@bivy/bivy 0.6.0 → 0.7.0

package/README.md

@@ -199,24 +199,33 @@ Every environment variable, config file, and precedence rule:
 ## Approvals and sandboxing
 
 The default approval mode is **`autonomous`**: agents act without per-action
-prompts. Safety comes from a floor that applies in *every* mode — catastrophic
-commands and writes outside the workspace are refused outright, and a backstop
-set (force-push, publish, deploy, sudo) always pauses for a human.
+prompts. The actual protection depends on the selected runtime. Native-sandbox
+agents enforce the chosen access tier; structured runtimes also pass tool calls
+through Bivy's policy and approval layer. Process agents that Bivy cannot
+intercept run with your OS user permissions. The picker shows this distinction
+and requires confirmation before selecting that limited path.
+
+Where Bivy receives structured shell/file calls, a heuristic floor blocks known
+catastrophic commands and structured writes outside the workspace, and a
+backstop set (force-push, publish, deploy, sudo) pauses for a human. This catches
+accidents; it is not an adversarial isolation boundary.
 
 If you want to be asked about more, set the mode explicitly:
 
 ```bash
 BIVY_APPROVAL_MODE=risky    # prompt on risky shell commands and file edits
 BIVY_APPROVAL_MODE=always   # prompt on all shell commands and file edits
-BIVY_APPROVAL_MODE=never    # no prompts beyond the hard floor
+BIVY_APPROVAL_MODE=never    # no prompts; structured-tool heuristic blocks still apply where available
 ```
 
 Approve from the terminal, browser, or phone.
 
 Sandbox tiers (`read-only`, `workspace-write`, `danger-full-access`) are enforced
 natively by agents that support them — Codex, Claude Code, Gemini CLI, Qwen Code.
-Agents without a native sandbox are governed at the filesystem, MCP, and network
-layer. **Bivy does not ship its own OS-level jail in 0.1.**
+Agents without a native sandbox may expose structured tool or MCP controls, but
+those controls do not cover activity the agent performs outside those channels;
+some process adapters run entirely with your user permissions. Check the
+picker's Protection label. **Bivy does not currently ship its own OS-level jail.**
 
 ## Credentials
 

package/bin/agent-manifest.json

@@ -5,6 +5,8 @@
       "label": "Codex",
       "command": "codex",
       "hidden": true,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "exec"
       ],
@@ -18,6 +20,8 @@
       "label": "OpenCode",
       "command": "opencode",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "-s"
@@ -32,6 +36,8 @@
       "label": "Aider",
       "command": "aider",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--yes-always",
         "--message"
@@ -46,6 +52,8 @@
       "label": "Hermes",
       "command": "hermes",
       "hidden": true,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [],
       "install": {
         "kind": "npm",
@@ -57,6 +65,8 @@
       "label": "Goose",
       "command": "goose",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "-t",
@@ -76,6 +86,8 @@
       "label": "Gemini CLI",
       "command": "gemini",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p",
         "-o",
@@ -92,6 +104,8 @@
       "label": "Qwen Code",
       "command": "qwen",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p",
         "--output-format",
@@ -108,6 +122,8 @@
       "label": "Cline",
       "command": "cline",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-y",
         "--id"
@@ -122,6 +138,8 @@
       "label": "Crush",
       "command": "crush",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "-q"
@@ -136,6 +154,8 @@
       "label": "Cursor",
       "command": "cursor-agent",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--force",
         "-p"
@@ -151,6 +171,8 @@
       "label": "GitHub Copilot",
       "command": "copilot",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--allow-all-tools",
         "-p"
@@ -165,6 +187,8 @@
       "label": "Grok",
       "command": "grok",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p"
       ],
@@ -178,6 +202,8 @@
       "label": "Amp",
       "command": "amp",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-x",
         "threads",
@@ -193,6 +219,8 @@
       "label": "Auggie",
       "command": "auggie",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--quiet",
         "--print"
@@ -207,6 +235,8 @@
       "label": "Droid",
       "command": "droid",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "exec",
         "--auto",
@@ -223,6 +253,8 @@
       "label": "Continue",
       "command": "cn",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--auto",
         "-p"
@@ -237,6 +269,8 @@
       "label": "Kilo Code",
       "command": "kilo",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "--auto",
@@ -252,6 +286,8 @@
       "label": "Rovo Dev",
       "command": "acli",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "rovodev",
         "run",
@@ -265,6 +301,8 @@
       "label": "Codebuff",
       "command": "codebuff",
       "hidden": true,
+      "supportTier": "experimental",
+      "certification": "unverified",
       "headlessFlags": [
         "--continue"
       ],

