@bridge4dev/runner 0.31.0 → 0.33.0

package/dist/protocol.d.ts

@@ -38,26 +38,52 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
          * scratch anyway; the bounds here only keep nonsense off the wire.
          */
         agentPromptPath: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        /**
+         * Session 18: the project's git policy for agents.
+         *
+         * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above — this
+         * rides inside `hello_ack` with every session on the server, so a malformed
+         * value must cost its own session's policy at most, never the frame.
+         *
+         * «Costs its own session's policy» is safe here BECAUSE of the polarity in
+         * `policy.ts`: `agentPushBan` resolves `undefined` to «refuse», so a value
+         * this schema drops leaves the session strictly more restricted, never less.
+         * That property is the whole reason `.catch(undefined)` is acceptable on a
+         * security field, and it is why the resolution lives in exactly one
+         * function rather than at each point of use.
+         */
+        agentPushBan: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+        agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+        agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
         budgetUsd: z.ZodNullable<z.ZodNumber>;
         budgetMinutes: z.ZodNullable<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
         path: string;
         projectId: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         budgetUsd: number | null;
         budgetMinutes: number | null;
         agentAutoCommit?: boolean | undefined;
+        agentPushBan?: boolean | undefined;
         agentPromptPath?: string | null | undefined;
+        agentProtectedBranches?: string[] | undefined;
+        agentAllowForcePush?: boolean | undefined;
+        agentAllowDestructiveGit?: boolean | undefined;
     }, {
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
         path: string;
         projectId: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         budgetUsd: number | null;
         budgetMinutes: number | null;
         agentAutoCommit?: boolean | undefined;
+        agentPushBan?: unknown;
         agentPromptPath?: unknown;
+        agentProtectedBranches?: unknown;
+        agentAllowForcePush?: unknown;
+        agentAllowDestructiveGit?: unknown;
     }>;
     /**
      * «Run this one without the project's agent prompt.» Absent means no — both
@@ -153,14 +179,18 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     activeMsBase: number;
     extraBudgetMinutes: number | null;
     workspace: {
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
         path: string;
         projectId: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         budgetUsd: number | null;
         budgetMinutes: number | null;
         agentAutoCommit?: boolean | undefined;
+        agentPushBan?: boolean | undefined;
         agentPromptPath?: string | null | undefined;
+        agentProtectedBranches?: string[] | undefined;
+        agentAllowForcePush?: boolean | undefined;
+        agentAllowDestructiveGit?: boolean | undefined;
     };
     tickets: {
         number: number;
@@ -188,14 +218,18 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     prompt: string;
     providerSessionId: string | null;
     workspace: {
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
         path: string;
         projectId: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         budgetUsd: number | null;
         budgetMinutes: number | null;
         agentAutoCommit?: boolean | undefined;
+        agentPushBan?: unknown;
         agentPromptPath?: unknown;
+        agentProtectedBranches?: unknown;
+        agentAllowForcePush?: unknown;
+        agentAllowDestructiveGit?: unknown;
     };
     tickets: {
         number: number;
@@ -264,26 +298,52 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
              * scratch anyway; the bounds here only keep nonsense off the wire.
              */
             agentPromptPath: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+            /**
+             * Session 18: the project's git policy for agents.
+             *
+             * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above — this
+             * rides inside `hello_ack` with every session on the server, so a malformed
+             * value must cost its own session's policy at most, never the frame.
+             *
+             * «Costs its own session's policy» is safe here BECAUSE of the polarity in
+             * `policy.ts`: `agentPushBan` resolves `undefined` to «refuse», so a value
+             * this schema drops leaves the session strictly more restricted, never less.
+             * That property is the whole reason `.catch(undefined)` is acceptable on a
+             * security field, and it is why the resolution lives in exactly one
+             * function rather than at each point of use.
+             */
+            agentPushBan: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             budgetUsd: z.ZodNullable<z.ZodNumber>;
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         }, {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         }>;
         /**
          * «Run this one without the project's agent prompt.» Absent means no — both
@@ -379,14 +439,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase: number;
         extraBudgetMinutes: number | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -414,14 +478,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         prompt: string;
         providerSessionId: string | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         };
         tickets: {
             number: number;
@@ -465,14 +533,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase: number;
         extraBudgetMinutes: number | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -506,14 +578,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         prompt: string;
         providerSessionId: string | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         };
         tickets: {
             number: number;
@@ -606,26 +682,52 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
              * scratch anyway; the bounds here only keep nonsense off the wire.
              */
             agentPromptPath: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+            /**
+             * Session 18: the project's git policy for agents.
+             *
+             * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above — this
+             * rides inside `hello_ack` with every session on the server, so a malformed
+             * value must cost its own session's policy at most, never the frame.
+             *
+             * «Costs its own session's policy» is safe here BECAUSE of the polarity in
+             * `policy.ts`: `agentPushBan` resolves `undefined` to «refuse», so a value
+             * this schema drops leaves the session strictly more restricted, never less.
+             * That property is the whole reason `.catch(undefined)` is acceptable on a
+             * security field, and it is why the resolution lives in exactly one
+             * function rather than at each point of use.
+             */
+            agentPushBan: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             budgetUsd: z.ZodNullable<z.ZodNumber>;
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         }, {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         }>;
         /**
          * «Run this one without the project's agent prompt.» Absent means no — both
@@ -721,14 +823,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase: number;
         extraBudgetMinutes: number | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -756,14 +862,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         prompt: string;
         providerSessionId: string | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         };
         tickets: {
             number: number;
@@ -805,14 +915,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase: number;
         extraBudgetMinutes: number | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: boolean | undefined;
             agentPromptPath?: string | null | undefined;
+            agentProtectedBranches?: string[] | undefined;
+            agentAllowForcePush?: boolean | undefined;
+            agentAllowDestructiveGit?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -843,14 +957,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         prompt: string;
         providerSessionId: string | null;
         workspace: {
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
             path: string;
             projectId: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             budgetUsd: number | null;
             budgetMinutes: number | null;
             agentAutoCommit?: boolean | undefined;
+            agentPushBan?: unknown;
             agentPromptPath?: unknown;
+            agentProtectedBranches?: unknown;
+            agentAllowForcePush?: unknown;
+            agentAllowDestructiveGit?: unknown;
         };
         tickets: {
             number: number;
@@ -1005,16 +1123,28 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     workspaceId: z.ZodString;
     trustMode: z.ZodOptional<z.ZodEnum<["STRICT", "NORMAL", "AUTO"]>>;
     agentAutoCommit: z.ZodOptional<z.ZodBoolean>;
+    agentPushBan: z.ZodOptional<z.ZodBoolean>;
+    agentProtectedBranches: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    agentAllowForcePush: z.ZodOptional<z.ZodBoolean>;
+    agentAllowDestructiveGit: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     type: "workspace_settings";
     workspaceId: string;
-    agentAutoCommit?: boolean | undefined;
     trustMode?: "STRICT" | "NORMAL" | "AUTO" | undefined;
+    agentAutoCommit?: boolean | undefined;
+    agentPushBan?: boolean | undefined;
+    agentProtectedBranches?: string[] | undefined;
+    agentAllowForcePush?: boolean | undefined;
+    agentAllowDestructiveGit?: boolean | undefined;
 }, {
     type: "workspace_settings";
     workspaceId: string;
-    agentAutoCommit?: boolean | undefined;
     trustMode?: "STRICT" | "NORMAL" | "AUTO" | undefined;
+    agentAutoCommit?: boolean | undefined;
+    agentPushBan?: boolean | undefined;
+    agentProtectedBranches?: string[] | undefined;
+    agentAllowForcePush?: boolean | undefined;
+    agentAllowDestructiveGit?: boolean | undefined;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"session_settings">;
     sessionId: z.ZodString;

