@bivy/bivy 0.6.0-staging.88 → 0.6.0-staging.89

package/dist/runtime/credential-store.js

@@ -34,6 +34,37 @@ function isStoredCredential(value) {
 function providerId(id) {
     return String(id ?? "").trim().toLowerCase();
 }
+/**
+ * Should an `incoming` credential replace the `local` one during a non-destructive
+ * `importAll` merge? Pure and exported so the convergence rule is unit-testable
+ * without a vault. Rules:
+ *  - No local entry → take the incoming one.
+ *  - Only OAuth-vs-OAuth needs freshness arbitration (an api-key set/replace, or a
+ *    type switch, keeps the existing "incoming wins on a real content change").
+ *  - A snapshot that omits the refresh token must never clobber a usable one —
+ *    rotated refresh tokens are single-use, so an incoming with a blank refresh is
+ *    strictly worse than a local one that still has it.
+ *  - Prefer the token minted LATER by `refreshedAt` (monotonic mint order) when
+ *    both carry it; otherwise fall back to the access-token `expires`. In both
+ *    cases a tie KEEPS the local credential (strictly-greater wins), so an equal
+ *    stamp can't needlessly churn/rotate the vault, and clock skew can't let an
+ *    equal-`expires` stale token win.
+ */
+export function preferIncomingCredential(local, incoming) {
+    if (!local)
+        return true;
+    if (local.type !== "oauth" || incoming.type !== "oauth")
+        return true;
+    const localRefresh = String(local.refresh ?? "").trim();
+    const incomingRefresh = String(incoming.refresh ?? "").trim();
+    if (!incomingRefresh && localRefresh)
+        return false;
+    const lt = Number(local.refreshedAt);
+    const it = Number(incoming.refreshedAt);
+    if (Number.isFinite(lt) && Number.isFinite(it))
+        return it > lt;
+    return (Number(incoming.expires) || 0) > (Number(local.expires) || 0);
+}
 /**
  * Encrypted, cross-process-locked credential vault backed by `<vaultDir>/auth.enc`.
  *
@@ -202,12 +233,10 @@ export class BivyCredentialStore {
                 if (!id || !isStoredCredential(incoming))
                     continue;
                 const local = vault[id];
-                if (incoming.type === "oauth" && local?.type === "oauth") {
-                    const localExpires = Number(local.expires) || 0;
-                    const incomingExpires = Number(incoming.expires) || 0;
-                    if (localExpires > incomingExpires)
-                        continue;
-                }
+                // Freshest-wins, rotation-safe (see preferIncomingCredential): a lagging
+                // or refresh-less snapshot must not overwrite a fresher local login.
+                if (!preferIncomingCredential(local, incoming))
+                    continue;
                 if (!(id in vault))
                     imported += 1;
                 // Only mark dirty on a real content change, so a snapshot that merely

package/dist/runtime/oauth/model-oauth.js

@@ -63,14 +63,15 @@ function tokensFrom(provider, payload, prev) {
     const rotated = typeof payload.refresh_token === "string" ? payload.refresh_token : "";
     const refresh = rotated || prev?.refresh || "";
     const expiresIn = Number(payload.expires_in) || 3600;
-    const expires = Date.now() + expiresIn * 1000 - provider.refreshSkewMs;
+    const now = Date.now();
+    const expires = now + expiresIn * 1000 - provider.refreshSkewMs;
     let accountId = prev?.accountId;
     if (provider.accountIdClaim) {
         accountId = jwtClaim(access, provider.accountIdClaim.path, provider.accountIdClaim.field) ?? accountId;
         if (!accountId)
             throw new Error(`Could not extract account id for "${provider.id}" from the OAuth token`);
     }
-    return { access, refresh, expires, ...(accountId ? { accountId } : {}) };
+    return { access, refresh, expires, refreshedAt: now, ...(accountId ? { accountId } : {}) };
 }
 // --- Authorization-code flow (browser + callback server + manual paste) ------
 function buildAuthorizeUrl(provider, opts) {
@@ -282,7 +283,7 @@ export async function loginModelOAuth(credsDir, providerId, interaction) {
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
     const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
-    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
+    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
     await createCredentialVault(credsDir).modify(providerId, async () => credential);
 }
 /** Exchange the refresh token for a fresh credential (network call; throws on failure). */
@@ -318,7 +319,7 @@ export async function refreshModelOAuth(credsDir, providerId) {
         if (Number(current.expires) > Date.now())
             return current;
         const fresh = await refreshTokens(provider, current);
-        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
+        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, refreshedAt: fresh.refreshedAt, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
     });
     return result?.type === "oauth" ? result.access : undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.6.0-staging.88",
+  "version": "0.6.0-staging.89",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",