@bivy/bivy 0.7.0-staging.107 → 0.7.0-staging.109

package/bin/bivy.mjs

@@ -3343,9 +3343,11 @@ async function cmdSetup(args = []) {
   console.log(`  ${agentReady ? c.green("✓") : c.yellow("!")} runtime ${agentReady ? `${setupAgent?.label || "Pi"} available` : "not installed — run 'bivy agents:install'"}`);
   console.log(`  ${modelReady ? (setupAgent?.needsBivyModel ? c.green("✓") : c.dim("○")) : c.yellow("!")} model ${modelReady ? (setupAgent?.needsBivyModel ? "credential configured" : "agent-managed — verified by the first task") : "not configured — run 'bivy login'"}`);
   console.log(`  ${c.dim("○")} repository chosen from the directory where you start Bivy`);
+  const ghReady = githubConnected(finalConfig);
+  console.log(`  ${ghReady ? c.green("✓") : c.dim("○")} GitHub ${ghReady ? "connected — your repos will list in the app" : c.dim("not connected — 'bivy github:connect' to list repos (optional)")}`);
   console.log(`  ${agentReady && modelReady ? c.green("✓") : c.yellow("!")} first task ${agentReady && modelReady ? "ready to try" : "blocked by the stage above"}`);
   console.log(`  ${fs.existsSync(relayConfigPath) ? c.green("✓") : c.yellow("!")} remote ${fs.existsSync(relayConfigPath) ? "configured" : "not configured — run 'bivy relay:setup'"}\n`);
-  printFirstRunSteps(modelReady);
+  printFirstRunSteps(modelReady, finalConfig);
   await finishSetupRemote(finalConfig, setupSession);
 }
 
@@ -3433,10 +3435,29 @@ async function openRemoteApp(config, { setupSession = null, open = true } = {})
   return { relay, remoteBase, accountUrl, pairedUrl, openUrl };
 }
 
-function printFirstRunSteps(modelReady = false) {
+// Whether GitHub is connected for repo listing/cloning. Bivy's own connect flow
+// (`bivy github:connect`, or the app's Connect button) writes BIVY_GITHUB_TOKEN
+// — usually a `secret://` vault reference — into cli.json's env; an explicit env
+// token counts too. A `gh auth login` session also works at runtime (the node
+// falls back to `gh auth token`), but that can't be known without shelling out,
+// so it's treated as "not connected here" — the hint is optional either way.
+function githubConnected(config = null) {
+  const token = String(
+    config?.env?.BIVY_GITHUB_TOKEN || process.env.BIVY_GITHUB_TOKEN || process.env.GITHUB_TOKEN || "",
+  ).trim();
+  return Boolean(token);
+}
+
+function printFirstRunSteps(modelReady = false, config = null) {
   console.log("  Run your first task:");
-  if (!modelReady) console.log(`    1. Model access:   ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
-  console.log(`    ${modelReady ? "1" : "2"}. Start chatting: ${c.cyan("bivy")}`);
+  let n = 0;
+  if (!modelReady) console.log(`    ${++n}. Model access:   ${c.cyan("bivy login")}  ${c.dim("(for Pi; other agents use their own login)")}`);
+  // GitHub is optional — "No repo" sessions work without it — so this only shows
+  // when nothing is connected yet, and never blocks the flow.
+  if (!githubConnected(config)) {
+    console.log(`    ${++n}. GitHub ${c.dim("(optional)")}: ${c.cyan("bivy github:connect")}  ${c.dim("— lets the app list your repos; required for private ones")}`);
+  }
+  console.log(`    ${++n}. Start chatting: ${c.cyan("bivy")}`);
   console.log(`       Starter task:  ${c.cyan('bivy exec "explain this repository and identify one low-risk improvement"')}\n`);
 }
 
