@bridge4dev/runner 0.22.1 → 0.27.0

package/dist/protocol.d.ts

@@ -179,11 +179,11 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         id: string;
         title: string;
     }[];
-    mode?: "ask" | "plan" | "auto" | "full" | undefined;
     mcp?: {
         url: string;
         token: string;
     } | undefined;
+    mode?: "ask" | "plan" | "auto" | "full" | undefined;
     model?: string | null | undefined;
     effort?: string | null | undefined;
     epoch?: number | undefined;
@@ -381,11 +381,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             id: string;
             title: string;
         }[];
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         mcp?: {
             url: string;
             token: string;
         } | undefined;
+        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         model?: string | null | undefined;
         effort?: string | null | undefined;
         epoch?: number | undefined;
@@ -469,11 +469,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             id: string;
             title: string;
         }[];
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         mcp?: {
             url: string;
             token: string;
         } | undefined;
+        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         model?: string | null | undefined;
         effort?: string | null | undefined;
         epoch?: number | undefined;
@@ -695,11 +695,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             id: string;
             title: string;
         }[];
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         mcp?: {
             url: string;
             token: string;
         } | undefined;
+        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         model?: string | null | undefined;
         effort?: string | null | undefined;
         epoch?: number | undefined;
@@ -778,11 +778,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             id: string;
             title: string;
         }[];
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         mcp?: {
             url: string;
             token: string;
         } | undefined;
+        mode?: "ask" | "plan" | "auto" | "full" | undefined;
         model?: string | null | undefined;
         effort?: string | null | undefined;
         epoch?: number | undefined;
@@ -961,16 +961,16 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     sessionId: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
+    name: string;
     type: "command";
     requestId: string;
-    name: string;
     sessionId?: string | undefined;
     workspaceId?: string | undefined;
     args?: Record<string, unknown> | undefined;
 }, {
+    name: string;
     type: "command";
     requestId: string;
-    name: string;
     sessionId?: string | undefined;
     workspaceId?: string | undefined;
     args?: Record<string, unknown> | undefined;

package/dist/recipe-schema.d.ts

@@ -253,6 +253,7 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
         shaPath?: string | undefined;
     } | undefined;
 }, {
+    version?: 1 | undefined;
     preview?: {
         run: string;
         url?: string | undefined;
@@ -260,7 +261,6 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
         timeoutSec?: number | undefined;
         stop?: string | undefined;
     } | undefined;
-    version?: 1 | undefined;
     notes?: string | undefined;
     steps?: {
         verify?: {

