@bivy/bivy 0.17.3-staging.20 → 0.17.3-staging.22

package/bin/bivy.mjs

@@ -2431,6 +2431,7 @@ async function cmdApp(args = []) {
        bivy app list [--session <id>]
        bivy app remove <app-id> [--session <id>]
        bivy app shot [app-id] [--widths 390,1280] [--themes light,dark] [--path /page] [--session <id>]
+       bivy app present [view] [--path /page] [--note "…"] [--session <id>]
        bivy app run [--name <name>] [--restart-on-change] [--session <id>] -- <command> [args…]
 
 Manifest: {"version":1,"name":"My app","views":[
@@ -2453,10 +2454,14 @@ Terminal commands run with the node user's permissions, not in a new sandbox.
 Chrome/Chromium (desktop apps: straight from their display) and prints the PNG paths — look at them before saying the UI is
 done. It is off by default: turn it on in Bivy → Settings → this machine, or
 run: bivy config set sessions.appScreenshots true
+"present" says a change is ready for the user to look at: they get a card in
+the chat with the app at phone width (and before/after), and it opens the live
+preview. Use it when you finish a visible change, or when the user asks to see
+it. [view] is an app or view name or ID (default: the one opened last).
 Web previews require operator setup; see docs/apps.md.`);
     return;
   }
-  if (!["publish", "list", "remove", "shot", "run"].includes(action)) throw new Error("Unknown app command. Run bivy app --help.");
+  if (!["publish", "list", "remove", "shot", "run", "present"].includes(action)) throw new Error("Unknown app command. Run bivy app --help.");
   // `run -- <command> [args…]`: publish a one-window desktop app without a manifest file.
   let runManifest;
   if (action === "run") {
@@ -2471,14 +2476,15 @@ Web previews require operator setup; see docs/apps.md.`);
     runManifest = { version: 1, name: name.slice(0, 100), views: [{ kind: "display", name: "Window", command, args: commandArgs, ...(restartIndex >= 0 ? { restartOnChange: true } : {}) }] };
   }
   const shot = {};
-  if (action === "shot") {
-    for (const flag of ["--widths", "--themes", "--path"]) {
+  if (action === "shot" || action === "present") {
+    for (const flag of action === "shot" ? ["--widths", "--themes", "--path"] : ["--path", "--note"]) {
       const i = rest.indexOf(flag);
       if (i < 0) continue;
       const value = rest[i + 1];
       if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value.`);
       if (flag === "--widths") shot.widths = value.split(",").map((w) => Number(w.trim()));
       else if (flag === "--themes") shot.themes = value.split(",").map((t) => t.trim());
+      else if (flag === "--note") shot.note = value;
       else shot.path = value;
       rest.splice(i, 2);
     }
@@ -2488,9 +2494,10 @@ Web previews require operator setup; see docs/apps.md.`);
   const sessionId = resolveAttachSessionId({ sessionFlag: sessionIndex >= 0 ? rest[sessionIndex + 1] : undefined, env: process.env });
   if (!sessionId) throw new Error("Set --session <id> or run inside a Bivy agent session.");
   const positional = rest.filter((_, i) => i !== sessionIndex && (sessionIndex < 0 || i !== sessionIndex + 1));
-  if (positional.some((a) => a.startsWith("-")) || (action === "shot" ? positional.length > 1 : positional.length !== (action === "list" || action === "run" ? 0 : 1))) throw new Error("Invalid arguments. Run bivy app --help.");
+  if (positional.some((a) => a.startsWith("-")) || (action === "shot" || action === "present" ? positional.length > 1 : positional.length !== (action === "list" || action === "run" ? 0 : 1))) throw new Error("Invalid arguments. Run bivy app --help.");
   const body = { sessionId, ...shot };
   if (action === "shot" && positional[0]) body.appId = positional[0];
+  if (action === "present" && positional[0]) body.target = positional[0];
   if (action === "publish") {
     const file = path.resolve(positional[0]);
     if (fs.statSync(file).size > 64 * 1024) throw new Error("App manifest exceeds 64 KiB.");

package/dist/apps/preview-shell.js

@@ -88,7 +88,8 @@ nav .btn[aria-pressed="true"] { background:var(--accent-soft); color:var(--accen
 <script nonce="${nonce}">
 const $=id=>document.getElementById(id);
 const frame=$('app'),status=$('status'),back=$('back'),reload=$('reload'),stage=$('stage');
-const ticket=location.hash.slice(1);history.replaceState(null,'',location.pathname);
+// "#ticket~page": a review card opens the preview on the page it shows.
+const [ticket,startPage='']=location.hash.slice(1).split('~');history.replaceState(null,'',location.pathname);
 let metadata,currentPath='/';
 // Peek: framed by a Bivy client, which owns closing and the composer.
 const embedded=parent!==window;
@@ -109,7 +110,7 @@ function show(data,launch){
   // (Set before navigating: the policy is fixed when the frame loads.)
   for(const b of [$('point'),$('errors')])b.hidden=data.inspect===false;
   if(data.inspect===false)frame.allow='clipboard-read; clipboard-write';
-  frame.src=data.origin+(launch?'/__bivy/open#'+(embedded?'e:':'')+launch:'/');
+  frame.src=data.origin+(launch?'/__bivy/open#'+(embedded?'e:':'')+launch+(startPage?'~'+startPage:''):'/');
   back.hidden=embedded&&Boolean(data.returnTo);
   for(const b of [reload,$('point'),$('errors')])b.disabled=false;
   status.textContent='Loading app…';

