@bridge4dev/runner 0.29.0 → 0.30.0

package/dist/adapters/claude.js

@@ -5,7 +5,7 @@ import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { mcpConfigPath } from '../paths.js';
 import { evaluateToolUse, maskSecrets, maskString } from '../policy.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Claude adapter over the Agent SDK. Three live-verified gotchas (plan §2):
 //  1. Bare tool names in `allowedTools` auto-approve BEFORE canUseTool — we
@@ -65,14 +65,77 @@ export function scrubbedEnv() {
     }
     return env;
 }
+/**
+ * The one env var the allowlist above refuses, added back for exactly one mode
+ * (ticket #156).
+ *
+ * The CLI's own guard, read out of the binary verbatim:
+ *
+ * ```js
+ * if (t === "bypassPermissions" || r) {
+ *   if (typeof process.getuid === "function" && process.getuid() === 0
+ *       && process.env.IS_SANDBOX !== "1" && !Z.CLAUDE_CODE_BUBBLEWRAP)
+ *     console.error("--dangerously-skip-permissions cannot be used with root/sudo privileges …"),
+ *     process.exit(1)
+ * }
+ * ```
+ *
+ * The runner's default install is root (`install.sh`), so on an ordinary
+ * machine «Unrestricted» did not degrade — it killed the session at launch with
+ * exit code 1. On the machine this was found on it happened to start, because
+ * `~/.claude/settings.json` carries `env: { IS_SANDBOX: "1" }` and this adapter
+ * loads user settings; that is a hole in the scrub covering a bug, not a fix.
+ *
+ * The condition here is the CLI's own, no wider: `full` AND uid 0. It is safe
+ * precisely where it is applied — `bypassPermissions` is the mode in which the
+ * SDK never calls `canUseTool` (it says so itself), so layer 1 is already inert
+ * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
+ * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
+ */
+function agentEnv(mode) {
+    const env = scrubbedEnv();
+    if (mode === 'full' && process.getuid?.() === 0)
+        env['IS_SANDBOX'] = '1';
+    return env;
+}
 // Normalized mode → Claude permission mode (session-5 plan §2). `full` is the
 // owner's explicit call (2026-07-24): "same as Claude works now, we don't
 // restrict anything" — in that mode the SDK stops calling canUseTool at all,
 // so the layer-1 policy cannot gate tools either; the dashboard says so.
+//
+// `auto` maps to the CLI's `default` rung, and the reason is the whole of
+// QA-128's one surviving BLOCKER — it was `'auto'` for most of this ticket and
+// had to come back.
+//
+// The CLI's own `auto` rung runs a MODEL CLASSIFIER over each tool call, and
+// what the classifier approves never becomes a `can_use_tool` request. This
+// adapter's only route into layer 1 is `canUseTool`. So in that rung
+// `evaluateToolUse` is not consulted, and the rules the product calls
+// unconditional — `sudo`, `git push`, docker control, secret paths, writes
+// outside the worktree, anything inside `.git` — are simply not applied.
+//
+// Measured, not reasoned. Same adapter, same options, only the model differs:
+//
+//   sonnet  (has the auto rung)  : `sudo -n id` → ran, policy consulted 0 times
+//   haiku-4.5 (has no auto rung) : `sudo -n id` → DENIED by policy
+//
+// Haiku is why this took a second pass to see: it refuses the rung outright
+// (`auto mode unavailable for this model`) and the CLI quietly falls back to
+// `default`, so a probe run on it shows the layer working perfectly.
+//
+// Nothing is lost by mapping to `default`. The CLI's rung was never what made
+// «Auto» mean «only the hard limits» — `effectiveTrust(trust, 'auto') → AUTO`
+// in `policy.ts` is, and it needs `canUseTool` to be reached to say so. What
+// `default` gives up is the classifier's convenience; what it keeps is the only
+// place the hard limits are enforced at all.
+//
+// `full` is the deliberate exception: `bypassPermissions` also stops calling
+// `canUseTool`, and there that IS the meaning of the mode — the dashboard says
+// so, and STRICT workspaces are not offered it.
 const MODE_TO_PERMISSION = {
     ask: 'default',
     plan: 'plan',
-    auto: 'acceptEdits',
+    auto: 'default',
     full: 'bypassPermissions',
 };
 const SYSTEM_APPEND = [
@@ -186,6 +249,23 @@ class ClaudeSession {
     /** Guards against overlapping capability probes. */
     capabilitiesInFlight = false;
     mode;
+    /**
+     * A launch-time mode this workspace does not allow, remembered so the feed
+     * can say so once the event queue is live (`full` on a STRICT workspace).
+     */
+    modeRefusedAtLaunch = null;
+    /**
+     * This process was launched with the bypass capability, so `setPermissionMode`
+     * may reach `bypassPermissions` on it.
+     *
+     * The CLI ties the capability to the LAUNCH, not to the current mode: a
+     * session started with the flag can be tightened to `default` and raised back
+     * to bypass freely (both verified live), while one started without it is
+     * refused outright. So this is the honest predicate for
+     * `modeSwitchNeedsRelaunch`, and it is not the same question as
+     * «is the mode `full` right now».
+     */
+    launchedWithBypass;
     model;
     /**
      * Reasoning effort pinned for this session (ticket #111).
@@ -283,7 +363,17 @@ class ClaudeSession {
     events = this.output;
     constructor(spec, queryFn) {
         this.spec = spec;
-        this.mode = spec.mode ?? 'ask';
+        // Refused rather than honoured, and BEFORE anything is built from it: on a
+        // STRICT workspace `full` would launch the CLI in `bypassPermissions`, and
+        // there layer 1 is never consulted — the manager's shield would be spent by
+        // whoever opened the session (ticket #156). The notice goes out in the
+        // constructor's own emit block below, once `output` can carry it.
