@bivy/bivy 0.6.0 → 0.7.0-staging.100

package/bin/patch-pi-dependencies.mjs

@@ -2,11 +2,11 @@
 // SPDX-License-Identifier: FSL-1.1-ALv2
 // Copyright (c) 2026 Petter André Sjulstad
 /**
- * pi-coding-agent 0.82.1 publishes an npm-shrinkwrap that pins the vulnerable
- * brace-expansion 5.0.7 below its own node_modules. npm overrides update the
- * outer lockfile/audit result but do not replace the shrinkwrapped files during
- * installation. Replace that one nested package with our direct, exact 5.0.9
- * dependency until pi publishes a corrected shrinkwrap.
+ * pi-coding-agent 0.82.1 publishes an npm-shrinkwrap that pins vulnerable
+ * transitive packages below its own node_modules. npm overrides update the outer
+ * lockfile/audit result but do not replace those shrinkwrapped files during
+ * installation. Replace the affected nested packages with direct, exact patched
+ * dependencies until pi publishes a corrected shrinkwrap.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -27,18 +27,24 @@ function findDependency(relativePath) {
   }
 }
 
-const source = findDependency("brace-expansion");
 const piPackage = findDependency(path.join("@earendil-works", "pi-coding-agent"));
-const target = piPackage && path.join(piPackage, "node_modules", "brace-expansion");
+if (!piPackage) process.exit(0);
 
-if (!target || !fs.existsSync(target)) process.exit(0);
-if (!source) throw new Error("Security patch source brace-expansion@5.0.9 is missing");
+const patches = [
+  { name: "brace-expansion", version: "5.0.9" },
+  { name: "undici", version: "8.9.0" },
+];
 
-const sourcePackage = JSON.parse(fs.readFileSync(path.join(source, "package.json"), "utf8"));
-if (sourcePackage.version !== "5.0.9") {
-  throw new Error(`Refusing dependency patch from unexpected brace-expansion ${sourcePackage.version}`);
+for (const patch of patches) {
+  const source = findDependency(patch.name);
+  const target = path.join(piPackage, "node_modules", patch.name);
+  if (!fs.existsSync(target)) continue;
+  if (!source) throw new Error(`Security patch source ${patch.name}@${patch.version} is missing`);
+  const sourcePackage = JSON.parse(fs.readFileSync(path.join(source, "package.json"), "utf8"));
+  if (sourcePackage.version !== patch.version) {
+    throw new Error(`Refusing dependency patch from unexpected ${patch.name} ${sourcePackage.version}`);
+  }
+  fs.rmSync(target, { recursive: true, force: true });
+  fs.cpSync(source, target, { recursive: true });
+  console.log(`Patched pi-coding-agent's nested ${patch.name} to ${patch.version}`);
 }
-
-fs.rmSync(target, { recursive: true, force: true });
-fs.cpSync(source, target, { recursive: true });
-console.log("Patched pi-coding-agent's nested brace-expansion to 5.0.9");

