@bivy/bivy 0.7.0-staging.102 → 0.7.0-staging.103

package/dist/metadata.js

@@ -182,6 +182,20 @@ export class MetadataStore {
         this.data.sessions[id] = { ...prev, resumeAt: next, updatedAt: nowIso() };
         this.save();
     }
+    /** Set the durable consecutive auto-resume counter (the restart-safe backstop
+     *  for the in-memory reroute budget). Pass 0 to clear. No-op when the row is
+     *  missing or already in the requested state, so a normal turn (counter already
+     *  0) never churns the file. */
+    setResumeAttempts(id, attempts) {
+        const prev = this.data.sessions[id];
+        if (!prev)
+            return;
+        const next = attempts > 0 ? attempts : undefined;
+        if ((prev.resumeAttempts ?? undefined) === next)
+            return;
+        this.data.sessions[id] = { ...prev, resumeAttempts: next, updatedAt: nowIso() };
+        this.save();
+    }
     /** Sessions with a durable auto-resume time set — the resume sweep re-arms
      *  these after a restart. */
     sessionsWithResumeAt() {

package/dist/policy/session-reroute.js

@@ -92,8 +92,22 @@ export class SessionRerouteController {
         // long enough that it's clearly a limit rather than routine backoff.
         if (decision.resetsAt === undefined && decision.delayMs < MIN_RESUME_DELAY_MS)
             return null;
-        const resumeAt = decision.resetsAt ?? new Date(now + decision.delayMs).toISOString();
-        return { condition: decision.condition, summary: decision.summary, delayMs: Math.max(0, decision.delayMs), resumeAt };
+        // Resolve the due time (provider reset when known, else backoff) and floor it
+        // to at least MIN_RESUME_DELAY_MS in the FUTURE. A reset time can be in the
+        // past or ~now — a stale/elapsed reset, clock skew, or (most often) a window
+        // that already lapsed while the daemon was down — and using it verbatim yields
+        // a 0ms delay. The caller arms a timer at that delay, so a 0ms resume re-sends
+        // instantly, re-hits the still-standing limit, and re-schedules 0ms again: a
+        // tight loop that pins a CPU core and never settles. Flooring turns a
+        // not-yet-cleared limit into a slow retry the attempt budget can still park.
+        const rawDueMs = decision.resetsAt ? Date.parse(decision.resetsAt) : now + decision.delayMs;
+        const dueMs = Math.max(Number.isFinite(rawDueMs) ? rawDueMs : now, now + MIN_RESUME_DELAY_MS);
+        return {
+            condition: decision.condition,
+            summary: decision.summary,
+            delayMs: dueMs - now,
+            resumeAt: new Date(dueMs).toISOString(),
+        };
     }
     /** Advance the attempt budget once the caller has committed to a resume, so a
      *  limit that re-fires after the reset counts toward `maxAttempts` and can

