@bivy/bivy 0.6.0 → 0.7.0

package/dist/diagnostics.js

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Redacted diagnostics export + privacy-safe activation instrumentation (B4d).
+//
+// A support bundle a user can share without leaking secrets, prompts, transcripts,
+// diffs, or repo contents: versions, health counters, a whitelisted set of config
+// flags (values still passed through redactSecrets defensively), and the activation
+// stage record. Everything user-authored stays on the node.
+import { redactSecrets } from "./redact.js";
+/** Ordered activation stages — the golden path from install to first useful task. */
+export const ACTIVATION_STAGES = ["install", "node_online", "runtime", "credential", "repo", "first_task"];
+/**
+ * Map the setup/doctor readiness booleans to a privacy-safe activation record —
+ * where the golden path is blocked, and where it flowed. No content, only the
+ * stage and its status. `null` for an unknown stage means "pending" (not reached).
+ */
+export function activationRecord(readiness) {
+    const status = (ok, skipWhenNull = false) => {
+        if (ok === null || ok === undefined)
+            return skipWhenNull ? "skipped" : "pending";
+        return ok ? "ok" : "blocked";
+    };
+    return [
+        { stage: "install", status: "ok" }, // reaching this code means the CLI installed
+        { stage: "node_online", status: status(readiness.nodeOnline) },
+        { stage: "runtime", status: status(readiness.runtimeReady) },
+        { stage: "credential", status: status(readiness.credentialReady, true) },
+        { stage: "repo", status: status(readiness.repoChosen) },
+        { stage: "first_task", status: status(readiness.firstTaskReady) },
+    ];
+}
+/** Env vars safe to include in a diagnostics bundle: non-secret config knobs only.
+ *  Anything not matching is dropped entirely (not just redacted). */
+const SAFE_ENV_KEYS = new Set([
+    "BIVY_APPROVAL_MODE", "BIVY_SANDBOX", "BIVY_RUNTIME", "BIVY_MULTI_USER_HOST",
+    "BIVY_REQUIRE_LOCAL_AUTH", "BIVY_TURN_TIMEOUT_MS", "BIVY_AUTOMATION_CHECKS",
+    "PORT", "BIVY_PUBLIC_URL",
+]);
+/** Deep-redact any string leaf in a JSON-ish value. */
+function redactDeep(value) {
+    if (typeof value === "string")
+        return redactSecrets(value);
+    if (Array.isArray(value))
+        return value.map(redactDeep);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = redactDeep(v);
+        return out;
+    }
+    return value;
+}
+/**
+ * Assemble a shareable diagnostics report. Only whitelisted config keys are
+ * included; every string leaf is passed through redactSecrets as a backstop so a
+ * value that slips in (a URL with an embedded token, say) is still masked.
+ */
+export function buildDiagnosticsReport(input) {
+    const config = {};
+    for (const [k, v] of Object.entries(input.env ?? {})) {
+        if (SAFE_ENV_KEYS.has(k) && typeof v === "string" && v.length)
+            config[k] = redactSecrets(v);
+    }
+    return {
+        version: input.version ?? "unknown",
+        platform: input.platform ?? "unknown",
+        nodeVersion: input.nodeVersion ?? "unknown",
+        relayConfigured: Boolean(input.relayConfigured),
+        health: redactDeep(input.health ?? {}),
+        config,
+        activation: input.activation ?? [],
+        generatedAt: input.generatedAt ?? "",
+    };
+}

