@bivy/bivy 0.9.1-staging.128 → 0.9.1-staging.130

package/dist/runtime/claude-code.js

@@ -1457,17 +1457,46 @@ export class ClaudeCodeRuntime {
         const projectDir = path.join(root, "projects", projectSlug);
         fs.mkdirSync(projectDir, { recursive: true });
         let parentUuid = null;
-        const lines = history.map((message) => {
+        const model = ctx.model?.provider === "anthropic"
+            ? ctx.model.id
+            : this.options.defaultModel ?? FALLBACK_MODELS.find((candidate) => candidate.id.includes("sonnet")).id;
+        const timestamp = Date.now();
+        const lines = history.map((turn, index) => {
             const uuid = randomUUID();
+            // Claude's store is permissive when read for display, but `--resume` / the
+            // Agent SDK expects provider-native assistant envelopes. Keep the portable
+            // history generic until this final serializer, then emit the same minimum
+            // shape as a real Claude transcript (content blocks, model/id, stop reason,
+            // usage and timestamps). This is the Claude counterpart to pi's native
+            // serializer and prevents a replay that paints correctly but fails on the
+            // first continued prompt.
+            const message = turn.role === "user"
+                ? { role: "user", content: turn.text }
+                : {
+                    model,
+                    id: `msg_bivy_${uuid.replace(/-/g, "")}`,
+                    type: "message",
+                    role: "assistant",
+                    content: [{ type: "text", text: turn.text }],
+                    stop_reason: "end_turn",
+                    stop_sequence: null,
+                    usage: {
+                        input_tokens: 0,
+                        cache_creation_input_tokens: 0,
+                        cache_read_input_tokens: 0,
+                        output_tokens: 0,
+                    },
+                };
             const entry = {
                 parentUuid,
                 isSidechain: false,
                 userType: "external",
                 cwd,
                 sessionId: newId,
-                type: message.role,
-                message: { role: message.role, content: message.text },
+                type: turn.role,
+                message,
                 uuid,
+                timestamp: new Date(timestamp + index).toISOString(),
             };
             parentUuid = uuid;
             return JSON.stringify(entry);

package/dist/runtime/pi.js

@@ -12,7 +12,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { completeSimple } from "@earendil-works/pi-ai/compat";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { createPiModelRuntime } from "./pi-oauth.js";
 import { toModelInfo as sharedToModelInfo } from "./normalize.js";
 import { provisionPiAuthJson } from "./credential-provisioning.js";
@@ -539,9 +539,48 @@ export class PiRuntime {
      * reconstruct provider-specific tool blocks. Never touches the source.
      */
     async importHistoryForFork(history, ctx) {
-        const sessionManager = SessionManager.create(ctx.cwd || ctx.workspace, this.options.sessionsDir);
-        for (const message of history) {
-            sessionManager.appendMessage({ role: message.role, content: message.text });
+        const cwd = ctx.cwd || ctx.workspace;
+        const sessionManager = SessionManager.create(cwd, this.options.sessionsDir);
+        const settings = SettingsManager.create(cwd, this.options.piDir);
+        const defaultProvider = settings.getDefaultProvider();
+        const defaultModel = settings.getDefaultModel();
+        const targetModel = ctx.model ?? (defaultProvider && defaultModel ? { provider: defaultProvider, id: defaultModel } : undefined);
+        const timestamp = Date.now();
+        for (const [index, message] of history.entries()) {
+            // SessionManager deliberately persists unvalidated objects. A bare
+            // `{role, content: string}` looks readable in the UI, but is NOT a valid
+            // pi AssistantMessage: the first real prompt later reaches provider and
+            // usage code that expects block-array content plus model/usage metadata.
+            // That was the codex→pi fork crash ("reading 'length'"). Materialise the
+            // portable prose as complete pi-ai messages instead.
+            const imported = message.role === "user"
+                ? {
+                    role: "user",
+                    content: [{ type: "text", text: message.text }],
+                    timestamp: timestamp + index,
+                }
+                : {
+                    role: "assistant",
+                    content: [{ type: "text", text: message.text }],
+                    // The target model is enough for pi to restore the requested model
+                    // before Bivy applies it again after stand-up. The synthetic API id
+                    // intentionally prevents provider-specific reasoning replay rules;
+                    // this history contains portable plain text only.
