@bridge4dev/runner 0.26.0 → 0.29.0

package/dist/adapters/claude.js

@@ -244,6 +244,42 @@ class ClaudeSession {
      * about the task — the live set typically precedes it (QA-111 m4).
      */
     skipTaskIds = new Set();
+    /**
+     * Uuid of the last message the CLI put in its transcript (ticket #126).
+     *
+     * This is the anchor a conversation rewind is measured from: handing it back
+     * as `resumeSessionAt` resumes the session with everything after it dropped.
+     * Every message type carries one — user echoes included, which is what makes
+     * "rewind to just before MY message" expressible at all.
+     */
+    lastMessageUuid = null;
+    /**
+     * A Stop the USER asked for is in flight.
+     *
+     * Aborting a turn mid-tool-use makes the SDK end it with
+     * `result{subtype:'error_during_execution'}`, which is indistinguishable
+     * from a crash by its shape alone — and `turn_end{ok:false}` puts the whole
+     * session in FAILED. So the one thing that CAN tell them apart is whether we
+     * asked: this flag is set by `interrupt()` and read by the result that
+     * follows it.
+     *
+     * Codex has always drawn the same distinction (`status: 'interrupted'` is
+     * reported `ok: true`); this is Claude catching up, not a new rule.
+     */
+    aborting = false;
+    /**
+     * The conversation is moving again — whatever a Stop armed is spent.
+     *
+     * Called from EVERY path that hands the agent something to act on, not just
+     * from `send()`: a Stop with nothing to interrupt produces no result at all,
+     * so a flag cleared only on a result stays armed and reports the NEXT turn's
+     * genuine failure as a clean stop (QA-120 M2). That is the original defect
+     * with the sign flipped, and the sign that loses data is this one — a run
+     * that failed would be reported as finished, with the reason dropped.
+     */
+    resumingTurn() {
+        this.aborting = false;
+    }
     events = this.output;
     constructor(spec, queryFn) {
         this.spec = spec;
@@ -321,6 +357,15 @@ class ClaudeSession {
             // `applyFlagSettings` call `setEffort` makes.
             ...(spec.effort === ULTRACODE ? { settings: { ultracode: true } } : {}),
             ...(spec.resumeProviderSessionId ? { resume: spec.resumeProviderSessionId } : {}),
+            // Ticket #126, conversation rewind. `resumeSessionAt` replays the
+            // transcript only up to (and including) this uuid; `forkSession` makes
+            // the result a NEW session id instead of truncating the old file, so the
+            // conversation the user rewound away from is still on disk afterwards.
+            // The SDK's own note applies and is repeated in the UI: a forked session
+            // starts without undo history.
+            ...(spec.resumeProviderSessionId && spec.resumeAtAnchor
+                ? { resumeSessionAt: spec.resumeAtAnchor, forkSession: true }
+                : {}),
             ...(spec.maxBudgetUsd !== undefined ? { maxBudgetUsd: spec.maxBudgetUsd } : {}),
             // Ticket #119. NOT `mcpServers` — the SDK JSON-stringifies that option
             // straight into argv (`sdk.mjs`: `H.push("--mcp-config", Re({mcpServers:ke}))`),
@@ -1110,6 +1155,7 @@ class ClaudeSession {
             log.warn('claude: answer for a question that is no longer open', { askId: reply.askId });
             return false;
         }
+        this.resumingTurn();
         // Validated BEFORE the ask is consumed: an answer with nothing in it would
         // otherwise release the tool call with `answers: {}` — the very shape of
         // the auto-answer this session deleted — and leave the card unanswerable.
@@ -1219,6 +1265,7 @@ class ClaudeSession {
             log.warn('claude: permission answer for unknown request', { requestId });
             return;
         }
+        this.resumingTurn();
         this.emit({
             type: 'permission_resolved',
             requestId,
@@ -1246,6 +1293,7 @@ class ClaudeSession {
             this.answerQuestion({ askId: openAsk, action: 'discuss', text });
             return;
         }
+        this.resumingTurn();
         const accepted = this.input.push({
             type: 'user',
             message: { role: 'user', content: text },
@@ -1258,13 +1306,37 @@ class ClaudeSession {
         }
     }
     async interrupt() {
+        this.aborting = true;
         try {
             await this.q.interrupt();
         }
         catch (error) {
+            // The abort never reached the SDK, so any failure that arrives now is the
+            // agent's own and must be reported as one.