package/dist/automation-checks.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+const DEFAULT_SCRIPT_NAMES = ["test", "lint", "typecheck"];
+const DEFAULT_CHECK_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_CHECK_TIMEOUT_MS = 30 * 60 * 1000;
+function configuredScriptNames(env) {
+    const raw = env.BIVY_AUTOMATION_CHECKS?.trim();
+    if (!raw)
+        return DEFAULT_SCRIPT_NAMES;
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return [...new Set(parsed.map(String).map((s) => s.trim()).filter((s) => /^[\w:.-]+$/.test(s)))].slice(0, 10);
+    }
+    catch {
+        // Fall through to a comma list; malformed entries are discarded rather than
+        // interpreted as shell. Only package-script names are accepted.
+    }
+    return [...new Set(raw.split(",").map((s) => s.trim()).filter((s) => /^[\w:.-]+$/.test(s)))].slice(0, 10);
+}
+function checkTimeoutMs(env) {
+    const parsed = Number(env.BIVY_AUTOMATION_CHECK_TIMEOUT_MS);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return DEFAULT_CHECK_TIMEOUT_MS;
+    return Math.min(MAX_CHECK_TIMEOUT_MS, Math.max(1_000, Math.floor(parsed)));
+}
+function packageManager(cwd) {
+    if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml")))
+        return { command: "pnpm", args: (script) => ["run", script] };
+    if (fs.existsSync(path.join(cwd, "yarn.lock")))
+        return { command: "yarn", args: (script) => ["run", script] };
+    return { command: "npm", args: (script) => ["run", script] };
+}
+/** Discover and run only declared package scripts. Command text and output stay
+ * on the node; hosted evidence receives a name, hash, pass/fail, and exit code. */
+export function runRequiredAutomationChecks(cwd, env = process.env, run = spawnSync) {
+    let pkg;
+    try {
+        pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+    }
+    catch {
+        return [];
+    }
+    const manager = packageManager(cwd);
+    const timeout = checkTimeoutMs(env);
+    const results = [];
+    for (const name of configuredScriptNames(env)) {
+        if (typeof pkg.scripts?.[name] !== "string")
+            continue;
+        const args = manager.args(name);
+        const commandHash = `sha256:${createHash("sha256").update(JSON.stringify([manager.command, ...args])).digest("hex")}`;
+        const startedAt = Date.now();
+        const result = run(manager.command, args, {
+            cwd,
+            env,
+            stdio: "ignore",
+            timeout,
+            killSignal: "SIGTERM",
+        });
+        const exitCode = typeof result.status === "number" ? result.status : 1;
+        results.push({ name, commandHash, status: exitCode === 0 ? "passed" : "failed", exitCode, durationMs: Math.max(0, Date.now() - startedAt) });
+    }
+    return results;
+}

package/dist/bivy-login.js

@@ -5,6 +5,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 import { createCredentialVault } from "./runtime/credential-store.js";
+import { probeAnthropicAccess } from "./runtime/anthropic-preflight.js";
 import { listPiProviders } from "./runtime/pi-oauth.js";
 import { loginModelOAuth } from "./runtime/oauth/model-oauth.js";
 import { openBrowser } from "./browser-open.js";
@@ -95,6 +96,18 @@ async function loginApiKey(provider) {
         throw new Error("API key cannot be empty.");
     await createCredentialVault(credsDir).setApiKey(provider.id, apiKey);
     console.log(`Saved API key for ${provider.name} to Bivy's credential vault.`);
+    // B1: validate real access, not just that a key was typed, where a safe probe
+    // exists. A rejected key is reported now instead of surfacing later as an
+    // opaque 401 on the user's first task.
+    if (provider.id === "anthropic") {
+        const probe = await probeAnthropicAccess(apiKey);
+        if (probe.probed && !probe.ok) {
+            console.log(`⚠ ${probe.reason || "The key was saved but Anthropic rejected it."} Double-check the key; re-run 'bivy login' to replace it.`);
+        }
+        else if (probe.probed) {
+            console.log("✓ Verified: the key can reach the Anthropic API.");
+        }
+    }
 }
 /** Bridge Pi's AuthInteraction to the terminal (prompt/notify). */
 function terminalInteraction(provider, signal) {

