@bridge4dev/runner 0.31.0 → 0.34.0

package/dist/supervisor.js

@@ -22,6 +22,34 @@ import { availableModes, MODE_REFUSED_TEXT } from './adapters/types.js';
 /** Refusals shared by every checkpoint command (ticket #126). */
 const CHECKPOINTS_OFF = 'Restore points are switched off on this server ([checkpoints] enabled = false)';
 const AGENT_BUSY = 'The agent is still working — stop the turn first';
+/**
+ * Adapter events that exist only because the agent is producing output right
+ * now (ticket #185). `message` is deliberately absent — a user echo carries the
+ * same type and proves nothing about the agent — and is handled at the call site.
+ */
+const AGENT_OUTPUT_EVENTS = new Set(['tool', 'thinking']);
+/**
+ * The project's git policy, lifted out of a session descriptor (session 18).
+ *
+ * One function so that «which descriptor fields are the git policy» is answered
+ * once. Absent fields are passed through as absent — `resolveGitPolicy` in
+ * `policy.ts` is the single place that decides what absent MEANS, and inventing
+ * a default here would put a second such place in the codebase, facing the
+ * other way.
+ */
+function gitPolicyOf(descriptor) {
+    const w = descriptor.workspace;
+    return {
+        ...(w.agentPushBan !== undefined ? { agentPushBan: w.agentPushBan } : {}),
+        ...(w.agentProtectedBranches !== undefined
+            ? { agentProtectedBranches: w.agentProtectedBranches }
+            : {}),
+        ...(w.agentAllowForcePush !== undefined ? { agentAllowForcePush: w.agentAllowForcePush } : {}),
+        ...(w.agentAllowDestructiveGit !== undefined
+            ? { agentAllowDestructiveGit: w.agentAllowDestructiveGit }
+            : {}),
+    };
+}
 export class Supervisor {
     ws;
     opts;
@@ -131,11 +159,43 @@ export class Supervisor {
                     if (frame.agentAutoCommit !== undefined) {
                         running.descriptor.workspace.agentAutoCommit = frame.agentAutoCommit;
                     }
+                    /**
+                     * Session 18: the git policy, applied live for the same reason as the
+                     * two above — it is read on every tool call, so «switch push back
+                     * off» must not mean «stop the agent first».
+                     *
+                     * The four fields move together, and the API sends all four in every
+                     * frame that touches any of them, so a partial update cannot leave
+                     * the runner with «push is allowed now» beside a protected list from
+                     * before the change. `!== undefined` on the FRAME is what tells a
+                     * policy change apart from a trust-only frame; inside the object,
+                     * `undefined` keeps its restrictive meaning as everywhere else.
+                     */
+                    const policyChanged = frame.agentPushBan !== undefined ||
+                        frame.agentProtectedBranches !== undefined ||
+                        frame.agentAllowForcePush !== undefined ||
+                        frame.agentAllowDestructiveGit !== undefined;
+                    if (policyChanged) {
+                        const next = {
+                            ...(frame.agentPushBan !== undefined ? { agentPushBan: frame.agentPushBan } : {}),
+                            ...(frame.agentProtectedBranches !== undefined
+                                ? { agentProtectedBranches: frame.agentProtectedBranches }
+                                : {}),
+                            ...(frame.agentAllowForcePush !== undefined
+                                ? { agentAllowForcePush: frame.agentAllowForcePush }
+                                : {}),
+                            ...(frame.agentAllowDestructiveGit !== undefined
+                                ? { agentAllowDestructiveGit: frame.agentAllowDestructiveGit }
+                                : {}),
+                        };
+                        Object.assign(running.descriptor.workspace, next);
+                    }
                     running.session?.setWorkspacePolicy({
                         ...(frame.trustMode !== undefined ? { trustMode: frame.trustMode } : {}),
                         ...(frame.agentAutoCommit !== undefined
                             ? { agentAutoCommit: frame.agentAutoCommit }
                             : {}),
+                        ...(policyChanged ? { gitPolicy: gitPolicyOf(running.descriptor) } : {}),
                     });
                 }
                 break;
@@ -406,6 +466,11 @@ export class Supervisor {
             ...(descriptor.workspace.agentAutoCommit === undefined
                 ? {}
                 : { agentAutoCommit: descriptor.workspace.agentAutoCommit }),
+            // Session 18. Always present, even when every field inside it is absent:
+            // an absent OBJECT and an object of absent fields resolve identically
+            // (`resolveGitPolicy` gives both the restrictive reading), and passing it
+            // unconditionally keeps one code path instead of two.
