@bridge4dev/runner 0.13.1 → 0.26.0

package/dist/paths.d.ts

@@ -1,7 +1,42 @@
 export declare function configDir(): string;
 export declare function stateDir(): string;
+/**
+ * Home for systemd USER units. Honours `DEVBRIDGE_RUNNER_HOME` like everything
+ * else here: `service-unit.ts` used to reach for `os.homedir()` directly, and the
+ * moment it started WRITING (the 0.21.0 limits drop-in) a test run began
+ * reconfiguring the developer's own service.
+ */
+export declare function systemdUserHome(): string;
 export declare function configFilePath(): string;
 export declare function statusFilePath(): string;
 export declare function journalDir(): string;
 export declare function worktreesDir(): string;
+/**
+ * Project directories this runner has been pointed at.
+ *
+ * Kept so `devbridge-runner doctor` can check the permissions that actually
+ * matter on this machine without being told the paths — the runner learns them
+ * from the API (binding a project, starting a session) and the person running
+ * doctor may have no idea which directories are bound.
+ */
+export declare function knownWorkspacesPath(): string;
+/** Session 14: the single preview checkout per repository. */
+export declare function previewsDir(): string;
+/**
+ * Per-session MCP config files (ticket #119).
+ *
+ * The Agent SDK serialises its `mcpServers` option straight into the CLI's
+ * argv (`sdk.mjs`: `H.push("--mcp-config", Re({mcpServers:ke}))`), which put the
+ * project's `dbk_…` key in `/proc/<pid>/cmdline` — world-readable, and how the
+ * key was found in the first place. The CLI also accepts a PATH there
+ * (`--mcp-config <configs...>`: "Load MCP servers from JSON files or strings"),
+ * so we write the same JSON to a 0600 file and pass the path instead.
+ *
+ * The basename is deliberately distinctive rather than just `<sessionId>.json`:
+ * `policy.ts` matches it by name in BOTH secret lists, so the guard holds
+ * wherever the file ends up — including under a `DEVBRIDGE_RUNNER_HOME`
+ * override, where the path carries no `devbridge-runner` segment.
+ */
+export declare function mcpConfigDir(): string;
+export declare function mcpConfigPath(sessionId: string): string;
 //# sourceMappingURL=paths.d.ts.map

package/dist/paths.js

@@ -18,6 +18,15 @@ export function stateDir() {
     const xdg = process.env['XDG_STATE_HOME'] ?? path.join(os.homedir(), '.local', 'state');
     return path.join(xdg, 'devbridge-runner');
 }
+/**
+ * Home for systemd USER units. Honours `DEVBRIDGE_RUNNER_HOME` like everything
+ * else here: `service-unit.ts` used to reach for `os.homedir()` directly, and the
+ * moment it started WRITING (the 0.21.0 limits drop-in) a test run began
+ * reconfiguring the developer's own service.
+ */
+export function systemdUserHome() {
+    return baseDir() ?? os.homedir();
+}
 export function configFilePath() {
     return path.join(configDir(), 'config.toml');
 }
@@ -30,4 +39,40 @@ export function journalDir() {
 export function worktreesDir() {
     return path.join(stateDir(), 'worktrees');
 }
+/**
+ * Project directories this runner has been pointed at.
+ *
+ * Kept so `devbridge-runner doctor` can check the permissions that actually
+ * matter on this machine without being told the paths — the runner learns them
+ * from the API (binding a project, starting a session) and the person running
+ * doctor may have no idea which directories are bound.
+ */
+export function knownWorkspacesPath() {
+    return path.join(stateDir(), 'workspaces.json');
+}
+/** Session 14: the single preview checkout per repository. */
+export function previewsDir() {
+    return path.join(stateDir(), 'previews');
+}
+/**
+ * Per-session MCP config files (ticket #119).
+ *
+ * The Agent SDK serialises its `mcpServers` option straight into the CLI's
+ * argv (`sdk.mjs`: `H.push("--mcp-config", Re({mcpServers:ke}))`), which put the
+ * project's `dbk_…` key in `/proc/<pid>/cmdline` — world-readable, and how the
+ * key was found in the first place. The CLI also accepts a PATH there
+ * (`--mcp-config <configs...>`: "Load MCP servers from JSON files or strings"),
+ * so we write the same JSON to a 0600 file and pass the path instead.
+ *
+ * The basename is deliberately distinctive rather than just `<sessionId>.json`:
+ * `policy.ts` matches it by name in BOTH secret lists, so the guard holds
+ * wherever the file ends up — including under a `DEVBRIDGE_RUNNER_HOME`
+ * override, where the path carries no `devbridge-runner` segment.
+ */
+export function mcpConfigDir() {
+    return path.join(stateDir(), 'mcp');
+}
+export function mcpConfigPath(sessionId) {
+    return path.join(mcpConfigDir(), `devbridge-mcp.${sessionId}.json`);
+}
 //# sourceMappingURL=paths.js.map