package/dist/control-plane-tasks.js

@@ -53,7 +53,19 @@ async function cp(cfg, method, path) {
     });
 }
 async function transitionWork(cfg, id, action) {
-    await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/${action}`).catch(() => { });
+    // Best-effort — a dropped transition never loses the run itself — but NOT
+    // silent: a swallowed `complete`/`fail`/`needs-attention` leaves the control
+    // plane's view of the item stale (stuck "running", or re-dispatched), so the
+    // failure must be visible in node logs/diagnostics rather than discarded (A4).
+    try {
+        const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/${action}`);
+        if (!res.ok) {
+            console.warn(`[control-plane-tasks] work ${id} "${action}" rejected by control plane (${res.status}); its status may be stale`);
+        }
+    }
+    catch (error) {
+        console.warn(`[control-plane-tasks] work ${id} "${action}" could not reach control plane:`, error instanceof Error ? error.message : error);
+    }
 }
 export async function fetchPendingWork(cfg) {
     const res = await cp(cfg, "GET", `/node/work?labels=${encodeURIComponent(cfg.labels.join(","))}`);
@@ -67,6 +79,10 @@ export async function claimWork(cfg, id) {
     const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/claim`);
     return res.ok;
 }
+export async function renewWorkLease(cfg, id) {
+    const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/heartbeat`);
+    return res.ok;
+}
 export async function completeWork(cfg, id) {
     await transitionWork(cfg, id, "complete");
 }
@@ -80,13 +96,22 @@ export async function needsAttentionWork(cfg, id) {
 /** Report privacy-safe run evidence (issue #153) — routing reason, output refs
  *  (branch/PR/checkpoint/commit/...), check results, and new timeline events.
  *  Best-effort: a dropped report loses one evidence update, never the run
- *  itself, so failures here are swallowed like the other transition calls. */
+ *  itself. It is not throwing, but the failure is logged (A4) so a persistently
+ *  failing evidence channel is visible in diagnostics instead of silent. */
 export async function reportEvidence(cfg, id, patch) {
-    await fetch(`${cfg.controlPlaneUrl}/node/work/${encodeURIComponent(id)}/evidence`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${cfg.enrollmentToken}`, "content-type": "application/json" },
-        body: JSON.stringify(patch),
-    }).catch(() => { });
+    try {
+        const res = await fetch(`${cfg.controlPlaneUrl}/node/work/${encodeURIComponent(id)}/evidence`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${cfg.enrollmentToken}`, "content-type": "application/json" },
+            body: JSON.stringify(patch),
+        });
+        if (!res.ok) {
+            console.warn(`[control-plane-tasks] work ${id} evidence report rejected (${res.status})`);
+        }
+    }
+    catch (error) {
+        console.warn(`[control-plane-tasks] work ${id} evidence report could not reach control plane:`, error instanceof Error ? error.message : error);
+    }
 }
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class ControlPlaneTaskPoller {
@@ -174,11 +199,15 @@ export class ControlPlaneTaskPoller {
         await Promise.all(running);
     }
     async runOne(item) {
+        let leaseHeartbeat;
         try {
             // Claim first so only one node runs it; skip if another node won (no
-            // claim → not ours → don't run or complete it).
+            // claim → not ours → don't run or complete it). A heartbeat keeps the
+            // finite lease alive; process death stops it and makes the item reclaimable.
             if (!(await claimWork(this.cfg, item.id)))
                 return;
+            leaseHeartbeat = setInterval(() => void renewWorkLease(this.cfg, item.id), 30_000);
+            leaseHeartbeat.unref?.();
             const report = (patch) => reportEvidence(this.cfg, item.id, patch);
             await transitionWork(this.cfg, item.id, "running");
             console.log(`[control-plane-tasks] running ${item.source} item ${item.id}: ${item.title}`);
@@ -190,6 +219,8 @@ export class ControlPlaneTaskPoller {
             await this.runWithPolicy(item, report);
         }
         finally {
+            if (leaseHeartbeat)
+                clearInterval(leaseHeartbeat);
             this.inFlight.delete(item.id);
         }
     }

