@bivy/bivy 0.20.7-staging.3 → 0.20.7-staging.4

package/dist/apps/backend/logs.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { redactSecrets } from "../../redact.js";
+const MAX_LINES = 2000;
+const MAX_MARKS = 50;
+const MAX_LINE = 2000;
+/** How bad a line is, as rows tried in order. A server's own words decide:
+ *  "error", an exception, a 5xx it answered. Adding a pattern is adding a row. */
+const LEVELS = [
+    { level: "error", pattern: /\b(error|exception|fatal|panic|traceback|uncaught|unhandled|failed)\b|[a-z](?:Error|Exception)\b|\b(?:Completed|status[=: ]+|HTTP\/\d(?:\.\d)?"?\s+)5\d\d\b|\s5\d\d\s+in\s+\d/i },
+    { level: "warn", pattern: /\b(warn|warning|deprecat\w*)\b/i },
+];
+// Terminal colour and cursor codes: a log is read as text.
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g;
+/** A stack frame or continuation belongs to the line above it. */
+const CONTINUATION = /^(\s+\S|\s*at\s|\s*from\s|\s*File\s"|Caused by:|\s*\.\.\.\s\d+ more)/;
+/** One source's recent lines, each stamped when it arrived. */
+export class LogBuffer {
+    lines = [];
+    partial = "";
+    append(data, at = Date.now()) {
+        const text = this.partial + data.replace(ANSI, "").replace(/\r\n?/g, "\n");
+        const parts = text.split("\n");
+        this.partial = parts.pop().slice(-MAX_LINE);
+        for (const raw of parts) {
+            if (!raw.trim())
+                continue;
+            const line = raw.slice(0, MAX_LINE);
+            const previous = this.lines.at(-1);
+            const level = CONTINUATION.test(line) && previous && previous.level !== "info" ? previous.level : LEVELS.find((row) => row.pattern.test(line))?.level ?? "info";
+            this.lines.push({ at, text: line, level });
+        }
+        if (this.lines.length > MAX_LINES)
+            this.lines = this.lines.slice(-MAX_LINES);
+    }
+    /** Lines since `since`, with secrets taken out: they're shown, and may be sent to an agent. */
+    read(since = 0) {
+        return this.lines.filter((line) => line.at > since).map((line) => ({ ...line, text: redactSecrets(line.text) }));
+    }
+    errorsBetween(from, to = Infinity) {
+        return this.read(from).filter((line) => line.level === "error" && line.at <= to);
+    }
+}
+/** "Your last action" per app: what the person (or the agent) just did, so the
+ *  log can say what came of it. */
+export class LogMarks {
+    marks = new Map();
+    /** `merge`: traffic from the preview, where a page and the requests it makes
+     *  in the same moment are one action. Something run on purpose always counts. */
+    add(appId, label, { at = Date.now(), merge = false } = {}) {
+        const list = this.marks.get(appId) ?? [];
+        if (merge && list.at(-1) && at - list.at(-1).at < 1000)
+            return;
+        list.push({ at, label: label.slice(0, 200) });
+        this.marks.set(appId, list.slice(-MAX_MARKS));
+    }
+    read(appId) { return [...this.marks.get(appId) ?? []]; }
+    forget(appId) { this.marks.delete(appId); }
+}

package/dist/apps/backend/rows.js

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+const MAX_ROWS = 1000;
+const text = (value) => value === null || value === undefined ? "null" : typeof value === "object" ? JSON.stringify(value) : String(value);
+/** A delimited line, with quotes ("a ""quoted"" value") as CSV writes them. */
+function splitLine(line, delimiter) {
+    const cells = [];
+    let cell = "", quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        if (quoted) {
+            if (char === "\"" && line[i + 1] === "\"") {
+                cell += "\"";
+                i++;
+            }
+            else if (char === "\"")
+                quoted = false;
+            else
+                cell += char;
+        }
+        else if (char === "\"" && !cell)
+            quoted = true;
+        else if (char === delimiter) {
+            cells.push(cell);
+            cell = "";
+        }
+        else
+            cell += char;
+    }
+    return [...cells, cell];
+}
+function delimited(output, delimiter) {
+    const lines = output.split(/\r?\n/).filter((line) => line.length);
+    if (!lines.length || !lines[0].includes(delimiter))
+        return undefined;
+    const columns = splitLine(lines[0], delimiter);
+    return { columns, rows: lines.slice(1, MAX_ROWS + 1).map((line) => Object.fromEntries(splitLine(line, delimiter).map((cell, i) => [columns[i] ?? `column ${i + 1}`, cell]))) };
+}
+const FORMATS = [
+    { name: "JSON", read: (output) => {
+            let value;
+            try {
+                value = JSON.parse(output);
+            }
+            catch {
+                return undefined;
+            }
+            if (!Array.isArray(value))
+                return undefined;
+            const objects = value.slice(0, MAX_ROWS).filter((row) => !!row && typeof row === "object" && !Array.isArray(row));
+            const columns = [...new Set(objects.flatMap((row) => Object.keys(row)))];
+            return { columns, rows: objects.map((row) => Object.fromEntries(columns.map((column) => [column, text(row[column])]))) };
+        } },
+    { name: "TSV", read: (output) => delimited(output, "\t") },
+    { name: "CSV", read: (output) => delimited(output, ",") },
+    // One column, no delimiter: still a table.
+    { name: "lines", read: (output) => {
+            const lines = output.split(/\r?\n/).filter((line) => line.length);
+            if (!lines.length)
+                return undefined;
+            return { columns: [lines[0]], rows: lines.slice(1, MAX_ROWS + 1).map((line) => ({ [lines[0]]: line })) };
+        } },
+];
+export function parseRows(output) {
+    const trimmed = output.trim();
+    if (!trimmed)
+        return { columns: [], rows: [] };
+    for (const format of FORMATS) {
+        const rows = format.read(trimmed);
+        if (rows)
+            return rows;
+    }
+    return { columns: [], rows: [] };
+}
+/** A saved query's file: the query, and its `-- title:` and `-- key:` comments. */
+export function readQueryFile(text) {
+    const tag = (name) => new RegExp(`^\\s*--\\s*${name}\\s*:\\s*(.+)$`, "im").exec(text)?.[1]?.trim();
+    return { sql: text.trim(), ...(tag("title") ? { title: tag("title") } : {}), ...(tag("key") ? { key: tag("key") } : {}) };
+}