package/dist/github-tasks.js

@@ -308,11 +308,15 @@ export function pickupMessage(nodeName) {
  * the control plane, not a GitHub label — touches the issue's labels at all.
  */
 export async function announcePickup(cfg, issueNumber, nodeName) {
-    await addLabel(cfg, issueNumber, cfg.claimLabel).catch(() => { });
+    // Best-effort and idempotent, but not silent (A4): a failed claim label can let
+    // another node pick up the same issue, and a failed comment hides the pickup
+    // from the reporter — both are worth a warning in the node log/diagnostics.
+    const warn = (what, error) => console.warn(`[github-tasks] issue #${issueNumber}: could not ${what}:`, error instanceof Error ? error.message : error);
+    await addLabel(cfg, issueNumber, cfg.claimLabel).catch((error) => warn(`apply claim label "${cfg.claimLabel}"`, error));
     if (cfg.label && cfg.label !== cfg.claimLabel) {
-        await removeLabel(cfg, issueNumber, cfg.label).catch(() => { });
+        await removeLabel(cfg, issueNumber, cfg.label).catch((error) => warn(`remove routing label "${cfg.label}"`, error));
     }
-    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch(() => { });
+    await commentIssue(cfg, issueNumber, pickupMessage(nodeName)).catch((error) => warn("post pickup comment", error));
 }
 export async function defaultBranch(cfg) {
     const res = await gh(cfg, "GET", "");
@@ -322,11 +326,27 @@ export async function defaultBranch(cfg) {
     return data.default_branch || "main";
 }
 export async function openPullRequest(cfg, input) {
+    // Idempotent across retry/reclaim (C4a). Creating a PR is an external effect
+    // that must not duplicate when the same item is retried on this node or
+    // reclaimed by another. A PR for this head may already exist — from a prior
+    // attempt or the agent's own `gh pr create` — so reuse it instead of POSTing
+    // blindly (GitHub 422s "a pull request already exists", which the old code
+    // reported as failure, silently losing the PR reference).
+    const branch = input.head.includes(":") ? input.head.slice(input.head.indexOf(":") + 1) : input.head;
+    const existing = await findOpenPullRequestForBranch(cfg, branch);
+    if (existing)
+        return existing;
     const res = await gh(cfg, "POST", "/pulls", input);
-    if (!res.ok)
-        return undefined;
-    const data = (await res.json().catch(() => ({})));
-    return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    if (res.ok) {
+        const data = (await res.json().catch(() => ({})));
+        return data.html_url ? { url: data.html_url, number: Number(data.number) } : undefined;
+    }
+    // 422 = a PR for this head/base already exists (opened concurrently, e.g. by a
+    // node that reclaimed the item mid-flight). Recover its reference rather than
+    // reporting failure and re-attempting.
+    if (res.status === 422)
+        return findOpenPullRequestForBranch(cfg, branch);
+    return undefined;
 }
 /**
  * Update an existing pull request's title and/or body. Used to refresh the