+                    api: "bivy-fork",
+                    provider: targetModel?.provider ?? "bivy-fork",
+                    model: targetModel?.id ?? "portable-history",
+                    usage: {
+                        input: 0,
+                        output: 0,
+                        cacheRead: 0,
+                        cacheWrite: 0,
+                        totalTokens: 0,
+                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+                    },
+                    stopReason: "stop",
+                    timestamp: timestamp + index,
+                };
+            sessionManager.appendMessage(imported);
         }
         const sessionFile = sessionManager.getSessionFile();
         if (!sessionFile)

package/dist/server.js

@@ -3598,27 +3598,12 @@ const RELAY_COMMANDS = {
         // changes into an E2E bundle the client carries to the destination node.
         const requestId = typeof msg.requestId === "string" ? msg.requestId : undefined;
         const rec = resolveSession(msg.sessionId);
-        if (!rec || !rec.sessionFile) {
-            relay?.sendEvent({ type: "session.fork.error", requestId, error: "Session not found or not resumable on this node." });
+        if (!rec) {
+            relay?.sendEvent({ type: "session.fork.error", requestId, error: "Session not found on this node." });
             return;
         }
         try {
-            const src = rec.source ?? "";
-            const repoSlug = src.startsWith("repo:") ? src.slice(5) : src.startsWith("issue:") ? src.slice(6).replace(/#\d+$/, "") : undefined;
-            const forkRecord = {
-                sourceSessionId: rec.id,
-                runtimeId: rec.runtimeId,
-                workspace: rec.workspace,
-                cwd: rec.session.cwd || rec.worktree?.path || rec.workspace,
-                worktree: rec.worktree?.path,
-                branch: rec.worktree?.branch,
-                repoSlug,
-                prUrl: rec.prUrl,
-                source: rec.source,
-                title: rec.session.getName(),
-                model: rec.session.getCurrentModel()?.name,
-                sandbox: rec.sandbox,
-            };
+            const forkRecord = forkRecordFor(rec);
             let dirtyPatch;
             if (rec.worktree) {
                 try {
@@ -3673,6 +3658,12 @@ const RELAY_COMMANDS = {
                 // so cut an independent fork branch instead of trying to adopt it.
                 worktree: msg.sameNode === true ? "fresh" : "adopt",
                 detectPrereqs: true,
+                // A same-node cross-agent fork can safely retain a non-repo workspace.
+                // A cross-node path belongs to the source machine, so standUpFork keeps
+                // its destination default unless repo metadata lets it reconstruct one.
+                ...(msg.sameNode === true
+                    ? { fallback: { workspace: bundle.record.workspace, cwd: bundle.record.cwd } }
+                    : {}),
             });
             if (!outcome.ok) {
                 relay?.sendEvent({ type: "session.fork.error", requestId, error: outcome.error, missing: outcome.missing });
@@ -3694,28 +3685,13 @@ const RELAY_COMMANDS = {
         // (model may still change); any node/agent change goes through import above.
         const requestId = typeof msg.requestId === "string" ? msg.requestId : undefined;
         const rec = resolveSession(msg.sessionId);
-        if (!rec || !rec.sessionFile) {
-            relay?.sendEvent({ type: "session.fork.error", requestId, error: "Session not found or not resumable on this node." });
+        if (!rec) {
+            relay?.sendEvent({ type: "session.fork.error", requestId, error: "Session not found on this node." });
             return;
         }
         try {
             const runtime = getRuntime(rec.runtimeId);
-            const src = rec.source ?? "";
-            const repoSlug = src.startsWith("repo:") ? src.slice(5) : src.startsWith("issue:") ? src.slice(6).replace(/#\d+$/, "") : undefined;
-            const forkRecord = {
-                sourceSessionId: rec.id,
-                runtimeId: rec.runtimeId,
-                workspace: rec.workspace,
-                cwd: rec.session.cwd || rec.worktree?.path || rec.workspace,
-                worktree: rec.worktree?.path,
-                branch: rec.worktree?.branch,
-                repoSlug,
-                prUrl: rec.prUrl,
-                source: rec.source,
-                title: rec.session.getName(),
-                model: rec.session.getCurrentModel()?.name,
-                sandbox: rec.sandbox,
-            };
+            const forkRecord = forkRecordFor(rec);
             // Carry uncommitted work: capture from the SOURCE worktree; standUpFork
             // re-applies it into the fork's fresh worktree. Local git ops only.
