"];
-const CLAUDE_CLI_PATH_CACHE = new Map();
 /** Resolve the operator-installed Claude Code CLI; never use the SDK's bundled fallback. */
 export function claudeCliPath() {
-    const command = process.env.BIVY_CLAUDE_COMMAND?.trim() || "claude";
-    const key = `${command}\0${process.env.PATH ?? ""}`;
-    if (CLAUDE_CLI_PATH_CACHE.has(key))
-        return CLAUDE_CLI_PATH_CACHE.get(key);
-    const result = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
-        shell: process.platform !== "win32",
-        encoding: "utf8",
-    });
-    const resolved = result.status === 0 ? result.stdout.split(/\r?\n/)[0]?.trim() || undefined : undefined;
-    CLAUDE_CLI_PATH_CACHE.set(key, resolved);
-    return resolved;
-}
-export function invalidateClaudeCliProbe() {
-    CLAUDE_CLI_PATH_CACHE.clear();
+    return resolveExecutable(process.env.BIVY_CLAUDE_COMMAND?.trim() || "claude") ?? undefined;
 }
 export function claudeCliAvailable() {
     return Boolean(claudeCliPath());

package/dist/agents/codex/integration.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
+import { resolveExecutable } from "../../executable.js";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { defineAgentIntegration } from "../definition.js";
@@ -10,25 +11,11 @@ import { deleteCodexSession, discoverNativeCodexSessions, loadCodexTranscript, w
 import { ProtocolRuntime } from "../../runtime/protocol.js";
 import { codexSlashCommands } from "../../runtime/slash-commands.js";
 export const CODEX_TESTED_VERSION = "0.156.1";
-const CODEX_AVAILABLE_CACHE = new Map();
 function codexCommand() {
     return process.env.BIVY_CODEX_BIN?.trim() || "codex";
 }
 export function codexCommandAvailable() {
-    const command = codexCommand();
-    const cached = CODEX_AVAILABLE_CACHE.get(command);
-    if (cached !== undefined)
-        return cached;
-    const result = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
-        shell: process.platform !== "win32",
-        stdio: "ignore",
-    });
-    const available = result.status === 0;
-    CODEX_AVAILABLE_CACHE.set(command, available);
-    return available;
-}
-export function invalidateCodexCommandProbe() {
-    CODEX_AVAILABLE_CACHE.clear();
+    return resolveExecutable(codexCommand()) !== null;
 }
 async function suggestCodexSessionName(firstPrompt, context) {
     const prompt = firstPrompt.trim();

package/dist/agents/pi/integration.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
-import { spawnSync } from "node:child_process";
+import { resolveExecutable } from "../../executable.js";
 import os from "node:os";
 import path from "node:path";
 import { defineAgentIntegration } from "../definition.js";
@@ -36,22 +36,8 @@ export async function listNativePiSessions() {
         firstMessage: session.firstMessage,
     }));
 }
-const PI_COMMAND_CACHE = new Map();
 export function piCommandAvailable() {
-    const command = piCommand();
-    const cached = PI_COMMAND_CACHE.get(command);
-    if (cached !== undefined)
-        return cached;
-    const result = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
-        shell: process.platform !== "win32",
-        stdio: "ignore",
-    });
-    const available = result.status === 0;
-    PI_COMMAND_CACHE.set(command, available);
-    return available;
-}
-export function invalidatePiCommandProbe() {
-    PI_COMMAND_CACHE.clear();
+    return resolveExecutable(piCommand()) !== null;
 }
 export function piBridgeInstalled() {
     try {