package/bin/bivy.mjs

@@ -425,6 +425,25 @@ function run(cmd, args, opts = {}) {
   });
 }
 
+/** Fixed executable + fixed entry point for setup's inline model-auth stage.
+ * Keep this separate from the generic CLI forwarding helper: no user-provided
+ * command or argv value reaches this process boundary. */
+function runSetupModelLogin(config) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, nodeScriptArgs(bivyLoginEntry), {
+      stdio: "inherit",
+      cwd: repoRoot,
+      env: startEnv(config),
+      shell: false,
+    });
+    child.on("exit", (code) => resolve(code ?? 0));
+    child.on("error", (error) => {
+      console.error(c.red(`Failed to start model login: ${error.message}`));
+      resolve(1);
+    });
+  });
+}
+
 function runQuiet(cmd, args, opts = {}) {
   const res = spawnSync(cmd, args, { encoding: "utf8", ...opts });
   return { code: res.status ?? 1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
@@ -1530,7 +1549,7 @@ function cmdCompletions(args = []) {
   const shell = (args[0] || "").toLowerCase();
   const commands = [
     "run", "sessions", "ls", "resume", "promote", "rename", "nodes", "agents", "agents:install", "shim", "takeover", "token", "exec",
-    "send", "attach", "kill", "setup", "start", "stop", "restart", "status", "doctor", "logs", "login",
+    "send", "attach", "kill", "setup", "start", "stop", "restart", "status", "doctor", "diagnostics", "logs", "login",
     "update", "update:log", "open", "service", "secrets", "voice", "link", "relay:setup",
     "github:connect", "github:app-create", "github:app-connect", "github:app-sync", "prune", "uninstall", "help", "version",
   ];
@@ -3194,9 +3213,10 @@ async function cmdSetup(args = []) {
     config.env = { ...config.env, BIVY_RUNTIME: setupAgent.runtimeId };
     saveConfig(config);
   }
+  let agentReady = true;
   if (setupAgent && setupAgent.runtimeId !== "pi") {
-    const installed = await ensureSetupAgent(setupAgent);
-    if (!installed) console.log(c.yellow(`${setupAgent.label} was not fully installed. Install it later from the app or with 'bivy agents:install'.`));
+    agentReady = await ensureSetupAgent(setupAgent);
+    if (!agentReady) console.log(c.yellow(`${setupAgent.label} was not fully installed. Install it later from the app or with 'bivy agents:install'.`));
   }
   console.log(c.dim(`Default agent: ${setupAgent?.label || "Pi"}  (change in Settings; sign into your model from the agent's CLI/TUI or Settings → Keys & OAuth)`));
 
@@ -3211,13 +3231,17 @@ async function cmdSetup(args = []) {
     console.log(c.bold("\n  Remote access\n"));
 
     console.log("Bivy uses remote access to make agent sessions visible and steerable from your other devices.");
+    // If self-host endpoints are already provided via the environment, default to
+    // self-hosted so a scripted or self-hosted install doesn't have to re-pick it
+    // (BIVY_CONTROL_PLANE_URL / BIVY_RELAY_URL then pre-fill the URL prompts below).
+    const selfHostEnv = Boolean((process.env.BIVY_CONTROL_PLANE_URL || "").trim() || (process.env.BIVY_RELAY_URL || "").trim());
     const syncChoice = await askChoice(
       "Remote access",
       [
         { key: "h", label: "hosted (recommended — one node is free)" },
         { key: "s", label: "self-hosted (your own control plane + relay)" },
       ],
-      "h",
+      selfHostEnv ? "s" : "h",
     );
     const relayArgs = [];
     if (syncChoice === "s") {
@@ -3278,6 +3302,22 @@ async function cmdSetup(args = []) {
   // `bivy github:app-create` / `github:app-connect`. One app covers every repo,
   // and the node mints its own tokens, so there's no per-repo token to set up here.
 
