@bivy/bivy 0.6.0 → 0.7.0-staging.95

package/dist/diagnostics.js

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Redacted diagnostics export + privacy-safe activation instrumentation (B4d).
+//
+// A support bundle a user can share without leaking secrets, prompts, transcripts,
+// diffs, or repo contents: versions, health counters, a whitelisted set of config
+// flags (values still passed through redactSecrets defensively), and the activation
+// stage record. Everything user-authored stays on the node.
+import { redactSecrets } from "./redact.js";
+/** Ordered activation stages — the golden path from install to first useful task. */
+export const ACTIVATION_STAGES = ["install", "node_online", "runtime", "credential", "repo", "first_task"];
+/**
+ * Map the setup/doctor readiness booleans to a privacy-safe activation record —
+ * where the golden path is blocked, and where it flowed. No content, only the
+ * stage and its status. `null` for an unknown stage means "pending" (not reached).
+ */
+export function activationRecord(readiness) {
+    const status = (ok, skipWhenNull = false) => {
+        if (ok === null || ok === undefined)
+            return skipWhenNull ? "skipped" : "pending";
+        return ok ? "ok" : "blocked";
+    };
+    return [
+        { stage: "install", status: "ok" }, // reaching this code means the CLI installed
+        { stage: "node_online", status: status(readiness.nodeOnline) },
+        { stage: "runtime", status: status(readiness.runtimeReady) },
+        { stage: "credential", status: status(readiness.credentialReady, true) },
+        { stage: "repo", status: status(readiness.repoChosen) },
+        { stage: "first_task", status: status(readiness.firstTaskReady) },
+    ];
+}
+/** Env vars safe to include in a diagnostics bundle: non-secret config knobs only.
+ *  Anything not matching is dropped entirely (not just redacted). */
+const SAFE_ENV_KEYS = new Set([
+    "BIVY_APPROVAL_MODE", "BIVY_SANDBOX", "BIVY_RUNTIME", "BIVY_MULTI_USER_HOST",
+    "BIVY_REQUIRE_LOCAL_AUTH", "BIVY_TURN_TIMEOUT_MS", "BIVY_AUTOMATION_CHECKS",
+    "PORT", "BIVY_PUBLIC_URL",
+]);
+/** Deep-redact any string leaf in a JSON-ish value. */
+function redactDeep(value) {
+    if (typeof value === "string")
+        return redactSecrets(value);
+    if (Array.isArray(value))
+        return value.map(redactDeep);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = redactDeep(v);
+        return out;
+    }
+    return value;
+}
+/**
+ * Assemble a shareable diagnostics report. Only whitelisted config keys are
+ * included; every string leaf is passed through redactSecrets as a backstop so a
+ * value that slips in (a URL with an embedded token, say) is still masked.
+ */
+export function buildDiagnosticsReport(input) {
+    const config = {};
+    for (const [k, v] of Object.entries(input.env ?? {})) {
+        if (SAFE_ENV_KEYS.has(k) && typeof v === "string" && v.length)
+            config[k] = redactSecrets(v);
+    }
+    return {
+        version: input.version ?? "unknown",
+        platform: input.platform ?? "unknown",
+        nodeVersion: input.nodeVersion ?? "unknown",
+        relayConfigured: Boolean(input.relayConfigured),
+        health: redactDeep(input.health ?? {}),
+        config,
+        activation: input.activation ?? [],
+        generatedAt: input.generatedAt ?? "",
+    };
+}

