@bivy/bivy 0.18.10 → 0.18.11-staging.10

package/bin/prune-sessions.mjs

@@ -9,6 +9,8 @@
 // not just Pi's `.bivy/pi/sessions`. Prune selects from that index; these helpers
 // decide which entries are stale. No I/O here on purpose.
 
+import path from "node:path";
+
 // Mirrors the server's isEmptyUntitledSummary: a session with no real title, no
 // first message and no messages is the hidden "Untitled" noise the sidebar filters
 // out. Keep-N protects only *real* sessions; empties are always eligible.
@@ -30,6 +32,42 @@ export function sessionActivityMs(s) {
   return 0;
 }
 
+// A Bivy-managed worktree lives at <repo>/.bivy/worktrees/<slug>. Only those are
+// ever removed on a session's behalf — never an arbitrary path a record names.
+export function isManagedWorktreePath(p) {
+  const parts = path.resolve(String(p ?? "")).split(path.sep);
+  return parts.length >= 3 && parts[parts.length - 3] === ".bivy" && parts[parts.length - 2] === "worktrees";
+}
+
+// Sessions and their worktrees are pruned as one unit, so neither outlives the
+// other. Selection runs per kind (sessions and worktrees have different keep
+// counts), then this links the two removal sets:
+//   - a session goes when its worktree goes, or when its worktree is already
+//     gone from disk (a session that can no longer open its checkout);
+//   - a worktree goes when every session using it goes (and no live agent holds it).
+// Live ("working") sessions are never added, and their worktree is never removed. `isLive(path)` / `exists(path)` are
+// the caller's I/O; paths are compared resolved. Returns the widened sets.
+export function linkSessionWorktrees({ sessions, staleSessions, staleWorktrees, isLive = () => false, exists = () => true }) {
+  const removeSessions = new Map(staleSessions.map((s) => [s.id, s]));
+  const removeWorktrees = new Set(staleWorktrees.map((p) => path.resolve(p)));
+  const byWorktree = new Map();
+  for (const s of sessions) {
+    if (!s.worktree || !isManagedWorktreePath(s.worktree)) continue;
+    const wt = path.resolve(s.worktree);
+    byWorktree.set(wt, [...(byWorktree.get(wt) ?? []), s]);
+  }
+  for (const [wt, owners] of byWorktree) {
+    if (owners.some((s) => s.status === "working")) removeWorktrees.delete(wt);
+    else if (exists(wt) && owners.every((s) => removeSessions.has(s.id)) && !isLive(wt)) removeWorktrees.add(wt);
+  }
+  for (const [wt, owners] of byWorktree) {
+    if (!removeWorktrees.has(wt) && exists(wt)) continue;
+    for (const s of owners) if (s.status !== "working") removeSessions.set(s.id, s);
+  }
+  const sorted = [...removeSessions.values()].sort((a, b) => sessionActivityMs(b) - sessionActivityMs(a));
+  return { sessions: sorted, worktrees: [...removeWorktrees] };
+}
+
 // Removal set for sessions. Live ("working") sessions are never touched. The
 // newest `keep` NON-EMPTY sessions (across every agent) survive; empty/untitled
 // sessions are always beyond the keep window. An item is removed only when it is

package/dist/agent-instructions.js

@@ -42,6 +42,10 @@ export const BIVY_AGENT_NOTE = [
         '`bivy suggest "<complete instruction>" [--title "short label"]` instead of only listing them. The user can ' +
         "start each in one tap, in this session or in a parallel one that works in its own copy of the project, so " +
         "write it to stand on its own, with paths relative to the project root.",
+    "- Only when the user asks for another agent or another of their machines to take part: " +
+        '`bivy delegate "<self-contained task>" --agent <id> [--machine <name>] --wait` runs it there and prints ' +
+        "its answer and any branch/PR; `--to codex,grok@<machine>` asks several to compare, `bivy delegate machines` " +
+        "lists machines and their agents. Use your own sub-agents for everything else.",
 ].join("\n");
 const PREAMBLE = "The user's global Bivy instructions follow. They apply to every workspace; where they conflict with " +
     "instructions from the current repository (AGENTS.md, CLAUDE.md, …), the repository's instructions win.";