package/dist/protocol.js

@@ -64,6 +64,31 @@ export const SessionDescriptorSchema = z.object({
          * scratch anyway; the bounds here only keep nonsense off the wire.
          */
         agentPromptPath: z.string().max(300).nullable().optional().catch(undefined),
+        /**
+         * Session 18: the project's git policy for agents.
+         *
+         * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above — this
+         * rides inside `hello_ack` with every session on the server, so a malformed
+         * value must cost its own session's policy at most, never the frame.
+         *
+         * «Costs its own session's policy» is safe here BECAUSE of the polarity in
+         * `policy.ts`: `agentPushBan` resolves `undefined` to «refuse», so a value
+         * this schema drops leaves the session strictly more restricted, never less.
+         * That property is the whole reason `.catch(undefined)` is acceptable on a
+         * security field, and it is why the resolution lives in exactly one
+         * function rather than at each point of use.
+         */
+        agentPushBan: z.boolean().optional().catch(undefined),
+        agentProtectedBranches: z
+            .array(z
+            .string()
+            .max(200)
+            .regex(/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/))
+            .max(20)
+            .optional()
+            .catch(undefined),
+        agentAllowForcePush: z.boolean().optional().catch(undefined),
+        agentAllowDestructiveGit: z.boolean().optional().catch(undefined),
         budgetUsd: z.number().nullable(),
         budgetMinutes: z.number().nullable(),
     }),
@@ -230,6 +255,19 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
         workspaceId: z.string().min(1).max(64),
         trustMode: z.enum(['STRICT', 'NORMAL', 'AUTO']).optional(),
         agentAutoCommit: z.boolean().optional(),
+        // Session 18 — the git policy, for the same reason: read on every tool
+        // call, so switching «Принудительно запретить push» back on must not
+        // require stopping the agent first.
+        agentPushBan: z.boolean().optional(),
+        agentProtectedBranches: z
+            .array(z
+            .string()
+            .max(200)
+            .regex(/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/))
+            .max(20)
+            .optional(),
+        agentAllowForcePush: z.boolean().optional(),
+        agentAllowDestructiveGit: z.boolean().optional(),
     }),
     z.object({
         type: z.literal('session_settings'),

