@bridge4dev/runner 0.11.0 → 0.22.1

package/dist/adapters/types.d.ts

@@ -31,6 +31,16 @@ export interface ModelOption {
     label: string;
     description?: string;
     isDefault?: boolean;
+    /**
+     * The wire model this row's `id` resolves to — `sonnet` → `claude-sonnet-5`
+     * (ticket #111).
+     *
+     * The catalogue is written in ALIASES, but the agent reports the RESOLVED id
+     * once a turn starts. Matching the two is the only way the dashboard can tell
+     * which row is selected, and a row it cannot find is a row whose effort levels
+     * it cannot offer — which is exactly how the effort control disappeared.
+     */
+    resolvedModel?: string;
     /** Empty/absent when the model has no reasoning-effort dial. */
     efforts?: EffortOption[];
     /** The level the agent uses when none is chosen. */
@@ -51,6 +61,46 @@ export interface McpServerStatusInfo {
     name: string;
     status: string;
 }
+/**
+ * One unit of work the agent is running beside the conversation (ticket #113):
+ * a subagent, a background shell command, a dynamic workflow.
+ *
+ * The dashboard used to know only the session's own status — «Waiting for you»
+ * — while the agent had twenty subagents in flight and a deploy running in the
+ * background. None of that was anywhere on the page.
+ */
+export interface AgentTask {
+    id: string;
+    /**
+     * What kind of work this is, as the agent named it: `local_agent`,
+     * `local_bash`, `local_workflow`, … Kept as free text, not an enum — the set
+     * grows with every CLI release, and an unknown kind must degrade to a generic
+     * row rather than drop the task from the tray.
+     */
+    kind: string;
+    /** One line the user can read. Truncated by the adapter. */
+    title: string;
+    status: 'running' | 'done' | 'failed';
+    /** Epoch ms the runner first saw it, on the RUNNER's clock. */
+    startedAt: number;
+    /**
+     * How long it has been running, measured on the runner at publish time.
+     *
+     * The tray renders this rather than `now - startedAt`: the two are different
+     * machines' clocks, and subtracting across them put the dev server's skew
+     * straight into the number a human reads.
+     */
+    ageMs?: number;
+    /** `general-purpose`, `code-reviewer`, … for subagent tasks. */
+    subagentType?: string;
+    /** `meta.name` of a dynamic workflow, for workflow tasks. */
+    workflowName?: string;
+    tokens?: number;
+    toolUses?: number;
+    durationMs?: number;
+    /** Present only with `agentProgressSummaries`: «Analyzing the auth module». */
+    summary?: string;
+}
 /** Everything the dashboard needs to render agent controls, live from the agent. */
 export interface AgentCapabilities {
     models: ModelOption[];
@@ -75,7 +125,23 @@ export interface SessionSpec {
      * first message instead of starting a turn.
      */
     prompt?: string;
+    /**
+     * Extra system-prompt material composed by the supervisor (session 13):
+     * which branch this session is on, where its plan/log belongs, and the
+     * project's own `CLAUDE.md` / `AGENTS.md`.
+     *
+     * System prompt and not the first user message on purpose — a free session
+     * has no first message, and the rules have to hold on every turn, not just
+     * the one that started the session.
+     */
+    workspaceContext?: string;
     trustMode: TrustMode;
+    /**
+     * Session 15: the project's «let the agent commit on its own» switch. Rides
+     * with `trustMode` because it lands in the same `PolicyContext` and is asked
+     * the same question — may this Bash call go through.
+     */
+    agentAutoCommit?: boolean;
     mode?: AgentMode;
     model?: string;
     effort?: string;
