@bivy/bivy 0.3.0-staging.45 → 0.3.0-staging.47

package/dist/repo-workspace.js

@@ -29,15 +29,60 @@ export function parseGitHubRemote(input) {
         return parseRepo(`${ssh[1]}/${ssh[2]}`);
     return undefined;
 }
-/** Infer owner/repo from a workspace's origin remote, if it is a GitHub checkout. */
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * A git failure that DEFINITIVELY means "this workspace is not a GitHub-connected
+ * checkout" — a genuine `undefined` answer — as opposed to a transient failure we
+ * must not mistake for one. `git remote get-url origin` reports "not a git
+ * repository" (no repo) or "No such remote" (a repo with no origin); both are
+ * real, stable answers. Anything else (notably `index.lock`/`config.lock`
+ * contention when many sessions touch the same shared clone at once) is transient.
+ */
+function isDefinitiveNonGitHubError(error) {
+    const e = error;
+    const text = `${e?.stderr ?? ""} ${e?.message ?? String(error)}`;
+    return /not a git repository|No such remote|does not appear to be a git repository/i.test(text);
+}
+/**
+ * Infer owner/repo from a workspace's origin remote, if it is a GitHub checkout.
+ *
+ * Retries transient git failures before giving up. Misclassifying a momentarily
+ * busy GitHub checkout as "not a repo" is what let a session skip worktree
+ * isolation and run directly in the shared clone root, where its `git
+ * checkout`/`git stash` collided with a concurrent session (the "sessions
+ * mixing" bug). So: a DEFINITIVE non-GitHub result (not a repo / no origin)
+ * resolves to `undefined` as before, but a transient error is retried and then
+ * THROWN — the caller must fail loudly rather than silently degrade to running
+ * the agent in the shared root.
+ */
 export async function inferGitHubRepoFromWorkspace(workspace) {
-    try {
-        const { stdout } = await exec("git", ["-C", workspace, "remote", "get-url", "origin"], { cwd: workspace });
-        return parseGitHubRemote(stdout);
-    }
-    catch {
-        return undefined;
+    let lastError;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            const { stdout } = await exec("git", ["-C", workspace, "remote", "get-url", "origin"], { cwd: workspace });
+            return parseGitHubRemote(stdout);
+        }
+        catch (error) {
+            if (isDefinitiveNonGitHubError(error))
+                return undefined;
+            lastError = error;
+            if (attempt < 2)
+                await delay(50 * (attempt + 1));
+        }
     }
+    throw new Error(`Could not determine the GitHub repo for ${workspace} (the checkout may be busy): ` +
+        `${lastError?.message ?? String(lastError)}`);
+}
+/**
+ * True when `dir` is a Bivy-managed shared clone root — a direct child of the
+ * repos root, i.e. `<reposRoot>/owner__repo` (see `cloneOrUpdateRepo`). Every
+ * session for a repo shares that one checkout, so an agent must NEVER run
+ * directly in it; it runs in a per-session worktree instead. Worktree paths live
+ * DEEPER (`<clone>/.bivy/worktrees/<slug>`) and are intentionally not matched, so
+ * this cleanly distinguishes "the shared root" from "an isolated worktree".
+ */
+export function isSharedCloneRoot(dir, reposRoot) {
+    return path.resolve(path.dirname(path.resolve(dir))) === path.resolve(reposRoot);
 }
 /** A GitHub token from env or the local `gh` login, or undefined (public only). */
 export async function resolveGitHubToken(env = process.env) {

package/dist/runtime/oauth/oauth-login-sweep.js

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Pure decision for sweeping stale browser-initiated OAuth logins (see the
+// `oauthLogins` registry in src/server.ts). A login parks the node until the
+// remote device pastes its code; an abandoned one must be reaped (aborting it
+// closes the local callback http.Server) and a finished one dropped after a
+// short grace so clients can still read its final status. Kept pure + isolated
+// so the edge logic is unit-tested without importing the daemon.