package/dist/supervisor.js

@@ -22,6 +22,28 @@ import { availableModes, MODE_REFUSED_TEXT } from './adapters/types.js';
 /** Refusals shared by every checkpoint command (ticket #126). */
 const CHECKPOINTS_OFF = 'Restore points are switched off on this server ([checkpoints] enabled = false)';
 const AGENT_BUSY = 'The agent is still working — stop the turn first';
+/**
+ * The project's git policy, lifted out of a session descriptor (session 18).
+ *
+ * One function so that «which descriptor fields are the git policy» is answered
+ * once. Absent fields are passed through as absent — `resolveGitPolicy` in
+ * `policy.ts` is the single place that decides what absent MEANS, and inventing
+ * a default here would put a second such place in the codebase, facing the
+ * other way.
+ */
+function gitPolicyOf(descriptor) {
+    const w = descriptor.workspace;
+    return {
+        ...(w.agentPushBan !== undefined ? { agentPushBan: w.agentPushBan } : {}),
+        ...(w.agentProtectedBranches !== undefined
+            ? { agentProtectedBranches: w.agentProtectedBranches }
+            : {}),
+        ...(w.agentAllowForcePush !== undefined ? { agentAllowForcePush: w.agentAllowForcePush } : {}),
+        ...(w.agentAllowDestructiveGit !== undefined
+            ? { agentAllowDestructiveGit: w.agentAllowDestructiveGit }
+            : {}),
+    };
+}
 export class Supervisor {
     ws;
     opts;
@@ -131,11 +153,43 @@ export class Supervisor {
                     if (frame.agentAutoCommit !== undefined) {
                         running.descriptor.workspace.agentAutoCommit = frame.agentAutoCommit;
                     }
+                    /**
+                     * Session 18: the git policy, applied live for the same reason as the
+                     * two above — it is read on every tool call, so «switch push back
+                     * off» must not mean «stop the agent first».
+                     *
+                     * The four fields move together, and the API sends all four in every
+                     * frame that touches any of them, so a partial update cannot leave
+                     * the runner with «push is allowed now» beside a protected list from
+                     * before the change. `!== undefined` on the FRAME is what tells a
+                     * policy change apart from a trust-only frame; inside the object,
+                     * `undefined` keeps its restrictive meaning as everywhere else.
+                     */
+                    const policyChanged = frame.agentPushBan !== undefined ||
+                        frame.agentProtectedBranches !== undefined ||
+                        frame.agentAllowForcePush !== undefined ||
+                        frame.agentAllowDestructiveGit !== undefined;
+                    if (policyChanged) {
+                        const next = {
+                            ...(frame.agentPushBan !== undefined ? { agentPushBan: frame.agentPushBan } : {}),
+                            ...(frame.agentProtectedBranches !== undefined
+                                ? { agentProtectedBranches: frame.agentProtectedBranches }
+                                : {}),
+                            ...(frame.agentAllowForcePush !== undefined
+                                ? { agentAllowForcePush: frame.agentAllowForcePush }
+                                : {}),
+                            ...(frame.agentAllowDestructiveGit !== undefined
+                                ? { agentAllowDestructiveGit: frame.agentAllowDestructiveGit }
+                                : {}),
+                        };
+                        Object.assign(running.descriptor.workspace, next);
+                    }
                     running.session?.setWorkspacePolicy({
                         ...(frame.trustMode !== undefined ? { trustMode: frame.trustMode } : {}),
                         ...(frame.agentAutoCommit !== undefined
                             ? { agentAutoCommit: frame.agentAutoCommit }
                             : {}),
+                        ...(policyChanged ? { gitPolicy: gitPolicyOf(running.descriptor) } : {}),
                     });
                 }
                 break;
@@ -406,6 +460,11 @@ export class Supervisor {
             ...(descriptor.workspace.agentAutoCommit === undefined
                 ? {}
                 : { agentAutoCommit: descriptor.workspace.agentAutoCommit }),
+            // Session 18. Always present, even when every field inside it is absent:
+            // an absent OBJECT and an object of absent fields resolve identically
