@bivy/bivy 0.7.0-staging.96 → 0.7.0-staging.98

package/bin/acp-shim.mjs

@@ -57,45 +57,112 @@ function bivy(obj) {
 // --- ACP agent (child JSON-RPC over its stdio) ------------------------------
 const agent = spawn(agentCmd, agentArgs, { stdio: ["pipe", "pipe", "pipe"] });
 agent.stderr.on("data", (d) => process.stderr.write(`[acp-agent] ${d}`));
-agent.on("error", (e) => bivy({ type: "session.error", error: `acp agent spawn failed: ${e.message}` }));
-agent.on("exit", (code) => {
-  if (code && code !== 0) bivy({ type: "session.error", error: `acp agent exited (${code})` });
-});
-
 let nextId = 1;
 const pending = new Map(); // jsonrpc id -> {resolve, reject}
-function agentRequest(method, params) {
+let agentDead = null; // set to an Error once the child is gone
+
+/**
+ * The child is gone (spawn failure or exit). Every in-flight request must be
+ * rejected: without this, a CLI whose ACP mode doesn't exist leaves `initialize`
+ * pending forever and the daemon waits out its whole session.create timeout instead
+ * of surfacing the real reason. Fail fast, with the reason.
+ */
+function killPending(reason) {
+  if (agentDead) return;
+  agentDead = reason instanceof Error ? reason : new Error(String(reason));
+  bivy({ type: "session.error", error: agentDead.message });
+  for (const [id, p] of [...pending]) { pending.delete(id); p.reject(agentDead); }
+}
+agent.on("error", (e) => killPending(`acp agent spawn failed: ${e.message}`));
+agent.on("exit", (code, signal) => {
+  if (code || signal) killPending(`acp agent exited (${code ?? signal})`);
+});
+// Writing to a dead child's stdin raises EPIPE; with no listener that's an uncaught
+// exception that takes the shim down mid-turn instead of reporting the cause.
+agent.stdin.on("error", (e) => killPending(`acp agent stdin closed: ${e.message}`));
+
+function agentWrite(payload) {
+  if (agentDead) throw agentDead;
+  agent.stdin.write(`${JSON.stringify(payload)}\n`);
+}
+function agentRequest(method, params, { timeoutMs } = {}) {
   const id = nextId++;
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
-  return new Promise((resolve, reject) => pending.set(id, { resolve, reject }));
+  return new Promise((resolve, reject) => {
+    let timer;
+    pending.set(id, {
+      resolve: (v) => { clearTimeout(timer); resolve(v); },
+      reject: (e) => { clearTimeout(timer); reject(e); },
+    });
+    if (timeoutMs) {
+      timer = setTimeout(() => {
+        if (pending.delete(id)) reject(new Error(`acp ${method} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+    }
+    try { agentWrite({ jsonrpc: "2.0", id, method, params }); }
+    catch (e) { clearTimeout(timer); pending.delete(id); reject(e); }
+  });
 }
 function agentReply(id, result) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, result })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", id, result }); } catch { /* child gone; killPending already reported it */ }
 }
 function agentReplyError(id, code, message) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", id, error: { code, message } }); } catch { /* child gone */ }
 }
 function agentNotify(method, params) {
-  agent.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+  try { agentWrite({ jsonrpc: "2.0", method, params }); } catch { /* child gone */ }
 }
 
 // --- session state ----------------------------------------------------------
 let sessionId = null;
 let cwd = process.cwd();
 let initialized = false;
+// The ACP config-option id that selects the model (usually "model"), learned from
+// session/new; used for the session/set_config_option fallback.
+let modelConfigId = "model";
+// A model chosen before the ACP session existed, applied once it does.
+let pendingModel = null;
 // toolCallId -> { requestId, options } so a later bivy tool.decision answers the
 // right ACP permission request with a concrete optionId.
 const permissionRequests = new Map();
 
 async function ensureInitialized() {
   if (initialized) return;
+  // Bounded: a binary that accepts the launch args but never speaks ACP would
+  // otherwise hang here until the daemon's own session timeout, hiding the cause.
   await agentRequest("initialize", {
     protocolVersion: 1,
     clientCapabilities: { fs: { readTextFile: true, writeTextFile: true } },
-  });
+  }, { timeoutMs: 20_000 });
   initialized = true;
 }
 
+/**
+ * ACP exposes a session's selectable models as a `select` config option on the
+ * session/new|load result (opencode: `configOptions: [{id:"model", currentValue,
+ * options:[{value,name}]}]`). Models are per-NODE — they depend on which providers
+ * the user has authenticated in the agent — so a hardcoded list would offer models
+ * the agent rejects. Publish what the agent actually reports, as a post-hello
+ * `runtime.models` event ProtocolRuntime folds into its picker.
+ */
+function publishModels(result) {
+  const options = Array.isArray(result?.configOptions) ? result.configOptions : [];
+  const modelOption = options.find((o) => String(o?.id ?? "") === "model" || String(o?.category ?? "") === "model");
+  const choices = Array.isArray(modelOption?.options) ? modelOption.options : [];
+  const models = choices
+    .map((o) => ({ id: String(o?.value ?? ""), name: String(o?.name ?? o?.value ?? "") }))
+    .filter((m) => m.id)
+    // ACP model ids are `provider/model`; split the provider so Bivy can group and
+    // scope provider-specific settings the same way it does for other runtimes.
+    .map((m) => ({ ...m, provider: m.id.includes("/") ? m.id.split("/")[0] : "agent" }));
+  if (!models.length) return;
+  modelConfigId = String(modelOption?.id ?? "model");
+  bivy({
+    type: "runtime.models",
+    models,
+    ...(modelOption?.currentValue ? { currentModel: String(modelOption.currentValue) } : {}),
+  });
+}
+
 // --- ACP → bivy: streamed session/update notifications ----------------------
 function onSessionUpdate(params) {
   const u = params?.update;
@@ -211,6 +278,33 @@ createInterface({ input: agent.stdout }).on("line", (line) => {
   if (msg.method === "session/update") onSessionUpdate(msg.params);
 });
 