             let dirtyPatch;
@@ -6066,6 +6042,33 @@ async function withRepoLock(key, fn) {
     repoWorktreeLocks.set(key, run.then(() => { }, () => { }));
     return run;
 }
+/** Build the runtime-neutral metadata carried by both local and remote forks. */
+function forkRecordFor(rec) {
+    const src = rec.source ?? "";
+    const repoSlug = src.startsWith("repo:")
+        ? src.slice(5)
+        : src.startsWith("issue:")
+            ? src.slice(6).replace(/#\d+$/, "")
+            : undefined;
+    const currentModel = rec.session.getCurrentModel();
+    return {
+        sourceSessionId: rec.id,
+        runtimeId: rec.runtimeId,
+        workspace: rec.workspace,
+        cwd: rec.session.cwd || rec.worktree?.path || rec.workspace,
+        worktree: rec.worktree?.path,
+        branch: rec.worktree?.branch,
+        repoSlug,
+        prUrl: rec.prUrl,
+        source: rec.source,
+        title: rec.session.getName(),
+        model: currentModel?.name,
+        ...(currentModel?.provider && currentModel.id
+            ? { modelRef: { provider: String(currentModel.provider), id: String(currentModel.id) } }
+            : {}),
+        sandbox: rec.sandbox,
+    };
+}
 /**
  * Best-effort push of a fork SOURCE's branch to origin before the bundle leaves
  * the node, so a cross-node fork's committed work travels via origin (the
@@ -6198,7 +6201,13 @@ async function standUpFork(opts) {
     }
     // Materialise the transcript, then stand the session up — resume the imported
     // transcript (full) or a fresh session the caller seeds with plan.seedPrompt.
-    const plan = await materializeFork({ bundle, targetRuntime, ctx: { workspace, cwd }, seed: { transcriptUrl: opts.transcriptUrl } });
+    // Preserve the source model only when the runtime itself is unchanged. A
+    // cross-agent fork must let the destination choose its own default unless the
+    // caller explicitly supplied a model valid for that target. Thread the final
+    // choice through the generic import context: adapters that need native model
+    // metadata (Pi/Claude) can serialize it; the others simply ignore it.
+    const targetModel = opts.model ?? (targetRuntimeId === bundle.record.runtimeId ? bundle.record.modelRef : undefined);
+    const plan = await materializeFork({ bundle, targetRuntime, ctx: { workspace, cwd, model: targetModel }, seed: { transcriptUrl: opts.transcriptUrl } });
     const record = plan.kind === "resume"
         ? await createSession(cwd, plan.sessionFile, { runtimeId: targetRuntimeId, source: bundle.record.source, sandbox: forkSandbox, makeActive: false })
         : await createSession(cwd, undefined, { runtimeId: targetRuntimeId, source: bundle.record.source, sandbox: forkSandbox, makeActive: false });
@@ -6224,7 +6233,7 @@ async function standUpFork(opts) {
     // cleanly, so the fork isn't silently missing work-in-progress.
     if (dirtyWarning)
         broadcast({ type: "session.notice", sessionId: record.id, message: dirtyWarning });
-    await applyRequestedModel(record, opts.model ?? nodeDefaultModel() ?? undefined);
+    await applyRequestedModel(record, targetModel);
     persistSessionMetadata(record);
     scheduleAdvertise();
     const missing = opts.detectPrereqs

package/dist/session/fork.js

@@ -12,7 +12,17 @@ export function buildForkBundle(opts) {
     // Prefer the build-free readMessages fast path (pi/Claude); fall back to the
     // live session's transcript for runtimes without one (the generic CLI runtime),
     // so a fork *from* any agent still carries its real history.