package/dist/apps/registry.js

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { EventEmitter } from "node:events";
+import { REVIEW_CARD_MODES } from "./types.js";
 const MAX_BYTES = 25 * 1024 * 1024;
 const MAX_TOTAL_BYTES = 100 * 1024 * 1024;
 const MAX_FILES = 2000;
@@ -116,7 +117,7 @@ export class AppRegistry extends EventEmitter {
                 continue;
             // A workspace that moved or a build that vanished drops that app, not the rest.
             try {
-                this.publish(record.sessionId, record.workspace, { ...record.manifest, views: keep.map((k) => k.spec) }, { id: record.id, viewIds: keep.map((k) => k.id), createdAt: record.createdAt });
+                this.publish(record.sessionId, record.workspace, { ...record.manifest, views: keep.map((k) => k.spec) }, { id: record.id, viewIds: keep.map((k) => k.id), createdAt: record.createdAt, reviewMode: record.reviewMode });
             }
             catch { /* skipped */ }
         }
@@ -148,7 +149,7 @@ export class AppRegistry extends EventEmitter {
         if (this.apps.size >= 50)
             throw new Error("Remove an app before publishing more (limit: 50).");
         const id = (i) => (i === undefined ? restore?.id : restore?.viewIds[i]) ?? randomBytes(16).toString("hex");
-        const app = { id: id(), sessionId, name: name(input.name), views: [], createdAt: restore?.createdAt ?? Date.now() };
+        const app = { id: id(), sessionId, name: name(input.name), views: [], createdAt: restore?.createdAt ?? Date.now(), ...(restore?.reviewMode && REVIEW_CARD_MODES.includes(restore.reviewMode) ? { reviewMode: restore.reviewMode } : {}) };
         const entries = [];
         let total = [...this.views.values()].reduce((sum, item) => sum + (item.target.kind === "static" ? item.target.bytes : 0), 0);
         for (const [index, spec] of input.views.entries()) {
@@ -192,7 +193,7 @@ export class AppRegistry extends EventEmitter {
         this.apps.set(app.id, app);
         for (const entry of entries)
             this.views.set(entry.view.id, entry);
-        this.persisted.set(app.id, { sessionId, workspace, manifest: structuredClone(input), id: app.id, viewIds: app.views.map((v) => v.id), createdAt: app.createdAt });
+        this.persisted.set(app.id, { sessionId, workspace, manifest: structuredClone(input), id: app.id, viewIds: app.views.map((v) => v.id), createdAt: app.createdAt, ...(app.reviewMode ? { reviewMode: app.reviewMode } : {}) });
         if (!restore)
             this.save();
         return structuredClone(app);
@@ -253,6 +254,18 @@ export class AppRegistry extends EventEmitter {
             throw new Error("View not found in this app.");
         return view;
     }
+    /** Review cards for this app: remembered across sessions' restarts. */
+    setReviewMode(sessionId, id, mode) {
+        if (!REVIEW_CARD_MODES.includes(mode))
+            throw new Error("Preview cards are ready, every or off.");
+        const app = this.require(sessionId, id);
+        app.reviewMode = mode;
+        const record = this.persisted.get(id);
+        if (record)
+            record.reviewMode = mode;
+        this.save();
+    }
+    reviewMode(id) { return this.apps.get(id)?.reviewMode ?? "ready"; }
     remove(sessionId, id) {
         const app = this.require(sessionId, id);
         for (const view of app.views)

package/dist/apps/review.js

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { inflateSync } from "node:zlib";
+/** What each review-card mode lets through. `present`: the agent's
+ * `bivy app present` makes a card. `minChange`: at the end of a run whose
+ * preview changed, the share of pixels that must differ from the page before
+ * the run; undefined = never on its own. A new mode is a new row. */
+export const REVIEW_MODES = {
+    // ~8×8 CSS px at 2× on a phone-sized page: a moved button or changed
+    // label, not a blinking caret (~0.01%).
+    ready: { present: true, minChange: 0.0002 },
+    every: { present: true, minChange: 0 },
+    off: { present: false },
+};
+/** Whether a moment gets a review card. Show me ("asked") is the user's own
+ * request, so it always does. Without a baseline, a run can't prove a visible
+ * change, so it gets no card: a backend-only run must never produce one. */
+export function shouldReview(input) {
+    if (input.trigger === "asked")
+        return true;
+    if (input.muted)
+        return false;
+    const rule = REVIEW_MODES[input.mode];
+    if (input.trigger === "present")
+        return rule.present;
+    return input.revisionChanged && rule.minChange !== undefined && input.change !== undefined && input.change > rule.minChange;
+}
+/** What the "session finished" notification carries about a review: IDs only.
+ * The device fetches the screenshot over the encrypted session channel. */
+export function reviewHint(review) {
+    return {
+        review: { appId: review.appId, viewId: review.viewId, reviewId: review.id },
+        body: `${review.name} ${review.trigger === "present" ? "is ready to review" : "changed"} — tap to see it.`,
+    };
+}
+/** Decodes the 8-bit, non-interlaced RGB(A) PNGs Chrome and rfb.ts write. */
+export function decodePng(png) {
+    if (png.readUInt32BE(0) !== 0x89504e47)
+        throw new Error("Not a PNG.");
+    let offset = 8, width = 0, height = 0, channels = 0;
+    const data = [];
+    while (offset < png.length) {
+        const length = png.readUInt32BE(offset);
+        const type = png.toString("latin1", offset + 4, offset + 8);
+        const chunk = png.subarray(offset + 8, offset + 8 + length);
+        if (type === "IHDR") {
+            width = chunk.readUInt32BE(0);
+            height = chunk.readUInt32BE(4);
+            const [depth, color, , , interlace] = chunk.subarray(8, 13);
+            channels = color === 6 ? 4 : color === 2 ? 3 : 0;
+            if (depth !== 8 || !channels || interlace)
+                throw new Error("Unsupported PNG.");
+        }
+        else if (type === "IDAT")
+            data.push(chunk);
+        else if (type === "IEND")
+            break;
+        offset += 12 + length;
+    }
+    const raw = inflateSync(Buffer.concat(data));
+    const stride = width * channels;
+    const pixels = Buffer.alloc(stride * height);
+    for (let y = 0; y < height; y++) {
+        const filter = raw[y * (stride + 1)];
+        const line = raw.subarray(y * (stride + 1) + 1, (y + 1) * (stride + 1));
+        const out = y * stride;
+        for (let x = 0; x < stride; x++) {
+            const a = x >= channels ? pixels[out + x - channels] : 0;
+            const b = y ? pixels[out - stride + x] : 0;
+            const c = y && x >= channels ? pixels[out - stride + x - channels] : 0;
+            let value = line[x];
+            if (filter === 1)
+                value += a;
+            else if (filter === 2)
+                value += b;
+            else if (filter === 3)
+                value += (a + b) >> 1;
+            else if (filter === 4) {
+                const p = a + b - c, pa = Math.abs(p - a), pb = Math.abs(p - b), pc = Math.abs(p - c);
+                value += pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+            }
+            pixels[out + x] = value & 0xff;
+        }
+    }
+    return { width, height, channels, pixels };
+}
+/** Share of pixels that visibly differ (0–1). Different sizes count as a
+ * full change: the page grew or shrank. */
+export function visualChange(before, after) {
+    if (before.equals(after))
+        return 0;
+    const a = decodePng(before), b = decodePng(after);
+    if (a.width !== b.width || a.height !== b.height)
+        return 1;
+    let changed = 0;
+    for (let i = 0, p = 0; p < a.width * a.height; p++, i += a.channels) {
+        const j = p * b.channels;
+        const delta = Math.abs(a.pixels[i] - b.pixels[j]) + Math.abs(a.pixels[i + 1] - b.pixels[j + 1]) + Math.abs(a.pixels[i + 2] - b.pixels[j + 2]);
+        // Re-renders of the same page are pixel-identical; this only skips
+        // sub-pixel antialiasing shifts, not a light grey on white.
+        if (delta > 12)
+            changed++;
+    }
+    return changed / (a.width * a.height);
+}
+/** PNG dimensions, from the header. */
+export function pngSize(png) {
+    return { width: png.readUInt32BE(16), height: png.readUInt32BE(20) };
+}

