@bivy/bivy 0.7.0-staging.97 → 0.7.0-staging.99

package/dist/metadata.js

@@ -169,6 +169,24 @@ export class MetadataStore {
         this.data.sessions[id] = { ...prev, resumePending: pending, updatedAt: nowIso() };
         this.save();
     }
+    /** Set/clear the durable auto-resume time (rate/usage-limit recovery). Pass
+     *  null to clear. No-op when the row is missing or already in the requested
+     *  state, so it never churns the file on the hot turn path. */
+    setResumeAt(id, resumeAt) {
+        const prev = this.data.sessions[id];
+        if (!prev)
+            return;
+        const next = resumeAt ?? undefined;
+        if ((prev.resumeAt ?? undefined) === next)
+            return;
+        this.data.sessions[id] = { ...prev, resumeAt: next, updatedAt: nowIso() };
+        this.save();
+    }
+    /** Sessions with a durable auto-resume time set — the resume sweep re-arms
+     *  these after a restart. */
+    sessionsWithResumeAt() {
+        return Object.values(this.data.sessions).filter((s) => typeof s.resumeAt === "string" && s.resumeAt);
+    }
     /** Look up a session's durable metadata by id, or by session-file path. */
     getSession(idOrPath) {
         if (!idOrPath)

package/dist/policy/conditions.js

@@ -50,6 +50,48 @@ export function parseResetsAt(raw) {
     const iso = /(20\d\d-\d\d-\d\dT[\d:.]+(?:Z|[+-]\d\d:?\d\d))/.exec(raw);
     return iso?.[1];
 }
+/**
+ * Parse a bare wall-clock reset time — the shape Claude's subscription limits
+ * surface, e.g. `resets 12am (UTC)`, `resets at 3pm UTC`, `resets 09:00 UTC` —
+ * into the ISO timestamp of its NEXT occurrence (interpreted as UTC, which is
+ * what these messages state). Returns undefined when there's no clear clock
+ * time, so a relative phrase ("resets in 2 hours", handled by
+ * parseRetryAfterMs) or an unrelated number never masquerades as a reset.
+ *
+ * NB: a bare time-of-day can't say WHICH day, so for a multi-day window (a
+ * "weekly limit") this resolves to the nearest matching midnight, which may be
+ * earlier than the real reset. Prefer a structured resetsAtHint when available.
+ */
+export function parseResetClock(raw, nowMs) {
+    const m = /reset[a-z]*\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(raw);
+    if (!m)
+        return undefined;
+    const meridiem = m[3]?.toLowerCase();
+    // Require a real clock signal — a meridiem, an explicit minutes field, or a
+    // trailing UTC/GMT marker — so a bare "resets 5 nodes" can't parse as 05:00.
+    const tzFollows = /\b(?:utc|gmt)\b/i.test(raw.slice(m.index));
+    if (!meridiem && m[2] === undefined && !tzFollows)
+        return undefined;
+    let hour = Number(m[1]);
+    const minute = m[2] ? Number(m[2]) : 0;
+    if (hour > 23 || minute > 59)
+        return undefined;
+    if (meridiem === "am") {
+        if (hour === 12)
+            hour = 0;
+    }
+    else if (meridiem === "pm") {
+        if (hour !== 12)
+            hour += 12;
+    }
+    if (hour > 23)
+        return undefined;
+    const now = new Date(nowMs);
+    let target = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0);
+    if (target <= nowMs)
+        target += 86_400_000; // already past today → next day's occurrence
+    return new Date(target).toISOString();
+}
 // Ordered classifiers: the FIRST match wins, so more-specific/actionable
 // conditions are tested before broader ones (auth 401 before generic HTTP
 // noise; explicit billing/quota before a bare rate-limit; context-window before
@@ -58,7 +100,12 @@ const CLASSIFIERS = [
     { condition: "auth_failed", test: (r) => isAnthropicAuthError(r) },
     {
         condition: "credits_exhausted",
-        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session) limit (?:reached|hit)|(?:you(?:'ve| have)\s+)?hit your limit|out of credits|plan (?:limit|allowance)/i.test(r),
+        // Includes subscription usage caps — a Claude "5-hour" or "weekly" window
+        // hit reads "you've hit your weekly limit · resets 12am (UTC)". The window
+        // qualifier (weekly/daily/5-hour/7-day) is optional and may sit between
+        // "your" and "limit", so it must not break the match (it did before — the
+        // word "weekly" left these limits classified "unknown" and never resumed).
