@bivy/bivy 0.20.9-staging.13 → 0.20.9-staging.2

package/README.md

@@ -285,9 +285,10 @@ Every session gets the `bivy` CLI, so any agent with a shell can talk back
 through the app, not only agents with their own built-in tools:
 
 ```bash
-bivy notify                                 # push to your phone so you come back
+bivy notify "Tests are green, PR is up"     # chat card + phone push when you're away
 bivy ask "Ship to staging?" --option Yes --option No  # waits for your answer
 bivy attach report.png --caption "Before/after"       # show a file in the chat
+bivy suggest "Add a dark theme to settings"           # a next task you start in one tap
 bivy context --json                                   # session, workspace, machine, apps
 ```
 
@@ -526,8 +527,6 @@ use, modify, and self-host it under that license. If users interact with your
 modified version over a network, section 13 requires you to offer its
 corresponding source. See [LICENSE](LICENSE).
 
-Bivy Cloud is the hosted operation of that stack. Its plans, billing and
-managed-compute operations live in a separate private service behind Core's
-deployment extension. Contributions are made under the
-[Contributor License Agreement](CLA.md). The Bivy name and logo are covered by
-the [trademark policy](TRADEMARKS.md).
+Bivy Cloud is the hosted operation of that stack plus billing and plans, in a
+separate private repository. Contributions use the
+[DCO](CONTRIBUTING.md#certificate-of-origin); there is no CLA.

package/bin/bivy.mjs

@@ -2595,6 +2595,38 @@ async function cmdContext(args = []) {
   console.log(`\nEverything else: ${c.cyan("bivy help")} (or ${c.cyan("bivy help --json")}).`);
 }
 
+// `bivy suggest "<task>" [--title "…"] [--run here|subagents|new] [--session <id>]`
+// — propose a task the user can start in one tap, in this session or beside it. For an agent
+// offering next steps: write the task as a complete instruction.
+async function cmdSuggest(args = []) {
+  const usage = 'Usage: bivy suggest "<task>" [--title "short label"] [--run here|subagents|new] [--session <id>] [--json]';
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log(`${usage}\n\nPost a task the user can start in one tap: in this session, through your sub-agents, or in a parallel session that works in its own copy of the project. Write it as a complete instruction, with paths relative to the project root.\n\n--run says where you recommend running it, which becomes the card's main button: here (builds on this conversation), subagents (independent tasks you can split across your own sub-agents; only if you have them), or new (bigger independent work the user will want to follow in its own session). Without it, one card recommends here and several recommend new.\n\n--json prints {"ok","id"}.`);
+    return;
+  }
+  const json = wantsJson(args);
+  const fail = (error) => cliError(error, { json, paint: c.red });
+  const flagsWithValue = new Set(["--session", "--title", "--run"]);
+  const flag = (name) => {
+    const i = args.indexOf(name);
+    return i >= 0 && i + 1 < args.length ? args[i + 1] : undefined;
+  };
+  const text = args.filter((a, i) => !a.startsWith("-") && !(i > 0 && flagsWithValue.has(args[i - 1]))).join(" ").trim();
+  const sessionId = resolveAttachSessionId({ sessionFlag: flag("--session"), env: process.env });
+  if (!text) return fail({ code: "usage", message: usage, exit: EXIT.usage });
+  const run = flag("--run");
+  if (run !== undefined && !["here", "subagents", "new"].includes(run)) return fail({ code: "usage", message: `--run is here, subagents or new (got "${run}").`, exit: EXIT.usage });
+  if (!sessionId) return fail({ code: "no_session", message: "No session id.", hint: "Run inside an agent session ($BIVY_SESSION_ID) or pass --session <id>.", next: "bivy sessions --json", exit: EXIT.usage });
+  const config = loadConfig();
+  if (!(await ensureNodeRunning(config))) return fail({ code: "node_unreachable", message: `Could not reach the Bivy node at ${url(config)}.`, next: "bivy status", exit: EXIT.unavailable });
+  const res = await sessionPost(config, sessionId, "suggest", { text, title: flag("--title"), run }).catch((error) => error);
+  if (res instanceof Error) return fail({ code: "node_unreachable", message: `Could not reach the Bivy node: ${res.message}`, next: "bivy status", exit: EXIT.unavailable });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) return fail(sessionHttpError("Suggest", res.status, body));
+  if (json) { console.log(JSON.stringify(body)); return; }
+  console.log(c.green("Suggested in the chat. The user can start it in one tap."));
+}
+
 // `bivy title "<title>" [--session <id>]` — rename the session the agent runs in.
 async function cmdTitle(args = []) {
   const usage = 'Usage: bivy title "<title>" [--session <id>] [--json]';
@@ -2642,37 +2674,45 @@ function durationSeconds(text) {
   return m ? Number(m[1]) * (m[2] === "h" ? 3600 : m[2] === "m" ? 60 : 1) : NaN;
 }
 
-// `bivy notify [--urgent]` — bring the user back: a push naming the session
-// (never any text) when nobody has the app open. Nothing is posted in the chat.
+// `bivy notify "<message>" [--urgent]` — reach the user: a card in the chat,
+// and a push naming the session (never the text) when nobody has the app open.
 async function cmdNotify(args = []) {
-  const usage = "Usage: bivy notify [--urgent] [--session <id>] [--json]";
+  const usage = 'Usage: bivy notify "<message>" [--urgent] [--session <id>] [--json]';
   if (args.includes("-h") || args.includes("--help")) {
     console.log(`${usage}
 