-    const messages = runtime.readMessages?.(sessionFile) ?? opts.liveMessages;
+    let messages = opts.liveMessages;
+    if (sessionFile && runtime.readMessages) {
+        try {
+            messages = runtime.readMessages(sessionFile) ?? messages;
+        }
+        catch {
+            // Runtime-native readers are best-effort. The live transcript is the
+            // universal source fallback and keeps one broken adapter from blocking a
+            // fork out to every other agent.
+        }
+    }
     const normalized = normalizeMessages(messages, {
         sourceRuntimeId: runtime.id,
         model: record.model,
@@ -21,9 +31,16 @@ export function buildForkBundle(opts) {
     });
     // Only worth capturing when the target is the same runtime (or not yet known).
     const nativeCouldReplay = !opts.targetRuntimeId || opts.targetRuntimeId === runtime.id;
-    const native = nativeCouldReplay && runtime.capabilities.forkTransport && runtime.exportForFork
-        ? runtime.exportForFork(sessionFile)
-        : undefined;
+    let native;
+    if (sessionFile && nativeCouldReplay && runtime.capabilities.forkTransport && runtime.exportForFork) {
+        try {
+            native = runtime.exportForFork(sessionFile);
+        }
+        catch {
+            // A native export is an optimization, never the only route. The portable
+            // transcript below still supports replay or a seeded continuation.
+        }
+    }
     return { record, normalized, ...(native ? { native } : {}), ...(opts.dirtyPatch ? { dirtyPatch: opts.dirtyPatch } : {}) };
 }
 /**
@@ -47,6 +64,7 @@ export function resolveForkFidelity(bundle, targetRuntime) {
         return "full";
     const canReplayHistory = !!targetRuntime.capabilities.forkHistoryImport &&
         typeof targetRuntime.importHistoryForFork === "function" &&
+        Array.isArray(bundle.normalized?.turns) &&
         bundle.normalized.turns.length > 0;
     return canReplayHistory ? "replayed" : "seeded";
 }
@@ -60,25 +78,38 @@ export function resolveForkFidelity(bundle, targetRuntime) {
  */
 export async function materializeFork(opts) {
     const { bundle, targetRuntime, ctx } = opts;
-    const fidelity = resolveForkFidelity(bundle, targetRuntime);
-    if (fidelity === "full" && bundle.native && targetRuntime.importForFork) {
-        const { sessionFile, id } = await targetRuntime.importForFork(bundle.native, ctx);
-        return { kind: "resume", fidelity: "full", sessionFile, id };
+    const intended = resolveForkFidelity(bundle, targetRuntime);
+    const validImport = (result) => typeof result?.sessionFile === "string" && result.sessionFile.trim().length > 0 &&
+        typeof result.id === "string" && result.id.trim().length > 0;
+    // Native transport is the preferred same-runtime route, but never a single
+    // point of failure. An adapter upgrade, stale native store, or malformed
+    // payload degrades through the exact same portable path all agents share.
+    if (intended === "full" && bundle.native && targetRuntime.importForFork) {
+        try {
+            const imported = await targetRuntime.importForFork(bundle.native, ctx);
+            if (validImport(imported))
+                return { kind: "resume", fidelity: "full", ...imported };
+        }
+        catch {
+            // Continue to portable replay (if supported), then the universal seed.
+        }
     }
-    // True cross-runtime fork: write the whole transcript as real prior turns into
-    // the target runtime's own store and resume it. Best-effort — if the runtime's
-    // history import throws (a malformed store, an unwritable dir), fall through to
-    // a seeded prompt so the fork still succeeds rather than erroring outright.
-    if (fidelity === "replayed" && targetRuntime.importHistoryForFork) {
+    // Write the runtime-neutral conversation into any destination that advertises
+    // a native history serializer. This path also rescues a failed same-runtime
+    // native import, so Pi/Claude/Codex all share one degradation ladder.
