@bivy/bivy 0.6.0-staging.86 → 0.6.0-staging.88

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/runtime/process.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { stripAnsi } from "./ansi.js";
 import { buildAgentCredentialEnv } from "./credentials.js";
-import { egressEnv } from "../harness/egress.js";
+import { egressEnv, sessionEgressEnv } from "../harness/egress.js";
 import { depCacheEnv } from "../harness/dep-cache.js";
 import { bivySessionEnv } from "./session-env.js";
 /**
@@ -300,12 +300,14 @@ class ProcessSession {
         // src/harness/sandbox.ts). Bivy no longer wraps the process in an OS jail.
         const child = spawn(this.runtimeOptions.command, args, {
             cwd: this.cwd,
-            // egressEnv() routes this agent's outbound traffic through the harness
-            // network broker when BIVY_EGRESS_PROXY is enabled (else it's {}).
-            // bivySessionEnv() lets the agent's own shell resolve its session for
-            // `bivy attach <path>` (see session-env.ts); spread last so it can never
-            // be shadowed by an operator-configured env var of the same name.
-            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...egressEnv(), ...bivySessionEnv(this.id) },
+            // Route this agent's outbound traffic through an egress proxy: this
+            // session's OWN proxy if it has one (a per-session sandbox/workflow network
+            // policy — sessionEgressEnv), else the node-global broker when
+            // BIVY_EGRESS_PROXY is enabled (else {}). bivySessionEnv() lets the agent's
+            // own shell resolve its session for `bivy attach <path>` (see
+            // session-env.ts); spread last so it can never be shadowed by an operator-
+            // configured env var of the same name.
+            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...(sessionEgressEnv(this.id) ?? egressEnv()), ...bivySessionEnv(this.id) },
             stdio: "pipe",
             // Detached so the child becomes the leader of its own process group
             // (POSIX) — see killProcessGroup() / abort() below, which kill that whole