package/dist/apps/gateway.js

@@ -23,6 +23,7 @@ const REVISION_PATH = "/__bivy/revision";
 const INSPECTOR_PATH = "/__bivy/inspector.js";
 const COMPARE_PATH = "/__bivy/compare";
 const NOTES_PATH = "/__bivy/notes";
+const SERVER_ERRORS_PATH = "/__bivy/server-errors";
 const SCENARIOS_PATH = "/__bivy/scenarios";
 const SCENARIO_PATH = "/__bivy/scenario";
 const scenarioKind = (entry) => entry.target.kind === "display" ? "desktop" : "web";
@@ -518,6 +519,10 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             this.compare(req, res, entry);
             return;
         }
+        if (req.url.startsWith(SERVER_ERRORS_PATH) && req.method === "GET") {
+            this.serverErrors(req, res, entry, session);
+            return;
+        }
         if (req.url === SCENARIOS_PATH && req.method === "GET") {
             this.scenarios(res, entry, session);
             return;
@@ -545,6 +550,15 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         if (rule && await simulate(req, res, rule, responseHeaders({}, this.ancestors(id))))
             return;
         const inspect = isPageLoad(req);
+        // What the person does in the preview marks the app's logs ("your last
+        // action"): opening a page, or sending something. Assets don't count.
+        const pathOnly = req.url.split("?")[0].slice(0, 200);
+        if (inspect) {
+            entry.loadedAt = Date.now();
+            this.registry.emit("action", id, `Opened ${pathOnly}`);
+        }
+        else if (!["GET", "HEAD", "OPTIONS"].includes(req.method ?? ""))
+            this.registry.emit("action", id, `${req.method} ${pathOnly} from the preview`);
         // Remember the framed page so a turn reload lands where the user was.
         if (req.method === "GET" && req.headers["sec-fetch-dest"] === "iframe" && req.url.length <= 2048)
             entry.lastPath = req.url;
@@ -885,6 +899,22 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ screenshot: Boolean(shot) }));
     }
+    /** Server errors for the shell's Console: since the page loaded ("page"),
+     *  or since the last answer's `now`. The owner's only: a server's log is not
+     *  for people with a shared link. */
+    serverErrors(req, res, entry, session) {
+        const cors = { "access-control-allow-origin": this.shellOrigin(entry.view.id), "access-control-allow-credentials": "true", vary: "Origin" };
+        if (session.reviewer) {
+            res.writeHead(403, cors);
+            res.end();
+            return;
+        }
+        const raw = new URL(req.url, "http://gateway").searchParams.get("since");
+        const since = raw === "page" || raw === null ? (entry.loadedAt ?? Date.now()) - 1 : Number(raw);
+        const found = Number.isFinite(since) ? this.registry.serverErrors?.(entry.view.id, since) : undefined;
+        res.writeHead(200, { ...cors, "content-type": "application/json", "cache-control": "no-store" });
+        res.end(JSON.stringify(found ?? { now: Date.now(), lines: [] }));
+    }
     /** The view's scenarios for the shell's switcher, and the one it's in: this
      *  browser's for a web page, the app's for a desktop app. */
     scenarios(res, entry, session) {