+        const requested = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requested) ? requested : 'ask';
+        if (this.mode !== requested) {
+            this.modeRefusedAtLaunch = requested;
+        }
+        this.launchedWithBypass = this.mode === 'full';
         if (spec.model)
             this.model = spec.model;
         // Gated, not copied: a pin stored against a model that no longer offers it
@@ -313,7 +403,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: scrubbedEnv(),
+            env: agentEnv(this.mode),
             /**
              * Everything the machine's own Claude has (owner's call, 2026-07-30).
              *
@@ -335,6 +425,14 @@ class ClaudeSession {
              */
             settingSources: ['user', 'project', 'local'],
             permissionMode: MODE_TO_PERMISSION[this.mode],
+            // The SDK's own words: "Must be set to `true` when using
+            // `permissionMode: 'bypassPermissions'`." It was never set, so
+            // «Unrestricted» asked the CLI for a mode it had not been given
+            // permission to offer (ticket #156). Passed only for `full`: as root the
+            // CLI refuses to START at all when this flag is present without
+            // `IS_SANDBOX=1`, so setting it unconditionally would take every mode
+            // down with it — verified live, exit code 1 on a plain `ask` session.
+            ...(this.mode === 'full' ? { allowDangerouslySkipPermissions: true } : {}),
             systemPrompt: {
                 type: 'preset',
                 preset: 'claude_code',
@@ -402,6 +500,10 @@ class ClaudeSession {
         if (this.mcpFallbackNotice) {
             this.emit({ type: 'notice', level: 'warn', text: this.mcpFallbackNotice });
         }
+        if (this.modeRefusedAtLaunch) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         this.lastTaskFingerprint = JSON.stringify({ done: 0, total: 0, tasks: [] });
         this.emit({ type: 'agent_tasks', tasks: [], done: 0, total: 0 });
         // Report what the agent can do right away. `system:init` only arrives with
@@ -605,7 +707,11 @@ class ClaudeSession {
         this.adoptLiveModel(this.liveWireModel ?? this.model);
         const capabilities = {
             models: this.knownModels,
-            modes: [...AGENT_MODES],
+            // Read from `spec` on every publication, not captured once: the workspace
+            // trust level changes under a running session (`setWorkspacePolicy`), and
+            // a manager tightening to STRICT has to see «Unrestricted» leave the
+            // picker rather than stay there as an offer that will be refused.
+            modes: availableModes(this.spec.trustMode),
             // Cap the list: it lands in an event payload with a hard size limit.
             commands: commands.slice(0, 150).map((c) => ({
                 name: c.name,
@@ -683,10 +789,103 @@ class ClaudeSession {
         // worst case. Fire-and-forget, same as the end-of-turn call.
         this.refreshContextUsage();
     }
+    /**
+     * Can this live process reach `mode`, or does the supervisor have to bring a
+     * new one up? (ticket #156)
+     *
+     * Only the `full` boundary matters, and only in the direction the CLI
+     * refuses. Crossing it OUTWARD works live — a bypass-launched session accepts
+     * `setPermissionMode('default')` and starts consulting `canUseTool` again,
+     * verified live — but it is answered `true` here as well, deliberately: that
+     * process still carries `--allow-dangerously-skip-permissions` and, as root,
+     * `IS_SANDBOX=1`. Leaving a session that is once more gated running with the
+     * ungated process's environment is the kind of residue that is correct today
+     * and quietly wrong after the next CLI release. One rule, both directions,
+     * nothing left over.
+     */
+    modeSwitchNeedsRelaunch(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode))
+            return false;
+        return (mode === 'full') !== this.launchedWithBypass;
+    }
     async setMode(mode) {
-        await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            // The picker has already moved; say what the mode actually is so it moves
+            // back, instead of showing a setting the session is not in.
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
+        // The mode is recorded whatever the CLI says (QA-128). Its permission rung
+        // is an optimisation; the layer that produces the cards a user sees is
+        // ours, and it reads `this.mode`. Leaving the field behind because the CLI
+        // does not offer `auto` on this model would be #157 all over again.
+        await this.applyPermissionMode(mode);
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157. The cards already on screen are the reason a person reaches
+        // for this control in the first place — the agent has stopped and is
+        // waiting on one. Judging only the NEXT tool call left the visible one
+        // exactly where it was, which reads as «the switch did nothing».
+        this.releasePermissionsAllowedNow();
+    }
+    /**
+     * Move the live CLI to this mode's permission rung, degrading rather than
+     * throwing when it refuses one (QA-128).
+     *
+     * Never rethrows: the caller has already decided what the session's mode is,
+     * and the CLI's opinion about its own rung must not undo that.
+     */
+    async applyPermissionMode(mode) {
+        try {
+            await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        }
+        catch (error) {
+            // Swallowed on purpose. The CLI refuses rungs per MODEL, not only per
+            // request — `Cannot set permission mode to auto: auto mode unavailable
+            // for this model`, measured on `claude-haiku-4-5`, which our own picker