package/dist/agents/claude-code/integration.js

@@ -4,7 +4,7 @@ import { defineAgentIntegration } from "../definition.js";
 import { withExactCapabilitySurface } from "../../runtime/types.js";
 import { createCredentialStore } from "../../runtime/credentials.js";
 import { ClaudeCodeRuntime, claudeRuntimeFromEnv, claudeSdkInstalled, } from "./runtime.js";
-export const CLAUDE_TESTED_VERSION = "0.3.281";
+export const CLAUDE_TESTED_VERSION = "0.3.284";
 const CLAUDE_CAPABILITIES = withExactCapabilitySurface({
     toolInterception: true,
     modelSelection: true,

package/dist/agents/claude-code/runtime.js

@@ -285,6 +285,11 @@ const INTERRUPT_MARKER = /^\s*\[Request interrupted by user/;
 function hasMetaFlag(entry) {
     return entry?.isMeta === true || entry?.isCompactSummary === true || entry?.isSynthetic === true;
 }
+/** True when an assistant message is the CLI's stand-in for a failed API call
+ *  (SDK `error`, transcript `isApiErrorMessage`) rather than the model's reply. */
+function isApiErrorMessage(message) {
+    return Boolean(message?.error) || message?.isApiErrorMessage === true;
+}
 /** True when a role:"user" turn is a model-only meta injection (see
  *  DROP_META_TEXT) rather than a real human prompt. Callers must exclude
  *  tool_result-bearing turns first — those carry real tool output, never meta. */
@@ -1084,6 +1089,10 @@ class ClaudeSession {
         if (!images.length)
             return;
         const toolUseId = String(block.tool_use_id ?? "");
+        // A file read returns an image that already exists on disk — most often
+        // one the user just uploaded — so surfacing it would repeat it in chat.
+        if (this.toolDetailsByUseId.get(toolUseId)?.kind === "read")
+            return;
         const toolName = this.toolNamesByUseId.get(toolUseId) ?? "tool";
         for (const image of images) {
             const byteLength = Buffer.byteLength(image.data, "base64");
@@ -1123,9 +1132,12 @@ class ClaudeSession {
                     break;
                 // Claude Code sometimes reports auth failures as an ordinary assistant
                 // text message rather than throwing. Intercept it before it is persisted
-                // or shown, refresh, and transparently continue the same prompt.
+                // or shown, refresh, and transparently continue the same prompt. Only a
+                // message the SDK flags as an API error qualifies: matching the model's
+                // own prose (an answer that mentions "no … token") re-drove the prompt
+                // after the turn had already answered it.
                 const assistantText = extractText(message.message);
-                if (assistantText && await this.recoverFromAuthError(assistantText))
+                if (isApiErrorMessage(message) && assistantText && await this.recoverFromAuthError(assistantText))
                     break;
                 const model = message.message?.model;
                 if (model)
@@ -1282,6 +1294,17 @@ class ClaudeSession {
                 // falls through so its capabilities/commands reach the client.)
                 if (message?.subtype === "task_notification" || message?.subtype === "compact_boundary")
                     break;
+                // Banners Claude Code shows the user: a hook's block reason, slash-command
+                // output, warnings (SDK 0.3.283+). Show them as the chat's system notice
+                // and keep them in the transcript; "info" is transcript-mode-only upstream.
+                if (message?.subtype === "informational") {
+                    const text = typeof message.content === "string" ? message.content.trim() : "";
+                    if (text && message.level !== "info") {
+                        this.messages.push({ role: "system", content: text, timestamp: Date.now() });
+                        this.emit({ type: "session.notice", level: message.level === "warning" ? "warning" : "info", message: text });
+                    }
+                    break;
+                }
                 this.emit({ type: String(message?.type ?? "unknown"), raw: message });
                 break;
             }

