@bivy/bivy 0.20.9-staging.12 → 0.20.9-staging.13

package/dist/automation-reseal.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { open, seal } from "./e2e.js";
+export async function resealAutomationTemplates(opts) {
+    const prefix = `bivy-room-v1:${opts.nodeId}:`;
+    const result = { resealed: 0, unreadable: [] };
+    for (const template of opts.templates) {
+        if (!template.templateCiphertext.startsWith(prefix))
+            continue;
+        const payload = template.templateCiphertext.slice(prefix.length);
+        if (tryOpen(opts.current, payload) !== undefined)
+            continue;
+        const plaintext = opts.retired.map((key) => tryOpen(key, payload)).find((text) => text !== undefined);
+        if (plaintext === undefined) {
+            result.unreadable.push(template.id);
+            continue;
+        }
+        await opts.save(template.id, `${prefix}${seal(opts.current, plaintext)}`);
+        result.resealed += 1;
+    }
+    return result;
+}
+function tryOpen(key, payload) {
+    try {
+        return open(key, payload);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/device-registry.js

@@ -7,6 +7,7 @@ import { generatePairingKeypair, generateRoomKey, generatePairSecret, deriveWrap
 import { seal, open } from "./e2e.js";
 const DEFAULT_PAIR_TTL_MS = 5 * 60_000;
 const ROOM_KEY_BYTES = 32;
+const MAX_RETIRED_ROOM_KEYS = 8;
 /**
  * Validate + canonicalize a pre-shared room-key seed. Returns the canonical
  * base64 of a well-formed 32-byte key, or undefined for anything malformed
@@ -81,6 +82,7 @@ export class PairingStore {
             return new PairingStore(filePath, {
                 nodeKeypair: parsed.nodeKeypair,
                 roomKeyB64: parsed.roomKeyB64,
+                ...(Array.isArray(parsed.retiredRoomKeysB64) && parsed.retiredRoomKeysB64.length ? { retiredRoomKeysB64: parsed.retiredRoomKeysB64 } : {}),
                 devices: Array.isArray(parsed.devices) ? parsed.devices : [],
             });
         }
@@ -130,6 +132,30 @@ export class PairingStore {
     roomKey() {
         return Buffer.from(this.data.roomKeyB64, "base64");
     }
+    /** Room keys replaced by earlier rotations that still guard stored data. */
+    retiredRoomKeys() {
+        return (this.data.retiredRoomKeysB64 ?? []).map((key) => Buffer.from(key, "base64"));
+    }
+    /** Drop retired room keys once nothing stored is sealed under them. */
+    forgetRetiredRoomKeys() {
+        if (!this.data.retiredRoomKeysB64)
+            return;
+        delete this.data.retiredRoomKeysB64;
+        this.persist();
+    }
+    /** Open a payload sealed under the current room key or a retired one. */
+    openSealed(payload) {
+        let lastError;
+        for (const key of [this.roomKey(), ...this.retiredRoomKeys()]) {
+            try {
+                return open(key, payload);
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        throw lastError;
+    }
     /** Issue a single-use, expiring pairing secret to embed in a linking QR. */
     issuePairSecret(ttlMs = DEFAULT_PAIR_TTL_MS) {
         this.sweepSecrets();
@@ -215,6 +241,7 @@ export class PairingStore {
     }
     /** Rotate the room key and re-wrap it for all current devices. */
     rotateRoomKey() {
+        this.data.retiredRoomKeysB64 = [this.data.roomKeyB64, ...(this.data.retiredRoomKeysB64 ?? [])].slice(0, MAX_RETIRED_ROOM_KEYS);
         this.data.roomKeyB64 = generateRoomKey().toString("base64");
         this.persist();
         const roomKey = this.roomKey();

