@bivy/bivy 0.6.0-staging.87 → 0.6.0-staging.89

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/runtime/credential-store.js

@@ -34,6 +34,37 @@ function isStoredCredential(value) {
 function providerId(id) {
     return String(id ?? "").trim().toLowerCase();
 }
+/**
+ * Should an `incoming` credential replace the `local` one during a non-destructive
+ * `importAll` merge? Pure and exported so the convergence rule is unit-testable
+ * without a vault. Rules:
+ *  - No local entry → take the incoming one.
+ *  - Only OAuth-vs-OAuth needs freshness arbitration (an api-key set/replace, or a
+ *    type switch, keeps the existing "incoming wins on a real content change").
+ *  - A snapshot that omits the refresh token must never clobber a usable one —
+ *    rotated refresh tokens are single-use, so an incoming with a blank refresh is
+ *    strictly worse than a local one that still has it.
+ *  - Prefer the token minted LATER by `refreshedAt` (monotonic mint order) when
+ *    both carry it; otherwise fall back to the access-token `expires`. In both
+ *    cases a tie KEEPS the local credential (strictly-greater wins), so an equal
+ *    stamp can't needlessly churn/rotate the vault, and clock skew can't let an
+ *    equal-`expires` stale token win.
+ */
+export function preferIncomingCredential(local, incoming) {
+    if (!local)
+        return true;
+    if (local.type !== "oauth" || incoming.type !== "oauth")
+        return true;
+    const localRefresh = String(local.refresh ?? "").trim();
+    const incomingRefresh = String(incoming.refresh ?? "").trim();
+    if (!incomingRefresh && localRefresh)
+        return false;
+    const lt = Number(local.refreshedAt);
+    const it = Number(incoming.refreshedAt);
+    if (Number.isFinite(lt) && Number.isFinite(it))
+        return it > lt;
+    return (Number(incoming.expires) || 0) > (Number(local.expires) || 0);
+}
 /**
  * Encrypted, cross-process-locked credential vault backed by `<vaultDir>/auth.enc`.
  *
@@ -202,12 +233,10 @@ export class BivyCredentialStore {
                 if (!id || !isStoredCredential(incoming))
                     continue;
                 const local = vault[id];
-                if (incoming.type === "oauth" && local?.type === "oauth") {
-                    const localExpires = Number(local.expires) || 0;
-                    const incomingExpires = Number(incoming.expires) || 0;
-                    if (localExpires > incomingExpires)
-                        continue;
-                }
+                // Freshest-wins, rotation-safe (see preferIncomingCredential): a lagging
+                // or refresh-less snapshot must not overwrite a fresher local login.
+                if (!preferIncomingCredential(local, incoming))
+                    continue;
                 if (!(id in vault))
                     imported += 1;
                 // Only mark dirty on a real content change, so a snapshot that merely

package/dist/runtime/oauth/model-oauth.js

@@ -63,14 +63,15 @@ function tokensFrom(provider, payload, prev) {
     const rotated = typeof payload.refresh_token === "string" ? payload.refresh_token : "";
     const refresh = rotated || prev?.refresh || "";
     const expiresIn = Number(payload.expires_in) || 3600;
-    const expires = Date.now() + expiresIn * 1000 - provider.refreshSkewMs;
+    const now = Date.now();
+    const expires = now + expiresIn * 1000 - provider.refreshSkewMs;
     let accountId = prev?.accountId;
     if (provider.accountIdClaim) {
         accountId = jwtClaim(access, provider.accountIdClaim.path, provider.accountIdClaim.field) ?? accountId;
         if (!accountId)
             throw new Error(`Could not extract account id for "${provider.id}" from the OAuth token`);
     }
-    return { access, refresh, expires, ...(accountId ? { accountId } : {}) };
+    return { access, refresh, expires, refreshedAt: now, ...(accountId ? { accountId } : {}) };
 }
 // --- Authorization-code flow (browser + callback server + manual paste) ------
 function buildAuthorizeUrl(provider, opts) {
@@ -282,7 +283,7 @@ export async function loginModelOAuth(credsDir, providerId, interaction) {
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
     const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
-    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
+    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
     await createCredentialVault(credsDir).modify(providerId, async () => credential);
 }
 /** Exchange the refresh token for a fresh credential (network call; throws on failure). */
@@ -318,7 +319,7 @@ export async function refreshModelOAuth(credsDir, providerId) {
         if (Number(current.expires) > Date.now())
             return current;
         const fresh = await refreshTokens(provider, current);
-        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
+        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, refreshedAt: fresh.refreshedAt, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
     });
     return result?.type === "oauth" ? result.access : undefined;
 }

