Let a session resume itself when its usage limit lifts

Off by default and per session: it spends quota the moment quota exists,
with nobody watching, which is not a thing a default may decide. Switched
on from the session settings dialog, with the message it sends editable
("continue" unless something else is typed).

Running out of quota becomes a state rather than an error. The Claude
driver recognises its dialect's sentence -- `Claude AI usage limit
reached|1788546972` -- and reports `LimitReached` with the reset time it
gave; nothing above a driver matches on a string. The transcript draws it
as a divider, like a clear or a compaction.

The schedule is a plan to *ask*, never a plan to send. Both reset times
available are untrustworthy in the direction that matters -- the dialect's
is written when the turn fails, the endpoint's moves when the window does
-- so the wait ends in a question to the usage meter, and only `ok` with
no window at 100% sends anything. A window still spent reschedules to its
own reset time, which is what makes a limit that lifts late wait longer
and one that lifts early resume sooner. A meter that cannot be asked is a
longer wait too, never a send. A day after the limit was hit the wait
gives up and says so in the transcript, so a machine that can never be
asked is not retried for ever.

The schedule is persisted on the session: a five-hour window outlasts a
backend restart, and a wait forgotten across one never comes back.

Driven end to end with echo, never a real account: `/limit [minutes]`
reports the same event a real driver does and `/usage` sets what the meter
answers, deliberately separate so the two can disagree. The wait moved
from the dialect's two minutes to the meter's seven when the meter changed
its mind, and the message went out on the first check after the meter came
back under the limit.

Also makes the settings dialog scrollable, which these two controls made
necessary: at a 1.5x system font it clipped the last of them with nothing
on screen to say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/androidApp/src/main/kotlin/com/example/aiapp/Api.kt

@@ -167,6 +167,24 @@ data class SessionSummary(
      * itself from a default is one you can turn off while believing you are reading it.
      */
     val notify: Boolean,
+    /**
+     * Whether this session sends itself a message once its account's usage limit lifts, and what
+     * that message says.
+     *
+     * The message is what the server would actually send, with its own default already filled in,
+     * so the field shows the words rather than an empty box standing for them.
+     */
+    val autoResume: Boolean,
+    val autoResumeMessage: String,
+    /**
+     * When the server next intends to check whether the limit has lifted, in epoch seconds, or null
+     * when nothing is waiting.
+     *
+     * A time to *ask*, not a time to resume: the server checks the meter at that moment and waits
+     * again if the limit is still on. Worded that way wherever it is shown, because a promise this
+     * app cannot keep is worse than no time at all.
+     */
+    val resumeAt: Double?,
     /**
      * The directory the session works in, or null where it was never given one.
      *
@@ -221,6 +239,12 @@ private fun parseSession(session: JSONObject) =
         takesEffort = session.optBoolean("takesEffort", false),
         imported = session.optBoolean("imported", false),
         notify = session.optBoolean("notify", true),
+        autoResume = session.optBoolean("autoResume", false),
+        // The server sends its own default rather than nothing, so an empty answer means an older
+        // server -- and this app's word for it is the same word.
+        autoResumeMessage =
+            session.optString("autoResumeMessage").ifEmpty { DEFAULT_RESUME_MESSAGE },
+        resumeAt = if (session.has("resumeAt")) session.getDouble("resumeAt") else null,
         cwd = session.optString("cwd").ifEmpty { null },
         contextTokens =
             if (session.has("contextTokens")) session.getLong("contextTokens") else null,
@@ -1072,6 +1096,36 @@ fun setSessionPermissionMode(settings: ServerSettings, sessionId: String, mode:
 }
 
 /** Turns this session's notifications on or off. Stored on the backend -- see `SessionConfig`. */
+/**
+ * What an auto-resume says when nothing else was typed. Mirrors the server's own default, so a
+ * cleared field shows the word that would actually be sent instead of going blank.
+ */
+const val DEFAULT_RESUME_MESSAGE = "continue"
+
+/**
+ * Turns auto-resume on or off and sets what it would say, in one request because they are one
+ * decision -- see the server's `/sessions/{id}/auto-resume`.
+ */
+fun setSessionAutoResume(
+    settings: ServerSettings,
+    sessionId: String,
+    autoResume: Boolean,
+    message: String?,
+) {
+    requestFromServer(
+        settings,
+        "/sessions/$sessionId/auto-resume",
+        method = "POST",
+        jsonBody =
+            JSONObject()
+                .put("autoResume", autoResume)
+                // Empty means the server's default rather than a session poked with nothing to
+                // read, which is the same rule the server applies to the field.
+                .put("message", message?.trim()?.ifEmpty { null } ?: JSONObject.NULL)
+                .toString(),
+    ) {}
+}
+
 fun setSessionNotify(settings: ServerSettings, sessionId: String, notify: Boolean) {
     requestFromServer(
         settings,

