@bridge4dev/runner 0.29.0 → 0.31.0

package/dist/adapters/claude.js

@@ -5,7 +5,7 @@ import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { mcpConfigPath } from '../paths.js';
 import { evaluateToolUse, maskSecrets, maskString } from '../policy.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Claude adapter over the Agent SDK. Three live-verified gotchas (plan §2):
 //  1. Bare tool names in `allowedTools` auto-approve BEFORE canUseTool — we
@@ -65,14 +65,77 @@ export function scrubbedEnv() {
     }
     return env;
 }
+/**
+ * The one env var the allowlist above refuses, added back for exactly one mode
+ * (ticket #156).
+ *
+ * The CLI's own guard, read out of the binary verbatim:
+ *
+ * ```js
+ * if (t === "bypassPermissions" || r) {
+ *   if (typeof process.getuid === "function" && process.getuid() === 0
+ *       && process.env.IS_SANDBOX !== "1" && !Z.CLAUDE_CODE_BUBBLEWRAP)
+ *     console.error("--dangerously-skip-permissions cannot be used with root/sudo privileges …"),
+ *     process.exit(1)
+ * }
+ * ```
+ *
+ * The runner's default install is root (`install.sh`), so on an ordinary
+ * machine «Unrestricted» did not degrade — it killed the session at launch with
+ * exit code 1. On the machine this was found on it happened to start, because
+ * `~/.claude/settings.json` carries `env: { IS_SANDBOX: "1" }` and this adapter
+ * loads user settings; that is a hole in the scrub covering a bug, not a fix.
+ *
+ * The condition here is the CLI's own, no wider: `full` AND uid 0. It is safe
+ * precisely where it is applied — `bypassPermissions` is the mode in which the
+ * SDK never calls `canUseTool` (it says so itself), so layer 1 is already inert
+ * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
+ * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
+ */
+function agentEnv(mode) {
+    const env = scrubbedEnv();
+    if (mode === 'full' && process.getuid?.() === 0)
+        env['IS_SANDBOX'] = '1';
+    return env;
+}
 // Normalized mode → Claude permission mode (session-5 plan §2). `full` is the
 // owner's explicit call (2026-07-24): "same as Claude works now, we don't
 // restrict anything" — in that mode the SDK stops calling canUseTool at all,
 // so the layer-1 policy cannot gate tools either; the dashboard says so.
+//
+// `auto` maps to the CLI's `default` rung, and the reason is the whole of
+// QA-128's one surviving BLOCKER — it was `'auto'` for most of this ticket and
+// had to come back.
+//
+// The CLI's own `auto` rung runs a MODEL CLASSIFIER over each tool call, and
+// what the classifier approves never becomes a `can_use_tool` request. This
+// adapter's only route into layer 1 is `canUseTool`. So in that rung
+// `evaluateToolUse` is not consulted, and the rules the product calls
+// unconditional — `sudo`, `git push`, docker control, secret paths, writes
+// outside the worktree, anything inside `.git` — are simply not applied.
+//
+// Measured, not reasoned. Same adapter, same options, only the model differs:
+//
+//   sonnet  (has the auto rung)  : `sudo -n id` → ran, policy consulted 0 times
+//   haiku-4.5 (has no auto rung) : `sudo -n id` → DENIED by policy
+//
+// Haiku is why this took a second pass to see: it refuses the rung outright
+// (`auto mode unavailable for this model`) and the CLI quietly falls back to
+// `default`, so a probe run on it shows the layer working perfectly.
+//
+// Nothing is lost by mapping to `default`. The CLI's rung was never what made
+// «Auto» mean «only the hard limits» — `effectiveTrust(trust, 'auto') → AUTO`
+// in `policy.ts` is, and it needs `canUseTool` to be reached to say so. What
+// `default` gives up is the classifier's convenience; what it keeps is the only
+// place the hard limits are enforced at all.
+//
+// `full` is the deliberate exception: `bypassPermissions` also stops calling
+// `canUseTool`, and there that IS the meaning of the mode — the dashboard says
+// so, and STRICT workspaces are not offered it.
 const MODE_TO_PERMISSION = {
     ask: 'default',
     plan: 'plan',
-    auto: 'acceptEdits',
+    auto: 'default',
     full: 'bypassPermissions',
 };
 const SYSTEM_APPEND = [
@@ -186,6 +249,23 @@ class ClaudeSession {
     /** Guards against overlapping capability probes. */
     capabilitiesInFlight = false;
     mode;
+    /**
+     * A launch-time mode this workspace does not allow, remembered so the feed
+     * can say so once the event queue is live (`full` on a STRICT workspace).
