@bivy/bivy 0.6.0 → 0.7.0-staging.100

package/dist/harness/mcp-inject.js

@@ -9,12 +9,13 @@
 // session-scoped (workspace-local files preferred) so a failure or a concurrent
 // session can't corrupt config: we snapshot the exact bytes and restore them.
 //
-// Only JSON configs are handled (Claude, Gemini, OpenCode, generic .mcp.json).
-// TOML/YAML-config agents are skipped — they still run and are governed by the
-// FS + network channels. Unit-tested in test/harness-mcp-inject.test.ts.
+// JSON configs (Claude, Gemini, generic .mcp.json) use the universal
+// `mcpServers` shape; OpenCode's project `opencode.json` uses its own `mcp`
+// shape (see routeOpenCodeThroughProxy). TOML/YAML (Codex, Goose) go through
+// the format-specific writers. Unit-tested in test/harness-mcp-inject.test.ts.
 import fs from "node:fs";
 import path from "node:path";
-import { agentMcpConfigTargets, bivyToolsServerSpec, routeThroughProxy, withBivyToolsServer, } from "./mcp-config.js";
+import { agentMcpConfigTargets, bivyToolsServerSpec, isOpenCodeConfigFile, routeOpenCodeThroughProxy, routeThroughProxy, toOpenCodeLocalServer, withBivyToolsServer, withOpenCodeBivyToolsServer, } from "./mcp-config.js";
 import { injectTomlMcp, injectYamlMcp, insertTomlServer } from "./mcp-config-formats.js";
 /** The proxy launcher Bivy injects — `bivy mcp-proxy …`. */
 export function bivyProxyLauncher(bivyCommand = "bivy") {
@@ -23,7 +24,9 @@ export function bivyProxyLauncher(bivyCommand = "bivy") {
 /**
  * Inject the proxy into a single JSON config file. Returns a restore thunk
  * (a no-op if the file was absent, unreadable, non-JSON, or had no stdio
- * servers to route). Never throws.
+ * servers to route). OpenCode project configs (`opencode.json`) use the
+ * OpenCode `mcp` shape; everything else uses the universal `mcpServers` shape.
+ * Never throws.
  */
 export function injectJsonMcpConfig(filePath, launcher) {
     let original;
@@ -40,7 +43,9 @@ export function injectJsonMcpConfig(filePath, launcher) {
     catch {
         return { injected: false, restore: () => { } };
     }
-    const result = routeThroughProxy(parsed, launcher);
+    const result = isOpenCodeConfigFile(filePath)
+        ? routeOpenCodeThroughProxy(parsed, launcher)
+        : routeThroughProxy(parsed, launcher);
     if (result.rewritten.length === 0)
         return { injected: false, restore: () => { } };
     // Preserve the file's indentation feel by re-serializing with 2 spaces; the
@@ -116,7 +121,9 @@ export function injectMcpConfigFile(filePath, launcher) {
  * servers a file already has), this CREATES the config when absent so an agent
  * that ships no MCP config still gets the tool. Handles the most-specific JSON
  * config (session-local for claude/gemini/opencode/generic) and Codex's TOML
- * (`~/.codex/config.toml` — Codex has no project-local option). restore() deletes
+ * (`~/.codex/config.toml` — Codex has no project-local option). OpenCode gets
+ * its native `{ mcp: { bivy: { type: "local", command: [...] } } }` shape — the
+ * universal `mcpServers` key is rejected by OpenCode's schema. restore() deletes
  * a file it created and rewrites the exact original bytes of one it modified.
  * Idempotent (a `bivy` server already present is a no-op, so concurrent sessions
  * sharing a global config don't double up). Best-effort; never throws. Goose YAML
@@ -131,6 +138,7 @@ export function injectBivyToolsForSession(agentId, ctx, bivyCommand = "bivy") {
         return { injected: [], restore: () => { } };
     const spec = bivyToolsServerSpec({ sessionId: ctx.sessionId, endpoint: ctx.endpoint, bivyCommand });
     const ext = path.extname(target).toLowerCase();
+    const openCode = agentId === "opencode" || isOpenCodeConfigFile(target);
     const existed = fs.existsSync(target);
     let original;
     if (existed) {
@@ -142,7 +150,22 @@ export function injectBivyToolsForSession(agentId, ctx, bivyCommand = "bivy") {
         }
     }
     let nextContent;
-    if (ext === ".json") {
+    if (ext === ".json" && openCode) {
+        let parsed = {};
+        if (original !== undefined) {
+            try {
+                parsed = JSON.parse(original);
+            }
+            catch {
+                return { injected: [], restore: () => { } };
+            }
+        }
+        const { config, added } = withOpenCodeBivyToolsServer(parsed, toOpenCodeLocalServer(spec));
+        if (!added)
+            return { injected: [], restore: () => { } };
+        nextContent = `${JSON.stringify(config, null, 2)}\n`;
+    }
+    else if (ext === ".json") {
         let parsed = {};
         if (original !== undefined) {
             try {