+export function isTerminalOAuthStatus(status) {
+    return status === "done" || status === "error";
+}
+export function decideOAuthLoginSweep(status, ageMs, opts) {
+    const terminal = isTerminalOAuthStatus(status);
+    const expired = terminal ? ageMs > opts.graceMs : ageMs > opts.ttlMs;
+    if (!expired)
+        return { drop: false, abort: false };
+    return { drop: true, abort: !terminal };
+}

package/dist/server.js

@@ -27,6 +27,7 @@ import { provisionAgentRun } from "./runtime/credential-provisioning.js";
 import { ingestAgentCredentials } from "./runtime/credential-ingest.js";
 import { suggestNameFromSelectedModel } from "./runtime/model-namer.js";
 import { isNativeOAuthProvider, loginModelOAuth } from "./runtime/oauth/model-oauth.js";
+import { decideOAuthLoginSweep } from "./runtime/oauth/oauth-login-sweep.js";
 import { listCodexSessions, loadCodexTranscript, discoverCodexSessionForCwd } from "./runtime/codex-sessions.js";
 import { dedupeSessionSummaries } from "./session-identity.js";
 import { discoverPiSessionForCwd } from "./runtime/pi-session-discovery.js";
@@ -46,7 +47,7 @@ import { createCheckpointBundle, applyCheckpointBundle, materializeCheckpoint }
 import { PolicyEngine } from "./policy/policy-engine.js";
 import { TerminalManager } from "./terminal.js";
 import { listMultiplexerSessions, attachCommand } from "./multiplexer.js";
-import { createWorktree, removeWorktree, branchSlug } from "./worktree.js";
+import { createWorktree, removeWorktree, branchSlug, gitRepoRoot } from "./worktree.js";
 import { HarnessManager } from "./harness/manager.js";
 import { startEgressProxyIfEnabled } from "./harness/egress.js";
 import { initSharedDepCache, sharedDepCacheRoot } from "./harness/dep-cache.js";
@@ -54,7 +55,7 @@ import { evictToCap, dirSizeBytes } from "./harness/cache-evict.js";
 import { checkDiskAdmission } from "./harness/disk-admission.js";
 import { sandboxTier, setConfiguredSandboxTier, normalizeSandboxTier } from "./harness/sandbox.js";
 import { injectMcpProxyForSession } from "./harness/mcp-inject.js";
-import { parseRepo, inferGitHubRepoFromWorkspace, resolveGitHubToken, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, fetchOrigin } from "./repo-workspace.js";
+import { parseRepo, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, fetchOrigin } from "./repo-workspace.js";
 import { configureGitAuth, writeGitCredentialEndpoint } from "./git-auth.js";
 import { GitHubTaskPoller, resolveGitHubTaskConfig, buildTaskPrompt, buildResumePrompt, buildInteractiveResumePrompt, DEFAULT_ISSUE_INSTRUCTIONS, parseBivyDirectives, commitAll, pushBranch, mergeBaseIntoBranch, completeMerge, abortMerge, findOpenPullRequestForBranch, findPullRequestsForBranch, findMergedPullRequestForBranch, issueBranchName, getPullRequest, commentIssue, listOpenLabelledIssues, selectActionableIssues, getIssue, getIssueCommentBody, addLabel, removeLabel, announcePickup, } from "./github-tasks.js";
 import { buildLinearTaskPrompt, getLinearIssue, linearBranchName } from "./linear-tasks.js";
@@ -755,6 +756,40 @@ let relay;
 const clients = new Set();
 const commandProcesses = new Map();
 const oauthLogins = new Map();
+// A browser-initiated subscription login parks the node on `manualCodePromise`
+// until the remote device pastes the code (`provider.oauth.code`). If the user
+// abandons it, the entry — AND its local callback http.Server — would otherwise
+// linger until the process exits. That matters especially on a short-lived
+// ephemeral node. Sweep periodically: abort (which closes the callback server,
+// see startCallbackServer) + drop any in-flight login past its TTL, and drop a
+// finished one after a short grace so clients can still read the final status.