package/dist/apps/preview-shell.js

@@ -132,7 +132,7 @@ body.badged #dock:not([data-edge="top"]) { bottom:calc(var(--space-2) + var(--sp
 <div id="dock">
   <section class="panel" id="console" hidden aria-labelledby="console-title">
     <h2><span id="console-title">Console</span><button class="btn sm ghost" id="clear">Clear</button></h2>
-    <p class="muted" id="console-empty">No errors or warnings since this page loaded.</p>
+    <p class="muted" id="console-empty">No errors or warnings since this page loaded, from the page or its server.</p>
     <ul id="entries"></ul>
     <div class="panel-actions"><button class="btn sm" id="send-errors" disabled>Send to agent…</button></div>
   </section>
@@ -248,6 +248,7 @@ function show(data,launch){
     // Put them back where they were before an update they asked for.
     if(restore){const at=restore;restore=null;frame.contentWindow?.postMessage(Object.assign({type:'bivy:restore'},at),metadata.origin);}
     if(!watching){watching=true;latest=-1;shown=null;watch();firstHint();}else if(wake)wake();
+    if(!serverPolling)void pollServer();
   };
   // A Bivy client framing the shell says whether it can take dictation.
   if(embedded&&data.returnTo)toBivy({type:'hello'});
@@ -597,18 +598,37 @@ function failScenario(s,message){
 $('scn-stay').onclick=()=>{$('scn-fail').hidden=true;scnBtn.hidden?more.focus():scnBtn.focus();};
 // Console
 let entries=[];
-function resetConsole(){entries=[];renderConsole();}
+function resetConsole(){entries=[];serverSince='page';renderConsole();}
+// The server's errors join the page's: what the app's server logged since this
+// page loaded (Bivy follows the output of servers it runs). The owner's only.
+let serverSince='page',serverPolling=false;
+async function pollServer(){
+  serverPolling=true;
+  if(metadata&&!metadata.reviewer&&metadata.inspect!==false){
+    try{
+      const r=await fetch(metadata.origin+'/__bivy/server-errors?since='+serverSince,{credentials:'include',cache:'no-store'});
+      if(r.ok){
+        const d=await r.json();
+        for(const line of (Array.isArray(d.lines)?d.lines:[]).slice(-20))entries.push({level:'error',source:'server',text:String(line.text).slice(0,500)});
+        if(entries.length>50)entries.splice(0,entries.length-50);
+        if(d.lines?.length)renderConsole();
+        if(Number.isFinite(d.now))serverSince=String(d.now);
+      }
+    }catch{}
+  }
+  setTimeout(()=>void pollServer(),document.hidden?10000:3000);
+}
 function renderConsole(){
   const errors=entries.filter(e=>e.level==='error').length,count=$('error-count');
   count.hidden=!errors;count.textContent=String(errors);
   // The number is shown once, on the pill, so it is visible without opening it.
   $('more').setAttribute('aria-label',errors?'Preview options, '+errors+' error'+(errors===1?'':'s'):'Preview options');
   $('console-empty').hidden=entries.length>0;$('send-errors').disabled=!entries.length;
-  $('entries').replaceChildren(...entries.map(e=>{const li=document.createElement('li');const tag=document.createElement('span');tag.className='badge';tag.dataset.tone=e.level==='error'?'danger':'warn';tag.textContent=e.level;const text=document.createElement('span');text.textContent=e.text;li.append(tag,text);return li;}));
+  $('entries').replaceChildren(...entries.map(e=>{const li=document.createElement('li');const tag=document.createElement('span');tag.className='badge';tag.dataset.tone=e.level==='error'?'danger':'warn';tag.textContent=e.source==='server'?'server':e.level;const text=document.createElement('span');text.textContent=e.text;li.append(tag,text);return li;}));
 }
 $('errors').onclick=()=>panels($('console').hidden?'console':null);
 $('clear').onclick=resetConsole;
-$('send-errors').onclick=()=>draft('Console output in the app preview "'+metadata.name+'" (page '+currentPath+'):\\n'+entries.slice(-20).map(e=>'- '+e.level+': '+e.text).join('\\n'));
+$('send-errors').onclick=()=>draft('Console output in the app preview "'+metadata.name+'" (page '+currentPath+'):\\n'+entries.slice(-20).map(e=>'- '+(e.source==='server'?'server error':e.level)+': '+e.text).join('\\n'));
 // Marking: one gesture, two results. Pointing at an element and circling an
 // area were two modes with a button each; they are one mode now, because they
 // are one intention — "this, here".

