@bivy/bivy 0.20.7-staging.2 → 0.20.7-staging.3

package/dist/runtime/codex-sessions.js

@@ -73,7 +73,8 @@ function metaFromFirstLine(line) {
         const id = typeof p.id === "string" ? p.id : typeof p.session_id === "string" ? p.session_id : undefined;
         const cwd = typeof p.cwd === "string" ? p.cwd : undefined;
         const createdAt = toEpoch(p.timestamp ?? rec.timestamp);
-        return { id, cwd, createdAt };
+        const parentThreadId = typeof p.parent_thread_id === "string" && p.parent_thread_id ? p.parent_thread_id : undefined;
+        return { id, cwd, createdAt, ...(parentThreadId ? { parentThreadId } : {}) };
     }
     catch {
         return {};
@@ -95,6 +96,17 @@ function textOf(content) {
         .join("")
         .trim();
 }
+/** Context Codex injects as "user" turns: its environment block, plugin hints,
+ * and AGENTS.md instructions. They are not something the user said, so a
+ * reopened transcript must not show them as user messages. */
+const INJECTED_USER_TURNS = [
+    /^<(environment_context|recommended_plugins|user_instructions|permissions instructions)\b/,
+    /^# AGENTS\.md instructions for /,
+];
+function isInjectedUserTurn(text) {
+    const start = text.trimStart();
+    return INJECTED_USER_TURNS.some((pattern) => pattern.test(start));
+}
 /**
  * Reconstruct a session's conversation from its rollout file as normalized
  * RuntimeMessages (role + content + timestamp) — the same shape loadClaudeTranscript
@@ -103,6 +115,8 @@ function textOf(content) {
  */
 export function loadCodexTranscriptFile(file) {
     const messages = [];
+    // The model of the turn being read (from its turn_context record).
+    let model;
     let raw;
     try {
         raw = fs.readFileSync(file, "utf8");
@@ -121,18 +135,153 @@ export function loadCodexTranscriptFile(file) {
             continue;
         }
         const p = inner(rec);
+        const timestamp = toEpoch(p.timestamp ?? rec.timestamp) ?? Date.now();
+        if (rec.type === "turn_context" && typeof p.model === "string" && p.model) {
+            model = p.model;
+            continue;
+        }
+        // Tool activity: a call and its output, paired by call_id. Kept as the same
+        // tool_use / tool_result blocks every other transcript uses, so a reopened,
+        // taken-over or forked Codex session still shows what ran and what it printed.
+        const tools = toolBlocksOf(p);
+        if (tools.length) {
+            messages.push(tools[0].type === "tool_use"
+                ? { role: "assistant", content: tools, timestamp, ...(model ? { model } : {}) }
+                : { role: "user", content: tools, timestamp });
+            continue;
+        }
         // A message item: either {role, content} directly or an item with type "message".
         const role = p.role ?? (p.type === "message" ? p.role : undefined);
         if (role !== "user" && role !== "assistant")
             continue;
         const content = p.content ?? p.text;
         const text = textOf(content);
-        if (!text)
+        if (!text || (role === "user" && isInjectedUserTurn(text)))
             continue;
-        messages.push({ role, content: text, timestamp: toEpoch(p.timestamp ?? rec.timestamp) ?? Date.now() });
+        messages.push({ role, content: text, timestamp, ...(role === "assistant" && model ? { model } : {}) });
     }
     return messages;
 }
+/** Rollout tool items as tool_use / tool_result blocks (empty when `p` is not
+ *  one). Codex writes `function_call` (JSON `arguments`) and `custom_tool_call`
+ *  (free-form `input`), each followed by an `…_output`. A code-mode `exec` call