-Push to the user's devices so they come back to this session. The push names the
-session, nothing else, and nothing is posted in the chat: say what you need in
-your reply. It is sent only when nobody has the app open; --urgent pushes even
-while they do. At most one push a minute per session. You don't need it when you
-finish: Bivy already pushes when a turn ends while the user is away. --json prints
-{"ok","push":"sent"|"user_watching"|"rate_limited"|"unavailable","userWatching"}.`);
+Send the user a message: it appears as a card in the chat, and their devices get
+a push notification (naming this session, not the text) when nobody has the app
+open. --urgent pushes even while they do. At most one push a minute per session;
+later messages still reach the chat. Use it when you finish long work, get
+blocked, or need the user to look at something. --json prints
+{"ok","id","push":"sent"|"user_watching"|"rate_limited","userWatching"}.`);
     return;
   }
   const json = wantsJson(args);
   const fail = (error) => cliError(error, { json, paint: c.red });
   const parsed = parseSessionArgs(args, ["--session"]);
   if (parsed.error) return fail({ code: "usage", message: parsed.error, exit: EXIT.usage });
+  const text = parsed.positional.join(" ").trim();
+  if (!text) return fail({ code: "usage", message: usage, exit: EXIT.usage });
   const sessionId = resolveAttachSessionId({ sessionFlag: parsed.one("--session"), env: process.env });
   if (!sessionId) return fail({ code: "no_session", message: "No session id.", hint: "Run inside an agent session ($BIVY_SESSION_ID) or pass --session <id>.", next: "bivy sessions --json", exit: EXIT.usage });
   const config = loadConfig();
   if (!(await ensureNodeRunning(config))) return fail({ code: "node_unreachable", message: `Could not reach the Bivy node at ${url(config)}.`, next: "bivy status", exit: EXIT.unavailable });
-  const res = await sessionPost(config, sessionId, "notify", { urgent: parsed.has("--urgent") }).catch((error) => error);
+  const res = await sessionPost(config, sessionId, "notify", { text, urgent: parsed.has("--urgent") }).catch((error) => error);
   if (res instanceof Error) return fail({ code: "node_unreachable", message: `Could not reach the Bivy node: ${res.message}`, next: "bivy status", exit: EXIT.unavailable });
   const body = await res.json().catch(() => ({}));
   if (!res.ok) return fail(sessionHttpError("Notify", res.status, body));
   if (json) { console.log(JSON.stringify(body)); return; }
-  if (body.push === "sent") { console.log(c.green("Pushed to the user's devices.")); return; }
-  const noPush = { user_watching: "the user has the app open, so they see your reply; add --urgent to push anyway", rate_limited: "this session pushed less than a minute ago", unavailable: "this machine isn't signed in to a Bivy account" }[body.push];
-  console.log(c.yellow(`No push sent: ${noPush ?? body.push}.`));
+  const noPush = { user_watching: "the user has the app open; add --urgent to push anyway", rate_limited: "this session pushed less than a minute ago", unavailable: "this machine isn't signed in to a Bivy account" }[body.push];
+  // A terminal run (`bivy run`) has no chat to hold a card: the push is the notice.
+  if (body.posted === false) {
+    if (body.push === "sent") console.log(c.green("Pushed to the user's devices."));
+    else console.log(c.yellow(`Not delivered: a terminal run has no chat to post in, and no push was sent (${noPush ?? body.push}).`));
+    return;
+  }
+  const pushed = body.push === "sent" ? "and pushed to the user's devices" : noPush ? `(no push: ${noPush})` : "";
+  console.log(c.green(`Posted in the chat ${pushed}.`.replace(" .", ".")));
 }
 
 // `bivy ask "<question>" [--option …]` — the question card, for any agent.
@@ -6475,6 +6515,9 @@ An agent's own --help passes through, e.g. 'bivy run claude --help'.`);
     case "attach":
       await cmdAttach(args);
       break;
+    case "suggest":
+      await cmdSuggest(args);
+      break;
     case "title":
       await cmdTitle(args);
       break;