+/**
+ * Select a model on the live ACP session. `session/set_model` is the direct form;
+ * agents that only expose the generic config-option surface take the same choice as
+ * `session/set_config_option`. A rejection propagates: ProtocolRuntime only commits
+ * the selection once we ack, so a model the agent won't accept must not look applied.
+ */
+async function setAgentModel(model) {
+  try {
+    await agentRequest("session/set_model", { sessionId, modelId: model }, { timeoutMs: 15_000 });
+  } catch (primary) {
+    try {
+      await agentRequest("session/set_config_option", { sessionId, configId: modelConfigId, value: model }, { timeoutMs: 15_000 });
+    } catch {
+      throw primary;
+    }
+  }
+}
+
+async function applyPendingModel() {
+  if (!pendingModel || !sessionId) return;
+  const model = pendingModel;
+  pendingModel = null;
+  // Best-effort: a stale pick shouldn't block the session from opening.
+  try { await setAgentModel(model); }
+  catch (e) { bivy({ type: "runtime.debug", message: `acp set_model failed: ${e instanceof Error ? e.message : String(e)}` }); }
+}
+
 // --- bivy commands in (daemon → us) -----------------------------------------
 async function onBivyCommand(msg) {
   const type = String(msg.type || "");
@@ -224,6 +318,8 @@ async function onBivyCommand(msg) {
         cwd = String(msg.cwd || msg.workspace || cwd);
         const res = await agentRequest("session/new", { cwd, mcpServers: [] });
         sessionId = res?.sessionId ?? res?.session?.id ?? null;
+        publishModels(res);
+        await applyPendingModel();
         bivy({ replyTo: id, ok: true, runtimeSessionRef: sessionId });
         return;
       }
@@ -235,11 +331,14 @@ async function onBivyCommand(msg) {
         try {
           const res = await agentRequest("session/load", { sessionId: ref, cwd, mcpServers: [] });
           sessionId = res?.sessionId ?? ref;
+          publishModels(res);
         } catch {
           // Agent doesn't support session/load — start fresh so the chat still opens.
           const res = await agentRequest("session/new", { cwd, mcpServers: [] });
           sessionId = res?.sessionId ?? null;
+          publishModels(res);
         }
+        await applyPendingModel();
         bivy({ replyTo: id, ok: true, runtimeSessionRef: sessionId });
         return;
       }
@@ -270,6 +369,19 @@ async function onBivyCommand(msg) {
         }
         return;
       }
+      case "model.set": {
+        const model = String(msg.model ?? "").trim();
+        if (!model) { bivy({ replyTo: id, ok: true }); return; }
+        if (!sessionId) {
+          // Chosen before the session exists — remember and apply at session/new.
+          pendingModel = model;
+          bivy({ replyTo: id, ok: true });
+          return;
+        }
+        await setAgentModel(model);
+        bivy({ replyTo: id, ok: true });
+        return;
+      }
       case "session.abort": {
         if (sessionId) agentNotify("session/cancel", { sessionId });
         if (id !== undefined) bivy({ replyTo: id, ok: true });
@@ -286,8 +398,10 @@ async function onBivyCommand(msg) {
 }
 
 // Announce capabilities: ACP agents are governed (per-tool permission) and
-// resumable (session/load). Models aren't part of the core ACP surface, so we
-// don't advertise a picker we can't drive.
+// resumable (session/load). modelSelection starts FALSE and is upgraded later by a
+// `runtime.models` event if the session reports selectable models — the list is
+// per-node (it depends on the providers the user has authenticated in the agent)
+// and only arrives with session/new, so claiming a picker here would be a guess.
 bivy({ type: "hello", runtime: { capabilities: { toolInterception: true, modelSelection: false, resume: true } } });
 
 createInterface({ input: process.stdin }).on("line", (line) => {

package/bin/agent-manifest.json

@@ -20,8 +20,9 @@
       "label": "OpenCode",
       "command": "opencode",
       "hidden": false,
-      "supportTier": "beta",
-      "certification": "adapter-tested",
+      "supportTier": "supported",
+      "certification": "release-tested",
+      "testedVersion": "1.18.13",
       "headlessFlags": [
         "run",
         "-s"

package/dist/metadata.js

@@ -169,6 +169,24 @@ export class MetadataStore {
         this.data.sessions[id] = { ...prev, resumePending: pending, updatedAt: nowIso() };
         this.save();
     }
+    /** Set/clear the durable auto-resume time (rate/usage-limit recovery). Pass
+     *  null to clear. No-op when the row is missing or already in the requested
+     *  state, so it never churns the file on the hot turn path. */
+    setResumeAt(id, resumeAt) {
+        const prev = this.data.sessions[id];
+        if (!prev)
+            return;
+        const next = resumeAt ?? undefined;
+        if ((prev.resumeAt ?? undefined) === next)
+            return;
+        this.data.sessions[id] = { ...prev, resumeAt: next, updatedAt: nowIso() };
+        this.save();
+    }
+    /** Sessions with a durable auto-resume time set — the resume sweep re-arms
+     *  these after a restart. */
+    sessionsWithResumeAt() {
+        return Object.values(this.data.sessions).filter((s) => typeof s.resumeAt === "string" && s.resumeAt);
+    }
     /** Look up a session's durable metadata by id, or by session-file path. */
     getSession(idOrPath) {
         if (!idOrPath)