package/dist/guard.js

@@ -4,8 +4,14 @@ import path from "node:path";
 export function bashCommand(input) {
     if (!input || typeof input !== "object")
         return "";
-    const command = input.command;
-    return typeof command === "string" ? command : "";
+    const value = input;
+    // Structured agents use different names for their shell surface. Keep this
+    // intentionally small and factual; unknown tools are not magically governed.
+    for (const key of ["command", "cmd", "script"]) {
+        if (typeof value[key] === "string")
+            return value[key];
+    }
+    return "";
 }
 /** Heuristic for the legacy "risky" mode (prompt-heavy). */
 export function looksRiskyBash(command) {
@@ -15,15 +21,51 @@ export function looksRiskyBash(command) {
     return (/(^|[;&|()\s])(rm|rmdir|mv|cp|chmod|chown|dd|mkfs|sudo|su|kill|pkill|curl|wget|git\s+(commit|push|reset|clean|checkout|switch|merge|rebase)|npm\s+(install|update|publish)|pnpm\s+(install|update|publish)|yarn\s+(add|install|upgrade|publish))([;&|()\s]|$)/.test(normalized) ||
         /(^|\s)(>|>>|2>|&>|tee\s+)/.test(normalized));
 }
+/** Parse dangerous recursive rm targets without a nested-quantifier regex. The
+ * input is user/agent controlled, so this intentionally stays linear-time. */
+function catastrophicRm(command) {
+    const systemRoots = ["/etc", "/usr", "/home", "/var", "/opt", "/boot", "/root", "/bin", "/sbin", "/lib", "/lib64"];
+    for (const segment of command.split(/[;\n|&]+/)) {
+        const tokens = segment.trim().split(/\s+/).map((token) => token.replace(/^["']|["']$/g, ""));
+        const rmIndex = tokens.lastIndexOf("rm");
+        if (rmIndex < 0)
+            continue;
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        for (const token of tokens.slice(rmIndex + 1)) {
+            if (token === "--recursive")
+                recursive = true;
+            else if (token === "--force")
+                force = true;
+            else if (token.startsWith("-") && !token.startsWith("--")) {
+                recursive ||= token.includes("r") || token.includes("R");
+                force ||= token.includes("f");
+            }
+            else if (!token.startsWith("--"))
+                targets.push(token);
+        }
+        if (!recursive || !force)
+            continue;
+        for (const rawTarget of targets) {
+            const target = rawTarget.length > 1 ? rawTarget.replace(/\/+$/, "") : rawTarget;
+            if (target === "/" || target === "~" || target === "$home" || target === "/*")
+                return true;
+            if (systemRoots.some((root) => target === root || target.startsWith(`${root}/`)))
+                return true;
+        }
+    }
+    return false;
+}
 /**
  * Catastrophic, irreversible, system-wide actions. Blocked OUTRIGHT in every mode
  * — the boundary that makes unattended autonomy safe rather than reckless.
  */
 export function looksCatastrophic(command) {
-    const c = command.trim().toLowerCase();
+    const c = command.trim().toLowerCase().slice(0, 100_000);
     if (!c)
         return false;
-    return (/\brm\s+(-\S*[rf]\S*\s+)+(\/|~|\$home|\/\*)(\s|$|\/)/.test(c) || // rm -rf / | ~ | /*
+    return (catastrophicRm(c) || // rm -rf / | ~ | system roots
         /\bmkfs(\.\w+)?\b/.test(c) ||
         /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|hd|disk)/.test(c) ||
         />\s*\/dev\/(sd|nvme|hd|disk)/.test(c) ||
@@ -76,11 +118,12 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     // case-sensitive compare silently disabled it for claude-code. Integration
     // tool names (MCP, etc.) keep their original casing via `isRiskyIntegration`.
     const tool = toolName.toLowerCase();
+    const isShell = tool === "bash" || tool === "shell" || tool === "execute" || tool === "run_command";
     // Tools that write to the filesystem and so must respect the workspace
     // boundary. MultiEdit/NotebookEdit also take a `file_path` (see toolPath).
     const isWrite = tool === "write" || tool === "edit" || tool === "multiedit" || tool === "notebookedit";
     // --- Hard floor: blocked in every mode ---
-    if (tool === "bash" && looksCatastrophic(bashCommand(input))) {
+    if (isShell && looksCatastrophic(bashCommand(input))) {
         return { decision: "deny", reason: "Blocked: catastrophic command (outside the safety boundary)" };
     }
     if (isWrite) {
@@ -95,15 +138,15 @@ export function guardToolCall(workspace, toolName, input, mode, isRiskyIntegrati
     if (isRiskyIntegration(toolName))
         return { decision: "ask" };
     if (mode === "autonomous") {
-        if (tool === "bash" && looksBackstop(bashCommand(input)))
+        if (isShell && looksBackstop(bashCommand(input)))
             return { decision: "ask" };
         return { decision: "allow" };
     }
     if (mode === "always") {
-        return { decision: tool === "bash" || isWrite ? "ask" : "allow" };
+        return { decision: isShell || isWrite ? "ask" : "allow" };
     }
     // "risky"
-    if (tool === "bash")
+    if (isShell)
         return { decision: looksRiskyBash(bashCommand(input)) ? "ask" : "allow" };
     return { decision: isWrite ? "ask" : "allow" };
 }