package/dist/policy.d.ts

@@ -3,6 +3,19 @@ export interface PolicyContext {
     trustMode: TrustMode;
     /** The session worktree — the only place the agent may write. */
     worktreePath: string;
+    /**
+     * May the agent commit on its own? (session 15)
+     *
+     * `false` is the project setting «I review and commit myself». It was a
+     * column, an API field and a switch in the workspace form since session 14 —
+     * and nothing ever sent it anywhere, so the switch moved a value that no code
+     * read. A control that does nothing is worse than a missing one: somebody
+     * turns it off and believes the agent stopped committing.
+     *
+     * `undefined` means the API did not say, which is every runner-API pair older
+     * than this release — and there the answer stays what it has always been.
+     */
+    agentAutoCommit?: boolean;
 }
 export interface PolicyDecision {
     decision: 'allow' | 'deny' | 'ask';
@@ -13,5 +26,55 @@ export declare function maskString(value: string): string;
 export declare function maskSecrets<T>(value: T): T;
 export declare function isSecretPath(p: string): boolean;
 export declare function isInsideWorktree(p: string, worktreePath: string): boolean;
+/**
+ * Anything inside a `.git` directory (session 16, QA-110 B2).
+ *
+ * This became load-bearing the day DIRECT mode made the repository ROOT the
+ * agent's confinement. In a linked worktree the real `.git` lives elsewhere, so
+ * «outside the worktree» happened to cover it; in the project folder it sits
+ * right there, one level down, and «inside the worktree» happened to allow it.
+ *
+ * A file in `.git/hooks/` is not data — it is code git runs on the next commit,
+ * outside every rule on the Bash denylist, including the `git clean` and
+ * `git reset --hard` this same session added to it. `.git/config` is worse: it
+ * can set `core.fsmonitor` or a credential helper and run a command on the very
+ * next git invocation. Neither is ever ordinary agent work.
+ */
+export declare function isGitInternalPath(p: string): boolean;
+export interface RecipeCommandContext {
+    /**
+     * The docker compose project this preview owns, from `preview.project` in the
+     * recipe. Present only for the preview `stop` command.
+     */
+    dockerProject?: string;
+    /** True only for the recipe's own `preview.stop` command. */
+    isPreviewStop?: boolean;
+}
+export interface RecipeCommandDecision {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Layer 1 for a command that came out of an APPROVED project recipe.
+ *
+ * The semantics, fixed here rather than left to be discovered: **an approved
+ * recipe does not ask, but it cannot get past the denylist.** Both halves
+ * matter and neither is what `evaluateToolUse` would do on its own.
+ *
+ *  - It does not ask, because there is nobody to ask: a build runs for minutes
+ *    with no agent turn around it, and the human already read every command on
+ *    the approval screen. Running it through the strict-mode branch would turn
+ *    `docker compose up --build` — which is not on any safe list — into a
+ *    permission card nobody can answer.
+ *  - It cannot get past the denylist, because approval is a statement about a
+ *    build, not a grant of `sudo`, of the firewall, or of the machine's power
+ *    switch.
+ *
+ * One denial is liftable, and only one: `docker … down`. A preview that cannot
+ * tear its own stack down leaks containers forever, so a recipe that NAMES its
+ * compose project may run `down` on that project in its `stop` command — and
+ * nowhere else. Without the name, the refusal stands and says why.
+ */
+export declare function evaluateRecipeCommand(command: string, ctx?: RecipeCommandContext): RecipeCommandDecision;
 export declare function evaluateToolUse(toolName: string, input: Record<string, unknown>, ctx: PolicyContext): PolicyDecision;
 //# sourceMappingURL=policy.d.ts.map