+            this.aborting = false;
             log.warn('claude: interrupt failed', { error: String(error) });
         }
     }
+    conversationAnchor() {
+        return this.lastMessageUuid;
+    }
+    /**
+     * `/compact` — the CLI's own command, delivered as ordinary user input.
+     *
+     * Deliberately not routed through `send()`: that one diverts text into an
+     * open question card, and a question is exactly the state in which the user
+     * is most likely to look at a full context meter and press the button.
+     */
+    async compact() {
+        if (this.stopped)
+            return false;
+        this.resumingTurn();
+        return this.input.push({
+            type: 'user',
+            message: { role: 'user', content: '/compact' },
+            parent_tool_use_id: null,
+        });
+    }
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -1305,6 +1377,26 @@ class ClaudeSession {
     async consume() {
         try {
             for await (const msg of this.q) {
+                // Ticket #126: where we are in the transcript, remembered BEFORE the
+                // message is interpreted.
+                //
+                // ONLY a finished assistant message of the MAIN conversation. The SDK
+                // stamps a uuid on roughly thirty message kinds — `system:init`, hook
+                // notifications, rate-limit events, tool progress, the closing
+                // `result` — and none of them is something the CLI can resume at. Its
+                // own contract is explicit: «The message ID should be from
+                // `SDKAssistantMessage.uuid`».
+                //
+                // Taking whichever came last handed the CLI, on a fresh session, the
+                // uuid of `system:init` — and the next launch died with «No message
+                // found with message.uuid of …», which is a FAILED session and a
+                // conversation that was never actually rewound.
+                //
+                // `parent_tool_use_id` excludes a subagent's own messages: they live
+                // inside a Task tool call, not in the conversation being resumed.
+                if (msg.type === 'assistant' && msg.parent_tool_use_id === null && msg.uuid) {
+                    this.lastMessageUuid = msg.uuid;
+                }
                 switch (msg.type) {
                     case 'system': {
                         if (msg.subtype === 'init') {
@@ -1393,16 +1485,32 @@ class ClaudeSession {
                         // otherwise, and it is the last thing anybody sees.
                         this.endTaskTurn();
                         this.refreshContextUsage();
-                        if (msg.subtype === 'success') {
-                            this.emit({ type: 'turn_end', ok: true });
-                        }
-                        else {
+                        // Consumed here whichever way the turn ended: one Stop arms this
+                        // once, for exactly one result.
+                        const aborted = this.aborting;
+                        this.aborting = false;
+                        const failure = msg.subtype === 'success' ? '' : classifyError(msg.subtype, msg.errors);
+                        if (failure && isRewindError(failure)) {
+                            // Not a failed turn — a refused resume. The CLI answers a bad
+                            // `resumeSessionAt` with exactly this and nothing else (no
+                            // `system:init`, no assistant message), so reporting it as a
+                            // turn failure moved the session to FAILED for a rewind that had
+                            // simply not been possible.
                             this.emit({
-                                type: 'turn_end',
-                                ok: false,
-                                errorMessage: classifyError(msg.subtype, msg.errors),
+                                type: 'error',
+                                message: classifyRunError(failure),
+                                code: 'rewind_failed',
                             });
                         }
+                        else if (msg.subtype === 'success' || aborted) {
+                            // A turn the user stopped is not a failed turn. Reporting it as
+                            // one moved the session to FAILED, which is terminal — pressing
+                            // Stop cost people the session they meant to keep.