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/repo-workspace.js

@@ -164,6 +164,25 @@ export async function resolveBranchBaseRef(repoDir, branch) {
         throw new Error(`Branch "${branch}" was not found on the remote.`);
     }
 }
+/**
+ * Base ref for ADOPTING a source branch onto a fresh clone on another node (a
+ * cross-node fork). Prefers the pushed `origin/<branch>` so the source's
+ * committed work travels; falls back to the repo's default branch when the
+ * source branch was never pushed (best-effort — any uncommitted work still
+ * arrives via the fork's dirty patch). Fetches first so `origin/<branch>` is
+ * current. Contrast with `resolveBranchBaseRef`, which is user-facing and throws
+ * on a missing branch; a fork must degrade rather than fail.
+ */
+export async function resolveAdoptBaseRef(repoDir, branch) {
+    await fetchOrigin(repoDir);
+    try {
+        await exec("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `origin/${branch}`], { cwd: repoDir });
+        return `origin/${branch}`;
+    }
+    catch {
+        return resolveDefaultBaseRef(repoDir);
+    }
+}
 /**
  * Whether an existing Bivy-owned checkout at `dest` can be reused as-is, i.e. it
  * has a `.git` entry AND `git rev-parse` accepts it as a real repository. A

package/dist/runtime/anthropic-preflight.js

@@ -71,6 +71,47 @@ export function anthropicCredentialPreflight(env, deps = {}) {
 export function isAnthropicAuthError(raw) {
     return isModelAuthError(raw);
 }
+/**
+ * Safely validate that an Anthropic API key actually grants access, rather than
+ * trusting mere presence (B1). Uses `GET /v1/models` — an authenticated, read-only,
+ * zero-token endpoint — so it never spends inference budget or mutates anything.
+ *
+ * Only API keys (`sk-…`) are probed: OAuth subscription tokens and the `claude`
+ * CLI's on-disk/Keychain login have no comparably safe check, so for those we
+ * return `{ probed: false, ok: true }` and let presence stand. Any non-auth
+ * failure (network down, 5xx, timeout) is also `probed: false` — we only report
+ * `ok: false` when the provider affirmatively rejects the credential (401/403).
+ */
+export async function probeAnthropicAccess(apiKey, deps = {}) {
+    const key = apiKey?.trim();
+    // Subscription/OAuth tokens are not API keys; there is no safe read probe.
+    if (!key || !key.startsWith("sk-"))
+        return { probed: false, ok: true, reason: "no API key to probe" };
+    const doFetch = deps.fetch ?? fetch;
+    const base = (deps.baseUrl ?? "https://api.anthropic.com").replace(/\/+$/, "");
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? 4000);
+    try {
+        const res = await doFetch(`${base}/v1/models?limit=1`, {
+            method: "GET",
+            headers: { "x-api-key": key, "anthropic-version": "2023-06-01" },
+            signal: controller.signal,
+        });
+        if (res.ok)
+            return { probed: true, ok: true, status: res.status };
+        if (res.status === 401 || res.status === 403) {
+            return { probed: true, ok: false, status: res.status, reason: `Anthropic rejected the credential (${res.status})` };
+        }
+        // 429/5xx/etc. — the key may be fine; don't falsely fail readiness.
+        return { probed: false, ok: true, status: res.status, reason: `inconclusive (${res.status})` };
+    }
+    catch (error) {
+        return { probed: false, ok: true, reason: error instanceof Error ? error.message : "probe failed" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Phrase an SDK error for the user: an auth failure gets the sign-in guidance
  * appended; anything else is returned unchanged.

package/dist/runtime/codex-sessions.js

@@ -168,7 +168,16 @@ export function writeCodexRollout(history, cwd) {
     const stamp = iso.replace(/[:.]/g, "-").replace(/Z$/, "");
     const file = path.join(dir, `rollout-${stamp}-${id}.jsonl`);
     const records = [
-        { type: "session_meta", timestamp: iso, payload: { id, timestamp: iso, cwd, cli_version: "bivy-fork" } },
+        // Codex's SessionMeta parser requires `originator`. Without it the first
+        // record is discarded as malformed; `thread/resume` then reaches the first
+        // response_item and fails with "does not start with session metadata".
+        // Keep both ids: current Codex accepts legacy `id`-only records, but writing
+        // the canonical `session_id` makes the synthetic rollout valid directly.
+        {
+            type: "session_meta",
+            timestamp: iso,
+            payload: { session_id: id, id, timestamp: iso, cwd, originator: "bivy", cli_version: "bivy-fork" },
+        },
         ...history.map((message) => ({
             type: "response_item",
             timestamp: iso,