+ *  is a script of `tools.<name>(<arg>)` calls with one output chunk each; it is
+ *  unwrapped into those calls, in the shapes the live app-server path uses, so a
+ *  reloaded card reads like the live one. */
+function toolBlocksOf(p) {
+    const id = typeof p.call_id === "string" ? p.call_id : undefined;
+    if (!id)
+        return [];
+    if (p.type === "custom_tool_call" && typeof p.input === "string") {
+        const calls = codeModeCalls(p.input);
+        if (calls.length)
+            return calls.map((call, i) => ({ type: "tool_use", id: codeModeId(id, i, calls.length), ...call }));
+    }
+    if (p.type === "function_call" || p.type === "custom_tool_call") {
+        let input = p.input !== undefined ? { input: p.input } : {};
+        if (typeof p.arguments === "string") {
+            try {
+                input = withoutOpaqueValues(JSON.parse(p.arguments));
+            }
+            catch {
+                input = { arguments: p.arguments };
+            }
+        }
+        return [{ type: "tool_use", id, name: String(p.name || "tool"), input }];
+    }
+    if (p.type === "function_call_output" || p.type === "custom_tool_call_output") {
+        const blocks = Array.isArray(p.output) ? p.output.map((block) => textOf([block])) : [];
+        const chunks = blocks.slice(1).map(codeModeResult);
+        if (blocks.length > 1 && /^Script completed\b/.test(blocks[0] ?? "") && chunks.every(Boolean)) {
+            return chunks.map((content, i) => ({ type: "tool_result", tool_use_id: codeModeId(id, i, chunks.length), content }));
+        }
+        const output = typeof p.output === "string" ? p.output : blocks.filter(Boolean).join("\n");
+        return [{ type: "tool_result", tool_use_id: id, content: output }];
+    }
+    return [];
+}
+/** The id of the i-th call in a code-mode script; a single call keeps the item's. */
+function codeModeId(id, index, count) {
+    return count === 1 ? id : `${id}#${index}`;
+}
+/** Calls in a code-mode script, one `text(await tools.<name>(<arg>));` per line. */
+function codeModeCalls(script) {
+    const calls = [];
+    for (const line of script.split("\n")) {
+        const match = /^\s*text\(await tools\.(\w+)\(([\s\S]*)\)\);?\s*$/.exec(line);
+        if (!match) {
+            if (line.trim())
+                return []; // any other code: keep the script as one opaque call
+            continue;
+        }
+        const arg = parseLooseJson(match[2]);
+        if (arg === undefined)
+            return [];
+        calls.push(codeModeCall(match[1], arg));
+    }
+    return calls;
+}
+function codeModeCall(name, arg) {
+    if (name === "exec_command" && arg && typeof arg === "object" && typeof arg.cmd === "string") {
+        const { cmd, workdir } = arg;
+        return { name: "shell", input: { command: cmd, ...(typeof workdir === "string" ? { cwd: workdir } : {}) } };
+    }
+    if (name === "apply_patch" && typeof arg === "string")
+        return { name: "apply_patch", input: { changes: patchChanges(arg) } };
+    return { name, input: arg && typeof arg === "object" ? withoutOpaqueValues(arg) : { input: arg } };
+}
+/** One code-mode output chunk as the live shell result shape, or the raw text. */
+function codeModeResult(chunk) {
+    try {
+        const parsed = JSON.parse(chunk);
+        if (typeof parsed.output === "string") {
+            return { content: parsed.output, ...(typeof parsed.exit_code === "number" ? { exitCode: parsed.exit_code } : {}) };
+        }
+        return chunk === "{}" ? "completed" : chunk;
+    }
+    catch {
+        return chunk || undefined;
+    }
+}
+/** JSON, or the JS object literal code mode writes (bare keys like `{cmd:"…"}`). */