package/dist/self-update.d.ts

@@ -62,6 +62,45 @@ export interface SelfUpdateOptions {
  * has one above `packages/runner`.
  */
 export declare function resolveInstalledPackageDir(entry?: string): string | null;
+/**
+ * The npm prefix the RUNNING package was installed into.
+ *
+ * This is the whole fix for the dedicated-user layout. `npm install -g` obeys
+ * npm's *configured* prefix, and `--prefix` is a per-invocation flag that npm
+ * persists nowhere — so the install the instructions prescribed for a dedicated
+ * user (`npm install -g --prefix ~/.local …`) produced a runner in
+ * `~/.local/lib/node_modules` while every later `npm install -g` aimed at
+ * `/usr`. Measured on a live server: `npm prefix -g` → `/usr`,
+ * `installIsWritable` → true (both checked directories really are the user's),
+ * and then npm dies with EACCES *inside* the update — the exact
+ * «the permissions to access this file as the current user» the owner pasted.
+ *
+ * Deriving the prefix from where we physically are is the truthful answer: it
+ * cannot disagree with reality, and it costs no subprocess. Returns null for a
+ * layout that is not a global npm install (a source checkout, a vendored copy),
+ * where the caller should fall back to `npm prefix -g`.
+ *
+ * `<prefix>/lib/node_modules/@scope/pkg` → `<prefix>`
+ * `<prefix>/lib/node_modules/pkg`        → `<prefix>`
+ */
+export declare function installPrefixFor(packageDir?: string | null): string | null;
+/**
+ * Can this user actually replace the installed package?
+ *
+ * The two legitimate installs part ways here. `npm install -g` run by root puts
+ * the package in `/usr/lib/node_modules` owned by root; the daemon then runs as
+ * a dedicated user, who cannot write there. The button was offered anyway and
+ * failed halfway through npm with «the permissions to access this file as the
+ * current user» — a dashboard button that cannot work, and an error in npm's
+ * words rather than ours.
+ *
+ * Three directories matter, because npm rewrites all three: the package itself,
+ * the `node_modules` above it, and `<prefix>/bin`, where the command symlink
+ * lives. `bin` was missing here and is not hypothetical — a prefix whose
+ * `lib/node_modules` was handed over with chown while `bin` stayed root-owned
+ * passes the first two and still fails.
+ */
+export declare function installIsWritable(packageDir?: string | null): boolean;
 /**
  * Is something going to restart us?
  *
@@ -78,5 +117,21 @@ export declare function isSupervisedProcess(env?: NodeJS.ProcessEnv): boolean;
  * never be talked into fetching its own replacement over http.
  */
 export declare function isTrustedTarballUrl(tarballUrl: string, apiUrl: string): boolean;
+/**
+ * The command a person can paste on the server to update this exact machine.
+ *
+ * Built by the runner rather than by the dashboard because only the runner
+ * knows the three things that make it correct: which prefix it lives in, which
+ * user it runs as, and that user's uid for `XDG_RUNTIME_DIR`. The dashboard
+ * used to assemble a generic `npm install -g <url> && systemctl --user restart`
+ * and then patch it with string surgery — which produced a command that could
+ * not work on precisely the machines that needed it.
+ */
+export declare function manualUpdateCommand(tarballUrl: string, options?: {
+    prefix?: string | null;
+    user?: string;
+    uid?: number;
+    packageDir?: string | null;
+}): string;
 export declare function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdateOutcome>;
 //# sourceMappingURL=self-update.d.ts.map