package/dist/runtime/credential-store.js

@@ -34,6 +34,37 @@ function isStoredCredential(value) {
 function providerId(id) {
     return String(id ?? "").trim().toLowerCase();
 }
+/**
+ * Should an `incoming` credential replace the `local` one during a non-destructive
+ * `importAll` merge? Pure and exported so the convergence rule is unit-testable
+ * without a vault. Rules:
+ *  - No local entry → take the incoming one.
+ *  - Only OAuth-vs-OAuth needs freshness arbitration (an api-key set/replace, or a
+ *    type switch, keeps the existing "incoming wins on a real content change").
+ *  - A snapshot that omits the refresh token must never clobber a usable one —
+ *    rotated refresh tokens are single-use, so an incoming with a blank refresh is
+ *    strictly worse than a local one that still has it.
+ *  - Prefer the token minted LATER by `refreshedAt` (monotonic mint order) when
+ *    both carry it; otherwise fall back to the access-token `expires`. In both
+ *    cases a tie KEEPS the local credential (strictly-greater wins), so an equal
+ *    stamp can't needlessly churn/rotate the vault, and clock skew can't let an
+ *    equal-`expires` stale token win.
+ */
+export function preferIncomingCredential(local, incoming) {
+    if (!local)
+        return true;
+    if (local.type !== "oauth" || incoming.type !== "oauth")
+        return true;
+    const localRefresh = String(local.refresh ?? "").trim();
+    const incomingRefresh = String(incoming.refresh ?? "").trim();
+    if (!incomingRefresh && localRefresh)
+        return false;
+    const lt = Number(local.refreshedAt);
+    const it = Number(incoming.refreshedAt);
+    if (Number.isFinite(lt) && Number.isFinite(it))
+        return it > lt;
+    return (Number(incoming.expires) || 0) > (Number(local.expires) || 0);
+}
 /**
  * Encrypted, cross-process-locked credential vault backed by `<vaultDir>/auth.enc`.
  *
@@ -202,12 +233,10 @@ export class BivyCredentialStore {
                 if (!id || !isStoredCredential(incoming))
                     continue;
                 const local = vault[id];
-                if (incoming.type === "oauth" && local?.type === "oauth") {
-                    const localExpires = Number(local.expires) || 0;
-                    const incomingExpires = Number(incoming.expires) || 0;
-                    if (localExpires > incomingExpires)
-                        continue;
-                }
+                // Freshest-wins, rotation-safe (see preferIncomingCredential): a lagging
+                // or refresh-less snapshot must not overwrite a fresher local login.
+                if (!preferIncomingCredential(local, incoming))
+                    continue;
                 if (!(id in vault))
                     imported += 1;
                 // Only mark dirty on a real content change, so a snapshot that merely