package/dist/policy/conditions.js

@@ -50,6 +50,48 @@ export function parseResetsAt(raw) {
     const iso = /(20\d\d-\d\d-\d\dT[\d:.]+(?:Z|[+-]\d\d:?\d\d))/.exec(raw);
     return iso?.[1];
 }
+/**
+ * Parse a bare wall-clock reset time — the shape Claude's subscription limits
+ * surface, e.g. `resets 12am (UTC)`, `resets at 3pm UTC`, `resets 09:00 UTC` —
+ * into the ISO timestamp of its NEXT occurrence (interpreted as UTC, which is
+ * what these messages state). Returns undefined when there's no clear clock
+ * time, so a relative phrase ("resets in 2 hours", handled by
+ * parseRetryAfterMs) or an unrelated number never masquerades as a reset.
+ *
+ * NB: a bare time-of-day can't say WHICH day, so for a multi-day window (a
+ * "weekly limit") this resolves to the nearest matching midnight, which may be
+ * earlier than the real reset. Prefer a structured resetsAtHint when available.
+ */
+export function parseResetClock(raw, nowMs) {
+    const m = /reset[a-z]*\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(raw);
+    if (!m)
+        return undefined;
+    const meridiem = m[3]?.toLowerCase();
+    // Require a real clock signal — a meridiem, an explicit minutes field, or a
+    // trailing UTC/GMT marker — so a bare "resets 5 nodes" can't parse as 05:00.
+    const tzFollows = /\b(?:utc|gmt)\b/i.test(raw.slice(m.index));
+    if (!meridiem && m[2] === undefined && !tzFollows)
+        return undefined;
+    let hour = Number(m[1]);
+    const minute = m[2] ? Number(m[2]) : 0;
+    if (hour > 23 || minute > 59)
+        return undefined;
+    if (meridiem === "am") {
+        if (hour === 12)
+            hour = 0;
+    }
+    else if (meridiem === "pm") {
+        if (hour !== 12)
+            hour += 12;
+    }
+    if (hour > 23)
+        return undefined;
+    const now = new Date(nowMs);
+    let target = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0);
+    if (target <= nowMs)
+        target += 86_400_000; // already past today → next day's occurrence
+    return new Date(target).toISOString();
+}
 // Ordered classifiers: the FIRST match wins, so more-specific/actionable
 // conditions are tested before broader ones (auth 401 before generic HTTP
 // noise; explicit billing/quota before a bare rate-limit; context-window before
@@ -58,7 +100,12 @@ const CLASSIFIERS = [
     { condition: "auth_failed", test: (r) => isAnthropicAuthError(r) },
     {
         condition: "credits_exhausted",
-        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session) limit (?:reached|hit)|(?:you(?:'ve| have)\s+)?hit your limit|out of credits|plan (?:limit|allowance)/i.test(r),
+        // Includes subscription usage caps — a Claude "5-hour" or "weekly" window
+        // hit reads "you've hit your weekly limit · resets 12am (UTC)". The window
+        // qualifier (weekly/daily/5-hour/7-day) is optional and may sit between
+        // "your" and "limit", so it must not break the match (it did before — the
+        // word "weekly" left these limits classified "unknown" and never resumed).
+        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session|weekly|daily|monthly|5[\s-]?hour|7[\s-]?day)[\s-]?limit(?:\s+(?:reached|hit))?|(?:you(?:'ve| have)\s+)?hit your (?:(?:weekly|daily|monthly|session|usage|5[\s-]?hour|7[\s-]?day)\s+)?limit|out of credits|plan (?:limit|allowance)/i.test(r),
     },
     {
         condition: "rate_limited",
@@ -86,7 +133,7 @@ const CLASSIFIERS = [
  * recovery metadata. Unmatched failures are `"unknown"` — deliberately left for
  * a human rather than blindly retried.
  */
-export function classifyFailure(error) {
+export function classifyFailure(error, opts = {}) {
     const raw = rawText(error).slice(0, 2000);
     const condition = CLASSIFIERS.find((c) => c.test(raw))?.condition ?? "unknown";
     const out = { condition, raw };
@@ -95,7 +142,11 @@ export function classifyFailure(error) {
         const retryAfterMs = parseRetryAfterMs(raw);
         if (retryAfterMs !== undefined)
             out.retryAfterMs = retryAfterMs;
-        const resetsAt = parseResetsAt(raw);
+        // Reset time, most-authoritative first: a structured hint the caller
+        // supplied (the provider's own usage snapshot), then an ISO stamp in the
+        // text, then a bare wall-clock ("resets 12am (UTC)") resolved to its next
+        // occurrence.
+        const resetsAt = opts.resetsAtHint ?? parseResetsAt(raw) ?? parseResetClock(raw, opts.now ?? Date.now());
         if (resetsAt !== undefined)
             out.resetsAt = resetsAt;
     }

package/dist/policy/run-policy.js

@@ -34,7 +34,7 @@ export function createRunPolicy(deps = {}) {
     const now = deps.now ?? Date.now;
     return {
         decide(ctx) {
-            const classified = classifyFailure(ctx.error);
+            const classified = classifyFailure(ctx.error, { now: now(), resetsAtHint: ctx.resetsAtHint });
             const { condition } = classified;
             const rule = findRule(ruleset, condition, context);
             if (!rule)
@@ -73,6 +73,7 @@ export function createRunPolicy(deps = {}) {
                     delayMs,
                     condition,
                     summary: `${condition}: transient — retrying (attempt ${nextAttempt}/${rule.maxAttempts})${timing}.`,
+                    ...(resetDelayMs !== undefined && classified.resetsAt ? { resetsAt: classified.resetsAt } : {}),
                 };
             }
             // action === "reroute": walk the chain from the current cursor, skipping