package/dist/apps/gateway.js

@@ -12,6 +12,7 @@ import { previewShell } from "./preview-shell.js";
 import { displayViewer, DISPLAY_MENU_PATH, DISPLAY_SOCKET_PATH, DISPLAY_STATS_PATH, NOVNC_PATH } from "./display-viewer.js";
 import { pressMenu, readMenuPath, readMenus } from "./menu.js";
 import { inspectorScript } from "./inspector.js";
+import { readStrokes } from "./annotate.js";
 const MIME = {
     ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8",
     ".css": "text/css; charset=utf-8", ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png",
@@ -199,6 +200,7 @@ export class AppGateway {
     registry;
     returnOrigins;
     signIn;
+    captureNote;
     server;
     template;
     tickets = new Map();
@@ -210,13 +212,16 @@ export class AppGateway {
      *  `embedded`: it runs framed inside a Bivy client (a third-party frame). */
     sessions = new Map();
     sockets = new Map();
+    captureAfter = 0;
+    capturing = false;
     displays = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: false });
     /** `signIn` sends a signed-out visit to a view's stable address back
      * through Bivy, which re-opens it for a signed-in device. */
-    constructor(registry, originTemplate, returnOrigins = () => [], signIn) {
+    constructor(registry, originTemplate, returnOrigins = () => [], signIn, captureNote) {
         this.registry = registry;
         this.returnOrigins = returnOrigins;
         this.signIn = signIn;
+        this.captureNote = captureNote;
         this.template = previewOriginTemplate(originTemplate);
         this.server = http.createServer((req, res) => { void this.handle(req, res).catch(() => { if (!res.headersSent)
             res.writeHead(502); res.end("Preview request failed."); }); });
@@ -253,12 +258,12 @@ export class AppGateway {
         this.requireWeb(id);
         return `${this.origin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: Date.now() + 60_000 })}`;
     }
-    /** A reusable link straight to the app origin (no shell frame), so it opens
-     * in any browser and can be inspected. Valid until revoked or SHARE_TTL. */
+    /** Public reviewers use the same isolated controls as the owner, but can
+     * only submit notes. Valid until revoked or SHARE_TTL. */
     share(id) {
         this.requireWeb(id);
         const expiresAt = Date.now() + SHARE_TTL;
-        return { url: `${this.origin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true })}`, expiresAt };
+        return { url: `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true })}`, expiresAt };
     }
     revoke(id) {
         for (const map of [this.tickets, this.sessions])
@@ -366,7 +371,7 @@ export class AppGateway {
                 return;
             }
             res.setHeader("Content-Type", "application/json");
-            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
+            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(grant.reusable ? { reviewer: true } : {}), ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
             return;
         }
         res.writeHead(404);
@@ -731,7 +736,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         let body = "";
         for await (const chunk of req) {
             body += chunk.toString();
-            if (body.length > 4096) {
+            if (body.length > 256_000) {
                 res.writeHead(413);
                 res.end();
                 return;
@@ -747,6 +752,16 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             return;
         }
         const text = (value, max) => typeof value === "string" ? value.trim().slice(0, max) : "";
+        if (!input || typeof input !== "object" || Array.isArray(input)) {
+            res.writeHead(400);
+            res.end();
+            return;
+        }
+        if (input.mark === undefined && input.context === undefined && body.length > 4096) {
+            res.writeHead(413);
+            res.end();
+            return;
+        }
         const note = text(input.note, 1000);
         if (!note) {
             res.writeHead(400);
@@ -755,12 +770,71 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         }
         const viewport = input.viewport;
         const path = text(input.path, 2048);
+        let shot;
+        if (input.mark !== undefined) {
+            // Public input cannot choose a session, app, Compare image, or capture
+            // dimensions beyond a modest viewport. No agent commands are exposed.
+            if (!this.session(req, entry.view.id)?.reviewer) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
+            let mark;
+            try {
+                const raw = input.mark;
+                const strokes = readStrokes(raw?.strokes);
+                const v = raw.viewport;
+                if (!Number.isFinite(v?.width) || !Number.isFinite(v?.height) || v.width < 40 || v.width > 4000 || v.height < 40 || v.height > 4000 || v.width * v.height > 4_000_000)
+                    throw Error();
+                const scroll = raw.scroll;
+                if (scroll && (![scroll.x, scroll.y].every(n => Number.isFinite(n) && n >= 0 && n <= 100_000)))
+                    throw Error();
+                if (strokes.some(s => s.points.some(([x, y]) => x < 0 || y < 0 || x > 104_000 || y > 104_000)))
+                    throw Error();
+                // Bound raster work as well as JSON size (long off-screen paths can
+                // otherwise consume CPU even though they paint no visible pixels).
+                const distance = strokes.reduce((total, s) => total + s.points.reduce((length, p, i) => i ? length + Math.hypot(p[0] - s.points[i - 1][0], p[1] - s.points[i - 1][1]) : length, 0), 0);
+                if (distance > 50_000)
+                    throw Error();
+                mark = { appId: entry.app.id, viewId: entry.view.id, strokes, viewport: v, path: text(raw.path, 2048), scroll, dpr: 1, theme: raw.theme === "dark" ? "dark" : "light", signals: { unknown: true } };
+            }
+            catch {
+                res.writeHead(400);
+                res.end("Invalid or oversized annotation. Try fewer marks or a narrower preview.");
+                return;
+            }
+            if (this.capturing || Date.now() < this.captureAfter) {
+                res.writeHead(429);
+                res.end("Please wait a moment before sending another picture.");
+                return;
+            }
+            this.capturing = true;
+            this.captureAfter = Date.now() + 10_000;
+            try {
+                shot = await this.captureNote?.(entry, mark);
+            }
+            catch {
+                res.writeHead(502);
+                res.end("Could not take the picture. Your note has not been sent; please retry.");
+                return;
+            }
+            finally {
+                this.capturing = false;
+            }
+            if (!this.session(req, entry.view.id) || this.registry.getView(entry.view.id) !== entry) {
+                res.writeHead(401);
+                res.end();
+                return;
+            }
+        }
         this.registry.addNote(entry.view.id, {
+            ...(shot ? { shot } : {}),
+            ...(input.context ? { context: text(input.context, 8000) } : {}),
             id: randomBytes(8).toString("hex"), at: Date.now(), note, selector: text(input.selector, 300), text: text(input.text, 200),
             path: path.startsWith("/") ? path : "/", viewport: { width: Number(viewport?.width) || 0, height: Number(viewport?.height) || 0 },
         });
-        res.writeHead(204);
-        res.end();
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ screenshot: Boolean(shot) }));
     }
     /** Compare shots for the shell: the list, or one PNG by index. */
     compare(req, res, entry) {