+const OAUTH_LOGIN_TTL_MS = 10 * 60_000;
+const OAUTH_LOGIN_DONE_GRACE_MS = 2 * 60_000;
+function sweepOauthLogins(now = Date.now()) {
+    for (const [id, login] of oauthLogins.entries()) {
+        const { drop, abort } = decideOAuthLoginSweep(login.status, now - login.createdAt, {
+            ttlMs: OAUTH_LOGIN_TTL_MS,
+            graceMs: OAUTH_LOGIN_DONE_GRACE_MS,
+        });
+        if (!drop)
+            continue;
+        if (abort) {
+            login.cancelled = true;
+            try {
+                login.abort.abort();
+            }
+            catch { /* already settled */ }
+        }
+        oauthLogins.delete(id);
+    }
+}
+let oauthLoginSweepTimer;
+function startOAuthLoginSweeper() {
+    if (oauthLoginSweepTimer)
+        return;
+    oauthLoginSweepTimer = setInterval(() => sweepOauthLogins(), 60_000);
+    oauthLoginSweepTimer.unref?.();
+}
 const openSessions = new Map();
 // Stage 2 (docs/agent-node-decoupling.md): sessionId -> agent-service address for
 // live REMOTE sessions the agent service keeps running across an eviction/
@@ -5140,6 +5175,9 @@ async function startOAuthLogin(provider) {
     // OpenAI's browser flow redirects to http://localhost:1455. Listen on IPv6
     // wildcard so browsers resolving localhost to ::1 can reach the callback.
     process.env.PI_OAUTH_CALLBACK_HOST ||= "::";
+    // Opportunistically drop stale/abandoned logins whenever a new one starts, so a
+    // long-lived node doesn't accumulate them between sweeps (and tests can drive it).
+    sweepOauthLogins();
     const id = randomUUID();
     const abort = new AbortController();
     const state = { id, provider, status: "starting", abort, createdAt: Date.now(), progress: [] };
@@ -5487,6 +5525,22 @@ async function standUpFork(opts) {
         cwd = wt.path;
         worktree = wt;
     }
+    else {
+        // Non-repo-backed source. The fork would otherwise reuse the PARENT's cwd,
+        // putting two sessions in one working tree — so when that cwd is itself a git
+        // checkout (a local repo without a GitHub origin), cut the fork its own
+        // worktree on a fresh branch. Best-effort: a non-git workspace has no tree to
+        // isolate, so the fork keeps the fallback cwd (no git collisions possible).
+        const forkRepoRoot = await gitRepoRoot(cwd);
+        if (forkRepoRoot) {
+            const forkBranch = `bivy/fork-${randomBytes(6).toString("hex")}`;
+            const wt = await createWorktree({ repoDir: forkRepoRoot, id: forkBranch, branch: forkBranch });
+            applyDirtyPatch(wt.path, bundle.dirtyPatch);
+            workspace = forkRepoRoot;
+            cwd = wt.path;
+            worktree = wt;
+        }
+    }
     // Materialise the transcript, then stand the session up — resume the imported
     // transcript (full) or a fresh session the caller seeds with plan.seedPrompt.
     const plan = await materializeFork({ bundle, targetRuntime, ctx: { workspace, cwd }, seed: { transcriptUrl: opts.transcriptUrl } });
@@ -7126,9 +7180,52 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
         if (!admission.allowed)
             throw new Error(`Not enough disk to start a new worktree session: ${admission.reason}`);
         const wtOpts = typeof opts.worktree === "object" ? opts.worktree : {};
-        worktree = await createWorktree({ repoDir: workspace, id: wtOpts.branch ?? `session-${Date.now()}`, branch: wtOpts.branch, base: wtOpts.base });
+        // A random suffix, never a timestamp: two sessions started in the same
+        // millisecond would otherwise resolve to the same slug → same worktree path
+        // and branch, and `createWorktree` would ADOPT the first's worktree, dropping
+        // the second session into a directory another session already owns.
+        worktree = await createWorktree({ repoDir: workspace, id: wtOpts.branch ?? `session-${randomBytes(6).toString("hex")}`, branch: wtOpts.branch, base: wtOpts.base });
         runtimeWorkspace = worktree.path;
     }
+    // Resume with a reaped worktree. When a repo-backed session is resumed but its
+    // worktree directory was removed while it was closed (disk cleanup, a manual
+    // rm, `git worktree remove`), restoredWorktree is undefined and we'd otherwise
+    // fall back to the shared clone root — which the invariant below then rejects.
