@bivy/bivy 0.3.0-staging.44 → 0.3.0-staging.46

package/dist/runtime/oauth/oauth-login-sweep.js

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Pure decision for sweeping stale browser-initiated OAuth logins (see the
+// `oauthLogins` registry in src/server.ts). A login parks the node until the
+// remote device pastes its code; an abandoned one must be reaped (aborting it
+// closes the local callback http.Server) and a finished one dropped after a
+// short grace so clients can still read its final status. Kept pure + isolated
+// so the edge logic is unit-tested without importing the daemon.
+export function isTerminalOAuthStatus(status) {
+    return status === "done" || status === "error";
+}
+export function decideOAuthLoginSweep(status, ageMs, opts) {
+    const terminal = isTerminalOAuthStatus(status);
+    const expired = terminal ? ageMs > opts.graceMs : ageMs > opts.ttlMs;
+    if (!expired)
+        return { drop: false, abort: false };
+    return { drop: true, abort: !terminal };
+}

package/dist/server.js

@@ -27,6 +27,7 @@ import { provisionAgentRun } from "./runtime/credential-provisioning.js";
 import { ingestAgentCredentials } from "./runtime/credential-ingest.js";
 import { suggestNameFromSelectedModel } from "./runtime/model-namer.js";
 import { isNativeOAuthProvider, loginModelOAuth } from "./runtime/oauth/model-oauth.js";
+import { decideOAuthLoginSweep } from "./runtime/oauth/oauth-login-sweep.js";
 import { listCodexSessions, loadCodexTranscript, discoverCodexSessionForCwd } from "./runtime/codex-sessions.js";
 import { dedupeSessionSummaries } from "./session-identity.js";
 import { discoverPiSessionForCwd } from "./runtime/pi-session-discovery.js";
@@ -755,6 +756,40 @@ let relay;
 const clients = new Set();
 const commandProcesses = new Map();
 const oauthLogins = new Map();
+// A browser-initiated subscription login parks the node on `manualCodePromise`
+// until the remote device pastes the code (`provider.oauth.code`). If the user
+// abandons it, the entry — AND its local callback http.Server — would otherwise
+// linger until the process exits. That matters especially on a short-lived
+// ephemeral node. Sweep periodically: abort (which closes the callback server,
+// see startCallbackServer) + drop any in-flight login past its TTL, and drop a
+// finished one after a short grace so clients can still read the final status.
+const OAUTH_LOGIN_TTL_MS = 10 * 60_000;
+const OAUTH_LOGIN_DONE_GRACE_MS = 2 * 60_000;
+function sweepOauthLogins(now = Date.now()) {
+    for (const [id, login] of oauthLogins.entries()) {
+        const { drop, abort } = decideOAuthLoginSweep(login.status, now - login.createdAt, {
+            ttlMs: OAUTH_LOGIN_TTL_MS,
+            graceMs: OAUTH_LOGIN_DONE_GRACE_MS,
+        });
+        if (!drop)
+            continue;
+        if (abort) {
+            login.cancelled = true;
+            try {
+                login.abort.abort();
+            }
+            catch { /* already settled */ }
+        }
+        oauthLogins.delete(id);
+    }
+}
+let oauthLoginSweepTimer;
+function startOAuthLoginSweeper() {
+    if (oauthLoginSweepTimer)
+        return;
+    oauthLoginSweepTimer = setInterval(() => sweepOauthLogins(), 60_000);
+    oauthLoginSweepTimer.unref?.();
+}
 const openSessions = new Map();
 // Stage 2 (docs/agent-node-decoupling.md): sessionId -> agent-service address for
 // live REMOTE sessions the agent service keeps running across an eviction/
@@ -3600,6 +3635,14 @@ async function syncModelAuthFromControlPlane() {
             vaultKeyB64 = pairingStore.unwrapFromNodePublicKey(data.wrappedKey.wrappedByPublicKey, data.wrappedKey.wrappedKey);
             writeLocalModelAuthVaultKey(vaultKeyB64);
         }
+        // Node-less inheritance: a lone HOSTED ephemeral (no peer to wrap the key)
+        // adopts the vault key the control plane escrowed for this hosted account, so
+        // it can decrypt the synced vault (incl. subscription OAuth) on cold start. The
+        // control plane serves `hostedKey` only for hosted-provisioning accounts.
+        if (!vaultKeyB64 && data.hostedKey && Buffer.from(data.hostedKey, "base64").length === 32) {
+            vaultKeyB64 = data.hostedKey;
+            writeLocalModelAuthVaultKey(vaultKeyB64);
+        }
         if (data.vault?.ciphertext && vaultKeyB64) {
             const { providers, localModels } = decryptModelAuthEnvelope(data.vault.ciphertext, vaultKeyB64);
             await importProviderAuth(credsDir, providers);
@@ -3666,6 +3709,13 @@ async function pushModelAuthToControlPlane() {
             method: "PUT",
             body: JSON.stringify({ targetNodeId: identity.nodeId, wrappedByPublicKey: pairingStore.nodePublicKeyB64(), wrappedKey: pairingStore.wrapForNodePublicKey(pairingStore.nodePublicKeyB64(), vaultKeyB64) }),
         });
+        // Node-less inheritance: a HOSTED node also escrows the vault key to the control
+        // plane (sealed at rest, hosted-only) so the account's NEXT hosted ephemeral —
+        // possibly the only node — can decrypt this vault without a peer to wrap the key.
+        // Gated to hosted nodes; the CP double-checks the account is hosted. Best effort.
+        if (process.env.BIVY_GITHUB_HOSTED_TASKS) {
+            await modelAuthFetch("/node/model-auth-key/hosted-escrow", { method: "PUT", body: JSON.stringify({ vaultKeyB64 }) }).catch(() => { });
+        }
         lastPushedModelAuthCiphertext = ciphertext;
     }
     catch (error) {
@@ -5125,6 +5175,9 @@ async function startOAuthLogin(provider) {
     // OpenAI's browser flow redirects to http://localhost:1455. Listen on IPv6
     // wildcard so browsers resolving localhost to ::1 can reach the callback.
     process.env.PI_OAUTH_CALLBACK_HOST ||= "::";
+    // Opportunistically drop stale/abandoned logins whenever a new one starts, so a
+    // long-lived node doesn't accumulate them between sweeps (and tests can drive it).
+    sweepOauthLogins();
     const id = randomUUID();
     const abort = new AbortController();
     const state = { id, provider, status: "starting", abort, createdAt: Date.now(), progress: [] };
@@ -9672,6 +9725,7 @@ const server = app.listen(port, host, async () => {
     if (process.env.BIVY_RESTORE)
         void restoreSessionFromSnapshot(String(process.env.BIVY_RESTORE));
     startModelAuthWatcher();
+    startOAuthLoginSweeper();
     startGithubAppSyncWatcher();
     await startGitHubTasksIfConfigured();
     startControlPlaneTasksIfConfigured();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.3.0-staging.44",
+  "version": "0.3.0-staging.46",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",