+            // offers. Letting that throw is what the caller must never allow: the
+            // exception would land before `this.mode` is written, the dashboard would
+            // show the new mode, and the layer that raises the cards would still be
+            // on the old one. That is ticket #157, reproduced by its own fix.
+            log.warn('claude: setPermissionMode refused — the session mode still stands', {
+                wanted: MODE_TO_PERMISSION[mode],
+                error: String(error),
+            });
+        }
+    }
+    /**
+     * Re-judge every open permission card under the rules in force NOW, and let
+     * through the ones that no longer need a human (ticket #157).
+     *
+     * Only in the permissive direction: a card that becomes `deny` or stays `ask`
+     * is left alone. Denying something the user is looking at — and had every
+     * right to approve — would be taking a decision away from them, which is the
+     * mistake session 12 spent its whole length undoing.
+     */
+    releasePermissionsAllowedNow() {
+        for (const [requestId, pending] of [...this.pending]) {
+            if (!pending.fromPolicy)
+                continue;
+            const verdict = evaluateToolUse(pending.toolName, pending.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+            pending.resolve({ behavior: 'allow', updatedInput: pending.input });
+        }
     }
     /**
      * Session 15: the project's trust level and auto-commit switch, changed
@@ -694,10 +893,50 @@ class ClaudeSession {
      * every tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // The manager tightened to STRICT while this session was running with
+        // nothing gated. Waiting for a relaunch would leave the shield down for the
+        // rest of the turn, so this one is applied live and immediately: the CLI
+        // accepts a TIGHTENING from bypass on the same process (verified live), and
+        // from the next tool call `canUseTool` — and layer 1 with it — is consulted
+        // again. The process keeps the launch flags it can no longer use; being
+        // gated a moment sooner is worth more than that tidiness.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            // The WITHDRAWN sentence, not the refusal one (QA-128): nobody in this
+            // session asked for anything — a manager changed the project.
+            this.emit({ type: 'notice', level: 'warn', text: MODE_WITHDRAWN_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+            void this.q.setPermissionMode(MODE_TO_PERMISSION[this.mode]).catch((error) => {
+                // The control request is the ONLY thing standing between «the manager
+                // set this project to Strict» and an agent that still gates nothing
+                // (QA-128). A warning in journald is not a response to that: if the
+                // process will not be tightened, it does not get to keep running.
+                log.warn('claude: could not tighten a full session after a STRICT switch', {
+                    error: String(error),
+                });
+                this.emit({
+                    type: 'notice',
+                    level: 'warn',
+                    text: 'This project was set to Strict trust and the running agent refused to switch its permission checks back on, so the session was stopped. Start it again to continue.',
+                });
+                this.stop('session_stopped');
+            });
+        }
+        // A tightening to STRICT has to take `full` out of the picker, and a
+        // loosening has to put it back — the list is computed from `spec` and only
+        // reaches the dashboard through a capabilities frame (ticket #156).
+        this.refreshCapabilities();
+        // Loosening the workspace releases what it no longer needs a human for, the
+        // same way a mode switch does. Tightening changes nothing here on purpose:
+        // this only ever lets cards through, never withdraws one.
+        this.releasePermissionsAllowedNow();
     }
     /**
      * Change the reasoning-effort level (tickets #111, #112).
@@ -1055,6 +1294,9 @@ class ClaudeSession {
         }
         const verdict = evaluateToolUse(toolName, input, {
             trustMode: this.spec.trustMode,
+            // Ticket #156: the missing argument. Everything else in this object was
+            // already here; the session's own mode was not, so «Auto» decided nothing.
+            mode: this.mode,
             ...(this.spec.agentAutoCommit === undefined
                 ? {}
                 : { agentAutoCommit: this.spec.agentAutoCommit }),
@@ -1082,10 +1324,13 @@ class ClaudeSession {
             ...(opts.description ? { description: opts.description } : {}),
             input: truncateInput(input),
         });
-        return this.waitForAnswer(opts, toolName);
+        return this.waitForAnswer(opts, toolName, input);
     }
     /** Park the tool call until the dashboard answers (or the request aborts). */
-    waitForAnswer(opts, toolName) {
+    waitForAnswer(opts, toolName, 
+    // The RAW input, not the truncated copy that went on the card: this is what
+    // the tool is released with, and what a later re-judgement is judged on.
+    input) {
         return new Promise((resolve) => {
             const settle = (result) => {
                 if (this.pending.delete(opts.requestId))
@@ -1093,6 +1338,8 @@ class ClaudeSession {
             };
             this.pending.set(opts.requestId, {
                 toolName,
+                input: input ?? {},
+                fromPolicy: input !== undefined,
                 resolve: settle,
             });
             opts.signal.addEventListener('abort', () => {

