@bivy/bivy 0.20.9-staging.18 → 0.20.9-staging.19

package/dist/agent-instructions.js

@@ -30,10 +30,12 @@ export const MAX_AGENT_INSTRUCTIONS_BYTES = 16 * 1024;
 export const BIVY_AGENT_NOTE = [
     "You are running inside Bivy. The user follows this session in a chat app (web or phone): they cannot see your " +
         "terminal or files you only write to disk. $BIVY_SESSION_ID identifies this session; the `bivy` commands below use it.",
-    "- Show a LOCAL file or image (report, screenshot, chart, a file they asked for): run " +
-        '`bivy attach <path> [--caption "short note"]`, or call the `attach_to_chat` tool if you have it. Images render ' +
-        "inline, other files as downloads; the path must be inside the session workspace. Markdown image syntax like " +
-        "![](path) does not render a local path. A REMOTE `https://` image in markdown does render.",
+    "- Show an IMAGE (screenshot, chart, diagram) inside your reply: write it as markdown, " +
+        "`![short caption](relative/path.png)`, where you want it to appear. The path must be inside the session " +
+        "workspace; a remote `https://` image works too. No tool call needed.",
+    "- Send a FILE, or an image on its own (a report, a download they asked for): run " +
+        '`bivy attach <path> [--caption "short note"]`, or call the `attach_to_chat` tool if you have it. Same ' +
+        "workspace-only rule; files arrive as downloads.",
     "- Something with a UI: `bivy app publish <manifest.json>` (a web server's port, a static build, a terminal) or " +
         "`bivy app run -- <command>` (a desktop app) gives the user a live preview; `bivy app shot` screenshots it so you " +
         "can check your work; `bivy app present` tells the user a visible change is ready to look at, and " +

package/dist/server.js

@@ -8160,14 +8160,17 @@ function attachSessionListeners(record) {
         if (event.type === "turn_start" || event.type === "message_boundary" || event.type === "message_end" || event.type === "turn_end") {
             transcripts.persistTranscriptSnapshot(record);
         }
-        // A finalized assistant message may reference a remote image via markdown
-        // (`![alt](https://…)`) — fetch and store it now so the chat can render it
-        // (see resolveInlineImages). Checked on both events: message_end is the
-        // precise "this assistant message is done" signal most runtimes emit, but
-        // turn_end is a safety net for one that only surfaces the final text there.
-        // Fire-and-forget and internally deduped, so checking on both costs nothing.
+        // A finalized assistant message may reference an image via markdown — a
+        // remote URL (`![alt](https://…)`) to fetch, or a file the agent just
+        // produced in its workspace (`![alt](out/chart.png)`) to read. Resolve and
+        // store either now, so the chat can render it and history keeps it after the
+        // workspace is gone. Checked on both events: message_end is the precise
+        // "this assistant message is done" signal most runtimes emit, but turn_end
+        // is a safety net for one that only surfaces the final text there. Both
+        // resolvers are internally deduped, so checking twice costs nothing.
         if (event.type === "message_end" || event.type === "turn_end") {
             transcripts.resolveInlineImages(record);
+            transcripts.resolveWorkspaceImages(record, harnessDirFor(record));
         }
         // Durably persist the throttled sidecars at the turn boundary so a crash
         // loses at most the in-flight turn's UI detail, not the whole turn. A