@@ -3614,6 +3635,17 @@ async function cmdDoctor(args = []) {
   console.log(c.bold("\n  Bivy doctor\n"));
   console.log(`  ${mark(hasSupportedNode())} Node ${process.version}${hasSupportedNode() ? "" : c.dim("  (needs >= 22.19.0)")}`);
   console.log(`  ${mark(commandExists("git"), true)} git${commandExists("git") ? "" : c.dim("  (recommended for repo-backed sessions)")}`);
+  // GitHub is optional (a "No repo" session needs none), so this only ever warns.
+  // `gh` is NOT required — it's a token fallback; the primary path is Bivy's own
+  // 'bivy github:connect' (or the app's Connect button). We surface gh only as an
+  // available shortcut when it's installed but nothing is connected yet.
+  const ghConnected = githubConnected(config);
+  const ghHint = ghConnected
+    ? c.green("connected")
+    : commandExists("gh")
+      ? c.dim("not connected — 'bivy github:connect' (or 'gh auth login')")
+      : c.dim("not connected — 'bivy github:connect' to list/clone private repos");
+  console.log(`  ${mark(ghConnected, true)} GitHub ${ghHint}`);
   console.log(`  ${mark(reachable)} node ${reachable ? c.green("reachable") : c.dim("not reachable — 'bivy start'")} at ${url(config)}`);
   console.log(`  ${mark(/running/.test(serviceStatusLine()), true)} ${serviceStatusLine()}`);
   const defaultAgent = String(config.env?.BIVY_RUNTIME || runtimes?.current?.id || "pi");

package/dist/github-device-auth.js

@@ -67,6 +67,22 @@ export function interpretTokenResponse(data) {
     }
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * A SINGLE access-token poll (no internal waiting) — for a caller that drives
+ * its own cadence. The web-driven connect flow uses this: the node holds the
+ * device code and the browser polls it on GitHub's interval, so the node never
+ * blocks a request thread in a poll loop. `pollForAccessToken` is the CLI's
+ * self-driving loop built on the same interpretation.
+ */
+export async function pollAccessTokenOnce(clientId, deviceCode) {
+    const res = await fetch(ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { accept: "application/json", "content-type": "application/json" },
+        body: JSON.stringify({ client_id: clientId, device_code: deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    return interpretTokenResponse(data);
+}
 /** Step 2: poll until the user authorizes (or the code expires). */
 export async function pollForAccessToken(clientId, device, signal) {
     let intervalMs = device.intervalSec * 1000;

package/dist/repo-workspace.js

@@ -100,6 +100,25 @@ export async function resolveGitHubToken(env = process.env) {
         return undefined;
     }
 }
+/**
+ * Whether the GitHub CLI (`gh`) is installed on this machine — used only to
+ * shade the "no GitHub token" message: when `gh` is present but `gh auth token`
+ * gave us nothing, the user is one `gh auth login` away, so the picker can say
+ * so. It never means `gh` is REQUIRED — `bivy github:connect` is the primary
+ * path and needs no CLI (see resolveGitHubToken). Mirrors the `command -v`
+ * probe in secrets.ts.
+ */
+export async function ghCliInstalled() {
+    const which = process.platform === "win32" ? "where" : "command";
+    const args = process.platform === "win32" ? ["gh"] : ["-v", "gh"];
+    try {
+        await exec(which, args, process.platform === "win32" ? {} : { shell: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Refresh the remote-tracking refs so a session branches off the CURRENT state
  * of `origin`, not whatever the local checkout last saw. Best-effort: an offline

package/dist/secrets.js

@@ -183,8 +183,12 @@ export class SecretVault {
         if (fs.existsSync(this.keyFile))
             checks.push({ name: "local key file permissions", ok: modeIsPrivate(this.keyFile), detail: this.keyFile });
         checks.push({ name: "1Password CLI", ok: await commandExists("op"), detail: "required for op:// references" });
-        checks.push({ name: "GitHub CLI", ok: await commandExists("gh"), detail: "fallback for GitHub tokens when no Bivy secret is configured" });
-        return { ok: checks.every((c) => c.ok || c.name === "1Password CLI" || c.name === "GitHub CLI"), checks };
+        checks.push({ name: "GitHub CLI (optional)", ok: await commandExists("gh"), detail: "optional token shortcut; Bivy connects GitHub itself via `bivy github:connect`" });
+        // 1Password and the GitHub CLI are optional shortcuts — a missing one must
+        // not fail the vault's health (Bivy connects GitHub itself; op is only for
+        // op:// refs). Match on a stable prefix so renaming the label can't silently
+        // turn either back into a hard failure.
+        return { ok: checks.every((c) => c.ok || c.name.startsWith("1Password CLI") || c.name.startsWith("GitHub CLI")), checks };
     }
     key() {
         try {