package/dist/runtime/index.js

@@ -40,6 +40,21 @@ import { ensureCodexAuth } from "./codex-auth.js";
 import { parserFactoryFor } from "./cli-parsers.js";
 import { sandboxTier, sandboxArgsFor, codexSandboxPolicy } from "../harness/sandbox.js";
 import { ProtocolRuntime, protocolRuntimeFromEnv, protocolCommandsFromEnv } from "./protocol.js";
+import { codexSlashCommands, opencodeSlashCommands } from "./slash-commands.js";
+/**
+ * On-disk slash commands (custom prompts/commands) for the CLI agents that keep
+ * them as markdown on the node — Codex's `$CODEX_HOME/prompts`, opencode's
+ * global + project `command` dirs. Populates their composer menu and makes an
+ * invoked `/name` actually run (see SlashCommandProvider). Any other agent has no
+ * such directory convention, so it returns undefined (no agent-native commands).
+ */
+function cliSlashCommands(id) {
+    if (id === "codex")
+        return codexSlashCommands();
+    if (id === "opencode")
+        return opencodeSlashCommands();
+    return undefined;
+}
 export * from "./types.js";
 export { NodeCredentialResolver, createCredentialStore } from "./credentials.js";
 const PI_CAPABILITIES = {
@@ -697,6 +712,9 @@ export function cliAgentManifest() {
             label: spec.displayName,
             command: spec.command,
             hidden: Boolean(spec.hidden),
+            supportTier: spec.supportTier ?? "beta",
+            certification: spec.testedVersion ? "release-tested" : (spec.supportTier ?? "beta") === "beta" ? "adapter-tested" : "unverified",
+            ...(spec.testedVersion ? { testedVersion: spec.testedVersion } : {}),
             headlessFlags: [...headless].filter((a) => !a.includes("{")),
             install: spec.install ?? null,
         };
@@ -979,6 +997,11 @@ function codexApprovalsInfo() {
             packages: false,
             fork: false,
             sessionDiscovery: true,
+            // getUsage() returns the shim's real token/cost snapshot, and `codex resume
+            // <id>` reopens the thread in Codex's TUI — advertise both so the catalog
+            // (and the pre-session picker) match what the session actually backs.
+            usageReporting: true,
+            interactiveTui: installed,
             // The governed/resumable Codex variant is the one that owns native
             // discovery+adoption (issue #156) — not the plain exec runtime below —
             // so an adopted session gets per-tool approvals from the moment it's
@@ -1095,7 +1118,12 @@ function codexAppServerRuntime(credsDir, tier) {
                 ],
             },
         ],
-        capabilities: { toolInterception: true, modelSelection: true, resume: true, nativeSessionDiscovery: true, nativeSessionAdoption: true },
+        // usageReporting: ProtocolSession.getUsage() already returns the shim's real
+        // token/cost snapshot — advertise it so the catalog matches what's backed.
+        // interactiveTui: `codex resume <rolloutId>` reopens the exact thread in
+        // Codex's own TUI (the same verified command as native discovery/takeover),
+        // gated on the codex binary being present — mirrors Claude's interactiveTui.
+        capabilities: { toolInterception: true, modelSelection: true, resume: true, usageReporting: true, interactiveTui: commandAvailable("codex"), nativeSessionDiscovery: true, nativeSessionAdoption: true },
         // Resume: the shim reconnects a prior thread via thread/resume by its rollout
         // id, and history preloads from the same on-disk rollout the exec path reads —
         // so takeover/reopen continues a governed session. (Validated on codex-cli
@@ -1112,6 +1140,15 @@ function codexAppServerRuntime(credsDir, tier) {
         // Bivy didn't start, so a pre-existing `codex` session can be adopted here
         // (the governed variant), never the plain exec runtime below.
         discoverNativeSessions: () => discoverNativeCodexSessions(),
+        // Codex custom prompts ($CODEX_HOME/prompts/*.md) → composer slash menu; an
+        // invoked one is expanded and sent as the turn (the app-server doesn't expand
+        // /prompt names itself). resolveCodexHome() matches the prepare'd CODEX_HOME.
+        slashCommands: codexSlashCommands(),
+        // "Continue in terminal": resume this exact thread in Codex's TUI by its
+        // rollout id. `codex resume <id>` is the same command native discovery and
+        // takeover already use (server.ts RESUME/NATIVE_RESUME maps); `env` carries
+        // the minted CODEX_HOME so the TUI reads the same auth.json chat did.
+        interactiveTui: ({ sessionRef, env }) => (sessionRef ? { command: "codex", args: ["resume", sessionRef], env } : null),
     });
 }
 // --- #2: the GENERAL ACP adapter (Agent Client Protocol) --------------------