@@ -83,6 +149,63 @@ export interface SessionSpec {
     mcp?: McpConfig;
     maxBudgetUsd?: number;
 }
+/**
+ * One question inside an agent's question call (session 12).
+ *
+ * Both agents can ask several at once — Claude's `AskUserQuestion` takes 1–4,
+ * a Codex elicitation carries a list — and until session 12 we kept only the
+ * first one and threw the rest away.
+ */
+export interface AgentQuestion {
+    /** Stable inside this ask: Claude `q0`…`q3`, Codex the elicitation's own id. */
+    id: string;
+    text: string;
+    /** Short chip label (Claude caps its own at 12 chars). */
+    header?: string;
+    multiSelect: boolean;
+    /**
+     * The user may write an answer of their own. Always true for Claude — its
+     * own tool description says the client is expected to provide "Other" — and
+     * for Codex when the elicitation marks the QUESTION `isOther` (that is where
+     * the live probe of 0.135.0 put the flag; an option-level one is accepted
+     * too, in case a later build moves it).
+     */
+    allowsCustom: boolean;
+    /**
+     * The answer is a secret (Codex marks an elicitation `isSecret`). The card
+     * masks the field and the runner keeps the value out of the feed — an event
+     * payload is stored for 90 days, which is no place for a token.
+     */
+    secret?: boolean;
+    options: Array<{
+        label: string;
+        description?: string;
+        preview?: string;
+    }>;
+}
+/** What the user picked (and/or typed) for one question. */
+export interface AgentQuestionAnswer {
+    questionId: string;
+    /** Chosen option labels; empty when the user only wrote their own answer. */
+    values: string[];
+    /** Free text the user typed instead of, or alongside, the options. */
+    custom?: string;
+    notes?: string;
+}
+/** Why a question was taken away from the user without them answering it. */
+export type QuestionInvalidationReason = 'session_stopped' | 'session_parked' | 'runner_restarted' | 'turn_aborted' | 'agent_cancelled' | 'budget_spent';
+/** The dashboard's answer to one open ask. */
+export interface QuestionReply {
+    askId: string;
+    /**
+     * `answer`  — the picked options / typed answer go back through the tool.
+     * `discuss` — the user chose to reply in words instead; the agent gets the
+     *             text as the tool result and keeps its turn.
+     */
+    action: 'answer' | 'discuss';
+    answers?: AgentQuestionAnswer[];
+    text?: string;
+}
 export type AgentEvent = {
     type: 'message';
     role: 'assistant' | 'user';
@@ -91,11 +214,35 @@ export type AgentEvent = {
     type: 'thinking';
     text: string;
 }
-/** The agent needs a decision from the user before it can continue. */
+/**
+ * The agent needs a decision from the user before it can continue. The tool
+ * call is PARKED until the answer arrives (session 12) — it is no longer
+ * denied, which used to read to the model like a pressed Escape and let it
+ * carry on answering for the user.
+ */
  | {
     type: 'question';
+    /** Issued by the adapter per ask; the answer is matched on it. */
+    askId: string;
+    questions: AgentQuestion[];
+    /**
+     * Mirror of the pre-session-12 shape, kept for one runner release so a
+     * dashboard or API that has not been redeployed yet still draws a card.
+     * Remove in 0.15.0 (recorded as debt in devreport #111).
+     */
     text: string;
     options?: string[];
+}
+/** An open question stopped being open — answered, discussed or withdrawn. */
+ | {
+    type: 'question_resolved';
+    askId: string;
+    outcome: 'answered' | 'discussed' | 'invalidated';
+    source: 'user' | 'runner';
+    reason?: QuestionInvalidationReason;
+    answers?: AgentQuestionAnswer[];