package/dist/github-tasks.js

@@ -308,11 +308,15 @@ export function pickupMessage(nodeName) {
  * the control plane, not a GitHub label — touches the issue's labels at all.
  */
 export async function announcePickup(cfg, issueNumber, nodeName) {
-    await addLabel(cfg, issueNumber, cfg.claimLabel).catch(() => { });
+    // Best-effort and idempotent, but not silent (A4): a failed claim label can let
+    // another node pick up the same issue, and a failed comment hides the pickup
+    // from the reporter — both are worth a warning in the node log/diagnostics.
+    const warn = (what, error) => console.warn(`[github-tasks] issue #${issueNumber}: could not ${what}:`, error instanceof Error ? error.message : error);
+    await addLabel(cfg, issueNumber, cfg.claimLabel).catch((error) => warn(`apply claim label "${cfg.claimLabel}"`, error));
     if (cfg.label && cfg.label !== cfg.claimLabel) {
-        await removeLabel(cfg, issueNumber, cfg.label).catch(() => { });
+        await removeLabel(cfg, issueNumber, cfg.label).catch((error) => warn(`remove routing label "${cfg.label}"`, error));
     }
-    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch(() => { });
+    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch((error) => warn("post pickup comment", error));
 }
 export async function defaultBranch(cfg) {
     const res = await gh(cfg, "GET", "");
@@ -322,11 +326,27 @@ export async function defaultBranch(cfg) {
     return data.default_branch || "main";
 }
 export async function openPullRequest(cfg, input) {
+    // Idempotent across retry/reclaim (C4a). Creating a PR is an external effect
+    // that must not duplicate when the same item is retried on this node or
+    // reclaimed by another. A PR for this head may already exist — from a prior
+    // attempt or the agent's own `gh pr create` — so reuse it instead of POSTing
+    // blindly (GitHub 422s "a pull request already exists", which the old code
+    // reported as failure, silently losing the PR reference).
+    const branch = input.head.includes(":") ? input.head.slice(input.head.indexOf(":") + 1) : input.head;
+    const existing = await findOpenPullRequestForBranch(cfg, branch);
+    if (existing)
+        return existing;
     const res = await gh(cfg, "POST", "/pulls", input);
-    if (!res.ok)
-        return undefined;
-    const data = (await res.json().catch(() => ({})));
-    return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    if (res.ok) {
+        const data = (await res.json().catch(() => ({})));
+        return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    }
+    // 422 = a PR for this head/base already exists (opened concurrently, e.g. by a
+    // node that reclaimed the item mid-flight). Recover its reference rather than
+    // reporting failure and re-attempting.
+    if (res.status === 422)
+        return findOpenPullRequestForBranch(cfg, branch);
+    return undefined;
 }
 /**
  * Update an existing pull request's title and/or body. Used to refresh the