package/dist/adapters/codex.js

@@ -5,7 +5,7 @@ import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
 import { truncate } from './claude.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
 // contract is unchanged, so the dashboard renders Codex sessions with the same
@@ -153,6 +153,8 @@ class CodexSession {
     heldPlan = null;
     lastCollabMode = null;
     mode;
+    /** A launch-time `full` this STRICT workspace does not allow (ticket #156). */
+    modeRefusedAtLaunch = false;
     model;
     effort;
     /** Last model catalogue from `model/list` — effort sets differ per model. */
@@ -164,7 +166,13 @@ class CodexSession {
     constructor(spec, home, deps) {
         this.spec = spec;
         this.home = home;
-        this.mode = spec.mode ?? 'ask';
+        // `full` on a STRICT workspace is refused, not honoured: Codex in that mode
+        // sends no approvals at all, so layer 1 never runs and the manager's shield
+        // would be spent from the chat (ticket #156).
+        const requestedMode = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requestedMode) ? requestedMode : 'ask';
+        if (this.mode !== requestedMode)
+            this.modeRefusedAtLaunch = true;
         this.model = spec.model;
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
@@ -183,6 +191,10 @@ class CodexSession {
                 cwd: spec.cwd,
                 ...wiring,
             });
+        if (this.modeRefusedAtLaunch) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         void this.boot();
     }
     // ─── Boot ──────────────────────────────────────────────────────────
@@ -590,10 +602,28 @@ class CodexSession {
      * tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // A manager tightened the project out from under a session that is running
+        // with nothing gated (QA-128). Codex carries `approvalPolicy` on the next
+        // `turn/start`, so recording the mode here IS the fix — the next turn is
+        // `on-request` and layer 1 sees every command again. Claude does the same
+        // thing through `setPermissionMode`; leaving this out of one adapter left
+        // the picker showing a mode that was no longer in its own list.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            this.notice('warn', MODE_WITHDRAWN_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
+        // `full` leaves (or rejoins) the picker with the trust level — the list is
+        // computed from `spec` and only travels in a capabilities frame (#156).
+        this.refreshCapabilities();
+        this.releaseApprovalsAllowedNow();
     }
     async setEffort(effort) {
         if (effort)
@@ -603,9 +633,56 @@ class CodexSession {
         this.emit({ type: 'settings', effort });
         this.refreshCapabilities();
     }
+    /**
+     * Codex needs no new process for any mode: `approvalPolicy` and the sandbox
+     * policy travel with the next `turn/start`, so the change is in force from
+     * the next turn whatever it is (ticket #156).
+     */
+    modeSwitchNeedsRelaunch(_mode) {
+        return false;
+    }
     async setMode(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157 — the card the user is looking at is the reason they reached
+        // for the control; judging only the next one leaves it sitting there.
+        this.releaseApprovalsAllowedNow();
+    }
+    /**
+     * Re-judge every open approval under the rules in force NOW and accept the
+     * ones that no longer need a human (ticket #157). Permissive direction only:
+     * a card that would now be denied is left for the user, because taking a
+     * decision away from them is the mistake session 12 exists to undo.
+     */
+    releaseApprovalsAllowedNow() {
+        for (const [requestId, pending] of [...this.approvals]) {
+            if (!pending.policy)
+                continue;
+            const verdict = evaluateToolUse(pending.policy.tool, pending.policy.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.approvals.delete(requestId);
+            this.client.respond(pending.rpcId, { decision: 'accept' });
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+        }
     }
     async interrupt() {
         if (!this.threadId || !this.activeTurnId)
@@ -705,6 +782,9 @@ class CodexSession {
             ? { decision: 'ask', reason: 'details unavailable' }
             : evaluateToolUse(enriched.policyTool, enriched.policyInput, {
                 trustMode: this.spec.trustMode,
+                // Ticket #156, the same missing argument as in the Claude adapter —
+                // both bridges call one policy, so both have to hand it the mode.
+                mode: this.mode,
                 ...(this.spec.agentAutoCommit === undefined
                     ? {}
                     : { agentAutoCommit: this.spec.agentAutoCommit }),
@@ -725,7 +805,11 @@ class CodexSession {
             });
             return;
         }
-        this.approvals.set(requestId, { rpcId: request.id, toolName: enriched.toolName });
+        this.approvals.set(requestId, {
+            rpcId: request.id,
+            toolName: enriched.toolName,
+            policy: enriched.forceAsk ? null : { tool: enriched.policyTool, input: enriched.policyInput },
+        });
         this.emit({
             type: 'permission',
             requestId,
@@ -1295,7 +1379,10 @@ class CodexSession {
         const currentEffort = this.effort ?? models.find((m) => m.id === currentModel)?.defaultEffort ?? undefined;
         const capabilities = {
             models,
-            modes: [...AGENT_MODES],
+            // Recomputed on every publication rather than captured: the workspace's
+            // trust level changes under a running session, and `full` has to leave
+            // the picker with it (ticket #156).
+            modes: availableModes(this.spec.trustMode),
             commands,
             currentMode: this.mode,
             ...(currentModel ? { currentModel } : {}),

