@bivy/bivy 0.17.3-staging.2 → 0.17.3-staging.21

package/dist/protocol/client-command-schemas.js

@@ -8,9 +8,15 @@ const optionalSession = { sessionId: Type.Optional(Type.String()) };
  * this table remains migration-compatible; adding validation is one data row. */
 export const CLIENT_COMMAND_SCHEMAS = {
     ping: Type.Object(request),
-    "apps.list": Type.Object({ ...request, ...session }),
+    "apps.list": Type.Object({ ...request, ...optionalSession }),
+    "artifacts.list": Type.Object(request),
     "apps.publish": Type.Object({ ...request, ...session, manifest: Type.Unknown() }),
-    "apps.open": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String(), returnTo: Type.Optional(Type.String({ maxLength: 2048 })) }),
+    "apps.offers": Type.Object({ ...request, ...session }),
+    "apps.adopt": Type.Object({ ...request, ...session, port: Type.Integer({ minimum: 1024, maximum: 65535 }) }),
+    "apps.open": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String(), returnTo: Type.Optional(Type.String({ maxLength: 2048 })), direct: Type.Optional(Type.Boolean()), scale: Type.Optional(Type.Integer({ minimum: 1, maximum: 2 })) }),
+    "apps.shot": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String()), widths: Type.Optional(Type.Array(Type.Integer(), { maxItems: 4 })), themes: Type.Optional(Type.Array(Type.Union([Type.Literal("light"), Type.Literal("dark")]), { maxItems: 2 })), path: Type.Optional(Type.String({ maxLength: 2048 })) }),
+    "apps.clearNotes": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
+    "apps.logs": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.share": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.revoke": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.remove": Type.Object({ ...request, ...session, appId: Type.String() }),
@@ -23,6 +29,8 @@ export const CLIENT_COMMAND_SCHEMAS = {
     }),
     "attachment.fetch": Type.Object({ ...request, hash: Type.String() }),
     "session.pause": Type.Object(session),
+    "session.presence.get": Type.Object({ ...request, ...session }),
+    "session.presence.draft": Type.Object({ ...request, ...session, device: Type.Object({ id: Type.String({ maxLength: 100 }), label: Type.Optional(Type.String({ maxLength: 200 })) }), text: Type.String({ maxLength: 20_000 }) }),
     "session.resume": Type.Object(session),
     "session.question.answer": Type.Object({ ...optionalSession, requestId: Type.String(), answers: Type.Optional(Type.Record(Type.String(), Type.String())) }),
     "session.replay": Type.Object({ ...session, afterSeq: Type.Optional(Type.Number()) }),
@@ -37,6 +45,7 @@ export const CLIENT_COMMAND_SCHEMAS = {
     "session.rename": Type.Object({ ...session, name: Type.String() }),
     abort: Type.Object(optionalSession),
     "session.turn_attention.resolve": Type.Object({ ...session, action: Type.Union([Type.Literal("stop"), Type.Literal("continue")]) }),
+    "session.limit_retry": Type.Object({ ...session, enabled: Type.Boolean() }),
     "session.command.invoke": Type.Object({ ...session, name: Type.String(), args: Type.Optional(Type.String()) }),
     "branches.list": Type.Object({ repo: Type.String() }),
     "history": Type.Object({ ...request, ...optionalSession, have: Type.Optional(Type.Number()), haveToken: Type.Optional(Type.String()) }),

package/dist/server.js

@@ -16,6 +16,7 @@ import { listRuntimes, catalogRuntimes, agentInstallSpec, canonicalAgentId, inva
 import { createRunPolicy } from "./policy/run-policy.js";
 import { DEFAULT_BACKOFF } from "./policy/ruleset.js";
 import { SessionRerouteController } from "./policy/session-reroute.js";
+import { detectSessionLimit, limitResumePlan, sessionLimitNotice } from "./policy/session-limit.js";
 import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
 import { createAuditLog, readAuditEvents } from "./audit/index.js";
@@ -31,6 +32,7 @@ import { AppRegistry } from "./apps/registry.js";
 import { AppGateway } from "./apps/gateway.js";
 import { RemotePreview } from "./apps/remote-preview.js";
 import { AppService } from "./apps/service.js";