package/dist/agents/codex/integration.js

@@ -10,7 +10,7 @@ import { codexCredentialPreflight } from "../../runtime/codex-preflight.js";
 import { deleteCodexSession, discoverNativeCodexSessions, loadCodexTranscript, writeCodexRollout, exportCodexRollout, importCodexRollout, } from "../../runtime/codex-sessions.js";
 import { ProtocolRuntime } from "../../runtime/protocol.js";
 import { codexSlashCommands } from "../../runtime/slash-commands.js";
-export const CODEX_TESTED_VERSION = "0.156.1";
+export const CODEX_TESTED_VERSION = "0.159.0";
 function codexCommand() {
     return process.env.BIVY_CODEX_BIN?.trim() || "codex";
 }

package/dist/agents/profiles.js

@@ -43,7 +43,7 @@ export const AGENT_PROFILES = {
         // Approve/Deny + session/load resume + a real model picker), the same bar Pi,
         // Claude Code, and Codex clear. See `acp` below for the version fallback.
         supportTier: "supported",
-        testedVersion: "1.18.32",
+        testedVersion: "1.18.33",
         blurb: "The most widely used open-source coding harness (OpenCode CLI).",
         // `opencode run -s <id> "<prompt>"` continues a prior session by its own id
         // (`-s, --session  session id to continue`, per `opencode run --help`).
@@ -363,7 +363,7 @@ export const AGENT_PROFILES = {
         // Approve/Deny + native resume + live model state), the same bar Pi, Claude
         // Code, Codex, and OpenCode clear. See `acp` below for the version fallback.
         supportTier: "supported",
-        testedVersion: "1.0.41",
+        testedVersion: "1.0.44",
         authOwner: "mixed",
         blurb: "xAI's official Grok coding agent (Grok CLI) — SuperGrok/X subscription or API key.",
         // Official CLI: `grok -p "<prompt>"` (alias `--single`) runs one headless
@@ -424,7 +424,7 @@ export const AGENT_PROFILES = {
         // (protocolVersion 1: session/new, session/prompt, session/request_permission,
         // loadSession resume, live model state) — the governed ProtocolRuntime path
         // that supersedes the `--always-approve` pipe above with real per-tool
-        // Approve/Deny. Validated against grok 1.0.41, so it is ON by default
+        // Approve/Deny. Validated against grok 1.0.44, so it is ON by default
         // (`preferred`) — gated on the binary actually describing the `agent`
         // subcommand ("Run Grok without the interactive UI" in `grok --help`), so an
         // older CLI falls back to the pipe path rather than opening a dead session.