package/dist/adapters/types.d.ts

@@ -5,14 +5,48 @@ export interface McpConfig {
 }
 /**
  * Agent-agnostic interaction mode (session-5 plan §2).
- *  ask  — ask before acting               (Claude `default`,  Codex `on-request`)
- *  plan — plan first, act after approval  (Claude `plan`,     Codex on-request + plan)
- *  auto — apply edits silently            (Claude `acceptEdits`, Codex `on-failure`)
+ *  ask  — ask before acting               (Claude `default`, Codex `on-request`)
+ *  plan — plan first, act after approval  (Claude `plan`,    Codex on-request + plan)
+ *  auto — work on its own, hard limits only (Claude `auto`,  Codex on-request + workspace-write)
  *  full — never ask                       (Claude `bypassPermissions`, Codex `never`)
+ *
+ * The mode is BOTH halves of the decision, and that took a bug to learn
+ * (ticket #156): it sets the agent CLI's own permission mode, AND it reaches
+ * `evaluateToolUse` as `PolicyContext.mode`. For four sessions it did only the
+ * first, so «Auto» moved a dial the layer that raises the cards never read.
  */
 export type AgentMode = 'ask' | 'plan' | 'auto' | 'full';
 export declare const AGENT_MODES: readonly AgentMode[];
 export declare function isAgentMode(value: unknown): value is AgentMode;
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export declare const MODE_REFUSED_TEXT = "\u00ABUnrestricted\u00BB is not available on this project. Its trust level is Strict, and \u00ABUnrestricted\u00BB is the one mode in which DevBridge checks nothing \u2014 the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.";
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export declare const MODE_WITHDRAWN_TEXT = "This project was just set to Strict trust, so \u00ABUnrestricted\u00BB is no longer available and this session now asks about every command. Nothing you did caused this \u2014 a project manager changed it in the server panel.";
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export declare function availableModes(trustMode: TrustMode): AgentMode[];
 /**
  * A reasoning-effort level a model supports. Codex advertises these per model
  * (`supportedReasoningEfforts`) and the set differs between models — the new
@@ -388,6 +422,24 @@ export interface AgentSession {
     setEffort(effort: string | null): Promise<void>;
     /** Switch interaction mode mid-session. */
     setMode(mode: AgentMode): Promise<void>;
+    /**
+     * Can this session reach `mode` without a new agent process? (ticket #156)
+     *
+     * Claude answers `false` for any move across the `full` boundary, and that is
+     * the CLI's rule rather than ours: `bypassPermissions` may only be entered by
+     * a process LAUNCHED with the dangerous flag, and the control request is
+     * refused outright otherwise —
+     *
+     *   Cannot set permission mode to bypassPermissions because the session was
+     *   not launched with --dangerously-skip-permissions
+     *
+     * (verified live against the bundled CLI 2.1.218). Until this existed the
+     * supervisor caught that error, turned it into a `notice`, and left the user
+     * with a picker reading «Unrestricted» over a session that was still asking.
+     *
+     * Codex answers `true` always: its policy travels with the next `turn/start`.
+     */
+    modeSwitchNeedsRelaunch(mode: AgentMode): boolean;
     /**
      * Project-level policy changed while this session is running (session 15).
      *

package/dist/adapters/types.js

@@ -2,4 +2,35 @@ export const AGENT_MODES = ['ask', 'plan', 'auto', 'full'];
 export function isAgentMode(value) {
     return typeof value === 'string' && AGENT_MODES.includes(value);
 }
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export const MODE_REFUSED_TEXT = '«Unrestricted» is not available on this project. Its trust level is Strict, and «Unrestricted» is the one mode in which DevBridge checks nothing — the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.';
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export const MODE_WITHDRAWN_TEXT = 'This project was just set to Strict trust, so «Unrestricted» is no longer available and this session now asks about every command. Nothing you did caused this — a project manager changed it in the server panel.';
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export function availableModes(trustMode) {
+    return trustMode === 'STRICT' ? AGENT_MODES.filter((mode) => mode !== 'full') : [...AGENT_MODES];
+}
 //# sourceMappingURL=types.js.map