+function parseLooseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch { /* bare keys below */ }
+    try {
+        return JSON.parse(text.replace(/([{,]\s*)([A-Za-z_$][\w$]*)\s*:/g, '$1"$2":'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Codex's own patch text as the app-server's `changes` list ({path, kind, diff}). */
+function patchChanges(patch) {
+    const changes = [];
+    let current;
+    const flush = () => { if (current)
+        changes.push({ path: current.path, kind: { type: current.kind }, diff: current.lines.join("\n") }); };
+    for (const line of patch.split("\n")) {
+        const header = /^\*\*\* (Add|Update|Delete) File: (.+)$/.exec(line);
+        if (header) {
+            flush();
+            current = { path: header[2].trim(), kind: header[1].toLowerCase(), lines: [] };
+        }
+        else if (current && !/^\*\*\* (Begin|End) Patch/.test(line)) {
+            current.lines.push(line);
+        }
+    }
+    flush();
+    return changes;
+}
+/** Drop values that are opaque encrypted blobs (Codex encrypts some sub-agent
+ *  messages in its rollout); they are noise on a card. */
+function withoutOpaqueValues(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).filter(([, v]) => !(typeof v === "string" && /^gAAAAA[\w-]{40,}={0,2}$/.test(v))));
+}
 /**
  * Materialise a **cross-runtime** fork's portable history as a fresh Codex
  * rollout so `codex ... resume <id>` (the app-server's `thread/resume`) opens on
@@ -291,7 +440,7 @@ export function listCodexSessions() {
         // etc. — which make useless list labels. Prefer the first turn that isn't one
         // of these XML-ish blocks (i.e. the user's real prompt), falling back to the
         // first turn only if that's genuinely all there is.
-        const userTurns = transcript.filter((m) => m.role === "user");
+        const userTurns = transcript.filter((m) => m.role === "user" && typeof m.content === "string");
         const contentOf = (m) => String(m?.content ?? "");
         const isInjectedBlock = (text) => /^<[a-z][\w-]*>/i.test(text.trimStart());
         const firstUser = userTurns.find((m) => !isInjectedBlock(contentOf(m))) ?? userTurns[0];
@@ -302,6 +451,7 @@ export function listCodexSessions() {
             cwd: meta.cwd,
             createdAt: meta.createdAt ?? mtime,
             firstMessage,
+            ...(meta.parentThreadId ? { parentThreadId: meta.parentThreadId } : {}),
         });
     }
     return sessions.sort((a, b) => (b.createdAt ?? 0) - (a.createdAt ?? 0));
@@ -341,7 +491,9 @@ export function deleteCodexSession(sessionId) {
 export function discoverCodexSessionForCwd(cwd, since = 0) {
     const target = path.resolve(cwd);
     const skewMs = 5_000;
-    return listCodexSessions().find((s) => s.cwd != null && path.resolve(s.cwd) === target && (s.createdAt ?? 0) >= since - skewMs);
+    // A sub-agent writes its own rollout in the same cwd, after its parent: the
+    // run is the parent's thread.
+    return listCodexSessions().find((s) => !s.parentThreadId && s.cwd != null && path.resolve(s.cwd) === target && (s.createdAt ?? 0) >= since - skewMs);
 }
 /**
  * Enumerate Codex's on-disk sessions as bounded discovery metadata (issue
@@ -353,7 +505,7 @@ export function discoverCodexSessionForCwd(cwd, since = 0) {
  */
 export function discoverNativeCodexSessions(hasLiveProcess = (cwd) => hasLiveProcessForCwd(cwd, CODEX_BIN_NAMES)) {
     return listCodexSessions()
-        .filter((s) => Boolean(s.id))
+        .filter((s) => Boolean(s.id) && !s.parentThreadId)
         .map((s) => ({
         runtimeId: "codex-approvals",
         ref: s.id,