+  // Model access is part of activation, not a post-success footnote. Pi/Aider use
+  // Bivy's provider login; offer it inline so setup cannot imply the first task
+  // is ready while the required credential is still absent. Agent-native auth is
+  // explained in the readiness checklist below because those CLIs own the flow.
+  if (setupAgent?.needsBivyModel && !hasModelConfig(config)) {
+    const signInNow = await askYesNo("Sign in to a model now so your first task can run?", true);
+    if (signInNow) {
+      rl.pause();
+      const loginCode = await runSetupModelLogin(config);
+      rl.resume();
+      if (loginCode !== 0 || !hasModelConfig(loadConfig())) {
+        console.log(c.yellow("Model sign-in did not complete. The node can start, but an agent reply still requires 'bivy login'."));
+      }
+    }
+  }
+
   // 4. Background service — always installed so the node keeps running (and stays
   // reachable remotely) after you close this terminal. No prompt.
   let started = false;
@@ -3296,9 +3336,17 @@ async function cmdSetup(args = []) {
     return;
   }
 
-  console.log(c.bold(c.green("\n  ✓ Your node is running.\n")));
-  printFirstRunSteps();
-  await finishSetupRemote(config, setupSession);
+  const finalConfig = loadConfig();
+  const modelReady = !setupAgent?.needsBivyModel || hasModelConfig(finalConfig);
+  console.log(c.bold(c.green("\n  ✓ Node running. Check first-task readiness below.\n")));
+  console.log(`  ${c.green("✓")} node reachable at ${url(finalConfig)}`);
+  console.log(`  ${agentReady ? c.green("✓") : c.yellow("!")} runtime ${agentReady ? `${setupAgent?.label || "Pi"} available` : "not installed — run 'bivy agents:install'"}`);
+  console.log(`  ${modelReady ? (setupAgent?.needsBivyModel ? c.green("✓") : c.dim("○")) : c.yellow("!")} model ${modelReady ? (setupAgent?.needsBivyModel ? "credential configured" : "agent-managed — verified by the first task") : "not configured — run 'bivy login'"}`);
+  console.log(`  ${c.dim("○")} repository chosen from the directory where you start Bivy`);
+  console.log(`  ${agentReady && modelReady ? c.green("✓") : c.yellow("!")} first task ${agentReady && modelReady ? "ready to try" : "blocked by the stage above"}`);
+  console.log(`  ${fs.existsSync(relayConfigPath) ? c.green("✓") : c.yellow("!")} remote ${fs.existsSync(relayConfigPath) ? "configured" : "not configured — run 'bivy relay:setup'"}\n`);
+  printFirstRunSteps(modelReady);
+  await finishSetupRemote(finalConfig, setupSession);
 }
 
 // Read and delete the one-time account-session handoff written by relay:setup
@@ -3385,11 +3433,11 @@ async function openRemoteApp(config, { setupSession = null, open = true } = {})
   return { relay, remoteBase, accountUrl, pairedUrl, openUrl };
 }
 
-function printFirstRunSteps() {
+function printFirstRunSteps(modelReady = false) {
   console.log("  Run your first task:");
-  console.log(`    1. Model access:  ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
-  console.log(`    2. Start chatting: ${c.cyan("bivy")}`);
-  console.log(`       One-shot task: ${c.cyan('bivy exec "explain this repository"')}\n`);
+  if (!modelReady) console.log(`    1. Model access:   ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
+  console.log(`    ${modelReady ? "1" : "2"}. Start chatting: ${c.cyan("bivy")}`);
+  console.log(`       Starter task:  ${c.cyan('bivy exec "explain this repository and identify one low-risk improvement"')}\n`);
 }
 