package/dist/apps/gateway.js

@@ -132,6 +132,8 @@ const poll=async()=>{try{const r=await fetch(location.href,{method:'HEAD',cache:
 }
 /** Copied links are reusable until revoked, capped so a forgotten one lapses. */
 export const SHARE_TTL = 24 * HOUR;
+/** The longest a copied link may be asked to last. */
+export const SHARE_TTL_MAX = 7 * 24 * HOUR;
 /** Bivy's packaged apps load the client from their own scheme, so a preview
  * framed there has this ancestor instead of a web origin. (Node's URL gives
  * these "null" origins, so they cannot be configured as return origins.) */
@@ -204,9 +206,13 @@ export class AppGateway {
         ["/__bivy/styles.css", readFileSync(new URL("./styles.css", import.meta.url))],
     ]);
     /** `reviewer`: the browser session came from a copied (shared) link.
+     *  `viewOnly`: that link came without the reviewer tools.
      *  `embedded`: it runs framed inside a Bivy client (a third-party frame). */
     sessions = new Map();
     sockets = new Map();
+    /** Connections opened by people with a copied link, so Stop sharing can end
+     * theirs and leave the owner's. */
+    shared = new WeakSet();
     captureAfter = 0;
     capturing = false;
     displays = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: false });
@@ -255,11 +261,33 @@ export class AppGateway {
         return `${this.origin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: Date.now() + 60_000 })}`;
     }
     /** Public reviewers use the same isolated controls as the owner, but can
-     * only submit notes. Valid until revoked or SHARE_TTL. */
-    share(id) {
+     * only submit notes; without `controls` they only see the app. Valid until
+     * revoked, sharing stops, or `ttl` (SHARE_TTL by default). */
+    share(id, { ttl = SHARE_TTL, controls = true } = {}) {
         this.requireWeb(id);
-        const expiresAt = Date.now() + SHARE_TTL;
-        return { url: `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true })}`, expiresAt };
+        if (!Number.isFinite(ttl) || ttl <= 0 || ttl > SHARE_TTL_MAX)
+            throw new Error("A share link can last at most 7 days.");
+        const expiresAt = Date.now() + ttl;
+        return { url: `${this.shellOrigin(id)}${OPEN_PATH}#${this.grant({ appId: id, expires: expiresAt, reusable: true, ...(controls ? {} : { viewOnly: true }) })}`, expiresAt, controls };
+    }
+    /** Copied links that still work: how many, and when the last one lapses. */
+    sharing(id) {
+        this.sweep();
+        const links = [...this.tickets.values()].filter((grant) => grant.appId === id && grant.reusable);
+        return links.length ? { links: links.length, expiresAt: Math.max(...links.map((grant) => grant.expires)) } : undefined;
+    }
+    /** Ends every copied link and the browser sessions and connections opened
+     * from them. The owner's own previews keep working. */
+    unshare(id) {
+        for (const [key, grant] of this.tickets)
+            if (grant.appId === id && grant.reusable)
+                this.tickets.delete(key);
+        for (const [key, session] of this.sessions)
+            if (session.appId === id && session.reviewer)
+                this.sessions.delete(key);
+        for (const socket of this.sockets.get(id) ?? [])
+            if (this.shared.has(socket))
+                socket.destroy();
     }
     revoke(id) {
         for (const map of [this.tickets, this.sessions])
@@ -313,13 +341,15 @@ export class AppGateway {
         const session = token ? this.sessions.get(token) : undefined;
         return session?.appId === id ? session : undefined;
     }
-    authorize(req, id) { return this.session(req, id)?.expires; }
-    track(id, socket, expires) {
+    track(id, socket, session) {
+        const expires = session.expires;
         let sockets = this.sockets.get(id);
         if (!sockets) {
             sockets = new Set();
             this.sockets.set(id, sockets);
         }
+        if (session.reviewer)
+            this.shared.add(socket);
         if (sockets.has(socket))
             return;
         sockets.add(socket);
@@ -369,7 +399,7 @@ export class AppGateway {
             res.setHeader("Content-Type", "application/json");
             // Someone opening a shared link sees "Made with Bivy" under the app; the owner doesn't.
             const badge = grant.reusable && this.badge ? await this.badge().catch(() => true) : false;
-            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(grant.reusable ? { reviewer: true } : {}), ...(badge ? { badge: true } : {}), ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
+            res.end(JSON.stringify({ name: entry.app.name, origin: this.origin(id), returnTo: grant.returnTo, ...(grant.reusable ? { reviewer: true } : {}), ...(grant.viewOnly ? { controls: false } : {}), ...(badge ? { badge: true } : {}), ...(entry.target.kind === "display" ? { inspect: false } : {}) }));
             return;
         }
         res.writeHead(404);