package/dist/session/inline-image-fetch.js

@@ -10,25 +10,21 @@
 // otherwise get the *viewer's* browser/IP to hit an arbitrary URL by embedding
 // it in a reply).
 //
-// This is the PURE-ish, testable half — URL extraction, host/SSRF validation,
-// and the guarded fetch itself — all dependency-injectable so tests never hit
-// the real network or DNS. The server half (src/server.ts) owns the AttachmentStore
+// This is the PURE-ish, testable half — host/SSRF validation and the guarded
+// fetch itself — all dependency-injectable so tests never hit the real network
+// or DNS. Which references a message makes at all is the renderer's and this
+// module's shared concern, so it lives in ./message-components.js (the same file
+// @bivy/core compiles). The server half (src/server.ts) owns the AttachmentStore
 // write, the durable event-log ref, and the live broadcast; see resolveInlineImages.
 import dns from "node:dns/promises";
 import { hostnameIsLocal } from "../auth.js";
 import { sanitizeAttachmentName, sniffMime } from "./attach-to-chat.js";
-/**
- * The image-markdown pattern, `![alt](https://…)` — MUST match the image regex
- * in `inline()` in packages/core/src/markdown.ts exactly. Not a shared import: the
- * node (src/) intentionally does not depend on @bivy/core (a browser/client
- * package — see packages/core's own description). Kept in lock-step by comment
- * instead: if you change one, change the other.
- */
-const INLINE_IMAGE_MD_RE = /!\[[^\]]*\]\((https:\/\/[^)\s]+)\)/g;
-/** Bound how many distinct remote images a single message can trigger a fetch
- *  for — a pathological/malicious message can't fan out into an unbounded
- *  number of outbound requests. */
-export const MAX_INLINE_IMAGES_PER_MESSAGE = 6;
+import { extractImageReferences, MAX_COMPONENTS_PER_MESSAGE } from "./message-components.js";
+/** Bound how many distinct images a single message can trigger a resolve for —
+ *  a pathological/malicious message can't fan out into an unbounded number of
+ *  outbound requests or file reads. Re-exported from the shared grammar, which
+ *  the renderer applies the same cap from. */
+export const MAX_INLINE_IMAGES_PER_MESSAGE = MAX_COMPONENTS_PER_MESSAGE;
 /** Ceiling for a single fetched inline image. Smaller than
  *  MAX_AGENT_ATTACHMENT_BYTES (attach-to-chat.ts) because these bytes come from
  *  an arbitrary, untrusted remote origin rather than the local workspace —
@@ -38,23 +34,17 @@ export const MAX_INLINE_IMAGE_BYTES = 8 * 1024 * 1024;
 const FETCH_TIMEOUT_MS = 10_000;
 /** Hard cap on redirect hops, mirroring execEphemeralRequest's guard. */
 const MAX_REDIRECTS = 5;
-/** Extract the distinct `https://` URLs a message's raw markdown references via
- *  `![alt](url)`, in first-seen order, capped at MAX_INLINE_IMAGES_PER_MESSAGE. */
+/** The distinct `https://` URLs a message's raw markdown references via
+ *  `![alt](url)`, in first-seen order, capped at MAX_INLINE_IMAGES_PER_MESSAGE.
+ *  Workspace-relative references are a different resolver's job (they are read,
+ *  not fetched) — see resolveWorkspaceImageRefs in transcript-persistence.ts. */
 export function extractInlineImageUrls(text) {
-    if (!text)
-        return [];
-    const out = [];
-    const seen = new Set();
-    for (const match of text.matchAll(INLINE_IMAGE_MD_RE)) {
-        const url = match[1];
-        if (!url || seen.has(url))
-            continue;
-        seen.add(url);
-        out.push(url);
-        if (out.length >= MAX_INLINE_IMAGES_PER_MESSAGE)
-            break;
-    }
-    return out;
+    return extractImageReferences(text).filter((i) => i.origin === "remote").map((i) => i.ref);
+}
+/** The distinct workspace-relative paths a message's raw markdown references,
+ *  in first-seen order, under the same per-message cap. */
+export function extractWorkspaceImagePaths(text) {
+    return extractImageReferences(text).filter((i) => i.origin === "workspace").map((i) => i.ref);
 }
 /** Best-effort plain text for an assistant RuntimeMessage's `content`, which is
  *  either a plain string or an array of typed blocks (`{type:"text", text}`