+                            this.emit({ type: 'turn_end', ok: true, ...(aborted ? { aborted: true } : {}) });
+                        }
+                        else {
+                            this.emit({ type: 'turn_end', ok: false, errorMessage: failure });
+                        }
                         break;
                     }
                     default:
@@ -1526,7 +1634,11 @@ function stringifyContent(content) {
     return content === undefined ? '' : JSON.stringify(content);
 }
 function classifyError(subtype, errors) {
-    const detail = errors.length ? `: ${maskString(errors.join('; ').slice(0, 500))}` : '';
+    // Optional on purpose despite the SDK's type: a `result` without `errors`
+    // threw from inside the event pump, which the loop's catch turned into a
+    // plain `error` event — so the turn that failed never ENDED, and the session
+    // sat at RUNNING with no way to tell.
+    const detail = errors?.length ? `: ${maskString(errors.join('; ').slice(0, 500))}` : '';
     switch (subtype) {
         case 'error_max_budget_usd':
             return 'Session budget (USD) exceeded — the run was stopped';
@@ -1556,14 +1668,30 @@ function isAuthError(message) {
 function isResumeError(message) {
     return /no conversation found|session .{0,40}not found|could not resume|invalid session id/i.test(message);
 }
+/**
+ * The CLI refused the point we asked it to resume at.
+ *
+ * Its exact wording, captured from the CLI itself: «No message found with
+ * message.uuid of: <uuid>». It arrives as a `result` with no `system:init`
+ * before it, and the query then throws with the same sentence — so this is
+ * matched on both paths.
+ */
+function isRewindError(message) {
+    return /no message found with message\.uuid/i.test(message);
+}
 function errorCode(message) {
     if (isAuthError(message))
         return 'auth_expired';
+    if (isRewindError(message))
+        return 'rewind_failed';
     if (isResumeError(message))
         return 'resume_failed';
     return undefined;
 }
 export function classifyRunError(message) {
+    if (isRewindError(message)) {
+        return 'The conversation could not be rewound to that point — the agent still remembers everything after it';
+    }
     if (isAuthError(message)) {
         return 'Claude authentication expired on this server — re-login is required (claude setup-token)';
     }

package/dist/adapters/codex.js

@@ -135,6 +135,20 @@ class CodexSession {
     threadId = null;
     threadModel = null;
     activeTurnId = null;
+    /**
+     * Last turn this thread finished (ticket #126).
+     *
+     * `thread/fork { lastTurnId }` forks THROUGH this turn inclusive, dropping
+     * everything after it — which is exactly "rewind the conversation to here".
+     * Verified against the JSON schema the installed codex-cli 0.145.0 generates
+     * itself (`codex app-server generate-json-schema`): `lastTurnId` is part of
+     * the STABLE surface, not the experimental one.
+     *
+     * `thread/rollback` is deliberately not used: its own schema marks it
+     * "DEPRECATED: will be removed soon", it counts turns from the end rather
+     * than naming one, and it mutates the thread in place instead of forking.
+     */
+    lastCompletedTurnId = null;
     /** Plan card waiting for the user; approving it starts the real work. */
     heldPlan = null;
     lastCollabMode = null;
@@ -256,6 +270,19 @@ class CodexSession {
      * second; losing the conversation costs the whole context.
      */
     static RESUME_RETRY_DELAY_MS = 1_500;
+    /** Branch the thread at `lastTurnId`, dropping every later turn. */
+    async forkThread(threadId, lastTurnId) {
+        const result = asRecord(await this.client.request('thread/fork', {
+            threadId,
+            lastTurnId,
+            ...this.threadParams(),
+        }));
+        const thread = asRecord(result['thread']);
+        const id = str(thread['id']);
+        if (!id)
+            throw new Error('thread/fork returned no thread id');
+        return { id, model: str(result['model']) ?? null };
+    }
     async resumeThread(resumeId) {
         // Resume takes the SAME overrides as start, and it must: the per-thread MCP
         // overlay lives only in memory, so resuming with just a thread id brings the
@@ -273,6 +300,34 @@ class CodexSession {
     }
     async openThread() {
         const resumeId = this.spec.resumeProviderSessionId;
+        // Ticket #126, conversation rewind. Forking rather than resuming: the
+        // thread the user rewound away from stays on disk untouched, and the fork
+        // carries the same overrides every other entry point passes (the per-thread
+        // MCP overlay lives only in memory, so a thread opened without it comes
+        // back with no DevBridge access at all).