package/bin/cli-commands.mjs

@@ -44,12 +44,14 @@ export const COMMANDS = [
   { name: "context", group: "session", scope: "session", json: true, usage: "context [--json]", summary: "Where this agent is running: session, workspace, machine, apps, and what to run next",
     tools: [{ name: "bivy_context", description: "Where you are running inside Bivy: your session, agent, workspace and git branch, the machine, apps you have published, whether the user has the app open, and the commands that reach them.", input: {}, argv: ["context"] }] },
   { name: "attach", group: "session", scope: "session", json: true, usage: 'attach <file> [--caption "…"] [--artifact]', summary: "Show a local file or image to the user in the chat" },
-  { name: "notify", group: "session", scope: "session", json: true, usage: "notify [--urgent]", summary: "Push to the user's phone so they come back (nothing posted in the chat)",
-    tools: [{ name: "notify_user", description: "Push to the user's phone so they come back to this session, e.g. when you are blocked on them while still working. The push names the session only and nothing is posted in the chat, so say what you need in your reply. Not needed when you finish: Bivy already pushes when a turn ends while they are away. Sent only when nobody has the app open, at most one a minute per session.", input: { urgent: { type: "boolean", description: "Push even while the user has the app open." } }, argv: ["notify", { when: "urgent", flag: "--urgent" }] }] },
+  { name: "notify", group: "session", scope: "session", json: true, usage: 'notify "<message>" [--urgent]', summary: "Message the user: a card in the chat, and a push when they're away",
+    tools: [{ name: "notify_user", description: "Send the user a message: a card in the chat, and a push to their phone when nobody has the app open (the push names the session, not the text). Use it when long work finishes, you are blocked, or something needs their attention. At most one push a minute per session.", input: { message: { type: "string", description: "What to tell the user.", required: true }, urgent: { type: "boolean", description: "Push even while the user has the app open." } }, argv: ["notify", { arg: "message" }, { when: "urgent", flag: "--urgent" }] }] },
   { name: "ask", group: "session", scope: "session", json: true, usage: 'ask "<question>" [--option A --option B] [--async]', summary: "Ask the user a question and wait for the answer", subcommands: ["status", "wait"],
     tools: [{ name: "ask_user", description: "Ask the user a question in the chat and wait for their answer (their phone gets a push). Offer 2-8 options, or none for a free-text answer; they can always write their own. Returns {status, answer}: status is answered, dismissed (decide yourself) or expired.", input: { question: { type: "string", description: "The question.", required: true }, options: { type: "array", items: { type: "string" }, description: "Choices to pick from (2-8)." }, multiple: { type: "boolean", description: "Allow several choices." }, header: { type: "string", description: "A short label for the card." }, timeout_seconds: { type: "number", description: "How long to wait (default 600)." } }, argv: ["ask", { arg: "question" }, { flag: "--option", from: "options" }, { when: "multiple", flag: "--multi" }, { flag: "--header", from: "header" }, { flag: "--timeout", from: "timeout_seconds" }] }] },
   { name: "title", group: "session", scope: "session", json: true, usage: 'title "<title>"', summary: "Rename this session",
     tools: [{ name: "set_session_title", description: "Rename this session in the user's session list. Use a short title (under 60 characters) that says what the work is, when the first message made a poor title or the work changed direction.", input: { title: { type: "string", description: "The new title.", required: true } }, argv: ["title", { arg: "title" }] }] },
+  { name: "suggest", group: "session", scope: "session", json: true, usage: 'suggest "<task>" [--title "label"] [--run here|subagents|new]', summary: "Propose a task the user can start in one tap",
+    tools: [{ name: "suggest_task", description: "Propose a next step the user can start in one tap: in this session, through your sub-agents, or in a parallel session with its own copy of the project. Write the task as a complete instruction with paths relative to the project root. Post one per idea instead of listing them.", input: { task: { type: "string", description: "The complete instruction.", required: true }, title: { type: "string", description: "A short label for the card." }, run: { type: "string", enum: ["here", "subagents", "new"], description: "Where you recommend running it: here (builds on this conversation), subagents (independent tasks you can split across your own sub-agents; only if you have them), or new (bigger independent work in its own session). Defaults: here for one card, new for several." } }, argv: ["suggest", { arg: "task" }, { flag: "--title", from: "title" }, { flag: "--run", from: "run" }] }] },
   { name: "app", group: "session", scope: "session", json: true, usage: "app <publish|shot|present|share|run|…>", summary: "Live previews: publish a web/terminal/desktop app, screenshot it, present it", subcommands: ["publish", "list", "remove", "shot", "present", "share", "notes", "run", "click", "type", "key", "scroll", "drag", "move", "menu"],
     tools: [
       { name: "app_publish", description: "Give the user a live preview of something with a UI, from an app manifest file (web server port, static build, terminal, or desktop app). Run `bivy app --help` for the manifest format.", input: { manifest_path: { type: "string", description: "Path to the manifest JSON.", required: true } }, argv: ["app", "publish", { arg: "manifest_path" }] },

package/bin/guides/talk-to-the-user.md

@@ -1,24 +1,18 @@
 # Talk to the user
 
-Summary: When to answer in chat, when to notify, and when to ask and wait.
+Summary: When to answer in chat, when to notify, when to ask and wait, and how to offer next steps.
 
 Your chat reply is the default. Reach for these when the chat alone won't do.
 
 ## They may be away: notify
 
-    bivy notify
-    bivy notify --urgent
+    bivy notify "Migration finished: 3 tables rewritten, all tests pass."
+    bivy notify --urgent "Production is serving the old build."
 
-Pushes to their devices so they come back to this session. The push names the
-session only and nothing is posted in the chat, so say what you need in your
-reply. It goes out only when nobody has the app open; `--urgent` pushes even
-while they are looking. One push a minute per session.
-
-You don't need it when you finish: Bivy already pushes when a turn ends while
-they are away. Use it while you keep working and need them, for example when a
-long run is blocked on something only they can do.
-
-Next steps and options go in your reply as plain text.
+Posts a card in the chat. When nobody has the app open, their devices get a push
+naming this session (the text stays in the chat). `--urgent` pushes even while
+they are looking. One push a minute per session; don't send one per step.
+Good moments: long work finished, you are blocked, something needs a look.
 