package/dist/session/message-components.js

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// The grammar for things an agent places INSIDE its chat message by writing
+// them in the markdown, rather than out-of-band beside it.
+//
+// Three parties have to agree on it, byte for byte:
+//
+//   1. the renderer (packages/core/src/markdown.ts) turns each reference into an
+//      EMPTY placeholder element carrying the reference as a data attribute;
+//   2. the node (src/session/transcript-persistence.ts) finds the same
+//      references in the raw message, resolves each one, and stores the bytes in
+//      the content-addressed AttachmentStore under that same reference string;
+//   3. the view (packages/web ChatView) looks the reference up in the entry's
+//      resolved map and hydrates the placeholder.
+//
+// Those three live in two packages that deliberately do not import each other
+// (src/ is the node; @bivy/core is the client library). The agreement used to be
+// two copies of one regex kept in lock-step by comment — which silently diverges
+// the moment someone edits one. This file is the single source instead: the node
+// compiles THIS file through a symlink at src/session/message-components.ts, and
+// scripts/check-module-boundaries.mjs fails if the two stop being one inode.
+//
+// Being compiled by both builds, it imports nothing at all.
+/** How many components one message may resolve. A pathological or hostile
+ *  message must not fan out into an unbounded number of file reads / outbound
+ *  fetches, nor bloat the event log that replicates to a phone. */
+export const MAX_COMPONENTS_PER_MESSAGE = 6;
+/** Longest reference we will even look at. Generous enough for a signed CDN URL
+ *  and far past any real workspace path, but a hard bound — it is also the
+ *  repetition limit in the pattern below, which is what keeps matching linear. */
+const MAX_REF_LENGTH = 2048;
+/** Longest alt text we will match. Bounded for the same reason, not because a
+ *  caption that long means anything. */
+const MAX_ALT_LENGTH = 500;
+/**
+ * Markdown image syntax. One literal, used by every caller here, so the "keep
+ * these two regexes identical" hazard cannot come back.
+ *
+ * Deliberately matches ANY target, not just the ones we accept:
+ * `classifyImageTarget` decides, and a target it rejects is left in the message
+ * as the literal text the agent wrote. Matching narrowly instead would make a
+ * rejected image silently vanish.
+ *
+ * Returned fresh per call: a shared `g`-flagged regex carries `lastIndex`
+ * between calls, which is exactly the kind of cross-call state that makes two
+ * consumers of one module disagree.
+ *
+ * Both repetitions are BOUNDED, and must stay that way. Unbounded `[^\]]*` and
+ * `[^)\s]+` make matching quadratic in the message length: on input like
+ * `![![![…` every `!` starts a match attempt that scans to the end of the
+ * string. This runs on assistant message text — which a prompt injection or a
+ * tool result echoed into a reply can shape — on the node, at every message
+ * boundary. With fixed upper bounds each attempt costs at most a constant, so
+ * the whole scan is linear. (CodeQL js/polynomial-redos flags the unbounded
+ * form; it was flagging the shape this module inherited.)
+ */
+function imagePattern() {
+    return new RegExp(`!\\[([^\\]]{0,${MAX_ALT_LENGTH}})\\]\\(([^)\\s]{1,${MAX_REF_LENGTH}})\\)`, "g");
+}
+/**
+ * Reverse the entity escaping `esc()` in markdown.ts applies to the whole
+ * message before the image rule ever runs.
+ *
+ * Without this the two sides disagree for any reference containing `&`: the
+ * renderer would key on `…?a=1&b=2` while the node — which scans the raw
+ * message text — keys on `…?a=1&b=2`, and the image never hydrates. (That
+ * mismatch predates this module; it is fixed here because this is now the one
+ * place that derives a reference key.) On already-raw text this is a no-op
+ * unless the text literally contains an entity, in which case both sides
+ * normalise it the same way and still agree.
+ */
+export function unescapeComponentRef(target) {
+    return String(target || "")
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&amp;/g, "&");
+}
+/**
+ * Decide what an image target means, or `null` to refuse it.
+ *
+ * `remote` targets are fetched BY THE NODE under its SSRF checks (see
+ * src/session/inline-image-fetch.ts) — never by the viewer's browser.
+ *
+ * `workspace` targets are read from the session's working directory. This
+ * function is NOT the security boundary for them: `planAttachment()`
+ * (src/session/attach-to-chat.ts) is, because only it can resolve symlinks
+ * against the real workspace root. What this does is refuse the obviously
+ * hostile shapes up front, so an absolute path or a traversal never becomes a
+ * map key or reaches the filesystem at all. Message text is agent-authored and
+ * therefore reachable by prompt injection, so both layers earn their place.
+ */
+export function classifyImageTarget(target) {
+    const t = String(target || "").trim();
+    if (!t || t.length > MAX_REF_LENGTH)
+        return null;
+    if (t.startsWith("https://"))
+        return "remote";
+    // Every other scheme is refused. `http:` would be an unencrypted fetch,
+    // `data:`/`blob:` smuggle bytes past the size and mime checks, `file:` reads
+    // the node's disk outside any workspace, and `javascript:` is self-evident.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(t))
+        return null;
+    if (t.startsWith("//"))
+        return null; // protocol-relative URL
+    if (t.startsWith("/") || t.startsWith("~"))
+        return null; // absolute / home-relative
+    if (t.startsWith("#"))
+        return null; // in-page anchor
+    if (t.includes("\\"))
+        return null;
+    if (t.split("/").some((segment) => segment === ".."))
+        return null; // traversal
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f\x7f]/.test(t))
+        return null;
+    return "workspace";
+}
+/**
+ * Every image reference a message makes, de-duplicated, in first-seen order and
+ * capped at `limit`. Targets `classifyImageTarget` refuses are left out: they
+ * are not components, they are prose.
+ */
+export function extractImageReferences(text, limit = MAX_COMPONENTS_PER_MESSAGE) {
+    if (!text)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const match of String(text).matchAll(imagePattern())) {
+        const ref = unescapeComponentRef(match[2] ?? "");
+        const origin = classifyImageTarget(ref);
+        if (!origin || seen.has(ref))
+            continue;
+        seen.add(ref);
+        out.push({ ref, origin });
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+/**
+ * Replace each accepted image reference via `render`, leaving refused ones as
+ * the literal text the agent wrote. The renderer uses this so the one pattern
+ * above stays the only place image syntax is recognised.
+ */
+export function replaceImageReferences(text, render) {
+    return String(text || "").replace(imagePattern(), (whole, alt, target) => {
+        const ref = unescapeComponentRef(target);
+        const origin = classifyImageTarget(ref);
+        if (!origin)
+            return whole;
+        return render({ alt: alt ?? "", ref, origin });
+    });
+}

