@bivy/bivy 0.6.0 → 0.7.0-staging.101

package/README.md

@@ -199,24 +199,33 @@ Every environment variable, config file, and precedence rule:
 ## Approvals and sandboxing
 
 The default approval mode is **`autonomous`**: agents act without per-action
-prompts. Safety comes from a floor that applies in *every* mode — catastrophic
-commands and writes outside the workspace are refused outright, and a backstop
-set (force-push, publish, deploy, sudo) always pauses for a human.
+prompts. The actual protection depends on the selected runtime. Native-sandbox
+agents enforce the chosen access tier; structured runtimes also pass tool calls
+through Bivy's policy and approval layer. Process agents that Bivy cannot
+intercept run with your OS user permissions. The picker shows this distinction
+and requires confirmation before selecting that limited path.
+
+Where Bivy receives structured shell/file calls, a heuristic floor blocks known
+catastrophic commands and structured writes outside the workspace, and a
+backstop set (force-push, publish, deploy, sudo) pauses for a human. This catches
+accidents; it is not an adversarial isolation boundary.
 
 If you want to be asked about more, set the mode explicitly:
 
 ```bash
 BIVY_APPROVAL_MODE=risky    # prompt on risky shell commands and file edits
 BIVY_APPROVAL_MODE=always   # prompt on all shell commands and file edits
-BIVY_APPROVAL_MODE=never    # no prompts beyond the hard floor
+BIVY_APPROVAL_MODE=never    # no prompts; structured-tool heuristic blocks still apply where available
 ```
 
 Approve from the terminal, browser, or phone.
 
 Sandbox tiers (`read-only`, `workspace-write`, `danger-full-access`) are enforced
 natively by agents that support them — Codex, Claude Code, Gemini CLI, Qwen Code.
-Agents without a native sandbox are governed at the filesystem, MCP, and network
-layer. **Bivy does not ship its own OS-level jail in 0.1.**
+Agents without a native sandbox may expose structured tool or MCP controls, but
+those controls do not cover activity the agent performs outside those channels;
+some process adapters run entirely with your user permissions. Check the
+picker's Protection label. **Bivy does not currently ship its own OS-level jail.**
 
 ## Credentials
 

package/bin/acp-shim.mjs

@@ -57,45 +57,112 @@ function bivy(obj) {
 // --- ACP agent (child JSON-RPC over its stdio) ------------------------------
 const agent = spawn(agentCmd, agentArgs, { stdio: ["pipe", "pipe", "pipe"] });
 agent.stderr.on("data", (d) => process.stderr.write(`[acp-agent] ${d}`));
-agent.on("error", (e) => bivy({ type: "session.error", error: `acp agent spawn failed: ${e.message}` }));
-agent.on("exit", (code) => {
-  if (code && code !== 0) bivy({ type: "session.error", error: `acp agent exited (${code})` });
-});
-
 let nextId = 1;
 const pending = new Map(); // jsonrpc id -> {resolve, reject}
-function agentRequest(method, params) {
+let agentDead = null; // set to an Error once the child is gone
+
+/**
+ * The child is gone (spawn failure or exit). Every in-flight request must be
+ * rejected: without this, a CLI whose ACP mode doesn't exist leaves `initialize`
+ * pending forever and the daemon waits out its whole session.create timeout instead
+ * of surfacing the real reason. Fail fast, with the reason.
+ */
+function killPending(reason) {
+  if (agentDead) return;
+  agentDead = reason instanceof Error ? reason : new Error(String(reason));
+  bivy({ type: "session.error", error: agentDead.message });
+  for (const [id, p] of [...pending]) { pending.delete(id); p.reject(agentDead); }
+}
+agent.on("error", (e) => killPending(`acp agent spawn failed: ${e.message}`));
+agent.on("exit", (code, signal) => {
+  if (code || signal) killPending(`acp agent exited (${code ?? signal})`);
+});
+// Writing to a dead child's stdin raises EPIPE; with no listener that's an uncaught
+// exception that takes the shim down mid-turn instead of reporting the cause.
+agent.stdin.on("error", (e) => killPending(`acp agent stdin closed: ${e.message}`));
+
+function agentWrite(payload) {
+  if (agentDead) throw agentDead;
+  agent.stdin.write(`${JSON.stringify(payload)}\n`);
+}
+function agentRequest(method, params, { timeoutMs } = {}) {
   const id = nextId++;
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
-  return new Promise((resolve, reject) => pending.set(id, { resolve, reject }));
+  return new Promise((resolve, reject) => {
+    let timer;
+    pending.set(id, {
+      resolve: (v) => { clearTimeout(timer); resolve(v); },
+      reject: (e) => { clearTimeout(timer); reject(e); },
+    });
+    if (timeoutMs) {
+      timer = setTimeout(() => {
+        if (pending.delete(id)) reject(new Error(`acp ${method} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+    }
+    try { agentWrite({ jsonrpc: "2.0", id, method, params }); }
+    catch (e) { clearTimeout(timer); pending.delete(id); reject(e); }
+  });
 }
 function agentReply(id, result) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, result })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", id, result }); } catch { /* child gone; killPending already reported it */ }
 }
 function agentReplyError(id, code, message) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", id, error: { code, message } }); } catch { /* child gone */ }
 }
 function agentNotify(method, params) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", method, params }); } catch { /* child gone */ }
 }
 