+        test: (r) => /\b402\b|payment required|insufficient\s+(?:credit|quota|balance|funds)|credit balance (?:is )?too low|quota (?:exceeded|exhausted)|billing|(?:usage|session|weekly|daily|monthly|5[\s-]?hour|7[\s-]?day)[\s-]?limit(?:\s+(?:reached|hit))?|(?:you(?:'ve| have)\s+)?hit your (?:(?:weekly|daily|monthly|session|usage|5[\s-]?hour|7[\s-]?day)\s+)?limit|out of credits|plan (?:limit|allowance)/i.test(r),
     },
     {
         condition: "rate_limited",
@@ -86,7 +133,7 @@ const CLASSIFIERS = [
  * recovery metadata. Unmatched failures are `"unknown"` — deliberately left for
  * a human rather than blindly retried.
  */
-export function classifyFailure(error) {
+export function classifyFailure(error, opts = {}) {
     const raw = rawText(error).slice(0, 2000);
     const condition = CLASSIFIERS.find((c) => c.test(raw))?.condition ?? "unknown";
     const out = { condition, raw };
@@ -95,7 +142,11 @@ export function classifyFailure(error) {
         const retryAfterMs = parseRetryAfterMs(raw);
         if (retryAfterMs !== undefined)
             out.retryAfterMs = retryAfterMs;
-        const resetsAt = parseResetsAt(raw);
+        // Reset time, most-authoritative first: a structured hint the caller
+        // supplied (the provider's own usage snapshot), then an ISO stamp in the
+        // text, then a bare wall-clock ("resets 12am (UTC)") resolved to its next
+        // occurrence.
+        const resetsAt = opts.resetsAtHint ?? parseResetsAt(raw) ?? parseResetClock(raw, opts.now ?? Date.now());
         if (resetsAt !== undefined)
             out.resetsAt = resetsAt;
     }

package/dist/policy/run-policy.js

@@ -34,7 +34,7 @@ export function createRunPolicy(deps = {}) {
     const now = deps.now ?? Date.now;
     return {
         decide(ctx) {
-            const classified = classifyFailure(ctx.error);
+            const classified = classifyFailure(ctx.error, { now: now(), resetsAtHint: ctx.resetsAtHint });
             const { condition } = classified;
             const rule = findRule(ruleset, condition, context);
             if (!rule)
@@ -73,6 +73,7 @@ export function createRunPolicy(deps = {}) {
                     delayMs,
                     condition,
                     summary: `${condition}: transient — retrying (attempt ${nextAttempt}/${rule.maxAttempts})${timing}.`,
+                    ...(resetDelayMs !== undefined && classified.resetsAt ? { resetsAt: classified.resetsAt } : {}),
                 };
             }
             // action === "reroute": walk the chain from the current cursor, skipping

package/dist/policy/session-reroute.js

@@ -21,6 +21,17 @@
 // whether to suppress the turn's error toast before kicking off the async swap +
 // retry (`applyReroute`). Reroute happens only at the turn boundary, so there is
 // no partial-work hazard.
+//
+// It also plans the OTHER in-place recovery a live session can do: waiting out a
+// provider usage/rate limit and re-sending the same prompt when the window
+// resets (`planResume`). Unlike a reroute (which the controller applies itself),
+// a resume can be hours away and must survive a daemon restart, so scheduling +
+// persistence live in the caller (src/server.ts) — the controller only decides
+// whether a resume is warranted and by when.
+/** Below this, a "retry" is ordinary backoff (seconds) — not worth deferring an
+ *  interactive turn for; let it surface. A real usage/rate window reset is
+ *  minutes-to-days out and always clears this bar. */
+const MIN_RESUME_DELAY_MS = 60_000;
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class SessionRerouteController {
     deps;
@@ -50,6 +61,47 @@ export class SessionRerouteController {
             attempt: this.attempt,
             rerouteCount: this.rerouteCount,
         });
+        if (decision.action !== "reroute")
+            return null;
+        return this.rerouteFrom(decision, currentModel);
+    }
+    /**
+     * Decide whether this turn error should be recovered by WAITING for a provider
+     * usage/rate limit to reset and re-sending the same prompt. Returns a plan the
+     * caller should persist + schedule, or null (surface the error as usual).
+     *
+     * `resetsAtHint` is the authoritative reset time when the caller has one (the
+     * provider's structured usage snapshot) — essential for a multi-day "weekly"
+     * window, whose error text only states a time-of-day. `now` is injectable for
+     * deterministic tests. Pure w.r.t. the controller's counters.