+import { DisplayHost } from "./apps/display.js";
 import { createAppCommands } from "./controllers/app-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
@@ -112,6 +114,9 @@ import { listInstalledPlugins } from "./plugins/store.js";
 import { createCapabilitiesController } from "./controllers/capabilities.js";
 import { createAccessDeviceController, createLinkedDeviceController } from "./controllers/devices.js";
 import { createSessionControlCommands } from "./controllers/session-control.js";
+import { createPresenceCommands } from "./controllers/presence-commands.js";
+import { createArtifactCommands } from "./controllers/artifact-commands.js";
+import { PresenceBook, deviceFrom } from "./session/presence.js";
 import { createForkCommands } from "./controllers/fork-commands.js";
 import { createGithubCommands } from "./controllers/github-commands.js";
 import { createCredentialCommands } from "./controllers/credential-commands.js";
@@ -963,6 +968,8 @@ async function harnessEndTurn(record) {
         record.workspaceState = (await harness.isDirty(record.id)) ? "dirty" : "clean";
         if (!result || result.changes.length === 0)
             return;
+        // Open previews of this session reload; static snapshots are re-taken.
+        appService.turnChanged(record.id);
         broadcast({
             type: "session.changes",
             sessionId: record.id,
@@ -1332,6 +1339,7 @@ function writeSettings(settings) {
         ...("syncStandbyNodeId" in settings ? { standbyNodeId: typeof settings.syncStandbyNodeId === "string" ? settings.syncStandbyNodeId || undefined : undefined } : {}),
         ...(settings.sessionResumeMode === "auto" || settings.sessionResumeMode === "manual" ? { resume: settings.sessionResumeMode } : {}),
         ...(typeof settings.autoAttachToolImages === "boolean" ? { autoAttachToolImages: settings.autoAttachToolImages } : {}),
+        ...(typeof settings.appScreenshots === "boolean" ? { appScreenshots: settings.appScreenshots } : {}),
         ...(Number.isInteger(settings.forkWorkspaceMaxBytes) ? { forkWorkspaceMaxBytes: Number(settings.forkWorkspaceMaxBytes) } : {}),
     };
     next.github = {
@@ -1418,6 +1426,15 @@ function nodeConfiguredDefaultAgent() {
 }
 /** How interactive sessions recover after a restart interrupted them mid-turn.
  *  Defaults to "auto" (re-drive the turn); "manual" waits for a user tap. */
+/** Agents may screenshot app previews: the node setting, or BIVY_APP_SCREENSHOTS. */
+function appScreenshotsEnabled() {
+    const env = process.env.BIVY_APP_SCREENSHOTS;
+    if (env === "1" || env === "true")
+        return true;
+    if (env === "0" || env === "false")
+        return false;
+    return readSettings().appScreenshots === true;
+}
 function nodeSessionResumeMode() {
     return readSettings().sessionResumeMode === "manual" ? "manual" : "auto";
 }
@@ -1451,6 +1468,7 @@ function nodeSettingsSnapshot() {
         })(),
         sessionResumeMode: nodeSessionResumeMode(),
         autoAttachToolImages: readSettings().autoAttachToolImages === true,
+        appScreenshots: appScreenshotsEnabled(),
         forkWorkspaceMaxBytes: Number.isInteger(readSettings().forkWorkspaceMaxBytes) ? Number(readSettings().forkWorkspaceMaxBytes) : 50 * 1024 * 1024,
     };
 }
@@ -1508,6 +1526,8 @@ async function applyNodeSettings(patch) {
     if ("sessionResumeMode" in patch) {
         settings.sessionResumeMode = patch.sessionResumeMode === "manual" ? "manual" : "auto";
     }
+    if ("appScreenshots" in patch)
+        settings.appScreenshots = patch.appScreenshots === true;
     if ("autoAttachToolImages" in patch) {
         settings.autoAttachToolImages = patch.autoAttachToolImages === true;
         setConfiguredAutoAttachToolImages(settings.autoAttachToolImages);
@@ -1659,6 +1679,19 @@ const sessionEvents = new SessionEventCoalescer({
 function broadcastTuiState(sessionId, active) {
     broadcast({ type: "terminal.tui", sessionId, active });
 }
+// Device handoff (src/session/presence.ts): which device last drove each
+// session and the draft it left, so the next device can pick up from there.