package/dist/diagnostics.js

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Redacted diagnostics export + privacy-safe activation instrumentation (B4d).
+//
+// A support bundle a user can share without leaking secrets, prompts, transcripts,
+// diffs, or repo contents: versions, health counters, a whitelisted set of config
+// flags (values still passed through redactSecrets defensively), and the activation
+// stage record. Everything user-authored stays on the node.
+import { redactSecrets } from "./redact.js";
+/** Ordered activation stages — the golden path from install to first useful task. */
+export const ACTIVATION_STAGES = ["install", "node_online", "runtime", "credential", "repo", "first_task"];
+/**
+ * Map the setup/doctor readiness booleans to a privacy-safe activation record —
+ * where the golden path is blocked, and where it flowed. No content, only the
+ * stage and its status. `null` for an unknown stage means "pending" (not reached).
+ */
+export function activationRecord(readiness) {
+    const status = (ok, skipWhenNull = false) => {
+        if (ok === null || ok === undefined)
+            return skipWhenNull ? "skipped" : "pending";
+        return ok ? "ok" : "blocked";
+    };
+    return [
+        { stage: "install", status: "ok" }, // reaching this code means the CLI installed
+        { stage: "node_online", status: status(readiness.nodeOnline) },
+        { stage: "runtime", status: status(readiness.runtimeReady) },
+        { stage: "credential", status: status(readiness.credentialReady, true) },
+        { stage: "repo", status: status(readiness.repoChosen) },
+        { stage: "first_task", status: status(readiness.firstTaskReady) },
+    ];
+}
+/** Env vars safe to include in a diagnostics bundle: non-secret config knobs only.
+ *  Anything not matching is dropped entirely (not just redacted). */
+const SAFE_ENV_KEYS = new Set([
+    "BIVY_APPROVAL_MODE", "BIVY_SANDBOX", "BIVY_RUNTIME", "BIVY_MULTI_USER_HOST",
+    "BIVY_REQUIRE_LOCAL_AUTH", "BIVY_TURN_TIMEOUT_MS", "BIVY_AUTOMATION_CHECKS",
+    "PORT", "BIVY_PUBLIC_URL",
+]);
+/** Deep-redact any string leaf in a JSON-ish value. */
+function redactDeep(value) {
+    if (typeof value === "string")
+        return redactSecrets(value);
+    if (Array.isArray(value))
+        return value.map(redactDeep);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = redactDeep(v);
+        return out;
+    }
+    return value;
+}
+/**
+ * Assemble a shareable diagnostics report. Only whitelisted config keys are
+ * included; every string leaf is passed through redactSecrets as a backstop so a
+ * value that slips in (a URL with an embedded token, say) is still masked.
+ */
+export function buildDiagnosticsReport(input) {
+    const config = {};
+    for (const [k, v] of Object.entries(input.env ?? {})) {
+        if (SAFE_ENV_KEYS.has(k) && typeof v === "string" && v.length)
+            config[k] = redactSecrets(v);
+    }
+    return {
+        version: input.version ?? "unknown",
+        platform: input.platform ?? "unknown",
+        nodeVersion: input.nodeVersion ?? "unknown",
+        relayConfigured: Boolean(input.relayConfigured),
+        health: redactDeep(input.health ?? {}),
+        config,
+        activation: input.activation ?? [],
+        generatedAt: input.generatedAt ?? "",
+    };
+}