package/dist/self-update.js

@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { log } from './log.js';
@@ -54,6 +55,85 @@ export function resolveInstalledPackageDir(entry = process.argv[1] ?? '') {
     }
     return null;
 }
+/**
+ * The npm prefix the RUNNING package was installed into.
+ *
+ * This is the whole fix for the dedicated-user layout. `npm install -g` obeys
+ * npm's *configured* prefix, and `--prefix` is a per-invocation flag that npm
+ * persists nowhere — so the install the instructions prescribed for a dedicated
+ * user (`npm install -g --prefix ~/.local …`) produced a runner in
+ * `~/.local/lib/node_modules` while every later `npm install -g` aimed at
+ * `/usr`. Measured on a live server: `npm prefix -g` → `/usr`,
+ * `installIsWritable` → true (both checked directories really are the user's),
+ * and then npm dies with EACCES *inside* the update — the exact
+ * «the permissions to access this file as the current user» the owner pasted.
+ *
+ * Deriving the prefix from where we physically are is the truthful answer: it
+ * cannot disagree with reality, and it costs no subprocess. Returns null for a
+ * layout that is not a global npm install (a source checkout, a vendored copy),
+ * where the caller should fall back to `npm prefix -g`.
+ *
+ * `<prefix>/lib/node_modules/@scope/pkg` → `<prefix>`
+ * `<prefix>/lib/node_modules/pkg`        → `<prefix>`
+ */
+export function installPrefixFor(packageDir = resolveInstalledPackageDir()) {
+    if (!packageDir)
+        return null;
+    const marker = `${path.sep}node_modules${path.sep}`;
+    const at = packageDir.lastIndexOf(marker);
+    if (at < 0)
+        return null;
+    const nodeModules = packageDir.slice(0, at + marker.length - 1);
+    const lib = path.dirname(nodeModules);
+    // Anything else is not the layout `npm install -g --prefix` produces, and
+    // guessing a prefix that npm would not use is worse than not guessing.
+    if (path.basename(lib) !== 'lib')
+        return null;
+    return path.dirname(lib);
+}
+function isWritable(target) {
+    try {
+        fs.accessSync(target, fs.constants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Can this user actually replace the installed package?
+ *
+ * The two legitimate installs part ways here. `npm install -g` run by root puts
+ * the package in `/usr/lib/node_modules` owned by root; the daemon then runs as
+ * a dedicated user, who cannot write there. The button was offered anyway and
+ * failed halfway through npm with «the permissions to access this file as the
+ * current user» — a dashboard button that cannot work, and an error in npm's
+ * words rather than ours.
+ *
+ * Three directories matter, because npm rewrites all three: the package itself,
+ * the `node_modules` above it, and `<prefix>/bin`, where the command symlink
+ * lives. `bin` was missing here and is not hypothetical — a prefix whose
+ * `lib/node_modules` was handed over with chown while `bin` stayed root-owned
+ * passes the first two and still fails.
+ */
+export function installIsWritable(packageDir = resolveInstalledPackageDir()) {
+    if (!packageDir)
+        return false;
+    const marker = `${path.sep}node_modules${path.sep}`;
+    const at = packageDir.lastIndexOf(marker);
+    // `<prefix>/lib/node_modules/@scope/pkg` → `<prefix>/lib/node_modules`
+    const nodeModules = at >= 0 ? packageDir.slice(0, at + marker.length - 1) : path.dirname(packageDir);
+    if (!isWritable(packageDir) || !isWritable(nodeModules))
+        return false;
+    const prefix = installPrefixFor(packageDir);
+    // No `bin` yet is fine — npm creates it. An existing one we cannot write is not.
+    if (prefix) {
+        const bin = path.join(prefix, 'bin');
+        if (fs.existsSync(bin) && !isWritable(bin))
+            return false;
+    }
+    return true;
+}
 /**
  * Is something going to restart us?
  *
@@ -110,17 +190,23 @@ const COMMAND_NAME = 'devbridge-runner';
  * command — the stable thing, referenced by a unit file we do not control —
  * points at the new one. So we follow the command.
  */
-async function commandOwner(exec) {
-    let prefix;
-    try {
-        const result = await exec('npm', ['prefix', '-g'], {
-            timeout: VERIFY_TIMEOUT_MS,
-            env: npmEnv(),
-        });
-        prefix = result.stdout.trim();
-    }
-    catch {
-        return null;