package/dist/apps/inspector.js

@@ -51,7 +51,7 @@ const report=(el,hold)=>{
   const r=el.getBoundingClientRect();
   onPicked({type:'picked',selector:selector(el),tag:el.localName,text:(el.innerText||el.getAttribute('aria-label')||el.getAttribute('alt')||'').trim().replace(/\\s+/g,' ').slice(0,200),
     rect:{x:Math.round(r.left),y:Math.round(r.top),width:Math.round(r.width),height:Math.round(r.height)},
-    viewport:{width:innerWidth,height:innerHeight},path:location.pathname+location.search+location.hash,hold});
+    viewport:{width:innerWidth,height:innerHeight},scroll:{x:Math.round(scrollX),y:Math.round(scrollY)},theme:matchMedia('(prefers-color-scheme: dark)').matches?'dark':'light',path:location.pathname+location.search+location.hash,hold});
 };
 // A long press picks at once and says so (the shell starts listening); the
 // layer stays until the finger lifts, so the release never reaches the app.
@@ -123,7 +123,12 @@ const marked=r=>{
 addEventListener('message',e=>{
   if(!framed||e.origin!==SHELL||e.source!==parent)return;
   const d=e.data||{},n=v=>Number.isFinite(+v)?+v:0;
-  if(d.type==='bivy:draw')post(drawState());
+  if(d.type==='bivy:note'&&REVIEWER){
+    void fetch('/__bivy/notes',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(d.note)})
+      .then(async r=>{if(!r.ok)throw Error(r.status===429?'Please wait a moment before sending another picture.':r.status===400||r.status===502?(await r.text()).slice(0,200):'Could not send. Check that the link is still valid and try again.');return r.json();})
+      .then(result=>post({type:'note-sent',id:d.id,screenshot:result.screenshot===true}),error=>post({type:'note-sent',id:d.id,error:error.message}));
+  }
+  else if(d.type==='bivy:draw')post(drawState());
   else if(d.type==='bivy:scroll'){scrollBy({left:n(d.dx),top:n(d.dy),behavior:'instant'});post({type:'scrolled',scroll:{x:Math.round(scrollX),y:Math.round(scrollY)}});}
   else if(d.type==='bivy:marks'&&d.rect)post({type:'marked',id:n(d.id),elements:marked({x:n(d.rect.x),y:n(d.rect.y),width:n(d.rect.width),height:n(d.rect.height)})});
 });