package/dist/policy.d.ts

@@ -1,6 +1,20 @@
+import type { AgentMode } from './adapters/types.js';
 export type TrustMode = 'STRICT' | 'NORMAL' | 'AUTO';
 export interface PolicyContext {
     trustMode: TrustMode;
+    /**
+     * The interaction mode the SESSION is in — the dial in the composer, as
+     * opposed to `trustMode`, which is the workspace's (ticket #156).
+     *
+     * It was missing here for four sessions, and that is the whole of #156: the
+     * user switched to «Auto» and the agent went on asking, because the function
+     * that decides whether to ask had never heard of the mode. A control that
+     * moves a value nothing reads is worse than a missing one.
+     *
+     * `undefined` means an older API/runner pair that does not send it, and there
+     * the answer stays exactly what it has always been — see `effectiveTrust`.
+     */
+    mode?: AgentMode;
     /** The session worktree — the only place the agent may write. */
     worktreePath: string;
     /**
@@ -76,5 +90,31 @@ export interface RecipeCommandDecision {
  * nowhere else. Without the name, the refusal stands and says why.
  */
 export declare function evaluateRecipeCommand(command: string, ctx?: RecipeCommandContext): RecipeCommandDecision;
+/**
+ * Fold the workspace's trust level and the session's mode into the one value
+ * the rules below actually consult (ticket #156).
+ *
+ * Three rules, and each is a sentence:
+ *
+ *  1. **`auto` rises to AUTO** — «only the hard limits». This is what makes the
+ *     button mean what it says: Claude's own Auto does not stop to ask about
+ *     `grep … | head`, and neither does this one any more. The hard denials
+ *     below — `sudo`, `git push`, docker control, secret paths, writes outside
+ *     the worktree, anything inside `.git` — are not part of the deal and are
+ *     checked before this value is ever read.
+ *  2. **`ask`/`plan` never rise above NORMAL.** On an AUTO-trust workspace
+ *     «Ask first» used to ask about nothing at all, which is a label that lies.
+ *     This is the one direction that is STRICTER than before, and it is strict
+ *     only where the old behaviour contradicted the word on the control.
+ *  3. **STRICT cannot be unlocked from the chat.** That is the entire reason
+ *     STRICT exists: a manager sets it on the workspace, and no session-level
+ *     dial may spend it. `full` is refused outright on such a workspace — see
+ *     `availableModes` in the adapters, because in `bypassPermissions` this
+ *     function is never called at all and a shield nobody consults is no shield.
+ *
+ * `mode === undefined` (an API or runner from before this release) returns the
+ * workspace trust unchanged, which is exactly the old behaviour.
+ */
+export declare function effectiveTrust(trustMode: TrustMode, mode?: AgentMode): TrustMode;
 export declare function evaluateToolUse(toolName: string, input: Record<string, unknown>, ctx: PolicyContext): PolicyDecision;
 //# sourceMappingURL=policy.d.ts.map

package/dist/policy.js

@@ -602,7 +602,46 @@ const AGENT_COMMIT = new RegExp(String.raw `\bgit\s+${FLAGS}commit\b`);
 // ─── Tool-use evaluation ─────────────────────────────────────────────
 const READ_TOOLS = new Set(['Read', 'Glob', 'Grep', 'NotebookRead']);
 const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
+/**
+ * Fold the workspace's trust level and the session's mode into the one value
+ * the rules below actually consult (ticket #156).
+ *
+ * Three rules, and each is a sentence:
+ *
+ *  1. **`auto` rises to AUTO** — «only the hard limits». This is what makes the
+ *     button mean what it says: Claude's own Auto does not stop to ask about
+ *     `grep … | head`, and neither does this one any more. The hard denials
+ *     below — `sudo`, `git push`, docker control, secret paths, writes outside
+ *     the worktree, anything inside `.git` — are not part of the deal and are
+ *     checked before this value is ever read.
+ *  2. **`ask`/`plan` never rise above NORMAL.** On an AUTO-trust workspace
+ *     «Ask first» used to ask about nothing at all, which is a label that lies.
+ *     This is the one direction that is STRICTER than before, and it is strict
+ *     only where the old behaviour contradicted the word on the control.
+ *  3. **STRICT cannot be unlocked from the chat.** That is the entire reason
+ *     STRICT exists: a manager sets it on the workspace, and no session-level
+ *     dial may spend it. `full` is refused outright on such a workspace — see
+ *     `availableModes` in the adapters, because in `bypassPermissions` this
+ *     function is never called at all and a shield nobody consults is no shield.
+ *
+ * `mode === undefined` (an API or runner from before this release) returns the
+ * workspace trust unchanged, which is exactly the old behaviour.
+ */
+export function effectiveTrust(trustMode, mode) {
+    if (trustMode === 'STRICT')
+        return 'STRICT';
+    if (mode === undefined)
+        return trustMode;
+    if (mode === 'auto' || mode === 'full')
+        return 'AUTO';
+    // ask / plan — at most NORMAL, never AUTO.
+    return trustMode === 'AUTO' ? 'NORMAL' : trustMode;
+}
 export function evaluateToolUse(toolName, input, ctx) {
+    // Read ONCE, here, and never `ctx.trustMode` again below: the branches that
+    // follow are the whole of layer 1, and a single one still reading the raw
+    // workspace value would be a hole in exactly the shape of #156.
+    const trust = effectiveTrust(ctx.trustMode, ctx.mode);
     // DevBridge MCP tools are the agent's job interface — always fine.
     if (toolName.startsWith('mcp__devbridge__')) {
         return { decision: 'allow', reason: 'devbridge mcp' };
@@ -633,9 +672,9 @@ export function evaluateToolUse(toolName, input, ctx) {
                 }
             }
         }
-        if (ctx.trustMode === 'STRICT')
+        if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
-        if (ctx.trustMode === 'AUTO')
+        if (trust === 'AUTO')
             return { decision: 'allow', reason: 'auto mode' };
         if (isSafeCommand(command)) {
             return { decision: 'allow', reason: 'safe command' };
@@ -667,22 +706,22 @@ export function evaluateToolUse(toolName, input, ctx) {
         if (WRITE_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
             return { decision: 'deny', reason: 'writes outside the session worktree are not allowed' };
         }
-        if (ctx.trustMode === 'STRICT')
+        if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
         if (READ_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
-            return ctx.trustMode === 'AUTO'
+            return trust === 'AUTO'
                 ? { decision: 'allow', reason: 'auto mode' }
                 : { decision: 'ask', reason: 'read outside the worktree' };
         }
         return { decision: 'allow', reason: 'inside worktree' };
     }
     if (toolName === 'WebFetch' || toolName === 'WebSearch') {
-        if (ctx.trustMode === 'STRICT')
+        if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
         return { decision: 'allow', reason: 'network read' };
     }
     // Unknown tools: ask unless the workspace is fully trusted.
-    if (ctx.trustMode === 'AUTO')
+    if (trust === 'AUTO')
         return { decision: 'allow', reason: 'auto mode' };
     return { decision: 'ask', reason: `unrecognized tool ${toolName}` };
 }