+    const canReplay = !!targetRuntime.capabilities.forkHistoryImport &&
+        typeof targetRuntime.importHistoryForFork === "function";
+    if (canReplay) {
         try {
             const history = buildForkHistory(bundle.normalized);
             if (history.length > 0) {
-                const { sessionFile, id } = await targetRuntime.importHistoryForFork(history, ctx);
-                return { kind: "resume", fidelity: "replayed", sessionFile, id };
+                const imported = await targetRuntime.importHistoryForFork(history, ctx);
+                if (validImport(imported))
+                    return { kind: "resume", fidelity: "replayed", ...imported };
             }
         }
         catch {
-            // fall through to the seeded continuation below
+            // Fall through to the agent-independent seeded continuation below.
         }
     }
     const seedPrompt = buildSeedPrompt(bundle.normalized, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.9.1-staging.128",
+  "version": "0.9.1-staging.130",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",
@@ -60,8 +60,5 @@
     "undici": "8.9.0"
   },
   "readme": "# Bivy\n\nRoute coding-agent work to infrastructure you own.\n\nBivy turns GitHub issues, Slack requests, signed webhooks, schedules, and live\nprompts into governed agent runs on your laptop, server, or cloud account. Choose\nthe node, agent, and model; burst onto a short-lived runner in your own cloud;\nthen watch, steer, and approve from a phone, browser, or terminal.\n\nAgents run with your repository, keys, and toolchain. Interactive session\ntraffic is end-to-end encrypted between your node and devices; Bivy's relay and\ncontrol plane do not receive repository contents, interactive prompts,\ntranscripts, or model keys. Inbound Slack commands and generic webhook\ninstructions necessarily reach the control plane and are retained with their\nqueue item until it is deleted; GitHub and Linear issue text is fetched directly\nby the node instead. Bivy adds routing, durable sessions, approvals, fallback\nrules, and outcome reports around agents you already use.\n\n- **Website:** [bivy.sh](https://bivy.sh)\n- **Documentation:** [`docs/`](docs/README.md) — start with the [quickstart](docs/quickstart.md)\n- **License:** [FSL-1.1-ALv2](LICENSE) (source-available; converts to Apache-2.0 two years after each release)\n\n> Bivy is 0.x software. The core loop is solid and used daily, but interfaces\n> and behaviour can change between releases.\n\n## Install\n\n```bash\ncurl -fsSL https://bivy.sh/install.sh | bash\n```\n\nmacOS and Linux. Requires Node.js 22.19 or newer; the installer installs it for\nyou on Debian/Ubuntu and otherwise points you at nodejs.org. It installs the\n[`@bivy/bivy`](https://www.npmjs.com/package/@bivy/bivy) package from npm, puts\nthe `bivy` command on your `PATH`, then runs the guided `bivy setup` wizard —\nworkspace, relay/control-plane sign-in, and an auto-start background service\n(launchd on macOS, systemd on Linux). Re-running it on a machine that already\nhas Bivy just applies the latest build and restarts the service.\n\nAlready have Node.js 22.19+? The installer is optional:\n\n```bash\nnpm install -g @bivy/bivy\nbivy setup\n```\n\nOr try it once without installing anything (`npx` always fetches the latest):\n\n```bash\nnpx @bivy/bivy setup\n```\n\nReleases are published from CI with provenance attestations; verify a build's\norigin with `npm audit signatures`. See [`docs/releasing.md`](docs/releasing.md).\n\n### Install options\n\nEnvironment variables passed to the one-line installer change what it does:\n\n| Goal | Variable |\n|---|---|\n| Track the dev channel (new build on every merge to `main`) | `BIVY_CHANNEL=staging` |\n| Pin an exact version | `BIVY_VERSION=0.1.0` |\n| Install without sudo, into a user-owned prefix | `BIVY_NPM_PREFIX=~/.local` |\n| Preinstall every bundled agent runtime | `BIVY_INSTALL_ALL_AGENTS=1` |\n\nFor example: `BIVY_CHANNEL=staging curl -fsSL https://bivy.sh/install.sh | bash`.\n\nWorking from a checkout of this repository instead:\n\n```bash\nnpm install\nnpm run setup\n```\n\nSee [`docs/install.md`](docs/install.md) for where data lives, service\nmanagement, and uninstall.