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/metadata.js

@@ -169,6 +169,24 @@ export class MetadataStore {
         this.data.sessions[id] = { ...prev, resumePending: pending, updatedAt: nowIso() };
         this.save();
     }
+    /** Set/clear the durable auto-resume time (rate/usage-limit recovery). Pass
+     *  null to clear. No-op when the row is missing or already in the requested
+     *  state, so it never churns the file on the hot turn path. */
+    setResumeAt(id, resumeAt) {
+        const prev = this.data.sessions[id];
+        if (!prev)
+            return;
+        const next = resumeAt ?? undefined;
+        if ((prev.resumeAt ?? undefined) === next)
+            return;
+        this.data.sessions[id] = { ...prev, resumeAt: next, updatedAt: nowIso() };
+        this.save();
+    }
+    /** Sessions with a durable auto-resume time set — the resume sweep re-arms
+     *  these after a restart. */
+    sessionsWithResumeAt() {
+        return Object.values(this.data.sessions).filter((s) => typeof s.resumeAt === "string" && s.resumeAt);
+    }
     /** Look up a session's durable metadata by id, or by session-file path. */
     getSession(idOrPath) {
         if (!idOrPath)

package/dist/policy/conditions.js

@@ -50,6 +50,48 @@ export function parseResetsAt(raw) {
     const iso = /(20\d\d-\d\d-\d\dT[\d:.]+(?:Z|[+-]\d\d:?\d\d))/.exec(raw);
     return iso?.[1];
 }
+/**
+ * Parse a bare wall-clock reset time — the shape Claude's subscription limits
+ * surface, e.g. `resets 12am (UTC)`, `resets at 3pm UTC`, `resets 09:00 UTC` —
+ * into the ISO timestamp of its NEXT occurrence (interpreted as UTC, which is
+ * what these messages state). Returns undefined when there's no clear clock
+ * time, so a relative phrase ("resets in 2 hours", handled by
+ * parseRetryAfterMs) or an unrelated number never masquerades as a reset.
+ *
+ * NB: a bare time-of-day can't say WHICH day, so for a multi-day window (a
+ * "weekly limit") this resolves to the nearest matching midnight, which may be
+ * earlier than the real reset. Prefer a structured resetsAtHint when available.
+ */
+export function parseResetClock(raw, nowMs) {
+    const m = /reset[a-z]*\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(raw);
+    if (!m)
+        return undefined;
+    const meridiem = m[3]?.toLowerCase();
+    // Require a real clock signal — a meridiem, an explicit minutes field, or a
+    // trailing UTC/GMT marker — so a bare "resets 5 nodes" can't parse as 05:00.
+    const tzFollows = /\b(?:utc|gmt)\b/i.test(raw.slice(m.index));
+    if (!meridiem && m[2] === undefined && !tzFollows)
+        return undefined;
+    let hour = Number(m[1]);
+    const minute = m[2] ? Number(m[2]) : 0;
+    if (hour > 23 || minute > 59)
+        return undefined;
+    if (meridiem === "am") {
+        if (hour === 12)
+            hour = 0;
+    }
+    else if (meridiem === "pm") {
+        if (hour !== 12)
+            hour += 12;
+    }
+    if (hour > 23)
+        return undefined;
+    const now = new Date(nowMs);
+    let target = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0);
+    if (target <= nowMs)
+        target += 86_400_000; // already past today → next day's occurrence
+    return new Date(target).toISOString();
+}
 // Ordered classifiers: the FIRST match wins, so more-specific/actionable
 // conditions are tested before broader ones (auth 401 before generic HTTP
 // noise; explicit billing/quota before a bare rate-limit; context-window before
@@ -58,7 +100,12 @@ const CLASSIFIERS = [
     { condition: "auth_failed", test: (r) => isAnthropicAuthError(r) },
     {
         condition: "credits_exhausted",
-        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session) limit (?:reached|hit)|(?:you(?:'ve| have)\s+)?hit your limit|out of credits|plan (?:limit|allowance)/i.test(r),
+        // Includes subscription usage caps — a Claude "5-hour" or "weekly" window
+        // hit reads "you've hit your weekly limit · resets 12am (UTC)". The window
+        // qualifier (weekly/daily/5-hour/7-day) is optional and may sit between
+        // "your" and "limit", so it must not break the match (it did before — the
+        // word "weekly" left these limits classified "unknown" and never resumed).
+        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session|weekly|daily|monthly|5[\s-]?hour|7[\s-]?day)[\s-]?limit(?:\s+(?:reached|hit))?|(?:you(?:'ve| have)\s+)?hit your (?:(?:weekly|daily|monthly|session|usage|5[\s-]?hour|7[\s-]?day)\s+)?limit|out of credits|plan (?:limit|allowance)/i.test(r),
     },
     {
         condition: "rate_limited",
@@ -86,7 +133,7 @@ const CLASSIFIERS = [
  * recovery metadata. Unmatched failures are `"unknown"` — deliberately left for
  * a human rather than blindly retried.
  */
-export function classifyFailure(error) {
+export function classifyFailure(error, opts = {}) {
     const raw = rawText(error).slice(0, 2000);
     const condition = CLASSIFIERS.find((c) => c.test(raw))?.condition ?? "unknown";
     const out = { condition, raw };
@@ -95,7 +142,11 @@ export function classifyFailure(error) {
         const retryAfterMs = parseRetryAfterMs(raw);
         if (retryAfterMs !== undefined)
             out.retryAfterMs = retryAfterMs;
-        const resetsAt = parseResetsAt(raw);
+        // Reset time, most-authoritative first: a structured hint the caller
+        // supplied (the provider's own usage snapshot), then an ISO stamp in the
+        // text, then a bare wall-clock ("resets 12am (UTC)") resolved to its next
+        // occurrence.
+        const resetsAt = opts.resetsAtHint ?? parseResetsAt(raw) ?? parseResetClock(raw, opts.now ?? Date.now());
         if (resetsAt !== undefined)
             out.resetsAt = resetsAt;
     }