package/dist/policy/session-reroute.js

@@ -21,6 +21,17 @@
 // whether to suppress the turn's error toast before kicking off the async swap +
 // retry (`applyReroute`). Reroute happens only at the turn boundary, so there is
 // no partial-work hazard.
+//
+// It also plans the OTHER in-place recovery a live session can do: waiting out a
+// provider usage/rate limit and re-sending the same prompt when the window
+// resets (`planResume`). Unlike a reroute (which the controller applies itself),
+// a resume can be hours away and must survive a daemon restart, so scheduling +
+// persistence live in the caller (src/server.ts) — the controller only decides
+// whether a resume is warranted and by when.
+/** Below this, a "retry" is ordinary backoff (seconds) — not worth deferring an
+ *  interactive turn for; let it surface. A real usage/rate window reset is
+ *  minutes-to-days out and always clears this bar. */
+const MIN_RESUME_DELAY_MS = 60_000;
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class SessionRerouteController {
     deps;
@@ -50,6 +61,47 @@ export class SessionRerouteController {
             attempt: this.attempt,
             rerouteCount: this.rerouteCount,
         });
+        if (decision.action !== "reroute")
+            return null;
+        return this.rerouteFrom(decision, currentModel);
+    }
+    /**
+     * Decide whether this turn error should be recovered by WAITING for a provider
+     * usage/rate limit to reset and re-sending the same prompt. Returns a plan the
+     * caller should persist + schedule, or null (surface the error as usual).
+     *
+     * `resetsAtHint` is the authoritative reset time when the caller has one (the
+     * provider's structured usage snapshot) — essential for a multi-day "weekly"
+     * window, whose error text only states a time-of-day. `now` is injectable for
+     * deterministic tests. Pure w.r.t. the controller's counters.
+     */
+    planResume(rawError, currentModel, opts = {}) {
+        if (this.applying)
+            return null;
+        const now = opts.now ?? Date.now();
+        const decision = this.deps.policy.decide({
+            routing: { model: currentModel },
+            error: rawError,
+            attempt: this.attempt,
+            rerouteCount: this.rerouteCount,
+            resetsAtHint: opts.resetsAtHint,
+        });
+        if (decision.action !== "retry")
+            return null;
+        // Only defer for a concrete recovery window — a provider reset, or a delay
+        // long enough that it's clearly a limit rather than routine backoff.
+        if (decision.resetsAt === undefined && decision.delayMs < MIN_RESUME_DELAY_MS)
+            return null;
+        const resumeAt = decision.resetsAt ?? new Date(now + decision.delayMs).toISOString();
+        return { condition: decision.condition, summary: decision.summary, delayMs: Math.max(0, decision.delayMs), resumeAt };
+    }
+    /** Advance the attempt budget once the caller has committed to a resume, so a
+     *  limit that re-fires after the reset counts toward `maxAttempts` and can
+     *  eventually exhaust (→ park) instead of looping forever. */
+    noteResumeApplied() {
+        this.attempt += 1;
+    }
+    rerouteFrom(decision, currentModel) {
         if (decision.action !== "reroute")
             return null;
         const model = decision.routing.model;