app/androidApp/src/main/kotlin/com/example/aiapp/Dividers.kt

@@ -12,6 +12,10 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
 
 /**
  * A line across the transcript saying what left the session's context.
@@ -47,3 +51,40 @@ fun TranscriptDivider(text: String, color: Color, modifier: Modifier = Modifier)
 fun ClearedRow(modifier: Modifier = Modifier) {
     TranscriptDivider("Context cleared", clearedColor, modifier)
 }
+
+/**
+ * The mark running out of quota leaves.
+ *
+ * The same red the usage bar takes when a window is spent, because it is the same fact in a second
+ * place: colour by consequence, so "there is nothing left to spend" is learned once.
+ *
+ * A time rather than a countdown. The row is folded once and never re-measured, so a span would go
+ * stale on screen the moment it was drawn; and this is when the *account* said it would reset,
+ * which is not a promise about when the session picks back up. A limit the session was told no
+ * reset time for says nothing about one -- that state has its own words rather than a plausible
+ * number.
+ */
+@Composable
+fun LimitRow(item: TranscriptItem.LimitNote, modifier: Modifier = Modifier) {
+    TranscriptDivider(limitSummary(item.resetsAt, ZoneId.systemDefault()), overLimitColor, modifier)
+}
+
+/**
+ * What the row says. Split out so the wording is testable without a screen, since the two states it
+ * has to keep apart -- a reset time that arrived and one that never did -- are exactly the pair
+ * that reads the same when it goes wrong.
+ *
+ * [zone] is a parameter rather than read here so a test says the same thing wherever it runs.
+ */
+fun limitSummary(resetsAt: Double?, zone: ZoneId): String {
+    val at = resetsAt?.let {
+        try {
+            DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+                .withZone(zone)
+                .format(Instant.ofEpochSecond(it.toLong()))
+        } catch (_: Exception) {
+            null
+        }
+    }
+    return if (at == null) "Usage limit reached" else "Usage limit reached • resets $at"
+}

app/androidApp/src/main/kotlin/com/example/aiapp/Events.kt

@@ -157,6 +157,18 @@ sealed class SessionEvent {
      */
     data object Cleared : SessionEvent()
 
+    /**
+     * The session stopped because its account's usage limit was reached.
+     *
+     * Its own event rather than an [Error] carrying the CLI's sentence, because it is a state
+     * rather than something that went wrong -- and because the raw sentence is `Claude AI usage
+     * limit reached|1788546972`, which is not readable by the person it is shown to.
+     *
+     * [resetsAt] is epoch seconds and null where the session was told nothing. Only the server acts
+     * on it; what this draws it as is a time, not a countdown, because nothing here re-measures it.
+     */
+    data class LimitReached(val resetsAt: Double?) : SessionEvent()
+
     data class Error(val message: String) : SessionEvent()
 
     /**
@@ -261,6 +273,10 @@ fun parseSeqEvent(json: String): SeqEvent {
                     trigger = body.optString("trigger").ifEmpty { null },
                 )
             "cleared" -> SessionEvent.Cleared
+            "limitReached" ->
+                SessionEvent.LimitReached(
+                    if (body.has("resetsAt")) body.getDouble("resetsAt") else null
+                )
             "error" -> SessionEvent.Error(body.getString("message"))
             else -> SessionEvent.Unknown(type)
         }

app/androidApp/src/main/kotlin/com/example/aiapp/SessionScreen.kt

@@ -1545,6 +1545,7 @@ fun SessionScreen(
                                                 is TranscriptItem.ClearedNote -> ClearedRow()
                                                 is TranscriptItem.CompactedNote ->
                                                     CompactedRow(item)
+                                                is TranscriptItem.LimitNote -> LimitRow(item)
                                                 // Never reached: a peer message is flattened into
                                                 // its own units. Here because a `when` over the
                                                 // item kinds has to stay exhaustive.