+const presenceBook = new PresenceBook();
+function publishPresence(presence) {
+    broadcast({ type: "session.presence", presence });
+}
+function notePresence(sessionId, device, via) {
+    if (!sessionId || !device)
+        return;
+    const changed = presenceBook.drove(sessionId, device, via);
+    if (changed)
+        publishPresence(changed);
+}
 // Terminals opened by relay clients (phone/web over the relay). Output is emitted
 // via the relay tagged with termId; clients filter by it. (Per-client unicast
 // is a known future hardening step.)
@@ -1802,6 +1835,20 @@ const replication = new ReplicationService({
     },
     log: (m) => console.error(`[replication] ${m}`),
 });
+/** Take over a replicated session on this node (manual promotion). Once it
+ *  wins the epoch it is this node's session, not a standby copy: retag it so
+ *  every client stops offering "Continue here", and push the new list. */
+async function promoteReplicaHere(sessionId) {
+    const epoch = await replication.promote(sessionId, identity.nodeId);
+    if (epoch === undefined)
+        return undefined;
+    const source = metadata.getSession(sessionId)?.source;
+    if (source?.startsWith("replica"))
+        metadata.upsertSession({ id: sessionId, source: source.replace(/^replica/, "promoted") });
+    broadcastSessionsList();
+    scheduleAdvertise();
+    return epoch;
+}
 // Retire the legacy overlay sidecars. The append-only log is the sole overlay
 // store now and every session was migrated into it by the prior release's boot
 // migration (.migrated-overlays-v1), verified complete on-disk before this landed.
@@ -1894,10 +1941,13 @@ const dedupeSessionNew = (requestId, create) => sessionNewDedupe.run(requestId,
 // generic key->promise cache as above, reused for a different key) — see
 // issue #154's queued follow-ups. A client that isn't sure whether a queued
 // item's send actually reached the node before the socket dropped (see
-// AppController.retryStuckFollowups) resends it verbatim after reconnecting;
+// FollowupCoordinator.retrySending) resends it verbatim after reconnecting;
 // this makes that safe by collapsing a retried clientMessageId onto the
-// original broadcast + turn instead of double-prompting the runtime.
-const promptDedupe = createSessionNewDedupe();
+// original broadcast + turn instead of double-prompting the runtime. The key is
+// kept for a day, not session.new's 10 minutes: a phone backgrounded mid-send
+// can reconnect long after the turn ended, and an expired key turned its
+// retry into a fresh, duplicate turn at the bottom of the chat.
+const promptDedupe = createSessionNewDedupe({ ttlMs: 24 * 60 * 60_000 });
 const dedupePrompt = (clientMessageId, run) => promptDedupe.run(clientMessageId, run);
 // Preview traffic has isolated per-view origins and a private gateway. Relay
 // delivery needs no listener; direct ingress is an optional operator override.
@@ -1906,14 +1956,26 @@ const appPreviewPort = Number(process.env.BIVY_APPS_PORT || 4318);
 if (process.env.BIVY_APPS_ORIGIN && (!Number.isInteger(appPreviewPort) || appPreviewPort < 1024 || appPreviewPort > 65535 || appPreviewPort === port)) {
     throw new Error("BIVY_APPS_PORT must be between 1024 and 65535 and different from the node API port.");
 }
-const appRegistry = new AppRegistry([port, ...(process.env.BIVY_APPS_ORIGIN ? [appPreviewPort] : [])]);
+// Apps persist with their IDs, so chat launchers and preview addresses survive
+// restarts; see AppRegistry for which views are restored.