package/dist/runtime/credential-provisioning.js

@@ -20,6 +20,7 @@ import { createCredentialVault } from "./credential-store.js";
 import { buildAgentCredentialEnv, createCredentialStore } from "./credentials.js";
 import { ensureCodexAuth, ensureCodexTrusted } from "./codex-auth.js";
 import { ensureGrokAuth } from "./grok-auth.js";
+import { opencodeAuthEnv } from "./opencode-auth.js";
 import { refreshModelOAuth } from "./oauth/model-oauth.js";
 import { isNativeOAuthProvider } from "./oauth/model-oauth-providers.js";
 /**
@@ -80,6 +81,10 @@ export async function provisionAgentRun(credsDir, piDir, agentId, workspace) {
         if (workspace)
             ensureCodexTrusted(workspace);
     }
+    else if (agentId === "opencode") {
+        // A ChatGPT plan connected in Bivy serves OpenCode too (OPENCODE_AUTH_CONTENT).
+        Object.assign(env, await opencodeAuthEnv(credsDir).catch(() => ({})));
+    }
     else if (agentId === "grok") {
         // Official Grok CLI reads XAI_API_KEY/GROK_API_KEY (already in env for api
         // keys) or its own auth.json; mint the latter from a connected SuperGrok /

package/dist/runtime/grok-sessions.js

@@ -43,6 +43,7 @@ function readSummary(dir) {
             createdAt: toEpoch(raw.created_at),
             updatedAt: toEpoch(raw.last_active_at ?? raw.updated_at),
             name,
+            ...(raw.session_kind === "subagent" ? { subagent: true } : {}),
         };
     }
     catch {
@@ -181,6 +182,7 @@ export function listGrokSessions() {
                 updatedAt,
                 name: summary.name,
                 firstMessage: firstUserMessage(dir),
+                ...(summary.subagent ? { subagent: true } : {}),
             });
         }
     }
@@ -254,7 +256,7 @@ export function discoverGrokSessionForCwd(cwd, since = 0) {
     const wanted = process.platform === "win32" ? target.toLowerCase() : target;
     return listGrokSessions()
         .filter((s) => {
-        if (!s.cwd)
+        if (!s.cwd || s.subagent)
             return false;
         const resolved = process.platform === "win32" ? path.resolve(s.cwd).toLowerCase() : path.resolve(s.cwd);
         return resolved === wanted;
@@ -270,7 +272,7 @@ export function discoverGrokSessionForCwd(cwd, since = 0) {
 }
 /** Issue #156 discovery surface for Grok's on-disk store. */
 export function discoverNativeGrokSessions(hasLiveProcess = (cwd) => hasLiveProcessForCwd(cwd, GROK_BIN_NAMES)) {
-    return listGrokSessions().map((s) => ({
+    return listGrokSessions().filter((s) => !s.subagent).map((s) => ({
         runtimeId: "grok",
         ref: s.id,
         file: s.dir,