+async function commandOwner(exec, installPrefix = null) {
+    // Where we actually live outranks what npm is configured to think. Under the
+    // dedicated-user layout `npm prefix -g` answers `/usr` — a directory that on
+    // such a host holds no runner at all — so asking npm first returned null and
+    // took the EEXIST rename-recovery and the unit repair down with it.
+    let prefix = installPrefix;
+    if (!prefix) {
+        try {
+            const result = await exec('npm', ['prefix', '-g'], {
+                timeout: VERIFY_TIMEOUT_MS,
+                env: npmEnv(),
+            });
+            prefix = result.stdout.trim();
+        }
+        catch {
+            return null;
+        }
     }
     if (!prefix)
         return null;
@@ -137,13 +223,55 @@ async function commandOwner(exec) {
         return null;
     }
 }
-function installArgs(source) {
+function installArgs(source, prefix) {
     // `--ignore-scripts` matches the documented install: this package and its whole
     // tree have no install/postinstall scripts, so nothing legitimate is skipped —
     // and an update pulled over the network gets no chance to run anything at
     // install time. `--loglevel=error` because npm's ERESOLVE warning about zod is
     // expected, harmless and long enough to bury the line that matters.
-    return ['install', '-g', '--ignore-scripts', '--loglevel=error', source];
+    //
+    // `--prefix` names the prefix the runner is ALREADY installed in. Without it
+    // npm uses its configured global prefix, which on a dedicated-user install is
+    // a directory the daemon cannot write — and, on the rarer host where it can,
+    // npm cheerfully installs a SECOND copy somewhere the service does not exec,
+    // reports success, and the runner restarts on the old version forever.
+    return [
+        'install',
+        '-g',
+        '--ignore-scripts',
+        '--loglevel=error',
+        ...(prefix ? ['--prefix', prefix] : []),
+        source,
+    ];
+}
+/**
+ * The command a person can paste on the server to update this exact machine.
+ *
+ * Built by the runner rather than by the dashboard because only the runner
+ * knows the three things that make it correct: which prefix it lives in, which
+ * user it runs as, and that user's uid for `XDG_RUNTIME_DIR`. The dashboard
+ * used to assemble a generic `npm install -g <url> && systemctl --user restart`
+ * and then patch it with string surgery — which produced a command that could
+ * not work on precisely the machines that needed it.
+ */
+export function manualUpdateCommand(tarballUrl, options = {}) {
+    const packageDir = options.packageDir === undefined ? resolveInstalledPackageDir() : options.packageDir;
+    const prefix = options.prefix === undefined ? installPrefixFor(packageDir) : options.prefix;
+    const user = options.user ?? os.userInfo().username;
+    const uid = options.uid ?? (typeof process.getuid === 'function' ? process.getuid() : -1);
+    const install = ['npm install -g --ignore-scripts --loglevel=error']
+        .concat(prefix ? [`--prefix ${prefix}`] : [])
+        .concat([tarballUrl])
+        .join(' ');
+    const restart = 'systemctl --user restart devbridge-runner';
+    // Writable by us → one line, run as ourselves. Not writable → the install
+    // half needs root and the restart half needs the daemon's own user, and
+    // «run it as root» alone is how people ended up with a new package and an
+    // old process still running.
+    if (installIsWritable(packageDir))
+        return `${install} && ${restart}`;
+    const runtime = uid >= 0 ? `/run/user/${uid}` : `/run/user/$(id -u ${user})`;
+    return `sudo ${install} && sudo -iu ${user} env XDG_RUNTIME_DIR=${runtime} ${restart}`;
 }
 /**
  * Install a global package, clearing the way if a DIFFERENTLY-NAMED build of this
@@ -156,25 +284,22 @@ function installArgs(source) {
  * one owner instead of two, which is also the only state the NEXT update can
  * work from.
  */
-async function installGlobal(exec, source) {
+async function installGlobal(exec, source, prefix) {
     try {
-        await exec('npm', installArgs(source), { timeout: NPM_TIMEOUT_MS, env: npmEnv() });
+        await exec('npm', installArgs(source, prefix), { timeout: NPM_TIMEOUT_MS, env: npmEnv() });
         return;
     }
     catch (error) {
         if (!/EEXIST/i.test(describe(error)))
             throw error;