+            gitPolicy: gitPolicyOf(descriptor),
             mode: running.mode,
             ...(running.model ? { model: running.model } : {}),
             ...(running.effort ? { effort: running.effort } : {}),
@@ -987,8 +1052,47 @@ export class Supervisor {
         }
         running.session.stop('session_parked');
     }
+    /**
+     * The agent is producing output while this runner still says a human is
+     * expected — put `lastReported` back to RUNNING (ticket #185).
+     *
+     * This is not cosmetics on top of the API's own repair. While `lastReported`
+     * lies, two things break here and only here:
+     *
+     *  - `isParkable()` reads WAITING_INPUT with no open question as «idle», so
+     *    `ensureCapacity` may KILL a live agent process to hand its slot to
+     *    another session;
+     *  - `isBillable()` counts only RUNNING/STARTING, so `agentActiveMs` stops
+     *    growing and the time budget never fires for work that is really happening.
+     *
+     * It happens for real: a background subagent's report wakes a new turn inside
+     * the agent process (SDK 0.3.226 emits a second `system:init` and a `result`
+     * carrying `origin: {kind:'task-notification'}`), and nothing here reports a
+     * turn the runner did not start. Compaction does the same, and so does a
+     * question this runner withdraws by itself.
+     *
+     * An open question is the one thing that must survive: there, WAITING_INPUT
+     * means a tool call is parked on a person, and the agent narrating around its
+     * own question must not take the card off the screen.
+     */
+    noteAgentIsWorking(running) {
+        if (running.openQuestions.size > 0)
+            return;
+        if (running.stopRequested || running.parkRequested || running.budgetSpent)
+            return;
+        if (running.lastReported !== 'WAITING_INPUT' && running.lastReported !== 'REVIEW')
+            return;
+        running.lastReported = 'RUNNING';
+        this.syncBudgetClock(running);
+        this.reportStatus(running.descriptor.id, 'RUNNING', {});
+    }
     forwardEvent(running, event) {
         const { descriptor } = running;
+        // Anything below that is the agent talking means the agent is working. Read
+        // before the switch so every such case gets it, including the ones added
+        // after this line was written.
+        if (event.type === 'message' ? event.role === 'assistant' : AGENT_OUTPUT_EVENTS.has(event.type))
+            this.noteAgentIsWorking(running);
         switch (event.type) {
             case 'provider_session': {
                 running.descriptor = { ...descriptor, providerSessionId: event.providerSessionId };
@@ -2372,6 +2476,21 @@ export class Supervisor {
                             error: 'The agent could not compact right now — wait for the current turn to finish',
                         });
                     }
+                    // Ticket #185. Compaction is a whole agent turn — `/compact` goes in
+                    // as an ordinary user message — and until now nobody said so: the
+                    // session read «Ваш ход» for the entire squeeze, and the dashboard
+                    // papered over it with `compactingSince`, a variable that exists only
+                    // in the tab that pressed the button. A second tab, a teammate or a
+                    // reload saw a session waiting for a person who had nothing to do.
+                    //
+                    // It is also not only cosmetic here: a session reading WAITING_INPUT
+                    // with no open question is parkable, and parking it would kill the
+                    // compaction mid-flight.
+                    if (running.lastReported !== 'RUNNING') {
+                        running.lastReported = 'RUNNING';
+                        this.syncBudgetClock(running);
+                        this.reportStatus(running.descriptor.id, 'RUNNING', {});
+                    }
                     return void reply({ ok: true, result: { started: true } });
                 }
                 case 'git_status': {
@@ -3358,16 +3477,58 @@ export function composeInitialPrompt(descriptor) {
 export function composeWorkspaceContext(descriptor, agentPrompt) {
     const sections = [];
     const plan = descriptor.branchPlan;
+    /**
+     * What this session may do about push, in one sentence (session 18).