package/dist/apps/registry.js

@@ -98,9 +98,60 @@ function command(spec, workspace, label) {
  * preview addresses survive restarts. Views whose server Bivy doesn't own —
  * a service without `start` — are not restored: a reused local port could
  * belong to anything by then. Detection offers them again. */
+/** A folder for a backend view's files: inside the workspace, never above it. */
+function inside(workspace, dir, fallback) {
+    const relative = dir === undefined ? fallback : dir;
+    if (typeof relative !== "string" || !relative || relative.length > 300 || path.isAbsolute(relative))
+        throw new Error("A backend view's dir is a folder inside the workspace, like .bivy/requests.");
+    const resolved = path.resolve(workspace, relative);
+    const from = path.relative(path.resolve(workspace), resolved);
+    if (from === ".." || from.startsWith(`..${path.sep}`))
+        throw new Error("A backend view's dir must be inside the workspace.");
+    return resolved;
+}
+function backendTarget(spec, workspace) {
+    if (spec.kind === "requests") {
+        const base = spec.base;
+        if (base !== undefined) {
+            if (typeof base.url === "string") {
+                const url = new URL(base.url);
+                if (!["http:", "https:"].includes(url.protocol) || url.username || url.password)
+                    throw new Error("A requests view's base.url is an http(s) address without credentials.");
+                return { kind: "requests", dir: inside(workspace, spec.dir, ".bivy/requests"), base: { url: url.href.replace(/\/$/, "") } };
+            }
+            if (typeof base.view !== "string" || !base.view)
+                throw new Error("A requests view's base is {\"url\": …} or {\"view\": \"<web view name>\"}.");
+            return { kind: "requests", dir: inside(workspace, spec.dir, ".bivy/requests"), base: { view: base.view } };
+        }
+        return { kind: "requests", dir: inside(workspace, spec.dir, ".bivy/requests") };
+    }
+    if (spec.kind === "data")
+        return { kind: "data", dir: inside(workspace, spec.dir, ".bivy/queries"), ...command(spec, workspace, "Data view") };
+    const source = spec.source;
+    if (!source)
+        return { kind: "logs", source: {} };
+    if (typeof source.view === "string")
+        return { kind: "logs", source: { view: source.view } };
+    // A file is followed the way a person would: tail -F, from the last lines.
+    if (typeof source.file === "string")
+        return { kind: "logs", source: { command: "tail", args: ["-n", "200", "-F", path.relative(workspace, inside(workspace, source.file, ""))], workspace: fs.realpathSync(workspace) } };
+    return { kind: "logs", source: command(source, workspace, "Logs view") };
+}
+/** Where a backend view reads from, in words, for its row in the Apps sheet. */
+function backendDetail(target) {
+    const line = (spec) => [spec.command, ...spec.args].join(" ").slice(0, 120);
+    if (target.kind === "requests")
+        return `${path.basename(target.dir)} · ${target.base && "url" in target.base ? target.base.url : target.base ? target.base.view : "the app's server"}`;
+    if (target.kind === "data")
+        return line(target);
+    return "command" in target.source ? line(target.source) : target.source.view ? `${target.source.view} output` : "the app's server output";
+}
 export class AppRegistry extends EventEmitter {
     reservedPorts;
     file;
+    /** Errors a web view's server logged since `since` (set by the backend
+     *  views, which follow server output; asked by the gateway for the Console). */
+    serverErrors;
     apps = new Map();
     views = new Map();
     persisted = new Map();
@@ -198,8 +249,12 @@ export class AppRegistry extends EventEmitter {
                 target = { kind: "display", ...command(spec, workspace, "Display view"), restartOnChange: spec.restartOnChange === true };
                 view = { ...base, kind: "web", source: "display", managed: true };
             }
+            else if (spec.kind === "requests" || spec.kind === "data" || spec.kind === "logs") {
+                target = backendTarget(spec, workspace);
+                view = { ...base, kind: "backend", backend: spec.kind, detail: backendDetail(target) };
+            }
             else
-                throw new Error("Unsupported app view. Supported views: web, terminal and display.");
+                throw new Error("Unsupported app view. Supported views: web, terminal, display, requests, data and logs.");
             app.views.push(view);
             const stored = restore?.notes?.[view.id];
             const notes = view.kind === "web" && Array.isArray(stored) ? stored.filter(isNote).slice(-MAX_NOTES) : [];

