@bridge4dev/runner 0.29.0 → 0.31.0

package/dist/supervisor.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { log } from './log.js';
 import { claimAutoResume, clearAutoResume, pruneAutoResume } from './auto-resume.js';
 import { evaluateRecipeCommand, maskSecrets, maskString } from './policy.js';
+import { agentPromptSizeLabel, quotePath, readAgentPrompt } from './agent-prompt.js';
 import { JournalStore } from './journal.js';
 import { deleteSessionBranch, ensurePreviewWorktree, ensureSessionWorktree, prepareDirectWorkspace, previewWorktreePath, removePreviewWorktree, removeSessionWorktree, repoKeyFor, sessionWorktreePath, validateWorkspacePath, } from './git.js';
 import { readRecipeProposal } from './recipe.js';
@@ -17,6 +18,7 @@ import { selfUpdate } from './self-update.js';
 import { rememberWorkspacePath } from './environment.js';
 import { composeMessageWithAttachments, saveAttachments, } from './attachments.js';
 import { applyRewind, createCheckpoint, dropCheckpoints, listCheckpoints, previewRewind, pruneCheckpoints, } from './checkpoints.js';
+import { availableModes, MODE_REFUSED_TEXT } from './adapters/types.js';
 /** Refusals shared by every checkpoint command (ticket #126). */
 const CHECKPOINTS_OFF = 'Restore points are switched off on this server ([checkpoints] enabled = false)';
 const AGENT_BUSY = 'The agent is still working — stop the turn first';
@@ -379,9 +381,11 @@ export class Supervisor {
             return false;
         }
         running.lastPrompt = prompt;
-        // Facts about this session only. The project's own documentation is read by
-        // each agent itself — see `composeWorkspaceContext`.
-        const workspaceContext = composeWorkspaceContext(descriptor);
+        // Facts about this session only, plus the one file the project named. The
+        // rest of the project's documentation is read by each agent itself — see
+        // `composeWorkspaceContext`.
+        const agentPrompt = this.resolveAgentPrompt(running);
+        const workspaceContext = composeWorkspaceContext(descriptor, agentPrompt?.text);
         const rewind = running.rewindAnchor;
         delete running.rewindAnchor;
         // A rewind resumes the conversation the POINT names, which is not always
@@ -395,6 +399,9 @@ export class Supervisor {
             cwd: running.worktreePath,
             ...(prompt ? { prompt } : {}),
             ...(workspaceContext ? { workspaceContext } : {}),
+            // Only when it was actually read: layer 1 must refuse writes to the file
+            // this process was given, not to a path it was merely told about.
+            ...(agentPrompt ? { agentPromptFile: agentPrompt.absPath } : {}),
             trustMode: descriptor.workspace.trustMode,
             ...(descriptor.workspace.agentAutoCommit === undefined
                 ? {}
@@ -425,6 +432,70 @@ export class Supervisor {
         void this.pumpEvents(running);
         return true;
     }
+    /**
+     * The project's own prompt file, read fresh for THIS agent process.
+     *
+     * Read per launch rather than per session on purpose: a system prompt only
+     * ever changes when the process restarts, so «edit the file, then press
+     * Continue» is the honest contract, and re-reading is what makes it true.
+     *
+     * Every outcome is said out loud. The whole point of moving the project's
+     * rules into the system prompt is that they can no longer be quietly
+     * outranked — so «the prompt did not load» must never be indistinguishable
+     * from «the prompt loaded». Supervisor notices repeat on every launch (only
+     * ADAPTER notices are de-duplicated — gotcha #148), which is exactly what is
+     * wanted here: each agent process either has the prompt or does not.
+     *
+     * Returns the text AND the absolute file, because layer 1 needs the second to
+     * refuse writes to it: in `workMode: DIRECT` the project folder is the
+     * agent's own working directory, so without that rule a session could rewrite
+     * the prompt it will itself be started with next time (QA-130 MAJOR-3).