\n\n## Updating\n\n```bash\nbivy update\n```\n\n`bivy update` detects how Bivy was installed and does the right thing, then\nwaits for any active session to finish its current turn and restarts the\nbackground service so the node reconnects on the new build:\n\n| Install kind | What `bivy update` does |\n|---|---|\n| npm global (`npm i -g`) | `npm install -g @bivy/bivy@<channel>`, then restart the service |\n| installer / packaged | re-runs `install.sh` (migrating to npm if needed), then restart |\n| git checkout | `git pull --ff-only` + `npm ci`, then restart |\n| `npx` run | nothing to update — each run already fetches the latest |\n\nUpdates follow the release **channel** recorded at install time — `latest`\n(production) by default, or `staging` if you installed with\n`BIVY_CHANNEL=staging`. Switch channels (the choice is remembered for next\ntime), or skip the wait for a busy session:\n\n```bash\nbivy update --staging   # move to the dev channel\nbivy update --stable    # move back to production (latest)\nbivy update --force     # don't wait for an in-flight turn to finish\n```\n\nThe daemon also checks the registry periodically and posts an in-session notice\nwhen a newer build is available.\n\n## Architecture\n\nBivy has three parts. Only the first one holds your data.\n\n```text\n  your machine                     hosted or self-hosted\n\n  ┌──────────────┐               ┌─────────┐        ┌───────────────┐\n  │ node daemon  │  ──dials──▶   │  relay  │ ◀────▶ │ control plane │\n  │ agents, keys │    outbound   │ opaque  │        │ accounts, web │\n  │ repo, tools  │               │ frames  │        │ app, metadata │\n  └──────────────┘               └─────────┘        └───────────────┘\n         ▲                                                  ▲\n         └────────── end-to-end encrypted session ───────────┘\n                     phone · browser · another terminal\n```\n\n- **Node** — a daemon on your machine. Owns the workspace, credentials, and agent\n  processes. Serves an API and WebSocket on `http://localhost:4317` plus a\n  `/healthz` probe. **It hosts no web UI.**\n- **Relay** — forwards encrypted frames between your node and your devices. Your\n  node dials out, so no inbound port is opened. The relay cannot read the frames.\n- **Control plane** — holds your account, node registry, and session index, and\n  serves the web/PWA client. Use the hosted one or run your own.\n\nBecause the node serves no UI, a browser or phone needs a control plane — hosted\nat `app.bivy.sh`, or one you deploy yourself. The terminal CLI needs neither.\n\nSee [`docs/remote-access.md`](docs/remote-access.md) and\n[`docs/security-model.md`](docs/security-model.md).\n\n## Supported agents\n\nNineteen agents are available in the picker, each driven through its native interface.\nPi, Claude Code, Codex, and OpenCode are the release-tested **Supported** paths;\nthe rest are explicitly Beta in the picker and support matrix:\n\n| Agent | Command | Notes |\n|---|---|---|\n| Pi | `bivy run pi` | Default; bundled |\n| Claude Code | `bivy run claude` | Bundled SDK |\n| Codex | `bivy run codex` | Installs `@openai/codex` |\n| OpenCode | `bivy run opencode` | Installs `opencode-ai` |\n| Gemini CLI | `bivy run gemini` | Installs `@google/gemini-cli` |\n| Qwen Code | `bivy run qwen` | Installs `@qwen-code/qwen-code` |\n| Goose | `bivy run goose` | Requires `goose` on PATH |\n| Aider | `bivy run aider` | No session resume (upstream gap) |\n| Cline | `bivy run cline` | Installs `cline` |\n| Crush | `bivy run crush` | No session resume (upstream gap) |\n| Cursor | `bivy run cursor` | ACP-capable |\n| GitHub Copilot | `bivy run copilot` | ACP-capable |\n| Grok | `bivy run grok` | Model selection |\n| Amp | `bivy run amp` | Native thread resume |\n| Auggie | `bivy run auggie` | Headless CLI |\n| Droid | `bivy run droid` | Model selection |\n| Continue | `bivy run continue` | Headless CLI |\n| Kilo Code | `bivy run kilocode` | ACP-capable |\n| Rovo Dev | `bivy run rovodev` | Installed out of band |\n\nAny other command works via `bivy run -- ./your-agent --flags`. ACP-capable\nagents can be promoted to Bivy's governed protocol path for per-tool approvals\nand native resume.