-        const owner = await commandOwner(exec);
+        const owner = await commandOwner(exec, prefix);
         if (!owner)
             throw error;
         log.warn('self-update: the command belongs to another package — retiring it', {
             package: owner.name,
         });
-        await exec('npm', ['uninstall', '-g', '--loglevel=error', owner.name], {
-            timeout: NPM_TIMEOUT_MS,
-            env: npmEnv(),
-        });
-        await exec('npm', installArgs(source), { timeout: NPM_TIMEOUT_MS, env: npmEnv() });
+        await exec('npm', ['uninstall', '-g', '--loglevel=error', ...(prefix ? ['--prefix', prefix] : []), owner.name], { timeout: NPM_TIMEOUT_MS, env: npmEnv() });
+        await exec('npm', installArgs(source, prefix), { timeout: NPM_TIMEOUT_MS, env: npmEnv() });
     }
 }
 /**
@@ -218,6 +343,20 @@ export async function selfUpdate(options) {
     if (!packageDir) {
         return fail('This runner runs from a source checkout, not from an installed package — update it with git instead.');
     }
+    // Installed by one user, run by another — the usual shape being `npm install
+    // -g` as root with the daemon under a dedicated user. npm gets far enough to
+    // start rewriting the package and then stops with EACCES, so the check has to
+    // happen BEFORE anything is touched. Refused with the two commands that work,
+    // because «run it as root» alone leaves out the restart, which needs the
+    // runner's own user.
+    if (!installIsWritable(packageDir)) {
+        const user = os.userInfo().username;
+        return fail(`The runner package in ${packageDir} belongs to another user, and this daemon runs as ${user}, ` +
+            'so it cannot replace itself. Run this on the server instead:\n  ' +
+            manualUpdateCommand(options.tarballUrl, { packageDir }));
+    }
+    // Derived once and threaded through every npm call below.
+    const prefix = installPrefixFor(packageDir);
     // Pack the current version FIRST: without a rollback artefact there is no
     // honest way back if the new build turns out to be broken.
     const rollbackDir = path.join(stateDir(), 'rollback');
@@ -242,7 +381,7 @@ export async function selfUpdate(options) {
         return fail('Could not prepare a rollback copy of the current version — update aborted');
     }
     try {
-        await installGlobal(exec, options.tarballUrl);
+        await installGlobal(exec, options.tarballUrl, prefix);
     }
     catch (error) {
         return fail(`Install failed: ${describe(error)}`, { rollbackTarball });
@@ -250,7 +389,7 @@ export async function selfUpdate(options) {
     // Where the new build actually landed. After a rename `packageDir` is the
     // directory we just retired, so its manifest would report the OLD version —
     // and the smoke test below would run code that no longer exists.
-    const installed = await commandOwner(exec);
+    const installed = await commandOwner(exec, prefix);
     const newPackageDir = installed?.dir ?? packageDir;
     const toVersion = readVersion(newPackageDir) ?? undefined;
     // The real test: does the newly installed build start? `--version` loads the
@@ -273,12 +412,12 @@ export async function selfUpdate(options) {
             // Through the same door as the install above: if the failed update renamed
             // the package, the command now belongs to the new name and putting the old
             // one back hits the very same EEXIST.
-            await installGlobal(exec, rollbackTarball);
+            await installGlobal(exec, rollbackTarball, prefix);
             return fail(`The new version did not start (${detail}). The previous version was restored and the runner keeps working.`, { rollbackTarball, ...(toVersion ? { toVersion } : {}) });
         }
         catch (rollbackError) {
             return fail(`The new version did not start (${detail}) and the rollback failed too (${describe(rollbackError)}). ` +
-                `Restore it on the server with: npm install -g ${rollbackTarball}`, { rollbackTarball, ...(toVersion ? { toVersion } : {}) });
+                `Restore it on the server with: npm install -g${prefix ? ` --prefix ${prefix}` : ''} ${rollbackTarball}`, { rollbackTarball, ...(toVersion ? { toVersion } : {}) });
         }
     }
     // The service unit may be pinned to a file inside the directory this update