package/dist/runtime/index.js

@@ -47,6 +47,7 @@ import { codexCredentialPreflight } from "./codex-preflight.js";
 import { opencodeCredentialPreflight } from "./opencode-preflight.js";
 import { grokCredentialPreflight } from "./grok-preflight.js";
 import { ensureGrokAuth } from "./grok-auth.js";
+import { opencodeAuthEnv } from "./opencode-auth.js";
 import { parserFactoryFor } from "./cli-parsers.js";
 import { sandboxTier, sandboxArgsFor } from "../harness/sandbox.js";
 import { serializeAcpMcpEnv } from "./acp-mcp.js";
@@ -61,6 +62,23 @@ const PREFLIGHT_BEHAVIORS = {
     opencode: (env, ctx) => opencodeCredentialPreflight(env, ctx),
     grok: (env) => grokCredentialPreflight(env),
 };
+/** Readers for an agent's own session store, by the profile's `historyLoader`.
+ *  The same reader serves the pipe path and the governed ACP path, so a session
+ *  reopened or taken over from a native run shows its earlier turns either way. */
+const HISTORY_LOADERS = {
+    grok: loadGrokTranscript,
+    gemini: (sessionId) => loadGeminiFamilyTranscript("gemini", sessionId),
+    qwen: (sessionId) => loadGeminiFamilyTranscript("qwen", sessionId),
+};
+/** Launch-env patches that project a Bivy-connected login into an agent's own
+ * credential store before it spawns (pipe and governed paths alike). */
+const PREPARE_BEHAVIORS = {
+    "grok-auth": async (credsDir) => {
+        const home = await ensureGrokAuth(credsDir);
+        return home ? { GROK_HOME: home } : {};
+    },
+    "opencode-auth": (credsDir) => opencodeAuthEnv(credsDir),
+};
 const SLASH_COMMAND_BEHAVIORS = {
     codex: codexSlashCommands,
     opencode: opencodeSlashCommands,
@@ -650,13 +668,8 @@ function acpRuntimeOptions(opts) {
         // the shim spawns, and Grok's prepare materializes `auth.json` from Bivy's
         // vault (pinning GROK_HOME) so `grok agent stdio` starts authenticated.
         ...(opts.behaviors?.preflight ? { preflight: PREFLIGHT_BEHAVIORS[opts.behaviors.preflight] } : {}),
-        ...(opts.behaviors?.prepare === "grok-auth" && opts.credsDir
-            ? {
-                prepare: async () => {
-                    const home = await ensureGrokAuth(opts.credsDir);
-                    return home ? { GROK_HOME: home } : {};
-                },
-            }
+        ...(opts.behaviors?.prepare && opts.credsDir
+            ? { prepare: () => PREPARE_BEHAVIORS[opts.behaviors.prepare](opts.credsDir) }
             : {}),
         // OpenCode's own store is SQLite under $XDG_DATA_HOME, so an ACP-promoted
         // opencode can both read a resumed session's transcript back for history
@@ -665,6 +678,7 @@ function acpRuntimeOptions(opts) {
         // in that store (writeHistory → capabilities.forkHistoryImport → fidelity
         // "replayed" instead of a seeded summary prompt). Only opencode has this
         // layout; a bare ACP agent gets none of these hooks.
+        ...(opts.historyLoader ? { loadHistory: HISTORY_LOADERS[opts.historyLoader] } : {}),
         ...(opts.behaviors?.sessionStore === "opencode"
             ? {
                 loadHistory: (sessionRef) => loadOpenCodeTranscript(sessionRef),
@@ -1145,6 +1159,7 @@ function makeCliRuntime(id, options, spec) {
             command: spec.command,
             agentArgs: spec.acp.args,
             behaviors: spec.behaviors,
+            historyLoader: spec.resume?.historyLoader,
             ...(spec.authOwner && spec.authOwner !== "agent" ? { credsDir: options.credsDir } : {}),
             sandbox: options.sandbox,
             mcpConfig: options.mcpConfig,
@@ -1174,12 +1189,8 @@ function makeCliRuntime(id, options, spec) {
     // mixed auth and may materialize a Bivy-connected subscription; Codex and
     // OpenCode retain their native stores without credential replacement.
     const preflight = behaviors?.preflight ? PREFLIGHT_BEHAVIORS[behaviors.preflight] : undefined;
-    const prepare = behaviors?.prepare === "grok-auth"
-        ? async () => {
-            const home = await ensureGrokAuth(options.credsDir);
-            return home ? { GROK_HOME: home } : {};
-        }
-        : undefined;
+    const prepareBehavior = behaviors?.prepare;
+    const prepare = prepareBehavior ? () => PREPARE_BEHAVIORS[prepareBehavior](options.credsDir) : undefined;
     // Resume, the generic way. Codex keeps its verified path (rollout history +
     // tier-aware `codex exec resume <id> --json`). Every other CLI agent becomes
     // resumable purely as data: a spec.resume template (or a BIVY_<ID>_RESUME_
@@ -1199,11 +1210,7 @@ function makeCliRuntime(id, options, spec) {
         : resumeTemplate
             ? {
                 resumable: true,
-                loadHistory: spec.resume?.historyLoader === "grok"
-                    ? loadGrokTranscript
-                    : spec.resume?.historyLoader === "gemini" || spec.resume?.historyLoader === "qwen"
-                        ? (sessionId) => loadGeminiFamilyTranscript(spec.resume.historyLoader, sessionId)
-                        : undefined,
+                loadHistory: spec.resume?.historyLoader ? HISTORY_LOADERS[spec.resume.historyLoader] : undefined,
                 // `{sandbox}` expands to that agent's native containment flags for
                 // the tier (e.g. Gemini/Qwen's `--approval-mode <mode>`) — a whole
                 // token, not a string substitution, since it can be multiple argv
@@ -1229,7 +1236,7 @@ function makeCliRuntime(id, options, spec) {
             sessionDiscovery: true,
             listDiskSessions: () => {
                 if (nativeSessionBehavior === "grok") {
-                    return listGrokSessions().map((s) => ({
+                    return listGrokSessions().filter((s) => !s.subagent).map((s) => ({
                         id: s.id,
                         path: s.dir,
                         cwd: s.cwd,