 async function finishSetupRemote(config, setupSession = null) {
@@ -3506,7 +3554,7 @@ async function cmdStatus(args = []) {
     console.log(`  sessions:  ${status.sessions?.open ?? 0} open, ${status.sessions?.indexed ?? 0} indexed${status.sessions?.active ? `, active ${status.sessions.active}` : ""}`);
     console.log(`  devices:   ${status.devices?.paired ?? 0} paired remote, ${status.devices?.localTokens ?? 0} local token(s)`);
     console.log(`  approvals: ${status.approvals?.pending ?? 0} pending`);
-    console.log(`  guard:     ${status.approvalMode || "autonomous"} (${status.guardrails?.workspaceBoundary ? "workspace boundary on" : "boundary unknown"})`);
+    console.log(`  guard:     ${status.approvalMode || "autonomous"} · ${status.guardrails?.protection || (status.guardrails?.workspaceBoundary ? "structured workspace controls" : "runs with user permissions")}`);
     if (status.updatedAt) {
       const when = new Date(status.updatedAt);
       console.log(`  updated:   ${Number.isNaN(when.getTime()) ? status.updatedAt : when.toLocaleString()}`);
@@ -3517,9 +3565,34 @@ async function cmdStatus(args = []) {
 
 // `bivy doctor` — one health screen: runtime deps, node reachability, model auth,
 // remote/relay, and agents on PATH.
+// `bivy diagnostics [--out <file>]` — fetch the node's redacted diagnostics
+// bundle (versions, health counters, whitelisted config, activation record — no
+// secrets/prompts/transcripts) and print it, or write it to a file to attach to a
+// support request. See src/diagnostics.ts for exactly what is (and isn't) included.
+async function cmdDiagnostics(args = []) {
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log('Usage: bivy diagnostics [--out <file>]\n\nPrint a redacted, shareable diagnostics bundle (no secrets, prompts, transcripts, or repo content). --out writes it to a file instead of stdout.');
+    return;
+  }
+  const config = loadConfig();
+  if (!(await ensureNodeRunning(config))) { console.error(c.red(`Could not reach the Bivy node at ${url(config)}.`)); process.exit(1); return; }
+  let report;
+  try { report = await localApi(config, "/api/diagnostics"); }
+  catch (error) { console.error(c.red(`Could not fetch diagnostics: ${error?.message || String(error)}`)); process.exit(1); return; }
+  const json = JSON.stringify(report, null, 2);
+  const outIdx = args.indexOf("--out");
+  const out = outIdx >= 0 && outIdx + 1 < args.length ? args[outIdx + 1] : undefined;
+  if (out) {
+    fs.writeFileSync(out, json + "\n");
+    console.log(c.green(`Wrote redacted diagnostics to ${out}`));
+  } else {
+    console.log(json);
+  }
+}
+
 async function cmdDoctor(args = []) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log("Usage: bivy doctor\n\nHealth check: runtime deps, node reachability, model auth, remote/relay, and agents on PATH. Exits non-zero if Node is unsupported or the node is unreachable, so it can gate CI/monitoring.");
+    console.log("Usage: bivy doctor\n\nHealth check: runtime deps, node reachability, model auth, remote/relay, and agents on PATH. Exits non-zero if Node is unsupported or the node is unreachable, so it can gate CI/monitoring. See also 'bivy diagnostics' for a shareable redacted bundle.");
     return;
   }
   if (!(await ensureDeps())) process.exit(1);
@@ -3565,6 +3638,16 @@ async function cmdDoctor(args = []) {
   const agentCommands = [...BUILTIN_TERMINAL_AGENTS.values()].filter((a) => a.type === "command").map((a) => a.command);
   const agents = agentCommands.filter((a) => commandExists(a));
   console.log(`  ${mark(agents.length > 0, true)} agents on PATH: ${agents.length ? c.cyan(agents.join(", ")) : c.dim("none (built-in Pi still works; 'bivy agents:install')")}`);
+  if (status?.eventLog) {
+    const healthy = status.eventLog.ok !== false;
+    const mib = Number(status.eventLog.bytes || 0) / (1024 * 1024);
+    console.log(`  ${mark(healthy, true)} event log ${healthy ? "writable" : `${status.eventLog.affectedSessions ?? 0} session(s) need attention`} · ${mib.toFixed(1)} MiB`);
+  }
+  if (status?.attachments) {
+    const mib = Number(status.attachments.bytes || 0) / (1024 * 1024);
+    const over = Number(status.attachments.overCapBytes || 0);
+    console.log(`  ${over > 0 ? warn : ok} attachments ${status.attachments.blobs ?? 0} blob(s), ${mib.toFixed(1)} MiB${over > 0 ? c.dim("  (over cap; referenced history retained)") : ""}`);
+  }
   console.log("");
 