 // --- session state ----------------------------------------------------------
 let sessionId = null;
 let cwd = process.cwd();
 let initialized = false;
+// The ACP config-option id that selects the model (usually "model"), learned from
+// session/new; used for the session/set_config_option fallback.
+let modelConfigId = "model";
+// A model chosen before the ACP session existed, applied once it does.
+let pendingModel = null;
 // toolCallId -> { requestId, options } so a later bivy tool.decision answers the
 // right ACP permission request with a concrete optionId.
 const permissionRequests = new Map();
 
 async function ensureInitialized() {
   if (initialized) return;
+  // Bounded: a binary that accepts the launch args but never speaks ACP would
+  // otherwise hang here until the daemon's own session timeout, hiding the cause.
   await agentRequest("initialize", {
     protocolVersion: 1,
     clientCapabilities: { fs: { readTextFile: true, writeTextFile: true } },
-  });
+  }, { timeoutMs: 20_000 });
   initialized = true;
 }
 
+/**
+ * ACP exposes a session's selectable models as a `select` config option on the
+ * session/new|load result (opencode: `configOptions: [{id:"model", currentValue,
+ * options:[{value,name}]}]`). Models are per-NODE — they depend on which providers
+ * the user has authenticated in the agent — so a hardcoded list would offer models
+ * the agent rejects. Publish what the agent actually reports, as a post-hello
+ * `runtime.models` event ProtocolRuntime folds into its picker.
+ */
+function publishModels(result) {
+  const options = Array.isArray(result?.configOptions) ? result.configOptions : [];
+  const modelOption = options.find((o) => String(o?.id ?? "") === "model" || String(o?.category ?? "") === "model");
+  const choices = Array.isArray(modelOption?.options) ? modelOption.options : [];
+  const models = choices
+    .map((o) => ({ id: String(o?.value ?? ""), name: String(o?.name ?? o?.value ?? "") }))
+    .filter((m) => m.id)
+    // ACP model ids are `provider/model`; split the provider so Bivy can group and
+    // scope provider-specific settings the same way it does for other runtimes.
+    .map((m) => ({ ...m, provider: m.id.includes("/") ? m.id.split("/")[0] : "agent" }));
+  if (!models.length) return;
+  modelConfigId = String(modelOption?.id ?? "model");
+  bivy({
+    type: "runtime.models",
+    models,
+    ...(modelOption?.currentValue ? { currentModel: String(modelOption.currentValue) } : {}),
+  });
+}
+
 // --- ACP → bivy: streamed session/update notifications ----------------------
 function onSessionUpdate(params) {
   const u = params?.update;
@@ -211,6 +278,33 @@ createInterface({ input: agent.stdout }).on("line", (line) => {
   if (msg.method === "session/update") onSessionUpdate(msg.params);
 });
 