package/dist/server.js

@@ -6886,6 +6886,14 @@ const SESSION_RESUME_SWEEP_MS = 60_000;
 /** Slack around "due": a capped timer may fire a touch early — drive only when
  *  within this of the target, else re-arm. */
 const SESSION_RESUME_TICK_MS = 15_000;
+/** Hard ceiling on consecutive auto-resumes for one session before we give up and
+ *  surface the limit. The reroute controller already caps per turn, but its budget
+ *  is in-memory: a session re-resolved after its child exits on the limit (or a
+ *  daemon restart) gets a fresh controller, so without a durable count a limit that
+ *  never actually clears would re-send every MIN_RESUME_DELAY_MS indefinitely.
+ *  Generous enough to ride out a mis-parsed multi-day window (each wait is ≥1 min,
+ *  usually far longer), low enough to bound a genuinely stuck limit. */
+const MAX_DURABLE_RESUME_ATTEMPTS = 10;
 const sessionResumeTimers = new Map();
 // Fire due auto-resumes (a usage/rate limit that has since reset) and re-arm the
 // tail of long waits whose in-process timer was capped or lost to a restart.
@@ -7192,10 +7200,20 @@ function armSessionResumeTimer(id, dueMs) {
     timer.unref?.();
     sessionResumeTimers.set(id, timer);
 }
-/** Persist + arm an auto-resume decided by the session policy. Synchronous so
- *  the caller can atomically suppress the turn's error toast. */
+/** Persist + arm an auto-resume decided by the session policy. Synchronous so the
+ *  caller can atomically suppress the turn's error toast. Returns false when the
+ *  session has already exhausted its durable auto-resume budget (a limit that never
+ *  clears) — the caller then lets the error surface instead of looping. */
 function scheduleSessionResume(record, plan) {
+    const attempts = metadata.getSession(record.id)?.resumeAttempts ?? 0;
+    if (attempts >= MAX_DURABLE_RESUME_ATTEMPTS) {
+        console.warn(`[resume] session ${record.id} hit the durable auto-resume cap (${MAX_DURABLE_RESUME_ATTEMPTS}) without the limit clearing — giving up`);
+        clearSessionResume(record.id);
+        metadata.setResumeAttempts(record.id, 0);
+        return false;
+    }
     metadata.setResumeAt(record.id, plan.resumeAt);
+    metadata.setResumeAttempts(record.id, attempts + 1);
     const when = Date.parse(plan.resumeAt);
     const cond = plan.condition.replace(/_/g, " ");
     broadcast({
@@ -7205,6 +7223,7 @@ function scheduleSessionResume(record, plan) {
         message: `Hit a ${cond} limit — I'll resume this automatically when it resets (${plan.resumeAt}).`,
     });
     armSessionResumeTimer(record.id, Number.isFinite(when) ? when : Date.now());
+    return true;
 }
 /** Fire a due auto-resume: re-open the session if needed and re-send the turn's
  *  last prompt. Clears the durable marker BEFORE driving so a crash mid-resume
@@ -7484,6 +7503,10 @@ function attachSessionListeners(record) {
                     resetsAtHint: limitResetHint(record, Date.now()),
                 }) ?? null
                 : null;
+            // Did this turn end by scheduling another auto-resume? If not, the session
+            // made forward progress (a user turn, a resume that cleared the limit, a
+            // reroute, or a surfaced error), so its durable resume streak resets below.
+            let scheduledResume = false;
             if (reroutePlan) {
                 void record.reroute.applyReroute(reroutePlan, {
                     getCurrentModelName: () => record.session.getCurrentModel()?.name,
@@ -7493,12 +7516,14 @@ function attachSessionListeners(record) {
                     },
                 });
             }
-            else if (resumePlan) {
+            else if (resumePlan && scheduleSessionResume(record, resumePlan)) {
                 // Charge the attempt budget so a limit that re-fires after the reset can
                 // eventually exhaust (→ surface) instead of looping, then park the turn
-                // as a scheduled resume rather than a dead error.
+                // as a scheduled resume rather than a dead error. scheduleSessionResume
+                // returns false once the durable cap is hit, so this falls through to
+                // surface the limit instead of resuming forever.
                 record.reroute.noteResumeApplied();
-                scheduleSessionResume(record, resumePlan);
+                scheduledResume = true;
             }
             else if (messageError) {
                 // Only the server-owned (pi-ai) path surfaces here; a Claude Code error
@@ -7527,6 +7552,11 @@ function attachSessionListeners(record) {
                     body: `${sessionNotifyLabel(record)} finished — tap to review the result.`,
                 });
             }
+            // Any turn that didn't schedule another resume broke the limit streak —
+            // clear the durable counter so a future limit starts with a full budget
+            // (no-op when it's already 0, so a normal turn never touches the file).
+            if (!scheduledResume)
+                metadata.setResumeAttempts(record.id, 0);
             // First real commit on a repo-backed worktree → publish the branch to the
             // remote (sets upstream), so the work is visible on GitHub. No-op until
             // there's a commit, and only pushes once. Then adopt a PR the agent opened

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.7.0-staging.102",
+  "version": "0.7.0-staging.103",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",