package/dist/guard.js

@@ -4,8 +4,14 @@ import path from "node:path";
 export function bashCommand(input) {
     if (!input || typeof input !== "object")
         return "";
-    const command = input.command;
-    return typeof command === "string" ? command : "";
+    const value = input;
+    // Structured agents use different names for their shell surface. Keep this
+    // intentionally small and factual; unknown tools are not magically governed.
+    for (const key of ["command", "cmd", "script"]) {
+        if (typeof value[key] === "string")
+            return value[key];
+    }
+    return "";
 }
 /** Heuristic for the legacy "risky" mode (prompt-heavy). */
 export function looksRiskyBash(command) {
@@ -15,15 +21,51 @@ export function looksRiskyBash(command) {
     return (/(^|[;&|()\s])(rm|rmdir|mv|cp|chmod|chown|dd|mkfs|sudo|su|kill|pkill|curl|wget|git\s+(commit|push|reset|clean|checkout|switch|merge|rebase)|npm\s+(install|update|publish)|pnpm\s+(install|update|publish)|yarn\s+(add|install|upgrade|publish))([;&|()\s]|$)/.test(normalized) ||
         /(^|\s)(>|>>|2>|&>|tee\s+)/.test(normalized));
 }
+/** Parse dangerous recursive rm targets without a nested-quantifier regex. The
+ * input is user/agent controlled, so this intentionally stays linear-time. */
+function catastrophicRm(command) {
+    const systemRoots = ["/etc", "/usr", "/home", "/var", "/opt", "/boot", "/root", "/bin", "/sbin", "/lib", "/lib64"];
+    for (const segment of command.split(/[;\n|&]+/)) {
+        const tokens = segment.trim().split(/\s+/).map((token) => token.replace(/^["']|["']$/g, ""));
+        const rmIndex = tokens.lastIndexOf("rm");
+        if (rmIndex < 0)
+            continue;
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        for (const token of tokens.slice(rmIndex + 1)) {
+            if (token === "--recursive")
+                recursive = true;
+            else if (token === "--force")
+                force = true;
+            else if (token.startsWith("-") && !token.startsWith("--")) {
+                recursive ||= token.includes("r") || token.includes("R");
+                force ||= token.includes("f");
+            }
+            else if (!token.startsWith("--"))
+                targets.push(token);
+        }
+        if (!recursive || !force)
+            continue;
+        for (const rawTarget of targets) {
+            const target = rawTarget.length > 1 ? rawTarget.replace(/\/+$/, "") : rawTarget;
+            if (target === "/" || target === "~" || target === "$home" || target === "/*")
+                return true;
+            if (systemRoots.some((root) => target === root || target.startsWith(`${root}/`)))
+                return true;
+        }
+    }
+    return false;
+}
 /**
  * Catastrophic, irreversible, system-wide actions. Blocked OUTRIGHT in every mode
  * — the boundary that makes unattended autonomy safe rather than reckless.
  */
 export function looksCatastrophic(command) {
-    const c = command.trim().toLowerCase();
+    const c = command.trim().toLowerCase().slice(0, 100_000);
     if (!c)
         return false;
-    return (/\brm\s+(-\S*[rf]\S*\s+)+(\/|~|\$home|\/\*)(\s|$|\/)/.test(c) || // rm -rf / | ~ | /*
+    return (catastrophicRm(c) || // rm -rf / | ~ | system roots
         /\bmkfs(\.\w+)?\b/.test(c) ||
         /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|hd|disk)/.test(c) ||
         />\s*\/dev\/(sd|nvme|hd|disk)/.test(c) ||
@@ -76,11 +118,12 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     // case-sensitive compare silently disabled it for claude-code. Integration
     // tool names (MCP, etc.) keep their original casing via `isRiskyIntegration`.
     const tool = toolName.toLowerCase();
+    const isShell = tool === "bash" || tool === "shell" || tool === "execute" || tool === "run_command";
     // Tools that write to the filesystem and so must respect the workspace
     // boundary. MultiEdit/NotebookEdit also take a `file_path` (see toolPath).
     const isWrite = tool === "write" || tool === "edit" || tool === "multiedit" || tool === "notebookedit";
     // --- Hard floor: blocked in every mode ---
-    if (tool === "bash" && looksCatastrophic(bashCommand(input))) {
+    if (isShell && looksCatastrophic(bashCommand(input))) {
         return { decision: "deny", reason: "Blocked: catastrophic command (outside the safety boundary)" };
     }
     if (isWrite) {
@@ -95,15 +138,15 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     if (isRiskyIntegration(toolName))
         return { decision: "ask" };
     if (mode === "autonomous") {
-        if (tool === "bash" && looksBackstop(bashCommand(input)))
+        if (isShell && looksBackstop(bashCommand(input)))
             return { decision: "ask" };
         return { decision: "allow" };
     }
     if (mode === "always") {
-        return { decision: tool === "bash" || isWrite ? "ask" : "allow" };
+        return { decision: isShell || isWrite ? "ask" : "allow" };
     }
     // "risky"
-    if (tool === "bash")
+    if (isShell)
         return { decision: looksRiskyBash(bashCommand(input)) ? "ask" : "allow" };
     return { decision: isWrite ? "ask" : "allow" };
 }