 ## You need a decision: ask
 
@@ -30,6 +24,23 @@ dismissed it (use your judgment), exit 5 that `--timeout` (default 10m) passed.
 For long waits use `--async`, keep working, and later `bivy ask wait <id>`.
 Ask only when you can't reasonably decide yourself.
 
+## Offer next steps: suggest
+
+    bivy suggest "Add a GET /version endpoint that returns the package version." --title "Add /version"
+
+Each suggestion is a card the user can start in one tap: here, through your
+sub-agents, or in a parallel session with its own copy of the project. Write it as
+a complete instruction with paths relative to the project root. Post one per idea
+instead of a bulleted list.
+
+`--run` picks the card's main button; the others stay one tap away:
+
+| `--run` | When |
+|---|---|
+| `here` | It builds on this conversation, or it's small. Default for a single card. |
+| `subagents` | Independent tasks you can split across your own sub-agents and report back on. Only if you have sub-agents. |
+| `new` | Bigger independent work the user will want to follow, review or merge on its own. Default for several cards. |
+
 ## Name the session: title
 
     bivy title "Fix login redirect loop"

package/dist/agent-instructions.js

@@ -39,12 +39,18 @@ export const BIVY_AGENT_NOTE = [
         "can check your work; `bivy app present` tells the user a visible change is ready to look at, and " +
         "`.bivy/scenarios/*.json` files let them open it in the states that matter (errors, empty, slow) with `--try`. " +
         "`bivy app --help` has the details.",
+    "- Proposing tasks the user could hand you (next steps, ideas, options): post each with " +
+        '`bivy suggest "<complete instruction>" [--title "short label"] [--run here|subagents|new]` instead of only ' +
+        "listing them. The user can start each in one tap, in this session, through your sub-agents, or in a parallel " +
+        "one that works in its own copy of the project, so write it to stand on its own, with paths relative to the " +
+        "project root. `--run` is the one you recommend: here when it builds on this conversation, subagents for " +
+        "independent tasks you can split and supervise (only if you have sub-agents), new for bigger work worth its " +
+        "own session.",
     '- If this session\'s title (taken from the first message) doesn\'t say what the work is, or the work changes ' +
         'direction: `bivy title "<short title>"`.',
-    "- Your chat reply is what the user reads; when you finish while they are away, Bivy pushes to their phone for you. " +
-        'To bring them back while you keep working: `bivy notify` (a push only; say what you need in the chat). To ask ' +
-        'and wait for an answer: `bivy ask "<question>" [--option A --option B]` prints their answer (or use your own ' +
-        "ask-the-user tool).",
+    "- When you finish long work, get blocked, or need the user to look at something: " +
+        '`bivy notify "<message>"` (a chat card, plus a push to their phone when they are away). To ask and wait for ' +
+        'an answer: `bivy ask "<question>" [--option A --option B]` prints their answer (or use your own ask-the-user tool).',
     "- Only when the user asks for another agent or another of their machines to take part: " +
         '`bivy delegate "<self-contained task>" --agent <id> [--machine <name>] --wait` runs it there and prints ' +
         "its answer and any branch/PR; `--to codex,grok@<machine>` asks several to compare, `bivy delegate machines` " +

package/dist/agents/pi/integration.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { defineAgentIntegration } from "../definition.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { bridgeInstalled, enableBridgeResolution } from "../../agent-bridges.mjs";
-export const PI_TESTED_VERSION = "1.0.4";
+export const PI_TESTED_VERSION = "0.99.2";
 export function piAgentDir() {
     return process.env.PI_CODING_AGENT_DIR?.trim() || path.join(os.homedir(), ".pi", "agent");
 }