package/dist/runtime/index.js

@@ -179,7 +179,11 @@ const CLI_AGENT_SPECS = {
         // reply to stdout (the TUI needs a real TTY and would hang over a pipe).
         args: ["run"],
         promptMode: "argv",
-        supportTier: "beta",
+        // Supported tier: OpenCode runs on the governed ACP path by default (per-tool
+        // Approve/Deny + session/load resume + a real model picker), the same bar Pi,
+        // Claude Code, and Codex clear. See `acp` below for the version fallback.
+        supportTier: "supported",
+        testedVersion: "1.18.13",
         blurb: "The most widely used open-source coding harness (OpenCode CLI).",
         // `opencode run -s <id> "<prompt>"` continues a prior session by its own id
         // (`-s, --session  session id to continue`, per `opencode run --help`).
@@ -195,11 +199,14 @@ const CLI_AGENT_SPECS = {
                 { id: "google/gemini-2.5-pro", name: "Gemini 2.5 Pro", provider: "google" },
             ],
         },
-        // OpenCode ships a native ACP server (`opencode acp`, per opencode.ai/docs/acp),
-        // so it can be driven through the governed ProtocolRuntime instead of the pipe —
-        // per-tool approvals + streaming + resume. Opt in with BIVY_OPENCODE_ACP=1 (or
-        // global BIVY_PREFER_ACP=1); off by default until validated for your version.
-        acp: { args: ["acp"] },
+        // `opencode acp` ("start ACP (Agent Client Protocol) server") drives OpenCode
+        // through the governed ProtocolRuntime instead of the one-shot pipe: per-tool
+        // Approve/Deny, streaming, `session/load` resume, and `session/set_model`.
+        // Validated against opencode 1.18.13, so it is ON by default (`preferred`) —
+        // gated on the binary actually listing the `acp` subcommand, so an older
+        // OpenCode falls back to the pipe path rather than opening a dead session.
+        // Force the pipe path back with BIVY_OPENCODE_ACP=0.
+        acp: { args: ["acp"], helpToken: "acp", preferred: true },
         install: { kind: "npm", pkg: "opencode-ai" },
     },
     aider: {
@@ -857,10 +864,28 @@ function cliThinkingConfig(id) {
 // installed binary doesn't actually mention. It never UPGRADES — adding a
 // capability needs the exact arg template, which help text can't safely supply — so
 // probing can only make the catalog MORE honest, never invent a no-op control.
+/**
+ * Absolute path of a command on the current PATH, or null when it isn't there.
+ * Used to key the help-probe cache: caching by the bare NAME would keep serving a
+ * stale answer after the binary behind that name changed (a CLI upgraded or
+ * installed while the daemon is running, or a different PATH entry winning).
+ */
+function resolveCommandPath(command) {
+    if (!command.trim())
+        return null;
+    const res = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
+        shell: process.platform !== "win32",
+        encoding: "utf8",
+    });
+    if (res.status !== 0)
+        return null;
+    return (res.stdout ?? "").split(/\r?\n/)[0]?.trim() || null;
+}
 const HELP_PROBE_CACHE = new Map();
 function probeHelpText(command) {
-    if (HELP_PROBE_CACHE.has(command))
-        return HELP_PROBE_CACHE.get(command) ?? null;
+    const key = resolveCommandPath(command) ?? command;
+    if (HELP_PROBE_CACHE.has(key))
+        return HELP_PROBE_CACHE.get(key) ?? null;
     let text = null;
     try {
         const res = spawnSync(command, ["--help"], { encoding: "utf8", timeout: 4000 });
@@ -870,7 +895,7 @@ function probeHelpText(command) {
     catch {
         text = null;
     }
-    HELP_PROBE_CACHE.set(command, text);
+    HELP_PROBE_CACHE.set(key, text);
     return text;
 }
 // A resume template mixes launch flags (`-p`, `--force`) with the resume-specific
@@ -963,9 +988,14 @@ function cliAgentInfo(id) {
         // src/harness/mcp-inject.ts + governMcpCall in src/server.ts.
         capabilities: { toolInterception: acpActive, mcpToolApprovals: acpActive || Boolean(process.env.BIVY_MCP_PROXY), modelSelection, resume, packages: false, fork: false, usageReporting, sessionDiscovery: id === "codex" },
         supportTier: spec.supportTier ?? (id === "codex" ? "supported" : "experimental"),
+        testedVersion: spec.testedVersion,
         authOwner: spec.authOwner ?? "agent",
         notes: installed
-            ? `Available on PATH. This process adapter ${spec.parserId && !spec.parserUnverified ? "parses its native JSON stream into a structured transcript" : spec.parserId ? "streams stdout/stderr (a structured JSON parser is available; opt in with BIVY_AGENT_STRUCTURED=1 once validated for your version)" : "streams stdout/stderr"}; Bivy governs its filesystem/exec/MCP effects at the sandbox tier rather than intercepting each tool call. Override its launch flags with BIVY_${id.toUpperCase()}_ARGS if your CLI version differs.`
+            ? acpActive
+                // Promoted to ACP: the description must match the governed path actually in
+                // use, not the pipe path this agent would otherwise take.
+                ? `Available on PATH, driven through its Agent Client Protocol server (\`${spec.command} ${spec.acp?.args.join(" ")}\`): each tool call is gated by Bivy's Approve/Deny before it runs, and sessions resume natively. Force the plain stdout pipe with BIVY_${id.toUpperCase()}_ACP=0.`
+                : `Available on PATH. This process adapter ${spec.parserId && !spec.parserUnverified ? "parses its native JSON stream into a structured transcript" : spec.parserId ? "streams stdout/stderr (a structured JSON parser is available; opt in with BIVY_AGENT_STRUCTURED=1 once validated for your version)" : "streams stdout/stderr"}; Bivy governs its filesystem/exec/MCP effects at the sandbox tier rather than intercepting each tool call. Override its launch flags with BIVY_${id.toUpperCase()}_ARGS if your CLI version differs.`
             : `${spec.command} was not found on PATH. Install it on this node, then select this agent again.`,
         install: installed || !installCommand ? undefined : {
             label: `Install ${spec.displayName}`,
@@ -980,6 +1010,13 @@ function cliAgentInfo(id) {
 // Approve/Deny card via guardianInterceptor, AND it resumes a prior thread by its
 // rollout id (thread/resume). Governed + resumable in one runtime supersedes the
 // exec path, which stays runnable via `BIVY_RUNTIME=codex` for a no-approval flow.
+/**
+ * The Codex CLI release this adapter was last certified against. Unlike Pi and the
+ * Claude Agent SDK, Codex is an external binary rather than a pinned npm dependency,
+ * so there is no lockfile entry to derive this from — it is bumped deliberately when
+ * the app-server shim is re-validated against a new Codex release.
+ */
+const CODEX_TESTED_VERSION = "0.145.0";
 function codexApprovalsInfo() {
     const installed = commandAvailable("codex");
     return {
@@ -1009,7 +1046,12 @@ function codexApprovalsInfo() {
             nativeSessionDiscovery: true,
             nativeSessionAdoption: true,
         },
-        supportTier: "beta",
+        // Supported tier: the app-server shim already clears the same bar as Pi and
+        // Claude Code — per-tool Approve/Deny, model selection, thread resume, usage
+        // reporting, and native session discovery/adoption — all over a bidirectional
+        // protocol rather than a one-shot pipe.
+        supportTier: "supported",
+        testedVersion: CODEX_TESTED_VERSION,
         authOwner: "agent",
         notes: installed
             ? "Drives Codex's experimental app-server so tool calls surface as in-chat approval cards, and resumes a prior thread by its rollout id (thread/resume). Governance AND resume in one runtime."
@@ -1202,15 +1244,50 @@ function acpRuntimeFromEnv(credsDir) {
     return acpRuntimeOptions({ id: "acp", displayName: process.env.BIVY_ACP_NAME?.trim() || "ACP Agent", command, agentArgs, credsDir });
 }
 /**
- * Whether a CLI agent should be driven through ACP rather than the one-shot pipe:
- * it declares an `acp` mode AND ACP is preferred for it (per-agent `BIVY_<ID>_ACP=1`
- * or global `BIVY_PREFER_ACP=1`). This is the data-driven "promote an agent to the
- * high-capability path" switch — no per-agent code, just a spec field + a flag.
+ * Does the INSTALLED binary actually evidence the agent's ACP mode? A default-on
+ * promotion must never be taken on faith: ACP is a hard switch (the pipe path is
+ * unreachable once a session opens), so a CLI too old to have the subcommand would
+ * otherwise hang and die instead of degrading. We reuse the same cached `--help`
+ * probe the opt-in capability refinement uses, and fail CLOSED — a missing binary
+ * or unreadable help keeps the agent on the honest pipe path.
+ */
+function acpSupportedByBinary(id) {
+    const spec = CLI_AGENT_SPECS[id];
+    if (!spec.acp)
+        return false;
+    if (!commandAvailable(spec.command))
+        return false;
+    const help = probeHelpText(spec.command);
+    if (!help)
+        return false;
+    const token = (spec.acp.helpToken ?? spec.acp.args[0] ?? "acp").toLowerCase();
+    return help.includes(token);
+}
+/**
+ * Whether a CLI agent should be driven through ACP rather than the one-shot pipe.
+ * Three ways in, in precedence order:
+ *   - `BIVY_<ID>_ACP=0` — operator forces the pipe path back (escape hatch).
+ *   - `BIVY_<ID>_ACP=1` / `BIVY_PREFER_ACP=1` — operator forces ACP, no probe (they
+ *     know their binary; an explicit request shouldn't be second-guessed).
+ *   - `spec.acp.preferred` — validated agents are promoted by DEFAULT, but only
+ *     when the installed binary evidences the ACP mode (see acpSupportedByBinary).
+ * Still no per-agent code: a spec field plus a flag.
+ *
+ * Both the catalog (cliAgentInfo) and the launch path (makeCliRuntime) call this,
+ * so what the picker advertises and what actually starts cannot disagree.
  */
 function prefersAcp(id) {
-    if (!CLI_AGENT_SPECS[id].acp)
+    const spec = CLI_AGENT_SPECS[id];
+    if (!spec.acp)
+        return false;
+    const override = process.env[`BIVY_${id.toUpperCase()}_ACP`];
+    if (override === "0")
+        return false;
+    if (override === "1" || process.env.BIVY_PREFER_ACP === "1")
+        return true;
+    if (!spec.acp.preferred)
         return false;
-    return process.env.BIVY_PREFER_ACP === "1" || process.env[`BIVY_${id.toUpperCase()}_ACP`] === "1";
+    return acpSupportedByBinary(id);
 }
 /**
  * Resolve the communication mode for a CLI agent. This is deliberately pure so