+     */
+    resolveAgentPrompt(running) {
+        const { descriptor } = running;
+        const configured = descriptor.workspace.agentPromptPath?.trim();
+        if (!configured)
+            return undefined;
+        // The session was started with «without the project's agent prompt». Said
+        // out loud too: a session behaving unlike every other session on the
+        // project should carry the reason in its own feed.
+        if (descriptor.skipAgentPrompt) {
+            this.sendEvent(running, 'notice', {
+                level: 'info',
+                text: 'Project prompt is switched off for this session. DevBridge rules still apply.',
+            });
+            return undefined;
+        }
+        const result = readAgentPrompt(descriptor.workspace.path, configured);
+        if (!result.ok) {
+            log.warn('agent prompt not loaded', {
+                sessionId: descriptor.id,
+                path: configured,
+                reason: result.reason,
+            });
+            this.sendEvent(running, 'notice', {
+                level: 'warn',
+                text: `Project prompt ${quotePath(configured)} was NOT loaded: ${result.reason}. The agent is running without it.`,
+            });
+            return undefined;
+        }
+        log.info('agent prompt loaded', {
+            sessionId: descriptor.id,
+            path: result.relPath,
+            bytes: result.bytes,
+            sha: result.sha,
+        });
+        // The `sha` is in the line a person reads, not only in journald. It is the
+        // one signal that the file behind an unchanged path has changed — which is
+        // exactly what an agent editing its own rules in DIRECT mode looks like
+        // (QA-130 MAJOR-3), and layer 1 cannot promise to prevent that in every
+        // mode.
+        this.sendEvent(running, 'notice', {
+            level: 'info',
+            text: `Project prompt loaded from ${quotePath(result.relPath)} — ${agentPromptSizeLabel(result.bytes)}, sha ${result.sha}.`,
+        });
+        return { text: result.text, absPath: result.absPath };
+    }
     // ─── Time budget (session 7) ───────────────────────────────────────
     //
     // The budget measures the AGENT's working time, not the calendar. Everything
@@ -626,6 +697,54 @@ export class Supervisor {
             this.launchAgent(running, prompt, running.descriptor.providerSessionId);
             return;
         }
+        // The mode crossed the `full` boundary: a NEW process, resuming the same
+        // conversation (ticket #156). Placed with the other one-shot relaunches and
+        // after the cleanup above, which is the whole point of routing it here.
+        if (running.modeRelaunch && !running.stopRequested) {
+            const { priorStatus } = running.modeRelaunch;
+            delete running.modeRelaunch;
+            running.parkRequested = false;
+            running.session = null;
+            running.costBaseUsd = running.costUsd; // the next process starts from here
+            const mode = running.mode;
+            // «Your conversation is kept» is only true when there IS one to keep
+            // (QA-128): a session switched before its first turn has no provider
+            // session id, so the new process starts the conversation over — and
+            // saying otherwise is a promise the feed can be checked against.
+            const kept = Boolean(running.descriptor.providerSessionId);
+            this.sendEvent(running, 'notice', {
+                level: 'info',
+                text: (mode === 'full'
+                    ? 'Switched to «Unrestricted». The agent was restarted — it no longer asks about anything. '
+                    : 'Left «Unrestricted». The agent was restarted — permission checks are back on. ') +
+                    (kept
+                        ? 'Your conversation is kept; send a message to carry on.'
+                        : 'This session had not started a conversation yet, so nothing was lost — send a message to begin.'),
+            });
+            this.sendEvent(running, 'settings', { mode });
+            // Empty prompt: the agent boots, reports its capabilities and waits, the
+            // same as a free CHAT session. It must NOT start a turn of its own here.
+            if (this.launchAgent(running, '', running.descriptor.providerSessionId)) {
+                // Anything typed during the park window is waiting on disk (see
+                // `deliverMessage`), and the new process is the one that can take it.