+     */
+    modeRefusedAtLaunch = null;
+    /**
+     * This process was launched with the bypass capability, so `setPermissionMode`
+     * may reach `bypassPermissions` on it.
+     *
+     * The CLI ties the capability to the LAUNCH, not to the current mode: a
+     * session started with the flag can be tightened to `default` and raised back
+     * to bypass freely (both verified live), while one started without it is
+     * refused outright. So this is the honest predicate for
+     * `modeSwitchNeedsRelaunch`, and it is not the same question as
+     * «is the mode `full` right now».
+     */
+    launchedWithBypass;
     model;
     /**
      * Reasoning effort pinned for this session (ticket #111).
@@ -283,7 +363,17 @@ class ClaudeSession {
     events = this.output;
     constructor(spec, queryFn) {
         this.spec = spec;
-        this.mode = spec.mode ?? 'ask';
+        // Refused rather than honoured, and BEFORE anything is built from it: on a
+        // STRICT workspace `full` would launch the CLI in `bypassPermissions`, and
+        // there layer 1 is never consulted — the manager's shield would be spent by
+        // whoever opened the session (ticket #156). The notice goes out in the
+        // constructor's own emit block below, once `output` can carry it.
+        const requested = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requested) ? requested : 'ask';
+        if (this.mode !== requested) {
+            this.modeRefusedAtLaunch = requested;
+        }
+        this.launchedWithBypass = this.mode === 'full';
         if (spec.model)
             this.model = spec.model;
         // Gated, not copied: a pin stored against a model that no longer offers it
@@ -313,7 +403,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: scrubbedEnv(),
+            env: agentEnv(this.mode),
             /**
              * Everything the machine's own Claude has (owner's call, 2026-07-30).
              *
@@ -335,6 +425,14 @@ class ClaudeSession {
              */
             settingSources: ['user', 'project', 'local'],
             permissionMode: MODE_TO_PERMISSION[this.mode],
+            // The SDK's own words: "Must be set to `true` when using
+            // `permissionMode: 'bypassPermissions'`." It was never set, so
+            // «Unrestricted» asked the CLI for a mode it had not been given
+            // permission to offer (ticket #156). Passed only for `full`: as root the
+            // CLI refuses to START at all when this flag is present without
+            // `IS_SANDBOX=1`, so setting it unconditionally would take every mode
+            // down with it — verified live, exit code 1 on a plain `ask` session.
+            ...(this.mode === 'full' ? { allowDangerouslySkipPermissions: true } : {}),
             systemPrompt: {
                 type: 'preset',
                 preset: 'claude_code',
@@ -402,6 +500,10 @@ class ClaudeSession {
         if (this.mcpFallbackNotice) {
             this.emit({ type: 'notice', level: 'warn', text: this.mcpFallbackNotice });
         }
+        if (this.modeRefusedAtLaunch) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         this.lastTaskFingerprint = JSON.stringify({ done: 0, total: 0, tasks: [] });
         this.emit({ type: 'agent_tasks', tasks: [], done: 0, total: 0 });
         // Report what the agent can do right away. `system:init` only arrives with
@@ -605,7 +707,11 @@ class ClaudeSession {
         this.adoptLiveModel(this.liveWireModel ?? this.model);
         const capabilities = {
             models: this.knownModels,
-            modes: [...AGENT_MODES],
+            // Read from `spec` on every publication, not captured once: the workspace
+            // trust level changes under a running session (`setWorkspacePolicy`), and
+            // a manager tightening to STRICT has to see «Unrestricted» leave the
+            // picker rather than stay there as an offer that will be refused.