@@ -433,7 +463,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             // A browser session never outlives the link that created it.
             const expires = Math.min(Date.now() + HOUR, grant.expires);
             const token = randomBytes(32).toString("hex");
-            this.sessions.set(token, { appId: id, expires, reviewer: grant.reusable === true, ...(embedded ? { embedded } : {}) });
+            this.sessions.set(token, { appId: id, expires, reviewer: grant.reusable === true, ...(grant.viewOnly ? { viewOnly: true } : {}), ...(embedded ? { embedded } : {}) });
             // Framed inside Bivy, the cookie is third-party: it must be SameSite=None,
             // and Partitioned keys it to Bivy's top-level site so no other site can use it.
             const scope = embedded ? "SameSite=None; Partitioned" : "SameSite=Lax";
@@ -442,16 +472,16 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             res.end();
             return;
         }
-        const session = this.session(req, id), expires = session?.expires;
+        const session = this.session(req, id);
         // A home-screen visit without access goes through Bivy to sign in, then
         // comes back to the same page. Framed loads keep the plain message.
-        const signIn = !expires && req.method === "GET" && req.headers["sec-fetch-dest"] === "document" && req.url?.startsWith("/") ? this.signIn?.(entry, req.url) : undefined;
+        const signIn = !session && req.method === "GET" && req.headers["sec-fetch-dest"] === "document" && req.url?.startsWith("/") ? this.signIn?.(entry, req.url) : undefined;
         if (signIn) {
             res.writeHead(303, { location: signIn });
             res.end();
             return;
         }
-        if (!expires) {
+        if (!session) {
             res.writeHead(401);
             res.end("Preview access expired. Open a new preview link from Bivy.");
             return;
@@ -472,7 +502,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
             res.end();
             return;
         }
-        this.track(id, req.socket, expires);
+        this.track(id, req.socket, session);
         if (req.url.startsWith(`${REVISION_PATH}?`) && req.method === "GET") {
             this.revision(req, res, entry);
             return;
@@ -483,10 +513,16 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         }
         if (req.url === INSPECTOR_PATH && req.method === "GET") {
             res.writeHead(200, { "content-type": "text/javascript; charset=utf-8", "cache-control": "no-store" });
-            res.end(inspectorScript(this.shellOrigin(id), session?.reviewer === true, session?.embedded === true));
+            res.end(inspectorScript(this.shellOrigin(id), session.reviewer === true && !session.viewOnly, session.embedded === true));
             return;
         }
         if (req.url === NOTES_PATH && req.method === "POST") {
+            // A view-only link shows the app and nothing else.
+            if (session.viewOnly) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
             await this.note(req, res, entry);
             return;
         }
@@ -880,13 +916,13 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
     }
     upgrade(req, socket, head) {
         const entry = this.entry(req);
-        const expires = entry && this.authorize(req, entry.view.id);
+        const session = entry && this.session(req, entry.view.id);
         const display = entry?.target.kind === "display";
-        if (!entry || !expires || (entry.target.kind !== "service" && !(display && req.url === DISPLAY_SOCKET_PATH)) || req.headers.origin !== this.origin(entry.view.id) || req.headers.upgrade?.toLowerCase() !== "websocket" || !req.url?.startsWith("/") || req.url.startsWith("//")) {
+        if (!entry || !session || (entry.target.kind !== "service" && !(display && req.url === DISPLAY_SOCKET_PATH)) || req.headers.origin !== this.origin(entry.view.id) || req.headers.upgrade?.toLowerCase() !== "websocket" || !req.url?.startsWith("/") || req.url.startsWith("//")) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
             return;
         }
-        this.track(entry.view.id, socket, expires);
+        this.track(entry.view.id, socket, session);
         if (display) {
             this.displaySocket(req, socket, head, entry);
             return;
@@ -898,7 +934,7 @@ fetch('${REDEEM_PATH}',{method:'POST',headers:{'Content-Type':'text/plain'},body
         upstream.setTimeout(10_000, () => upstream.destroy());
         upstream.on("upgrade", (response, peer, upstreamHead) => {
             peer.setTimeout(0);
-            this.track(entry.view.id, peer, expires);
+            this.track(entry.view.id, peer, session);
             const headers = cleanHeaders(response.headers);
             delete headers["set-cookie"];
             socket.write(`HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n${Object.entries(headers).filter(([, value]) => value !== undefined).map(([key, value]) => `${key}: ${value}\r\n`).join("")}\r\n`);