package/dist/apps/service.js

@@ -1,8 +1,11 @@
+import { randomBytes } from "node:crypto";
+import { REVIEW_MODES, shouldReview, visualChange } from "./review.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { scanListeners } from "./listeners.js";
 import { takeShots } from "./screenshot.js";
+const NO_REVIEWS = { publish: (review) => review, expire: () => { } };
 const NO_DISPLAYS = { unavailable: () => "Desktop app views aren't available on this machine.", ensure: () => Promise.reject(new Error("Desktop app views aren't available on this machine.")), stop: () => { } };
 /** How long a screenshot waits for a desktop app's first window. */
 const WINDOW_WAIT_MS = 15_000;
@@ -26,6 +29,13 @@ export class AppService {
     screenshots;
     displays;
     shooting = Promise.resolve();
+    reviews;
+    settleMs;
+    runs = new Map();
+    /** The latest card per view: a newer one expires its images. */
+    latest = new Map();
+    /** Screenshots in progress, so a card, Compare and a baseline share one browser run. */
+    inflight = new Map();
     constructor(registry, gateway, terminals, options = {}) {
         this.registry = registry;
         this.gateway = gateway;
@@ -34,6 +44,8 @@ export class AppService {
         this.serverWatchMs = options.serverWatchMs ?? 5_000;
         this.screenshots = { enabled: options.screenshots?.enabled ?? (() => false), take: options.screenshots?.take ?? takeShots };
         this.displays = options.displays ?? NO_DISPLAYS;
+        this.reviews = options.reviews ?? NO_REVIEWS;
+        this.settleMs = options.settleMs ?? COMPARE_SETTLE_MS;
     }
     /** A session's apps, or every app on this machine when no session is given. */
     list(sessionId) {
@@ -75,29 +87,173 @@ export class AppService {
             void this.ensureServer(entry).catch(() => { });
         }
         if (bumped.length && this.screenshots.enabled())
-            setTimeout(() => void this.capture(bumped), COMPARE_SETTLE_MS).unref?.();
+            setTimeout(() => void this.capture(bumped), this.settleMs).unref?.();
         return bumped;
     }
     /** One phone-width shot per view of the page last viewed, kept for Compare. */
     async capture(viewIds) {
         for (const id of viewIds) {
             const entry = this.registry.getView(id);
-            if (!entry || entry.view.kind !== "web")
-                continue;
+            if (entry?.view.kind === "web")
+                await this.shotOf(entry);
+        }
+    }
+    /** A phone-width screenshot of a page at the view's current revision: one
+     * already taken (Compare's after-turn shot), one in progress, or a new one.
+     * Undefined when it fails; a card then goes without a picture. */
+    shotOf(entry, page = entry.lastPath ?? "/") {
+        const revision = entry.revision;
+        const taken = [...entry.shots ?? []].reverse().find((shot) => shot.revision === revision && (shot.path ?? "/") === page);
+        if (taken)
+            return Promise.resolve(taken.png);
+        const key = `${entry.view.id}:${revision}:${page}`;
+        let pending = this.inflight.get(key);
+        if (pending)
+            return pending;
+        pending = (async () => {
             await this.windowShown(entry).catch(() => { });
-            const outDir = path.join(os.tmpdir(), "bivy-shots", "compare", id);
-            const run = this.shooting.catch(() => { }).then(() => this.screenshots.take([entry], { widths: [390], themes: ["light"], path: entry.lastPath ?? "/" }, outDir));
+            const outDir = path.join(os.tmpdir(), "bivy-shots", "compare", entry.view.id);
+            const run = this.shooting.catch(() => { }).then(() => this.screenshots.take([entry], { widths: [390], themes: ["light"], path: page }, outDir));
             this.shooting = run;
             try {
                 const [shot] = await run;
                 if (!shot)
-                    continue;
+                    return undefined;
                 const png = fs.readFileSync(shot.file);
                 fs.rmSync(outDir, { recursive: true, force: true });
-                entry.shots = [...(entry.shots ?? []), { revision: entry.revision, at: Date.now(), png }].slice(-COMPARE_KEEP);
+                entry.shots = [...(entry.shots ?? []), { revision, at: Date.now(), png, path: page }].slice(-COMPARE_KEEP);
+                return png;
             }
-            catch { /* a failed shot just leaves Compare without this turn */ }
+            catch {
+                return undefined; /* a failed shot just leaves Compare without this turn */
+            }
+            finally {
+                this.inflight.delete(key);
+            }
+        })();
+        this.inflight.set(key, pending);
+        return pending;
+    }
+    /** Web views of a session whose app wants review cards on their own. */
+    reviewable(sessionId) {
+        return this.registry.list(sessionId).filter((app) => REVIEW_MODES[this.registry.reviewMode(app.id)].minChange !== undefined)
+            .flatMap((app) => app.views.filter((view) => view.kind === "web").map((view) => this.registry.getView(view.id))).filter(Boolean);
+    }
+    /** An agent run started. Remembers each view's revision, and the page as
+     * it is now, so the end of the run can tell whether anything visibly
+     * changed. A baseline is only taken when no screenshot of this revision
+     * exists yet — after the first run, the last run's screenshot serves. */
+    runStarted(sessionId) {
+        const views = this.reviewable(sessionId);
+        const run = { start: new Map(views.map((entry) => [entry.view.id, entry.revision])), baseline: new Map(), reviews: new Map(), muted: false, ended: false };
+        this.runs.set(sessionId, run);
+        if (!this.screenshots.enabled())
+            return;
+        for (const entry of views)
+            void this.shotOf(entry).then((png) => { if (png && entry.revision === run.start.get(entry.view.id))
+                run.baseline.set(entry.view.id, png); });
+    }
+    /** The run ended (done, or waiting for the user). Views whose revision
+     * changed are screenshotted and compared with the page before the run; a
+     * visible change makes (or updates) this run's card. Returns the run's
+     * latest card, for the "session finished" notification. */
+    async runEnded(sessionId) {
+        const run = this.runs.get(sessionId);
+        if (!run || run.ended)
+            return undefined;
+        run.ended = true;
+        let latest;
+        const changed = [...run.start].map(([id, revision]) => ({ entry: this.registry.getView(id), revision })).filter(({ entry, revision }) => entry && entry.revision !== revision);
+        if (changed.length && this.screenshots.enabled() && !run.muted)
+            await new Promise((r) => setTimeout(r, this.settleMs));
+        for (const { entry } of changed) {
+            if (!entry || !this.screenshots.enabled())
+                continue;
+            const mode = this.registry.reviewMode(entry.app.id);
+            if (run.muted || REVIEW_MODES[mode].minChange === undefined)
+                continue;
+            const before = run.baseline.get(entry.view.id);
+            const after = await this.shotOf(entry);
+            const change = before && after ? visualChange(before, after) : undefined;
+            // A card the agent presented earlier in the run is refreshed if the page changed since.
+            const current = this.latest.get(entry.view.id);
+            const presented = current && run.reviews.get(entry.app.id) === current.id;