package/dist/policy/run-policy.js

@@ -34,7 +34,7 @@ export function createRunPolicy(deps = {}) {
     const now = deps.now ?? Date.now;
     return {
         decide(ctx) {
-            const classified = classifyFailure(ctx.error);
+            const classified = classifyFailure(ctx.error, { now: now(), resetsAtHint: ctx.resetsAtHint });
             const { condition } = classified;
             const rule = findRule(ruleset, condition, context);
             if (!rule)
@@ -73,6 +73,7 @@ export function createRunPolicy(deps = {}) {
                     delayMs,
                     condition,
                     summary: `${condition}: transient — retrying (attempt ${nextAttempt}/${rule.maxAttempts})${timing}.`,
+                    ...(resetDelayMs !== undefined && classified.resetsAt ? { resetsAt: classified.resetsAt } : {}),
                 };
             }
             // action === "reroute": walk the chain from the current cursor, skipping

package/dist/policy/session-reroute.js

@@ -21,6 +21,17 @@
 // whether to suppress the turn's error toast before kicking off the async swap +
 // retry (`applyReroute`). Reroute happens only at the turn boundary, so there is
 // no partial-work hazard.
+//
+// It also plans the OTHER in-place recovery a live session can do: waiting out a
+// provider usage/rate limit and re-sending the same prompt when the window
+// resets (`planResume`). Unlike a reroute (which the controller applies itself),
+// a resume can be hours away and must survive a daemon restart, so scheduling +
+// persistence live in the caller (src/server.ts) — the controller only decides
+// whether a resume is warranted and by when.
+/** Below this, a "retry" is ordinary backoff (seconds) — not worth deferring an
+ *  interactive turn for; let it surface. A real usage/rate window reset is
+ *  minutes-to-days out and always clears this bar. */
+const MIN_RESUME_DELAY_MS = 60_000;
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class SessionRerouteController {
     deps;
@@ -50,6 +61,47 @@ export class SessionRerouteController {
             attempt: this.attempt,
             rerouteCount: this.rerouteCount,
         });
+        if (decision.action !== "reroute")
+            return null;
+        return this.rerouteFrom(decision, currentModel);
+    }
+    /**
+     * Decide whether this turn error should be recovered by WAITING for a provider
+     * usage/rate limit to reset and re-sending the same prompt. Returns a plan the
+     * caller should persist + schedule, or null (surface the error as usual).
+     *
+     * `resetsAtHint` is the authoritative reset time when the caller has one (the
+     * provider's structured usage snapshot) — essential for a multi-day "weekly"
+     * window, whose error text only states a time-of-day. `now` is injectable for
+     * deterministic tests. Pure w.r.t. the controller's counters.
+     */
+    planResume(rawError, currentModel, opts = {}) {
+        if (this.applying)
+            return null;
+        const now = opts.now ?? Date.now();
+        const decision = this.deps.policy.decide({
+            routing: { model: currentModel },
+            error: rawError,
+            attempt: this.attempt,
+            rerouteCount: this.rerouteCount,
+            resetsAtHint: opts.resetsAtHint,
+        });
+        if (decision.action !== "retry")
+            return null;
+        // Only defer for a concrete recovery window — a provider reset, or a delay
+        // long enough that it's clearly a limit rather than routine backoff.
+        if (decision.resetsAt === undefined && decision.delayMs < MIN_RESUME_DELAY_MS)
+            return null;
+        const resumeAt = decision.resetsAt ?? new Date(now + decision.delayMs).toISOString();
+        return { condition: decision.condition, summary: decision.summary, delayMs: Math.max(0, decision.delayMs), resumeAt };
+    }
+    /** Advance the attempt budget once the caller has committed to a resume, so a