package/dist/apps/styles.css

@@ -485,12 +485,6 @@ input, textarea, select { font-family: inherit; font-size: 16px; }
 }
 .transcript-turn { display: flex; flex-direction: column; gap: var(--space-4); min-width: 0; }
 .transcript-standalone { display: flex; justify-content: center; min-width: 0; }
-/* A centered flex row lets a child grow past the column on one long unbroken
-   token (a path in an error); cap every standalone item to the column. */
-.transcript-standalone > * { min-width: 0; max-width: 100%; }
-/* Errors span the column so their edges line up with the turn content. */
-.transcript-error { flex: 1; display: flex; flex-direction: column; gap: var(--space-2); overflow-wrap: anywhere; }
-.transcript-error .settings-disclosure-body { margin: 0; padding: 0; white-space: pre-wrap; font-size: var(--text-xs); color: var(--muted); }
 .turn-response-body { display: flex; flex-direction: column; gap: var(--space-2); min-width: 0; }
 .jump-latest {
   position: absolute; left: 50%; bottom: 16px; transform: translateX(-50%);
@@ -661,6 +655,20 @@ input, textarea, select { font-family: inherit; font-size: 16px; }
 .entry-actions { display: flex; flex-wrap: wrap; gap: var(--space-2); font-style: normal; }
 .msg.system .entry-actions { justify-content: center; }
 .msg.thinking { align-self: flex-start; color: var(--muted); font-size: 13px; border-left: 2px solid var(--line-strong); padding-left: 10px; }
+.msg.error {
+  align-self: stretch; display: flex; gap: 8px; align-items: flex-start;
+  background: var(--danger-soft); border: 1px solid color-mix(in srgb, var(--danger) 45%, transparent);
+  border-left: 3px solid var(--danger); border-radius: var(--radius-sm); padding: 10px 12px;
+}
+.msg-error-icon {
+  flex: none; width: 18px; height: 18px; margin-top: 1px; border-radius: var(--radius-full);
+  background: var(--danger); color: var(--danger-contrast); font-weight: 700; font-size: 12px;
+  display: grid; place-items: center;
+}
+.msg-error-text {
+  flex: 1; min-width: 0; font-size: 13px; line-height: 1.45; color: var(--ink);
+  white-space: pre-wrap; overflow-wrap: anywhere; word-break: break-word;
+}
 .msg.streaming { position: relative; }
 .msg.streaming::after { content: "▍"; color: var(--accent); animation: blink 1s steps(2) infinite; }
 @keyframes blink { 50% { opacity: 0; } }
@@ -1469,8 +1477,10 @@ button.sheet-action:last-child { border-bottom: 0; }
 }
 /* Password-manager-style provider credential vault. Saved items are the primary
    list; the provider catalog appears only inside Add. */
-/* The credential vault: a wide settings panel that reads as a shallow "vault". */
-.credential-vault { gap: 14px; max-width: 680px; width: 100%; overflow-wrap: anywhere; }
+/* Wide settings panels that read as a shallow "vault": the credential vault and
+   the isolated-machine-profiles panel share this container + header layout. */
+.credential-vault, .machine-profiles { gap: 14px; max-width: 680px; width: 100%; }
+.credential-vault { overflow-wrap: anywhere; }
 .vault-title-row { display: flex; align-items: flex-start; justify-content: space-between; gap: 14px; }
 .vault-title-row > div { min-width: 0; }
 /* The header action (e.g. "+ Add profile") never shrinks or wraps — the title
@@ -2607,6 +2617,15 @@ a.queue-item:hover { border-color: var(--line-strong); background: var(--surface
   transition: border-color 0.15s ease, box-shadow 0.15s ease;
 }
 .connect-option:hover { border-color: var(--line-strong); box-shadow: var(--shadow-md); }
+.connect-option-head { display: flex; align-items: flex-start; gap: 12px; }
+.connect-option-badge {
+  flex: none; width: 36px; height: 36px; display: grid; place-items: center;
+  border-radius: var(--radius-md); color: var(--accent);
+  background: color-mix(in srgb, var(--accent) 12%, transparent);
+}
+.connect-option-copy { min-width: 0; }
+.connect-option-copy h3 { margin: 1px 0 3px; font-size: 15px; }
+.connect-option-copy p { margin: 0; color: var(--muted); font-size: 13px; line-height: 1.45; }
 