+     */
+    planResume(rawError, currentModel, opts = {}) {
+        if (this.applying)
+            return null;
+        const now = opts.now ?? Date.now();
+        const decision = this.deps.policy.decide({
+            routing: { model: currentModel },
+            error: rawError,
+            attempt: this.attempt,
+            rerouteCount: this.rerouteCount,
+            resetsAtHint: opts.resetsAtHint,
+        });
+        if (decision.action !== "retry")
+            return null;
+        // Only defer for a concrete recovery window — a provider reset, or a delay
+        // long enough that it's clearly a limit rather than routine backoff.
+        if (decision.resetsAt === undefined && decision.delayMs < MIN_RESUME_DELAY_MS)
+            return null;
+        const resumeAt = decision.resetsAt ?? new Date(now + decision.delayMs).toISOString();
+        return { condition: decision.condition, summary: decision.summary, delayMs: Math.max(0, decision.delayMs), resumeAt };
+    }
+    /** Advance the attempt budget once the caller has committed to a resume, so a
+     *  limit that re-fires after the reset counts toward `maxAttempts` and can
+     *  eventually exhaust (→ park) instead of looping forever. */
+    noteResumeApplied() {
+        this.attempt += 1;
+    }
+    rerouteFrom(decision, currentModel) {
         if (decision.action !== "reroute")
             return null;
         const model = decision.routing.model;

package/dist/server.js

@@ -501,11 +501,11 @@ const terminals = new TerminalManager();
 // and fixed for that session's life; switching agents in the UI starts a new one.
 let defaultRuntimeId = (process.env.BIVY_RUNTIME ?? "pi").toLowerCase();
 const runtimeHost = new RuntimeHost({ credsDir, piDir, sessionsDir, attachToChat: attachToChatForSession });
-// In-session model reroute (docs/rulesets.md). Opt-in: set
-// BIVY_SESSION_MODEL_FALLBACK to a comma-separated model list and a session that
-// hits an exhausted-credits / rate-limit turn error swaps down the list (via the
-// runtime's live setModel) and retries, instead of surfacing the error. Absent =
-// inert, session behavior unchanged.
+// A built-in in-session model-fallback ruleset from BIVY_SESSION_MODEL_FALLBACK
+// (docs/rulesets.md). Opt-in: set it to a comma-separated model list and a
+// session that hits an exhausted-credits / rate-limit turn error swaps down the
+// list (via the runtime's live setModel) and retries. Used only when the user
+// hasn't authored their own session-scoped ruleset in the UI.
 function sessionModelFallbackRuleset() {
     const models = (process.env.BIVY_SESSION_MODEL_FALLBACK ?? "")
         .split(",")
@@ -529,9 +529,21 @@ function sessionModelFallbackRuleset() {
         ],
     };
 }
-const sessionRuleset = sessionModelFallbackRuleset();
-const sessionRunPolicy = sessionRuleset ? createRunPolicy({ ruleset: sessionRuleset, context: "session" }) : undefined;
-if (sessionRunPolicy) {
+/** The ruleset in-session recovery runs under right now: the user's active
+ *  ruleset if it applies to sessions, else the env model-fallback ruleset, else
+ *  undefined (→ built-in DEFAULT_RULESET). Read lazily on each turn error so UI
+ *  edits take effect without a restart, mirroring activeQueueRuleset. */
+function activeSessionRuleset() {
+    return activeRulesetFor(rulesetsDir, "session") ?? sessionModelFallbackRuleset();
+}
+// The in-session recovery effector's policy. Always available: an interactive
+// session can wait out a provider usage/rate limit and resume when it resets
+// (planResume), or swap models down a fallback chain (planReroute). Thin wrapper
+// so a freshly-saved active ruleset is picked up on the next turn error.
+const sessionRunPolicy = {
+    decide: (ctx) => createRunPolicy({ context: "session", ruleset: activeSessionRuleset() }).decide(ctx),
+};
+if (process.env.BIVY_SESSION_MODEL_FALLBACK) {
     console.log(`[policy] in-session model reroute enabled: ${process.env.BIVY_SESSION_MODEL_FALLBACK}`);
 }
 let lastUpdateCheckAt = 0;
@@ -3542,6 +3554,9 @@ const RELAY_COMMANDS = {
             record.lastPrompt = agentPrompt;
             record.lastPromptOptions = promptOptionsFor(record, msg.streamingBehavior, images);
             record.reroute?.beginTurn();
+            // The user is driving this turn manually — supersede any pending auto-resume
+            // that was scheduled after a prior limit so it can't re-fire on top of them.
