@bivy/bivy 0.20.1-staging.8 → 0.20.1

package/dist/remote/tailnet.js

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// The other machines on your tailnet that run Bivy, so a machine reached over
+// Tailscale can offer the rest. Tailscale lists the peers; each is asked for
+// Bivy's hello at its tailnet address, which only answers where `bivy
+// tailscale` is on.
+import { execFile } from "node:child_process";
+/** Peers from `tailscale status --json`, without the machine itself. */
+export function parseTailnetPeers(text) {
+    let status;
+    try {
+        status = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    return Object.values(status?.Peer ?? {})
+        .map((p) => ({ dnsName: String(p.DNSName ?? "").replace(/\.$/, ""), hostName: String(p.HostName ?? ""), online: p.Online === true, os: p.OS }))
+        .filter((p) => p.dnsName.endsWith(".ts.net"));
+}
+function tailscaleStatus() {
+    return new Promise((resolve) => {
+        execFile("tailscale", ["status", "--json"], { timeout: 3000, maxBuffer: 4 * 1024 * 1024 }, (error, stdout) => resolve(error ? "" : stdout));
+    });
+}
+async function hello(peer, fetchImpl) {
+    try {
+        const res = await fetchImpl(`https://${peer.dnsName}/api/direct/hello`, { signal: AbortSignal.timeout(2500) });
+        const body = await res.json();
+        if (!res.ok || body?.bivy !== true)
+            return null;
+        return { name: typeof body.name === "string" && body.name ? body.name : peer.hostName, url: `https://${peer.dnsName}`, nodeId: typeof body.nodeId === "string" ? body.nodeId : undefined, os: peer.os, online: true, self: false };
+    }
+    catch {
+        return null;
+    }
+}
+/** Online tailnet peers running Bivy over Tailscale. Offline peers aren't asked. */
+export async function discoverTailnetMachines(deps = {}) {
+    const peers = parseTailnetPeers(await (deps.status ?? tailscaleStatus)()).filter((p) => p.online);
+    const found = await Promise.all(peers.map((p) => hello(p, deps.fetchImpl ?? fetch)));
+    return found.filter((m) => m !== null).sort((a, b) => a.name.localeCompare(b.name));
+}