package/dist/supervisor.d.ts

@@ -317,6 +317,10 @@ export declare class Supervisor {
     private interruptSession;
     /** Live model / interaction-mode switch (persisted for the next relaunch). */
     private applySettings;
+    /** Is a turn (or a question the agent is parked on) in flight right now? */
+    private isMidTurn;
+    /** The three live setters, in the order that lets an explicit pick win. */
+    private applyLiveSettings;
     private stopSession;
     private reconcile;
     /**

package/dist/supervisor.js

@@ -17,6 +17,7 @@ import { selfUpdate } from './self-update.js';
 import { rememberWorkspacePath } from './environment.js';
 import { composeMessageWithAttachments, saveAttachments, } from './attachments.js';
 import { applyRewind, createCheckpoint, dropCheckpoints, listCheckpoints, previewRewind, pruneCheckpoints, } from './checkpoints.js';
+import { availableModes, MODE_REFUSED_TEXT } from './adapters/types.js';
 /** Refusals shared by every checkpoint command (ticket #126). */
 const CHECKPOINTS_OFF = 'Restore points are switched off on this server ([checkpoints] enabled = false)';
 const AGENT_BUSY = 'The agent is still working — stop the turn first';
@@ -626,6 +627,54 @@ export class Supervisor {
             this.launchAgent(running, prompt, running.descriptor.providerSessionId);
             return;
         }
+        // The mode crossed the `full` boundary: a NEW process, resuming the same
+        // conversation (ticket #156). Placed with the other one-shot relaunches and
+        // after the cleanup above, which is the whole point of routing it here.
+        if (running.modeRelaunch && !running.stopRequested) {
+            const { priorStatus } = running.modeRelaunch;
+            delete running.modeRelaunch;
+            running.parkRequested = false;
+            running.session = null;
+            running.costBaseUsd = running.costUsd; // the next process starts from here
+            const mode = running.mode;
+            // «Your conversation is kept» is only true when there IS one to keep
+            // (QA-128): a session switched before its first turn has no provider
+            // session id, so the new process starts the conversation over — and
+            // saying otherwise is a promise the feed can be checked against.
+            const kept = Boolean(running.descriptor.providerSessionId);
+            this.sendEvent(running, 'notice', {
+                level: 'info',
+                text: (mode === 'full'
+                    ? 'Switched to «Unrestricted». The agent was restarted — it no longer asks about anything. '
+                    : 'Left «Unrestricted». The agent was restarted — permission checks are back on. ') +
+                    (kept
+                        ? 'Your conversation is kept; send a message to carry on.'
+                        : 'This session had not started a conversation yet, so nothing was lost — send a message to begin.'),
+            });
+            this.sendEvent(running, 'settings', { mode });
+            // Empty prompt: the agent boots, reports its capabilities and waits, the
+            // same as a free CHAT session. It must NOT start a turn of its own here.
+            if (this.launchAgent(running, '', running.descriptor.providerSessionId)) {
+                // Anything typed during the park window is waiting on disk (see
+                // `deliverMessage`), and the new process is the one that can take it.
+                this.flushPendingMessages(running);
+                if (priorStatus === 'REVIEW') {
+                    this.reportStatus(descriptor.id, 'REVIEW', {
+                        costUsd: running.costUsd,
+                        activeMs: running.activeMs,
+                    });
+                }
+                return;
+            }
+            // The agent did not start — an exhausted budget is the only way here. The
+            // session stays parked and resumable rather than silently disappearing.
+            this.reportStatus(descriptor.id, statusForReport(running), {
+                costUsd: running.costUsd,
+                activeMs: running.activeMs,
+            });
+            this.drainSessionsWaitingForCapacity();
+            return;
+        }
         if (running.stopRequested) {
             // Report before removing from the map — reportStatus records
             // lastReported on the live entry, and the journal cleanup below
@@ -1373,12 +1422,22 @@ export class Supervisor {
                 this.sendEvent(running, 'message_delivered', { targetSeqs: delivered });
             }
         };
-        if (running.session) {
+        if (running.session && !running.parkRequested) {
             running.session.send(text);
             settle();
             this.reportStatus(running.descriptor.id, 'RUNNING', {});
             return;
         }
+        // The process is on its way out and `running.session` has not been cleared
+        // yet — parking only ASKS it to stop (QA-128). Handing the text to a dying
+        // process and then reporting it delivered is the one outcome worse than
+        // making the user wait: the words are gone and the interface says they
+        // arrived. This window is short but it is exactly when somebody types,
+        // because they have just changed the mode.
+        if (running.parkRequested) {
+            this.requeue(running, held, text, originSeq);
+            return;
+        }
         // Parked session: the follow-up message becomes the resume prompt.
         if (!this.ensureCapacity(running.descriptor.id)) {
             this.sendEvent(running, 'system_note', {
@@ -1573,6 +1632,22 @@ export class Supervisor {
         const running = this.sessions.get(sessionId);
         if (!running)