package/dist/apps/preview-shell.js

@@ -162,6 +162,8 @@ function show(data,launch){
     $('draft-text').maxLength=1000;
     $('send-errors').textContent='Leave a note…';
   }
+  // A view-only share link shows the app without Bivy's tools.
+  $('dock').hidden=data.controls===false;
   $('made-with').hidden=!data.badge;
   document.body.classList.toggle('badged',Boolean(data.badge));
   $('title').textContent=data.name;

package/dist/apps/remote-preview.js

@@ -65,11 +65,13 @@ export class RemotePreview {
             throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
         return this.gateway.open(id, returnTo);
     }
-    share(id) {
+    share(id, options) {
         if (!this.available)
             throw new Error("Preview delivery is unavailable. Reconnect the machine and try again.");
-        return this.gateway.share(id);
+        return this.gateway.share(id, options);
     }
+    sharing(id) { return this.gateway?.sharing(id); }
+    unshare(id) { this.gateway?.unshare(id); }
     revoke(id) { this.gateway?.revoke(id); }
     address(id) { return this.available ? this.gateway.address(id) : undefined; }
     openDirect(id) {

package/dist/apps/service.js

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+import { SHARE_DURATIONS } from "./types.js";
 import { randomBytes } from "node:crypto";
 import { REVIEW_MODES, shouldReview, visualChange } from "./review.js";
 import fs from "node:fs";
@@ -73,6 +76,9 @@ export class AppService {
                     view.stats = structuredClone(entry.stats);
                 if (entry?.lastPath)
                     view.lastPath = entry.lastPath;
+                const sharing = this.gateway?.sharing?.(view.id);
+                if (sharing)
+                    view.sharing = sharing;
             }
         return { apps, previewAvailable: available };
     }
@@ -577,18 +583,21 @@ export class AppService {
         void server.pending?.then((termId) => this.terminals.close(termId)).catch(() => { });
         this.servers.delete(id);
     }
-    share(sessionId, appId, viewId) {
+    share(sessionId, appId, viewId, options = {}) {
         if (this.registry.requireView(sessionId, appId, viewId).view.kind !== "web")
             throw new Error("Only web views have preview links.");
         if (!this.gateway)
             throw new Error("Bivy's preview service is unavailable on this connection.");
-        return this.gateway.share(viewId);
+        const duration = options.duration === undefined ? undefined : SHARE_DURATIONS.find((row) => row.id === options.duration);
+        if (options.duration !== undefined && !duration)
+            throw new Error(`A share link lasts ${SHARE_DURATIONS.map((row) => row.id).join(", ")}.`);
+        return this.gateway.share(viewId, { ...(duration ? { ttl: duration.ms } : {}), controls: options.controls !== false });
     }
     /** `bivy app share`: mints a share link for a web view picked by app and/or
      * view ID or name, like `present` (default: the one opened last). */
     shareView(sessionId, input) {
         const entry = this.pickTarget(sessionId, input);
-        return { ...this.share(sessionId, entry.app.id, entry.view.id), appId: entry.app.id, viewId: entry.view.id, app: entry.app.name, view: entry.view.name };
+        return { ...this.share(sessionId, entry.app.id, entry.view.id, input), appId: entry.app.id, viewId: entry.view.id, app: entry.app.name, view: entry.view.name };
     }
     clearNotes(sessionId, appId, viewId) {
         this.registry.requireView(sessionId, appId, viewId);
@@ -623,6 +632,12 @@ export class AppService {
             throw new Error(`No web view called "${input.view}"${input.app ? ` in "${input.app}"` : ""}. Run bivy app list to see them.`);
         return found;
     }
+    /** Ends a view's share links and what people opened with them; the owner's previews and the app stay. */
+    unshare(sessionId, appId, viewId) {
+        this.registry.requireView(sessionId, appId, viewId);
+        this.gateway?.unshare?.(viewId);
+        return { ok: true };
+    }
     /** Ends every link, browser session and open connection for one view; the app stays. */
     revoke(sessionId, appId, viewId) {
         this.registry.requireView(sessionId, appId, viewId);