package/dist/apps/preview-shell.js

@@ -48,8 +48,8 @@ nav .btn[aria-pressed="true"] { background:var(--accent-soft); color:var(--accen
 /* Hold to talk: a phone-sized target that never selects text or opens a callout. */
 #mic { flex:none; inline-size:var(--space-7); block-size:var(--space-7); padding:0; border-radius:var(--radius-full); touch-action:none; user-select:none; -webkit-user-select:none; -webkit-touch-callout:none; }
 #mic[aria-pressed="true"] { background:var(--accent); border-color:var(--accent); color:var(--accent-contrast); }
-#voice-status { font-size:var(--text-xs); margin:var(--space-2) 0 0; }
-#voice-status:empty { display:none; }
+#voice-status, #note-status { font-size:var(--text-xs); margin:var(--space-2) 0 0; }
+#voice-status:empty, #note-status:empty { display:none; }
 /* The note owns the dock while editing. Only its body scrolls; actions never
    cover the text field, even when the keyboard leaves little vertical room. */
 #dock { max-height:calc(100% - var(--space-4)); }
@@ -107,6 +107,7 @@ nav .btn[aria-pressed="true"] { background:var(--accent-soft); color:var(--accen
     <button class="btn" id="mic" type="button" hidden aria-pressed="false" aria-label="Speak" title="Hold to speak, or tap to start and stop"><svg viewBox="0 0 24 24" width="20" height="20" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 15.5a3 3 0 003-3V6a3 3 0 10-6 0v6.5a3 3 0 003 3z"/><path d="M6 11.5v1a6 6 0 0012 0v-1M12 18.5V21M9 21h6"/></svg></button></div>
     <p class="muted" id="voice-status" role="status"></p>
     <p class="muted" id="draft-hint">Review in chat before sending.</p>
+    <p class="muted" id="note-status" role="status"></p>
     <details id="draft-details"><summary>Preview context</summary><pre id="draft-context"></pre></details>
     </div>
     <div class="panel-actions"><button class="btn sm ghost" id="draft-cancel">Cancel</button><button class="btn sm primary" id="draft-add">Add to chat</button></div>
@@ -146,9 +147,16 @@ const embedded=parent!==window;
 const toBivy=m=>parent.postMessage(Object.assign({source:'bivy-preview'},m),location.ancestorOrigins?.[0]||new URL(metadata.returnTo).origin);
 const storageKey='bivy-preview';
 const safePath=p=>typeof p==='string'&&p.startsWith('/')&&!p.startsWith('//')&&p.length<=2048?p:'/';
-const open=(path,message)=>{status.hidden=false;status.textContent=message;resetConsole();frame.src=metadata.origin+safePath(path);};
+const reviewerTools=ready=>{if(metadata?.reviewer)for(const id of ['point','draw','errors'])$(id).disabled=!ready;};
+const open=(path,message)=>{status.hidden=false;status.textContent=message;resetConsole();reviewerTools(false);frame.src=metadata.origin+safePath(path);};
 function show(data,launch){
   metadata=data;
+  if(data.reviewer){
+    drawOk=data.inspect!==false;$('draw').hidden=!drawOk;back.hidden=true;
+    $('draft-title').textContent='Note for the app’s owner';
+    $('draft-text').maxLength=1000;
+    $('send-errors').textContent='Leave a note…';
+  }
   $('title').textContent=data.name;
   $('title').title=data.name;
   document.title='Bivy · '+data.name;
@@ -161,8 +169,9 @@ function show(data,launch){
   for(const b of [$('point'),$('errors')])b.hidden=data.inspect===false;
   if(data.inspect===false)frame.allow='clipboard-read; clipboard-write';
   frame.src=data.origin+(launch?'/__bivy/open#'+(embedded?'e:':'')+launch+(startPage?'~'+startPage:''):'/');
-  back.hidden=embedded&&Boolean(data.returnTo);
+  back.hidden=Boolean(data.reviewer)||(embedded&&Boolean(data.returnTo));
   for(const b of [reload,$('point'),$('errors')])b.disabled=false;
+  reviewerTools(false);
   status.textContent='Loading app…';
   frame.onload=()=>{status.hidden=true;void loadCompare();if(revision===null){revision=-1;watch();}else if(wake)wake();};
   // A Bivy client framing the shell says whether it can take dictation.
@@ -189,16 +198,21 @@ async function watch(){
     revision=d.revision;retry=0;setTimeout(watch,0);
   }catch{retry=Math.min(30000,(retry||1000)*2);const t=setTimeout(watch,retry);wake=()=>{clearTimeout(t);watch();};}
 }
-// Drafts go to the session's composer; nothing is ever sent from here.
+// Owner drafts go to the session's composer. Reviewer drafts use only the
+// bounded notes endpoint, never the owner's command channel.
 function toChat(text){
   if(embedded)return toBivy({type:'draft',text});
   const to=new URL(metadata.returnTo),session=to.pathname.split('/').pop();
   location.assign(to.origin+'/share?session='+encodeURIComponent(session)+'&text='+encodeURIComponent(text));
 }
+let noteMark=null,pendingNote=null,noteSequence=0;
 function draft(context,listen){
-  panels(null);
+  panels(null);noteMark=null;
+  $('draft-add').disabled=false;
+  $('note-status').textContent='';
+  $('draft-hint').textContent=metadata.reviewer?'Feedback only — no agent runs. Pictures are approximate; if screenshots are off, we save text and mark details.':'Review in chat before sending.';
   $('draft').hidden=false;
-  $('draft-add').textContent=metadata.returnTo?'Add to chat':'Copy';
+  $('draft-add').textContent=metadata.reviewer?'Send note':metadata.returnTo?'Add to chat':'Copy';
   $('draft-context').textContent=context;
   $('draft-details').open=false;
   const box=$('draft-text');box.value='';
@@ -240,12 +254,34 @@ function fromBivy(d){