+        if (resumeId && this.spec.resumeAtAnchor) {
+            try {
+                return await this.forkThread(resumeId, this.spec.resumeAtAnchor);
+            }
+            catch (error) {
+                log.warn('codex: thread/fork failed — resuming the whole conversation', {
+                    sessionId: this.spec.sessionId,
+                    error: describe(error),
+                });
+                // Reported through the SAME channel as Claude's refused resume, so the
+                // supervisor withdraws the pending feed cut here too. A notice alone
+                // left the page believing a rewind had happened: it had already thrown
+                // away messages this thread still holds.
+                this.emit({
+                    type: 'error',
+                    message: 'The conversation could not be rewound to that point — the agent still remembers everything after it',
+                    code: 'rewind_failed',
+                    // This thread carries on below with a plain resume — there is
+                    // nothing for the supervisor to relaunch.
+                    recovered: true,
+                });
+            }
+        }
         if (resumeId) {
             try {
                 return await this.resumeThread(resumeId);
@@ -567,6 +622,33 @@ class CodexSession {
             log.warn('codex: interrupt failed', { error: describe(error) });
         }
     }
+    conversationAnchor() {
+        return this.lastCompletedTurnId;
+    }
+    /**
+     * `thread/compact/start` — a stable method of app-server 0.145.0, taking only
+     * the thread id and answering with an empty object; the summary itself
+     * arrives later as a `contextCompaction` item, which this adapter already
+     * turns into a notice.
+     *
+     * Until now compaction on this agent was entirely the agent's own business
+     * and the dashboard hid `/compact` from Codex sessions on the grounds that
+     * "that agent does not have it". It does.
+     */
+    async compact() {
+        if (!this.threadId || this.stopped)
+            return false;
+        if (this.activeTurnId)
+            return false;
+        try {
+            await this.client.request('thread/compact/start', { threadId: this.threadId });
+            return true;
+        }
+        catch (error) {
+            log.warn('codex: compaction refused', { error: describe(error) });
+            return false;
+        }
+    }
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -1140,6 +1222,12 @@ class CodexSession {
     onTurnCompleted(params) {
         const turn = asRecord(params['turn']);
         const status = str(turn['status']);
+        // Ticket #126: the anchor a conversation rewind is measured from. Only a
+        // COMPLETED turn may be one — `thread/fork` refuses a turn that is still in
+        // progress, and the id is taken from the notification rather than from
+        // `activeTurnId` so a steered turn anchors on what the thread actually
+        // recorded.
+        this.lastCompletedTurnId = str(turn['id']) ?? this.activeTurnId ?? this.lastCompletedTurnId;
         this.activeTurnId = null;
         // A held plan means the turn ended by proposing, not by finishing the work.
         if (this.heldPlan)
@@ -1153,8 +1241,14 @@ class CodexSession {
             });
             return;
         }
-        // `interrupted` is a user-initiated Stop: the session stays usable.
-        this.emit({ type: 'turn_end', ok: true });
+        // `interrupted` is a user-initiated Stop: the session stays usable. Named
+        // rather than merely tolerated, so the feed can tell "stopped" from
+        // "finished" — the same distinction the Claude adapter now draws.
+        this.emit({
+            type: 'turn_end',
+            ok: true,
+            ...(status === 'interrupted' ? { aborted: true } : {}),
+        });
         this.flushQueued();
     }
     onStderr(text) {

package/dist/adapters/types.d.ts

@@ -146,6 +146,21 @@ export interface SessionSpec {
     model?: string;
     effort?: string;
     resumeProviderSessionId?: string;
+    /**
+     * Resume the conversation only up to this anchor, dropping everything after
+     * it (ticket #126, conversation rewind).