package/dist/server.js

@@ -87,9 +87,11 @@ import { SessionEventCoalescer } from "./session-event-coalescer.js";
 import { readMachineTheme, watchMachineTheme } from "./machine-theme.js";
 import { authMiddleware, resolveAuth, isAuthorized, requestOriginAllowed, markRemoteListener } from "./auth.js";
 import { PairCodes } from "./pair-codes.js";
+import { accessReport } from "./access.js";
+import { hostedEndpoints } from "./hosted-endpoints.mjs";
 import http from "node:http";
 import { webAppDirs, webAppRouter } from "./web-app.js";
-import { RelayConnector, loadRelayConfig, loadDirectListenerConfig, soloCredentials } from "./remote/index.js";
+import { RelayConnector, loadRelayConfig, loadDirectListenerConfig, discoverTailnetMachines, soloCredentials } from "./remote/index.js";
 import { readEphemeralTeardownConfig, shouldSelfTeardown, snapshotsDurableForTeardown, performSelfTeardown } from "./ephemeral-teardown.js";
 import { buildSessionSnapshot, applySessionSnapshot } from "./session/snapshot.js";
 import { clearTurnActivity } from "./session/turn-activity.js";
@@ -2297,6 +2299,25 @@ appRegistry.on("notes", (viewId) => {
         });
     }, NOTES_NOTIFY_MS).unref?.();
 });
+// Asking every peer takes a moment; a short cache keeps switcher opens instant.
+let tailnetCache = null;
+async function tailnetMachines() {
+    const direct = loadDirectListenerConfig(appDir);
+    if (!direct?.hostname)
+        return [];
+    if (!tailnetCache || Date.now() - tailnetCache.at > 15_000)
+        tailnetCache = { at: Date.now(), machines: discoverTailnetMachines() };
+    const self = { name: identity.name, url: `https://${direct.hostname}`, nodeId: identity.nodeId, os: process.platform, online: true, self: true };
+    return [self, ...(await tailnetCache.machines).filter((m) => m.url !== self.url)];
+}
+function currentAccess() {
+    const relay = loadRelayConfig(appDir);
+    return accessReport({
+        tailscaleHostname: loadDirectListenerConfig(appDir)?.hostname,
+        relay: relay ? { controlPlaneUrl: relay.controlPlaneUrl, room: relay.room, roomToken: relay.roomToken } : null,
+        hostedControlPlane: hostedEndpoints(process.env).controlPlane,
+    });
+}
 const RELAY_COMMANDS = {
     ...createAppCommands(appService, (id) => { const record = resolveSession(id); return record ? harnessDirFor(record) : undefined; }, (app) => {
         const record = resolveSession(app.sessionId);
@@ -2314,6 +2335,14 @@ const RELAY_COMMANDS = {
     // (see runBivyUpdate). The node restarts itself when the update lands, so the
     // client just sees the socket reconnect on the new build; a failure to even
     // start reports back so the banner can show the manual command.
+    // The machines on this machine's tailnet that run Bivy, this one first.
+    async "tailnet.machines"(msg, ctx) {
+        ctx.reply({ type: "tailnet.machines.ok", requestId: msg.requestId, machines: await tailnetMachines() });
+    },
+    // How this machine can be reached and what the next setup would add (src/access.ts).
+    "access.get"(msg, ctx) {
+        ctx.reply({ type: "access.get.ok", requestId: msg.requestId, ...currentAccess() });
+    },
     "node.update"(_msg, ctx) {
         const result = runBivyUpdate();
         ctx.reply({ type: "node.update.result", ok: result.ok, error: result.error });
@@ -9478,6 +9507,12 @@ app.post("/api/auth/pair", sensitiveRateLimiter, (req, res) => {
     const { device, token } = accessDevices.create(name);
     res.json({ ok: true, device, token });
 });
+// Identifies a Bivy node to the other machines on its tailnet, so each can list
+// the rest (tailnet.machines). Public, like /healthz: it says only that Bivy
+// runs here and under which name; the direct listener is tailnet-only.
+app.get("/api/direct/hello", (_req, res) => {
+    res.json({ bivy: true, name: identity.name, nodeId: identity.nodeId });
+});
 // All other /api routes require auth (loopback may bypass, per config and host
 // — see loopbackAllowed()/isMultiUserHost() in src/auth.ts).
 app.use("/api", authMiddleware(identity, {
@@ -12142,8 +12177,10 @@ const wss = new WebSocketServer({ server, path: "/ws" });
 // getting loopback trust; every caller needs a device token.
 const directWebApp = webAppRouter(webAppDirs(repoRoot));
 let directListener = null;
+let directOwner;
 async function reloadDirectListener() {
     const config = loadDirectListenerConfig(appDir);
+    directOwner = config?.owner;
     if (directListener && directListener.port !== config?.port) {
         const previous = directListener;
         directListener = null;
@@ -12160,7 +12197,8 @@ async function reloadDirectListener() {
             directApp.use(directWebApp);
         directApp.use(app);
         const listener = http.createServer(directApp);
-        markRemoteListener(listener);
+        // The owner's own tailnet devices come in on their Tailscale identity.
+        markRemoteListener(listener, { trustedLogin: () => directOwner });
         const directWss = new WebSocketServer({ server: listener, path: "/ws" });
         directWss.on("connection", (socket, req) => wss.emit("connection", socket, req));
         await new Promise((resolve, reject) => {

package/dist/session/run-terminal.js

@@ -180,7 +180,7 @@ export function createRunTerminals(deps) {
             deps.broadcast({ type: "terminal.idle", termId: id, at: Date.now() });
             broadcastRunTerminalList();
             const who = displayName || "An agent";
-            deps.sendNotificationHint({ kind: "agent_waiting", title: `${who} is waiting`, body: `${who} has been quiet for a bit — it may be waiting for your input.` });
+            deps.sendNotificationHint({ kind: "agent_waiting", title: `${who} is waiting`, body: `${who} has been quiet for a bit — it may be waiting for your input.`, ...runTarget(id) });
         }, IDLE_NOTIFY_INTERVAL));
     }
     function clearRunIdleNotify(id) {
@@ -201,7 +201,11 @@ export function createRunTerminals(deps) {
         lastBellNotify.set(id, now);
         const meta = terminals.meta(id);
         const who = meta?.name?.trim() || meta?.label?.trim() || "A terminal";
-        deps.sendNotificationHint({ kind: "terminal_bell", title: "Terminal bell", body: `${who} rang the terminal bell — it may be waiting for you.` });
+        deps.sendNotificationHint({ kind: "terminal_bell", title: "Terminal bell", body: `${who} rang the terminal bell — it may be waiting for you.`, ...runTarget(id) });
+    }
+    function runTarget(id) {
+        const sessionId = terminals.meta(id)?.sessionId;
+        return sessionId ? { sessionId, targetSessionId: sessionId } : {};
     }
     function clearBellNotify(id) {
         lastBellNotify.delete(id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.20.1-staging.8",
+  "version": "0.20.1",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",