             return;
+        // Validated HERE, before anything is remembered (QA-128). `running.mode` is
+        // what a parked session launches with and what the API is told the session
+        // is in, so storing a mode this workspace forbids made a parked session
+        // report itself as «Unrestricted» and made the adapter refuse it again on
+        // every single relaunch — a red line in the feed with no user action behind
+        // it. The adapters keep their own guard; this one stops the value from ever
+        // being written down.
+        if (mode && !availableModes(running.descriptor.workspace.trustMode).includes(mode)) {
+            this.sendEvent(running, 'notice', { level: 'warn', text: MODE_REFUSED_TEXT });
+            this.sendEvent(running, 'settings', { mode: running.mode });
+            mode = undefined;
+            if (model === undefined && effort === undefined)
+                return;
+        }
+        // Kept so a refused switch can put the picker back where it was.
+        const previousMode = running.mode;
         // Remember first: a parked session applies them on its next launch.
         if (model)
             running.model = model;
@@ -1586,6 +1661,67 @@ export class Supervisor {
             this.sendEvent(running, 'settings', { model, mode, effort });
             return;
         }
+        // «Unrestricted» is the one mode the agent cannot be talked into on a
+        // process that was not launched for it (ticket #156). The CLI refuses the
+        // control request outright — `Cannot set permission mode to
+        // bypassPermissions because the session was not launched with
+        // --dangerously-skip-permissions` — and until this branch existed that
+        // refusal became a `notice` in the catch below, leaving the picker reading
+        // «Unrestricted» over a session that went on asking.
+        const needsRelaunch = Boolean(mode && running.session.modeSwitchNeedsRelaunch(mode));
+        if (needsRelaunch && this.isMidTurn(running)) {
+            // A new process would take the turn — and the open card, and the parked
+            // question — down with it. The dashboard locks the picker while the agent
+            // RUNS, but a session sitting on a permission card is WAITING_PERMISSION
+            // and the picker is live there by design (that is the very moment somebody
+            // reaches for it), so this guard is reachable through the interface and
+            // not only through a direct API call (QA-128).
+            this.sendEvent(running, 'notice', {
+                level: 'warn',
+                // Both directions: getting OUT of «Unrestricted» needs a new process
+                // just as much as getting in, and a sentence written for one of them
+                // reads as nonsense during the other.
+                text: (mode === 'full'
+                    ? 'Switching to «Unrestricted» starts a new agent process, so it can only be done between turns. '
+                    : 'Leaving «Unrestricted» starts a new agent process, so it can only be done between turns. ') +
+                    (running.openQuestions.size > 0 || running.lastReported === 'WAITING_PERMISSION'
+                        ? 'Answer what the agent is asking first, or press Stop.'
+                        : 'Stop the turn, or wait for it to finish.'),
+            });
+            running.mode = previousMode;
+            this.sendEvent(running, 'settings', { mode: previousMode });
+            // The rest of the request still stands — refusing the mode is no reason
+            // to drop a model or effort change that travelled with it (QA-128).
+            await this.applyLiveSettings(running, model, undefined, effort);
+            return;
+        }
+        if (needsRelaunch && mode) {
+            await this.applyLiveSettings(running, model, undefined, effort);
+            // Handed to `pumpEvents` rather than done here, exactly like the auth and
+            // stale-resume recoveries above it (QA-128). `park()` only ASKS the
+            // process to stop; the cleanup that follows — settling the active clock,
+            // clearing the budget timers, moving the cost baseline so the next
+            // process does not re-count what this one spent — happens when the event
+            // stream ends. Relaunching inline wins the race against all of it: the
+            // new session lands in `running.session` first, and the old pump then
+            // sees `running.session !== session` and returns without cleaning up.
+            running.modeRelaunch = { priorStatus: running.lastReported };
+            this.park(running, { quiet: true });
+            return;
+        }
+        await this.applyLiveSettings(running, model, mode, effort);
+    }
+    /** Is a turn (or a question the agent is parked on) in flight right now? */
+    isMidTurn(running) {
+        return (running.lastReported === 'RUNNING' ||
+            running.lastReported === 'STARTING' ||
+            running.lastReported === 'WAITING_PERMISSION' ||
+            running.openQuestions.size > 0);
+    }
+    /** The three live setters, in the order that lets an explicit pick win. */
+    async applyLiveSettings(running, model, mode, effort) {
+        if (!running.session)
+            return;
         try {
             // Model first: switching models can invalidate the picked effort, and
             // the adapter drops it in that case — applying effort after lets an

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.29.0";
+export declare const RUNNER_VERSION = "0.30.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.29.0';
+export const RUNNER_VERSION = '0.30.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",