@bridge4dev/runner 0.45.1 → 0.46.1

package/dist/adapters/claude.js

@@ -5,7 +5,7 @@ import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { mcpConfigPath } from '../paths.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
-import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './rate-limits.js';
 import { applyUsagePercentages, parseUsageText, probeUsageText } from './claude-usage.js';
 import { claudeCliPath } from '../agent-binary.js';
@@ -486,7 +486,7 @@ class ClaudeSession {
         // to a 0600 file before the CLI is spawned and removed in `stop()`.
         const mcpServers = spec.mcp
             ? {
-                devbridge: {
+                [DEVBRIDGE_MCP_SERVER_NAME]: {
                     type: 'http',
                     url: spec.mcp.url,
                     headers: { Authorization: `Bearer ${spec.mcp.token}` },

package/dist/adapters/codex.d.ts

@@ -81,6 +81,16 @@ export declare function readEfforts(value: unknown): EffortOption[];
  * we say we do not know — which is the honest answer and the safe one.
  */
 export declare function codexResetsAt(raw: unknown): string | null;
+/**
+ * The reset time as a sentence, not as a machine stamp.
+ *
+ * `2026-08-31T14:02:42.000Z` in the middle of a feed reads like a log line that
+ * escaped. The hour and minute in UTC is what a person actually needs, and UTC
+ * is named rather than converted: this runs on a dev server whose timezone has
+ * nothing to do with the reader's, and a silently wrong local time is worse
+ * than an explicit foreign one.
+ */
+export declare function describeResetTime(iso: string): string;
 export declare class CodexAdapter implements AgentAdapter {
     private readonly deps;
     readonly id: "codex";