+    /** One short line for the card: «Postgres». */
+    summary?: string;
 } | {
     type: 'tool';
     phase: 'use' | 'result';
@@ -116,7 +263,12 @@ export type AgentEvent = {
     type: 'permission_resolved';
     requestId: string;
     allow: boolean;
-    source: 'user' | 'policy' | 'abort';
+    /**
+     * `runner` (session 12) is the honest answer for a card the runner took
+     * away — parked, stopped, restarted. Those used to be reported as a plain
+     * `deny`, so the feed said "denied" about a decision no human ever made.
+     */
+    source: 'user' | 'policy' | 'abort' | 'runner';
     reason?: string;
 } | {
     type: 'provider_session';
@@ -134,6 +286,20 @@ export type AgentEvent = {
     type: 'context_usage';
     usedTokens: number;
     maxTokens: number;
+}
+/**
+ * Everything running beside the conversation, right now (ticket #113).
+ *
+ * A LEVEL signal with REPLACE semantics, not a stream of start/stop edges:
+ * the agent publishes its whole live set on every membership change, so a
+ * dropped frame can never wedge a task in the tray forever. `done`/`total`
+ * count the current turn, which is what «14 of 20 done» means.
+ */
+ | {
+    type: 'agent_tasks';
+    tasks: AgentTask[];
+    done: number;
+    total: number;
 } | {
     type: 'notice';
     level: 'info' | 'warn';
@@ -163,6 +329,18 @@ export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
     events: AsyncIterable<AgentEvent>;
     answerPermission(requestId: string, allow: boolean, note?: string): void;
+    /**
+     * Answer (or discuss) an open question. Returns false when the ask is no
+     * longer open — a card from a previous life of the session, or one the user
+     * answered twice — so the caller can say so instead of failing silently.
+     */
+    answerQuestion(reply: QuestionReply): boolean;
+    /**
+     * Withdraw every open ask without killing the session — what «Stop the turn»
+     * needs. Codex's elicitation blocks its own rpc, so leaving it parked would
+     * make the NEXT message be consumed as the answer to a turn that is gone.
+     */
+    cancelQuestions(reason: QuestionInvalidationReason): void;
     /** Follow-up user input into the live session. */
     send(text: string): void;
     /** Switch model mid-session (VS-Code-extension parity). */
@@ -171,10 +349,28 @@ export interface AgentSession {
     setEffort(effort: string | null): Promise<void>;
     /** Switch interaction mode mid-session. */
     setMode(mode: AgentMode): Promise<void>;
+    /**
+     * Project-level policy changed while this session is running (session 15).
+     *
+     * `trustMode` and `agentAutoCommit` are read on EVERY tool call, so updating
+     * them here takes effect on the next one. Without this they were fixed at
+     * launch: a manager tightening trust to STRICT — or switching the agent's
+     * own commits off — changed a row in the database and nothing else, while
+     * the card next to the control reported the new value as a fact. The
+     * dangerous direction is the tightening one.
+     */
+    setWorkspacePolicy(policy: {
+        trustMode?: TrustMode;
+        agentAutoCommit?: boolean;
+    }): void;
     /** Interrupt the current turn (session stays resumable). */
     interrupt(): Promise<void>;
-    /** Tear the session down (kills the agent process). */
-    stop(): void;
+    /**
+     * Tear the session down (kills the agent process). The reason travels so
+     * anything the user was still being asked is withdrawn with a cause they can
+     * read, instead of quietly turning into a denial.
+     */
+    stop(reason?: QuestionInvalidationReason): void;
 }
 export interface AgentAdapter {
     readonly id: 'claude' | 'codex';