package/dist/runtime/inherited-session-env.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Agents mark the shells they run with variables that say "you are inside my
+// session". A node started from such a shell (an agent ran `bivy`, a dev node,
+// a setup script) inherits them, and every agent the node launches would think
+// it is a child of that session. Claude Code then stops saving its transcript
+// (CLAUDE_CODE_CHILD_SESSION), which history, takeover and fork read. The node
+// itself is never part of a session, so it drops these once at startup.
+//
+// Exact names, not prefixes: CLAUDE_CONFIG_DIR, CLAUDE_CODE_OAUTH_TOKEN and
+// similar are the user's own configuration and must reach the agents.
+/** Variables an agent sets in its own shells to mark its session. */
+export const INHERITED_SESSION_MARKERS = [
+    // Claude Code (and the Claude Agent SDK)
+    "CLAUDECODE",
+    "CLAUDE_CODE_CHILD_SESSION",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ATTENDED",
+    "CLAUDE_CODE_ENTRYPOINT",
+    "CLAUDE_CODE_EXECPATH",
+    "CLAUDE_CODE_MESSAGING_SOCKET",
+    "CLAUDE_CODE_MESSAGING_TOKEN",
+    "CLAUDE_AGENT_SDK_VERSION",
+    "CLAUDE_PID",
+    "CLAUDE_EFFORT",
+    // Codex
+    "CODEX_SESSION_ID",
+    "CODEX_THREAD_ID",
+    "CODEX_CI",
+    // OpenCode
+    "OPENCODE",
+    "OPENCODE_PID",
+    // Grok
+    "GROK_AGENT",
+    "GROK_SESSION_ID",
+    // Generic "run by an agent" markers
+    "AGENT",
+    "AI_AGENT",
+    // Bivy's own per-session identity (see session-env.ts)
+    "BIVY_SESSION_ID",
+    "BIVY_SESSION_TOKEN",
+];
+/** Remove inherited session markers from `env` in place; returns the names removed. */
+export function scrubInheritedSessionEnv(env = process.env) {
+    const removed = [];
+    for (const name of INHERITED_SESSION_MARKERS) {
+        if (env[name] === undefined)
+            continue;
+        delete env[name];
+        removed.push(name);
+    }
+    return removed;
+}

package/dist/runtime/model-ref.js

@@ -10,9 +10,15 @@
 // (Pi) rejected the bare form and the session silently kept its default model.
 // Resolving against the session's own catalog makes every spelling work for any
 // runtime without per-agent code.
+/** Bivy provider ids another agent knows under a different name: a ChatGPT
+ * plan is `openai-codex` in Bivy and Pi, but plain `openai` in OpenCode. */
+const PROVIDER_EQUIVALENTS = {
+    "openai-codex": "openai",
+};
 /**
  * Resolve `ref` against `models`. An explicit provider is kept as-is. Otherwise
- * match, in order: the exact id, a `provider/id` split, then an id that ends in
+ * match, in order: the exact id, a `provider/id` split, the same split under
+ * the provider's name in this agent (PROVIDER_EQUIVALENTS), then an id that ends in
  * `/<ref.id>` (a bare name for an ACP slash id). Ties prefer the current
  * model's provider. Unknown refs are returned unchanged so the runtime reports
  * its own error.
@@ -25,9 +31,16 @@ export function resolveModelRef(models, ref, current) {
     const tiers = [
         models.filter((m) => m.id === id),
         slash > 0 ? models.filter((m) => m.provider === id.slice(0, slash) && m.id === id.slice(slash + 1)) : [],
+        slash > 0 ? providerEquivalent(models, id.slice(0, slash), id.slice(slash + 1)) : [],
         models.filter((m) => m.id.endsWith(`/${id}`)),
     ];
     const candidates = tiers.find((tier) => tier.length) ?? [];
     const pick = candidates.find((m) => m.provider === current?.provider) ?? candidates[0];
     return pick ? { provider: pick.provider, id: pick.id } : ref;
 }
+function providerEquivalent(models, provider, id) {
+    const other = PROVIDER_EQUIVALENTS[provider];
+    if (!other)
+        return [];
+    return models.filter((m) => m.id === `${other}/${id}` || (m.provider === other && m.id === id));
+}