package/dist/adapters/codex.js

@@ -5,7 +5,7 @@ import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
 import { truncate } from './claude.js';
-import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { clampPercent, rateWindowKeyFromMinutes } from './rate-limits.js';
 import { answerSummary, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
@@ -267,6 +267,15 @@ class CodexSession {
                         // `missing`, not `expired`: nothing expired, there is simply no login.
                         code: 'auth_missing',
                     });
+                    // The fourth door, and the one that matters most now: this is the
+                    // ordinary «Codex was never signed in on this machine» path, and
+                    // `auth_missing` is the only code that still earns a relaunch. With
+                    // `finish()` alone the app-server we just started is orphaned — it
+                    // sets `stopped`, so the later `stop()` returns on its first line and
+                    // nothing ever kills the child — and the relaunch then starts a
+                    // second one beside it. Two strays per session, from the branch
+                    // built to recover. Found by independent QA, 01.09.2026.
+                    this.stop();
                     this.finish();
                     return;
                 }
@@ -297,6 +306,13 @@ class CodexSession {
             // Before finish(): it ends the output queue, so emitting after it would
             // drop the error entirely and the session would just stop with no reason.
             this.classifyAndEmitFailure(error);
+            // `stop()` before `finish()`, not instead of it. The start may have failed
+            // with the app-server alive and well (a refused sign-in does exactly
+            // that), and `finish()` alone sets `stopped` — after which `stop()`
+            // returns on its first line and nothing ever kills the child. `finish()`
+            // still follows, because a client that died before it could spawn will
+            // never fire the exit handler that would otherwise end the queue.
+            this.stop();
             this.finish();
         }
     }
@@ -463,7 +479,7 @@ class CodexSession {
             return {};
         return {
             mcp_servers: {
-                devbridge: {
+                [DEVBRIDGE_MCP_SERVER_NAME]: {
                     url: mcp.url,
                     http_headers: { Authorization: `Bearer ${mcp.token}` },
                     // Reading and updating tickets is what the session is FOR — the same
@@ -541,6 +557,13 @@ class CodexSession {
             this.activeTurnId = str(turn['id']) ?? this.activeTurnId;
         })
             .catch((error) => {
+            // #344. This rejection was the back door: it reported every failure as
+            // a bare turn ending with the provider's raw sentence and no code, so
+            // a refused sign-in arrived as «Please log out and sign in again» —
+            // which people read as being about their DevBridge account — with
+            // nothing for the dashboard to offer a «Sign in» button on.
+            if (this.endedOnAuthFailure(describe(error)))
+                return;
             this.emit({ type: 'turn_end', ok: false, errorMessage: describe(error) });
         });
     }
@@ -1196,6 +1219,21 @@ class CodexSession {
                 if (willRetry)
                     return;
                 const detail = asRecord(params['error']);
+                // #258, reopened 31.08.2026. A spent plan arrives here FIRST and as a
+                // turn failure only afterwards — on production the two were seventy-one
+                // seconds apart. Treated as a crash, the first one filed the session
+                // FAILED, which is terminal, and every later frame was answered with
+                // «that session is gone»: the auto-pause could not arm, the reset time
+                // was never read, and the person saw the same sentence eight times over
+                // a dead session. Claude has no equivalent path, which is the whole of
+                // why it behaved and this did not.
+                if (this.noteRateLimitRefusal(detail))
+                    return;
+                // #344. The one door of the three that always did classify — but it
+                // left the process running, so the session sat FAILED beside a live
+                // agent that would refuse every turn with the same credential.
+                if (this.endedOnAuthFailure(str(detail['message']) ?? ''))
+                    return;
                 this.classifyAndEmitFailure(new Error(str(detail['message']) ?? 'Codex reported an error'));
                 return;
             }
@@ -1220,10 +1258,20 @@ class CodexSession {
                 return;
             }
             case 'mcpServer/startupStatus/updated': {
-                const name = str(params['name']) ?? 'MCP server';
+                // Named or not, the sentence below already says «MCP server» — an
+                // absent name used to make it say so twice.
+                const name = str(params['name']);
                 const status = str(params['status']);
                 if (status === 'failed') {
-                    this.notice('warn', `MCP server ${name} failed to start — the agent cannot reach tickets`);
+                    // #346. The sentence about tickets belongs to OUR server and to no
+                    // other. Codex starts built-in ones of its own — `codex_apps`, its
+                    // ChatGPT Apps connector, which fails precisely when the sign-in is
+                    // dead — and saying «the agent cannot reach tickets» over a
+                    // `devbridge` that is up with all 29 tools is a false alarm that
+                    // costs the true alarm its credibility.
+                    this.notice('warn', name === DEVBRIDGE_MCP_SERVER_NAME
+                        ? `MCP server ${name} failed to start — the agent cannot reach tickets`