+    // Re-provision a fresh worktree on the SAME branch instead (branches survive
+    // `git worktree remove`, so the agent's committed history is intact), restoring
+    // isolation so the resumed session is usable again. Best-effort: if the clone
+    // or branch is gone, we leave it to the invariant to fail safe rather than
+    // corrupt a neighbour. The clone root is reconstructed from `source`
+    // (`repo:owner/repo`) because stored `workspace` is the old worktree path.
+    if (requestedSessionFile && !worktree && storedMeta?.worktree && storedMeta?.branch) {
+        const parsedSource = parseRepoSource(storedMeta.source);
+        if (parsedSource) {
+            const repoDir = path.join(reposRoot, `${parsedSource.owner}__${parsedSource.repo}`);
+            try {
+                // Clear any stale registration left by a dir that was rm'd out from under
+                // git, so re-adding the branch's worktree doesn't hit "already checked out".
+                runGit(["worktree", "prune"], repoDir);
+                const reprovisioned = await createWorktree({ repoDir, id: storedMeta.branch, branch: storedMeta.branch });
+                worktree = reprovisioned;
+                runtimeWorkspace = reprovisioned.path;
+            }
+            catch (error) {
+                console.warn(`Could not re-provision worktree for resumed session on ${storedMeta.branch}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    // Isolation invariant. A session must NEVER run directly in a Bivy-managed
+    // shared clone root (`<reposRoot>/owner__repo`): every session for that repo
+    // shares that one checkout, so an agent running there collides with concurrent
+    // sessions on `git checkout`/`git stash` — exactly the "sessions mixing" bug.
+    // A GitHub-backed session is supposed to get its own worktree; reaching here
+    // without one means an earlier step degraded (e.g. a transient repo-inference
+    // failure, or a resume whose worktree was reaped). Fail loudly instead of
+    // silently sharing the tree and corrupting a neighbouring session's work.
+    if (!worktree && isSharedCloneRoot(runtimeWorkspace, reposRoot)) {
+        throw new Error(`Refusing to start a session in the shared clone root ${runtimeWorkspace} without an isolated worktree — ` +
+            `this would collide with concurrent sessions on the same repo. Retry; if it persists the checkout may be busy.`);
+    }
     const runtimeSessionOptions = { workspace: runtimeWorkspace, toolProvider: integrations.toolProvider(), ...(rt.capabilities.toolInterception ? { toolInterceptor: guardianInterceptor } : {}) };
     // Stage 2/3: prefer re-attaching to a still-live remote session — routed to its
     // OWN agent service — over re-opening a fresh copy from disk. Falls back to
@@ -7156,8 +7253,12 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     if (requestedSessionFile && storedMeta?.name && !session.getName())
         session.setName(storedMeta.name);
     const sessionWorkspace = session.cwd || runtimeWorkspace;
-    const inferredRepo = opts.source || storedMeta?.source ? undefined : await inferGitHubRepoFromWorkspace(sessionWorkspace);
-    if (!worktree && requestedSessionFile && inferredRepo) {
+    // Best-effort here (unlike createWorkspaceSession, which must fail loudly):
+    // this only decides whether to ADOPT an already-checked-out branch as the
+    // session's worktree label, so a transient inference failure should quietly
+    // skip adoption rather than break resuming the session.
+    const inferredRepo = opts.source || storedMeta?.source ? undefined : await inferGitHubRepoFromWorkspace(sessionWorkspace).catch(() => undefined);
+    if (!worktree && requestedSessionFile && inferredRepo && !isSharedCloneRoot(sessionWorkspace, reposRoot)) {
         const branch = runGit(["branch", "--show-current"], sessionWorkspace) || runGit(["rev-parse", "--short", "HEAD"], sessionWorkspace) || undefined;
         if (branch) {
             const mainWorktree = runGit(["worktree", "list", "--porcelain"], sessionWorkspace)?.split("\n").find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
@@ -9687,6 +9788,7 @@ const server = app.listen(port, host, async () => {
     if (process.env.BIVY_RESTORE)
         void restoreSessionFromSnapshot(String(process.env.BIVY_RESTORE));
     startModelAuthWatcher();
+    startOAuthLoginSweeper();
     startGithubAppSyncWatcher();
     await startGitHubTasksIfConfigured();
     startControlPlaneTasksIfConfigured();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.3.0-staging.45",
+  "version": "0.3.0-staging.47",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",