+            if (!shouldReview({ trigger: "run", mode, muted: run.muted, revisionChanged: true, change }) && !(presented && after))
+                continue;
+            latest = this.review(entry, run, { trigger: presented ? current.trigger : "run", note: presented ? current.note : undefined, path: entry.lastPath ?? "/", shot: after, before });
+        }
+        if (!latest) {
+            const id = [...run.reviews.values()].at(-1);
+            latest = [...this.latest.values()].find((review) => review.id === id);
         }
+        return latest;
+    }
+    /** `bivy app present`, or Show me ("asked"): a card for one view now. */
+    async present(sessionId, input) {
+        const trigger = input.trigger ?? "present";
+        const page = input.path;
+        if (page !== undefined && (typeof page !== "string" || !page.startsWith("/") || page.startsWith("//") || page.length > 2048))
+            throw new Error("Path must start with /.");
+        const note = typeof input.note === "string" ? input.note.trim().slice(0, 500) : undefined;
+        const entry = this.pickView(sessionId, input.target);
+        const mode = this.registry.reviewMode(entry.app.id);
+        const active = this.runs.get(sessionId);
+        const run = active && !active.ended ? active : undefined;
+        if (!shouldReview({ trigger, mode, muted: run?.muted ?? false, revisionChanged: true })) {
+            return { message: run?.muted ? "The user muted preview cards for this run. They can still open the preview from the chat." : `Preview cards are off for ${entry.app.name}. The user can still open the preview from the chat.` };
+        }
+        // Presenting means the change is ready: pick up files written since the
+        // turn began, so the picture (and any open preview) shows them.
+        if (trigger === "present" && this.turnChanged(sessionId).includes(entry.view.id) && this.screenshots.enabled())
+            await new Promise((r) => setTimeout(r, this.settleMs));
+        const enabled = this.screenshots.enabled();
+        const path = page ?? entry.lastPath ?? "/";
+        const shot = enabled ? await this.shotOf(entry, path) : undefined;
+        const baseline = run?.baseline.get(entry.view.id);
+        const before = baseline && shot && !baseline.equals(shot) && path === (entry.lastPath ?? "/") ? baseline : undefined;
+        const review = this.review(entry, run, { trigger, note, path, shot, before, screenshotsOff: !enabled });
+        return { review, message: enabled ? (shot ? "The user sees it in the chat." : "The user sees a card in the chat, but the screenshot failed.") : "The user sees a card in the chat. Screenshots are off on this machine, so it has no picture." };
+    }
+    /** No more cards for the rest of the session's current run. */
+    mute(sessionId) {
+        const run = this.runs.get(sessionId);
+        if (run && !run.ended)
+            run.muted = true;
+        return { ok: true };
+    }
+    setReviewMode(sessionId, appId, mode) {
+        this.registry.setReviewMode(sessionId, appId, mode);
+        return { ok: true };
+    }
+    /** A view by app or view ID or name; by default the one opened last, else the newest app's first. */
+    pickView(sessionId, target) {
+        const views = this.registry.list(sessionId).flatMap((app) => app.views.filter((view) => view.kind === "web").map((view) => this.registry.getView(view.id))).filter(Boolean);
+        if (!views.length)
+            throw new Error("This session has no web views to present. Publish one with bivy app publish, or preview a detected server.");
+        if (target) {
+            const wanted = target.trim().toLowerCase();
+            const found = views.find((entry) => [entry.app.id, entry.view.id].includes(wanted))
+                ?? views.find((entry) => entry.view.name.toLowerCase() === wanted) ?? views.find((entry) => entry.app.name.toLowerCase() === wanted);
+            if (!found)
+                throw new Error(`No web view called "${target}" in this session. Run bivy app list to see them.`);
+            return found;
+        }
+        return views.reduce((best, entry) => (entry.openedAt ?? 0) > (best.openedAt ?? 0) || ((entry.openedAt ?? 0) === (best.openedAt ?? 0) && entry.app.createdAt > best.app.createdAt) ? entry : best);
+    }
+    /** Makes or updates a card, keeping each view's images to the latest card. */
+    review(entry, run, fields) {
+        const id = (run && run.reviews.get(entry.app.id)) ?? `review-${randomBytes(8).toString("hex")}`;
+        const { shot, before, ...rest } = fields;
+        const review = this.reviews.publish({
+            id, sessionId: entry.app.sessionId, appId: entry.app.id, viewId: entry.view.id, name: entry.app.name, view: entry.view.name,
+            at: Date.now(), ...Object.fromEntries(Object.entries(rest).filter(([, value]) => value !== undefined && value !== false)),
+        }, { shot, before });
+        const previous = this.latest.get(entry.view.id);
+        if (previous && previous.id !== review.id)
+            this.reviews.expire(previous, new Set([review.shot?.hash, review.before?.hash].filter((hash) => Boolean(hash))));
+        this.latest.set(entry.view.id, review);
+        run?.reviews.set(entry.app.id, review.id);
+        return review;
     }
     /** Servers running in the workspace that this session doesn't preview yet. */
     async offers(sessionId, workspace) {
@@ -114,7 +270,8 @@ export class AppService {
     /** `direct` opens the app origin itself (no shell): a signed-in device
      * returning to a view's stable address. */
     /** `scale`: the opening device's pixel density, used if this starts a display. */
-    async open(sessionId, appId, viewId, returnTo, direct = false, scale) {
+    /** `page`: start on this page instead of the app's root (a review card's page). */
+    async open(sessionId, appId, viewId, returnTo, direct = false, scale, page) {
         const entry = this.registry.requireView(sessionId, appId, viewId);
         if (entry.target.kind === "display" && !entry.display)
             entry.displayScale = scale === 2 ? 2 : 1;
@@ -123,15 +280,18 @@ export class AppService {
                 throw new Error("Bivy's preview service is unavailable on this connection.");
             if (direct && !this.gateway.openDirect)
                 throw new Error("This machine can't open previews directly.");
-            const url = direct ? this.gateway.openDirect(viewId) : this.gateway.open(viewId, returnTo);
+            let url = direct ? this.gateway.openDirect(viewId) : this.gateway.open(viewId, returnTo);
+            if (page && page.startsWith("/") && !page.startsWith("//") && page.length <= 2048)
+                url += `~${encodeURIComponent(page).replace(/~/g, "%7E")}`;
             // Don't wait for a managed server to boot: the preview shows it starting
             // and reloads itself once it answers.
             if (this.servers.get(viewId))
                 this.servers.get(viewId).restarts = [];
             void this.ensureServer(entry).catch(() => { });
+            entry.openedAt = Date.now();
             // Compare needs a "before": take a baseline the first time it's opened.
             if (!entry.shots?.length && this.screenshots.enabled())
-                setTimeout(() => void this.capture([viewId]), COMPARE_SETTLE_MS).unref?.();
+                setTimeout(() => void this.capture([viewId]), this.settleMs).unref?.();
             return { kind: "web", url };
         }
         if (entry.target.kind !== "terminal")