package/dist/runtime/opencode-auth.js

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// OpenCode credential projection.
+//
+// A subscription a user connects inside Bivy (a ChatGPT plan, stored in the
+// vault as `openai-codex`) should serve OpenCode too, without a separate
+// `opencode auth login`. OpenCode reads its logins from `auth.json`, or, when
+// set, from OPENCODE_AUTH_CONTENT, which REPLACES that file for the process. So
+// the projection is the user's own auth.json plus any vault subscription it
+// lacks, handed over in that env var. The user's file is never written and
+// their own logins always win.
+//
+// The refresh token is withheld. OpenAI rotates it on every grant, so an
+// OpenCode refresh would invalidate the vault's copy for Codex and Pi. OpenCode
+// gets the access token Bivy keeps fresh; a later launch projects a new one.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createCredentialVault } from "./credential-store.js";
+import { refreshExpiringOAuth } from "./credential-provisioning.js";
+/** Vault OAuth provider -> the provider key OpenCode's auth.json uses for it. */
+const OPENCODE_SUBSCRIPTIONS = [
+    { vault: "openai-codex", opencode: "openai" },
+];
+/** OpenCode's auth.json, resolved the way the CLI resolves it. */
+export function opencodeAuthPath(env = process.env) {
+    const data = env.XDG_DATA_HOME?.trim() || (process.platform === "win32" ? env.APPDATA?.trim() : "") || path.join(os.homedir(), ".local", "share");
+    return path.join(data, "opencode", "auth.json");
+}
+function readJsonObject(file) {
+    try {
+        const value = JSON.parse(fs.readFileSync(file, "utf8"));
+        return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * `{ OPENCODE_AUTH_CONTENT }` carrying the user's OpenCode logins plus each
+ * Bivy-connected subscription they don't already have, or `{}` when there is
+ * nothing to add (OpenCode then reads its own file as usual).
+ */
+export async function opencodeAuthEnv(credsDir, authPath = opencodeAuthPath()) {
+    const native = readJsonObject(authPath);
+    const missing = OPENCODE_SUBSCRIPTIONS.filter((row) => !native[row.opencode]);
+    if (!missing.length)
+        return {};
+    await refreshExpiringOAuth(credsDir).catch(() => undefined);
+    const vault = createCredentialVault(credsDir);
+    const projected = {};
+    for (const row of missing) {
+        const cred = (await vault.read(row.vault).catch(() => undefined));
+        if (cred?.type !== "oauth" || typeof cred.access !== "string" || !cred.access)
+            continue;
+        projected[row.opencode] = {
+            type: "oauth",
+            access: cred.access,
+            refresh: "",
+            expires: typeof cred.expires === "number" ? cred.expires : 0,
+            ...(typeof cred.accountId === "string" && cred.accountId ? { accountId: cred.accountId } : {}),
+        };
+    }
+    if (!Object.keys(projected).length)
+        return {};
+    return { OPENCODE_AUTH_CONTENT: JSON.stringify({ ...native, ...projected }) };
+}

package/dist/runtime/opencode-preflight.js

@@ -40,6 +40,15 @@ function hasNativeCredential(provider, ctx) {
         return false;
     }
 }
+/** A login Bivy projected for this launch (OPENCODE_AUTH_CONTENT, see opencode-auth.ts). */
+function hasProjectedCredential(provider, env) {
+    try {
+        return Boolean(JSON.parse(env.OPENCODE_AUTH_CONTENT ?? "{}")[provider]);
+    }
+    catch {
+        return false;
+    }
+}
 /** Actionable message shown when OpenCode's selected provider has no credential. */
 export function opencodeNoCredentialMessage(provider, envVar) {
     const label = provider.charAt(0).toUpperCase() + provider.slice(1);
@@ -69,7 +78,7 @@ export function opencodeCredentialPreflight(env, ctx = {}) {
     if (provider === "anthropic" && env.CLAUDE_CODE_OAUTH_TOKEN?.trim())
         return undefined;
     const envVar = apiKeyEnvVar(provider);
-    if (env[envVar]?.trim() || hasNativeCredential(provider, ctx))
+    if (env[envVar]?.trim() || hasNativeCredential(provider, ctx) || hasProjectedCredential(provider, env))
         return undefined;
     return opencodeNoCredentialMessage(provider, envVar);
 }