+/**
+ * Select a model on the live ACP session. `session/set_model` is the direct form;
+ * agents that only expose the generic config-option surface take the same choice as
+ * `session/set_config_option`. A rejection propagates: ProtocolRuntime only commits
+ * the selection once we ack, so a model the agent won't accept must not look applied.
+ */
+async function setAgentModel(model) {
+  try {
+    await agentRequest("session/set_model", { sessionId, modelId: model }, { timeoutMs: 15_000 });
+  } catch (primary) {
+    try {
+      await agentRequest("session/set_config_option", { sessionId, configId: modelConfigId, value: model }, { timeoutMs: 15_000 });
+    } catch {
+      throw primary;
+    }
+  }
+}
+
+async function applyPendingModel() {
+  if (!pendingModel || !sessionId) return;
+  const model = pendingModel;
+  pendingModel = null;
+  // Best-effort: a stale pick shouldn't block the session from opening.
+  try { await setAgentModel(model); }
+  catch (e) { bivy({ type: "runtime.debug", message: `acp set_model failed: ${e instanceof Error ? e.message : String(e)}` }); }
+}
+
 // --- bivy commands in (daemon → us) -----------------------------------------
 async function onBivyCommand(msg) {
   const type = String(msg.type || "");
@@ -224,6 +318,8 @@ async function onBivyCommand(msg) {
         cwd = String(msg.cwd || msg.workspace || cwd);
         const res = await agentRequest("session/new", { cwd, mcpServers: [] });
         sessionId = res?.sessionId ?? res?.session?.id ?? null;
+        publishModels(res);
+        await applyPendingModel();
         bivy({ replyTo: id, ok: true, runtimeSessionRef: sessionId });
         return;
       }
@@ -235,11 +331,14 @@ async function onBivyCommand(msg) {
         try {
           const res = await agentRequest("session/load", { sessionId: ref, cwd, mcpServers: [] });
           sessionId = res?.sessionId ?? ref;
+          publishModels(res);
         } catch {
           // Agent doesn't support session/load — start fresh so the chat still opens.
           const res = await agentRequest("session/new", { cwd, mcpServers: [] });
           sessionId = res?.sessionId ?? null;
+          publishModels(res);
         }
+        await applyPendingModel();
         bivy({ replyTo: id, ok: true, runtimeSessionRef: sessionId });
         return;
       }
@@ -270,6 +369,19 @@ async function onBivyCommand(msg) {
         }
         return;
       }
+      case "model.set": {
+        const model = String(msg.model ?? "").trim();
+        if (!model) { bivy({ replyTo: id, ok: true }); return; }
+        if (!sessionId) {
+          // Chosen before the session exists — remember and apply at session/new.
+          pendingModel = model;
+          bivy({ replyTo: id, ok: true });
+          return;
+        }
+        await setAgentModel(model);
+        bivy({ replyTo: id, ok: true });
+        return;
+      }
       case "session.abort": {
         if (sessionId) agentNotify("session/cancel", { sessionId });
         if (id !== undefined) bivy({ replyTo: id, ok: true });
@@ -286,8 +398,10 @@ async function onBivyCommand(msg) {
 }
 