+            modes: availableModes(this.spec.trustMode),
             // Cap the list: it lands in an event payload with a hard size limit.
             commands: commands.slice(0, 150).map((c) => ({
                 name: c.name,
@@ -683,10 +789,104 @@ class ClaudeSession {
         // worst case. Fire-and-forget, same as the end-of-turn call.
         this.refreshContextUsage();
     }
+    /**
+     * Can this live process reach `mode`, or does the supervisor have to bring a
+     * new one up? (ticket #156)
+     *
+     * Only the `full` boundary matters, and only in the direction the CLI
+     * refuses. Crossing it OUTWARD works live — a bypass-launched session accepts
+     * `setPermissionMode('default')` and starts consulting `canUseTool` again,
+     * verified live — but it is answered `true` here as well, deliberately: that
+     * process still carries `--allow-dangerously-skip-permissions` and, as root,
+     * `IS_SANDBOX=1`. Leaving a session that is once more gated running with the
+     * ungated process's environment is the kind of residue that is correct today
+     * and quietly wrong after the next CLI release. One rule, both directions,
+     * nothing left over.
+     */
+    modeSwitchNeedsRelaunch(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode))
+            return false;
+        return (mode === 'full') !== this.launchedWithBypass;
+    }
     async setMode(mode) {
-        await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            // The picker has already moved; say what the mode actually is so it moves
+            // back, instead of showing a setting the session is not in.
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
+        // The mode is recorded whatever the CLI says (QA-128). Its permission rung
+        // is an optimisation; the layer that produces the cards a user sees is
+        // ours, and it reads `this.mode`. Leaving the field behind because the CLI
+        // does not offer `auto` on this model would be #157 all over again.
+        await this.applyPermissionMode(mode);
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157. The cards already on screen are the reason a person reaches
+        // for this control in the first place — the agent has stopped and is
+        // waiting on one. Judging only the NEXT tool call left the visible one
+        // exactly where it was, which reads as «the switch did nothing».
+        this.releasePermissionsAllowedNow();
+    }
+    /**
+     * Move the live CLI to this mode's permission rung, degrading rather than
+     * throwing when it refuses one (QA-128).
+     *
+     * Never rethrows: the caller has already decided what the session's mode is,
+     * and the CLI's opinion about its own rung must not undo that.
+     */
+    async applyPermissionMode(mode) {
+        try {
+            await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        }
+        catch (error) {
+            // Swallowed on purpose. The CLI refuses rungs per MODEL, not only per
+            // request — `Cannot set permission mode to auto: auto mode unavailable
+            // for this model`, measured on `claude-haiku-4-5`, which our own picker
+            // offers. Letting that throw is what the caller must never allow: the
+            // exception would land before `this.mode` is written, the dashboard would
+            // show the new mode, and the layer that raises the cards would still be
+            // on the old one. That is ticket #157, reproduced by its own fix.
+            log.warn('claude: setPermissionMode refused — the session mode still stands', {
+                wanted: MODE_TO_PERMISSION[mode],
+                error: String(error),
+            });
+        }
+    }
+    /**
+     * Re-judge every open permission card under the rules in force NOW, and let
+     * through the ones that no longer need a human (ticket #157).
+     *
+     * Only in the permissive direction: a card that becomes `deny` or stays `ask`
+     * is left alone. Denying something the user is looking at — and had every
+     * right to approve — would be taking a decision away from them, which is the
+     * mistake session 12 spent its whole length undoing.
+     */
+    releasePermissionsAllowedNow() {
+        for (const [requestId, pending] of [...this.pending]) {
+            if (!pending.fromPolicy)
+                continue;
+            const verdict = evaluateToolUse(pending.toolName, pending.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                ...(this.spec.agentPromptFile ? { agentPromptFile: this.spec.agentPromptFile } : {}),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+            pending.resolve({ behavior: 'allow', updatedInput: pending.input });
+        }
     }
     /**
      * Session 15: the project's trust level and auto-commit switch, changed
@@ -694,10 +894,50 @@ class ClaudeSession {
      * every tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // The manager tightened to STRICT while this session was running with
+        // nothing gated. Waiting for a relaunch would leave the shield down for the
+        // rest of the turn, so this one is applied live and immediately: the CLI
+        // accepts a TIGHTENING from bypass on the same process (verified live), and
+        // from the next tool call `canUseTool` — and layer 1 with it — is consulted
+        // again. The process keeps the launch flags it can no longer use; being
+        // gated a moment sooner is worth more than that tidiness.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            // The WITHDRAWN sentence, not the refusal one (QA-128): nobody in this
+            // session asked for anything — a manager changed the project.