package/dist/service-unit.d.ts

@@ -15,12 +15,24 @@
  */
 export declare const SERVICE_NAME = "devbridge-runner";
 /** `<prefix>/bin/devbridge-runner` for an installed package, else the script. */
+/**
+ * A path that will not exist after a reboot.
+ *
+ * `fnm` (and `nvm`/`volta` in the same spirit) puts the active version's `bin`
+ * into a per-shell directory under `/run/user/<uid>/fnm_multishells/…` — tmpfs,
+ * created for one shell session. `command -v devbridge-runner` resolves there,
+ * so baking it into a unit produces a service that works until the shell that
+ * installed it goes away, and then fails with status=127 forever. Observed on a
+ * real install, 2026-07-31, on a ROOT install — this is not a dedicated-user
+ * problem, it is a per-user node manager problem.
+ */
+export declare function isEphemeralPath(target: string): boolean;
 export declare function unitExecTarget(argv1?: string): {
     execStart: string;
     viaCommand: boolean;
 };
 export declare function unitPath(home?: string): string;
-export declare function buildUnit(execStart?: string): string;
+export declare function buildUnit(execStart?: string, nodeBinary?: string): string;
 /**
  * Resource policy for the service, and why it does not live in the unit above.
  *

package/dist/service-unit.js

@@ -20,10 +20,31 @@ import { systemdUserHome } from './paths.js';
 export const SERVICE_NAME = 'devbridge-runner';
 const COMMAND_NAME = 'devbridge-runner';
 /** `<prefix>/bin/devbridge-runner` for an installed package, else the script. */
+/**
+ * A path that will not exist after a reboot.
+ *
+ * `fnm` (and `nvm`/`volta` in the same spirit) puts the active version's `bin`
+ * into a per-shell directory under `/run/user/<uid>/fnm_multishells/…` — tmpfs,
+ * created for one shell session. `command -v devbridge-runner` resolves there,
+ * so baking it into a unit produces a service that works until the shell that
+ * installed it goes away, and then fails with status=127 forever. Observed on a
+ * real install, 2026-07-31, on a ROOT install — this is not a dedicated-user
+ * problem, it is a per-user node manager problem.
+ */
+export function isEphemeralPath(target) {
+    // Deliberately narrow: `/run` and `/dev/shm` are tmpfs by definition, and
+    // `fnm_multishells` is named because fnm also offers non-tmpfs layouts. `/tmp`
+    // is NOT here — a package installed there is odd but survives, and tests build
+    // their fake installs in temp directories.
+    return (/^\/(run|proc)\//.test(target) ||
+        target.startsWith('/dev/shm/') ||
+        target.includes('fnm_multishells'));
+}
 export function unitExecTarget(argv1 = process.argv[1] ?? '') {
-    // Invoked through the command itself: that is already the stable path.
+    // Invoked through the command itself: that is already the stable path —
+    // unless it lives in a directory that disappears with the shell.
     try {
-        if (fs.lstatSync(argv1).isSymbolicLink()) {
+        if (fs.lstatSync(argv1).isSymbolicLink() && !isEphemeralPath(path.resolve(argv1))) {
             return { execStart: path.resolve(argv1), viaCommand: true };
         }
     }
@@ -43,8 +64,9 @@ export function unitExecTarget(argv1 = process.argv[1] ?? '') {
         let dir = path.dirname(script);
         for (let i = 0; i < 6; i++) {
             const candidate = path.join(dir, 'bin', COMMAND_NAME);
-            if (fs.existsSync(candidate))
+            if (fs.existsSync(candidate) && !isEphemeralPath(candidate)) {
                 return { execStart: candidate, viaCommand: true };
+            }
             const parent = path.dirname(dir);
             if (parent === dir)
                 break;
@@ -56,13 +78,19 @@ export function unitExecTarget(argv1 = process.argv[1] ?? '') {
 export function unitPath(home = systemdUserHome()) {
     return path.join(home, '.config', 'systemd', 'user', `${SERVICE_NAME}.service`);
 }
-export function buildUnit(execStart) {
+export function buildUnit(execStart, nodeBinary = process.execPath) {
     const target = execStart ?? unitExecTarget().execStart;
-    // The command carries a `#!/usr/bin/env node` shebang, so it is exec'd directly;
-    // a bare script path needs the interpreter spelled out.
-    const command = target.endsWith('.js')
-        ? `${process.execPath} ${target} daemon`
-        : `${target} daemon`;
+    /**
+     * The interpreter is ALWAYS spelled out, even for the command symlink.
+     *
+     * The file carries `#!/usr/bin/env node`, and relying on that shebang means
+     * relying on `node` being on the PATH systemd gives the service — which it is
+     * not when node came from fnm/nvm/volta. That produced `status=127` and an
+     * endless restart loop on a real machine. Node runs a file with a shebang
+     * perfectly well (it is a comment to it), so naming the interpreter costs
+     * nothing and removes the dependency entirely.
+     */
+    const command = `${nodeBinary} ${target} daemon`;
     return ([
         '[Unit]',
         'Description=DevBridge Dev Runner',
@@ -206,6 +234,9 @@ export function unitIsBroken(readFile = (p) => fs.readFileSync(p, 'utf8')) {
     const target = parts[0]?.endsWith('node') ? parts[1] : parts[0];
     if (!target)
         return false;
-    return !fs.existsSync(target);
+    // Gone already, or living somewhere that will be gone after a reboot — the
+    // second one still runs today, which is exactly why it has to be repaired
+    // before the reboot rather than after it.
+    return !fs.existsSync(target) || isEphemeralPath(target) || isEphemeralPath(parts[0] ?? '');
 }
 //# sourceMappingURL=service-unit.js.map