package/dist/session/transcript-persistence.js

@@ -17,7 +17,8 @@ import { createClientProjection } from "./client-projection.js";
 import { randomBytes } from "node:crypto";
 import { mergeBases } from "./event-log.js";
 import { thinkingTextFromContent } from "./transcript-merge.js";
-import { extractInlineImageUrls, fetchInlineImage, isFetchImageError, inlineImageDisplayName, assistantTextForImageScan } from "./inline-image-fetch.js";
+import { extractInlineImageUrls, extractWorkspaceImagePaths, fetchInlineImage, isFetchImageError, inlineImageDisplayName, assistantTextForImageScan } from "./inline-image-fetch.js";
+import { planAttachment, isAttachPlanError } from "./attach-to-chat.js";
 import { historyDelta } from "../history-sync.js";
 import { withToolDetails } from "../runtime/tool-call-map.js";
 // Display-only intermediate reasoning is persisted as a length-capped HEAD so a
@@ -72,6 +73,12 @@ function thinkingTextFromEvent(event) {
     return "";
 }
 const INLINE_IMAGE_RETRY_COOLDOWN_MS = 10 * 60 * 1000;
+/** Ceiling for one workspace image copied into the transcript. Matches the
+ *  remote cap (MAX_INLINE_IMAGE_BYTES) rather than the larger explicit-attach
+ *  one: a `![…](path)` is incidental illustration the agent spent no tool call
+ *  on, and every byte is persisted in the event log and replicated to phones. An
+ *  agent that means to send something big still has `bivy attach`. */
+const MAX_WORKSPACE_IMAGE_BYTES = 8 * 1024 * 1024;
 export function createTranscriptPersistence(deps) {
     const { eventLog, attachmentStore } = deps;
     const project = createClientProjection(attachmentStore, eventLog);
@@ -93,15 +100,86 @@ export function createTranscriptPersistence(deps) {
         const logged = eventLog.readBase(record.id);
         eventLog.appendBaseSnapshot(record.id, logged.length ? mergeBases(logged, base) : base);
     }
-    function resolveInlineImages(record) {
-        const messages = record.session.getMessages();
-        const urls = new Set();
-        for (const m of messages) {
+    /** Every distinct reference the session's assistant messages make, via the
+     *  extractor for one origin. */
+    function imageRefsInTranscript(record, extract) {
+        const refs = new Set();
+        for (const m of record.session.getMessages()) {
             if (m.role !== "assistant")
                 continue;
-            for (const url of extractInlineImageUrls(assistantTextForImageScan(m.content)))
-                urls.add(url);
+            for (const ref of extract(assistantTextForImageScan(m.content)))
+                refs.add(ref);
         }
+        return refs;
+    }
+    /** Store resolved bytes under `ref` and tell every client, durably and live.
+     *  One place, so the remote and workspace resolvers below cannot drift in how
+     *  they record what they found. */
+    function recordResolvedImage(sessionId, ref, bytes, meta) {
+        const stored = attachmentStore.put(bytes, { name: meta.name, mimeType: meta.mimeType, kind: "image" });
+        eventLog.appendInlineImage(sessionId, { url: ref, ref: stored });
+        eventLog.flush(sessionId);
+        deps.broadcast(deps.stampSessionEvent({ type: "session.event", sessionId, event: { type: "inlineImage", url: ref, ref: stored } }));
+    }
+    /**
+     * Resolve markdown images an agent wrote as a path inside the session
+     * workspace (`![Coverage](out/coverage.png)`) — the common case, since the
+     * file the agent just produced is right there and writing the markdown costs
+     * it nothing. Bytes are copied into the content-addressed AttachmentStore now,
+     * at emit time, because the transcript outlives the workspace: an ephemeral
+     * machine is destroyed, and history still has to render on a phone weeks later.
+     *
+     * Confinement is planAttachment's, exactly as for `bivy attach` — the resolved
+     * real path must sit inside the session's working directory. That matters more
+     * here than there: this path comes from message *prose*, so a prompt injection