+            clearSessionResume(record.id);
             await promptWithWatchdog(record, agentPrompt, record.lastPromptOptions);
         }).catch((error) => {
             // Mirror the HTTP path (see the /prompt route): a rejected turn after
@@ -6862,6 +6877,20 @@ const idleCloseTimer = setInterval(() => { closeIdleSessions(); pruneGhostSessio
 idleCloseTimer.unref?.();
 const worktreeCleanupTimer = setInterval(() => void sweepDiskGuardrails(), worktreeCleanupSweepMs);
 worktreeCleanupTimer.unref?.();
+// In-session auto-resume tunables (see the resume helpers below). setTimeout
+// can't be trusted past ~24.8 days and we don't want one timer owning a
+// multi-hour wait a restart would drop, so each timer is capped and the periodic
+// sweep re-arms the remainder from the persisted resumeAt.
+const SESSION_RESUME_MAX_TIMER_MS = 30 * 60_000;
+const SESSION_RESUME_SWEEP_MS = 60_000;
+/** Slack around "due": a capped timer may fire a touch early — drive only when
+ *  within this of the target, else re-arm. */
+const SESSION_RESUME_TICK_MS = 15_000;
+const sessionResumeTimers = new Map();
+// Fire due auto-resumes (a usage/rate limit that has since reset) and re-arm the
+// tail of long waits whose in-process timer was capped or lost to a restart.
+const sessionResumeTimer = setInterval(() => sessionResumeSweep(), SESSION_RESUME_SWEEP_MS);
+sessionResumeTimer.unref?.();
 // --- server-side ephemeral teardown ----------------------------------------
 // On a disposable machine (bootstrap set BIVY_EPHEMERAL=1) the daemon ends the
 // machine ITSELF once it goes idle, so teardown no longer needs the launching
@@ -7111,6 +7140,125 @@ async function refreshSessionUsage(record) {
         // Usage reporting must never affect the session it's reporting on.
     }
 }
+// ── In-session auto-resume after a usage/rate limit ─────────────────────────
+// When a turn ends because a provider window is exhausted ("you've hit your
+// weekly limit · resets 12am (UTC)") and the session's ruleset says retry, we
+// wait out the window and re-send the same prompt when it resets — instead of
+// leaving a dead error bubble. Durable: the due time is persisted (metadata
+// resumeAt) so a daemon restart re-arms it (sessionResumeSweep); an in-process
+// timer fires it promptly while the daemon is up. (Tunables + timer map are
+// declared up by the timer cluster so the sweep interval can reference them.)
+/** The authoritative reset time for the limit a session just hit: the soonest
+ *  future reset among its most-utilized usage windows (the binding one), from
+ *  the last snapshot the runtime reported. Essential for a multi-day "weekly"
+ *  window, whose error text states only a time-of-day. Undefined when unknown. */
+function limitResetHint(record, nowMs) {
+    const windows = record.usage?.plan?.windows ?? [];
+    let best;
+    for (const w of windows) {
+        if (!w.resetsAt)
+            continue;
+        const at = Date.parse(w.resetsAt);
+        if (!Number.isFinite(at) || at <= nowMs)
+            continue;
+        const util = w.utilizationPct ?? 0;
+        // Prefer the most-utilized window (the one being hit); tie-break on soonest reset.