+const appRegistry = new AppRegistry([port, ...(process.env.BIVY_APPS_ORIGIN ? [appPreviewPort] : [])], path.join(appDir, "apps.json"));
 const appReturnOrigins = () => {
     const config = loadRelayConfig(appDir);
     return [config?.clientBaseUrl, config?.controlPlaneUrl, ...(process.env.BIVY_APPS_RETURN_ORIGINS ?? "").split(",")]
         .filter((value) => Boolean(value?.trim())).map((value) => new URL(value.trim()).origin);
 };
-const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, process.env.BIVY_APPS_ORIGIN, appReturnOrigins) : undefined;
-const remotePreview = new RemotePreview(appRegistry, appReturnOrigins);
+// A signed-out visit to a preview's stable address goes through the Bivy
+// client: open the session on this node, then the client re-opens the view.
+const appSignIn = (view, pagePath) => {
+    const client = loadRelayConfig(appDir)?.clientBaseUrl;
+    if (!client)
+        return undefined;
+    return `${new URL(client).origin}/sessions/${encodeURIComponent(view.app.sessionId)}?node=${encodeURIComponent(identity.nodeId)}#preview=${view.app.id}.${view.view.id}.${encodeURIComponent(pagePath)}`;
+};
+const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, process.env.BIVY_APPS_ORIGIN, appReturnOrigins, appSignIn) : undefined;
+const remotePreview = new RemotePreview(appRegistry, appReturnOrigins, appSignIn);
+// Desktop app views: one private display per view, started on first open.
+const appDisplays = new DisplayHost();
 const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     start: async (spec) => {
         let failure = "Could not start the app terminal.";
@@ -1928,6 +1990,12 @@ const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     },
     has: (id) => terminals.has(id),
     close: (id) => { terminals.close(id); },
+}, { screenshots: { enabled: appScreenshotsEnabled }, displays: appDisplays });
+// A reviewer's note shows up in an open Apps sheet without reopening it.
+appRegistry.on("notes", (viewId) => {
+    const entry = appRegistry.getView(viewId);
+    if (entry)
+        broadcast({ type: "apps.changed", sessionId: entry.app.sessionId });
 });
 const RELAY_COMMANDS = {
     ...createAppCommands(appService, (id) => { const record = resolveSession(id); return record ? harnessDirFor(record) : undefined; }, (app) => {
@@ -1971,6 +2039,12 @@ const RELAY_COMMANDS = {
         const meta = attachmentStore.readMeta(hash);
         ctx.reply({ type: "attachment.data", requestId, hash, mimeType: meta?.mimeType ?? "application/octet-stream", name: meta?.name, data: bytes.toString("base64") });
     },
+    ...createArtifactCommands({
+        sessionIds: () => new Set([...metadata.listSessions().map((session) => session.id), ...[...openSessions.values()].map((record) => record.id)]),
+        scan: (id) => eventLog.scan(id, ["outbound-attachment"]),
+        stored: (hash) => attachmentStore.getPath(hash) !== null,
+    }),
+    ...createPresenceCommands(presenceBook, publishPresence),
     ...createSessionControlCommands({
         resolve: (sessionId) => resolveSession(sessionId),
         pause: pauseSession,
@@ -2187,6 +2261,11 @@ const RELAY_COMMANDS = {
         else
             abortSessionRecord(record, ctx.broadcast);
     },
+    "session.limit_retry"(msg) {
+        const record = resolveSession(msg.sessionId);
+        if (record)
+            setSessionLimitRetry(record, msg.enabled === true);
+    },
     "session.turn_attention.resolve"(msg) {
         const record = resolveSession(msg.sessionId);
         const action = msg.action === "stop" ? "stop" : msg.action === "continue" ? "continue" : undefined;
@@ -2729,10 +2808,9 @@ const RELAY_COMMANDS = {
         const sessionId = String(msg.sessionId ?? "").trim();
         if (!sessionId)
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Missing sessionId" });
-        const epoch = await replication.promote(sessionId, identity.nodeId);
+        const epoch = await promoteReplicaHere(sessionId);
         if (epoch === undefined)