package/dist/github-tasks.js

@@ -308,11 +308,15 @@ export function pickupMessage(nodeName) {
  * the control plane, not a GitHub label — touches the issue's labels at all.
  */
 export async function announcePickup(cfg, issueNumber, nodeName) {
-    await addLabel(cfg, issueNumber, cfg.claimLabel).catch(() => { });
+    // Best-effort and idempotent, but not silent (A4): a failed claim label can let
+    // another node pick up the same issue, and a failed comment hides the pickup
+    // from the reporter — both are worth a warning in the node log/diagnostics.
+    const warn = (what, error) => console.warn(`[github-tasks] issue #${issueNumber}: could not ${what}:`, error instanceof Error ? error.message : error);
+    await addLabel(cfg, issueNumber, cfg.claimLabel).catch((error) => warn(`apply claim label "${cfg.claimLabel}"`, error));
     if (cfg.label && cfg.label !== cfg.claimLabel) {
-        await removeLabel(cfg, issueNumber, cfg.label).catch(() => { });
+        await removeLabel(cfg, issueNumber, cfg.label).catch((error) => warn(`remove routing label "${cfg.label}"`, error));
     }
-    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch(() => { });
+    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch((error) => warn("post pickup comment", error));
 }
 export async function defaultBranch(cfg) {
     const res = await gh(cfg, "GET", "");
@@ -322,11 +326,27 @@ export async function defaultBranch(cfg) {
     return data.default_branch || "main";
 }
 export async function openPullRequest(cfg, input) {
+    // Idempotent across retry/reclaim (C4a). Creating a PR is an external effect
+    // that must not duplicate when the same item is retried on this node or
+    // reclaimed by another. A PR for this head may already exist — from a prior
+    // attempt or the agent's own `gh pr create` — so reuse it instead of POSTing
+    // blindly (GitHub 422s "a pull request already exists", which the old code
+    // reported as failure, silently losing the PR reference).
+    const branch = input.head.includes(":") ? input.head.slice(input.head.indexOf(":") + 1) : input.head;
+    const existing = await findOpenPullRequestForBranch(cfg, branch);
+    if (existing)
+        return existing;
     const res = await gh(cfg, "POST", "/pulls", input);
-    if (!res.ok)
-        return undefined;
-    const data = (await res.json().catch(() => ({})));
-    return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    if (res.ok) {
+        const data = (await res.json().catch(() => ({})));
+        return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    }
+    // 422 = a PR for this head/base already exists (opened concurrently, e.g. by a
+    // node that reclaimed the item mid-flight). Recover its reference rather than
+    // reporting failure and re-attempting.
+    if (res.status === 422)
+        return findOpenPullRequestForBranch(cfg, branch);
+    return undefined;
 }
 /**
  * Update an existing pull request's title and/or body. Used to refresh the