package/dist/runtime/protocol.js

@@ -410,6 +410,21 @@ class ProtocolSession {
                 this.runtimeSessionRef = msg.runtimeSessionRef;
             return;
         }
+        // Late-arriving model registry. A shim that knows its models up front puts them
+        // in `hello`; one whose list is only knowable per session — an ACP agent's
+        // models depend on which providers the user has authenticated, and arrive with
+        // session/new — publishes them here instead. Same contract as the hello path: a
+        // picker backed by a real `model.set` the shim answers, never a claimed one.
+        if (type === "runtime.models") {
+            const models = parseModels(msg.models);
+            if (models.length) {
+                this.models = models;
+                this.capabilitiesRef.modelSelection = true;
+                if (typeof msg.currentModel === "string")
+                    this.currentModelId = msg.currentModel;
+            }
+            return;
+        }
         if (type === "message.delta") {
             const text = String(msg.text ?? "");
             if (!this.assistantText)

package/dist/server.js

@@ -501,11 +501,11 @@ const terminals = new TerminalManager();
 // and fixed for that session's life; switching agents in the UI starts a new one.
 let defaultRuntimeId = (process.env.BIVY_RUNTIME ?? "pi").toLowerCase();
 const runtimeHost = new RuntimeHost({ credsDir, piDir, sessionsDir, attachToChat: attachToChatForSession });
-// In-session model reroute (docs/rulesets.md). Opt-in: set
-// BIVY_SESSION_MODEL_FALLBACK to a comma-separated model list and a session that
-// hits an exhausted-credits / rate-limit turn error swaps down the list (via the
-// runtime's live setModel) and retries, instead of surfacing the error. Absent =
-// inert, session behavior unchanged.
+// A built-in in-session model-fallback ruleset from BIVY_SESSION_MODEL_FALLBACK
+// (docs/rulesets.md). Opt-in: set it to a comma-separated model list and a
+// session that hits an exhausted-credits / rate-limit turn error swaps down the
+// list (via the runtime's live setModel) and retries. Used only when the user
+// hasn't authored their own session-scoped ruleset in the UI.
 function sessionModelFallbackRuleset() {
     const models = (process.env.BIVY_SESSION_MODEL_FALLBACK ?? "")
         .split(",")
@@ -529,9 +529,21 @@ function sessionModelFallbackRuleset() {
         ],
     };
 }
-const sessionRuleset = sessionModelFallbackRuleset();
-const sessionRunPolicy = sessionRuleset ? createRunPolicy({ ruleset: sessionRuleset, context: "session" }) : undefined;
-if (sessionRunPolicy) {
+/** The ruleset in-session recovery runs under right now: the user's active
+ *  ruleset if it applies to sessions, else the env model-fallback ruleset, else
+ *  undefined (→ built-in DEFAULT_RULESET). Read lazily on each turn error so UI
+ *  edits take effect without a restart, mirroring activeQueueRuleset. */
+function activeSessionRuleset() {
+    return activeRulesetFor(rulesetsDir, "session") ?? sessionModelFallbackRuleset();
+}
+// The in-session recovery effector's policy. Always available: an interactive
+// session can wait out a provider usage/rate limit and resume when it resets
+// (planResume), or swap models down a fallback chain (planReroute). Thin wrapper
+// so a freshly-saved active ruleset is picked up on the next turn error.
+const sessionRunPolicy = {
+    decide: (ctx) => createRunPolicy({ context: "session", ruleset: activeSessionRuleset() }).decide(ctx),
+};
+if (process.env.BIVY_SESSION_MODEL_FALLBACK) {
     console.log(`[policy] in-session model reroute enabled: ${process.env.BIVY_SESSION_MODEL_FALLBACK}`);
 }
 let lastUpdateCheckAt = 0;
@@ -3542,6 +3554,9 @@ const RELAY_COMMANDS = {
             record.lastPrompt = agentPrompt;
             record.lastPromptOptions = promptOptionsFor(record, msg.streamingBehavior, images);
             record.reroute?.beginTurn();
+            // The user is driving this turn manually — supersede any pending auto-resume
+            // that was scheduled after a prior limit so it can't re-fire on top of them.
+            clearSessionResume(record.id);
             await promptWithWatchdog(record, agentPrompt, record.lastPromptOptions);
         }).catch((error) => {
             // Mirror the HTTP path (see the /prompt route): a rejected turn after
@@ -6862,6 +6877,20 @@ const idleCloseTimer = setInterval(() => { closeIdleSessions(); pruneGhostSessio
 idleCloseTimer.unref?.();
 const worktreeCleanupTimer = setInterval(() => void sweepDiskGuardrails(), worktreeCleanupSweepMs);
 worktreeCleanupTimer.unref?.();
+// In-session auto-resume tunables (see the resume helpers below). setTimeout
+// can't be trusted past ~24.8 days and we don't want one timer owning a
+// multi-hour wait a restart would drop, so each timer is capped and the periodic
+// sweep re-arms the remainder from the persisted resumeAt.
+const SESSION_RESUME_MAX_TIMER_MS = 30 * 60_000;
+const SESSION_RESUME_SWEEP_MS = 60_000;
+/** Slack around "due": a capped timer may fire a touch early — drive only when
+ *  within this of the target, else re-arm. */
+const SESSION_RESUME_TICK_MS = 15_000;
+const sessionResumeTimers = new Map();
+// Fire due auto-resumes (a usage/rate limit that has since reset) and re-arm the
+// tail of long waits whose in-process timer was capped or lost to a restart.
+const sessionResumeTimer = setInterval(() => sessionResumeSweep(), SESSION_RESUME_SWEEP_MS);
+sessionResumeTimer.unref?.();
 // --- server-side ephemeral teardown ----------------------------------------
 // On a disposable machine (bootstrap set BIVY_EPHEMERAL=1) the daemon ends the
 // machine ITSELF once it goes idle, so teardown no longer needs the launching
@@ -7111,6 +7140,125 @@ async function refreshSessionUsage(record) {
         // Usage reporting must never affect the session it's reporting on.
     }
 }