+     *
+     * The value is whatever `AgentSession.conversationAnchor()` returned earlier
+     * in this session's life — a Claude message uuid or a Codex turn id. It is
+     * opaque to everything above the adapter, and it is only ever meaningful
+     * together with `resumeProviderSessionId`.
+     *
+     * Both agents answer this by FORKING rather than by truncating in place, so
+     * the original conversation is never destroyed: the adapter reports the new
+     * provider session id through `provider_session`, and the old one stays on
+     * disk exactly as it was.
+     */
+    resumeAtAnchor?: string;
     mcp?: McpConfig;
     maxBudgetUsd?: number;
 }
@@ -313,6 +328,14 @@ export type AgentEvent = {
     type: 'turn_end';
     ok: boolean;
     errorMessage?: string;
+    /**
+     * The turn ended because the user pressed Stop, not because it finished.
+     *
+     * Reported `ok: true` — a stop is not a failure — but named, so the feed
+     * can say «stopped» rather than «done» and so a stopped turn never reads
+     * as work the agent completed.
+     */
+    aborted?: boolean;
 } | {
     type: 'error';
     message: string;
@@ -323,7 +346,23 @@ export type AgentEvent = {
      * never signed in "expired" sent people looking for a problem that did
      * not exist.
      */
-    code?: 'resume_failed' | 'auth_expired' | 'auth_missing';
+    /**
+     * `rewind_failed` — the CLI refused the point we asked it to resume at
+     * (ticket #126). Recoverable and NOT a failed session: the conversation
+     * is intact, only the rewind did not happen, and the caller must say so
+     * rather than pretending it did.
+     */
+    code?: 'resume_failed' | 'auth_expired' | 'auth_missing' | 'rewind_failed';
+    /**
+     * The adapter has already dealt with it and the session is still running.
+     *
+     * Only meaningful with `rewind_failed`, and it is the difference between
+     * the two agents: Claude's refused resume kills the query, so the
+     * supervisor must bring the process back without the anchor; Codex falls
+     * back to a plain resume inside `openThread` and needs no relaunch at
+     * all. Both still have to withdraw the feed cut and say what happened.
+     */
+    recovered?: boolean;
 };
 export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
@@ -365,6 +404,26 @@ export interface AgentSession {
     }): void;
     /** Interrupt the current turn (session stays resumable). */
     interrupt(): Promise<void>;
+    /**
+     * An opaque id naming the conversation as it stands RIGHT NOW (ticket #126).
+     *
+     * Handed back later as `SessionSpec.resumeAtAnchor` to rewind the agent's
+     * memory to this exact point. `null` means the agent has nothing to anchor to
+     * yet — a session whose first turn has not finished — and the caller must
+     * then treat "rewind to here" as "start the conversation over".
+     *
+     * Claude: the uuid of the last message in its transcript.
+     * Codex:  the id of the last completed turn.
+     */
+    conversationAnchor(): string | null;
+    /**
+     * Ask the agent to summarise the conversation so far and continue from the
+     * summary — `/compact` in either CLI.
+     *
+     * Returns false when the agent is in no state to do it (mid-turn, or the
+     * call was refused); the caller says so rather than pretending it happened.
+     */
+    compact(): Promise<boolean>;
     /**
      * Tear the session down (kills the agent process). The reason travels so
      * anything the user was still being asked is withdrawn with a cause they can

package/dist/agent-auth.d.ts

@@ -0,0 +1,29 @@
+export declare function agentAuthPath(): string;
+/** The token we hold for Claude, or null once it is too old to trust. */
+export declare function storedClaudeToken(): string | null;
+export declare function storeClaudeToken(token: string): void;
+export declare function clearStoredClaudeToken(): void;
+/**
+ * Put a stored token into this process's environment, unless the operator
+ * already set one.
+ *
+ * Their variable wins on purpose: an explicitly exported
+ * `CLAUDE_CODE_OAUTH_TOKEN` in the unit or in `environment.d` is a deliberate
+ * choice, and silently overriding it with something we captured months ago is
+ * the kind of surprise this file exists to prevent.
+ *
+ * Returns true when it applied one.