 // Announce capabilities: ACP agents are governed (per-tool permission) and
-// resumable (session/load). Models aren't part of the core ACP surface, so we
-// don't advertise a picker we can't drive.
+// resumable (session/load). modelSelection starts FALSE and is upgraded later by a
+// `runtime.models` event if the session reports selectable models — the list is
+// per-node (it depends on the providers the user has authenticated in the agent)
+// and only arrives with session/new, so claiming a picker here would be a guess.
 bivy({ type: "hello", runtime: { capabilities: { toolInterception: true, modelSelection: false, resume: true } } });
 
 createInterface({ input: process.stdin }).on("line", (line) => {

package/bin/agent-manifest.json

@@ -5,6 +5,8 @@
       "label": "Codex",
       "command": "codex",
       "hidden": true,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "exec"
       ],
@@ -18,6 +20,9 @@
       "label": "OpenCode",
       "command": "opencode",
       "hidden": false,
+      "supportTier": "supported",
+      "certification": "release-tested",
+      "testedVersion": "1.18.13",
       "headlessFlags": [
         "run",
         "-s"
@@ -32,6 +37,8 @@
       "label": "Aider",
       "command": "aider",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--yes-always",
         "--message"
@@ -46,6 +53,8 @@
       "label": "Hermes",
       "command": "hermes",
       "hidden": true,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [],
       "install": {
         "kind": "npm",
@@ -57,6 +66,8 @@
       "label": "Goose",
       "command": "goose",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "-t",
@@ -76,6 +87,8 @@
       "label": "Gemini CLI",
       "command": "gemini",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p",
         "-o",
@@ -92,6 +105,8 @@
       "label": "Qwen Code",
       "command": "qwen",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p",
         "--output-format",
@@ -108,6 +123,8 @@
       "label": "Cline",
       "command": "cline",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-y",
         "--id"
@@ -122,6 +139,8 @@
       "label": "Crush",
       "command": "crush",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "-q"
@@ -136,6 +155,8 @@
       "label": "Cursor",
       "command": "cursor-agent",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--force",
         "-p"
@@ -151,6 +172,8 @@
       "label": "GitHub Copilot",
       "command": "copilot",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--allow-all-tools",
         "-p"
@@ -165,6 +188,8 @@
       "label": "Grok",
       "command": "grok",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-p"
       ],
@@ -178,6 +203,8 @@
       "label": "Amp",
       "command": "amp",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "-x",
         "threads",
@@ -193,6 +220,8 @@
       "label": "Auggie",
       "command": "auggie",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--quiet",
         "--print"
@@ -207,6 +236,8 @@
       "label": "Droid",
       "command": "droid",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "exec",
         "--auto",
@@ -223,6 +254,8 @@
       "label": "Continue",
       "command": "cn",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "--auto",
         "-p"
@@ -237,6 +270,8 @@
       "label": "Kilo Code",
       "command": "kilo",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "run",
         "--auto",
@@ -252,6 +287,8 @@
       "label": "Rovo Dev",
       "command": "acli",
       "hidden": false,
+      "supportTier": "beta",
+      "certification": "adapter-tested",
       "headlessFlags": [
         "rovodev",
         "run",
@@ -265,6 +302,8 @@
       "label": "Codebuff",
       "command": "codebuff",
       "hidden": true,
+      "supportTier": "experimental",
+      "certification": "unverified",
       "headlessFlags": [
         "--continue"
       ],