package/dist/supervisor.js

@@ -12,8 +12,9 @@ import { VerifyRunner, runOneOffCommand, } from './verify.js';
 import { VerifyReportQueue } from './verify-queue.js';
 import { applySession, gitBranches, gitCommit, gitDiff, gitLog, gitPush, gitRefs, gitShow, gitStatus, revertApply, gitStage, gitUnstage, gitDiscard, gitPull, gitMergeAbort, updateFromBase, workspaceState, } from './gitops.js';
 import { fsView } from './fsview.js';
-import { agentAuthStatuses, AuthRelay } from './auth-relay.js';
+import { agentAuthStatuses, AuthRelay, clearAgentAuthFailure, noteAgentAuthFailure, } from './auth-relay.js';
 import { selfUpdate } from './self-update.js';
+import { rememberWorkspacePath } from './environment.js';
 import { composeMessageWithAttachments, saveAttachments, } from './attachments.js';
 export class Supervisor {
     ws;
@@ -297,6 +298,10 @@ export class Supervisor {
      * would be a lock bought for nothing.
      */
     async prepareWorkspace(descriptor) {
+        // Also here, not only at bind time: a server paired before this existed has
+        // never sent a `validate_path`, and its projects would be invisible to
+        // `doctor` until somebody re-bound them.
+        rememberWorkspacePath(descriptor.workspace.path);
         if (descriptor.workMode === 'DIRECT') {
             return prepareDirectWorkspace(descriptor.workspace.path);
         }
@@ -794,7 +799,12 @@ export class Supervisor {
         if (!running.session)
             return;
         running.parkRequested = true;
+        // `code` is what the dashboard reads to tell «parked» from «your turn»
+        // (#124). The prose stays for runners older than 0.23.0, which the
+        // dashboard still matches on; delete that fallback once the fleet has
+        // moved, not before.
         this.sendEvent(running, 'system_note', {
+            code: 'session_parked',
             text: 'Session parked — the runner switched to another session. Send a message to resume.',
         });
         running.session.stop('session_parked');
@@ -867,6 +877,15 @@ export class Supervisor {
                     });
                     return;
                 }
+                // The retry is spent and the agent is still refused — this is the only
+                // authority on a login the credentials file cannot see through (a
+                // provider-side revocation leaves the file looking perfectly healthy).
+                // The panel is told from here, not from a guess (#121).
+                if (isAuthCode(event.code)) {
+                    const refused = relayAgent(String(descriptor.agent).toLowerCase());
+                    if (refused)
+                        noteAgentAuthFailure(refused);
+                }
                 // Forward the code: the API stores the payload as-is, so the dashboard
                 // can offer "Sign in" instead of a dead error card.
                 this.sendEvent(running, 'error', {
@@ -906,6 +925,13 @@ export class Supervisor {
                 }
                 return;
             case 'message':
+                // The provider answered, so this sign-in works — drop any refusal we
+                // are still holding against it (#121).
+                if (event.role === 'assistant') {
+                    const working = relayAgent(String(descriptor.agent).toLowerCase());
+                    if (working)
+                        clearAgentAuthFailure(working);
+                }
                 this.sendEvent(running, 'message', { role: event.role, text: event.text });
                 return;
             case 'thinking':
@@ -1214,6 +1240,7 @@ export class Supervisor {
         // Parked session: the follow-up message becomes the resume prompt.
         if (!this.ensureCapacity(running.descriptor.id)) {
             this.sendEvent(running, 'system_note', {
+                code: 'runner_busy',
                 text: (this.maxSessions === 1
                     ? 'The runner is busy with another session — this one continues as soon as it finishes its turn.'
                     : `The runner is busy with ${this.maxSessions} other sessions — this one continues as soon as one of them finishes its turn.`) +
@@ -1579,6 +1606,10 @@ export class Supervisor {
                     if (!path)
                         return void reply({ ok: false, error: 'path argument is required' });
                     const validation = await validateWorkspacePath(path);
+                    // Remembered so `devbridge-runner doctor` can check the permissions
+                    // of the real projects without being told which they are.
+                    if (validation.ok)
+                        rememberWorkspacePath(path);
                     return void reply({
                         ok: validation.ok,
                         result: validation,
@@ -2209,6 +2240,9 @@ export class Supervisor {
                     if (!agent || !code)
                         return void reply({ ok: false, error: 'agent and code are required' });
                     const result = await this.authRelay.submitCode(agent, code);
+                    // A fresh credential outranks anything we remember about the old one.
+                    if (result.ok)
+                        clearAgentAuthFailure(agent);
                     return void reply({
                         ok: result.ok,
                         result,

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.22.1";
+export declare const RUNNER_VERSION = "0.27.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.22.1';
+export const RUNNER_VERSION = '0.27.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.22.1",
+  "version": "0.27.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",