package/dist/guard.js

@@ -4,8 +4,14 @@ import path from "node:path";
 export function bashCommand(input) {
     if (!input || typeof input !== "object")
         return "";
-    const command = input.command;
-    return typeof command === "string" ? command : "";
+    const value = input;
+    // Structured agents use different names for their shell surface. Keep this
+    // intentionally small and factual; unknown tools are not magically governed.
+    for (const key of ["command", "cmd", "script"]) {
+        if (typeof value[key] === "string")
+            return value[key];
+    }
+    return "";
 }
 /** Heuristic for the legacy "risky" mode (prompt-heavy). */
 export function looksRiskyBash(command) {
@@ -15,15 +21,51 @@ export function looksRiskyBash(command) {
     return (/(^|[;&|()\s])(rm|rmdir|mv|cp|chmod|chown|dd|mkfs|sudo|su|kill|pkill|curl|wget|git\s+(commit|push|reset|clean|checkout|switch|merge|rebase)|npm\s+(install|update|publish)|pnpm\s+(install|update|publish)|yarn\s+(add|install|upgrade|publish))([;&|()\s]|$)/.test(normalized) ||
         /(^|\s)(>|>>|2>|&>|tee\s+)/.test(normalized));
 }
+/** Parse dangerous recursive rm targets without a nested-quantifier regex. The
+ * input is user/agent controlled, so this intentionally stays linear-time. */
+function catastrophicRm(command) {
+    const systemRoots = ["/etc", "/usr", "/home", "/var", "/opt", "/boot", "/root", "/bin", "/sbin", "/lib", "/lib64"];
+    for (const segment of command.split(/[;\n|&]+/)) {
+        const tokens = segment.trim().split(/\s+/).map((token) => token.replace(/^["']|["']$/g, ""));
+        const rmIndex = tokens.lastIndexOf("rm");
+        if (rmIndex < 0)
+            continue;
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        for (const token of tokens.slice(rmIndex + 1)) {
+            if (token === "--recursive")
+                recursive = true;
+            else if (token === "--force")
+                force = true;
+            else if (token.startsWith("-") && !token.startsWith("--")) {
+                recursive ||= token.includes("r") || token.includes("R");
+                force ||= token.includes("f");
+            }
+            else if (!token.startsWith("--"))
+                targets.push(token);
+        }
+        if (!recursive || !force)
+            continue;
+        for (const rawTarget of targets) {
+            const target = rawTarget.length > 1 ? rawTarget.replace(/\/+$/, "") : rawTarget;
+            if (target === "/" || target === "~" || target === "$home" || target === "/*")
+                return true;
+            if (systemRoots.some((root) => target === root || target.startsWith(`${root}/`)))
+                return true;
+        }
+    }
+    return false;
+}
 /**
  * Catastrophic, irreversible, system-wide actions. Blocked OUTRIGHT in every mode
  * — the boundary that makes unattended autonomy safe rather than reckless.
  */
 export function looksCatastrophic(command) {
-    const c = command.trim().toLowerCase();
+    const c = command.trim().toLowerCase().slice(0, 100_000);
     if (!c)
         return false;
-    return (/\brm\s+(-\S*[rf]\S*\s+)+(\/|~|\$home|\/\*)(\s|$|\/)/.test(c) || // rm -rf / | ~ | /*
+    return (catastrophicRm(c) || // rm -rf / | ~ | system roots
         /\bmkfs(\.\w+)?\b/.test(c) ||
         /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|hd|disk)/.test(c) ||
         />\s*\/dev\/(sd|nvme|hd|disk)/.test(c) ||
@@ -76,11 +118,12 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     // case-sensitive compare silently disabled it for claude-code. Integration
     // tool names (MCP, etc.) keep their original casing via `isRiskyIntegration`.
     const tool = toolName.toLowerCase();
+    const isShell = tool === "bash" || tool === "shell" || tool === "execute" || tool === "run_command";
     // Tools that write to the filesystem and so must respect the workspace
     // boundary. MultiEdit/NotebookEdit also take a `file_path` (see toolPath).
     const isWrite = tool === "write" || tool === "edit" || tool === "multiedit" || tool === "notebookedit";
     // --- Hard floor: blocked in every mode ---
-    if (tool === "bash" && looksCatastrophic(bashCommand(input))) {
+    if (isShell && looksCatastrophic(bashCommand(input))) {
         return { decision: "deny", reason: "Blocked: catastrophic command (outside the safety boundary)" };
     }
     if (isWrite) {
@@ -95,15 +138,15 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     if (isRiskyIntegration(toolName))
         return { decision: "ask" };
     if (mode === "autonomous") {
-        if (tool === "bash" && looksBackstop(bashCommand(input)))
+        if (isShell && looksBackstop(bashCommand(input)))
             return { decision: "ask" };
         return { decision: "allow" };
     }
     if (mode === "always") {
-        return { decision: tool === "bash" || isWrite ? "ask" : "allow" };
+        return { decision: isShell || isWrite ? "ask" : "allow" };
     }
     // "risky"
-    if (tool === "bash")
+    if (isShell)
         return { decision: looksRiskyBash(bashCommand(input)) ? "ask" : "allow" };
     return { decision: isWrite ? "ask" : "allow" };
 }