package/bin/bivy.mjs

@@ -425,6 +425,25 @@ function run(cmd, args, opts = {}) {
   });
 }
 
+/** Fixed executable + fixed entry point for setup's inline model-auth stage.
+ * Keep this separate from the generic CLI forwarding helper: no user-provided
+ * command or argv value reaches this process boundary. */
+function runSetupModelLogin(config) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, nodeScriptArgs(bivyLoginEntry), {
+      stdio: "inherit",
+      cwd: repoRoot,
+      env: startEnv(config),
+      shell: false,
+    });
+    child.on("exit", (code) => resolve(code ?? 0));
+    child.on("error", (error) => {
+      console.error(c.red(`Failed to start model login: ${error.message}`));
+      resolve(1);
+    });
+  });
+}
+
 function runQuiet(cmd, args, opts = {}) {
   const res = spawnSync(cmd, args, { encoding: "utf8", ...opts });
   return { code: res.status ?? 1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
@@ -1530,7 +1549,7 @@ function cmdCompletions(args = []) {
   const shell = (args[0] || "").toLowerCase();
   const commands = [
     "run", "sessions", "ls", "resume", "promote", "rename", "nodes", "agents", "agents:install", "shim", "takeover", "token", "exec",
-    "send", "attach", "kill", "setup", "start", "stop", "restart", "status", "doctor", "logs", "login",
+    "send", "attach", "kill", "setup", "start", "stop", "restart", "status", "doctor", "diagnostics", "logs", "login",
     "update", "update:log", "open", "service", "secrets", "voice", "link", "relay:setup",
     "github:connect", "github:app-create", "github:app-connect", "github:app-sync", "prune", "uninstall", "help", "version",
   ];
@@ -3194,9 +3213,10 @@ async function cmdSetup(args = []) {
     config.env = { ...config.env, BIVY_RUNTIME: setupAgent.runtimeId };
     saveConfig(config);
   }
+  let agentReady = true;
   if (setupAgent && setupAgent.runtimeId !== "pi") {
-    const installed = await ensureSetupAgent(setupAgent);
-    if (!installed) console.log(c.yellow(`${setupAgent.label} was not fully installed. Install it later from the app or with 'bivy agents:install'.`));
+    agentReady = await ensureSetupAgent(setupAgent);
+    if (!agentReady) console.log(c.yellow(`${setupAgent.label} was not fully installed. Install it later from the app or with 'bivy agents:install'.`));
   }
   console.log(c.dim(`Default agent: ${setupAgent?.label || "Pi"}  (change in Settings; sign into your model from the agent's CLI/TUI or Settings → Keys & OAuth)`));
 
@@ -3211,13 +3231,17 @@ async function cmdSetup(args = []) {
     console.log(c.bold("\n  Remote access\n"));
 
     console.log("Bivy uses remote access to make agent sessions visible and steerable from your other devices.");
+    // If self-host endpoints are already provided via the environment, default to
+    // self-hosted so a scripted or self-hosted install doesn't have to re-pick it
+    // (BIVY_CONTROL_PLANE_URL / BIVY_RELAY_URL then pre-fill the URL prompts below).
+    const selfHostEnv = Boolean((process.env.BIVY_CONTROL_PLANE_URL || "").trim() || (process.env.BIVY_RELAY_URL || "").trim());
     const syncChoice = await askChoice(
       "Remote access",
       [
         { key: "h", label: "hosted (recommended — one node is free)" },
         { key: "s", label: "self-hosted (your own control plane + relay)" },
       ],
-      "h",
+      selfHostEnv ? "s" : "h",
     );
     const relayArgs = [];
     if (syncChoice === "s") {
@@ -3278,6 +3302,22 @@ async function cmdSetup(args = []) {
   // `bivy github:app-create` / `github:app-connect`. One app covers every repo,
   // and the node mints its own tokens, so there's no per-repo token to set up here.
 
+  // Model access is part of activation, not a post-success footnote. Pi/Aider use
+  // Bivy's provider login; offer it inline so setup cannot imply the first task
+  // is ready while the required credential is still absent. Agent-native auth is
+  // explained in the readiness checklist below because those CLIs own the flow.
+  if (setupAgent?.needsBivyModel && !hasModelConfig(config)) {
+    const signInNow = await askYesNo("Sign in to a model now so your first task can run?", true);
+    if (signInNow) {
+      rl.pause();
+      const loginCode = await runSetupModelLogin(config);
+      rl.resume();
+      if (loginCode !== 0 || !hasModelConfig(loadConfig())) {
+        console.log(c.yellow("Model sign-in did not complete. The node can start, but an agent reply still requires 'bivy login'."));
+      }
+    }
+  }
+
   // 4. Background service — always installed so the node keeps running (and stays
   // reachable remotely) after you close this terminal. No prompt.
   let started = false;
@@ -3296,9 +3336,17 @@ async function cmdSetup(args = []) {
     return;
   }
 