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Promotion lost the epoch race" });
-        scheduleAdvertise();
         ctx.reply({ type: "session.promote.result", requestId, ok: true, sessionId, epoch });
     },
     // Ephemeral provisioning transport (node-broker path). A remote device that
@@ -2835,7 +2913,7 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "integrations.updated", integrations: integrations.list() });
         }
     },
-    async prompt(msg) {
+    async prompt(msg, ctx) {
         const text = String(msg.text ?? "").trim();
         const { images, imageNotes, imageRefs, files } = attachmentsFrom(msg.attachments);
         if (!text && !images.length && !files.length)
@@ -2876,6 +2954,7 @@ const RELAY_COMMANDS = {
             broadcast({ type: "session.error", sessionId: record.id, error: record.tuiRefreshing ? "This session is returning from the terminal. Try again in a moment." : "This session is open in the terminal (TUI). Close the TUI to chat here." });
             return;
         }
+        notePresence(record.id, deviceFrom(msg.device), "chat");
         touchSession(record);
         // Now that the session (and its workdir) exists, write file attachments to
         // disk and fold their path notes into the prompt the agent actually sees.
@@ -2887,6 +2966,14 @@ const RELAY_COMMANDS = {
         eventLog.appendAttachments(record.id, promptText, [...imageRefs, ...fileRefs]);
         const agentPrompt = promptForAgent(record, promptText);
         const cmid = typeof msg.clientMessageId === "string" && msg.clientMessageId ? msg.clientMessageId : undefined;
+        // A retry of a prompt we already took: the caller missed our echo (that is
+        // why it retried), so acknowledge it again — to the caller only, since
+        // other clients already rendered the first one. Without this the client
+        // keeps the message "sending" and resends it on every reconnect.
+        if (promptDedupe.has(cmid)) {
+            ctx.reply({ type: "session.user_message", sessionId: record.id, text: promptText, clientMessageId: cmid, retry: true });
+            return;
+        }
         void dedupePrompt(cmid, async () => {
             broadcast({ type: "session.user_message", sessionId: record.id, text: promptText, clientMessageId: msg.clientMessageId });
             void sessionNamer.maybeNameSession(record, promptText);
@@ -2899,6 +2986,7 @@ const RELAY_COMMANDS = {
             // The user is driving this turn manually — supersede any pending auto-resume
             // that was scheduled after a prior limit so it can't re-fire on top of them.
             clearSessionResume(record.id);
+            record.limitHit = undefined;
             await turnWatchdog.promptWithWatchdog(record, agentPrompt, record.lastPromptOptions);
         }).catch((error) => {
             // Mirror the HTTP path (see the /prompt route): a rejected turn after
@@ -3017,6 +3105,8 @@ async function handleRelayMessage(msg) {
         // Fallthrough for kinds not in RELAY_COMMANDS: terminal.* frames go to the
         // PTY manager; anything else is an unknown client message.
         if (typeof msg.kind === "string" && msg.kind.startsWith("terminal.")) {
+            if (msg.kind === "terminal.attach")
+                notePresence(terminals.meta(String(msg.termId ?? ""))?.sessionId, deviceFrom(msg.device), "terminal");
             // The relay is a single tunnel with no per-remote-client identity at this
             // layer, so every relay-tunneled client shares one size slot. That still
             // keeps them distinct from each local socket, so a PTY shared between a
@@ -6239,6 +6329,21 @@ function rememberSession(record) {
     persistSessionMetadata(record);
     recordSessionLocation(record);
     enforceOpenSessionCap(record.id);
+    // Opened while a `bivy run` pinned to it is live (e.g. `bivy resume` on the
+    // laptop, then the chat on a phone): the terminal owns it until it ends.