package/dist/apps/styles.css

@@ -354,6 +354,9 @@ input, textarea, select { font-family: inherit; font-size: 16px; }
 @keyframes dot-pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.6; } }
 .session-row { position: relative; display: flex; align-items: center; }
 .session-row .session-item { flex: 1; min-width: 0; }
+/* A delegated child under its parent session (sessionNesting.ts). */
+.session-row.nested { padding-inline-start: var(--space-4); }
+.session-row.nested::before { content: ""; position: absolute; inset-block: var(--space-2); inset-inline-start: var(--space-2); border-inline-start: 1px solid var(--line-strong); }
 .pending-launch-actions { display: flex; flex: none; gap: 4px; padding-right: 6px; }
 .pending-launch-actions button { min-height: var(--space-7); min-width: var(--space-7); border: 1px solid var(--line-strong); border-radius: var(--radius-sm); background: var(--surface-2); color: var(--ink); padding: 5px 8px; font-size: 12px; cursor: pointer; }
 .pending-launch-actions button:last-child { color: var(--muted); background: transparent; }
@@ -1193,7 +1196,9 @@ button.sheet-action:last-child { border-bottom: 0; }
   margin: 0;
   max-height: calc(var(--app-h, 100dvh) - (2 * var(--space-5)));
 }
-.sheet-head { display: flex; align-items: center; gap: 10px; padding: 12px 16px; border-bottom: 1px solid var(--line); flex: none; touch-action: none; }
+/* Lifted above the sheet body so a menu opened from the header (the model
+   picker's reasoning menu) layers over the body's sticky search field. */
+.sheet-head { display: flex; align-items: center; gap: 10px; padding: 12px 16px; border-bottom: 1px solid var(--line); flex: none; touch-action: none; position: relative; z-index: calc(var(--z-sticky) + 1); }
 .sheet-title { font-weight: 700; flex: 1; }
 .sheet-close { border: 0; background: transparent; color: var(--muted); font-size: 22px; line-height: 1; min-width: var(--space-7); min-height: var(--space-7); }
 .sheet-close:active { transform: scale(0.9); }
@@ -3105,6 +3110,26 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .suggestion-actions, .suggestion-all { display: flex; flex-wrap: wrap; gap: var(--space-2); margin-top: var(--space-2); }
 .suggestion-all { padding-top: var(--space-2); border-top: 1px solid var(--line); }
 .suggestion-status { margin: var(--space-2) 0 0; display: flex; align-items: center; gap: var(--space-2); color: var(--ok); font-size: var(--text-sm); font-weight: var(--weight-medium); }
+/* Delegation (DelegationCard.tsx): a task handed to another agent/machine.
+   Shell from .card, status from .badge; layout only here. A fan-out renders as
+   one group whose members sit side by side where there is room. */
+.delegation-card { max-inline-size: 440px; display: flex; flex-direction: column; gap: var(--space-1); }
+.delegation-eyebrow { margin: 0; color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-semibold); }
+.delegation-head { display: flex; align-items: center; justify-content: space-between; gap: var(--space-2); }
+.delegation-head { align-items: flex-start; }
+.delegation-target { display: flex; flex-direction: column; font-weight: var(--weight-semibold); overflow-wrap: anywhere; min-inline-size: 0; }
+.delegation-machine { color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-normal); }
+.delegation-task { margin: 0; color: var(--muted); font-size: var(--text-sm); overflow-wrap: anywhere; display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; }
+.delegation-failure { margin: 0; color: var(--danger); font-size: var(--text-sm); overflow-wrap: anywhere; }
+.delegation-answer summary { cursor: pointer; color: var(--muted); font-size: var(--text-sm); }
+.delegation-answer p { margin: var(--space-1) 0 0; font-size: var(--text-sm); white-space: pre-wrap; overflow-wrap: anywhere; max-block-size: 18em; overflow-y: auto; }
+.delegation-refs { margin: 0; display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2); font-size: var(--text-sm); }
+.delegation-refs code { overflow-wrap: anywhere; }
+.delegation-actions { display: flex; flex-wrap: wrap; gap: var(--space-2); }
+.delegation-group { display: flex; flex-direction: column; gap: var(--space-1); margin-block: var(--space-2); }
+.delegation-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: var(--space-2); }
+.delegation-member { display: flex; flex-direction: column; gap: var(--space-1); min-inline-size: 0; }
+.delegation-member > .btn { align-self: flex-start; }
 /* Review card (ReviewCard.tsx): the app at a moment worth judging. The
    screenshot is shown whole, phone-shaped, on a quiet stage; Before/Now is the
    canonical .segmented switch; one primary action. */
@@ -3147,6 +3172,9 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .apps-empty strong { color: var(--ink); font-size: var(--text-base); }
 .apps-empty p { margin: 0; max-inline-size: 34ch; }
 .apps-foot { margin: 0; padding: 0 var(--space-1); color: var(--muted); font-size: var(--text-xs); line-height: var(--lh-xs); }
+/* Share sheet (AppAccess.tsx): the sharing status sits in the sheet, not at page edge. */
+.apps-sheet > .banner { border-radius: var(--radius-md); padding: var(--space-2) var(--space-3); }
+.apps-sheet > .settings-toggle-row { padding-inline: var(--space-1); }
 /* Peek: an app preview framed in a drawer over the chat (PreviewPeek.tsx). */
 .preview-peek { display: block; inline-size: 100%; block-size: 100%; border: 0; border-radius: var(--radius-md); background: var(--bg); }
 /* Share-sheet landing (ShareDestinationSheet.tsx): what was shared, then one