+// ── In-session auto-resume after a usage/rate limit ─────────────────────────
+// When a turn ends because a provider window is exhausted ("you've hit your
+// weekly limit · resets 12am (UTC)") and the session's ruleset says retry, we
+// wait out the window and re-send the same prompt when it resets — instead of
+// leaving a dead error bubble. Durable: the due time is persisted (metadata
+// resumeAt) so a daemon restart re-arms it (sessionResumeSweep); an in-process
+// timer fires it promptly while the daemon is up. (Tunables + timer map are
+// declared up by the timer cluster so the sweep interval can reference them.)
+/** The authoritative reset time for the limit a session just hit: the soonest
+ *  future reset among its most-utilized usage windows (the binding one), from
+ *  the last snapshot the runtime reported. Essential for a multi-day "weekly"
+ *  window, whose error text states only a time-of-day. Undefined when unknown. */
+function limitResetHint(record, nowMs) {
+    const windows = record.usage?.plan?.windows ?? [];
+    let best;
+    for (const w of windows) {
+        if (!w.resetsAt)
+            continue;
+        const at = Date.parse(w.resetsAt);
+        if (!Number.isFinite(at) || at <= nowMs)
+            continue;
+        const util = w.utilizationPct ?? 0;
+        // Prefer the most-utilized window (the one being hit); tie-break on soonest reset.
+        if (!best || util > best.util || (util === best.util && at < best.at))
+            best = { at, util };
+    }
+    return best ? new Date(best.at).toISOString() : undefined;
+}
+/** Cancel a pending in-process resume timer (leaves the durable marker alone). */
+function cancelSessionResumeTimer(id) {
+    const timer = sessionResumeTimers.get(id);
+    if (timer) {
+        clearTimeout(timer);
+        sessionResumeTimers.delete(id);
+    }
+}
+/** Clear both the durable resume marker and any armed timer — the session moved
+ *  on (a new user turn, or the resume itself started). */
+function clearSessionResume(id) {
+    cancelSessionResumeTimer(id);
+    metadata.setResumeAt(id, null);
+}
+function armSessionResumeTimer(id, dueMs) {
+    cancelSessionResumeTimer(id);
+    const delay = Math.min(Math.max(0, dueMs - Date.now()), SESSION_RESUME_MAX_TIMER_MS);
+    const timer = setTimeout(() => {
+        sessionResumeTimers.delete(id);
+        void driveSessionResume(id);
+    }, delay);
+    timer.unref?.();
+    sessionResumeTimers.set(id, timer);
+}
+/** Persist + arm an auto-resume decided by the session policy. Synchronous so
+ *  the caller can atomically suppress the turn's error toast. */
+function scheduleSessionResume(record, plan) {
+    metadata.setResumeAt(record.id, plan.resumeAt);
+    const when = Date.parse(plan.resumeAt);
+    const cond = plan.condition.replace(/_/g, " ");
+    broadcast({
+        type: "session.notice",
+        sessionId: record.id,
+        level: "info",
+        message: `Hit a ${cond} limit — I'll resume this automatically when it resets (${plan.resumeAt}).`,
+    });
+    armSessionResumeTimer(record.id, Number.isFinite(when) ? when : Date.now());
+}
+/** Fire a due auto-resume: re-open the session if needed and re-send the turn's
+ *  last prompt. Clears the durable marker BEFORE driving so a crash mid-resume
+ *  can't loop. Best-effort — never throws into a timer/sweep. */
+async function driveSessionResume(id) {
+    const meta = metadata.getSession(id);
+    if (!meta?.resumeAt)
+        return; // cancelled or already resumed
+    const due = Date.parse(meta.resumeAt);
+    if (Number.isFinite(due) && due - Date.now() > SESSION_RESUME_TICK_MS) {
+        // A capped timer fired before the real due time — re-arm for the remainder.
+        armSessionResumeTimer(id, due);
+        return;
+    }
+    clearSessionResume(id);
+    try {
+        const live = openSessions.get(id);
+        if (live?.isWorking)
+            return; // a user turn is already running — don't pile on
+        const record = live ?? (await resolveOrResumeSession(id, meta.path));
+        if (!record)
+            return; // transcript gone / unresolvable
+        if (record.isWorking)
+            return;
+        // In-memory lastPrompt is the exact user turn to retry; after a restart it's
+        // gone, so fall back to the generic interrupted-turn continuation nudge.
+        const prompt = record.lastPrompt ?? buildInteractiveResumePrompt();
+        console.log(`[resume] auto-resuming session ${id} — provider limit has reset`);
+        broadcast({ type: "session.notice", sessionId: id, level: "info", message: "The limit has reset — resuming now." });
+        await promptWithWatchdog(record, prompt, record.lastPromptOptions);
+    }
+    catch (error) {
+        console.warn(`[resume] auto-resume after a provider limit failed for ${id}`, error);
+    }
+}
+/** Re-arm (or immediately fire) durable auto-resume markers. Runs once at boot
+ *  and on an interval, so a wait survives a restart and a capped timer's tail
+ *  still fires. */
+function sessionResumeSweep() {
+    const now = Date.now();
+    for (const meta of metadata.sessionsWithResumeAt()) {
+        const due = Date.parse(meta.resumeAt);
+        if (!Number.isFinite(due)) {
+            metadata.setResumeAt(meta.id, null);
+            continue;
+        }
+        if (sessionResumeTimers.has(meta.id))
+            continue; // already armed this run
+        if (due <= now + SESSION_RESUME_TICK_MS)
+            void driveSessionResume(meta.id);
+        else
+            armSessionResumeTimer(meta.id, due);
+    }
+}
 /**
  * Turn a raw provider/runtime error string into something a human can read.
  * Model APIs commonly return `<status> {json}` (e.g. `400 {"error":{"message":
@@ -7184,9 +7332,12 @@ function maybeSignalAuthRequired(record, errorText) {
 }
 function attachSessionListeners(record) {
     record.unsubscribe?.();
-    // In-session model reroute controller (inert unless BIVY_SESSION_MODEL_FALLBACK