+     *
+     * `!== false` — silence refuses, exactly as `resolveGitPolicy` reads it. This
+     * text and the rule in `policy.ts` have to agree; an agent told it may push
+     * and then refused has been lied to, and an agent told it may not while the
+     * project allows it wastes the freedom the owner paid for.
+     */
+    const pushLine = (() => {
+        // `?.` and not `.`: this function is exported and called with descriptors
+        // assembled by hand in tests and by older code paths. A missing `workspace`
+        // must land on the refusing branch like every other unknown here, not throw
+        // and take the whole session start with it.
+        if (descriptor.workspace?.agentPushBan !== false) {
+            return '- You cannot push: `git push` is refused for this project. A human presses «Push» in DevBridge when they want the branch on the remote.';
+        }
+        const guarded = descriptor.workspace?.agentProtectedBranches ?? ['main', 'master'];
+        return guarded.length > 0
+            ? `- You may push, except to these protected branches: ${guarded.join(', ')}. Name the branch explicitly — \`git push <remote> <branch>\`.`
+            : '- You may push.';
+    })();
     if (plan) {
         const forked = plan.baseBranch ? ` It was branched from \`${plan.baseBranch}\`.` : '';
         sections.push([
             'Git in this session:',
             `- You are in a dedicated worktree on branch \`${plan.branch}\`.${forked}`,
             '- Commit to this branch. Do not switch branches and do not merge into the base branch yourself — a human presses «Apply» in DevBridge, which squash-merges your branch for them.',
-            '- You cannot push: `git push` is refused. A human presses «Push» when they want the branch on the remote.',
+            pushLine,
             `- Put a plan or working notes in \`docs/devbridge/${plan.branch.replace(/\//g, '-')}.md\`, unless this repository already has its own convention for where such documents live — if it does, follow that.`,
         ].join('\n'));
     }
+    else {
+        /**
+         * A DIRECT session got NO «Git in this session» block at all, and that is
+         * the older half of this bug (session 16 shipped DIRECT as the default;
+         * this block stayed gated on `branchPlan`, which only a BRANCH session
+         * has). So the arrangement that writes into the person's OWN project
+         * folder was the one told nothing about where it was — while the adapter's
+         * static line went on claiming «a dedicated git worktree on a session
+         * branch», which in DIRECT is simply false.
+         *
+         * Being in somebody's working copy is the case that needs saying MORE, not
+         * less: there is no «Apply» to undo it, and uncommitted changes in that
+         * folder may not be the agent's.
+         */
+        sections.push([
+            'Git in this session:',
+            '- You are working in the PROJECT FOLDER ITSELF, on the branch it is already checked out on — not in a worktree of your own. There is no session branch and nothing to «apply» afterwards: your commits are immediately on the branch the person works on.',
+            '- Uncommitted changes you find here may be a human’s, or another session’s. Never discard or reset what you did not write.',
+            pushLine,
+        ].join('\n'));
+    }
     // The ticket convention lives HERE, not in the first chat message (session
     // 16). It is a standing rule of the project — true on the twentieth turn as
     // much as the first — and putting it in the visible prompt only trained the

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.31.0";
+export declare const RUNNER_VERSION = "0.34.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.31.0';
+export const RUNNER_VERSION = '0.34.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.31.0",
+  "version": "0.34.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",
@@ -37,16 +37,16 @@
     "prepublishOnly": "tsc"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.218",
-    "smol-toml": "^1.7.0",
-    "ws": "^8.21.1",
-    "zod": "^3.24.0"
+    "@anthropic-ai/claude-agent-sdk": "^0.3.226",
+    "smol-toml": "^1.7.1",
+    "ws": "^8.21.3",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@types/node": "^22.10.2",
+    "@types/node": "^22.20.1",
     "@types/ws": "^8.18.1",
-    "tsx": "^4.19.2",
-    "typescript": "~5.7.2",
-    "vitest": "^2.1.9"
+    "tsx": "^4.23.11",
+    "typescript": "~5.7.3",
+    "vitest": "^3.2.7"
   }
 }