+            this.emit({ type: 'notice', level: 'warn', text: MODE_WITHDRAWN_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+            void this.q.setPermissionMode(MODE_TO_PERMISSION[this.mode]).catch((error) => {
+                // The control request is the ONLY thing standing between «the manager
+                // set this project to Strict» and an agent that still gates nothing
+                // (QA-128). A warning in journald is not a response to that: if the
+                // process will not be tightened, it does not get to keep running.
+                log.warn('claude: could not tighten a full session after a STRICT switch', {
+                    error: String(error),
+                });
+                this.emit({
+                    type: 'notice',
+                    level: 'warn',
+                    text: 'This project was set to Strict trust and the running agent refused to switch its permission checks back on, so the session was stopped. Start it again to continue.',
+                });
+                this.stop('session_stopped');
+            });
+        }
+        // A tightening to STRICT has to take `full` out of the picker, and a
+        // loosening has to put it back — the list is computed from `spec` and only
+        // reaches the dashboard through a capabilities frame (ticket #156).
+        this.refreshCapabilities();
+        // Loosening the workspace releases what it no longer needs a human for, the
+        // same way a mode switch does. Tightening changes nothing here on purpose:
+        // this only ever lets cards through, never withdraws one.
+        this.releasePermissionsAllowedNow();
     }
     /**
      * Change the reasoning-effort level (tickets #111, #112).
@@ -1055,9 +1295,13 @@ class ClaudeSession {
         }
         const verdict = evaluateToolUse(toolName, input, {
             trustMode: this.spec.trustMode,
+            // Ticket #156: the missing argument. Everything else in this object was
+            // already here; the session's own mode was not, so «Auto» decided nothing.
+            mode: this.mode,
             ...(this.spec.agentAutoCommit === undefined
                 ? {}
                 : { agentAutoCommit: this.spec.agentAutoCommit }),
+            ...(this.spec.agentPromptFile ? { agentPromptFile: this.spec.agentPromptFile } : {}),
             worktreePath: this.spec.cwd,
         });
         if (verdict.decision === 'allow') {
@@ -1082,10 +1326,13 @@ class ClaudeSession {
             ...(opts.description ? { description: opts.description } : {}),
             input: truncateInput(input),
         });
-        return this.waitForAnswer(opts, toolName);
+        return this.waitForAnswer(opts, toolName, input);
     }
     /** Park the tool call until the dashboard answers (or the request aborts). */
-    waitForAnswer(opts, toolName) {
+    waitForAnswer(opts, toolName, 
+    // The RAW input, not the truncated copy that went on the card: this is what
+    // the tool is released with, and what a later re-judgement is judged on.
+    input) {
         return new Promise((resolve) => {
             const settle = (result) => {
                 if (this.pending.delete(opts.requestId))
@@ -1093,6 +1340,8 @@ class ClaudeSession {
             };
             this.pending.set(opts.requestId, {
                 toolName,
+                input: input ?? {},
+                fromPolicy: input !== undefined,
                 resolve: settle,
             });
             opts.signal.addEventListener('abort', () => {

package/dist/adapters/codex.js

@@ -5,7 +5,7 @@ import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
 import { truncate } from './claude.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
 // contract is unchanged, so the dashboard renders Codex sessions with the same
@@ -153,6 +153,8 @@ class CodexSession {
     heldPlan = null;
     lastCollabMode = null;
     mode;
+    /** A launch-time `full` this STRICT workspace does not allow (ticket #156). */
+    modeRefusedAtLaunch = false;
     model;
     effort;
     /** Last model catalogue from `model/list` — effort sets differ per model. */
@@ -164,7 +166,13 @@ class CodexSession {
     constructor(spec, home, deps) {
         this.spec = spec;
         this.home = home;
-        this.mode = spec.mode ?? 'ask';
+        // `full` on a STRICT workspace is refused, not honoured: Codex in that mode
+        // sends no approvals at all, so layer 1 never runs and the manager's shield
+        // would be spent from the chat (ticket #156).