package/dist/apps/service.js

@@ -13,6 +13,7 @@ import { captureFrame, encodePng, sendInput } from "./rfb.js";
 import { inputEvents, readAction } from "./input.js";
 import { pressMenu, readMenuPath, readMenus } from "./menu.js";
 import { pngSize } from "./review.js";
+import { Backend } from "./backend/index.js";
 import { SCENARIO_DIR, loadScenarios, planScenario, scenariosFor, summarize } from "./scenarios.js";
 import { startScenarioProxy } from "./scenario-proxy.js";
 const scenarioKind = (entry) => entry.target.kind === "display" ? "desktop" : "web";
@@ -71,6 +72,8 @@ export class AppService {
     proxies = new Map();
     /** Screenshots in progress, so a card, Compare and a baseline share one browser run. */
     inflight = new Map();
+    /** Requests, data and logs views: what a backend change did. */
+    backend;
     constructor(registry, gateway, terminals, options = {}) {
         this.registry = registry;
         this.gateway = gateway;
@@ -83,6 +86,7 @@ export class AppService {
         this.reviews = options.reviews ?? NO_REVIEWS;
         this.pinSink = options.pins ?? NO_PINS;
         this.settleMs = options.settleMs ?? COMPARE_SETTLE_MS;
+        this.backend = new Backend(registry, terminals);
         registry.desktopScenario = (viewId, scenario) => this.desktopScenario(viewId, scenario);
     }
     /** A session's apps, or every app on this machine when no session is given. */
@@ -200,11 +204,16 @@ export class AppService {
         const views = this.reviewable(sessionId);
         const run = { start: new Map(views.map((entry) => [entry.view.id, entry.revision])), baseline: new Map(), reviews: new Map(), muted: false, ended: false };
         this.runs.set(sessionId, run);
+        if (this.backend.views(sessionId).length)
+            run.backend = this.backend.baseline(sessionId).catch(() => { });
+        // Settles when the backend's "before" is taken (tests wait on it; the server doesn't need to).
+        const ready = run.backend ?? Promise.resolve();
         if (!this.screenshots.enabled())
-            return;
+            return ready;
         for (const entry of views)
             void this.shotOf(entry).then((png) => { if (png && entry.revision === run.start.get(entry.view.id))
                 run.baseline.set(entry.view.id, png); });
+        return ready;
     }
     /** The run ended (done, or waiting for the user). Views whose revision
      * changed are screenshotted and compared with the page before the run; a
@@ -216,6 +225,12 @@ export class AppService {
             return undefined;
         run.ended = true;
         let latest;
+        // Backend views run again; what changed is evidence, on the app's card.
+        let evidence = new Map();
+        if (run.backend) {
+            await run.backend;
+            evidence = await this.backend.evidence(sessionId).catch(() => evidence);
+        }
         const changed = [...run.start].map(([id, revision]) => ({ entry: this.registry.getView(id), revision })).filter(({ entry, revision }) => entry && entry.revision !== revision);
         if (changed.length && this.screenshots.enabled() && !run.muted)
             await new Promise((r) => setTimeout(r, this.settleMs));
@@ -238,7 +253,7 @@ export class AppService {
             const presented = current && run.reviews.get(entry.app.id) === current.id;
             if (!shouldReview({ trigger: "run", mode, muted: run.muted, revisionChanged: true, change }) && !(presented && after))
                 continue;
-            latest = this.review(entry, run, { trigger: presented ? current.trigger : "run", note: presented ? current.note : undefined, try: presented ? current.try : undefined, path: entry.lastPath ?? "/", shot: after, before });
+            latest = this.review(entry, run, { trigger: presented ? current.trigger : "run", note: presented ? current.note : undefined, try: presented ? current.try : undefined, path: entry.lastPath ?? "/", shot: after, before, evidence: evidence.get(entry.app.id)?.changed ? evidence.get(entry.app.id).rows : undefined });
         }
         // Reviewer notes that arrived since the last hand-over ride on the view's
         // card for this run, or get a card of their own. A count only: the notes
@@ -263,6 +278,14 @@ export class AppService {
                 latest ??= card;
             }
         }
+        // A backend-only change: the evidence is the card.
+        for (const [appId, found] of evidence) {
+            if (!found.changed || run.muted || run.reviews.has(appId) || this.registry.reviewMode(appId) === "off")
+                continue;
+            const entry = this.registry.getView(found.rows[0].viewId);
+            if (entry)
+                latest = this.review(entry, run, { trigger: "run", path: "/", evidence: found.rows });
+        }
         if (!latest) {
             const id = [...run.reviews.values()].at(-1);
             latest = [...this.latest.values()].find((review) => review.id === id);
@@ -776,6 +799,7 @@ export class AppService {
                 throw new Error("App was removed while starting.");
             }
             server.termId = termId;
+            this.backend.attach(id, termId);
             return termId;
         })
             .finally(() => { server.pending = undefined; });
@@ -818,6 +842,16 @@ export class AppService {
         void server.pending?.then((termId) => this.terminals.close(termId)).catch(() => { });
         this.servers.delete(id);
     }
+    /** A backend view of a session, by exact IDs (the app) or by name (`bivy app requests`). */
+    backendView(sessionId, kind, input) {
+        if (input.appId && input.viewId) {
+            const entry = this.registry.requireView(sessionId, input.appId, input.viewId);
+            if (entry.target.kind !== kind)
+                throw new Error(`That isn't a ${kind} view.`);
+            return entry;
+        }
+        return this.backend.pick(sessionId, kind, input.target);
+    }
     share(sessionId, appId, viewId, options = {}) {
         if (this.registry.requireView(sessionId, appId, viewId).view.kind !== "web")
             throw new Error("Only web views have preview links.");
@@ -882,6 +916,7 @@ export class AppService {
     remove(sessionId, appId) {
         const app = this.registry.require(sessionId, appId);
         this.registry.remove(sessionId, appId);
+        this.backend.forget(app.views.map((view) => view.id), app.id);
         for (const view of app.views) {
             this.gateway?.revoke(view.id);
             this.stopServer(view.id);