package/dist/apps/styles.css

@@ -116,6 +116,10 @@ input, textarea, select { font-family: inherit; font-size: 16px; }
 }
 .menu-item:hover, .menu-item[aria-checked="true"], .menu-item.active { background: var(--surface-2); }
 .menu-item.danger { color: var(--danger); }
+.menu-item-label { flex: 1; min-width: 0; }
+.menu-item.separated { margin-top: var(--space-1); border-top: 1px solid var(--line); border-radius: 0 0 var(--radius-sm) var(--radius-sm); }
+/* A section title inside a menu (e.g. "Preview cards" above its choices). */
+.menu-heading { padding: var(--space-2) var(--space-3) var(--space-1); color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-semibold); letter-spacing: 0.04em; text-transform: uppercase; }
 
 /* ---- Feedback ---- */
 .toast {
@@ -3038,6 +3042,21 @@ select.picker-search { appearance: auto; }
 .app-row-meta { color: var(--muted); font-size: var(--text-xs); line-height: var(--lh-xs); }
 .app-row-action { flex: none; display: flex; align-items: center; gap: var(--space-1); }
 .app-message { margin-block: var(--space-2); }
+/* Review card (ReviewCard.tsx): the app at a moment worth judging. The
+   screenshot is shown whole, phone-shaped, on a quiet stage; Before/Now is the
+   canonical .segmented switch; one primary action. */
+.review-card { margin-block: var(--space-2); max-inline-size: 440px; }
+.review-stage { display: flex; flex-direction: column; align-items: center; gap: var(--space-2); margin: 0 var(--space-3); padding: var(--space-3); border-radius: var(--radius-md); background: var(--surface-2); }
+.review-shot { display: grid; place-items: center; padding: 0; border: 1px solid var(--line); border-radius: var(--radius-md); background: var(--bg); overflow: hidden; cursor: zoom-in; box-shadow: var(--shadow-sm); }
+.review-shot img { display: block; inline-size: auto; block-size: auto; max-inline-size: 100%; max-block-size: min(300px, 40vh); }
+.review-loading { display: grid; place-items: center; inline-size: 139px; block-size: min(300px, 40vh); max-inline-size: 100%; }
+.review-gone { margin: 0; padding: var(--space-6) var(--space-3); color: var(--muted); font-size: var(--text-sm); text-align: center; }
+.review-side .seg-btn { min-block-size: 44px; min-inline-size: 72px; }
+.review-banner { margin: 0 var(--space-3); }
+.review-note { margin: var(--space-3) var(--space-3) 0; padding-inline-start: var(--space-3); border-inline-start: 2px solid var(--line-strong); color: var(--ink); font-size: var(--text-sm); white-space: pre-wrap; }
+.review-status { margin: var(--space-2) var(--space-3) 0; color: var(--muted); font-size: var(--text-sm); }
+.review-actions { display: flex; padding: var(--space-3); }
+.review-actions .btn { flex: 1; min-block-size: 44px; }
 