+        const requestedMode = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requestedMode) ? requestedMode : 'ask';
+        if (this.mode !== requestedMode)
+            this.modeRefusedAtLaunch = true;
         this.model = spec.model;
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
@@ -183,6 +191,10 @@ class CodexSession {
                 cwd: spec.cwd,
                 ...wiring,
             });
+        if (this.modeRefusedAtLaunch) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         void this.boot();
     }
     // ─── Boot ──────────────────────────────────────────────────────────
@@ -590,10 +602,28 @@ class CodexSession {
      * tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // A manager tightened the project out from under a session that is running
+        // with nothing gated (QA-128). Codex carries `approvalPolicy` on the next
+        // `turn/start`, so recording the mode here IS the fix — the next turn is
+        // `on-request` and layer 1 sees every command again. Claude does the same
+        // thing through `setPermissionMode`; leaving this out of one adapter left
+        // the picker showing a mode that was no longer in its own list.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            this.notice('warn', MODE_WITHDRAWN_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
+        // `full` leaves (or rejoins) the picker with the trust level — the list is
+        // computed from `spec` and only travels in a capabilities frame (#156).
+        this.refreshCapabilities();
+        this.releaseApprovalsAllowedNow();
     }
     async setEffort(effort) {
         if (effort)
@@ -603,9 +633,57 @@ class CodexSession {
         this.emit({ type: 'settings', effort });
         this.refreshCapabilities();
     }
+    /**
+     * Codex needs no new process for any mode: `approvalPolicy` and the sandbox
+     * policy travel with the next `turn/start`, so the change is in force from
+     * the next turn whatever it is (ticket #156).
+     */
+    modeSwitchNeedsRelaunch(_mode) {
+        return false;
+    }
     async setMode(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157 — the card the user is looking at is the reason they reached
+        // for the control; judging only the next one leaves it sitting there.
+        this.releaseApprovalsAllowedNow();
+    }
+    /**
+     * Re-judge every open approval under the rules in force NOW and accept the
+     * ones that no longer need a human (ticket #157). Permissive direction only:
+     * a card that would now be denied is left for the user, because taking a
+     * decision away from them is the mistake session 12 exists to undo.
+     */
+    releaseApprovalsAllowedNow() {
+        for (const [requestId, pending] of [...this.approvals]) {
+            if (!pending.policy)
+                continue;
+            const verdict = evaluateToolUse(pending.policy.tool, pending.policy.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                ...(this.spec.agentPromptFile ? { agentPromptFile: this.spec.agentPromptFile } : {}),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.approvals.delete(requestId);
+            this.client.respond(pending.rpcId, { decision: 'accept' });
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+        }
     }
     async interrupt() {
         if (!this.threadId || !this.activeTurnId)
@@ -705,9 +783,13 @@ class CodexSession {
             ? { decision: 'ask', reason: 'details unavailable' }
             : evaluateToolUse(enriched.policyTool, enriched.policyInput, {
                 trustMode: this.spec.trustMode,
+                // Ticket #156, the same missing argument as in the Claude adapter —
+                // both bridges call one policy, so both have to hand it the mode.
+                mode: this.mode,
                 ...(this.spec.agentAutoCommit === undefined
                     ? {}
                     : { agentAutoCommit: this.spec.agentAutoCommit }),
+                ...(this.spec.agentPromptFile ? { agentPromptFile: this.spec.agentPromptFile } : {}),
                 worktreePath: this.spec.cwd,
             });
         if (verdict.decision === 'allow') {
@@ -725,7 +807,11 @@ class CodexSession {
             });
             return;
         }
-        this.approvals.set(requestId, { rpcId: request.id, toolName: enriched.toolName });
+        this.approvals.set(requestId, {
+            rpcId: request.id,
+            toolName: enriched.toolName,
+            policy: enriched.forceAsk ? null : { tool: enriched.policyTool, input: enriched.policyInput },
+        });
         this.emit({
             type: 'permission',
             requestId,
@@ -1295,7 +1381,10 @@ class CodexSession {
         const currentEffort = this.effort ?? models.find((m) => m.id === currentModel)?.defaultEffort ?? undefined;
         const capabilities = {
             models,
-            modes: [...AGENT_MODES],
+            // Recomputed on every publication rather than captured: the workspace's
+            // trust level changes under a running session, and `full` has to leave
+            // the picker with it (ticket #156).
+            modes: availableModes(this.spec.trustMode),
             commands,
             currentMode: this.mode,
             ...(currentModel ? { currentModel } : {}),

package/dist/adapters/types.d.ts

@@ -5,14 +5,48 @@ export interface McpConfig {
 }
 /**
  * Agent-agnostic interaction mode (session-5 plan §2).