   // Fail the command when a hard check is red (unsupported Node or an
@@ -4234,6 +4317,9 @@ An agent's own --help passes through, e.g. 'bivy run claude --help'.`);
     case "doctor":
       await cmdDoctor(args);
       break;
+    case "diagnostics":
+      await cmdDiagnostics(args);
+      break;
     case "logs":
       await cmdLogs(args);
       break;

package/bin/patch-pi-dependencies.mjs

@@ -2,11 +2,11 @@
 // SPDX-License-Identifier: FSL-1.1-ALv2
 // Copyright (c) 2026 Petter André Sjulstad
 /**
- * pi-coding-agent 0.82.1 publishes an npm-shrinkwrap that pins the vulnerable
- * brace-expansion 5.0.7 below its own node_modules. npm overrides update the
- * outer lockfile/audit result but do not replace the shrinkwrapped files during
- * installation. Replace that one nested package with our direct, exact 5.0.9
- * dependency until pi publishes a corrected shrinkwrap.
+ * pi-coding-agent 0.82.1 publishes an npm-shrinkwrap that pins vulnerable
+ * transitive packages below its own node_modules. npm overrides update the outer
+ * lockfile/audit result but do not replace those shrinkwrapped files during
+ * installation. Replace the affected nested packages with direct, exact patched
+ * dependencies until pi publishes a corrected shrinkwrap.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -27,18 +27,24 @@ function findDependency(relativePath) {
   }
 }
 
-const source = findDependency("brace-expansion");
 const piPackage = findDependency(path.join("@earendil-works", "pi-coding-agent"));
-const target = piPackage && path.join(piPackage, "node_modules", "brace-expansion");
+if (!piPackage) process.exit(0);
 
-if (!target || !fs.existsSync(target)) process.exit(0);
-if (!source) throw new Error("Security patch source brace-expansion@5.0.9 is missing");
+const patches = [
+  { name: "brace-expansion", version: "5.0.9" },
+  { name: "undici", version: "8.9.0" },
+];
 
-const sourcePackage = JSON.parse(fs.readFileSync(path.join(source, "package.json"), "utf8"));
-if (sourcePackage.version !== "5.0.9") {
-  throw new Error(`Refusing dependency patch from unexpected brace-expansion ${sourcePackage.version}`);
+for (const patch of patches) {
+  const source = findDependency(patch.name);
+  const target = path.join(piPackage, "node_modules", patch.name);
+  if (!fs.existsSync(target)) continue;
+  if (!source) throw new Error(`Security patch source ${patch.name}@${patch.version} is missing`);
+  const sourcePackage = JSON.parse(fs.readFileSync(path.join(source, "package.json"), "utf8"));
+  if (sourcePackage.version !== patch.version) {
+    throw new Error(`Refusing dependency patch from unexpected ${patch.name} ${sourcePackage.version}`);
+  }
+  fs.rmSync(target, { recursive: true, force: true });
+  fs.cpSync(source, target, { recursive: true });
+  console.log(`Patched pi-coding-agent's nested ${patch.name} to ${patch.version}`);
 }
-
-fs.rmSync(target, { recursive: true, force: true });
-fs.cpSync(source, target, { recursive: true });
-console.log("Patched pi-coding-agent's nested brace-expansion to 5.0.9");