 /* Apps sheet (AppsSheet.tsx): one card per app, its views nested, one primary
    action per view; secondary tools as quiet icon buttons; rare or destructive

package/dist/apps/types.js

@@ -1,5 +1,21 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
+export const REVIEW_CARD_MODES = ["ready", "every", "off"];
+export const APP_REVIEW_BLOCK = "bivy_app_review";
+const isShot = (value) => {
+    const shot = value;
+    return !!shot && typeof shot.hash === "string" && /^[0-9a-f]{64}$/.test(shot.hash) && [shot.size, shot.width, shot.height].every((n) => typeof n === "number" && n >= 0);
+};
+export function isAppReview(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const review = value;
+    return typeof review.id === "string" && typeof review.sessionId === "string" && typeof review.appId === "string" && /^[a-f0-9]{32}$/.test(review.appId)
+        && typeof review.viewId === "string" && typeof review.name === "string" && typeof review.view === "string" && typeof review.path === "string"
+        && (review.trigger === "present" || review.trigger === "run" || review.trigger === "asked") && typeof review.at === "number"
+        && (review.shot === undefined || isShot(review.shot)) && (review.before === undefined || isShot(review.before))
+        && (review.note === undefined || typeof review.note === "string");
+}
 export const APP_PUBLICATION_BLOCK = "bivy_app";
 export function isAppReference(value) {
     if (!value || typeof value !== "object")

package/dist/controllers/app-commands.js

@@ -20,8 +20,12 @@ export function createAppCommands(service, workspaceFor, published = () => { })
             published(app);
             return { app };
         },
-        "apps.open": (msg) => service.open(String(msg.sessionId), String(msg.appId), String(msg.viewId), typeof msg.returnTo === "string" ? msg.returnTo : undefined, msg.direct === true, typeof msg.scale === "number" ? msg.scale : undefined),
+        "apps.open": (msg) => service.open(String(msg.sessionId), String(msg.appId), String(msg.viewId), typeof msg.returnTo === "string" ? msg.returnTo : undefined, msg.direct === true, typeof msg.scale === "number" ? msg.scale : undefined, typeof msg.path === "string" ? msg.path : undefined),
         "apps.shot": (msg) => service.shot(String(msg.sessionId), typeof msg.appId === "string" ? msg.appId : undefined, { widths: msg.widths, themes: msg.themes, path: typeof msg.path === "string" ? msg.path : undefined }),
+        "apps.present": (msg) => service.present(String(msg.sessionId), { target: typeof msg.target === "string" ? msg.target : undefined, path: typeof msg.path === "string" ? msg.path : undefined, note: typeof msg.note === "string" ? msg.note : undefined }),
+        "apps.showMe": (msg) => service.present(String(msg.sessionId), { target: typeof msg.appId === "string" ? msg.appId : undefined, trigger: "asked" }),
+        "apps.mute": (msg) => service.mute(String(msg.sessionId)),
+        "apps.reviewMode": (msg) => service.setReviewMode(String(msg.sessionId), String(msg.appId), msg.mode),
         "apps.clearNotes": (msg) => service.clearNotes(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.logs": (msg) => service.logs(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.share": (msg) => service.share(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
@@ -31,7 +35,7 @@ export function createAppCommands(service, workspaceFor, published = () => { })
     return Object.fromEntries(Object.entries(operations).map(([kind, execute]) => [kind, async (msg, ctx) => {
             try {
                 ctx.reply({ type: `${kind}.ok`, requestId: msg.requestId, ...await execute(msg) });
-                if (kind === "apps.publish" || kind === "apps.adopt" || kind === "apps.remove")
+                if (kind === "apps.publish" || kind === "apps.adopt" || kind === "apps.remove" || kind === "apps.reviewMode")
                     ctx.broadcast({ type: "apps.changed", sessionId: msg.sessionId });
             }
             catch (error) {

package/dist/protocol/client-command-routes.js

@@ -3,7 +3,7 @@
 /** Direct-mode adapters for operations whose canonical implementation is the
  * client command registry. Relay and HTTP now differ only in framing. */
 export const CLIENT_COMMAND_ROUTES = [
-    ...["list", "publish", "offers", "adopt", "open", "logs", "shot", "clearNotes", "share", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
+    ...["list", "publish", "offers", "adopt", "open", "logs", "shot", "present", "showMe", "mute", "reviewMode", "clearNotes", "share", "revoke", "remove"].map((action) => ({ method: "post", path: `/api/apps/${action}`, kind: `apps.${action}` })),
     { method: "post", path: "/api/artifacts/list", kind: "artifacts.list" },
     { method: "post", path: "/api/auth/credentials/native-preview", kind: "credentials.native.preview" },
     { method: "post", path: "/api/auth/credentials/native-import", kind: "credentials.native.import" },

package/dist/protocol/client-command-schemas.js

@@ -13,8 +13,12 @@ export const CLIENT_COMMAND_SCHEMAS = {
     "apps.publish": Type.Object({ ...request, ...session, manifest: Type.Unknown() }),
     "apps.offers": Type.Object({ ...request, ...session }),
     "apps.adopt": Type.Object({ ...request, ...session, port: Type.Integer({ minimum: 1024, maximum: 65535 }) }),
-    "apps.open": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String(), returnTo: Type.Optional(Type.String({ maxLength: 2048 })), direct: Type.Optional(Type.Boolean()), scale: Type.Optional(Type.Integer({ minimum: 1, maximum: 2 })) }),
+    "apps.open": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String(), returnTo: Type.Optional(Type.String({ maxLength: 2048 })), direct: Type.Optional(Type.Boolean()), scale: Type.Optional(Type.Integer({ minimum: 1, maximum: 2 })), path: Type.Optional(Type.String({ maxLength: 2048 })) }),
     "apps.shot": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String()), widths: Type.Optional(Type.Array(Type.Integer(), { maxItems: 4 })), themes: Type.Optional(Type.Array(Type.Union([Type.Literal("light"), Type.Literal("dark")]), { maxItems: 2 })), path: Type.Optional(Type.String({ maxLength: 2048 })) }),
+    "apps.present": Type.Object({ ...request, ...session, target: Type.Optional(Type.String({ maxLength: 200 })), path: Type.Optional(Type.String({ maxLength: 2048 })), note: Type.Optional(Type.String({ maxLength: 2000 })) }),
+    "apps.showMe": Type.Object({ ...request, ...session, appId: Type.Optional(Type.String()) }),
+    "apps.mute": Type.Object({ ...request, ...session }),
+    "apps.reviewMode": Type.Object({ ...request, ...session, appId: Type.String(), mode: Type.Union([Type.Literal("ready"), Type.Literal("every"), Type.Literal("off")]) }),
     "apps.clearNotes": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.logs": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),
     "apps.share": Type.Object({ ...request, ...session, appId: Type.String(), viewId: Type.String() }),