 .connect-command {
   display: flex; align-items: center; gap: 8px; padding: 4px 4px 4px 12px;
@@ -2626,8 +2645,9 @@ a.queue-item:hover { border-color: var(--line-strong); background: var(--surface
 .connect-option-links { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2); }
 .connect-option-link { align-self: flex-start; color: var(--accent); font-size: 12.5px; font-weight: 600; text-decoration: none; }
 .connect-option-link:hover { text-decoration: underline; }
+.connect-option-cta { align-self: flex-start; }
 /* A one-time "next step" card above the composer (automations, notifications). */
-.next-step { box-sizing: border-box; width: min(100% - 2 * var(--space-3), 800px - 2 * var(--space-3)); margin: 0 auto var(--space-3); display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); }
+.next-step { margin: 0 var(--space-4) var(--space-3); display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); }
 .next-step p { margin: var(--space-1) 0 0; color: var(--muted); font-size: var(--text-sm); }
 .next-step .banner { margin-top: var(--space-2); }
 .next-step .next-step-ok { margin: 0; color: var(--ok); font-weight: var(--weight-medium); }
@@ -2980,7 +3000,7 @@ textarea.picker-search { resize: vertical; font-family: ui-monospace, monospace;
 .node-switcher-btn.locked { cursor: default; }
 .node-switcher-name { max-width: 220px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .node-switcher-caret { color: var(--muted); font-size: 9px; }
-.node-menu { position: absolute; left: 0; top: calc(100% + 6px); min-width: 220px; width: max-content; max-width: calc(100vw - var(--space-6)); z-index: var(--z-dropdown); }
+.node-menu { position: absolute; left: 0; top: calc(100% + 6px); min-width: 220px; z-index: var(--z-dropdown); }
 /* "Reconnecting…" line at the top of the open switcher, under the node the
    button shows — the dropdown's spelled-out counterpart to the spinner dot. */
 .node-menu-status { display: flex; align-items: center; gap: 8px; padding: 10px 14px; font-size: 13px; color: var(--muted); border-bottom: 1px solid var(--line); }
@@ -2995,8 +3015,6 @@ textarea.picker-search { resize: vertical; font-family: ui-monospace, monospace;
 .node-menu-item.active { font-weight: 600; }
 .node-menu-name { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .node-menu-check { color: var(--accent); }
-/* Quiet trailing hint on a cloud row, e.g. "starts when you send". */
-.node-menu-meta { flex: none; color: var(--muted); font-size: var(--text-xs); }
 .node-menu-glyph { color: var(--accent); flex: none; }
 .eph-steps { margin: 4px 0; padding-left: 18px; color: var(--muted); font-size: 13px; display: grid; gap: 4px; }
 .code-snippet { margin: 6px 0 0; overflow: auto; border: 1px solid var(--line); border-radius: var(--radius-md); padding: 10px; background: var(--surface); font-size: 12px; }
@@ -3229,9 +3247,24 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
 .app-row-meta { color: var(--muted); font-size: var(--text-xs); line-height: var(--lh-xs); }
 .app-row-action { flex: none; display: flex; align-items: center; gap: var(--space-1); }
 .app-message { margin-block: var(--space-2); }
+/* Suggested task (SuggestionCard.tsx): a task the agent proposed, one tap to
+   start in its own session. Shell from .card; layout only here. */
+.suggestion-card { max-inline-size: 440px; display: flex; flex-direction: column; gap: var(--space-1); }
 /* The small label above a chat card's content, shared by every agent-posted card. */
-.delegation-eyebrow, .notice-eyebrow { margin: 0; color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-semibold); }
-/* Notice (NoticeCard.tsx): a message from Bivy, e.g. applied automations.
+.suggestion-eyebrow, .delegation-eyebrow, .notice-eyebrow { margin: 0; color: var(--muted); font-size: var(--text-xs); font-weight: var(--weight-semibold); }
+.suggestion-title { margin: 0; font-size: var(--text-base); font-weight: var(--weight-semibold); overflow-wrap: anywhere; }
+.suggestion-text { margin: 0; color: var(--muted); font-size: var(--text-sm); white-space: pre-wrap; overflow-wrap: anywhere; display: -webkit-box; -webkit-line-clamp: 4; -webkit-box-orient: vertical; overflow: hidden; }
+.suggestion-text[data-expanded="true"] { display: block; overflow: visible; }
+.suggestion-actions { display: flex; flex-wrap: wrap; gap: var(--space-2); margin-top: var(--space-2); }
+.suggestion-bar, .suggestion-all { display: flex; flex-direction: column; gap: var(--space-1); margin-top: var(--space-2); }
+.suggestion-all { padding-top: var(--space-2); border-top: 1px solid var(--line); }
+.suggestion-bar .suggestion-actions, .suggestion-all .suggestion-actions { margin-top: 0; }
+.suggestion-hint { margin: 0; color: var(--muted); font-size: var(--text-xs); }
+/* In a set, the title is the checkbox's label, so the whole line is the tap target. */
+.suggestion-pick { display: flex; align-items: flex-start; gap: var(--space-2); cursor: pointer; }
+.suggestion-pick input { flex: none; inline-size: 18px; block-size: 18px; margin: 2px 0 0; accent-color: var(--accent); }
+.suggestion-status { margin: var(--space-2) 0 0; display: flex; align-items: center; gap: var(--space-2); color: var(--ok); font-size: var(--text-sm); font-weight: var(--weight-medium); }
+/* Notice (NoticeCard.tsx): a message the agent sent with `bivy notify`.
    Shell and tone from .card, the urgent marker from .badge. */
 .notice-card { max-inline-size: 440px; display: flex; flex-direction: column; gap: var(--space-1); }
 .notice-eyebrow { display: flex; align-items: center; gap: var(--space-2); }

package/dist/certification/generated.js

@@ -5,7 +5,7 @@ export const CERTIFICATION_MATRIX = {
     agents: [
         { id: "claude-code-sdk", status: "active", executionMode: "protocol", pinnedVersion: "0.3.286", capabilities: ["toolInterception", "modelSelection", "resume"] },
         { id: "codex-approvals", status: "active", executionMode: "protocol", pinnedVersion: "0.159.2", capabilities: ["toolInterception", "modelSelection", "resume"] },
-        { id: "pi", status: "active", executionMode: "protocol", pinnedVersion: "1.0.4", capabilities: ["toolInterception", "modelSelection", "resume"] },
+        { id: "pi", status: "active", executionMode: "protocol", pinnedVersion: "0.99.2", capabilities: ["toolInterception", "modelSelection", "resume"] },
         { id: "opencode", status: "active", executionMode: "protocol", pinnedVersion: "1.18.33", capabilities: ["toolInterception", "modelSelection", "resume"] },
         { id: "grok", status: "active", executionMode: "protocol", pinnedVersion: "1.0.44", capabilities: ["toolInterception", "modelSelection", "resume"] },
     ]