 $('draft-cancel').onclick=()=>{const target=marks?$('draw'):point;cancelListening();$('draft').hidden=true;endDraw();target.focus();};
 $('draft-add').onclick=async()=>{
   cancelListening();
-  const note=$('draft-text').value.trim(),text=(note?note+'\\n\\n':'')+$('draft-context').textContent;
+  const note=$('draft-text').value.trim();
+  if(metadata.reviewer){
+    if(!note){$('note-status').textContent='Write a note before sending.';$('draft-text').focus();return;}
+    const mark=marks||noteMark,id=++noteSequence;
+    $('draft-add').disabled=true;$('draft-cancel').disabled=true;$('draft-text').disabled=true;
+    $('note-status').textContent='Sending note…';$('draft-add').textContent='Sending…';
+    const timer=setTimeout(()=>finishNote({id,error:'No reply yet. Your note may have arrived; check the connection before retrying.'}),60000);
+    pendingNote={id,timer};
+    frame.contentWindow?.postMessage({type:'bivy:note',id,note:{note,context:$('draft-context').textContent,selector:mark?.selector||'',text:mark?.text||'',path:mark?.path||currentPath,viewport:mark?.viewport||{width:frame.clientWidth,height:frame.clientHeight},...(mark?{mark}:{})}},metadata.origin);
+    return;
+  }
+  const text=(note?note+'\\n\\n':'')+$('draft-context').textContent;
   // Marks go to the Bivy client, which adds a picture made on the machine.
   if(marks){const mark=marks;$('draft').hidden=true;endDraw();return toBivy({type:'annotation',text,mark});}
   if(metadata.returnTo){$('draft').hidden=true;return toChat(text);}
   try{await navigator.clipboard.writeText(text);$('draft-add').textContent='Copied';}catch{$('draft-text').select();}
 };
+$('draft-text').addEventListener('input',()=>{if(!pendingNote)$('note-status').textContent='';});
+function finishNote(d){
+  if(!pendingNote||d.id!==pendingNote.id)return;
+  clearTimeout(pendingNote.timer);pendingNote=null;
+  $('draft-cancel').disabled=false;$('draft-add').disabled=false;$('draft-text').disabled=false;$('draft-add').textContent='Send note';
+  if(d.error){$('note-status').textContent=String(d.error).slice(0,200);return;}
+  $('draft').hidden=true;endDraw();noteMark=null;
+  $('stamp').textContent=d.screenshot?'Note and approximate picture sent':'Note sent without a picture';
+  status.hidden=false;status.textContent=$('stamp').textContent+'. The app’s owner will see it.';
+  point.focus();
+}
 // Console
 let entries=[];
 function resetConsole(){entries=[];renderConsole();}
@@ -274,13 +310,15 @@ function picked(d){
   draft('In the app preview "'+metadata.name+'" (page '+safePath(d.path)+', viewport '+v.width+'×'+v.height+'):\\n'
     +'Element: '+String(d.selector).slice(0,300)+(d.text?' ("'+String(d.text).slice(0,200)+'")':'')+', '+r.width+'×'+r.height+' at '+r.x+','+r.y
     +(errors.length?'\\nRecent errors:\\n'+errors.map(e=>'- '+e.text).join('\\n'):''),d.hold===true&&voice);
+  if(metadata.reviewer){const s=pos(d.scroll);noteMark={path:safePath(d.path),viewport:v,scroll:s,theme:d.theme,selector:String(d.selector).slice(0,300),text:String(d.text||'').slice(0,200),strokes:[{tool:'box',points:[[r.x+s.x,r.y+s.y],[r.x+r.width+s.x,r.y+r.height+s.y]]}]};}
 }
 // Draw: freeze the app and mark what's wrong. Marks are kept in page
 // coordinates (so they stay on the content while two fingers scroll), and
 // the app reports what's under each one. On Done they go into the draft box
 // with that context; Add to chat hands them to the Bivy client, which gets a
-// picture from the machine. Nothing about them goes through this origin's
-// network. Compare's "after" shot can be marked the same way.
+// picture from the machine. Reviewers instead submit marks with their note;
+// pictures stay on the machine for the owner. Compare's "after" shot can be
+// marked the same way by the owner.
 const ink=$('ink'),inkMarks=$('ink-marks'),SVG='http://www.w3.org/2000/svg';
 let draw=null,marks=null,drawOk=false,nextStroke=0;
 const pos=v=>({x:Number(v?.x)||0,y:Number(v?.y)||0});
@@ -401,6 +439,7 @@ $('draw-done').onclick=()=>{
 // Compare: screenshots around the agent's last change (agent screenshots on).
 const compareBtn=$('compare-btn');let shots=[],urls=[],compareAfter=-1;
 async function loadCompare(){
+  if(metadata.reviewer)return;
   try{const r=await fetch(metadata.origin+'/__bivy/compare',{credentials:'include',cache:'no-store'});if(!r.ok)return;shots=(await r.json()).shots||[];compareBtn.hidden=shots.length<2;}catch{}
 }
 function panels(open){if(listening)cancelListening();if(draw&&!(open==='compare'&&draw.target==='compare'))endDraw();for(const [id,btn] of [['console','errors'],['compare','compare-btn']]){$(id).hidden=id!==open;$(btn).setAttribute('aria-pressed',String(id===open));}$('draft').hidden=true;}
@@ -443,7 +482,8 @@ addEventListener('message',e=>{
     downText.textContent='Nothing is answering on port '+downPort+'.';
     ask.hidden=!metadata.returnTo;
   }else if(d.source==='bivy-inspector'){
-    if(d.type==='route')currentPath=safePath(d.path);
+    if(d.type==='note-sent'&&metadata.reviewer)finishNote(d);
+    else if(d.type==='route'){currentPath=safePath(d.path);reviewerTools(true);}
     else if(d.type==='console'&&(d.level==='error'||d.level==='warn')){entries.push({level:d.level,text:String(d.text).slice(0,500)});if(entries.length>50)entries.shift();renderConsole();}
     else if(d.type==='picked')picked(d);
     else if(d.type==='release'&&heldAt){heldAt=0;stopListening();}