+    runTerms.adoptLiveRun(record);
+}
+/** The open session a run's pinned id refers to — by Bivy id or by the
+ *  runtime's own session ref. Unlike resolveSession, never the active one. */
+function findOpenSession(ref) {
+    const direct = openSessions.get(ref);
+    if (direct)
+        return direct;
+    for (const record of openSessions.values()) {
+        if (record.sessionFile === ref)
+            return record;
+    }
+    return undefined;
 }
 // Keep the number of live (in-memory) sessions bounded. Idle-close already
 // trims over time, but a burst of opens within the idle window could pile up
@@ -7246,12 +7351,15 @@ function scheduleSessionResume(record, plan) {
     metadata.setResumeAt(record.id, plan.resumeAt);
     metadata.setResumeAttempts(record.id, attempts + 1);
     const when = Date.parse(plan.resumeAt);
-    const cond = plan.condition.replace(/_/g, " ");
+    const at = Number.isFinite(when)
+        ? new Date(when).toLocaleString("en-US", { timeZone: "UTC", month: "short", day: "numeric", hour: "2-digit", minute: "2-digit", hour12: false })
+        : plan.resumeAt;
     broadcast({
         type: "session.notice",
         sessionId: record.id,
         level: "info",
-        message: `Hit a ${cond} limit — I'll resume this automatically when it resets (${plan.resumeAt}).`,
+        message: `I'll retry this automatically when the limit resets (${at} UTC).`,
+        actions: ["cancel-resume"],
     });
     armSessionResumeTimer(record.id, Number.isFinite(when) ? when : Date.now());
     return true;
@@ -7290,6 +7398,23 @@ async function driveSessionResume(id) {
         console.warn(`[resume] auto-resume after a provider limit failed for ${id}`, error);
     }
 }
+/** The user's answer to a surfaced limit: opt in to retrying the turn when the
+ *  window resets (scheduled through the same durable resume path the policy
+ *  uses), or cancel a pending retry. */
+function setSessionLimitRetry(record, enabled) {
+    if (!enabled) {
+        clearSessionResume(record.id);
+        metadata.setResumeAttempts(record.id, 0);
+        broadcast({ type: "session.notice", sessionId: record.id, level: "info", message: "Automatic retry cancelled." });
+        return;
+    }
+    const plan = record.limitHit && limitResumePlan(record.limitHit);
+    if (!plan) {
+        broadcast({ type: "session.notice", sessionId: record.id, level: "info", message: "There's no pending limit to retry — send a message to continue." });
+        return;
+    }
+    scheduleSessionResume(record, plan);
+}
 /** Re-arm (or immediately fire) durable auto-resume markers. Runs once at boot
  *  and on an interval, so a wait survives a restart and a capped timer's tail
  *  still fires. */
@@ -7618,6 +7743,13 @@ function attachSessionListeners(record) {
                 broadcast({ type: "session.failed", sessionId: record.id, failedAt: record.lastFailureAt });
                 if (messageError)
                     broadcast({ type: "session.error", sessionId: record.id, error: sessionAgentError(record, messageError) });
+                // A usage/rate limit nothing recovered automatically: offer the ways past
+                // it — fork to another agent now, or retry when the window resets.
+                record.limitHit = detectSessionLimit(turnError, { resetsAtHint: limitResetHint(record, Date.now()) });
+                if (record.limitHit) {
+                    const notice = sessionLimitNotice(getRuntime(record.runtimeId).displayName, record.limitHit);
+                    broadcast({ type: "session.notice", sessionId: record.id, level: "warn", ...notice });
+                }
                 // If the terminal error is an auth failure (expired key/token → 4xx),
                 // also raise the sign-in sheet for the failing provider.