+        if (!best || util > best.util || (util === best.util && at < best.at))
+            best = { at, util };
+    }
+    return best ? new Date(best.at).toISOString() : undefined;
+}
+/** Cancel a pending in-process resume timer (leaves the durable marker alone). */
+function cancelSessionResumeTimer(id) {
+    const timer = sessionResumeTimers.get(id);
+    if (timer) {
+        clearTimeout(timer);
+        sessionResumeTimers.delete(id);
+    }
+}
+/** Clear both the durable resume marker and any armed timer — the session moved
+ *  on (a new user turn, or the resume itself started). */
+function clearSessionResume(id) {
+    cancelSessionResumeTimer(id);
+    metadata.setResumeAt(id, null);
+}
+function armSessionResumeTimer(id, dueMs) {
+    cancelSessionResumeTimer(id);
+    const delay = Math.min(Math.max(0, dueMs - Date.now()), SESSION_RESUME_MAX_TIMER_MS);
+    const timer = setTimeout(() => {
+        sessionResumeTimers.delete(id);
+        void driveSessionResume(id);
+    }, delay);
+    timer.unref?.();
+    sessionResumeTimers.set(id, timer);
+}
+/** Persist + arm an auto-resume decided by the session policy. Synchronous so
+ *  the caller can atomically suppress the turn's error toast. */
+function scheduleSessionResume(record, plan) {
+    metadata.setResumeAt(record.id, plan.resumeAt);
+    const when = Date.parse(plan.resumeAt);
+    const cond = plan.condition.replace(/_/g, " ");
+    broadcast({
+        type: "session.notice",
+        sessionId: record.id,
+        level: "info",
+        message: `Hit a ${cond} limit — I'll resume this automatically when it resets (${plan.resumeAt}).`,
+    });
+    armSessionResumeTimer(record.id, Number.isFinite(when) ? when : Date.now());
+}
+/** Fire a due auto-resume: re-open the session if needed and re-send the turn's
+ *  last prompt. Clears the durable marker BEFORE driving so a crash mid-resume
+ *  can't loop. Best-effort — never throws into a timer/sweep. */
+async function driveSessionResume(id) {
+    const meta = metadata.getSession(id);
+    if (!meta?.resumeAt)
+        return; // cancelled or already resumed
+    const due = Date.parse(meta.resumeAt);
+    if (Number.isFinite(due) && due - Date.now() > SESSION_RESUME_TICK_MS) {
+        // A capped timer fired before the real due time — re-arm for the remainder.
+        armSessionResumeTimer(id, due);
+        return;
+    }
+    clearSessionResume(id);
+    try {
+        const live = openSessions.get(id);
+        if (live?.isWorking)
+            return; // a user turn is already running — don't pile on
+        const record = live ?? (await resolveOrResumeSession(id, meta.path));
+        if (!record)
+            return; // transcript gone / unresolvable
+        if (record.isWorking)
+            return;
+        // In-memory lastPrompt is the exact user turn to retry; after a restart it's
+        // gone, so fall back to the generic interrupted-turn continuation nudge.
+        const prompt = record.lastPrompt ?? buildInteractiveResumePrompt();
+        console.log(`[resume] auto-resuming session ${id} — provider limit has reset`);
+        broadcast({ type: "session.notice", sessionId: id, level: "info", message: "The limit has reset — resuming now." });
+        await promptWithWatchdog(record, prompt, record.lastPromptOptions);
+    }
+    catch (error) {
+        console.warn(`[resume] auto-resume after a provider limit failed for ${id}`, error);
+    }
+}
+/** Re-arm (or immediately fire) durable auto-resume markers. Runs once at boot
+ *  and on an interval, so a wait survives a restart and a capped timer's tail
+ *  still fires. */
+function sessionResumeSweep() {
+    const now = Date.now();
+    for (const meta of metadata.sessionsWithResumeAt()) {
+        const due = Date.parse(meta.resumeAt);
+        if (!Number.isFinite(due)) {
+            metadata.setResumeAt(meta.id, null);
+            continue;
+        }
+        if (sessionResumeTimers.has(meta.id))
+            continue; // already armed this run
+        if (due <= now + SESSION_RESUME_TICK_MS)
+            void driveSessionResume(meta.id);
+        else
+            armSessionResumeTimer(meta.id, due);
+    }
+}
 /**
  * Turn a raw provider/runtime error string into something a human can read.
  * Model APIs commonly return `<status> {json}` (e.g. `400 {"error":{"message":
@@ -7184,9 +7332,12 @@ function maybeSignalAuthRequired(record, errorText) {
 }
 function attachSessionListeners(record) {
     record.unsubscribe?.();
-    // In-session model reroute controller (inert unless BIVY_SESSION_MODEL_FALLBACK
-    // is set). One per session; its per-turn budget resets on each user prompt.
-    if (sessionRunPolicy && !record.reroute) {
+    // In-session recovery controller — waits out a usage/rate limit and resumes
+    // (planResume), or swaps models down a fallback chain (planReroute). One per
+    // session; its per-turn budget resets on each user prompt. The policy reads
+    // the active session ruleset lazily, so it's inert until one authorizes a
+    // retry/reroute for the failing condition.