package/dist/device-registry.js

@@ -7,7 +7,6 @@ import { generatePairingKeypair, generateRoomKey, generatePairSecret, deriveWrap
 import { seal, open } from "./e2e.js";
 const DEFAULT_PAIR_TTL_MS = 5 * 60_000;
 const ROOM_KEY_BYTES = 32;
-const MAX_RETIRED_ROOM_KEYS = 8;
 /**
  * Validate + canonicalize a pre-shared room-key seed. Returns the canonical
  * base64 of a well-formed 32-byte key, or undefined for anything malformed
@@ -82,7 +81,6 @@ export class PairingStore {
             return new PairingStore(filePath, {
                 nodeKeypair: parsed.nodeKeypair,
                 roomKeyB64: parsed.roomKeyB64,
-                ...(Array.isArray(parsed.retiredRoomKeysB64) && parsed.retiredRoomKeysB64.length ? { retiredRoomKeysB64: parsed.retiredRoomKeysB64 } : {}),
                 devices: Array.isArray(parsed.devices) ? parsed.devices : [],
             });
         }
@@ -132,30 +130,6 @@ export class PairingStore {
     roomKey() {
         return Buffer.from(this.data.roomKeyB64, "base64");
     }
-    /** Room keys replaced by earlier rotations that still guard stored data. */
-    retiredRoomKeys() {
-        return (this.data.retiredRoomKeysB64 ?? []).map((key) => Buffer.from(key, "base64"));
-    }
-    /** Drop retired room keys once nothing stored is sealed under them. */
-    forgetRetiredRoomKeys() {
-        if (!this.data.retiredRoomKeysB64)
-            return;
-        delete this.data.retiredRoomKeysB64;
-        this.persist();
-    }
-    /** Open a payload sealed under the current room key or a retired one. */
-    openSealed(payload) {
-        let lastError;
-        for (const key of [this.roomKey(), ...this.retiredRoomKeys()]) {
-            try {
-                return open(key, payload);
-            }
-            catch (error) {
-                lastError = error;
-            }
-        }
-        throw lastError;
-    }
     /** Issue a single-use, expiring pairing secret to embed in a linking QR. */
     issuePairSecret(ttlMs = DEFAULT_PAIR_TTL_MS) {
         this.sweepSecrets();
@@ -241,7 +215,6 @@ export class PairingStore {
     }
     /** Rotate the room key and re-wrap it for all current devices. */
     rotateRoomKey() {
-        this.data.retiredRoomKeysB64 = [this.data.roomKeyB64, ...(this.data.retiredRoomKeysB64 ?? [])].slice(0, MAX_RETIRED_ROOM_KEYS);
         this.data.roomKeyB64 = generateRoomKey().toString("base64");
         this.persist();
         const roomKey = this.roomKey();

package/dist/ephemeral-exec.js

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// Ephemeral provisioning proxy (node-broker path).
+//
+// A remote device that holds the user's cloud token asks this node to make ONE
+// allowlisted HTTPS request to a provider (Fly/Hetzner/AWS/...) on its behalf —
+// the browser can't call those APIs directly (no CORS). The token/credentials
+// ride in the request headers and are used transiently; nothing is persisted
+// here, so the provisioning stays end-to-end (the control plane never sees
+// it). The host allowlist is the SSRF guard and must be kept in lock-step with
+// the two other copies: `ALLOWED_HOSTS` in packages/core/src/ephemeral.ts
+// (the browser-side adapter) and the control-plane's cold-start relay in
+// services/control-plane/src/index.ts.
+export const EPHEMERAL_ALLOWED_HOSTS = new Set([
+    "api.hetzner.cloud",
+    "api.machines.dev",
+    "api.fly.io",
+    "ec2.us-east-1.amazonaws.com",
+    "ec2.us-west-2.amazonaws.com",
+    "ec2.eu-west-1.amazonaws.com",
+    "ec2.eu-central-1.amazonaws.com",
+    "ec2.ap-southeast-1.amazonaws.com",
+    "ec2.ap-northeast-1.amazonaws.com",
+    "ssm.us-east-1.amazonaws.com",
+    "ssm.us-west-2.amazonaws.com",
+    "ssm.eu-west-1.amazonaws.com",
+    "ssm.eu-central-1.amazonaws.com",
+    "ssm.ap-southeast-1.amazonaws.com",
+    "ssm.ap-northeast-1.amazonaws.com",
+]);
+/** Hard cap on redirect hops, so a provider (or a MITM) can't wedge us in a loop. */
+const MAX_REDIRECTS = 5;
+function checkAllowedHost(url) {
+    let host;
+    try {
+        host = new URL(url).host;
+    }
+    catch {
+        throw new Error(`Bad provider URL: ${url}`);
+    }
+    if (!EPHEMERAL_ALLOWED_HOSTS.has(host))
+        throw new Error(`Refusing to proxy to non-provider host: ${host}`);
+    return host;
+}
+/**
+ * How a redirect changes the follow-up request, mirroring the WHATWG fetch spec's
+ * own `redirect: "follow"` behavior (which we're replicating manually below so we
+ * can re-validate the target host on every hop): 303 always downgrades to a
+ * bodyless GET; 301/302 do the same but only for a non-GET/HEAD method; 307/308
+ * preserve the original method and body.
+ */
+function nextHopRequest(status, method, payload) {
+    if (status === 303 || ((status === 301 || status === 302) && method !== "GET" && method !== "HEAD")) {
+        return { method: "GET", payload: undefined };
+    }
+    return { method, payload };
+}
+/**
+ * Perform one allowlisted provider request for a remote device. Rejects any
+ * non-provider host — including a redirect target: the allowlist check ran only
+ * on the *initial* URL, but a plain `fetch` follows redirects transparently, so a
+ * provider response (or anyone able to influence it) could 302 us — Authorization
+ * header and all — to an arbitrary host. `redirect: "manual"` disables that
+ * auto-follow so every hop's Location is re-checked against the same allowlist
+ * before it's requested.
+ */
+export async function execEphemeralRequest(request, fetchImpl = fetch) {
+    let url = String(request?.url ?? "");
+    let method = String(request?.method ?? "GET").toUpperCase();
+    const headers = { ...(request?.headers ?? {}) };
+    let payload;
+    if (request?.body !== undefined && request?.body !== null && method !== "GET" && method !== "HEAD") {
+        payload = typeof request.body === "string" ? request.body : JSON.stringify(request.body);
+        if (!Object.keys(headers).some((h) => h.toLowerCase() === "content-type"))
+            headers["content-type"] = "application/json";
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 30_000);
+    try {
+        for (let hop = 0;; hop++) {
+            const host = checkAllowedHost(url);
+            const res = await fetchImpl(url, { method, headers, body: payload, signal: controller.signal, redirect: "manual" });
+            if (res.status >= 300 && res.status < 400 && res.status !== 304) {
+                if (hop >= MAX_REDIRECTS)
+                    throw new Error(`Too many redirects proxying to ${host}`);
+                const location = res.headers.get("location");
+                if (!location)
+                    throw new Error(`Redirect from ${host} (${res.status}) had no Location header`);
+                // Resolve relative to the current hop; the loop's next iteration
+                // re-validates this new host before it's ever requested — the whole
+                // point of this loop.
+                url = new URL(location, url).toString();
+                ({ method, payload } = nextHopRequest(res.status, method, payload));
+                continue;
+            }
+            const text = await res.text();
+            let body = text;
+            try {
+                body = text ? JSON.parse(text) : null;
+            }
+            catch { /* non-JSON provider response */ }
+            return { status: res.status, body };
+        }
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/ephemeral-teardown.js