+     * can propose one. The grammar refuses absolute paths and traversal before we
+     * get here; planAttachment is what actually proves containment, symlinks
+     * included.
+     *
+     * Synchronous (a local read, unlike a remote fetch) and resolved once per
+     * reference per session, so re-rendering history never re-reads the disk. One
+     * consequence: if the agent overwrites a file it already referenced and
+     * references the same path again, the chat keeps showing the first version.
+     * Distinct paths are the workaround until componentRefs carry a per-message
+     * anchor the way outbound attachments already do.
+     */
+    function resolveWorkspaceImages(record, workspaceDir) {
+        if (!workspaceDir)
+            return;
+        const paths = imageRefsInTranscript(record, extractWorkspaceImagePaths);
+        if (!paths.size)
+            return;
+        const alreadyResolved = new Set(eventLog.readInlineImages(record.id).map(([ref]) => ref));
+        for (const rel of paths) {
+            if (alreadyResolved.has(rel))
+                continue;
+            const failedAt = inlineImageFailedAt.get(rel);
+            if (failedAt !== undefined && Date.now() - failedAt < INLINE_IMAGE_RETRY_COOLDOWN_MS)
+                continue;
+            const plan = planAttachment({ workspaceDir, filePath: rel, maxBytes: MAX_WORKSPACE_IMAGE_BYTES });
+            if (isAttachPlanError(plan)) {
+                console.warn(`[inline-image] ${rel}: ${plan.error}`);
+                inlineImageFailedAt.set(rel, Date.now());
+                continue;
+            }
+            // `![…](notes.md)` is a link the agent mistyped, not an image. Refusing
+            // non-image bytes keeps a stray one from becoming an unopenable chip.
+            if (plan.kind !== "image") {
+                console.warn(`[inline-image] ${rel}: not an image (${plan.mimeType})`);
+                inlineImageFailedAt.set(rel, Date.now());
+                continue;
+            }
+            try {
+                recordResolvedImage(record.id, rel, plan.bytes, { name: plan.name, mimeType: plan.mimeType });
+            }
+            catch (error) {
+                console.warn(`[inline-image] ${rel}:`, error instanceof Error ? error.message : String(error));
+                inlineImageFailedAt.set(rel, Date.now());
+            }
+        }
+    }
+    function resolveInlineImages(record) {
+        const urls = imageRefsInTranscript(record, extractInlineImageUrls);
         if (!urls.size)
             return;
         const alreadyResolved = new Set(eventLog.readInlineImages(record.id).map(([url]) => url));
@@ -119,10 +197,7 @@ export function createTranscriptPersistence(deps) {
                         inlineImageFailedAt.set(url, Date.now());
                         return;
                     }
-                    const ref = attachmentStore.put(result.bytes, { name: inlineImageDisplayName(url, result.mimeType), mimeType: result.mimeType, kind: "image" });
-                    eventLog.appendInlineImage(record.id, { url, ref });
-                    eventLog.flush(record.id);
-                    deps.broadcast(deps.stampSessionEvent({ type: "session.event", sessionId: record.id, event: { type: "inlineImage", url, ref } }));
+                    recordResolvedImage(record.id, url, result.bytes, { name: inlineImageDisplayName(url, result.mimeType), mimeType: result.mimeType });
                 }
                 catch (error) {
                     console.warn(`[inline-image] ${url}:`, error instanceof Error ? error.message : String(error));
@@ -278,6 +353,7 @@ export function createTranscriptPersistence(deps) {
         persistToolActivityFromEvent,
         persistIntermediateFromEvent,
         resolveInlineImages,
+        resolveWorkspaceImages,
         conversationMessages,
         forkMessages,
         buildHistoryEvent,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.20.9-staging.18",
+  "version": "0.20.9-staging.19",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",