package/dist/apps/styles.css

@@ -3243,6 +3243,14 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .review-side .seg-btn { min-block-size: 44px; min-inline-size: 72px; }
 .review-banner { margin: 0 var(--space-3); }
 .review-note { margin: var(--space-3) var(--space-3) 0; padding-inline-start: var(--space-3); border-inline-start: 2px solid var(--line-strong); color: var(--ink); font-size: var(--text-sm); white-space: pre-wrap; }
+/* Backend evidence on a review card: one line per thing a run changed. */
+.review-evidence { list-style: none; margin: 0 var(--space-3); padding: 0; border-top: 1px solid var(--line); }
+.review-evidence-row { display: grid; grid-template-columns: 4.5rem minmax(0, 1fr) auto; align-items: baseline; gap: var(--space-2); inline-size: 100%; min-block-size: var(--space-7); padding: var(--space-2) 0; border: 0; border-bottom: 1px solid var(--line); background: none; color: var(--ink); font: inherit; font-size: var(--text-sm); text-align: start; cursor: pointer; }
+.review-evidence li:last-child .review-evidence-row { border-bottom: 0; }
+.review-evidence-row:hover { background: var(--surface-2); }
+.review-evidence-kind { color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-semibold); }
+.review-evidence-text { display: flex; flex-wrap: wrap; gap: 0 var(--space-2); min-inline-size: 0; overflow-wrap: anywhere; }
+.review-evidence-text code { color: var(--muted); font-family: var(--font-mono); font-size: var(--text-xs); }
 /* "Try it": scenarios the agent offered, each opening the live preview in that state. */
 .review-try { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-1); margin: var(--space-3) var(--space-3) 0; }
 .review-try-label { margin-inline-end: var(--space-1); color: var(--muted); font-size: var(--text-sm); }
@@ -3278,6 +3286,64 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .apps-note { display: flex; flex-direction: column; gap: 2px; padding-inline-start: var(--space-3); border-inline-start: 2px solid var(--line-strong); }
 .apps-note-text { color: var(--ink); font-size: var(--text-sm); }
 .apps-notes-actions { display: flex; gap: var(--space-2); }
+/* Backend views (BackendView.tsx): Requests, Data and Logs. Rows reuse the
+   Apps sheet's density; answers and rows are the app's own text, in mono. */
+.backend-view { display: flex; flex-direction: column; gap: var(--space-3); padding: var(--space-3) var(--space-4) var(--space-5); }
+.backend-toolbar { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: var(--space-2); }
+.backend-source, .backend-meta { color: var(--muted); font-size: var(--text-xs); overflow-wrap: anywhere; }
+.backend-meta code, .backend-foot code, .backend-row-sub { font-family: var(--font-mono); }
+.backend-back { align-self: flex-start; }
+.backend-group { display: flex; flex-direction: column; gap: var(--space-2); }
+.backend-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: var(--space-2); }
+.backend-row { display: flex; align-items: center; gap: var(--space-2); inline-size: 100%; min-block-size: var(--space-7); box-sizing: border-box; padding: var(--space-2) var(--space-3); border: 1px solid var(--line); border-radius: var(--radius-md); background: var(--surface); color: var(--ink); font: inherit; text-align: start; cursor: pointer; }
+.backend-row:hover { background: var(--surface-2); }
+.backend-method { flex: none; min-inline-size: 3.25rem; font-family: var(--font-mono); font-size: var(--text-xs); font-weight: var(--weight-bold); color: var(--accent); }
+.backend-method[data-method="GET"], .backend-method[data-method="HEAD"] { color: var(--ok); }
+.backend-method[data-method="DELETE"] { color: var(--danger); }
+.backend-row-text { display: flex; flex-direction: column; flex: 1; min-inline-size: 0; gap: 2px; }
+.backend-row-name { font-size: var(--text-sm); font-weight: var(--weight-semibold); overflow-wrap: anywhere; }
+.backend-row-sub { color: var(--muted); font-size: var(--text-xs); overflow-wrap: anywhere; }
+.backend-foot, .backend-empty { margin: 0; color: var(--muted); font-size: var(--text-xs); }
+.backend-empty { font-size: var(--text-sm); }
+.backend-detail-head { display: flex; align-items: flex-start; gap: var(--space-2); }
+.backend-status { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2); }
+.backend-switch { align-self: flex-start; }
+.backend-body { margin: 0; max-block-size: 50vh; overflow: auto; padding: var(--space-3); border-radius: var(--radius-md); background: var(--surface-2); color: var(--ink); font-family: var(--font-mono); font-size: var(--text-xs); line-height: 1.6; white-space: pre-wrap; overflow-wrap: anywhere; }
+.backend-request summary { color: var(--muted); font-size: var(--text-sm); cursor: pointer; margin-block-end: var(--space-2); }
+.backend-changes { list-style: none; margin: 0; padding: 0; border-radius: var(--radius-md); background: var(--surface-2); font-family: var(--font-mono); font-size: var(--text-xs); }
+.backend-changes li { display: flex; flex-wrap: wrap; gap: var(--space-1) var(--space-2); padding: var(--space-2) var(--space-3); border-bottom: 1px solid var(--line); overflow-wrap: anywhere; }
+.backend-changes li:last-child { border-bottom: 0; }
+.backend-path { color: var(--muted); }
+.backend-was { color: var(--del); text-decoration: line-through; }
+.backend-now { color: var(--add); }
+.backend-gone { color: var(--del); }
+.backend-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: var(--space-2); }
+.backend-actions .btn { min-block-size: var(--space-7); }
+.backend-query { display: flex; flex-direction: column; gap: var(--space-2); padding-block-start: var(--space-3); border-top: 1px solid var(--line); }
+.backend-query-head { display: flex; align-items: baseline; justify-content: space-between; gap: var(--space-2); }
+.backend-query-head h3 { margin: 0; font-size: var(--text-base); }
+.backend-counts { font-family: var(--font-mono); font-size: var(--text-xs); font-weight: var(--weight-semibold); }
+.backend-counts [data-tone="ok"] { color: var(--ok); } .backend-counts [data-tone="warn"] { color: var(--warn); } .backend-counts [data-tone="danger"] { color: var(--danger); }
+.backend-rowcard { display: flex; flex-direction: column; gap: var(--space-1); padding: var(--space-2) var(--space-3); border: 1px solid var(--line); border-inline-start: 3px solid var(--line-strong); border-radius: var(--radius-md); }
+.backend-rowcard[data-kind="added"] { border-inline-start-color: var(--ok); }
+.backend-rowcard[data-kind="changed"] { border-inline-start-color: var(--warn); }
+.backend-rowcard[data-kind="removed"] { border-inline-start-color: var(--danger); }
+.backend-fields { display: grid; grid-template-columns: minmax(5rem, max-content) minmax(0, 1fr); gap: 2px var(--space-3); margin: 0; font-size: var(--text-xs); }
+.backend-fields div { display: contents; }
+.backend-fields dt { color: var(--muted); }
+.backend-fields dd { margin: 0; font-family: var(--font-mono); overflow-wrap: anywhere; }
+.backend-table-wrap { overflow-x: auto; border: 1px solid var(--line); border-radius: var(--radius-md); }
+.backend-table { border-collapse: collapse; inline-size: 100%; font-size: var(--text-xs); }
+.backend-table th, .backend-table td { padding: var(--space-1) var(--space-2); border-bottom: 1px solid var(--line); text-align: start; white-space: nowrap; }
+.backend-table th { position: sticky; top: 0; background: var(--surface-2); color: var(--muted); font-weight: var(--weight-semibold); }
+.backend-table td { font-family: var(--font-mono); }
+.backend-log { list-style: none; margin: 0; padding: var(--space-2) 0; max-block-size: 60vh; overflow: auto; border-radius: var(--radius-md); background: var(--surface-2); font-family: var(--font-mono); font-size: var(--text-xs); line-height: 1.6; }
+.backend-line { padding: 1px var(--space-3); white-space: pre-wrap; overflow-wrap: anywhere; }
+.backend-line[data-level="error"] { background: var(--danger-soft); }
+.backend-line[data-level="warn"] { color: var(--warn); }
+.backend-line-time { color: var(--muted); }
+.backend-mark { display: flex; align-items: center; gap: var(--space-2); margin: var(--space-2) 0; padding: 0 var(--space-3); color: var(--accent); font-family: var(--font-sans); font-weight: var(--weight-semibold); scroll-margin-block-start: var(--space-2); }
+.backend-mark::before, .backend-mark::after { content: ""; flex: 1; block-size: 1px; background: color-mix(in srgb, var(--accent) 40%, var(--line)); }
 .apps-empty { display: flex; flex-direction: column; align-items: center; gap: var(--space-2); padding: var(--space-6) var(--space-4); color: var(--muted); font-size: var(--text-sm); text-align: center; }
 .apps-empty strong { color: var(--ink); font-size: var(--text-base); }
 .apps-empty p { margin: 0; max-inline-size: 34ch; }