+ */
+export declare function applyStoredClaudeToken(): boolean;
+/**
+ * The OAuth token `claude setup-token` printed, reassembled out of pty output.
+ *
+ * Written against how the output actually arrives rather than how it looks in a
+ * terminal: the pty wraps at its width, so a ~100-character token is routinely
+ * split across lines. Continuation lines are joined only while they consist
+ * ENTIRELY of token characters — prose ("Store this token securely") contains
+ * spaces or punctuation and stops the join, which is what keeps the reassembly
+ * from swallowing the sentence after it.
+ */
+export declare function extractOauthToken(text: string): string | null;
+//# sourceMappingURL=agent-auth.d.ts.map

package/dist/agent-auth.js

@@ -0,0 +1,136 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { configDir } from './paths.js';
+/**
+ * A Claude login this runner owns, for the one CLI that cannot store one.
+ *
+ * Background, because this file only makes sense with it. The dashboard's
+ * sign-in button relays a real OAuth flow to the machine — and until 0.27.0 it
+ * relayed `claude setup-token`, which is not a login at all. Measured against
+ * the 2.1.220 binary and confirmed by Anthropic's own docs: `setup-token` mints
+ * a long-lived INFERENCE-ONLY token, prints it, and «does not save the token
+ * anywhere». The runner threw the printed token away, then judged the login by
+ * reading `~/.claude/.credentials.json` — a file that command never writes. So
+ * the flow completed, the panel re-probed within a second, and answered «No
+ * Claude login on this server» underneath a success screen. That is the bug
+ * behind every «I signed in and it still says signed out».
+ *
+ * The main path is now `claude auth login`, which persists properly and needs
+ * nothing from this module. This exists for the fallback: a CLI old enough not
+ * to have `auth login` still has `setup-token`, and rather than leave that
+ * machine with no way in, we capture the token it prints and keep it ourselves.
+ * `CLAUDE_CODE_OAUTH_TOKEN` is already on the session env allowlist, so a stored
+ * token reaches the agent exactly like an operator-configured one.
+ *
+ * Stored on the machine, 0600, in the runner's own config directory. DevBridge
+ * never receives it: the token travels from the provider into a pty on this
+ * host and onto this host's disk.
+ */
+const FILE_MODE = 0o600;
+export function agentAuthPath() {
+    return path.join(configDir(), 'agent-auth.json');
+}
+/**
+ * How long a captured token is believed without further evidence.
+ *
+ * `claude setup-token` mints a one-year credential and there is no way to ask
+ * whether it is still good without spending a request. A stored token that
+ * never ages out is a green light nobody can turn off: the panel would keep
+ * saying «signed in» about a revoked account for as long as the file exists.
+ * Eleven months keeps it inside the token's own life while still expiring.
+ */
+const TOKEN_MAX_AGE_MS = 334 * 24 * 60 * 60 * 1000;
+function read() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(agentAuthPath(), 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/** The token we hold for Claude, or null once it is too old to trust. */
+export function storedClaudeToken() {
+    const file = read();
+    const value = file.claudeOauthToken;
+    if (typeof value !== 'string' || value.length === 0)
+        return null;
+    const stamped = typeof file.updatedAt === 'string' ? Date.parse(file.updatedAt) : NaN;
+    if (Number.isFinite(stamped) && Date.now() - stamped > TOKEN_MAX_AGE_MS)
+        return null;
+    return value;
+}
+export function storeClaudeToken(token) {
+    const dir = configDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = agentAuthPath();
+    // Same write-then-rename as the config: a torn file here reads as «signed
+    // out» and sends somebody through the whole login again.
+    const tmp = path.join(dir, `.agent-auth.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, `${JSON.stringify({ claudeOauthToken: token, updatedAt: new Date().toISOString() }, null, 2)}\n`, { mode: FILE_MODE });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, FILE_MODE);
+}
+export function clearStoredClaudeToken() {
+    try {
+        fs.rmSync(agentAuthPath(), { force: true });
+    }
+    catch {
+        /* nothing to clear */
+    }
+}
+/**
+ * Put a stored token into this process's environment, unless the operator
+ * already set one.