package/dist/server.js

@@ -32,6 +32,7 @@ import { AppRegistry } from "./apps/registry.js";
 import { AppGateway } from "./apps/gateway.js";
 import { RemotePreview } from "./apps/remote-preview.js";
 import { AppService } from "./apps/service.js";
+import { pngSize, reviewHint } from "./apps/review.js";
 import { DisplayHost } from "./apps/display.js";
 import { createAppCommands } from "./controllers/app-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
@@ -921,6 +922,9 @@ function harnessDirFor(record) {
  *  changes card — acceptable for a best-effort diff, and the prompt no longer
  *  waits on git. Never throws into the prompt path. */
 function harnessBeginTurn(record) {
+    // A run starts: review cards measure what the app looked like before it.
+    appService.runStarted(record.id);
+    record.runReview = undefined;
     const dir = harnessDirFor(record);
     record.harnessTurnReady = undefined;
     record.harnessTurnFinished = false;
@@ -952,9 +956,12 @@ function finishHarnessTurn(record) {
     if (record.harnessTurnFinished)
         return;
     record.harnessTurnFinished = true;
-    void harnessEndTurn(record).finally(() => {
+    const ended = harnessEndTurn(record);
+    void ended.finally(() => {
         void replication.onTurnComplete(record.id);
     });
+    // After the diff has bumped preview revisions: decide on this run's review card.
+    record.runReview = ended.then(() => appService.runEnded(record.id)).catch(() => undefined);
 }
 async function harnessEndTurn(record) {
     const previous = record.workspaceState === "dirty" ? "dirty" : "clean";
@@ -1776,10 +1783,15 @@ function referencedAttachmentHashes() {
     // `scan`, not `entries`: this visits every session ever created, and must not pin
     // each one's full log in the event-log cache.
     for (const id of ids) {
-        for (const entry of eventLog.scan(id, ["attachment", "outbound-attachment", "inline-image"])) {
+        for (const entry of eventLog.scan(id, ["attachment", "outbound-attachment", "inline-image", "app-review"])) {
             if (entry.bivyKind === "attachment")
                 for (const ref of entry.refs)
                     hashes.add(ref.hash);
+            else if (entry.bivyKind === "app-review") {
+                for (const shot of [entry.review.shot, entry.review.before])
+                    if (shot)
+                        hashes.add(shot.hash);
+            }
             else if (entry.bivyKind === "outbound-attachment" || entry.bivyKind === "inline-image")
                 hashes.add(entry.ref.hash);
         }
@@ -1976,6 +1988,55 @@ const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, pr
 const remotePreview = new RemotePreview(appRegistry, appReturnOrigins, appSignIn);
 // Desktop app views: one private display per view, started on first open.
 const appDisplays = new DisplayHost();
+/** Review cards: screenshots become encrypted attachments (fetched by hash
+ * like any image), and the card is logged so it survives a reload. A card
+ * that updates moves to the end of the run; an expired one stays put. */
+function createReviewSink() {
+    const anchors = new Map();
+    const emit = (review, anchor) => {
+        const record = resolveSession(review.sessionId);
+        if (!record)
+            return;
+        const at = anchor ?? { afterMessageCount: record.session.getMessages().length, createdAt: Date.now() };
+        anchors.set(review.id, at);
+        eventLog.appendAppReview(record.id, { ...at, review });
+        broadcast(stampSessionEvent({ type: "session.event", sessionId: record.id, event: { type: "app_review", id: review.id, review } }));
+    };
+    const store = (png, name) => {
+        if (!png)
+            return undefined;
+        try {
+            const ref = attachmentStore.put(png, { name, mimeType: "image/png", kind: "image" });
+            return { hash: ref.hash, size: ref.size, ...pngSize(png) };
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        publish(review, images) {
+            const card = { ...review };
+            const shot = store(images.shot, `${review.name} ${review.path}.png`);
+            const before = store(images.before, `${review.name} ${review.path} before.png`);
+            if (shot)
+                card.shot = shot;
+            if (before)
+                card.before = before;
+            emit(card);
+            return card;
+        },
+        expire(review, keep) {
+            const record = resolveSession(review.sessionId);
+            for (const hash of [review.shot?.hash, review.before?.hash]) {
+                // Never delete bytes anything else in the chat points at.
+                if (hash && !keep.has(hash) && !record?.seenAttachmentHashes?.has(hash))
+                    attachmentStore.remove(hash);
+            }
+            const { shot: _shot, before: _before, ...rest } = review;
+            emit({ ...rest, expired: true }, anchors.get(review.id));
+        },
+    };
+}
 const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     start: async (spec) => {
         let failure = "Could not start the app terminal.";
@@ -1990,7 +2051,7 @@ const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     },
     has: (id) => terminals.has(id),
     close: (id) => { terminals.close(id); },
-}, { screenshots: { enabled: appScreenshotsEnabled }, displays: appDisplays });
+}, { screenshots: { enabled: appScreenshotsEnabled }, displays: appDisplays, reviews: createReviewSink() });
 // A reviewer's note shows up in an open Apps sheet without reopening it.
 appRegistry.on("notes", (viewId) => {
     const entry = appRegistry.getView(viewId);
@@ -3999,6 +4060,19 @@ function sessionNotifyLabel(record, fallback = "A session") {
         return `${agent} · ${branch}`;
     return agent || branch || fallback;
 }
+/** How long the "finished" notification waits for a review card. */
+const DONE_REVIEW_WAIT_MS = 30_000;
+async function doneNotification(record) {
+    const label = sessionNotifyLabel(record);
+    const review = await Promise.race([record.runReview ?? Promise.resolve(undefined), new Promise((r) => setTimeout(r, DONE_REVIEW_WAIT_MS))]);
+    const base = { kind: "session_done", sessionId: record.id, targetSessionId: record.id, title: "Session finished" };
+    // No card, but the session has a preview: the notification offers Show me.
+    const showMe = appRegistry.list(record.id).some((app) => app.views.some((view) => view.kind === "web"));
+    if (!review || review.expired)
+        return { ...base, body: `${label} finished — tap to review the result.`, ...(showMe ? { showMe } : {}) };
+    const hint = reviewHint(review);
+    return { ...base, title: `${label} finished`, body: hint.body, review: hint.review };
+}
 async function sendNotificationHint(input) {
     if (!sessionAdvertiseTarget)
         return;
@@ -7762,13 +7836,10 @@ function attachSessionListeners(record) {
                 });
             }
             else if (!record.isWorking && !record.remoteActive && clients.size === 0 && (relay?.clientCount ?? 0) === 0 && (record.backgroundTaskCount ?? 0) === 0) {
-                void sendNotificationHint({
-                    kind: "session_done",
-                    sessionId: record.id,
-                    targetSessionId: record.id,
-                    title: "Session finished",
-                    body: `${sessionNotifyLabel(record)} finished — tap to review the result.`,
-                });
+                // Nobody is watching: the one "finished" notification also says when
+                // the app changed, and opens its review card. Waits (bounded) for the
+                // card; the hint carries IDs only, never the screenshot.
+                void doneNotification(record).then((hint) => sendNotificationHint(hint));
             }
             // Any turn that didn't schedule another resume broke the limit streak —
             // clear the durable counter so a future limit starts with a full budget