package/dist/server.js

@@ -60,7 +60,7 @@ import { checkDiskAdmission } from "./harness/disk-admission.js";
 import { sandboxTier, setConfiguredSandboxTier, normalizeSandboxTier } from "./harness/sandbox.js";
 import { setConfiguredAutoAttachToolImages } from "./harness/tool-image-attachments.js";
 import { injectMcpProxyForSession, injectBivyToolsForSession } from "./harness/mcp-inject.js";
-import { parseRepo, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, resolveAdoptBaseRef, fetchOrigin } from "./repo-workspace.js";
+import { parseRepo, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, ghCliInstalled, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, resolveAdoptBaseRef, fetchOrigin } from "./repo-workspace.js";
 import { configureGitAuth, writeGitCredentialEndpoint } from "./git-auth.js";
 import { GitHubTaskPoller, resolveGitHubTaskConfig, buildTaskPrompt, buildResumePrompt, buildInteractiveResumePrompt, DEFAULT_ISSUE_INSTRUCTIONS, parseBivyDirectives, commitAll, pushBranch, mergeBaseIntoBranch, completeMerge, abortMerge, findOpenPullRequestForBranch, findPullRequestsForBranch, findMergedPullRequestForBranch, issueBranchName, getPullRequest, commentIssue, listOpenLabelledIssues, selectActionableIssues, getIssue, getIssueCommentBody, addLabel, removeLabel, announcePickup, } from "./github-tasks.js";
 import { buildLinearTaskPrompt, getLinearIssue, linearBranchName } from "./linear-tasks.js";
@@ -84,6 +84,7 @@ import { ReplicationService } from "./session/replication-service.js";
 import { createSessionNewDedupe } from "./session/session-new-dedupe.js";
 import { evaluateForkPrereqs, blockingForkPrereqs, missingForkPrereqs } from "./session/fork-prereqs.js";
 import { SecretVault, resolveSecret } from "./secrets.js";
+import { deviceFlowClientId, requestDeviceCode, pollAccessTokenOnce, REPO_CONNECT_SCOPE } from "./github-device-auth.js";
 import { InstallationTokenCache, createAppJwt, resolveInstallationId } from "./github-app-auth.js";
 import { loadGitHubAppConfigs, orderAppsForOwner, listGitHubApps, removeGitHubApp, upsertGitHubApp, privateKeyIdFor, } from "./github-apps.js";
 import { buildAppManifest, convertManifest, renderManifestForm } from "./github-app-manifest.js";
@@ -2824,6 +2825,15 @@ const RELAY_COMMANDS = {
     async "repos.list"() {
         relay?.sendEvent({ type: "repos.list", ...(await listAccessibleRepos()) });
     },
+    // Web-driven "Connect GitHub" for the repo picker: start the node's device
+    // flow, then poll it on GitHub's interval. Both answer with the same
+    // `github.connect.status` event so the client has one shape to handle.
+    async "github.connect.start"() {
+        relay?.sendEvent({ type: "github.connect.status", ...(await startGithubConnect()) });
+    },
+    async "github.connect.poll"() {
+        relay?.sendEvent({ type: "github.connect.status", ...(await pollGithubConnect()) });
+    },
     // Branches for the repo the composer's repo pill just picked, so the branch
     // pill next to it can offer a specific remote branch to clone/base a new
     // session from instead of always the repo's default. See listRepoBranches.
@@ -10134,7 +10144,7 @@ async function listAccessibleRepos() {
     try {
         const token = await resolveGitHubToken();
         if (!token)
-            return { authed: false, repos: [] };
+            return { authed: false, repos: [], reason: (await ghCliInstalled()) ? "gh-unauthed" : "no-token" };
         const ghRes = await fetch("https://api.github.com/user/repos?sort=updated&per_page=100&affiliation=owner,collaborator,organization_member", {
             headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "bivy" },
         });
@@ -10159,6 +10169,83 @@ async function listAccessibleRepos() {
         return { authed: false, repos: [], error: error instanceof Error ? error.message : String(error) };
     }
 }
+let pendingGithubConnect = null;
+async function startGithubConnect() {
+    const clientId = deviceFlowClientId();
+    if (!clientId)
+        return { status: "unconfigured" };
+    try {
+        const device = await requestDeviceCode(clientId, REPO_CONNECT_SCOPE);