@@ -9,7 +9,6 @@ export function readEphemeralTeardownConfig(env = process.env) {
         onFinish: env.BIVY_TEARDOWN_ON_FINISH === "1",
         finishGraceMs: Number(env.BIVY_TEARDOWN_FINISH_GRACE_MS) || 10_000,
         idleGraceMs: Number(env.BIVY_SESSION_IDLE_CLOSE_MS) || 30 * 60 * 1000,
-        sleep: env.BIVY_EPHEMERAL_SLEEP === "1",
     };
 }
 /**
@@ -21,10 +20,8 @@ export function readEphemeralTeardownConfig(env = process.env) {
 export function shouldSelfTeardown(cfg, state) {
     if (!cfg.enabled)
         return false;
-    // A fresh box waits for its first work. A sleeping machine woken for
-    // nothing goes back to sleep after the idle window instead of running to TTL.
     if (!state.everBusy)
-        return cfg.sleep && state.idleForMs >= cfg.idleGraceMs;
+        return false;
     if (state.anyWorking || state.anyRemoteActive || state.inFlightWork > 0)
         return false;
     const grace = cfg.onFinish ? cfg.finishGraceMs : cfg.idleGraceMs;
@@ -53,13 +50,6 @@ export async function performSelfTeardown(deps) {
     torndown = true;
     const log = deps.log ?? ((m) => console.log(`[ephemeral-teardown] ${m}`));
     const exit = deps.exit ?? ((c) => process.exit(c));
-    if (deps.sleep) {
-        // Exit only: the provider keeps the stopped machine and its disk, and a
-        // wake starts it again. Signalling settled would get it reaped.
-        log(`machine idle — sleeping (provider=${deps.provider})`);
-        exit(0);
-        return;
-    }
     log(`machine idle — self-teardown (provider=${deps.provider})`);
     try {
         await deps.signalSettled?.();

package/dist/exec.js

@@ -14,7 +14,6 @@
 // A turn that ends without any assistant text because the agent FAILED (e.g. an
 // unauthenticated CLI) exits non-zero with the error on stderr, rather than
 // reporting a silent empty success.
-import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
 const USAGE = `Usage: bivy exec [options] "<prompt>"   (or pipe the prompt on stdin, or pass -)
 
@@ -224,9 +223,7 @@ async function main() {
         try {
             await api(args.url, args.token, "/api/session/prompt", {
                 method: "POST",
-                // One id per exec run: the node drops a repeated id as a duplicate send
-                // for a day, so an id shared by every run in a session ate follow-ups.
-                body: JSON.stringify({ sessionId, text: prompt, clientMessageId: `exec-${randomUUID()}` }),
+                body: JSON.stringify({ sessionId, text: prompt, clientMessageId: `exec-${sessionId}` }),
             });
         }
         catch (error) {

package/dist/runtime/model-catalog.js

@@ -147,19 +147,3 @@ export async function catalogReplyEvent(load, sessionId) {
         return { type: "session.error", sessionId, error: `Couldn't read this machine's model catalog: ${error instanceof Error ? error.message : String(error)}` };
     }
 }
-/**
- * Give a session's agent up to `timeoutMs` to publish its real model catalog
- * before a caller reads it. A not-yet-started agent otherwise answers from a
- * placeholder list. Never throws; a runtime without warmModels() is a no-op.
- */
-export async function warmSessionCatalog(session, timeoutMs) {
-    if (!session.warmModels)
-        return;
-    let timer;
-    await Promise.race([
-        session.warmModels().catch(() => { }),
-        new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); }),
-    ]);
-    if (timer)
-        clearTimeout(timer);
-}