package/dist/server.js

@@ -54,6 +54,7 @@ import { ControlPlaneSessionLocationRegistry, LayeredSessionLocationRegistry } f
 import { attachAdoptedSessions, classifyAttachFailure } from "./runtime/adoption.js";
 import { createCredentialStore, testProviderCredential } from "./runtime/credentials.js";
 import { decodeAutomationTemplate } from "./automation-template.js";
+import { resealAutomationTemplates } from "./automation-reseal.js";
 import { passWebhookFilter } from "./automation-filter-gate.js";
 import { isModelAuthError, authProviderForSession, classifyModelAuthError } from "./runtime/auth-errors.js";
 import { createCredentialVault, migrateVaultDir } from "./runtime/credential-store.js";
@@ -1080,6 +1081,7 @@ const linkedDevices = createLinkedDeviceController({
         syncPairingMetadata();
         relay?.pushRotate(deliveries);
         broadcast({ type: "devices.updated", devices });
+        void resealRetiredAutomationTemplates();
     },
 });
 const accessDevices = createAccessDeviceController({
@@ -3537,6 +3539,7 @@ function startRelayIfConfigured() {
     if (config.controlPlaneUrl && config.enrollmentToken) {
         sessionAdvertiseTarget = { controlPlaneUrl: config.controlPlaneUrl, enrollmentToken: config.enrollmentToken };
         void syncModelAuthFromControlPlane();
+        void resealRetiredAutomationTemplates();
         if (remoteRuntimeEnabled()) {
             // Stage 3: layer a control-plane-backed location registry UNDER the in-memory
             // one (so a lookup surviving a restart resolves from durable state), then
@@ -3698,6 +3701,43 @@ async function modelAuthFetch(pathname, init = {}) {
         headers.set("content-type", "application/json");
     return fetch(`${sessionAdvertiseTarget.controlPlaneUrl.replace(/\/$/, "")}${pathname}`, { ...init, headers });
 }
+// A device revoke rotates the room key. Re-seal this node's stored automation
+// instructions under the new key so the node and its devices can still read
+// them, then drop the retired keys. Retried at startup until it completes.
+async function resealRetiredAutomationTemplates() {
+    const retired = pairingStore.retiredRoomKeys();
+    if (!retired.length || !sessionAdvertiseTarget)
+        return;
+    const current = pairingStore.roomKey();
+    try {
+        const res = await modelAuthFetch("/node/automation-templates");
+        if (!res?.ok)
+            throw new Error(`control plane returned ${res?.status}`);
+        const { templates } = await res.json();
+        const result = await resealAutomationTemplates({
+            nodeId: identity.nodeId,
+            current,
+            retired,
+            templates,
+            save: async (id, templateCiphertext) => {
+                const saved = await modelAuthFetch(`/node/automation-templates/${encodeURIComponent(id)}`, { method: "PUT", body: JSON.stringify({ templateCiphertext }) });
+                if (!saved?.ok)
+                    throw new Error(`control plane returned ${saved?.status}`);
+            },
+        });
+        if (result.resealed)
+            console.log(`[automation-reseal] re-sealed ${result.resealed} automation template(s) under the rotated room key`);
+        if (result.unreadable.length)
+            console.warn(`[automation-reseal] ${result.unreadable.length} automation template(s) were sealed under a key this node no longer has: ${result.unreadable.join(", ")}`);
+        // Another rotation during this pass retired `current`; run again for it.
+        if (!pairingStore.roomKey().equals(current))
+            return void resealRetiredAutomationTemplates();
+        pairingStore.forgetRetiredRoomKeys();
+    }
+    catch (error) {
+        console.warn("[automation-reseal] will retry at next start:", error.message);
+    }
+}
 const remoteSessionAdmission = createRemoteSessionAdmission(async (idempotencyKey) => {
     // Only remote scopes reach this callback. Self-hosted control planes answer
     // allowed without an extension; losing enrollment mid-launch must fail closed.
@@ -5554,7 +5594,7 @@ async function executeWorkItem(item, report, signal) {
             throw new Error("automation instructions were encrypted for a different node");
         }
         try {
-            const template = decodeAutomationTemplate(open(pairingStore.roomKey(), payload.join(":")));
+            const template = decodeAutomationTemplate(pairingStore.openSealed(payload.join(":")));
             credentialLabels = template.credentialLabels;
             filter = template.filter;
             item = { ...item, body: template.instructions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.20.9-staging.12",
+  "version": "0.20.9-staging.13",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",