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/mcp-config.js

@@ -3,12 +3,13 @@
 // Universal Agent Harness — MCP config rewriting.
 //
 // The one piece of MCP governance that is unavoidably per-agent is *where* the
-// config lives — but the shape is near-universal. Claude Code, Codex, Cursor,
-// Windsurf, and most MCP hosts use the same `{ mcpServers: { name: { command,
-// args, env } } }` object (stdio servers) plus optional remote (url) servers.
-// This module rewrites that object so every stdio server launches through the
-// Bivy MCP proxy instead of directly — turning each agent's own MCP config into
-// the injection point, with no agent-specific code beyond the file location.
+// config lives — and, for a couple of hosts, the shape. Claude Code, Cursor,
+// Windsurf, and most MCP hosts use `{ mcpServers: { name: { command, args, env
+// } } }` (stdio) plus optional remote (url) servers. OpenCode is the JSON
+// outlier: `{ mcp: { name: { type: "local", command: [bin, ...args],
+// environment } } }` (see opencode.ai/config.json). This module rewrites both
+// shapes so every stdio server launches through the Bivy MCP proxy instead of
+// directly — turning each agent's own MCP config into the injection point.
 //
 // Pure functions, no I/O — unit-tested in test/harness-mcp-config.test.ts. The
 // file-location table for each agent is data (see agentMcpConfigTargets) that
@@ -109,6 +110,88 @@ export function withBivyToolsServer(config, spec, name = "bivy") {
         return { config, added: false };
     return { config: { ...config, mcpServers: { ...servers, [name]: spec } }, added: true };
 }
+/** Convert a universal stdio server spec into OpenCode's local-server shape. */
+export function toOpenCodeLocalServer(spec) {
+    const command = [spec.command ?? "", ...(spec.args ?? [])].filter((s, i) => i === 0 || s !== undefined);
+    // Drop a leading empty command if somehow absent — callers always pass one.
+    const argv = command[0] ? command : command.slice(1);
+    const out = { type: "local", command: argv };
+    if (spec.env && Object.keys(spec.env).length)
+        out.environment = { ...spec.env };
+    return out;
+}
+/** True when an OpenCode local server already launches through the Bivy proxy. */
+export function isOpenCodeProxied(spec, launcher) {
+    if (!Array.isArray(spec.command) || spec.command.length === 0)
+        return false;
+    if (spec.command[0] !== launcher.command)
+        return false;
+    return spec.command.includes(PROXY_MARKER);
+}
+/**
+ * Rewrite every local stdio server in `config.mcp` to launch through the proxy:
+ *
+ *   original:  { type: "local", command: ["mcp-fs", "--root", "/w"], environment: {...} }
+ *   rewritten: { type: "local",
+ *                command: ["bivy", "mcp-proxy", "--bivy-mcp", "--server", "<name>", "--",
+ *                          "mcp-fs", "--root", "/w"],
+ *                environment: {...} }
+ *
+ * Remote servers and already-proxied locals are left untouched (reported in
+ * `skipped`). Idempotent. Does not mutate the input.
+ */
+export function routeOpenCodeThroughProxy(config, launcher) {
+    const rewritten = [];
+    const skipped = [];
+    const servers = config.mcp ?? {};
+    const nextServers = {};
+    for (const [name, spec] of Object.entries(servers)) {
+        if (!spec || typeof spec !== "object") {
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        if (!Array.isArray(spec.command) || spec.command.length === 0 || typeof spec.command[0] !== "string" || !spec.command[0]) {
+            // Remote/url server, enabled-only stub, or malformed — can't wrap via stdio proxy.
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        if (isOpenCodeProxied(spec, launcher)) {
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        const prefix = launcher.argsPrefix ?? [];
+        const orig = spec.command;
+        nextServers[name] = {
+            ...spec,
+            type: "local",
+            command: [launcher.command, ...prefix, PROXY_MARKER, "--server", name, "--", ...orig],
+        };
+        rewritten.push(name);
+    }
+    return {
+        config: { ...config, mcp: nextServers },
+        rewritten,
+        skipped,
+    };
+}
+/**
+ * Insert the Bivy tools server under OpenCode's `mcp.<name>` (default "bivy").
+ * Idempotent: an existing entry of that name is left untouched.
+ */
+export function withOpenCodeBivyToolsServer(config, spec, name = "bivy") {
+    const servers = config.mcp ?? {};
+    if (servers[name])
+        return { config, added: false };
+    return { config: { ...config, mcp: { ...servers, [name]: spec } }, added: true };
+}
+/** Basename check for OpenCode project config files we inject into. */
+export function isOpenCodeConfigFile(filePath) {
+    const base = nodePath.basename(filePath).toLowerCase();
+    return base === "opencode.json" || base === ".opencode.json" || base === "opencode.jsonc" || base === ".opencode.jsonc";
+}
 /** JSON MCP-config file candidates for an agent, most-specific (safest) first. */
 export function agentMcpConfigTargets(agentId, ctx) {
     const ws = (...parts) => nodePath.join(ctx.workspace, ...parts);