- *  ask  — ask before acting               (Claude `default`,  Codex `on-request`)
- *  plan — plan first, act after approval  (Claude `plan`,     Codex on-request + plan)
- *  auto — apply edits silently            (Claude `acceptEdits`, Codex `on-failure`)
+ *  ask  — ask before acting               (Claude `default`, Codex `on-request`)
+ *  plan — plan first, act after approval  (Claude `plan`,    Codex on-request + plan)
+ *  auto — work on its own, hard limits only (Claude `auto`,  Codex on-request + workspace-write)
  *  full — never ask                       (Claude `bypassPermissions`, Codex `never`)
+ *
+ * The mode is BOTH halves of the decision, and that took a bug to learn
+ * (ticket #156): it sets the agent CLI's own permission mode, AND it reaches
+ * `evaluateToolUse` as `PolicyContext.mode`. For four sessions it did only the
+ * first, so «Auto» moved a dial the layer that raises the cards never read.
  */
 export type AgentMode = 'ask' | 'plan' | 'auto' | 'full';
 export declare const AGENT_MODES: readonly AgentMode[];
 export declare function isAgentMode(value: unknown): value is AgentMode;
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export declare const MODE_REFUSED_TEXT = "\u00ABUnrestricted\u00BB is not available on this project. Its trust level is Strict, and \u00ABUnrestricted\u00BB is the one mode in which DevBridge checks nothing \u2014 the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.";
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export declare const MODE_WITHDRAWN_TEXT = "This project was just set to Strict trust, so \u00ABUnrestricted\u00BB is no longer available and this session now asks about every command. Nothing you did caused this \u2014 a project manager changed it in the server panel.";
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export declare function availableModes(trustMode: TrustMode): AgentMode[];
 /**
  * A reasoning-effort level a model supports. Codex advertises these per model
  * (`supportedReasoningEfforts`) and the set differs between models — the new
@@ -142,6 +176,15 @@ export interface SessionSpec {
      * the same question — may this Bash call go through.
      */
     agentAutoCommit?: boolean;
+    /**
+     * Absolute path of the project's prompt file, set only when it was actually
+     * read into `workspaceContext` for this process (session 17).
+     *
+     * Rides down to `PolicyContext` so layer 1 can refuse writes to it: in
+     * `workMode: DIRECT` the project folder is the agent's own working directory,
+     * so without this the agent could rewrite its own next system prompt.
+     */
+    agentPromptFile?: string;
     mode?: AgentMode;
     model?: string;
     effort?: string;
@@ -388,6 +431,24 @@ export interface AgentSession {
     setEffort(effort: string | null): Promise<void>;
     /** Switch interaction mode mid-session. */
     setMode(mode: AgentMode): Promise<void>;
+    /**
+     * Can this session reach `mode` without a new agent process? (ticket #156)
+     *
+     * Claude answers `false` for any move across the `full` boundary, and that is
+     * the CLI's rule rather than ours: `bypassPermissions` may only be entered by
+     * a process LAUNCHED with the dangerous flag, and the control request is
+     * refused outright otherwise —
+     *
+     *   Cannot set permission mode to bypassPermissions because the session was
+     *   not launched with --dangerously-skip-permissions
+     *
+     * (verified live against the bundled CLI 2.1.218). Until this existed the
+     * supervisor caught that error, turned it into a `notice`, and left the user
+     * with a picker reading «Unrestricted» over a session that was still asking.
+     *
+     * Codex answers `true` always: its policy travels with the next `turn/start`.
+     */
+    modeSwitchNeedsRelaunch(mode: AgentMode): boolean;
     /**
      * Project-level policy changed while this session is running (session 15).
      *

package/dist/adapters/types.js

@@ -2,4 +2,35 @@ export const AGENT_MODES = ['ask', 'plan', 'auto', 'full'];
 export function isAgentMode(value) {
     return typeof value === 'string' && AGENT_MODES.includes(value);
 }
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export const MODE_REFUSED_TEXT = '«Unrestricted» is not available on this project. Its trust level is Strict, and «Unrestricted» is the one mode in which DevBridge checks nothing — the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.';
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export const MODE_WITHDRAWN_TEXT = 'This project was just set to Strict trust, so «Unrestricted» is no longer available and this session now asks about every command. Nothing you did caused this — a project manager changed it in the server panel.';
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export function availableModes(trustMode) {
+    return trustMode === 'STRICT' ? AGENT_MODES.filter((mode) => mode !== 'full') : [...AGENT_MODES];
+}
 //# sourceMappingURL=types.js.map