+    if (!record.reroute) {
         record.reroute = new SessionRerouteController({
             policy: sessionRunPolicy,
             onNotice: (n) => broadcast({ type: "session.notice", sessionId: record.id, level: n.level, message: n.message }),
@@ -7306,7 +7457,18 @@ function attachSessionListeners(record) {
             // credential or a 4xx from the API) otherwise vanished: working cleared,
             // no reply, no signal. Surface it as a session-scoped error so the client
             // can show it *inline in that chat*, and notify instead of "done".
-            const turnError = terminalTurnError(event);
+            // A terminal turn error reaches us two ways. pi-ai puts it on the last
+            // assistant message (stopReason:"error" → terminalTurnError), and the
+            // server owns surfacing it. Claude Code instead throws inside the SDK
+            // query: it emits its OWN session.error to the client AND carries the raw
+            // text on agent_end.error (e.g. "you've hit your weekly limit · resets 12am
+            // (UTC)"). We read that too — but only to DRIVE recovery, since the runtime
+            // already surfaced it; re-broadcasting would double the error bubble.
+            const messageError = terminalTurnError(event);
+            const agentEndError = typeof event.error === "string"
+                ? humanizeAgentError(event.error)
+                : undefined;
+            const turnError = messageError ?? (agentEndError?.trim() ? agentEndError : undefined);
             // Before surfacing a turn error, see if the session's run policy can recover
             // it in place by swapping to a fallback model and retrying the same prompt.
             // planReroute is synchronous, so we can atomically suppress the error toast
@@ -7314,6 +7476,14 @@ function attachSessionListeners(record) {
             const reroutePlan = turnError && record.lastPrompt !== undefined
                 ? record.reroute?.planReroute(turnError, record.session.getCurrentModel()?.name) ?? null
                 : null;
+            // If a reroute doesn't apply, a usage/rate limit that gave a reset time can
+            // instead be waited out and resumed when the window clears (planResume is
+            // synchronous too, so this stays atomic with suppressing the error toast).
+            const resumePlan = !reroutePlan && turnError && record.lastPrompt !== undefined
+                ? record.reroute?.planResume(turnError, record.session.getCurrentModel()?.name, {
+                    resetsAtHint: limitResetHint(record, Date.now()),
+                }) ?? null
+                : null;
             if (reroutePlan) {
                 void record.reroute.applyReroute(reroutePlan, {
                     getCurrentModelName: () => record.session.getCurrentModel()?.name,
@@ -7323,14 +7493,23 @@ function attachSessionListeners(record) {
                     },
                 });
             }
-            else if (turnError) {
+            else if (resumePlan) {
+                // Charge the attempt budget so a limit that re-fires after the reset can
+                // eventually exhaust (→ surface) instead of looping, then park the turn
+                // as a scheduled resume rather than a dead error.
+                record.reroute.noteResumeApplied();
+                scheduleSessionResume(record, resumePlan);
+            }
+            else if (messageError) {
+                // Only the server-owned (pi-ai) path surfaces here; a Claude Code error
+                // the runtime already broadcast falls through to avoid a duplicate bubble.
                 record.lastFailureAt = Date.now();
                 metadata.touchSession(record.id, "failed");
                 scheduleAdvertise();
-                broadcast({ type: "session.error", sessionId: record.id, error: turnError });
+                broadcast({ type: "session.error", sessionId: record.id, error: messageError });
                 // If the terminal error is an auth failure (expired key/token → 4xx),
                 // also raise the sign-in sheet for the failing provider.
-                maybeSignalAuthRequired(record, turnError);
+                maybeSignalAuthRequired(record, messageError);
                 void sendNotificationHint({
                     kind: "session_error",
                     sessionId: record.id,
@@ -10655,6 +10834,14 @@ const server = app.listen(port, host, async () => {
     // Recover interactive sessions a restart interrupted mid-turn (auto-continue, or
     // flag for a one-tap manual Resume) per the node's sessionResumeMode setting.
     void reconcileInterruptedSessions().catch((error) => console.warn("[resume] interrupted-session reconciliation failed", error));
+    // Re-arm (or fire) durable auto-resume markers a limit-hit turn left behind,
+    // so a session waiting out a usage/rate window still resumes after a restart.
+    try {
+        sessionResumeSweep();
+    }
+    catch (error) {
+        console.warn("[resume] auto-resume sweep failed at boot", error);
+    }
     // Universal Agent Harness — network effect boundary (opt-in via
     // BIVY_EGRESS_PROXY). Governs/logs outbound traffic of CLI agents, which
     // inherit the proxy env from process.ts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.7.0-staging.97",
+  "version": "0.7.0-staging.99",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",