package/dist/automation-checks.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+const DEFAULT_SCRIPT_NAMES = ["test", "lint", "typecheck"];
+const DEFAULT_CHECK_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_CHECK_TIMEOUT_MS = 30 * 60 * 1000;
+function configuredScriptNames(env) {
+    const raw = env.BIVY_AUTOMATION_CHECKS?.trim();
+    if (!raw)
+        return DEFAULT_SCRIPT_NAMES;
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return [...new Set(parsed.map(String).map((s) => s.trim()).filter((s) => /^[\w:.-]+$/.test(s)))].slice(0, 10);
+    }
+    catch {
+        // Fall through to a comma list; malformed entries are discarded rather than
+        // interpreted as shell. Only package-script names are accepted.
+    }
+    return [...new Set(raw.split(",").map((s) => s.trim()).filter((s) => /^[\w:.-]+$/.test(s)))].slice(0, 10);
+}
+function checkTimeoutMs(env) {
+    const parsed = Number(env.BIVY_AUTOMATION_CHECK_TIMEOUT_MS);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return DEFAULT_CHECK_TIMEOUT_MS;
+    return Math.min(MAX_CHECK_TIMEOUT_MS, Math.max(1_000, Math.floor(parsed)));
+}
+function packageManager(cwd) {
+    if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml")))
+        return { command: "pnpm", args: (script) => ["run", script] };
+    if (fs.existsSync(path.join(cwd, "yarn.lock")))
+        return { command: "yarn", args: (script) => ["run", script] };
+    return { command: "npm", args: (script) => ["run", script] };
+}
+/** Discover and run only declared package scripts. Command text and output stay
+ * on the node; hosted evidence receives a name, hash, pass/fail, and exit code. */
+export function runRequiredAutomationChecks(cwd, env = process.env, run = spawnSync) {
+    let pkg;
+    try {
+        pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+    }
+    catch {
+        return [];
+    }
+    const manager = packageManager(cwd);
+    const timeout = checkTimeoutMs(env);
+    const results = [];
+    for (const name of configuredScriptNames(env)) {
+        if (typeof pkg.scripts?.[name] !== "string")
+            continue;
+        const args = manager.args(name);
+        const commandHash = `sha256:${createHash("sha256").update(JSON.stringify([manager.command, ...args])).digest("hex")}`;
+        const startedAt = Date.now();
+        const result = run(manager.command, args, {
+            cwd,
+            env,
+            stdio: "ignore",
+            timeout,
+            killSignal: "SIGTERM",
+        });
+        const exitCode = typeof result.status === "number" ? result.status : 1;
+        results.push({ name, commandHash, status: exitCode === 0 ? "passed" : "failed", exitCode, durationMs: Math.max(0, Date.now() - startedAt) });
+    }
+    return results;
+}

package/dist/bivy-login.js

@@ -5,6 +5,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 import { createCredentialVault } from "./runtime/credential-store.js";
+import { probeAnthropicAccess } from "./runtime/anthropic-preflight.js";
 import { listPiProviders } from "./runtime/pi-oauth.js";
 import { loginModelOAuth } from "./runtime/oauth/model-oauth.js";
 import { openBrowser } from "./browser-open.js";
@@ -95,6 +96,18 @@ async function loginApiKey(provider) {
         throw new Error("API key cannot be empty.");
     await createCredentialVault(credsDir).setApiKey(provider.id, apiKey);
     console.log(`Saved API key for ${provider.name} to Bivy's credential vault.`);
+    // B1: validate real access, not just that a key was typed, where a safe probe
+    // exists. A rejected key is reported now instead of surfacing later as an
+    // opaque 401 on the user's first task.
+    if (provider.id === "anthropic") {
+        const probe = await probeAnthropicAccess(apiKey);
+        if (probe.probed && !probe.ok) {
+            console.log(`⚠ ${probe.reason || "The key was saved but Anthropic rejected it."} Double-check the key; re-run 'bivy login' to replace it.`);
+        }
+        else if (probe.probed) {
+            console.log("✓ Verified: the key can reach the Anthropic API.");
+        }
+    }
 }
 /** Bridge Pi's AuthInteraction to the terminal (prompt/notify). */
 function terminalInteraction(provider, signal) {