package/dist/attachments.d.ts

@@ -35,12 +35,19 @@ export interface SavedAttachment {
  */
 export declare function safeAttachmentName(id: string, fileName: string): string;
 /**
- * Keep `.devbridge/` out of git for this repository.
+ * Keep downloaded attachments out of git for this repository.
  *
  * Uses `info/exclude` rather than `.gitignore`: it is local-only, so we never
  * add a line to a file the user commits. `--git-common-dir` matters because a
  * linked worktree's `.git` is a file, and the shared exclude list is what both
  * the worktree and the main checkout consult.
+ *
+ * Session 14 narrowed the line from `/.devbridge/` to `/.devbridge/attachments/`,
+ * and migrates repositories that already carry the wide one. The wide version
+ * excluded `.devbridge/project.json` — the recipe file this release asks people
+ * to commit — so `git add` on it would have been refused without `-f` and
+ * `git add -A` would have skipped it silently. Only our own exact line is
+ * rewritten; anything else in the file is left alone.
  */
 export declare function ensureGitExclude(worktreePath: string): Promise<void>;
 /**

package/dist/attachments.js

@@ -37,13 +37,24 @@ export function safeAttachmentName(id, fileName) {
     const trimmed = base.slice(-80) || 'file';
     return `${id.slice(0, 8)}-${trimmed}`;
 }
+/** What session 10 wrote — the whole directory. Narrowed in session 14. */
+const LEGACY_EXCLUDE_LINE = '/.devbridge/';
+/** Only the attachments, so `.devbridge/project.json` stays a normal file. */
+const EXCLUDE_LINE = '/.devbridge/attachments/';
 /**
- * Keep `.devbridge/` out of git for this repository.
+ * Keep downloaded attachments out of git for this repository.
  *
  * Uses `info/exclude` rather than `.gitignore`: it is local-only, so we never
  * add a line to a file the user commits. `--git-common-dir` matters because a
  * linked worktree's `.git` is a file, and the shared exclude list is what both
  * the worktree and the main checkout consult.
+ *
+ * Session 14 narrowed the line from `/.devbridge/` to `/.devbridge/attachments/`,
+ * and migrates repositories that already carry the wide one. The wide version
+ * excluded `.devbridge/project.json` — the recipe file this release asks people
+ * to commit — so `git add` on it would have been refused without `-f` and
+ * `git add -A` would have skipped it silently. Only our own exact line is
+ * rewritten; anything else in the file is left alone.
  */
 export async function ensureGitExclude(worktreePath) {
     try {
@@ -54,7 +65,6 @@ export async function ensureGitExclude(worktreePath) {
         const commonDir = path.resolve(worktreePath, stdout.trim());
         const infoDir = path.join(commonDir, 'info');
         const excludeFile = path.join(infoDir, 'exclude');
-        const line = '/.devbridge/';
         let current = '';
         try {
             current = fs.readFileSync(excludeFile, 'utf8');
@@ -62,11 +72,19 @@ export async function ensureGitExclude(worktreePath) {
         catch {
             /* no exclude file yet */
         }
-        if (current.split('\n').some((entry) => entry.trim() === line))
+        const lines = current.split('\n');
+        const legacyIndex = lines.findIndex((entry) => entry.trim() === LEGACY_EXCLUDE_LINE);
+        if (legacyIndex !== -1) {
+            lines[legacyIndex] = EXCLUDE_LINE;
+            fs.mkdirSync(infoDir, { recursive: true });
+            fs.writeFileSync(excludeFile, lines.join('\n'));
+            return;
+        }
+        if (lines.some((entry) => entry.trim() === EXCLUDE_LINE))
             return;
         fs.mkdirSync(infoDir, { recursive: true });
         const prefix = current.length === 0 || current.endsWith('\n') ? '' : '\n';
-        fs.appendFileSync(excludeFile, `${prefix}# DevBridge: files you attach to a session live here\n${line}\n`);
+        fs.appendFileSync(excludeFile, `${prefix}# DevBridge: files you attach to a session live here\n${EXCLUDE_LINE}\n`);
     }
     catch (error) {
         // Not fatal: the worst case is that attachments show up as untracked files.

package/dist/auto-resume.d.ts

@@ -0,0 +1,18 @@
+/**
+ * May this session's interrupted turn be picked up automatically right now?
+ *
+ * Records the attempt when it says yes — the caller does not have to remember to,
+ * and a caller that forgot would silently remove the ceiling.
+ */
+export declare function claimAutoResume(sessionId: string, now?: number): boolean;
+/**
+ * Forget a session's history — called when a HUMAN sends a message.
+ *
+ * Without this, two automatic continuations early in a long session would use up
+ * the allowance for the rest of its life. A person typing into the session is the
+ * clearest possible signal that the work is on track again.
+ */
+export declare function clearAutoResume(sessionId: string): void;
+/** Drop entries for sessions that no longer exist, and anything past the window. */
+export declare function pruneAutoResume(liveSessionIds: Set<string>, now?: number): void;
+//# sourceMappingURL=auto-resume.d.ts.map