@@ -1132,6 +1169,7 @@ function acpShimPath() {
  * ACP promotion path so both wrap agents identically.
  */
 function acpRuntimeOptions(opts) {
+    const slashCommands = cliSlashCommands(opts.id);
     return {
         id: opts.id,
         displayName: opts.displayName,
@@ -1141,6 +1179,9 @@ function acpRuntimeOptions(opts) {
         // the FIRST session (before the shim's hello lands); the hello confirms them.
         capabilities: { toolInterception: true, resume: true },
         resumable: true,
+        // An ACP-promoted opencode still surfaces/expands its on-disk commands (the
+        // ACP handshake doesn't carry them); a bare ACP agent has none.
+        ...(slashCommands ? { slashCommands } : {}),
         ...(opts.credsDir ? { credentials: createCredentialStore(opts.credsDir) } : {}),
     };
 }
@@ -1450,6 +1491,45 @@ const PICKER_RUNTIME_IDS = new Set([
     ...NON_CLI_PICKER_IDS,
     ...CLI_AGENT_IDS.filter((id) => !CLI_AGENT_SPECS[id].hidden),
 ]);
+function runtimeCertification(runtime) {
+    if (runtime.id === "pi")
+        return { certification: "release-tested", testedVersion: "0.83.0" };
+    if (runtime.id === "claude-code-sdk")
+        return { certification: "release-tested", testedVersion: "0.3.220" };
+    if (runtime.testedVersion)
+        return { certification: "release-tested", testedVersion: runtime.testedVersion };
+    return { certification: runtime.supportTier === "beta" ? "adapter-tested" : "unverified" };
+}
+function runtimeProtection(runtime) {
+    // Native SDK/CLI sandboxes receive the requested read-only/workspace/full tier
+    // in their own process boundary. The governed Codex path has both native
+    // sandbox flags and Bivy interception; label the stronger containment source.
+    const nativeSandbox = runtime.id === "claude-code-sdk" || runtime.id === "codex-approvals"
+        || (isCliAgentId(runtime.id) && Boolean(CLI_AGENT_SPECS[runtime.id].composeArgs));
+    if (nativeSandbox)
+        return {
+            protectionLevel: "native-sandbox",
+            protectionLabel: "Native sandbox",
+            protectionDetail: "This agent enforces Bivy's selected access tier in its native sandbox. Bivy tool controls may add approvals, but are not an OS jail of their own.",
+        };
+    if (runtime.capabilities.toolInterception)
+        return {
+            protectionLevel: "tool-controls",
+            protectionLabel: "Bivy tool controls",
+            protectionDetail: "Structured tool calls pass through Bivy policy and approvals. Shell heuristics prevent accidents, not adversarial escape.",
+        };
+    if (runtime.capabilities.mcpToolApprovals)
+        return {
+            protectionLevel: "mcp-controls",
+            protectionLabel: "MCP tools only",
+            protectionDetail: "Bivy governs MCP tool calls, but the agent's built-in shell and file operations still run with your user permissions.",
+        };
+    return {
+        protectionLevel: "user-permissions",
+        protectionLabel: "Runs as your user",
+        protectionDetail: "No Bivy-owned isolation or complete tool interception. Use a container/VM for unattended or untrusted work.",
+    };
+}
 export function listRuntimes(currentId) {
     return RUNTIME_CATALOG
         // Keep the current runtime visible even if hidden, so a session pinned to a
@@ -1472,7 +1552,7 @@ export function listRuntimes(currentId) {
         if (runtime.id === "acp")
             return acpInfo();
         return runtime;
-    }).map((runtime) => ({ ...runtime, current: runtime.id === currentId }));
+    }).map((runtime) => ({ ...runtime, ...runtimeProtection(runtime), ...runtimeCertification(runtime), current: runtime.id === currentId }));
 }
 export function makeRuntime(options) {
     const id = (options.runtime ?? process.env.BIVY_RUNTIME ?? "pi").toLowerCase();
@@ -1616,5 +1696,5 @@ function makeCliRuntime(id, options) {
                     : [a.replace(/\{id\}/g, sessionId).replace(/\{tier\}/g, tier)]),
             }
             : {};
-    return new ProcessRuntime({ id, displayName: spec.displayName, command: spec.command, args: runArgs, promptMode: spec.promptMode, credentials: createCredentialStore(options.credsDir), parserFactory: parserFactoryFor(parserId), preflight, prepare, model: cliModelConfig(id), thinking: cliThinkingConfig(id), usageReporting: cliUsageReporting(id), ...resumeOpts });
+    return new ProcessRuntime({ id, displayName: spec.displayName, command: spec.command, args: runArgs, promptMode: spec.promptMode, credentials: createCredentialStore(options.credsDir), parserFactory: parserFactoryFor(parserId), preflight, prepare, model: cliModelConfig(id), thinking: cliThinkingConfig(id), usageReporting: cliUsageReporting(id), slashCommands: cliSlashCommands(id), ...resumeOpts });
 }