+ *
+ * Their variable wins on purpose: an explicitly exported
+ * `CLAUDE_CODE_OAUTH_TOKEN` in the unit or in `environment.d` is a deliberate
+ * choice, and silently overriding it with something we captured months ago is
+ * the kind of surprise this file exists to prevent.
+ *
+ * Returns true when it applied one.
+ */
+export function applyStoredClaudeToken() {
+    if (process.env['CLAUDE_CODE_OAUTH_TOKEN'])
+        return false;
+    const token = storedClaudeToken();
+    if (!token)
+        return false;
+    process.env['CLAUDE_CODE_OAUTH_TOKEN'] = token;
+    return true;
+}
+/**
+ * The OAuth token `claude setup-token` printed, reassembled out of pty output.
+ *
+ * Written against how the output actually arrives rather than how it looks in a
+ * terminal: the pty wraps at its width, so a ~100-character token is routinely
+ * split across lines. Continuation lines are joined only while they consist
+ * ENTIRELY of token characters — prose ("Store this token securely") contains
+ * spaces or punctuation and stops the join, which is what keeps the reassembly
+ * from swallowing the sentence after it.
+ */
+export function extractOauthToken(text) {
+    const lines = text.split('\n').map((line) => line.trim());
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? '';
+        const start = line.match(/sk-ant-oat[0-9]*-[A-Za-z0-9_-]*$/);
+        // The token must run to the end of its line; anything after it on the same
+        // line means this is prose mentioning a token, not the token itself.
+        if (!start)
+            continue;
+        let token = start[0];
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = lines[j] ?? '';
+            if (!/^[A-Za-z0-9_-]+$/.test(next))
+                break;
+            token += next;
+        }
+        // Long enough to be real, short enough not to be a runaway join.
+        if (token.length >= 40 && token.length <= 400)
+            return token;
+    }
+    return null;
+}
+//# sourceMappingURL=agent-auth.js.map

package/dist/attachments.d.ts

@@ -67,6 +67,17 @@ export declare function saveAttachments(input: {
     saved: SavedAttachment[];
     failed: string[];
 }>;
+/**
+ * Delete old attachments from a session worktree.
+ *
+ * These files are invisible to git by design, which also means nothing else
+ * will ever clean them up: a long-lived workspace would accumulate every
+ * screenshot and archive anyone attached to it, on the owner's own disk. Age
+ * first, then a size budget for the case where age alone is not enough.
+ *
+ * Best effort — a folder we cannot prune is not a reason to lose the message.
+ */
+export declare function pruneAttachmentDir(dir: string, now?: number): void;
 /**
  * Turn the user's message plus the files into one prompt.
  *
@@ -74,6 +85,22 @@ export declare function saveAttachments(input: {
  * files with their own tools, and an agent-specific encoding (image blocks for
  * Claude, `localImage` items for Codex) would be two code paths that drift.
  * The user's own words stay first — the files are context, not the request.
+ *
+ * Each line NAMES the file and stops there (#128). The old version ended every
+ * list with «Open them before answering — images included», which was false for
+ * a `.zip` — there is nothing to look at — and false for a `.docx`. An
+ * instruction that is wrong for the file in front of the agent is worse than no
+ * instruction: it produces a confident answer about a document nobody opened.
+ *
+ * What we deliberately do NOT do is decide for the agent. Unpacking an archive,
+ * or extracting a document's text and handing over our version of it, would put
+ * DevBridge in charge of a job the agent does better with the whole file in
+ * front of it — and would mean the agent answers about what WE chose to show,
+ * not about what the person actually attached.
+ *
+ * The closing line is a trust frame, not decoration. These files come from a
+ * person through a web form; anything inside one that reads like an order to
+ * the agent is data, not authority (react-security-standards AI.2/AI.3).
  */
 export declare function composeMessageWithAttachments(text: string, saved: SavedAttachment[]): string;
 //# sourceMappingURL=attachments.d.ts.map