package/dist/control-plane-tasks.js

@@ -53,7 +53,19 @@ async function cp(cfg, method, path) {
     });
 }
 async function transitionWork(cfg, id, action) {
-    await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/${action}`).catch(() => { });
+    // Best-effort — a dropped transition never loses the run itself — but NOT
+    // silent: a swallowed `complete`/`fail`/`needs-attention` leaves the control
+    // plane's view of the item stale (stuck "running", or re-dispatched), so the
+    // failure must be visible in node logs/diagnostics rather than discarded (A4).
+    try {
+        const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/${action}`);
+        if (!res.ok) {
+            console.warn(`[control-plane-tasks] work ${id} "${action}" rejected by control plane (${res.status}); its status may be stale`);
+        }
+    }
+    catch (error) {
+        console.warn(`[control-plane-tasks] work ${id} "${action}" could not reach control plane:`, error instanceof Error ? error.message : error);
+    }
 }
 export async function fetchPendingWork(cfg) {
     const res = await cp(cfg, "GET", `/node/work?labels=${encodeURIComponent(cfg.labels.join(","))}`);
@@ -67,6 +79,10 @@ export async function claimWork(cfg, id) {
     const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/claim`);
     return res.ok;
 }
+export async function renewWorkLease(cfg, id) {
+    const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/heartbeat`);
+    return res.ok;
+}
 export async function completeWork(cfg, id) {
     await transitionWork(cfg, id, "complete");
 }
@@ -80,13 +96,22 @@ export async function needsAttentionWork(cfg, id) {
 /** Report privacy-safe run evidence (issue #153) — routing reason, output refs
  *  (branch/PR/checkpoint/commit/...), check results, and new timeline events.
  *  Best-effort: a dropped report loses one evidence update, never the run
- *  itself, so failures here are swallowed like the other transition calls. */
+ *  itself. It is not throwing, but the failure is logged (A4) so a persistently
+ *  failing evidence channel is visible in diagnostics instead of silent. */
 export async function reportEvidence(cfg, id, patch) {
-    await fetch(`${cfg.controlPlaneUrl}/node/work/${encodeURIComponent(id)}/evidence`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${cfg.enrollmentToken}`, "content-type": "application/json" },
-        body: JSON.stringify(patch),
-    }).catch(() => { });
+    try {
+        const res = await fetch(`${cfg.controlPlaneUrl}/node/work/${encodeURIComponent(id)}/evidence`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${cfg.enrollmentToken}`, "content-type": "application/json" },
+            body: JSON.stringify(patch),
+        });
+        if (!res.ok) {
+            console.warn(`[control-plane-tasks] work ${id} evidence report rejected (${res.status})`);
+        }
+    }
+    catch (error) {
+        console.warn(`[control-plane-tasks] work ${id} evidence report could not reach control plane:`, error instanceof Error ? error.message : error);
+    }
 }
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class ControlPlaneTaskPoller {
@@ -174,11 +199,15 @@ export class ControlPlaneTaskPoller {
         await Promise.all(running);
     }
     async runOne(item) {
+        let leaseHeartbeat;
         try {
             // Claim first so only one node runs it; skip if another node won (no
-            // claim → not ours → don't run or complete it).
+            // claim → not ours → don't run or complete it). A heartbeat keeps the
+            // finite lease alive; process death stops it and makes the item reclaimable.
             if (!(await claimWork(this.cfg, item.id)))
                 return;
+            leaseHeartbeat = setInterval(() => void renewWorkLease(this.cfg, item.id), 30_000);
+            leaseHeartbeat.unref?.();
             const report = (patch) => reportEvidence(this.cfg, item.id, patch);
             await transitionWork(this.cfg, item.id, "running");
             console.log(`[control-plane-tasks] running ${item.source} item ${item.id}: ${item.title}`);
@@ -190,6 +219,8 @@ export class ControlPlaneTaskPoller {
             await this.runWithPolicy(item, report);
         }
         finally {
+            if (leaseHeartbeat)
+                clearInterval(leaseHeartbeat);
             this.inFlight.delete(item.id);
         }
     }