                 maybeSignalAuthRequired(record, turnError);
@@ -8590,10 +8722,17 @@ const runTerms = createRunTerminals({
     sendNotificationHint: (hint) => void sendNotificationHint(hint),
     createSession: (workspace, sessionFile, opts) => createSession(workspace, sessionFile, opts),
     resolveSession: (id) => resolveSession(id),
+    findOpenSession: (ref) => findOpenSession(ref),
     sessionBusy: (record) => sessionBusy(record),
     sessionTerminalsRecord: (sessionId, val) => sessionTerminals.record(sessionId, val),
     sessionTerminalsForget: (sessionId) => sessionTerminals.forget(sessionId),
-    upsertSessionMetadata: (patch) => metadata.upsertSession(patch),
+    upsertSessionMetadata: (patch) => {
+        const input = patch;
+        // A run continuing a saved session (`bivy resume`) only moves its status;
+        // the session keeps its own name, source and agent.
+        const prev = metadata.getSession(input.id);
+        metadata.upsertSession(prev ? { id: input.id, status: input.status } : input);
+    },
     sessionListChanged: () => { broadcastSessionsList(); scheduleAdvertise(); },
     saveRunLog: (termId, log) => runLogs.save(termId, log),
     loadRunLog: (termId) => runLogs.load(termId),
@@ -11048,6 +11187,7 @@ app.post("/api/session/prompt", async (req, res, next) => {
         if (record.tuiTermId || record.tuiRefreshing) {
             return res.status(409).json({ error: record.tuiRefreshing ? "This session is returning from the terminal. Try again in a moment." : "This session is open in the terminal (TUI). Close the TUI to chat here." });
         }
+        notePresence(record.id, deviceFrom(req.body?.device), "chat");
         const session = record.session;
         const { note: fileNote, refs: fileRefs } = materializeAttachments(record, files);
         const promptText = [text, imageNotes.join("\n"), fileNote].filter(Boolean).join("\n\n") ||
@@ -11130,6 +11270,13 @@ app.post("/api/session/abort", (req, res, next) => {
         next(error);
     }
 });
+app.post("/api/session/limit-retry", (req, res) => {
+    const record = resolveSession(req.body?.sessionId);
+    if (!record)
+        return res.status(404).json({ error: "No active session" });
+    setSessionLimitRetry(record, req.body?.enabled === true);
+    res.json({ ok: true });
+});
 app.post("/api/session/turn-attention", (req, res, next) => {
     try {
         const record = resolveSession(req.body?.sessionId);
@@ -11154,10 +11301,9 @@ app.post("/api/session/promote", async (req, res, next) => {
         const sessionId = String(req.body?.sessionId ?? "").trim();
         if (!sessionId)
             return res.status(400).json({ error: "Missing sessionId" });
-        const epoch = await replication.promote(sessionId, identity.nodeId);
+        const epoch = await promoteReplicaHere(sessionId);
         if (epoch === undefined)
             return res.status(409).json({ error: "Promotion lost the epoch race (another node owns it, or it isn't replicated)" });
-        scheduleAdvertise();
         res.json({ ok: true, epoch });
     }
     catch (error) {
@@ -11375,6 +11521,7 @@ wss.on("connection", (socket, req) => {
     // Stable id for this socket, keying its per-terminal size so several clients
     // sharing a PTY size it to their min (see TerminalManager.setClientSize).
     const clientTerminalId = `sock-${randomUUID()}`;
+    let socketDevice;
     socket.send(JSON.stringify({ type: "hello", activeSessionId: active?.id, activeSession: active ? { id: active.id, isStreaming: sessionBusy(active), sessionState: sessionState(active), lastActivity: active.lastActivity, workingStartedAt: active.workingStartedAt } : null }));
     // Authoritative version status on every connect: `latest` set means this node
     // is behind (banner shows); absent means up to date (banner + any "Updating…"
@@ -11399,6 +11546,12 @@ wss.on("connection", (socket, req) => {
             return;
         }
         if (typeof msg?.kind === "string" && msg.kind.startsWith("terminal.")) {
+            // A terminal client (`bivy run`/`bivy resume`) names its device once; typing
+            // into a session's terminal then makes it that session's driver.