package/dist/apps/types.js

@@ -1,6 +1,12 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
 export const REVIEW_CARD_MODES = ["ready", "every", "off"];
+const isEvidence = (row) => {
+    const r = row;
+    return !!r && typeof r.viewId === "string" && typeof r.view === "string" && ["requests", "data", "logs"].includes(r.backend)
+        && typeof r.summary === "string" && r.summary.length <= 300 && (r.detail === undefined || (typeof r.detail === "string" && r.detail.length <= 300))
+        && ["ok", "warn", "danger", "neutral"].includes(r.tone) && (r.item === undefined || typeof r.item === "string");
+};
 export const APP_REVIEW_BLOCK = "bivy_app_review";
 const isShot = (value) => {
     const shot = value;
@@ -16,6 +22,7 @@ export function isAppReview(value) {
         && (review.shot === undefined || isShot(review.shot)) && (review.before === undefined || isShot(review.before))
         && (review.note === undefined || typeof review.note === "string")
         && (review.notes === undefined || (Number.isInteger(review.notes) && review.notes >= 0))
+        && (review.evidence === undefined || (Array.isArray(review.evidence) && review.evidence.length <= 12 && review.evidence.every(isEvidence)))
         && (review.try === undefined || (Array.isArray(review.try) && review.try.length <= 6 && review.try.every((item) => !!item && typeof item.id === "string" && /^[a-z0-9][a-z0-9-]{0,63}$/.test(item.id) && typeof item.name === "string" && item.name.length <= 80)));
 }
 export const APP_PIN_STATES = ["open", "changed", "gone", "done"];