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsDialog.kt

@@ -6,8 +6,10 @@ import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
@@ -26,6 +28,10 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.unit.dp
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -89,6 +95,16 @@ fun SessionSettingsDialog(
     // and a spinner sits beside it, which is what not knowing looks like.
     var notify by remember(sessionId) { mutableStateOf<Boolean?>(null) }
     var notifyError by remember { mutableStateOf<String?>(null) }
+    // The same three-state shape the notification switch has, for the same reason: until the
+    // server has answered, the switch is disabled rather than showing a position nothing confirmed.
+    var autoResume by remember(sessionId) { mutableStateOf<Boolean?>(null) }
+    var resumeMessage by remember(sessionId) { mutableStateOf(DEFAULT_RESUME_MESSAGE) }
+    // When the server next intends to ask whether the limit has lifted, or null when nothing is
+    // waiting. Read once with everything else: it moves on the server's schedule, not this
+    // screen's, and a figure that redrew itself here would be this app re-measuring what it was
+    // told.
+    var resumeAt by remember(sessionId) { mutableStateOf<Double?>(null) }
+    var resumeError by remember { mutableStateOf<String?>(null) }
     // Where the session works. Null until the server has been asked, for the same reason the switch
     // above is. An empty answer is a session that was never given a directory, which is not the
     // same as one whose directory is unknown -- the field is only enabled once one of those is
@@ -102,6 +118,9 @@ fun SessionSettingsDialog(
         try {
             val fresh = withContext(Dispatchers.IO) { fetchSession(settings, sessionId) }
             notify = fresh.notify
+            autoResume = fresh.autoResume
+            resumeMessage = fresh.autoResumeMessage
+            resumeAt = fresh.resumeAt
             cwd = fresh.cwd.orEmpty()
             typedCwd = fresh.cwd.orEmpty()
         } catch (e: ApiException) {
@@ -109,6 +128,8 @@ fun SessionSettingsDialog(
             // instead of offering a position nothing confirmed.
             notifyError = e.message
             notify = null
+            resumeError = e.message
+            autoResume = null
         }
     }
 