-    // is set). One per session; its per-turn budget resets on each user prompt.
-    if (sessionRunPolicy && !record.reroute) {
+    // In-session recovery controller — waits out a usage/rate limit and resumes
+    // (planResume), or swaps models down a fallback chain (planReroute). One per
+    // session; its per-turn budget resets on each user prompt. The policy reads
+    // the active session ruleset lazily, so it's inert until one authorizes a
+    // retry/reroute for the failing condition.
+    if (!record.reroute) {
         record.reroute = new SessionRerouteController({
             policy: sessionRunPolicy,
             onNotice: (n) => broadcast({ type: "session.notice", sessionId: record.id, level: n.level, message: n.message }),
@@ -7306,7 +7457,18 @@ function attachSessionListeners(record) {
             // credential or a 4xx from the API) otherwise vanished: working cleared,
             // no reply, no signal. Surface it as a session-scoped error so the client
             // can show it *inline in that chat*, and notify instead of "done".
-            const turnError = terminalTurnError(event);
+            // A terminal turn error reaches us two ways. pi-ai puts it on the last
+            // assistant message (stopReason:"error" → terminalTurnError), and the
+            // server owns surfacing it. Claude Code instead throws inside the SDK
+            // query: it emits its OWN session.error to the client AND carries the raw
+            // text on agent_end.error (e.g. "you've hit your weekly limit · resets 12am
+            // (UTC)"). We read that too — but only to DRIVE recovery, since the runtime
+            // already surfaced it; re-broadcasting would double the error bubble.
+            const messageError = terminalTurnError(event);
+            const agentEndError = typeof event.error === "string"
+                ? humanizeAgentError(event.error)
+                : undefined;
+            const turnError = messageError ?? (agentEndError?.trim() ? agentEndError : undefined);
             // Before surfacing a turn error, see if the session's run policy can recover
             // it in place by swapping to a fallback model and retrying the same prompt.
             // planReroute is synchronous, so we can atomically suppress the error toast
@@ -7314,6 +7476,14 @@ function attachSessionListeners(record) {
             const reroutePlan = turnError && record.lastPrompt !== undefined
                 ? record.reroute?.planReroute(turnError, record.session.getCurrentModel()?.name) ?? null
                 : null;
+            // If a reroute doesn't apply, a usage/rate limit that gave a reset time can
+            // instead be waited out and resumed when the window clears (planResume is
+            // synchronous too, so this stays atomic with suppressing the error toast).
+            const resumePlan = !reroutePlan && turnError && record.lastPrompt !== undefined
+                ? record.reroute?.planResume(turnError, record.session.getCurrentModel()?.name, {
+                    resetsAtHint: limitResetHint(record, Date.now()),
+                }) ?? null
+                : null;
             if (reroutePlan) {
                 void record.reroute.applyReroute(reroutePlan, {
                     getCurrentModelName: () => record.session.getCurrentModel()?.name,
@@ -7323,14 +7493,23 @@ function attachSessionListeners(record) {
                     },
                 });
             }
-            else if (turnError) {
+            else if (resumePlan) {
+                // Charge the attempt budget so a limit that re-fires after the reset can
+                // eventually exhaust (→ surface) instead of looping, then park the turn
+                // as a scheduled resume rather than a dead error.
+                record.reroute.noteResumeApplied();
+                scheduleSessionResume(record, resumePlan);
+            }
+            else if (messageError) {
+                // Only the server-owned (pi-ai) path surfaces here; a Claude Code error
+                // the runtime already broadcast falls through to avoid a duplicate bubble.
                 record.lastFailureAt = Date.now();
                 metadata.touchSession(record.id, "failed");
                 scheduleAdvertise();
-                broadcast({ type: "session.error", sessionId: record.id, error: turnError });
+                broadcast({ type: "session.error", sessionId: record.id, error: messageError });
                 // If the terminal error is an auth failure (expired key/token → 4xx),
                 // also raise the sign-in sheet for the failing provider.
-                maybeSignalAuthRequired(record, turnError);
+                maybeSignalAuthRequired(record, messageError);
                 void sendNotificationHint({
                     kind: "session_error",
                     sessionId: record.id,
@@ -10655,6 +10834,14 @@ const server = app.listen(port, host, async () => {
     // Recover interactive sessions a restart interrupted mid-turn (auto-continue, or
     // flag for a one-tap manual Resume) per the node's sessionResumeMode setting.
     void reconcileInterruptedSessions().catch((error) => console.warn("[resume] interrupted-session reconciliation failed", error));
+    // Re-arm (or fire) durable auto-resume markers a limit-hit turn left behind,
+    // so a session waiting out a usage/rate window still resumes after a restart.
+    try {
+        sessionResumeSweep();
+    }
+    catch (error) {
+        console.warn("[resume] auto-resume sweep failed at boot", error);
+    }
     // Universal Agent Harness — network effect boundary (opt-in via
     // BIVY_EGRESS_PROXY). Governs/logs outbound traffic of CLI agents, which
     // inherit the proxy env from process.ts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.7.0-staging.96",
+  "version": "0.7.0-staging.98",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",