package/dist/runtime/process.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { stripAnsi } from "./ansi.js";
 import { buildAgentCredentialEnv } from "./credentials.js";
-import { egressEnv } from "../harness/egress.js";
+import { egressEnv, sessionEgressEnv } from "../harness/egress.js";
 import { depCacheEnv } from "../harness/dep-cache.js";
 import { bivySessionEnv } from "./session-env.js";
 /**
@@ -300,12 +300,14 @@ class ProcessSession {
         // src/harness/sandbox.ts). Bivy no longer wraps the process in an OS jail.
         const child = spawn(this.runtimeOptions.command, args, {
             cwd: this.cwd,
-            // egressEnv() routes this agent's outbound traffic through the harness
-            // network broker when BIVY_EGRESS_PROXY is enabled (else it's {}).
-            // bivySessionEnv() lets the agent's own shell resolve its session for
-            // `bivy attach <path>` (see session-env.ts); spread last so it can never
-            // be shadowed by an operator-configured env var of the same name.
-            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...egressEnv(), ...bivySessionEnv(this.id) },
+            // Route this agent's outbound traffic through an egress proxy: this
+            // session's OWN proxy if it has one (a per-session sandbox/workflow network
+            // policy — sessionEgressEnv), else the node-global broker when
+            // BIVY_EGRESS_PROXY is enabled (else {}). bivySessionEnv() lets the agent's
+            // own shell resolve its session for `bivy attach <path>` (see
+            // session-env.ts); spread last so it can never be shadowed by an operator-
+            // configured env var of the same name.
+            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...(sessionEgressEnv(this.id) ?? egressEnv()), ...bivySessionEnv(this.id) },
             stdio: "pipe",
             // Detached so the child becomes the leader of its own process group
             // (POSIX) — see killProcessGroup() / abort() below, which kill that whole

package/dist/server.js

@@ -53,7 +53,7 @@ import { commandLaunch } from "./command-launch.js";
 import { listMultiplexerSessions, attachCommand } from "./multiplexer.js";
 import { createWorktree, removeWorktree, branchSlug, gitRepoRoot } from "./worktree.js";
 import { HarnessManager } from "./harness/manager.js";
-import { startEgressProxyIfEnabled } from "./harness/egress.js";
+import { startEgressProxyIfEnabled, applySessionSandboxEgress, stopSessionEgress } from "./harness/egress.js";
 import { initSharedDepCache, sharedDepCacheRoot } from "./harness/dep-cache.js";
 import { evictToCap, dirSizeBytes } from "./harness/cache-evict.js";
 import { checkDiskAdmission } from "./harness/disk-admission.js";
@@ -6772,6 +6772,9 @@ function closeSessionRecord(record, reason = "closed") {
     sessionEvents.clear(record.id);
     record.session.dispose();
     harness.detach(record.id);
+    // Tear down this session's own egress proxy, if it started one (read-only /
+    // workflow network policy). No-op for the default path.
+    void stopSessionEgress(record.id);
     record.mcpRestore?.();
     openSessions.delete(record.id);
     if (record.sessionFile)
@@ -7951,6 +7954,12 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // session legitimately starts "active now".
     const resumedLastActive = requestedSessionFile ? metaLastActiveMs(storedMeta) : undefined;
     const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: opts.approvalMode, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral };
+    // Apply this session's sandbox network policy as a per-session egress proxy
+    // (its own proxy/decider, never the node-global one). Opt-in via BIVY_SANDBOX_NET:
+    // a read-only session then actually blocks outbound network even for a CLI agent
+    // whose own sandbox doesn't (opencode/aider/goose). No-op otherwise. Fire-and-
+    // forget — a slow proxy listen never delays session creation.
+    void applySessionSandboxEgress(record.id, sessionSandbox, (event) => broadcast({ type: "node.egress", event }));
     // Stage 2 slice 4: a re-attached session recovers its still-running TUI
     // terminal link (the PTY survives a detach) from the session→terminal registry.
     if (attached) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.6.0-staging.87",
+  "version": "0.6.0-staging.89",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",