-  console.log(c.bold(c.green("\n  ✓ Your node is running.\n")));
-  printFirstRunSteps();
-  await finishSetupRemote(config, setupSession);
+  const finalConfig = loadConfig();
+  const modelReady = !setupAgent?.needsBivyModel || hasModelConfig(finalConfig);
+  console.log(c.bold(c.green("\n  ✓ Node running. Check first-task readiness below.\n")));
+  console.log(`  ${c.green("✓")} node reachable at ${url(finalConfig)}`);
+  console.log(`  ${agentReady ? c.green("✓") : c.yellow("!")} runtime ${agentReady ? `${setupAgent?.label || "Pi"} available` : "not installed — run 'bivy agents:install'"}`);
+  console.log(`  ${modelReady ? (setupAgent?.needsBivyModel ? c.green("✓") : c.dim("○")) : c.yellow("!")} model ${modelReady ? (setupAgent?.needsBivyModel ? "credential configured" : "agent-managed — verified by the first task") : "not configured — run 'bivy login'"}`);
+  console.log(`  ${c.dim("○")} repository chosen from the directory where you start Bivy`);
+  console.log(`  ${agentReady && modelReady ? c.green("✓") : c.yellow("!")} first task ${agentReady && modelReady ? "ready to try" : "blocked by the stage above"}`);
+  console.log(`  ${fs.existsSync(relayConfigPath) ? c.green("✓") : c.yellow("!")} remote ${fs.existsSync(relayConfigPath) ? "configured" : "not configured — run 'bivy relay:setup'"}\n`);
+  printFirstRunSteps(modelReady);
+  await finishSetupRemote(finalConfig, setupSession);
 }
 
 // Read and delete the one-time account-session handoff written by relay:setup
@@ -3385,11 +3433,11 @@ async function openRemoteApp(config, { setupSession = null, open = true } = {})
   return { relay, remoteBase, accountUrl, pairedUrl, openUrl };
 }
 
-function printFirstRunSteps() {
+function printFirstRunSteps(modelReady = false) {
   console.log("  Run your first task:");
-  console.log(`    1. Model access:  ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
-  console.log(`    2. Start chatting: ${c.cyan("bivy")}`);
-  console.log(`       One-shot task: ${c.cyan('bivy exec "explain this repository"')}\n`);
+  if (!modelReady) console.log(`    1. Model access:   ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
+  console.log(`    ${modelReady ? "1" : "2"}. Start chatting: ${c.cyan("bivy")}`);
+  console.log(`       Starter task:  ${c.cyan('bivy exec "explain this repository and identify one low-risk improvement"')}\n`);
 }
 
 async function finishSetupRemote(config, setupSession = null) {
@@ -3506,7 +3554,7 @@ async function cmdStatus(args = []) {
     console.log(`  sessions:  ${status.sessions?.open ?? 0} open, ${status.sessions?.indexed ?? 0} indexed${status.sessions?.active ? `, active ${status.sessions.active}` : ""}`);
     console.log(`  devices:   ${status.devices?.paired ?? 0} paired remote, ${status.devices?.localTokens ?? 0} local token(s)`);
     console.log(`  approvals: ${status.approvals?.pending ?? 0} pending`);
-    console.log(`  guard:     ${status.approvalMode || "autonomous"} (${status.guardrails?.workspaceBoundary ? "workspace boundary on" : "boundary unknown"})`);
+    console.log(`  guard:     ${status.approvalMode || "autonomous"} · ${status.guardrails?.protection || (status.guardrails?.workspaceBoundary ? "structured workspace controls" : "runs with user permissions")}`);
     if (status.updatedAt) {
       const when = new Date(status.updatedAt);
       console.log(`  updated:   ${Number.isNaN(when.getTime()) ? status.updatedAt : when.toLocaleString()}`);
@@ -3517,9 +3565,34 @@ async function cmdStatus(args = []) {
 