package/dist/controllers/app-commands.js

@@ -9,6 +9,7 @@ export function createAppCommands(service, workspaceFor, published = () => { },
             throw new Error("Open the session on this machine before publishing an app.");
         return workspace;
     };
+    const pick = (msg) => ({ appId: typeof msg.appId === "string" ? msg.appId : undefined, viewId: typeof msg.viewId === "string" ? msg.viewId : undefined, target: typeof msg.target === "string" ? msg.target : undefined });
     const operations = {
         "apps.list": (msg) => service.list(typeof msg.sessionId === "string" ? msg.sessionId : undefined),
         "apps.publish": (msg) => {
@@ -43,6 +44,15 @@ export function createAppCommands(service, workspaceFor, published = () => { },
         "apps.agentNotes": (msg) => service.setAgentNotes(String(msg.sessionId), String(msg.appId), msg.enabled === true),
         "apps.notes": (msg) => service.notes(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined, since: typeof msg.since === "number" ? msg.since : undefined }),
         "apps.logs": (msg) => service.logs(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
+        // Backend views. The app passes exact IDs; `bivy app requests|data|logs` a name, or nothing.
+        "apps.requests": (msg) => service.backend.requests(service.backendView(String(msg.sessionId), "requests", pick(msg))),
+        "apps.request": (msg) => service.backend.detail(service.backendView(String(msg.sessionId), "requests", pick(msg)), String(msg.id)),
+        "apps.runRequest": (msg) => {
+            const entry = service.backendView(String(msg.sessionId), "requests", pick(msg));
+            return typeof msg.id === "string" ? service.backend.run(entry, msg.id) : service.backend.runAuto(entry, "last", "Ran all requests");
+        },
+        "apps.data": (msg) => service.backend.data(service.backendView(String(msg.sessionId), "data", pick(msg)), msg.run === true),
+        "apps.serverLog": (msg) => service.backend.log(service.backendView(String(msg.sessionId), "logs", pick(msg)), typeof msg.since === "number" ? msg.since : 0),
         // The app UI passes exact IDs; `bivy app share` passes an app and/or view by ID or name.
         "apps.share": (msg) => {
             const options = { duration: msg.duration, controls: msg.controls !== false };

package/dist/protocol/client-command-routes.js

@@ -3,7 +3,7 @@
 /** Direct-mode adapters for operations whose canonical implementation is the
  * client command registry. Relay and HTTP now differ only in framing. */
 export const CLIENT_COMMAND_ROUTES = [
-    ...["list", "publish", "offers", "adopt", "open", "logs", "shot", "input", "menu", "present", "scenarios", "showMe", "mute", "reviewMode", "annotate", "clearNotes", "agentNotes", "notes", "share", "unshare", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
+    ...["list", "publish", "offers", "adopt", "open", "logs", "requests", "request", "runRequest", "data", "serverLog", "shot", "input", "menu", "present", "scenarios", "showMe", "mute", "reviewMode", "annotate", "clearNotes", "agentNotes", "notes", "share", "unshare", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
     { method: "post", path: "/api/artifacts/list", kind: "artifacts.list" },
     { method: "post", path: "/api/access/get", kind: "access.get" },
     { method: "post", path: "/api/tailnet/machines", kind: "tailnet.machines" },

package/dist/protocol/client-command-schemas.js

@@ -4,6 +4,8 @@ import { Type } from "typebox";
 import { SHARE_DURATIONS } from "../apps/types.js";
 const request = { requestId: Type.Optional(Type.String()) };
 const session = { sessionId: Type.String() };
+/** A backend view by exact IDs (the app), or by app or view name (`bivy app requests`). */
+const backendView = { appId: Type.Optional(Type.String({ maxLength: 200 })), viewId: Type.Optional(Type.String({ maxLength: 200 })), target: Type.Optional(Type.String({ maxLength: 200 })) };
 const optionalSession = { sessionId: Type.Optional(Type.String()) };
 /** Declarative validation at the client-command boundary. A command absent from
  * this table remains migration-compatible; adding validation is one data row. */
@@ -36,6 +38,11 @@ export const CLIENT_COMMAND_SCHEMAS = {
     "apps.agentNotes": Type.Object({ ...request, ...session, appId: Type.String(), enabled: Type.Boolean() }),
     "apps.notes": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String({ maxLength: 200 })), view: Type.Optional(Type.String({ maxLength: 200 })), since: Type.Optional(Type.Number()) }),
     "apps.logs": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
+    "apps.requests": Type.Object({ ...request, ...session, ...backendView }),
+    "apps.request": Type.Object({ ...request, ...session, ...backendView, id: Type.String({ maxLength: 200 }) }),
+    "apps.runRequest": Type.Object({ ...request, ...session, ...backendView, id: Type.Optional(Type.String({ maxLength: 200 })) }),
+    "apps.data": Type.Object({ ...request, ...session, ...backendView, run: Type.Optional(Type.Boolean()) }),
+    "apps.serverLog": Type.Object({ ...request, ...session, ...backendView, since: Type.Optional(Type.Number()) }),
     "apps.share": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String({ maxLength: 200 })), viewId: Type.Optional(Type.String()), view: Type.Optional(Type.String({ maxLength: 200 })),
         duration: Type.Optional(Type.Union(SHARE_DURATIONS.map((row) => Type.Literal(row.id)))), controls: Type.Optional(Type.Boolean()) }),
     "apps.unshare": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),

package/dist/server.js

@@ -1196,7 +1196,7 @@ function harnessDirFor(record) {
  *  waits on git. Never throws into the prompt path. */
 function harnessBeginTurn(record) {
     // A run starts: review cards measure what the app looked like before it.
-    appService.runStarted(record.id);
+    void appService.runStarted(record.id);
     record.runReview = undefined;
     const dir = harnessDirFor(record);
     record.harnessTurnReady = undefined;
@@ -2278,6 +2278,7 @@ const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     },
     has: (id) => terminals.has(id),
     close: (id) => { terminals.close(id); },
+    tap: (id, onData) => terminals.tap(id, onData) ?? undefined,
 }, {
     scan: async (workspace) => notAgentServers(await scanListeners(workspace)),
     scanMachine: async (root) => notAgentServers(await scanMachineListeners(root)),