package/dist/apps/types.js

@@ -24,3 +24,11 @@ export function isAppReference(value) {
     const ref = value;
     return typeof ref.appId === "string" && /^[a-f0-9]{32}$/.test(ref.appId) && typeof ref.sessionId === "string" && ref.sessionId.length > 0 && typeof ref.name === "string" && ref.name.length <= 100;
 }
+/** How long a new share link works. Links live in the machine's memory, so a
+ * restart ends them sooner. Adding a choice means adding a row. */
+export const SHARE_DURATIONS = [
+    { id: "1h", label: "1 hour", ms: 3_600_000 },
+    { id: "1d", label: "1 day", ms: 86_400_000 },
+    { id: "7d", label: "7 days", ms: 7 * 86_400_000 },
+];
+export const DEFAULT_SHARE_DURATION = "1d";

package/dist/certification/generated.js

@@ -3,10 +3,10 @@
 export const CERTIFICATION_MATRIX = {
     schemaVersion: 1,
     agents: [
-        { id: "claude-code-sdk", status: "active", executionMode: "protocol", pinnedVersion: "0.3.281", capabilities: ["toolInterception", "modelSelection", "resume"] },
-        { id: "codex-approvals", status: "active", executionMode: "protocol", pinnedVersion: "0.156.1", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "claude-code-sdk", status: "active", executionMode: "protocol", pinnedVersion: "0.3.284", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "codex-approvals", status: "active", executionMode: "protocol", pinnedVersion: "0.159.0", capabilities: ["toolInterception", "modelSelection", "resume"] },
         { id: "pi", status: "active", executionMode: "protocol", pinnedVersion: "0.87.1", capabilities: ["toolInterception", "modelSelection", "resume"] },
-        { id: "opencode", status: "active", executionMode: "protocol", pinnedVersion: "1.18.32", capabilities: ["toolInterception", "modelSelection", "resume"] },
-        { id: "grok", status: "active", executionMode: "protocol", pinnedVersion: "1.0.41", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "opencode", status: "active", executionMode: "protocol", pinnedVersion: "1.18.33", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "grok", status: "active", executionMode: "protocol", pinnedVersion: "1.0.44", capabilities: ["toolInterception", "modelSelection", "resume"] },
     ]
 };

package/dist/controllers/app-commands.js

@@ -34,9 +34,13 @@ export function createAppCommands(service, workspaceFor, published = () => { })
         "apps.notes": (msg) => service.notes(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined, since: typeof msg.since === "number" ? msg.since : undefined }),
         "apps.logs": (msg) => service.logs(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         // The app UI passes exact IDs; `bivy app share` passes an app and/or view by ID or name.
-        "apps.share": (msg) => typeof msg.viewId === "string" && typeof msg.appId === "string"
-            ? service.share(String(msg.sessionId), msg.appId, msg.viewId)
-            : service.shareView(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined }),
+        "apps.share": (msg) => {
+            const options = { duration: msg.duration, controls: msg.controls !== false };
+            return typeof msg.viewId === "string" && typeof msg.appId === "string"
+                ? service.share(String(msg.sessionId), msg.appId, msg.viewId, options)
+                : service.shareView(String(msg.sessionId), { app: typeof msg.appId === "string" ? msg.appId : undefined, view: typeof msg.view === "string" ? msg.view : undefined, ...options });
+        },
+        "apps.unshare": (msg) => service.unshare(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.revoke": (msg) => service.revoke(String(msg.sessionId), String(msg.appId), String(msg.viewId)),
         "apps.remove": (msg) => { service.remove(String(msg.sessionId), String(msg.appId)); return { ok: true }; },
     };