 // `bivy doctor` — one health screen: runtime deps, node reachability, model auth,
 // remote/relay, and agents on PATH.
+// `bivy diagnostics [--out <file>]` — fetch the node's redacted diagnostics
+// bundle (versions, health counters, whitelisted config, activation record — no
+// secrets/prompts/transcripts) and print it, or write it to a file to attach to a
+// support request. See src/diagnostics.ts for exactly what is (and isn't) included.
+async function cmdDiagnostics(args = []) {
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log('Usage: bivy diagnostics [--out <file>]\n\nPrint a redacted, shareable diagnostics bundle (no secrets, prompts, transcripts, or repo content). --out writes it to a file instead of stdout.');
+    return;
+  }
+  const config = loadConfig();
+  if (!(await ensureNodeRunning(config))) { console.error(c.red(`Could not reach the Bivy node at ${url(config)}.`)); process.exit(1); return; }
+  let report;
+  try { report = await localApi(config, "/api/diagnostics"); }
+  catch (error) { console.error(c.red(`Could not fetch diagnostics: ${error?.message || String(error)}`)); process.exit(1); return; }
+  const json = JSON.stringify(report, null, 2);
+  const outIdx = args.indexOf("--out");
+  const out = outIdx >= 0 && outIdx + 1 < args.length ? args[outIdx + 1] : undefined;
+  if (out) {
+    fs.writeFileSync(out, json + "\n");
+    console.log(c.green(`Wrote redacted diagnostics to ${out}`));
+  } else {
+    console.log(json);
+  }
+}
+
 async function cmdDoctor(args = []) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log("Usage: bivy doctor\n\nHealth check: runtime deps, node reachability, model auth, remote/relay, and agents on PATH. Exits non-zero if Node is unsupported or the node is unreachable, so it can gate CI/monitoring.");
+    console.log("Usage: bivy doctor\n\nHealth check: runtime deps, node reachability, model auth, remote/relay, and agents on PATH. Exits non-zero if Node is unsupported or the node is unreachable, so it can gate CI/monitoring. See also 'bivy diagnostics' for a shareable redacted bundle.");
     return;
   }
   if (!(await ensureDeps())) process.exit(1);
@@ -3565,6 +3638,16 @@ async function cmdDoctor(args = []) {
   const agentCommands = [...BUILTIN_TERMINAL_AGENTS.values()].filter((a) => a.type === "command").map((a) => a.command);
   const agents = agentCommands.filter((a) => commandExists(a));
   console.log(`  ${mark(agents.length > 0, true)} agents on PATH: ${agents.length ? c.cyan(agents.join(", ")) : c.dim("none (built-in Pi still works; 'bivy agents:install')")}`);
+  if (status?.eventLog) {
+    const healthy = status.eventLog.ok !== false;
+    const mib = Number(status.eventLog.bytes || 0) / (1024 * 1024);
+    console.log(`  ${mark(healthy, true)} event log ${healthy ? "writable" : `${status.eventLog.affectedSessions ?? 0} session(s) need attention`} · ${mib.toFixed(1)} MiB`);
+  }
+  if (status?.attachments) {
+    const mib = Number(status.attachments.bytes || 0) / (1024 * 1024);
+    const over = Number(status.attachments.overCapBytes || 0);
+    console.log(`  ${over > 0 ? warn : ok} attachments ${status.attachments.blobs ?? 0} blob(s), ${mib.toFixed(1)} MiB${over > 0 ? c.dim("  (over cap; referenced history retained)") : ""}`);
+  }
   console.log("");
 
   // Fail the command when a hard check is red (unsupported Node or an
@@ -4234,6 +4317,9 @@ An agent's own --help passes through, e.g. 'bivy run claude --help'.`);
     case "doctor":
       await cmdDoctor(args);
       break;
+    case "diagnostics":
+      await cmdDiagnostics(args);
+      break;
     case "logs":
       await cmdLogs(args);
       break;