package/dist/auto-resume.js

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { stateDir } from './paths.js';
+/**
+ * How often a session is allowed to have its interrupted turn picked up again
+ * automatically.
+ *
+ * Session 18 (QA-112). When the runner process dies mid-turn, everything the
+ * agent was doing is abandoned and the session is parked with «send a message to
+ * continue». On 2026-07-30 that cost the owner two full runs of
+ * `timeout 900 pnpm -r typecheck`: the process died, they typed «продолжай», and
+ * the fifteen-minute command started from zero — twice, four minutes apart.
+ *
+ * Continuing by itself is only safe with a ceiling. A runner stuck in a crash
+ * loop would otherwise relaunch the same agent on every restart, five seconds
+ * apart, forever — and each relaunch costs real tokens and may repeat a
+ * side effect. So: at most `MAX_ATTEMPTS` inside `WINDOW_MS`, per session,
+ * recorded on disk because the whole point is that the process does not survive.
+ */
+const MAX_ATTEMPTS = 2;
+const WINDOW_MS = 30 * 60_000;
+function ledgerPath() {
+    return path.join(stateDir(), 'auto-resume.json');
+}
+function read() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(ledgerPath(), 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function write(ledger) {
+    try {
+        const dir = stateDir();
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const tmp = path.join(dir, `.auto-resume.json.${process.pid}.tmp`);
+        fs.writeFileSync(tmp, JSON.stringify(ledger), { mode: 0o600 });
+        fs.renameSync(tmp, ledgerPath());
+    }
+    catch {
+        /* Failing to record an attempt must not stop the session from continuing:
+           the ceiling is a safety net, not a precondition. */
+    }
+}
+/**
+ * May this session's interrupted turn be picked up automatically right now?
+ *
+ * Records the attempt when it says yes — the caller does not have to remember to,
+ * and a caller that forgot would silently remove the ceiling.
+ */
+export function claimAutoResume(sessionId, now = Date.now()) {
+    const ledger = read();
+    const recent = (ledger[sessionId]?.at ?? []).filter((at) => now - at < WINDOW_MS);
+    if (recent.length >= MAX_ATTEMPTS) {
+        // Keep the pruned list so the window slides instead of being reset by a
+        // refusal, then let the caller fall back to asking the human.
+        ledger[sessionId] = { at: recent };
+        write(ledger);
+        return false;
+    }
+    ledger[sessionId] = { at: [...recent, now] };
+    write(ledger);
+    return true;
+}
+/**
+ * Forget a session's history — called when a HUMAN sends a message.
+ *
+ * Without this, two automatic continuations early in a long session would use up
+ * the allowance for the rest of its life. A person typing into the session is the
+ * clearest possible signal that the work is on track again.
+ */
+export function clearAutoResume(sessionId) {
+    const ledger = read();
+    if (!(sessionId in ledger))
+        return;
+    // Rebuilt rather than `delete`d: the ledger is a plain record keyed by session
+    // id, and a dynamic delete on it is exactly the pattern the lint rule is for.
+    write(Object.fromEntries(Object.entries(ledger).filter(([id]) => id !== sessionId)));
+}
+/** Drop entries for sessions that no longer exist, and anything past the window. */
+export function pruneAutoResume(liveSessionIds, now = Date.now()) {
+    const ledger = read();
+    const kept = {};
+    let changed = false;
+    for (const [sessionId, entry] of Object.entries(ledger)) {
+        const recent = entry.at.filter((at) => now - at < WINDOW_MS);
+        // Nothing recent AND the session is gone → forget it entirely. A live
+        // session keeps its (possibly empty) entry so its budget is honest.
+        if (recent.length === 0 && !liveSessionIds.has(sessionId)) {
+            changed = true;
+            continue;
+        }
+        if (recent.length !== entry.at.length)
+            changed = true;
+        kept[sessionId] = { at: recent };
+    }
+    if (changed)
+        write(kept);
+}
+//# sourceMappingURL=auto-resume.js.map

package/dist/commit-message.d.ts

@@ -0,0 +1,51 @@
+import { query } from '@anthropic-ai/claude-agent-sdk';
+export interface ProposeCommitMessageInput {
+    worktreePath: string;
+    workspacePath: string;
+    branch: string;
+    baseBranch?: string;
+    /** Ticket numbers to reference; the API substitutes them, never the model. */
+    tickets?: number[];
+    /** Subjects of the commits already on the branch, newest first. */
+    commitSubjects?: string[];
+    /** Project settings, straight from the workspace row. */
+    language?: string;
+    convention?: string;
+}
+export interface ProposeCommitMessageResult {
+    ok: boolean;
+    message?: string;
+    /** Files removed from the prompt because they are on the secret denylist. */
+    redactedFiles?: number;
+    diffTruncated?: boolean;
+    error?: string;
+}
+/**
+ * Drop whole file sections that are on the secret denylist.
+ *
+ * `gitDiff` throws in this situation; here that would mean «no proposal at all
+ * because the branch touches `.env.example`». Removing the file and saying so
+ * is both safer (the bytes never leave) and more useful.
+ */
+export declare function stripProtectedFiles(diff: string): {
+    diff: string;
+    redacted: number;
+};
+/**
+ * The one-shot itself.
+ *
+ * `maxTurns: 1` and every tool refused: this run must read nothing, write
+ * nothing and call nothing. It gets the diff in its prompt and answers with
+ * text. `settingSources: []` for the same reason the session adapter uses it —
+ * a `.claude/settings.json` inside the worktree is a file the agent can write.
+ */
+export declare function proposeCommitMessage(input: ProposeCommitMessageInput, queryFn?: typeof query): Promise<ProposeCommitMessageResult>;
+/**
+ * What comes back is text a model wrote, so it is treated as such: fences off,
+ * an opening «Here is the commit message:» off, masked, capped.
+ *
+ * The trailer and signature filtering lives on the API side, where it also
+ * catches what a human pastes into the box — one filter, one place.
+ */
+export declare function cleanProposal(text: string): string;
+//# sourceMappingURL=commit-message.d.ts.map