+            socketDevice = deviceFrom(msg.device) ?? socketDevice;
+            if (msg.kind === "terminal.input" || msg.kind === "terminal.attach") {
+                notePresence(terminals.meta(String(msg.termId ?? ""))?.sessionId, socketDevice, "terminal");
+            }
             runTerms.handleTerminalMessage(msg, (event) => {
                 if (socket.readyState === WebSocket.OPEN)
                     socket.send(JSON.stringify(event));
@@ -11443,6 +11596,7 @@ function shutdown(signal) {
     }
     catch { }
     terminals.disposeAll();
+    appDisplays.stopAll();
     // Drop persistent client/relay sockets so server.close() can actually drain;
     // otherwise a lingering WebSocket keeps the process alive until the supervisor
     // SIGKILLs it, orphaning children.

package/dist/session/presence.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Which device is driving a session, and the draft it left behind. This is a
+// soft lease, not a lock. Nothing is ever refused because another device drove
+// last; it only lets the next device say "you were on your Mac a minute ago" and
+// carry the unsent draft over. Devices name themselves (the room key already
+// trusts every linked device, so this is presentation, not authentication).
+// In-memory: a handoff is minutes-scale, and a node restart is a fine reset.
+/** Longest device label kept; they're shown in a one-line strip. */
+const LABEL_MAX = 60;
+/** Longest draft carried between devices. */
+const DRAFT_MAX = 20_000;
+/** A driver that keeps typing re-announces at most this often. */
+const REANNOUNCE_MS = 30_000;
+/** Presence older than this is forgotten. */
+const TTL_MS = 6 * 60 * 60 * 1000;
+/** A device reference from untrusted client input, or undefined. */
+export function deviceFrom(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const { id, label } = value;
+    if (typeof id !== "string" || !id.trim() || id.length > 100)
+        return undefined;
+    const name = typeof label === "string" && label.trim() ? label.trim().slice(0, LABEL_MAX) : "Another device";
+    return { id: id.trim(), label: name };
+}
+export class PresenceBook {
+    now;
+    sessions = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    get(sessionId) {
+        this.expire();
+        return this.sessions.get(sessionId) ?? { sessionId };
+    }
+    /** A device sent input to the session. Returns the presence to broadcast when
+     *  the driver changed (or is due a re-announce), else undefined. A chat send
+     *  also consumes that device's draft, since the draft has now been sent. */
+    drove(sessionId, device, via) {
+        const at = this.now();
+        const entry = this.entry(sessionId);
+        const previous = entry.driver;
+        entry.driver = { ...device, via, at };
+        const sentDraft = via === "chat" && entry.draft?.device.id === device.id;
+        if (sentDraft)
+            entry.draft = undefined;
+        const changed = !previous || previous.id !== device.id || previous.via !== via || at - previous.at >= REANNOUNCE_MS;
+        return changed || sentDraft ? { ...entry } : undefined;
+    }
+    /** A device's unsent draft for the session (empty text clears it). */
+    draft(sessionId, device, text) {
+        const entry = this.entry(sessionId);
+        const trimmed = text.slice(0, DRAFT_MAX);
+        if (trimmed.trim())
+            entry.draft = { device, text: trimmed, at: this.now() };
+        else if (entry.draft?.device.id === device.id)
+            entry.draft = undefined;
+        return { ...entry };
+    }
+    entry(sessionId) {
+        this.expire();
+        let entry = this.sessions.get(sessionId);
+        if (!entry) {
+            entry = { sessionId };
+            this.sessions.set(sessionId, entry);
+        }
+        return entry;
+    }
+    expire() {
+        const cutoff = this.now() - TTL_MS;
+        for (const [id, entry] of this.sessions) {
+            if (entry.driver && entry.driver.at < cutoff)
+                entry.driver = undefined;
+            if (entry.draft && entry.draft.at < cutoff)
+                entry.draft = undefined;
+            if (!entry.driver && !entry.draft)
+                this.sessions.delete(id);
+        }
+    }
+}