@bivy/bivy 0.2.1 → 0.3.0

package/dist/server.js

@@ -4578,6 +4578,36 @@ function invalidateGitHubApps() {
  * replies post as `<app>[bot]`; anything else uses the device-flow PAT. This is
  * where future sources (Slack bot token, Linear/Notion OAuth) branch in.
  */
+// Hosted (control-plane-orchestrated) machines carry neither a static GitHub
+// token nor an app key. When BIVY_HOSTED_MINT is set they mint a fresh,
+// short-lived token from the control plane per git op — cached until ~5 min
+// before expiry so a burst of git ops is a single round trip. This is the final
+// fallback rung after local apps and BIVY_GITHUB_TOKEN.
+let hostedMintCache;
+async function hostedMintToken() {
+    if (!process.env.BIVY_HOSTED_MINT || !sessionAdvertiseTarget)
+        return undefined;
+    const now = Date.now();
+    if (hostedMintCache && hostedMintCache.expiresAt - now > 5 * 60 * 1000)
+        return hostedMintCache.token;
+    try {
+        const res = await fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}/node/hosted-git-credential`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${sessionAdvertiseTarget.enrollmentToken}` },
+        });
+        if (!res.ok)
+            return undefined;
+        const data = (await res.json().catch(() => ({})));
+        if (!data.token)
+            return undefined;
+        const parsed = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
+        hostedMintCache = { token: data.token, expiresAt: Number.isFinite(parsed) ? parsed : now + 55 * 60 * 1000 };
+        return data.token;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function resolveTokenForWorkItem(item) {
     if (item.installationId) {
         const apps = await ensureGitHubApps();
@@ -4595,7 +4625,7 @@ async function resolveTokenForWorkItem(item) {
             }
         }
     }
-    return resolveGitHubToken();
+    return (await resolveGitHubToken()) ?? (await hostedMintToken());
 }
 /**
  * The token for interactive repo operations (clone/fetch/push/PR) on `owner/repo`.
@@ -4643,7 +4673,7 @@ async function resolveTokenForRepo(owner, repo) {
             }
         }
     }
-    return resolveGitHubToken();
+    return (await resolveGitHubToken()) ?? (await hostedMintToken());
 }
 async function runWorkItem(item, report) {
     if ((item.source === "schedule" || item.source === "manual") && item.body?.startsWith("bivy-room-v1:")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",