package/dist/apps/registry.js

@@ -15,7 +15,9 @@ const isNote = (value) => {
     const note = value;
     return !!note && typeof note.id === "string" && typeof note.at === "number" && typeof note.note === "string" && note.note.length <= 1000
         && typeof note.selector === "string" && typeof note.text === "string" && typeof note.path === "string"
-        && typeof note.viewport?.width === "number" && typeof note.viewport?.height === "number";
+        && typeof note.viewport?.width === "number" && typeof note.viewport?.height === "number"
+        && (note.context === undefined || (typeof note.context === "string" && note.context.length <= 8000))
+        && (note.shot === undefined || (typeof note.shot?.hash === "string" && /^[a-f0-9]{64}$/.test(note.shot.hash) && Number.isFinite(note.shot.size) && Number.isFinite(note.shot.width) && Number.isFinite(note.shot.height)));
 };
 const sameFiles = (a, b) => a.size === b.size && [...a].every(([key, data]) => b.get(key)?.equals(data));
 /** Snapshot, not a live filesystem server: symlinks and hidden files are never published. */
@@ -295,6 +297,10 @@ export class AppRegistry extends EventEmitter {
         this.save();
     }
     agentNotes(id) { return this.apps.get(id)?.agentNotes === true; }
+    /** Includes persisted apps not restored yet; unread pictures survive GC. */
+    notePictureHashes() {
+        return [...this.persisted.values()].flatMap(record => Object.values(record.notes ?? {}).flatMap(notes => Array.isArray(notes) ? notes.filter(isNote).flatMap(note => note.shot ? [note.shot.hash] : []) : []));
+    }
     /** A reviewer's note: kept bounded, saved with the app, announced (`notes`). */
     addNote(viewId, note) {
         const entry = this.views.get(viewId);

package/dist/apps/remote-preview.js

@@ -9,15 +9,17 @@ export class RemotePreview {
     registry;
     returnOrigins;
     signIn;
+    captureNote;
     gateway;
     origin;
     relayUrl;
     online = false;
     sockets = new Set();
-    constructor(registry, returnOrigins, signIn) {
+    constructor(registry, returnOrigins, signIn, captureNote) {
         this.registry = registry;
         this.returnOrigins = returnOrigins;
         this.signIn = signIn;
+        this.captureNote = captureNote;
     }
     get available() { return this.online && Boolean(this.gateway); }
     ready(origin, relayUrl) {
@@ -30,7 +32,7 @@ export class RemotePreview {
             return;
         if (this.origin !== template) {
             this.gateway?.close();
-            this.gateway = new AppGateway(this.registry, template, this.returnOrigins, this.signIn);
+            this.gateway = new AppGateway(this.registry, template, this.returnOrigins, this.signIn, this.captureNote);
             this.origin = template;
         }
         this.relayUrl = relayUrl.replace(/\/$/, "") + "/preview/stream";

package/dist/executable.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import path from "node:path";
+/** Resolve without a shell or a lifetime cache: installs, removals and PATH
+ * changes must be visible to a running daemon as well as its terminals. */
+export function resolveExecutable(command, env = process.env, cwd = process.cwd()) {
+    if (!command.trim())
+        return null;
+    const win = process.platform === "win32";
+    const isExecutable = (file) => {
+        try {
+            if (!fs.statSync(file).isFile())
+                return false;
+            fs.accessSync(file, win ? fs.constants.F_OK : fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const exts = win ? (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+    const withExts = (file) => exts.map((ext) => (ext && !file.toLowerCase().endsWith(ext.toLowerCase()) ? file + ext : file));
+    const explicit = command.includes("/") || (win && command.includes("\\"));
+    const bases = explicit
+        ? [path.resolve(cwd, command)]
+        : (env.PATH || "").split(path.delimiter).filter(Boolean).map((dir) => path.resolve(cwd, dir, command));
+    for (const base of bases) {
+        for (const candidate of withExts(base)) {
+            if (isExecutable(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}

package/dist/runtime/host.js

@@ -66,8 +66,9 @@ export class RuntimeHost {
         const info = this.list(canonical).find((candidate) => candidate.id === canonical);
         if (!info)
             throw new Error(`Unknown agent: ${wantId}`);
-        if (info.status !== "available")
-            throw new Error(`${info.displayName} is not available on this node yet.`);
+        if (info.status !== "available") {
+            throw new Error(`${info.displayName} is not available on this node. ${info.notes || "Install this agent on the node before starting a session."}`);
+        }
         return canonical;
     }
     get(requested, fallback, sandbox) {