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/mcp-config.js

@@ -3,12 +3,13 @@
 // Universal Agent Harness — MCP config rewriting.
 //
 // The one piece of MCP governance that is unavoidably per-agent is *where* the
-// config lives — but the shape is near-universal. Claude Code, Codex, Cursor,
-// Windsurf, and most MCP hosts use the same `{ mcpServers: { name: { command,
-// args, env } } }` object (stdio servers) plus optional remote (url) servers.
-// This module rewrites that object so every stdio server launches through the
-// Bivy MCP proxy instead of directly — turning each agent's own MCP config into
-// the injection point, with no agent-specific code beyond the file location.
+// config lives — and, for a couple of hosts, the shape. Claude Code, Cursor,
+// Windsurf, and most MCP hosts use `{ mcpServers: { name: { command, args, env
+// } } }` (stdio) plus optional remote (url) servers. OpenCode is the JSON
+// outlier: `{ mcp: { name: { type: "local", command: [bin, ...args],
+// environment } } }` (see opencode.ai/config.json). This module rewrites both
+// shapes so every stdio server launches through the Bivy MCP proxy instead of
+// directly — turning each agent's own MCP config into the injection point.
 //
 // Pure functions, no I/O — unit-tested in test/harness-mcp-config.test.ts. The
 // file-location table for each agent is data (see agentMcpConfigTargets) that
@@ -109,6 +110,88 @@ export function withBivyToolsServer(config, spec, name = "bivy") {
         return { config, added: false };
     return { config: { ...config, mcpServers: { ...servers, [name]: spec } }, added: true };
 }
+/** Convert a universal stdio server spec into OpenCode's local-server shape. */
+export function toOpenCodeLocalServer(spec) {
+    const command = [spec.command ?? "", ...(spec.args ?? [])].filter((s, i) => i === 0 || s !== undefined);
+    // Drop a leading empty command if somehow absent — callers always pass one.
+    const argv = command[0] ? command : command.slice(1);
+    const out = { type: "local", command: argv };
+    if (spec.env && Object.keys(spec.env).length)
+        out.environment = { ...spec.env };
+    return out;
+}
+/** True when an OpenCode local server already launches through the Bivy proxy. */
+export function isOpenCodeProxied(spec, launcher) {
+    if (!Array.isArray(spec.command) || spec.command.length === 0)
+        return false;
+    if (spec.command[0] !== launcher.command)
+        return false;
+    return spec.command.includes(PROXY_MARKER);
+}
+/**
+ * Rewrite every local stdio server in `config.mcp` to launch through the proxy:
+ *
+ *   original:  { type: "local", command: ["mcp-fs", "--root", "/w"], environment: {...} }
+ *   rewritten: { type: "local",
+ *                command: ["bivy", "mcp-proxy", "--bivy-mcp", "--server", "<name>", "--",
+ *                          "mcp-fs", "--root", "/w"],
+ *                environment: {...} }
+ *
+ * Remote servers and already-proxied locals are left untouched (reported in
+ * `skipped`). Idempotent. Does not mutate the input.
+ */
+export function routeOpenCodeThroughProxy(config, launcher) {
+    const rewritten = [];
+    const skipped = [];
+    const servers = config.mcp ?? {};
+    const nextServers = {};
+    for (const [name, spec] of Object.entries(servers)) {
+        if (!spec || typeof spec !== "object") {
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        if (!Array.isArray(spec.command) || spec.command.length === 0 || typeof spec.command[0] !== "string" || !spec.command[0]) {
+            // Remote/url server, enabled-only stub, or malformed — can't wrap via stdio proxy.
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        if (isOpenCodeProxied(spec, launcher)) {
+            nextServers[name] = spec;
+            skipped.push(name);
+            continue;
+        }
+        const prefix = launcher.argsPrefix ?? [];
+        const orig = spec.command;
+        nextServers[name] = {
+            ...spec,
+            type: "local",
+            command: [launcher.command, ...prefix, PROXY_MARKER, "--server", name, "--", ...orig],
+        };
+        rewritten.push(name);
+    }
+    return {
+        config: { ...config, mcp: nextServers },
+        rewritten,
+        skipped,
+    };
+}
+/**
+ * Insert the Bivy tools server under OpenCode's `mcp.<name>` (default "bivy").
+ * Idempotent: an existing entry of that name is left untouched.
+ */
+export function withOpenCodeBivyToolsServer(config, spec, name = "bivy") {
+    const servers = config.mcp ?? {};
+    if (servers[name])
+        return { config, added: false };
+    return { config: { ...config, mcp: { ...servers, [name]: spec } }, added: true };
+}
+/** Basename check for OpenCode project config files we inject into. */
+export function isOpenCodeConfigFile(filePath) {
+    const base = nodePath.basename(filePath).toLowerCase();
+    return base === "opencode.json" || base === ".opencode.json" || base === "opencode.jsonc" || base === ".opencode.jsonc";
+}
 /** JSON MCP-config file candidates for an agent, most-specific (safest) first. */
 export function agentMcpConfigTargets(agentId, ctx) {
     const ws = (...parts) => nodePath.join(ctx.workspace, ...parts);

