@bivy/bivy 0.18.5-staging.2 → 0.18.5-staging.3

package/dist/github-app-repos.js

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { createAppJwt } from "./github-app-auth.js";
+/** App credentials cannot call /user/repos. Enumerate each installation instead. */
+export async function listGithubAppRepos(apps, fetchImpl = fetch) {
+    const repos = new Map();
+    async function pages(path, token, field) {
+        const rows = [];
+        for (let page = 1;; page++) {
+            const res = await fetchImpl(`https://api.github.com${path}?per_page=100&page=${page}`, {
+                headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "bivy" },
+            });
+            if (!res.ok)
+                throw new Error(`GitHub responded ${res.status} while listing repositories`);
+            const body = await res.json();
+            const batch = field ? body[field] : body;
+            if (!Array.isArray(batch))
+                throw new Error("GitHub returned an invalid repository listing");
+            rows.push(...batch);
+            if (batch.length < 100)
+                return rows;
+        }
+    }
+    for (const app of apps) {
+        const jwt = createAppJwt(app.cfg.appId, app.cfg.privateKeyPem, Math.floor(Date.now() / 1000));
+        for (const installation of await pages("/app/installations", jwt)) {
+            if (installation.suspended_at)
+                continue;
+            const token = await app.cache.get(String(installation.id));
+            for (const repo of await pages("/installation/repositories", token, "repositories")) {
+                if (typeof repo.full_name !== "string" || !repo.full_name)
+                    continue;
+                repos.set(repo.full_name.toLowerCase(), {
+                    slug: repo.full_name,
+                    description: typeof repo.description === "string" ? repo.description : "",
+                    private: Boolean(repo.private),
+                    pushedAt: typeof repo.pushed_at === "string" ? repo.pushed_at : undefined,
+                    defaultBranch: typeof repo.default_branch === "string" ? repo.default_branch : undefined,
+                });
+            }
+        }
+    }
+    return [...repos.values()].sort((a, b) => (b.pushedAt ?? "").localeCompare(a.pushedAt ?? "") || a.slug.localeCompare(b.slug));
+}

package/dist/server.js

@@ -142,6 +142,7 @@ import { computeSessionContract } from "./session/session-contract.js";
 import { SecretVault, resolveSecret } from "./secrets.js";
 import { deviceFlowClientId, requestDeviceCode, pollAccessTokenOnce, REPO_CONNECT_SCOPE } from "./github-device-auth.js";
 import { InstallationTokenCache, createAppJwt, resolveInstallationId } from "./github-app-auth.js";
+import { listGithubAppRepos } from "./github-app-repos.js";
 import { loadGitHubAppConfigs, orderAppsForOwner, listGitHubApps, removeGitHubApp, upsertGitHubApp, privateKeyIdFor, } from "./github-apps.js";
 import { buildAppManifest, convertManifest, renderManifestForm } from "./github-app-manifest.js";
 import { encryptGithubAppEnvelope, decryptGithubAppEnvelope, readLocalGithubAppVaultKey, writeLocalGithubAppVaultKey, forgetLocalGithubAppVaultKey, mintLocalGithubAppVaultKey, } from "./github-app-vault.js";
@@ -4843,6 +4844,7 @@ async function ensureGitHubApps() {
 function invalidateGitHubApps() {
     githubApps = undefined;
     installationIdByRepo.clear();
+    invalidateGithubListingCaches();
 }
 /**
  * The node-side token seam. A GitHub App work item (carries an installationId,
@@ -10482,13 +10484,19 @@ async function createControlPlaneHook(kind = "github") {
     return data;
 }
 // List the GitHub repos the node can reach with its own token (for picking a
-// git workspace). Privacy-preserving: uses only the token stored on this
-// machine (env or `gh`), never the control plane. Returns `authed: false` with
+// git workspace). Uses local App installations when available, otherwise the
+// token stored on this machine (env or `gh`). Returns `authed: false` with
 // an empty list when there's no token so the UI falls back to manual owner/repo.
 async function listAccessibleRepos() {
     if (reposCache && Date.now() - reposCache.at < REPO_LIST_TTL_MS)
         return reposCache.val;
     try {
+        const apps = await ensureGitHubApps();
+        if (apps.length) {
+            const val = { authed: true, repos: await listGithubAppRepos(apps) };
+            reposCache = { at: Date.now(), val };
+            return val;
+        }
         const token = await resolveGitHubToken();
         if (!token)
             return { authed: false, repos: [], reason: (await ghCliInstalled()) ? "gh-unauthed" : "no-token" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.18.5-staging.2",
+  "version": "0.18.5-staging.3",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",