+                this.flushPendingMessages(running);
+                if (priorStatus === 'REVIEW') {
+                    this.reportStatus(descriptor.id, 'REVIEW', {
+                        costUsd: running.costUsd,
+                        activeMs: running.activeMs,
+                    });
+                }
+                return;
+            }
+            // The agent did not start — an exhausted budget is the only way here. The
+            // session stays parked and resumable rather than silently disappearing.
+            this.reportStatus(descriptor.id, statusForReport(running), {
+                costUsd: running.costUsd,
+                activeMs: running.activeMs,
+            });
+            this.drainSessionsWaitingForCapacity();
+            return;
+        }
         if (running.stopRequested) {
             // Report before removing from the map — reportStatus records
             // lastReported on the live entry, and the journal cleanup below
@@ -1373,12 +1492,22 @@ export class Supervisor {
                 this.sendEvent(running, 'message_delivered', { targetSeqs: delivered });
             }
         };
-        if (running.session) {
+        if (running.session && !running.parkRequested) {
             running.session.send(text);
             settle();
             this.reportStatus(running.descriptor.id, 'RUNNING', {});
             return;
         }
+        // The process is on its way out and `running.session` has not been cleared
+        // yet — parking only ASKS it to stop (QA-128). Handing the text to a dying
+        // process and then reporting it delivered is the one outcome worse than
+        // making the user wait: the words are gone and the interface says they
+        // arrived. This window is short but it is exactly when somebody types,
+        // because they have just changed the mode.
+        if (running.parkRequested) {
+            this.requeue(running, held, text, originSeq);
+            return;
+        }
         // Parked session: the follow-up message becomes the resume prompt.
         if (!this.ensureCapacity(running.descriptor.id)) {
             this.sendEvent(running, 'system_note', {
@@ -1573,6 +1702,22 @@ export class Supervisor {
         const running = this.sessions.get(sessionId);
         if (!running)
             return;
+        // Validated HERE, before anything is remembered (QA-128). `running.mode` is
+        // what a parked session launches with and what the API is told the session
+        // is in, so storing a mode this workspace forbids made a parked session
+        // report itself as «Unrestricted» and made the adapter refuse it again on
+        // every single relaunch — a red line in the feed with no user action behind
+        // it. The adapters keep their own guard; this one stops the value from ever
+        // being written down.
+        if (mode && !availableModes(running.descriptor.workspace.trustMode).includes(mode)) {
+            this.sendEvent(running, 'notice', { level: 'warn', text: MODE_REFUSED_TEXT });
+            this.sendEvent(running, 'settings', { mode: running.mode });
+            mode = undefined;
+            if (model === undefined && effort === undefined)
+                return;
+        }
+        // Kept so a refused switch can put the picker back where it was.
+        const previousMode = running.mode;
         // Remember first: a parked session applies them on its next launch.
         if (model)
             running.model = model;
@@ -1586,6 +1731,67 @@ export class Supervisor {
             this.sendEvent(running, 'settings', { model, mode, effort });
             return;
         }
+        // «Unrestricted» is the one mode the agent cannot be talked into on a
+        // process that was not launched for it (ticket #156). The CLI refuses the
+        // control request outright — `Cannot set permission mode to
+        // bypassPermissions because the session was not launched with
+        // --dangerously-skip-permissions` — and until this branch existed that
+        // refusal became a `notice` in the catch below, leaving the picker reading
+        // «Unrestricted» over a session that went on asking.
+        const needsRelaunch = Boolean(mode && running.session.modeSwitchNeedsRelaunch(mode));
+        if (needsRelaunch && this.isMidTurn(running)) {
+            // A new process would take the turn — and the open card, and the parked
+            // question — down with it. The dashboard locks the picker while the agent
+            // RUNS, but a session sitting on a permission card is WAITING_PERMISSION
+            // and the picker is live there by design (that is the very moment somebody
+            // reaches for it), so this guard is reachable through the interface and
+            // not only through a direct API call (QA-128).