package/dist/harness/mcp-inject.js

@@ -9,12 +9,13 @@
 // session-scoped (workspace-local files preferred) so a failure or a concurrent
 // session can't corrupt config: we snapshot the exact bytes and restore them.
 //
-// Only JSON configs are handled (Claude, Gemini, OpenCode, generic .mcp.json).
-// TOML/YAML-config agents are skipped — they still run and are governed by the
-// FS + network channels. Unit-tested in test/harness-mcp-inject.test.ts.
+// JSON configs (Claude, Gemini, generic .mcp.json) use the universal
+// `mcpServers` shape; OpenCode's project `opencode.json` uses its own `mcp`
+// shape (see routeOpenCodeThroughProxy). TOML/YAML (Codex, Goose) go through
+// the format-specific writers. Unit-tested in test/harness-mcp-inject.test.ts.
 import fs from "node:fs";
 import path from "node:path";
-import { agentMcpConfigTargets, bivyToolsServerSpec, routeThroughProxy, withBivyToolsServer, } from "./mcp-config.js";
+import { agentMcpConfigTargets, bivyToolsServerSpec, isOpenCodeConfigFile, routeOpenCodeThroughProxy, routeThroughProxy, toOpenCodeLocalServer, withBivyToolsServer, withOpenCodeBivyToolsServer, } from "./mcp-config.js";
 import { injectTomlMcp, injectYamlMcp, insertTomlServer } from "./mcp-config-formats.js";
 /** The proxy launcher Bivy injects — `bivy mcp-proxy …`. */
 export function bivyProxyLauncher(bivyCommand = "bivy") {
@@ -23,7 +24,9 @@ export function bivyProxyLauncher(bivyCommand = "bivy") {
 /**
  * Inject the proxy into a single JSON config file. Returns a restore thunk
  * (a no-op if the file was absent, unreadable, non-JSON, or had no stdio
- * servers to route). Never throws.
+ * servers to route). OpenCode project configs (`opencode.json`) use the
+ * OpenCode `mcp` shape; everything else uses the universal `mcpServers` shape.
+ * Never throws.
  */
 export function injectJsonMcpConfig(filePath, launcher) {
     let original;
@@ -40,7 +43,9 @@ export function injectJsonMcpConfig(filePath, launcher) {
     catch {
         return { injected: false, restore: () => { } };
     }
-    const result = routeThroughProxy(parsed, launcher);
+    const result = isOpenCodeConfigFile(filePath)
+        ? routeOpenCodeThroughProxy(parsed, launcher)
+        : routeThroughProxy(parsed, launcher);
     if (result.rewritten.length === 0)
         return { injected: false, restore: () => { } };
     // Preserve the file's indentation feel by re-serializing with 2 spaces; the
@@ -116,7 +121,9 @@ export function injectMcpConfigFile(filePath, launcher) {
  * servers a file already has), this CREATES the config when absent so an agent
  * that ships no MCP config still gets the tool. Handles the most-specific JSON
  * config (session-local for claude/gemini/opencode/generic) and Codex's TOML
- * (`~/.codex/config.toml` — Codex has no project-local option). restore() deletes
+ * (`~/.codex/config.toml` — Codex has no project-local option). OpenCode gets
+ * its native `{ mcp: { bivy: { type: "local", command: [...] } } }` shape — the
+ * universal `mcpServers` key is rejected by OpenCode's schema. restore() deletes
  * a file it created and rewrites the exact original bytes of one it modified.
  * Idempotent (a `bivy` server already present is a no-op, so concurrent sessions
  * sharing a global config don't double up). Best-effort; never throws. Goose YAML
@@ -131,6 +138,7 @@ export function injectBivyToolsForSession(agentId, ctx, bivyCommand = "bivy") {
         return { injected: [], restore: () => { } };
     const spec = bivyToolsServerSpec({ sessionId: ctx.sessionId, endpoint: ctx.endpoint, bivyCommand });
     const ext = path.extname(target).toLowerCase();
+    const openCode = agentId === "opencode" || isOpenCodeConfigFile(target);
     const existed = fs.existsSync(target);
     let original;
     if (existed) {
@@ -142,7 +150,22 @@ export function injectBivyToolsForSession(agentId, ctx, bivyCommand = "bivy") {
         }
     }
     let nextContent;
-    if (ext === ".json") {
+    if (ext === ".json" && openCode) {
+        let parsed = {};
+        if (original !== undefined) {
+            try {
+                parsed = JSON.parse(original);
+            }
+            catch {
+                return { injected: [], restore: () => { } };
+            }
+        }
+        const { config, added } = withOpenCodeBivyToolsServer(parsed, toOpenCodeLocalServer(spec));
+        if (!added)
+            return { injected: [], restore: () => { } };
+        nextContent = `${JSON.stringify(config, null, 2)}\n`;
+    }
+    else if (ext === ".json") {
         let parsed = {};
         if (original !== undefined) {
             try {