package/dist/runtime/protocol.js

@@ -400,9 +400,12 @@ class ProtocolSession {
         });
         this.child = child;
         child.stdout.on("data", (chunk) => this.onData(chunk.toString("utf8")));
+        // A protocol agent reports its errors in-band (session.error), so its stderr
+        // is diagnostics: shim logs and the agent's own request dumps, which in the
+        // transcript read as a broken tool card. Keep it for when the shim dies
+        // without a word (see "close" below).
         child.stderr.on("data", (chunk) => {
             this.stderrOutput += chunk.toString("utf8");
-            this.emit({ type: "tool_execution_update", toolName: "agent_output", toolCallId: "agent-output", input: { stream: "stderr", output: stripAnsi(this.stderrOutput.slice(-4000)) } });
         });
         // The agent's stdin pipe can break (EPIPE) when the shim exits mid-turn — for
         // example a dispose()/abort() racing an in-flight write (a tool.decision reply,
@@ -431,6 +434,10 @@ class ProtocolSession {
             if (this.child === child)
                 this.markChildGone();
             this.failAll(new Error(`Protocol agent exited (${code ?? signal ?? "unknown"})`));
+            const stderr = stripAnsi(this.stderrOutput.slice(-4000)).trim();
+            if (typeof code === "number" && code !== 0 && stderr) {
+                this.emit({ type: "tool_execution_update", toolName: "agent_output", toolCallId: "agent-output", input: { stream: "stderr", output: stderr } });
+            }
             this.emit({ type: "agent_end", code, signal });
         });
         await new Promise((resolve, reject) => {
@@ -597,6 +604,23 @@ class ProtocolSession {
             this.messages[this.turnMessageIndex] = { ...this.messages[this.turnMessageIndex], content };
         }
     }
+    /** Persist the live turn's content so far (prose, tools, their results) and
+     *  commit it on clients, so a steering message can follow it in order. */
+    sealStreamedSoFar() {
+        const hadTools = this.turnContent.some((b) => b.type !== "thinking") || this.turnToolResults.length > 0;
+        if (hadTools) {
+            this.flushPendingTurnText();
+            if (this.turnContent.length)
+                this.snapshotAssistantTurn([...this.turnContent]);
+            if (this.turnToolResults.length)
+                this.messages.push({ role: "user", content: this.turnToolResults, timestamp: Date.now() });
+        }
+        else if (this.assistantText) {
+            this.snapshotAssistantTurn(this.assistantText);
+        }
+        if (this.assistantText)
+            this.emit({ type: "message_boundary", message: { role: "assistant", content: this.assistantText } });
+    }
     /**
      * Fold assistant text that arrives after the turn was sealed (session.done)
      * onto the last persisted assistant message — the ACP end_turn race (see the
@@ -786,6 +810,9 @@ class ProtocolSession {
             }
             this.emit({ type: "message_end", message });
             this.streaming = false;
+            // The sealed turn owns its message slot. Anything that streams after this
+            // (a late tool or a turn the host never opened) must not overwrite it.
+            this.turnMessageIndex = undefined;
             this.assistantText = "";
             this.assistantItemBoundary = false;
             this.reasoningText = "";
@@ -821,6 +848,7 @@ class ProtocolSession {
             const errored = { role: "assistant", content: "", stopReason: "error", errorMessage: errorText, timestamp: Date.now() };
             this.messages.push(errored);
             this.streaming = false;
+            this.turnMessageIndex = undefined;
             this.assistantText = "";
             this.assistantItemBoundary = false;
             this.reasoningText = "";
@@ -1034,6 +1062,12 @@ class ProtocolSession {
         catch {
             textToSend = prompt;
         }
+        // A message sent while a turn is still streaming steers into it. Keep what
+        // the agent already said as its own message, before this one: resetting the
+        // turn here dropped that text, and the rest of the reply then ran into the
+        // answer to this message as one bubble.
+        if (this.streaming)
+            this.sealStreamedSoFar();
         this.messages.push({ role: "user", content: prompt, timestamp: Date.now() });
         this.streaming = true;
         this.turnMessageIndex = undefined;