+            this.sendEvent(running, 'notice', {
+                level: 'warn',
+                // Both directions: getting OUT of «Unrestricted» needs a new process
+                // just as much as getting in, and a sentence written for one of them
+                // reads as nonsense during the other.
+                text: (mode === 'full'
+                    ? 'Switching to «Unrestricted» starts a new agent process, so it can only be done between turns. '
+                    : 'Leaving «Unrestricted» starts a new agent process, so it can only be done between turns. ') +
+                    (running.openQuestions.size > 0 || running.lastReported === 'WAITING_PERMISSION'
+                        ? 'Answer what the agent is asking first, or press Stop.'
+                        : 'Stop the turn, or wait for it to finish.'),
+            });
+            running.mode = previousMode;
+            this.sendEvent(running, 'settings', { mode: previousMode });
+            // The rest of the request still stands — refusing the mode is no reason
+            // to drop a model or effort change that travelled with it (QA-128).
+            await this.applyLiveSettings(running, model, undefined, effort);
+            return;
+        }
+        if (needsRelaunch && mode) {
+            await this.applyLiveSettings(running, model, undefined, effort);
+            // Handed to `pumpEvents` rather than done here, exactly like the auth and
+            // stale-resume recoveries above it (QA-128). `park()` only ASKS the
+            // process to stop; the cleanup that follows — settling the active clock,
+            // clearing the budget timers, moving the cost baseline so the next
+            // process does not re-count what this one spent — happens when the event
+            // stream ends. Relaunching inline wins the race against all of it: the
+            // new session lands in `running.session` first, and the old pump then
+            // sees `running.session !== session` and returns without cleaning up.
+            running.modeRelaunch = { priorStatus: running.lastReported };
+            this.park(running, { quiet: true });
+            return;
+        }
+        await this.applyLiveSettings(running, model, mode, effort);
+    }
+    /** Is a turn (or a question the agent is parked on) in flight right now? */
+    isMidTurn(running) {
+        return (running.lastReported === 'RUNNING' ||
+            running.lastReported === 'STARTING' ||
+            running.lastReported === 'WAITING_PERMISSION' ||
+            running.openQuestions.size > 0);
+    }
+    /** The three live setters, in the order that lets an explicit pick win. */
+    async applyLiveSettings(running, model, mode, effort) {
+        if (!running.session)
+            return;
         try {
             // Model first: switching models can invalidate the picked effort, and
             // the adapter drops it in that case — applying effort after lets an
@@ -3140,8 +3346,16 @@ export function composeInitialPrompt(descriptor) {
  * A repository that wants both agents equipped ships both files, or symlinks
  * one to the other. That is a repository convention and not something a runner
  * should paper over.
+ *
+ * `agentPrompt` is the one exception, and it is an exception for a reason this
+ * function cannot do anything about: `CLAUDE.md` and `AGENTS.md` arrive at the
+ * USER level, and a project's standing process rules have to sit at the system
+ * level to survive both a compaction and a rule the CLI states about itself
+ * (`agent-prompt.ts`). It arrives here already read and already checked — this
+ * function still opens no files — and it goes LAST, so a project overrides us
+ * exactly the way `CLAUDE.md` does by being read last.
  */
-export function composeWorkspaceContext(descriptor) {
+export function composeWorkspaceContext(descriptor, agentPrompt) {
     const sections = [];
     const plan = descriptor.branchPlan;
     if (plan) {
@@ -3169,6 +3383,8 @@ export function composeWorkspaceContext(descriptor) {
     else if (descriptor.tickets.length > 0) {
         sections.push('DevBridge tickets are attached to this chat for CONTEXT only. Read them with the DevBridge MCP tools; do not change their status — this session is not assigned to them.');
     }
+    if (agentPrompt)
+        sections.push(agentPrompt);
     return sections.join('\n\n');
 }
 //# sourceMappingURL=supervisor.js.map

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.29.0";
+export declare const RUNNER_VERSION = "0.31.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.29.0';
+export const RUNNER_VERSION = '0.31.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",