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/repo-workspace.js

@@ -164,6 +164,25 @@ export async function resolveBranchBaseRef(repoDir, branch) {
         throw new Error(`Branch "${branch}" was not found on the remote.`);
     }
 }
+/**
+ * Base ref for ADOPTING a source branch onto a fresh clone on another node (a
+ * cross-node fork). Prefers the pushed `origin/<branch>` so the source's
+ * committed work travels; falls back to the repo's default branch when the
+ * source branch was never pushed (best-effort — any uncommitted work still
+ * arrives via the fork's dirty patch). Fetches first so `origin/<branch>` is
+ * current. Contrast with `resolveBranchBaseRef`, which is user-facing and throws
+ * on a missing branch; a fork must degrade rather than fail.
+ */
+export async function resolveAdoptBaseRef(repoDir, branch) {
+    await fetchOrigin(repoDir);
+    try {
+        await exec("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `origin/${branch}`], { cwd: repoDir });
+        return `origin/${branch}`;
+    }
+    catch {
+        return resolveDefaultBaseRef(repoDir);
+    }
+}
 /**
  * Whether an existing Bivy-owned checkout at `dest` can be reused as-is, i.e. it
  * has a `.git` entry AND `git rev-parse` accepts it as a real repository. A

package/dist/runtime/anthropic-preflight.js

@@ -71,6 +71,47 @@ export function anthropicCredentialPreflight(env, deps = {}) {
 export function isAnthropicAuthError(raw) {
     return isModelAuthError(raw);
 }
+/**
+ * Safely validate that an Anthropic API key actually grants access, rather than
+ * trusting mere presence (B1). Uses `GET /v1/models` — an authenticated, read-only,
+ * zero-token endpoint — so it never spends inference budget or mutates anything.
+ *
+ * Only API keys (`sk-…`) are probed: OAuth subscription tokens and the `claude`
+ * CLI's on-disk/Keychain login have no comparably safe check, so for those we
+ * return `{ probed: false, ok: true }` and let presence stand. Any non-auth
+ * failure (network down, 5xx, timeout) is also `probed: false` — we only report
+ * `ok: false` when the provider affirmatively rejects the credential (401/403).
+ */
+export async function probeAnthropicAccess(apiKey, deps = {}) {
+    const key = apiKey?.trim();
+    // Subscription/OAuth tokens are not API keys; there is no safe read probe.
+    if (!key || !key.startsWith("sk-"))
+        return { probed: false, ok: true, reason: "no API key to probe" };
+    const doFetch = deps.fetch ?? fetch;
+    const base = (deps.baseUrl ?? "https://api.anthropic.com").replace(/\/+$/, "");
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? 4000);
+    try {
+        const res = await doFetch(`${base}/v1/models?limit=1`, {
+            method: "GET",
+            headers: { "x-api-key": key, "anthropic-version": "2023-06-01" },
+            signal: controller.signal,
+        });
+        if (res.ok)
+            return { probed: true, ok: true, status: res.status };
+        if (res.status === 401 || res.status === 403) {
+            return { probed: true, ok: false, status: res.status, reason: `Anthropic rejected the credential (${res.status})` };
+        }
+        // 429/5xx/etc. — the key may be fine; don't falsely fail readiness.
+        return { probed: false, ok: true, status: res.status, reason: `inconclusive (${res.status})` };
+    }
+    catch (error) {
+        return { probed: false, ok: true, reason: error instanceof Error ? error.message : "probe failed" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Phrase an SDK error for the user: an auth failure gets the sign-in guidance
  * appended; anything else is returned unchanged.

package/dist/runtime/codex-sessions.js

@@ -168,7 +168,16 @@ export function writeCodexRollout(history, cwd) {
     const stamp = iso.replace(/[:.]/g, "-").replace(/Z$/, "");
     const file = path.join(dir, `rollout-${stamp}-${id}.jsonl`);
     const records = [
-        { type: "session_meta", timestamp: iso, payload: { id, timestamp: iso, cwd, cli_version: "bivy-fork" } },
+        // Codex's SessionMeta parser requires `originator`. Without it the first
+        // record is discarded as malformed; `thread/resume` then reaches the first
+        // response_item and fails with "does not start with session metadata".
+        // Keep both ids: current Codex accepts legacy `id`-only records, but writing
+        // the canonical `session_id` makes the synthetic rollout valid directly.
+        {
+            type: "session_meta",
+            timestamp: iso,
+            payload: { session_id: id, id, timestamp: iso, cwd, originator: "bivy", cli_version: "bivy-fork" },
+        },
         ...history.map((message) => ({
             type: "response_item",
             timestamp: iso,