package/dist/runtime/index.js

@@ -4,12 +4,13 @@
 // This is the seam where additional runtimes (Claude Agent SDK, generic RPC,
 // …) are registered without touching the daemon.
 import { spawnSync } from "node:child_process";
+import { resolveExecutable as resolveCommandPath } from "../executable.js";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { ClaudeCodeRuntime, claudeRuntimeFromEnv, claudeSdkInstalled, invalidateClaudeCliProbe } from "../agents/claude-code/runtime.js";
+import { ClaudeCodeRuntime, claudeRuntimeFromEnv, claudeSdkInstalled } from "../agents/claude-code/runtime.js";
 import { claudeCodeIntegration } from "../agents/claude-code/integration.js";
-import { codexAppServerRuntime, codexIntegration, invalidateCodexCommandProbe, } from "../agents/codex/integration.js";
-import { invalidatePiCommandProbe, piAgentDir, piCommandAvailable, piIntegration, LazyPiRuntime } from "../agents/pi/integration.js";
+import { codexAppServerRuntime, codexIntegration, } from "../agents/codex/integration.js";
+import { piAgentDir, piCommandAvailable, piIntegration, LazyPiRuntime } from "../agents/pi/integration.js";
 import { deleteCodexSession, loadCodexTranscript } from "./codex-sessions.js";
 import { deleteOpenCodeSession, exportOpenCodeSession, importOpenCodeSession, loadOpenCodeTranscript, writeOpenCodeHistory } from "./opencode-sessions.js";
 import { discoverNativeGrokSessions, listGrokSessions, loadGrokTranscript } from "./grok-sessions.js";
@@ -70,27 +71,9 @@ function cliSlashCommands(spec) {
 }
 export * from "./types.js";
 export { NodeCredentialResolver, createCredentialStore } from "./credentials.js";
-// Memoized CLI probes. `commandAvailable`/`resolveCommandPath`/`probeHelpText`
-// each shell out with a BLOCKING spawnSync, and the runtime catalog that calls
-// them (cliAgentInfo → prefersAcp/acpSupportedByBinary) is rebuilt often — on
-// every advertise and every runtimes.list send. Re-probing per build stalled the
-// event loop for seconds at a time (a synchronous spawn storm). A CLI's presence
-// is effectively constant for the daemon's run, so cache per command for the
-// process lifetime and clear on install (invalidateCliProbeCache).
-const COMMAND_AVAILABLE_CACHE = new Map();
+// Filesystem lookup stays fresh without spawning a shell on every catalog build.
 function commandAvailable(command) {
-    if (!command.trim())
-        return false;
-    const cached = COMMAND_AVAILABLE_CACHE.get(command);
-    if (cached !== undefined)
-        return cached;
-    const result = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
-        shell: process.platform !== "win32",
-        stdio: "ignore",
-    });
-    const available = result.status === 0;
-    COMMAND_AVAILABLE_CACHE.set(command, available);
-    return available;
+    return resolveCommandPath(command) !== null;
 }
 function genericCliInfo() {
     const options = processRuntimeFromEnv();
@@ -421,29 +404,6 @@ function cliThinkingConfig(id, spec) {
 // installed binary doesn't actually mention. It never UPGRADES — adding a
 // capability needs the exact arg template, which help text can't safely supply — so
 // probing can only make the catalog MORE honest, never invent a no-op control.
-/**
- * Absolute path of a command on the current PATH, or null when it isn't there.
- * Used to key the help-probe cache: caching by the bare NAME would keep serving a
- * stale answer after the binary behind that name changed (a CLI upgraded or
- * installed while the daemon is running, or a different PATH entry winning).
- * Memoized per command (see COMMAND_AVAILABLE_CACHE) — it spawnSyncs, and is hit
- * on every catalog build.
- */
-const COMMAND_PATH_CACHE = new Map();
-function resolveCommandPath(command) {
-    if (!command.trim())
-        return null;
-    const cached = COMMAND_PATH_CACHE.get(command);
-    if (cached !== undefined)
-        return cached;
-    const res = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
-        shell: process.platform !== "win32",
-        encoding: "utf8",
-    });
-    const resolved = res.status !== 0 ? null : ((res.stdout ?? "").split(/\r?\n/)[0]?.trim() || null);
-    COMMAND_PATH_CACHE.set(command, resolved);
-    return resolved;
-}
 const HELP_PROBE_CACHE = new Map();
 function probeHelpText(command) {
     const key = resolveCommandPath(command) ?? command;
@@ -461,21 +421,10 @@ function probeHelpText(command) {
     HELP_PROBE_CACHE.set(key, text);
     return text;
 }
-/**
- * Drop every memoized CLI probe (availability, resolved path, --help text). These
- * probes shell out with a blocking spawnSync and are cached for the process
- * lifetime to keep the frequently-rebuilt runtime catalog off the event loop, so a
- * CLI installed/updated mid-run wouldn't otherwise be noticed until a restart.
- * Call this right after Bivy installs a runtime so the next catalog build re-probes
- * and reflects the new binary immediately.
- */
+/** Refresh expensive help probes after Bivy installs or updates an agent.
+ * Executable availability itself is never cached. */
 export function invalidateCliProbeCache() {
-    COMMAND_AVAILABLE_CACHE.clear();
-    COMMAND_PATH_CACHE.clear();
     HELP_PROBE_CACHE.clear();
-    invalidatePiCommandProbe();
-    invalidateClaudeCliProbe();
-    invalidateCodexCommandProbe();
 }
 // A resume template mixes launch flags (`-p`, `--force`) with the resume-specific
 // token(s) (`--resume`, `threads continue`, `-s`, `--restore`, …). Only the latter