\n\n[`docs/runtime-support-matrix.md`](docs/runtime-support-matrix.md) lists exactly\nwhat each agent supports — resume, model selection, approvals, sandboxing.\n\n## Common commands\n\n```bash\nbivy                  # launch the default agent as a durable session\nbivy run claude       # run a specific agent\nbivy sessions         # list live and saved sessions\nbivy resume           # resume the most recent session\nbivy open             # open the web app (requires relay setup)\nbivy status           # config summary and node reachability\nbivy doctor           # health check\nbivy logs -f          # tail node logs\nbivy update           # update Bivy and restart the service\n```\n\nFull command list, flags, and examples: [`docs/cli-reference.md`](docs/cli-reference.md).\n\n## Configuration\n\nThe common knobs:\n\n```bash\nBIVY_WORKSPACE=/path/to/repo    # default workspace\nBIVY_SANDBOX=read-only          # read-only | workspace-write (default) | danger-full-access\nBIVY_APPROVAL_MODE=risky        # never | risky | always | autonomous (default)\n```\n\nEvery environment variable, config file, and precedence rule:\n[`docs/configuration.md`](docs/configuration.md).\n\n## Approvals and sandboxing\n\nThe default approval mode is **`autonomous`**: agents act without per-action\nprompts. The actual protection depends on the selected runtime. Native-sandbox\nagents enforce the chosen access tier; structured runtimes also pass tool calls\nthrough Bivy's policy and approval layer. Process agents that Bivy cannot\nintercept run with your OS user permissions. The picker shows this distinction\nand requires confirmation before selecting that limited path.\n\nWhere Bivy receives structured shell/file calls, a heuristic floor blocks known\ncatastrophic commands and structured writes outside the workspace, and a\nbackstop set (force-push, publish, deploy, sudo) pauses for a human. This catches\naccidents; it is not an adversarial isolation boundary.\n\nIf you want to be asked about more, set the mode explicitly:\n\n```bash\nBIVY_APPROVAL_MODE=risky    # prompt on risky shell commands and file edits\nBIVY_APPROVAL_MODE=always   # prompt on all shell commands and file edits\nBIVY_APPROVAL_MODE=never    # no prompts; structured-tool heuristic blocks still apply where available\n```\n\nApprove from the terminal, browser, or phone.\n\nSandbox tiers (`read-only`, `workspace-write`, `danger-full-access`) are enforced\nnatively by agents that support them — Codex, Claude Code, Gemini CLI, Qwen Code.\nAgents without a native sandbox may expose structured tool or MCP controls, but\nthose controls do not cover activity the agent performs outside those channels;\nsome process adapters run entirely with your user permissions. Check the\npicker's Protection label. **Bivy does not currently ship its own OS-level jail.**\n\n## Credentials\n\nProvider credentials stay on the node or in a vault you control. Bivy Cloud does\nnot receive model keys, GitHub repository tokens, OAuth refresh tokens,\ninteractive session prompts, transcripts, or workspace files. See the\n[security model](docs/security-model.md#what-the-control-plane-sees) for the\nseparate inbound-automation data boundary.\n\n```bash\nbivy secrets list\nbivy secrets set github.repo-token\nbivy secrets ref github.repo-token op://Bivy/GitHub/repo-token\nbivy secrets doctor\n```\n\n`secret://`, `env://`, and `op://` (1Password) references are resolved on demand\nwhen the daemon provisions an agent run, so the raw values never sit in your\nconfig. See [`docs/key-management.md`](docs/key-management.md).\n\n## GitHub work queue\n\nLabel an issue `bivy` (or `bivy/<node>` to target a machine), or mention the Bivy\nGitHub App in a comment. A node you own claims the work, runs the agent in an\nisolated worktree, and the agent opens the pull request itself.