package/dist/server.js

@@ -53,7 +53,7 @@ import { commandLaunch } from "./command-launch.js";
 import { listMultiplexerSessions, attachCommand } from "./multiplexer.js";
 import { createWorktree, removeWorktree, branchSlug, gitRepoRoot } from "./worktree.js";
 import { HarnessManager } from "./harness/manager.js";
-import { startEgressProxyIfEnabled } from "./harness/egress.js";
+import { startEgressProxyIfEnabled, applySessionSandboxEgress, stopSessionEgress } from "./harness/egress.js";
 import { initSharedDepCache, sharedDepCacheRoot } from "./harness/dep-cache.js";
 import { evictToCap, dirSizeBytes } from "./harness/cache-evict.js";
 import { checkDiskAdmission } from "./harness/disk-admission.js";
@@ -5225,6 +5225,47 @@ async function resolveTokenForRepo(owner, repo) {
     }
     return (await resolveGitHubToken()) ?? (await hostedMintToken());
 }
+/** The session source a Linear-issue pickup advertises, keyed by the issue's
+ *  provider-native id so the control plane can correlate a re-dispatch to it
+ *  (findSessionByExternalId → "linear:<externalId>"). The Linear analogue of the
+ *  GitHub `issue:owner/repo#N` source. */
+function linearSessionSource(externalId) {
+    return `linear:${externalId}`;
+}
+/**
+ * Case B for a queued follow-up the control plane correlated to an existing
+ * session (`targetKind === "existing_session"`): if that session is still live on
+ * this node, continue it as a normal chat — run `prompt` as a follow-up turn and
+ * re-publish its branch/PR — so a channel reply lands in the same thread. The
+ * provider-agnostic analogue of the GitHub issue follow-up (`runIssueFollowUp`);
+ * used by both the Linear and the generic (Slack) pickup paths. When the session
+ * isn't live here (its machine was torn down), best-effort restore its snapshot so
+ * the caller's fresh pickup continues its branch/transcript instead of cold-
+ * starting, and return false so the caller falls through. Returns true only when
+ * it fully handled the item.
+ */
+async function continueCorrelatedSession(item, prompt, report) {
+    if (item.targetKind !== "existing_session" || !item.targetSessionId)
+        return false;
+    const record = openSessions.get(item.targetSessionId);
+    if (!record) {
+        await restoreSessionFromSnapshot(item.targetSessionId).catch((e) => console.warn(`[case-b] snapshot restore for ${item.targetSessionId} failed:`, e.message));
+        return false;
+    }
+    const branch = record.worktree?.branch;
+    await runSessionTurn(record, prompt);
+    if (record.worktree) {
+        await maybePushWorktreeBranch(record);
+        await maybeDetectPullRequest(record);
+    }
+    await report({
+        output: { sessionId: record.id, branch, prUrl: record.prUrl },
+        events: record.prUrl
+            ? [{ at: new Date().toISOString(), kind: "pull_request", summary: "Pull request updated.", ref: branch, url: record.prUrl }]
+            : undefined,
+    });
+    return true;
+}
 async function runWorkItem(item, report) {
     if ((item.source === "schedule" || item.source === "manual") && item.body?.startsWith("bivy-room-v1:")) {
         const [, nodeId, ...payload] = item.body.split(":");
@@ -5303,6 +5344,10 @@ async function runWorkItem(item, report) {
         const parsed = parseRepo(repoSlug);
         if (!parsed)
             throw new Error(`Linear work item has an invalid repo "${repoSlug}"`);
+        // Case B: a re-dispatch the control plane correlated to an existing session
+        // continues it as a normal chat instead of starting cold (mirrors GitHub).
+        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue), report))
+            return;
         const githubToken = await resolveGitHubToken();
         if (!githubToken)
             throw new Error("no GitHub token available to clone the Linear issue repository");
@@ -5313,7 +5358,7 @@ async function runWorkItem(item, report) {
         const record = await createSession(repoDir, undefined, {
             worktree: { branch, base },
             makeActive: false,
-            source: "queue:linear:issue",
+            source: linearSessionSource(item.externalId),
             runtimeId: item.runtimeId || nodeConfiguredDefaultAgent(),
             sandbox: normalizeSandboxTier(item.sandbox),
             approvalMode: approvalModeFrom(item.approvalMode),
@@ -5339,6 +5384,13 @@ async function runWorkItem(item, report) {
     const parsedRepo = item.repo ? parseRepo(item.repo) : undefined;
     if (item.repo && !parsedRepo)
         throw new Error(`work item ${item.id} has an invalid repo "${item.repo}"`);
+    const request = item.body ? `${item.title}\n\n${item.body}` : item.title;
+    // Case B (provider-agnostic): a follow-up the control plane correlated to an
+    // existing session continues it as a normal chat. Reached by Slack the moment a
+    // reply carries a thread identity the control plane can correlate; a one-shot
+    // slash command has none, so it simply falls through to a fresh session.
+    if (await continueCorrelatedSession(item, request, report))
+        return;
     const sessionOpts = {
         makeActive: false,
         title: item.title,
@@ -5359,7 +5411,6 @@ async function runWorkItem(item, report) {
         }
         catch { }
     }
-    const request = item.body ? `${item.title}\n\n${item.body}` : item.title;
     const prompt = parsedRepo || record.worktree
         ? [
             request,
@@ -6721,6 +6772,9 @@ function closeSessionRecord(record, reason = "closed") {
     sessionEvents.clear(record.id);
     record.session.dispose();
     harness.detach(record.id);
+    // Tear down this session's own egress proxy, if it started one (read-only /
+    // workflow network policy). No-op for the default path.
+    void stopSessionEgress(record.id);
     record.mcpRestore?.();
     openSessions.delete(record.id);
     if (record.sessionFile)
@@ -7900,6 +7954,12 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // session legitimately starts "active now".
     const resumedLastActive = requestedSessionFile ? metaLastActiveMs(storedMeta) : undefined;
     const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: opts.approvalMode, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral };
+    // Apply this session's sandbox network policy as a per-session egress proxy
+    // (its own proxy/decider, never the node-global one). Opt-in via BIVY_SANDBOX_NET:
+    // a read-only session then actually blocks outbound network even for a CLI agent
+    // whose own sandbox doesn't (opencode/aider/goose). No-op otherwise. Fire-and-
+    // forget — a slow proxy listen never delays session creation.
+    void applySessionSandboxEgress(record.id, sessionSandbox, (event) => broadcast({ type: "node.egress", event }));
     // Stage 2 slice 4: a re-attached session recovers its still-running TUI
     // terminal link (the PTY survives a detach) from the session→terminal registry.
     if (attached) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.6.0-staging.86",
+  "version": "0.6.0-staging.88",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",