package/dist/server.js

@@ -239,7 +239,7 @@ process.chdir(appDir);
 // dirs here makes commands work from agent shells without requiring a user shell
 // profile.
 const userLocalPrefix = process.env.BIVY_NPM_GLOBAL_PREFIX || path.join(process.env.HOME ?? os.homedir(), ".local");
-process.env.PATH = [path.join(repoRoot, "bin"), path.join(userLocalPrefix, "bin"), process.env.PATH || ""].filter(Boolean).join(path.delimiter);
+process.env.PATH = [path.join(repoRoot, "bin"), path.join(userLocalPrefix, "bin"), process.env.PATH || "", path.dirname(process.execPath)].filter(Boolean).join(path.delimiter);
 const piDir = path.join(appDir, "pi");
 // The node's shared, agent-neutral credential vault (auth.enc/auth.key). NOT
 // inside any one agent's dir — every runtime (Pi, Codex, Claude, …) reads the
@@ -1654,6 +1654,8 @@ function referencedAttachmentHashes() {
                 hashes.add(entry.ref.hash);
         }
     }
+    for (const hash of appRegistry.notePictureHashes())
+        hashes.add(hash);
     return eventLog.health().ok ? hashes : null;
 }
 // --- Warm session replication (docs/session-replication.md) -----------------
@@ -1842,8 +1844,18 @@ const appSignIn = (view, pagePath) => {
         return undefined;
     return `${new URL(client).origin}/sessions/${encodeURIComponent(view.app.sessionId)}?node=${encodeURIComponent(identity.nodeId)}#preview=${view.app.id}.${view.view.id}.${encodeURIComponent(pagePath)}`;
 };
-const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, process.env.BIVY_APPS_ORIGIN, appReturnOrigins, appSignIn) : undefined;
-const remotePreview = new RemotePreview(appRegistry, appReturnOrigins, appSignIn);
+// Public notes get owner-only encrypted pictures, never a screenshot response
+// on the public origin. The annotation service honors appScreenshots being off.
+const captureReviewerNote = async (entry, mark) => {
+    const result = await appService.annotate(entry.app.sessionId, mark);
+    if (!result.image)
+        return undefined;
+    const image = result.image;
+    const ref = attachmentStore.put(Buffer.from(image.data, "base64"), { name: "Reviewer note (approximate).png", mimeType: "image/png", kind: "image" });
+    return { hash: ref.hash, size: ref.size, width: image.width, height: image.height };
+};
+const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, process.env.BIVY_APPS_ORIGIN, appReturnOrigins, appSignIn, captureReviewerNote) : undefined;
+const remotePreview = new RemotePreview(appRegistry, appReturnOrigins, appSignIn, captureReviewerNote);
 // Desktop app views: one private display per view, started on first open.
 const appDisplays = createDisplayHost(appDir);
 /** Review cards: screenshots become encrypted attachments (fetched by hash

package/dist/terminal.js

@@ -2,6 +2,7 @@
 // Copyright (c) 2026 Petter André Sjulstad
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
+import { resolveExecutable } from "./executable.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { depCacheEnv } from "./harness/dep-cache.js";
@@ -70,41 +71,7 @@ function defaultShell() {
  * Resolving up front lets open() throw a clear, catchable error — and hands the
  * PTY an unambiguous absolute path.
  */
-export function resolveExecutable(command, env, cwd) {
-    const win = process.platform === "win32";
-    const isExecutable = (file) => {
-        try {
-            if (!fs.statSync(file).isFile())
-                return false;
-            if (win)
-                return true;
-            fs.accessSync(file, fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    };
-    // On Windows a bare name may need a PATHEXT suffix (claude → claude.cmd).
-    const exts = win ? (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-    const withExts = (file) => exts.map((ext) => (ext && !file.toLowerCase().endsWith(ext.toLowerCase()) ? file + ext : file));
-    // A command with an explicit path is resolved directly (against the workspace
-    // for a relative one), never via PATH — same as exec.
-    if (command.includes("/") || (win && command.includes("\\"))) {
-        for (const candidate of withExts(path.resolve(cwd, command))) {
-            if (isExecutable(candidate))
-                return candidate;
-        }
-        return null;
-    }
-    for (const dir of (env.PATH || "").split(path.delimiter).filter(Boolean)) {
-        for (const candidate of withExts(path.join(dir, command))) {
-            if (isExecutable(candidate))
-                return candidate;
-        }
-    }
-    return null;
-}
+export { resolveExecutable } from "./executable.js";
 /**
  * Restore the execute bit on node-pty's bundled `spawn-helper` binary.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.18.4-staging.9",
+  "version": "0.18.5-staging.1",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",