\n\nAvailable on every plan. On Bivy Cloud, the free trial shows the first 25\ndistinct sessions in the hosted app and includes 10 unattended automations per\nrolling 7-day window across GitHub, Slack, webhooks, and schedules. Sessions keep\nrunning on your machines after the hosted trial is exhausted, but new ones are\nhidden from the hosted app until you subscribe. Pro removes both limits.\nSelf-hosted stacks are unlimited.\n\nA private GitHub App only installs on the account that owns it, so connect one\napp per GitHub account — one for your personal repos, one per organization\n(`bivy github:app-create --org <org>`). A node can serve several at once, each\nwith its own key and `@`-mention handle.\n\nSee [`docs/github-work-queue.md`](docs/github-work-queue.md).\n\n## Linear work queue\n\nApply `bivy` or `bivy/<node>` to a Linear issue to dispatch it to the same hosted queue. The node fetches issue content directly from Linear, works in an isolated GitHub worktree, and asks the agent to open a pull request. See [`docs/linear-work-queue.md`](docs/linear-work-queue.md).\n\n## Development\n\n```bash\nnpm install\nnpm run dev          # node daemon on http://localhost:4317\nnpm run dev:web      # web client dev server (proxies /api and /ws to the node)\n```\n\nChecks — all of these run in CI:\n\n```bash\nnpm run typecheck\nnpm run typecheck:web\nnpm run lint\nnpm run test:unit\nnpm run test:core\nnpm run check:licenses\nnpm run check:secrets\n```\n\nRepository layout:\n\n- `src/` — node daemon, runtime adapters, approvals, secrets, sessions\n- `bin/` — the `bivy` CLI\n- `packages/core` — shared protocol, pairing, wire format\n- `packages/web` — the React/Vite PWA client (`@bivy/web`)\n- `services/relay` — self-hostable relay\n- `services/control-plane` — self-hostable control plane\n- `deploy/` — self-host deployment examples\n\nSee [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n## Self-hosting\n\nNode, relay, and control plane are all in this repository. Point a node at your\nown deployment by passing URLs to `bivy relay:setup` — re-running it switches an\nexisting node over to the new endpoints:\n\n```bash\nbivy relay:setup \\\n  --control-plane https://bivy.example.com \\\n  --relay wss://relay.example.com\n```\n\nEach URL has a flag and an environment-variable equivalent (the flag wins):\n\n| Flag | Environment variable | Points at | Default |\n|---|---|---|---|\n| `--control-plane <url>` | `BIVY_CONTROL_PLANE_URL` | accounts, node registry, and the web-app API | hosted (`app.bivy.sh`) |\n| `--relay <wss-url>` | `BIVY_RELAY_URL` | the encrypted-frame relay your node dials out to | hosted |\n| `--client <url>` | `BIVY_CLIENT_BASE_URL` | base URL used when building app/PWA links | the `--control-plane` URL |\n\nSign-in defaults to GitHub device login (`--github`); pass\n`--email you@example.com` for an email magic-link, or `--session-token <token>`\nto skip interactive sign-in. `relay:setup` checks the control plane is reachable, enrolls\nthis node, and writes the endpoints to `.bivy/relay.json`, so `bivy open`,\n`bivy link`, and `bivy update` all keep using your deployment afterwards.\n\n**Self-hosting is unsupported** — no SLA, community best-effort via GitHub\nissues. You own TLS, backups, upgrades, and hardening. See\n[`docs/self-host.md`](docs/self-host.md).\n\n## Security\n\nReport vulnerabilities through [GitHub private vulnerability reporting](https://github.com/bivysh/bivy/security/advisories/new).\nPlease do not open a public issue. See [`SECURITY.md`](SECURITY.md) for scope,\nresponse times, and safe harbour, and [`docs/security-model.md`](docs/security-model.md)\nfor the trust model and known limitations.\n\n## License\n\nBivy Core is licensed under the Functional Source License (FSL-1.1-ALv2): you may\nuse, modify, and self-host it for any purpose **except a Competing Use** —\noffering it to others as a product or service that substitutes for Bivy or Bivy\nCloud. Two years after each release, that version converts to Apache-2.0.\n\nThis is a source-available licence, not an OSI-approved open source licence.\n\nSee [`LICENSE`](LICENSE), [`CORE.md`](CORE.md), and [`CLOUD.md`](CLOUD.md).\n",
-  "readmeFilename": "README.md",
-  "bundledDependencies": [
-    "@earendil-works/pi-coding-agent"
-  ]
+  "readmeFilename": "README.md"
 }