package/dist/session/attachment-store.js

@@ -195,4 +195,19 @@ export class AttachmentStore {
             return null;
         }
     }
+    /** Delete one blob now, for a caller that knows nothing else references it
+     * (an expired review card's screenshot). Best-effort. */
+    remove(hash) {
+        const p = this.getPath(hash);
+        if (!p)
+            return;
+        try {
+            fs.unlinkSync(p);
+        }
+        catch { /* already gone */ }
+        try {
+            fs.unlinkSync(this.metaPath(hash));
+        }
+        catch { /* sidecar optional */ }
+    }
 }

package/dist/session/event-log.js

@@ -29,7 +29,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { normalizedIntermediateText, thinkingTextFromContent, mergeTranscript } from "./transcript-merge.js";
-import { APP_PUBLICATION_BLOCK, isAppReference } from "../apps/types.js";
+import { APP_PUBLICATION_BLOCK, APP_REVIEW_BLOCK, isAppReference, isAppReview } from "../apps/types.js";
 /**
  * Decompose a transcript message into serialization-independent "atoms": the
  * agent's own tool ids (unique + identical across serializations) and its text
@@ -241,8 +241,14 @@ function isAppPublication(value) {
     const entry = value;
     return entry.bivyKind === "app-publication" && typeof entry.id === "string" && typeof entry.createdAt === "number" && typeof entry.afterMessageCount === "number" && isAppReference(entry.app);
 }
+function isAppReviewEntry(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const entry = value;
+    return entry.bivyKind === "app-review" && typeof entry.id === "string" && typeof entry.createdAt === "number" && typeof entry.afterMessageCount === "number" && isAppReview(entry.review);
+}
 function isRecord(value) {
-    return isOverlay(value) || isBase(value) || isAttachment(value) || isOutboundAttachment(value) || isInlineImage(value) || isAppPublication(value);
+    return isOverlay(value) || isBase(value) || isAttachment(value) || isOutboundAttachment(value) || isInlineImage(value) || isAppPublication(value) || isAppReviewEntry(value);
 }
 /**
  * Fold attachment records into a text→refs list: last write wins per text (a
@@ -353,7 +359,18 @@ export function replayExtras(entries) {
         role: "assistant", content: [{ type: APP_PUBLICATION_BLOCK, app: entry.app }],
         id: entry.id, afterMessageCount: entry.afterMessageCount, createdAt: entry.createdAt,
     }));
-    return [...foldIntermediate(intermediate), ...foldTool(tool), ...replayOutboundAttachments(entries), ...publications];
+    // Last write wins: a card that updated in place shows its latest state, at its latest position.
+    const reviews = new Map();
+    for (const entry of entries)
+        if (entry.bivyKind === "app-review") {
+            reviews.delete(entry.id);
+            reviews.set(entry.id, entry);
+        }
+    const cards = [...reviews.values()].map((entry) => ({
+        role: "assistant", content: [{ type: APP_REVIEW_BLOCK, review: entry.review }],
+        id: entry.id, afterMessageCount: entry.afterMessageCount, createdAt: entry.createdAt,
+    }));
+    return [...foldIntermediate(intermediate), ...foldTool(tool), ...replayOutboundAttachments(entries), ...publications, ...cards];
 }
 /**
  * Fold the outbound (agent-sent) attachment records into time-anchored synthetic
@@ -648,6 +665,11 @@ export class EventLog {
         this.load(id);
         this.enqueue(id, `app:${entry.id}`, { ...entry, app: { ...entry.app }, bivyKind: "app-publication", createdAt: Date.now() });
     }
+    /** `createdAt`/`afterMessageCount` place the card; an expired card keeps its original place. */
+    appendAppReview(id, entry) {
+        this.load(id);
+        this.enqueue(id, `review:${entry.review.id}`, { bivyKind: "app-review", createdAt: entry.createdAt ?? Date.now(), afterMessageCount: entry.afterMessageCount, id: entry.review.id, review: structuredClone(entry.review) });
+    }
     appendOutboundAttachment(id, entry) {
         this.load(id);
         const record = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.17.3-staging.20",
+  "version": "0.17.3-staging.22",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",