+     *  limit that re-fires after the reset counts toward `maxAttempts` and can
+     *  eventually exhaust (→ park) instead of looping forever. */
+    noteResumeApplied() {
+        this.attempt += 1;
+    }
+    rerouteFrom(decision, currentModel) {
         if (decision.action !== "reroute")
             return null;
         const model = decision.routing.model;

package/dist/repo-workspace.js

@@ -164,6 +164,25 @@ export async function resolveBranchBaseRef(repoDir, branch) {
         throw new Error(`Branch "${branch}" was not found on the remote.`);
     }
 }
+/**
+ * Base ref for ADOPTING a source branch onto a fresh clone on another node (a
+ * cross-node fork). Prefers the pushed `origin/<branch>` so the source's
+ * committed work travels; falls back to the repo's default branch when the
+ * source branch was never pushed (best-effort — any uncommitted work still
+ * arrives via the fork's dirty patch). Fetches first so `origin/<branch>` is
+ * current. Contrast with `resolveBranchBaseRef`, which is user-facing and throws
+ * on a missing branch; a fork must degrade rather than fail.
+ */
+export async function resolveAdoptBaseRef(repoDir, branch) {
+    await fetchOrigin(repoDir);
+    try {
+        await exec("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `origin/${branch}`], { cwd: repoDir });
+        return `origin/${branch}`;
+    }
+    catch {
+        return resolveDefaultBaseRef(repoDir);
+    }
+}
 /**
  * Whether an existing Bivy-owned checkout at `dest` can be reused as-is, i.e. it
  * has a `.git` entry AND `git rev-parse` accepts it as a real repository. A

package/dist/runtime/anthropic-preflight.js

@@ -71,6 +71,47 @@ export function anthropicCredentialPreflight(env, deps = {}) {
 export function isAnthropicAuthError(raw) {
     return isModelAuthError(raw);
 }
+/**
+ * Safely validate that an Anthropic API key actually grants access, rather than
+ * trusting mere presence (B1). Uses `GET /v1/models` — an authenticated, read-only,
+ * zero-token endpoint — so it never spends inference budget or mutates anything.
+ *
+ * Only API keys (`sk-…`) are probed: OAuth subscription tokens and the `claude`
+ * CLI's on-disk/Keychain login have no comparably safe check, so for those we
+ * return `{ probed: false, ok: true }` and let presence stand. Any non-auth
+ * failure (network down, 5xx, timeout) is also `probed: false` — we only report
+ * `ok: false` when the provider affirmatively rejects the credential (401/403).
+ */
+export async function probeAnthropicAccess(apiKey, deps = {}) {
+    const key = apiKey?.trim();
+    // Subscription/OAuth tokens are not API keys; there is no safe read probe.
+    if (!key || !key.startsWith("sk-"))
+        return { probed: false, ok: true, reason: "no API key to probe" };
+    const doFetch = deps.fetch ?? fetch;
+    const base = (deps.baseUrl ?? "https://api.anthropic.com").replace(/\/+$/, "");
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? 4000);
+    try {
+        const res = await doFetch(`${base}/v1/models?limit=1`, {
+            method: "GET",
+            headers: { "x-api-key": key, "anthropic-version": "2023-06-01" },
+            signal: controller.signal,
+        });
+        if (res.ok)
+            return { probed: true, ok: true, status: res.status };
+        if (res.status === 401 || res.status === 403) {
+            return { probed: true, ok: false, status: res.status, reason: `Anthropic rejected the credential (${res.status})` };
+        }
+        // 429/5xx/etc. — the key may be fine; don't falsely fail readiness.
+        return { probed: false, ok: true, status: res.status, reason: `inconclusive (${res.status})` };
+    }
+    catch (error) {
+        return { probed: false, ok: true, reason: error instanceof Error ? error.message : "probe failed" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Phrase an SDK error for the user: an auth failure gets the sign-in guidance
  * appended; anything else is returned unchanged.