+        pendingGithubConnect = { clientId, device, expiresAt: Date.now() + device.expiresInSec * 1000 };
+        return {
+            status: "waiting",
+            userCode: device.userCode,
+            verificationUri: device.verificationUri,
+            intervalMs: device.intervalSec * 1000,
+            expiresInMs: device.expiresInSec * 1000,
+        };
+    }
+    catch (error) {
+        return { status: "error", error: error instanceof Error ? error.message : String(error) };
+    }
+}
+async function pollGithubConnect() {
+    const pending = pendingGithubConnect;
+    if (!pending)
+        return { status: "idle" };
+    if (Date.now() > pending.expiresAt) {
+        pendingGithubConnect = null;
+        return { status: "expired" };
+    }
+    let poll;
+    try {
+        poll = await pollAccessTokenOnce(pending.clientId, pending.device.deviceCode);
+    }
+    catch (error) {
+        // A transient network blip mid-flow — keep the code alive and let the client
+        // poll again rather than discarding a device code the user may have authorized.
+        return { status: "error", error: error instanceof Error ? error.message : String(error) };
+    }
+    switch (poll.status) {
+        case "ok":
+            pendingGithubConnect = null;
+            persistConnectedGithubToken(poll.token);
+            return { status: "connected" };
+        case "slow_down":
+            // GitHub says we're polling too fast — widen the interval it hands the
+            // browser so the next poll backs off (and doesn't burn the device code).
+            pending.device.intervalSec = poll.intervalSec ?? pending.device.intervalSec + 5;
+        // falls through — same "keep waiting" answer, just a larger interval.
+        case "pending":
+            return {
+                status: "waiting",
+                userCode: pending.device.userCode,
+                verificationUri: pending.device.verificationUri,
+                intervalMs: pending.device.intervalSec * 1000,
+                expiresInMs: Math.max(0, pending.expiresAt - Date.now()),
+            };
+        case "denied":
+            pendingGithubConnect = null;
+            return { status: "denied" };
+        case "expired":
+            pendingGithubConnect = null;
+            return { status: "expired" };
+        default:
+            pendingGithubConnect = null;
+            return { status: "error", error: poll.error };
+    }
+}
+// Store the repo-scoped token exactly like `bivy github:connect`: the raw token
+// in the node's secret vault, and only a `secret://` reference in cli.json. But
+// ALSO update the LIVE process env so resolveGitHubToken() picks it up without a
+// restart (the Tier-1 caveat), and drop the repo-list cache so the very next
+// list is authed.
+function persistConnectedGithubToken(token) {
+    new SecretVault(appDir).setLocal("github.repo-token", token, "GitHub repo/work-queue token");
+    saveCliEnv({ BIVY_GITHUB_TOKEN: "secret://github.repo-token" });
+    process.env.BIVY_GITHUB_TOKEN = "secret://github.repo-token";
+    invalidateGithubListingCaches();
+}
 // Fetch a repo's remote branch names with a given token (or none, for a public
 // repo). One GitHub call; returns null on a non-OK response so the caller can
 // decide whether to retry with a different token.
@@ -10582,6 +10669,13 @@ app.get("/github/app/manifest/callback", async (req, res, next) => {
 app.get("/api/repos", async (_req, res) => {
     res.json(await listAccessibleRepos());
 });
+// Direct-transport (local PWA) equivalents of the github.connect.* commands.
+app.post("/api/github/connect/start", async (_req, res) => {
+    res.json(await startGithubConnect());
+});
+app.get("/api/github/connect/poll", async (_req, res) => {
+    res.json(await pollGithubConnect());
+});
 app.get("/api/repos/branches", async (req, res) => {
     res.json(await listRepoBranches(String(req.query.repo || "").trim()));
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.7.0-staging.107",
+  "version": "0.7.0-staging.109",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",