@@ -174,6 +195,39 @@ fun SessionSettingsDialog(
         }
     }
 
+    /**
+     * Turns auto-resume on or off, or changes what it would say.
+     *
+     * One request for both, because the server takes one: switching it on and typing the message
+     * are two halves of the same decision, and sending them separately would leave a moment where
+     * the session is armed with the old words.
+     *
+     * Put back if refused, like the notification switch. Turning it off also clears what was
+     * scheduled -- said here rather than only on the server, or the row would go on naming a time
+     * that no longer exists.
+     */
+    fun setAutoResume(on: Boolean, message: String) {
+        val wasOn = autoResume
+        val wasMessage = resumeMessage
+        val wasAt = resumeAt
+        autoResume = on
+        resumeMessage = message
+        if (!on) resumeAt = null
+        resumeError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) {
+                    setSessionAutoResume(settings, sessionId, on, message)
+                }
+            } catch (e: ApiException) {
+                autoResume = wasOn
+                resumeMessage = wasMessage
+                resumeAt = wasAt
+                resumeError = e.message
+            }
+        }
+    }
+
     // Nothing to do when the name has not changed, so the button says so rather than sending a
     // request whose success would look exactly like the failure of having typed nothing.
     val changed = name.trim().isNotEmpty() && name.trim() != title
@@ -200,7 +254,10 @@ fun SessionSettingsDialog(
         onDismissRequest = onDismiss,
         title = { Text("Session settings") },
         text = {
-            Column {
+            // Scrollable, because this dialog grew past a screenful: a Material dialog constrains
+            // its own height and clips what does not fit, so the last control on the list is one
+            // large system font away from being unreachable with nothing on screen to say so.
+            Column(Modifier.verticalScroll(rememberScrollState())) {
                 OutlinedTextField(
                     value = name,
                     onValueChange = { name = it },
@@ -244,6 +301,70 @@ fun SessionSettingsDialog(
                     )
                 }
                 Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text("Resume after a usage limit", modifier = Modifier.weight(1f))
+                    if (autoResume == null && resumeError == null) {
+                        CircularProgressIndicator(
+                            modifier = Modifier.width(16.dp).height(16.dp),
+                            strokeWidth = 2.dp,
+                        )
+                        Spacer(Modifier.width(8.dp))
+                    }
+                    Switch(
+                        checked = autoResume == true,
+                        onCheckedChange = { setAutoResume(it, resumeMessage) },
+                        enabled = autoResume != null,
+                    )
+                }
+                // Disabled rather than hidden while the switch is off: a field that comes and goes
+                // makes its own presence the signal, and a visible one teaches what the switch will
+                // do. Committed on the keyboard's Done rather than on every keystroke, so typing a
+                // sentence is one request instead of one per letter.
+                OutlinedTextField(
+                    value = resumeMessage,
+                    onValueChange = { resumeMessage = it },
+                    label = { Text("Message to send") },
+                    // What an empty field means, in the field: the server's own word rather than a
+                    // session poked with nothing to read.
+                    placeholder = { Text(DEFAULT_RESUME_MESSAGE) },
+                    singleLine = true,
+                    enabled = autoResume == true,
+                    modifier = Modifier.fillMaxWidth(),
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                    keyboardActions =
+                        KeyboardActions(onDone = { setAutoResume(true, resumeMessage) }),
+                )
+                // What it does and what it costs, in the order it happens. The last sentence is the
+                // one that matters: the time below is when the server will *ask*, not a promise
+                // about when the session speaks.
+                Text(
+                    "When this session stops because the account is out of quota, the server " +
+                        "checks the limit and sends this message once it has lifted. It checks " +
+                        "again if the limit is still on.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                // Only where something is actually waiting. Absent is not a state worth a row: a
+                // session that has not hit a limit has nothing scheduled, which the reader can see
+                // from the switch.
+                resumeAt?.let { at ->
+                    Text(
+                        "Waiting now -- next check ${formatCheckTime(at)}.",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                resumeError?.let {
+                    Text(
+                        it,
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                Spacer(Modifier.height(8.dp))
                 Row(
                     verticalAlignment = Alignment.CenterVertically,
                     modifier = Modifier.fillMaxWidth(),
@@ -399,3 +520,21 @@ fun SessionSettingsDialog(
         dismissButton = { TextButton(onClick = onDismiss) { Text("Close") } },
     )
 }
+
+/**
+ * When the server will next look, as a local time.
+ *
+ * A time rather than a countdown, for the reason the transcript's own limit row gives: this screen
+ * reads the figure once, and a span drawn from a value nothing refreshes goes stale while somebody
+ * is looking at it.
+ */
+private fun formatCheckTime(epochSeconds: Double): String =
+    try {
+        DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+            .withZone(ZoneId.systemDefault())
+            .format(Instant.ofEpochSecond(epochSeconds.toLong()))
+    } catch (_: Exception) {
+        // A time that cannot be read is not a time to show: the sentence above still says a check
+        // is coming, which is the part the reader can act on.
+        "soon"
+    }

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptItems.kt

@@ -175,6 +175,18 @@ sealed class TranscriptItem {
         val preTokens: Long?,
         val postTokens: Long?,
     ) : TranscriptItem()
+
+    /**
+     * The account ran out of quota, so the turn stopped here.
+     *
+     * A divider rather than an error: nothing failed, and what a reader scrolling back needs from
+     * it is the same thing a clear or a compaction gives them -- why the conversation stops at this
+     * line.
+     *
+     * [resetsAt] is epoch seconds and null where the session was told nothing, which is a state the
+     * row has words for rather than a time it invents.
+     */
+    data class LimitNote(override val seq: Long, val resetsAt: Double?) : TranscriptItem()
 }
 
 /**
@@ -458,6 +470,7 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
             } else {
                 items + TranscriptItem.ImageItem(entry.seq, event.ref)
             }
+        is SessionEvent.LimitReached -> items + TranscriptItem.LimitNote(entry.seq, event.resetsAt)
         is SessionEvent.Cleared -> items + TranscriptItem.ClearedNote(entry.seq)
         is SessionEvent.Compacted ->
             items + TranscriptItem.CompactedNote(entry.seq, event.preTokens, event.postTokens)