package/dist/runtime/codex-sessions.js

@@ -168,7 +168,16 @@ export function writeCodexRollout(history, cwd) {
     const stamp = iso.replace(/[:.]/g, "-").replace(/Z$/, "");
     const file = path.join(dir, `rollout-${stamp}-${id}.jsonl`);
     const records = [
-        { type: "session_meta", timestamp: iso, payload: { id, timestamp: iso, cwd, cli_version: "bivy-fork" } },
+        // Codex's SessionMeta parser requires `originator`. Without it the first
+        // record is discarded as malformed; `thread/resume` then reaches the first
+        // response_item and fails with "does not start with session metadata".
+        // Keep both ids: current Codex accepts legacy `id`-only records, but writing
+        // the canonical `session_id` makes the synthetic rollout valid directly.
+        {
+            type: "session_meta",
+            timestamp: iso,
+            payload: { session_id: id, id, timestamp: iso, cwd, originator: "bivy", cli_version: "bivy-fork" },
+        },
         ...history.map((message) => ({
             type: "response_item",
             timestamp: iso,

package/dist/runtime/credential-store.js

@@ -34,6 +34,37 @@ function isStoredCredential(value) {
 function providerId(id) {
     return String(id ?? "").trim().toLowerCase();
 }
+/**
+ * Should an `incoming` credential replace the `local` one during a non-destructive
+ * `importAll` merge? Pure and exported so the convergence rule is unit-testable
+ * without a vault. Rules:
+ *  - No local entry → take the incoming one.
+ *  - Only OAuth-vs-OAuth needs freshness arbitration (an api-key set/replace, or a
+ *    type switch, keeps the existing "incoming wins on a real content change").
+ *  - A snapshot that omits the refresh token must never clobber a usable one —
+ *    rotated refresh tokens are single-use, so an incoming with a blank refresh is
+ *    strictly worse than a local one that still has it.
+ *  - Prefer the token minted LATER by `refreshedAt` (monotonic mint order) when
+ *    both carry it; otherwise fall back to the access-token `expires`. In both
+ *    cases a tie KEEPS the local credential (strictly-greater wins), so an equal
+ *    stamp can't needlessly churn/rotate the vault, and clock skew can't let an
+ *    equal-`expires` stale token win.
+ */
+export function preferIncomingCredential(local, incoming) {
+    if (!local)
+        return true;
+    if (local.type !== "oauth" || incoming.type !== "oauth")
+        return true;
+    const localRefresh = String(local.refresh ?? "").trim();
+    const incomingRefresh = String(incoming.refresh ?? "").trim();
+    if (!incomingRefresh && localRefresh)
+        return false;
+    const lt = Number(local.refreshedAt);
+    const it = Number(incoming.refreshedAt);
+    if (Number.isFinite(lt) && Number.isFinite(it))
+        return it > lt;
+    return (Number(incoming.expires) || 0) > (Number(local.expires) || 0);
+}
 /**
  * Encrypted, cross-process-locked credential vault backed by `<vaultDir>/auth.enc`.
  *
@@ -202,12 +233,10 @@ export class BivyCredentialStore {
                 if (!id || !isStoredCredential(incoming))
                     continue;
                 const local = vault[id];
-                if (incoming.type === "oauth" && local?.type === "oauth") {
-                    const localExpires = Number(local.expires) || 0;
-                    const incomingExpires = Number(incoming.expires) || 0;
-                    if (localExpires > incomingExpires)
-                        continue;
-                }
+                // Freshest-wins, rotation-safe (see preferIncomingCredential): a lagging
+                // or refresh-less snapshot must not overwrite a fresher local login.
+                if (!preferIncomingCredential(local, incoming))
+                    continue;
                 if (!(id in vault))
                     imported += 1;
                 // Only mark dirty on a real content change, so a snapshot that merely