+            // (`resolveGitPolicy` gives both the restrictive reading), and passing it
+            // unconditionally keeps one code path instead of two.
+            gitPolicy: gitPolicyOf(descriptor),
             mode: running.mode,
             ...(running.model ? { model: running.model } : {}),
             ...(running.effort ? { effort: running.effort } : {}),
@@ -3358,16 +3417,58 @@ export function composeInitialPrompt(descriptor) {
 export function composeWorkspaceContext(descriptor, agentPrompt) {
     const sections = [];
     const plan = descriptor.branchPlan;
+    /**
+     * What this session may do about push, in one sentence (session 18).
+     *
+     * `!== false` — silence refuses, exactly as `resolveGitPolicy` reads it. This
+     * text and the rule in `policy.ts` have to agree; an agent told it may push
+     * and then refused has been lied to, and an agent told it may not while the
+     * project allows it wastes the freedom the owner paid for.
+     */
+    const pushLine = (() => {
+        // `?.` and not `.`: this function is exported and called with descriptors
+        // assembled by hand in tests and by older code paths. A missing `workspace`
+        // must land on the refusing branch like every other unknown here, not throw
+        // and take the whole session start with it.
+        if (descriptor.workspace?.agentPushBan !== false) {
+            return '- You cannot push: `git push` is refused for this project. A human presses «Push» in DevBridge when they want the branch on the remote.';
+        }
+        const guarded = descriptor.workspace?.agentProtectedBranches ?? ['main', 'master'];
+        return guarded.length > 0
+            ? `- You may push, except to these protected branches: ${guarded.join(', ')}. Name the branch explicitly — \`git push <remote> <branch>\`.`
+            : '- You may push.';
+    })();
     if (plan) {
         const forked = plan.baseBranch ? ` It was branched from \`${plan.baseBranch}\`.` : '';
         sections.push([
             'Git in this session:',
             `- You are in a dedicated worktree on branch \`${plan.branch}\`.${forked}`,
             '- Commit to this branch. Do not switch branches and do not merge into the base branch yourself — a human presses «Apply» in DevBridge, which squash-merges your branch for them.',
-            '- You cannot push: `git push` is refused. A human presses «Push» when they want the branch on the remote.',
+            pushLine,
             `- Put a plan or working notes in \`docs/devbridge/${plan.branch.replace(/\//g, '-')}.md\`, unless this repository already has its own convention for where such documents live — if it does, follow that.`,
         ].join('\n'));
     }
+    else {
+        /**
+         * A DIRECT session got NO «Git in this session» block at all, and that is
+         * the older half of this bug (session 16 shipped DIRECT as the default;
+         * this block stayed gated on `branchPlan`, which only a BRANCH session
+         * has). So the arrangement that writes into the person's OWN project
+         * folder was the one told nothing about where it was — while the adapter's
+         * static line went on claiming «a dedicated git worktree on a session
+         * branch», which in DIRECT is simply false.
+         *
+         * Being in somebody's working copy is the case that needs saying MORE, not
+         * less: there is no «Apply» to undo it, and uncommitted changes in that
+         * folder may not be the agent's.
+         */
+        sections.push([
+            'Git in this session:',
+            '- You are working in the PROJECT FOLDER ITSELF, on the branch it is already checked out on — not in a worktree of your own. There is no session branch and nothing to «apply» afterwards: your commits are immediately on the branch the person works on.',
+            '- Uncommitted changes you find here may be a human’s, or another session’s. Never discard or reset what you did not write.',
+            pushLine,
+        ].join('\n'));
+    }
     // The ticket convention lives HERE, not in the first chat message (session
     // 16). It is a standing rule of the project — true on the twentieth turn as
     // much as the first — and putting it in the visible prompt only trained the

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.31.0";
+export declare const RUNNER_VERSION = "0.33.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.31.0';
+export const RUNNER_VERSION = '0.33.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",