+                        : `MCP server ${name ?? '(unnamed)'} failed to start — its tools are unavailable to the agent`);
                 }
                 return;
             }
@@ -1442,8 +1490,45 @@ class CodexSession {
                 resetsAt: codexResetsAt(window['resetsAt'] ?? window['resets_at']),
             });
         }
-        this.rateLimitWindows = windows.sort((a, b) => (a.windowMinutes ?? Number.MAX_SAFE_INTEGER) - (b.windowMinutes ?? Number.MAX_SAFE_INTEGER));
-        this.ratePlanType = str(snapshot['planType'] ?? snapshot['plan_type']) ?? null;
+        /**
+         * A snapshot with no windows never LOWERS what we know (#258, 31.08.2026).
+         *
+         * Codex sends one at the exact moment it refuses a turn: on production the
+         * five-hour window was reported at 100 % with a reset time of 14:02, and
+         * six hundred milliseconds later the same process sent an empty snapshot,
+         * then the refusal. `rateLimitRefusal` borrows its clock from this list, so
+         * by the time it looked there was nothing to borrow — the block went out as
+         * `{key: 'other', resetsAt: null}`, the API answered «reset time unknown»
+         * and the session stopped instead of sleeping until the window reopened.
+         *
+         * «No plan» stays expressible, because that is the case where a window has
+         * never arrived at all — an API-key account sends empty snapshots and
+         * nothing else, and `available` below is still false for it. What cannot
+         * happen any more is knowing something and then unknowing it.
+         */
+        const merged = new Map(this.rateLimitWindows.map((window) => [window.key, window]));
+        for (const window of windows)
+            merged.set(window.key, window);
+        this.rateLimitWindows = [...merged.values()].sort((a, b) => (a.windowMinutes ?? Number.MAX_SAFE_INTEGER) - (b.windowMinutes ?? Number.MAX_SAFE_INTEGER));
+        /**
+         * Merged BY WINDOW, not snapshot-for-snapshot.
+         *
+         * Codex routinely sends a snapshot carrying one slot with the other null —
+         * the live payload recorded above is exactly that — so replacing the list
+         * wholesale erases a window that has not gone anywhere. It matters because
+         * `rateLimitRefusal` borrows its clock from the FULLEST known window: lose
+         * the five-hour one and the refusal borrows the weekly one instead, whose
+         * reset is days out, and the API answers «longer than five hours» and calls
+         * a human rather than sleeping twenty minutes.
+         *
+         * The cost is a window that lingers after Codex stops mentioning it, with a
+         * percentage going stale on the ring. That is the smaller error: a stale
+         * percentage misinforms, a missing clock changes what the product does.
+         *
+         * The plan type survives an empty snapshot for the same reason — «pro»
+         * does not stop being true because one update carried no fields.
+         */
+        this.ratePlanType = str(snapshot['planType'] ?? snapshot['plan_type']) ?? this.ratePlanType;
         this.emitRateLimits();
     }
     emitRateLimits(blocked = null) {
@@ -1494,6 +1579,103 @@ class CodexSession {
             this.turnIrreversible = true;
         }
     }
+    /** A refusal already recognised, waiting for the turn it belongs to to end. */
+    limitBlockPending = false;
+    limitSettleTimer;
+    /** A turn this adapter closed itself; Codex's own late ending is ignored. */
+    selfSettledTurnId = null;
+    /**
+     * How long a recognised refusal waits for `turn/completed` before we end the
+     * turn ourselves. Codex took seventy-one seconds on the production incident,
+     * so this is generous on purpose: the cost of waiting is a session that says
+     * «working» a little too long, and the cost of not waiting is two endings for
+     * one turn.
+     */
+    static LIMIT_SETTLE_MS = 180_000;
+    /**
+     * The plan is spent — say so, and keep the session alive to be woken.
+     *
+     * This is the Codex half of what the Claude adapter already does through
+     * `limitBlockPending`: a refusal is recorded, the block goes out on a
+     * `rate_limits` frame so the API can arm its clock, and the turn ends
+     * carrying `limitBlocked` — which is what keeps the status out of FAILED.
+     * Terminal is the one thing it must not be: `applyRateLimitBlock` refuses to
+     * schedule anything for a session that has already ended, so a session filed
+     * FAILED here can never be the session that wakes up later.
+     *
+     * A `notice` rather than an `error`, deliberately: the supervisor collapses
+     * repeated notices for the life of a session and does not collapse errors, so
+     * the same sentence printed itself once per refusal — eight times in the
+     * feed of the session this was found on.
+     */
+    noteRateLimitRefusal(error) {
+        const blocked = this.rateLimitRefusal(error);
+        if (!blocked)
+            return false;
+        this.emitRateLimits(blocked);
+        this.emit({
+            type: 'notice',
+            level: 'warn',
+            text: 'Codex refused the turn: the plan limit is spent' +
+                (blocked.resetsAt ? `, and it lifts at ${describeResetTime(blocked.resetsAt)}.` : '.'),
+        });
+        /**
+         * The flag is set ONLY while a turn is in flight, and that is not caution.
+         *
+         * Its whole job is to make the ending of THIS turn carry `limitBlocked`. A
+         * refusal that arrives between turns has no ending to mark, so a flag set
+         * here would simply wait — and the next turn, which may be a perfectly good
+         * one after the window reopened, would inherit it and be filed as refused.
+         * The API is told about the refusal either way: `applyRateLimitBlock` is
+         * driven by the `rate_limits` frame above, not by this flag.
+         */
+        if (this.activeTurnId === null)
+            return true;
+        this.limitBlockPending = true;
+        if (this.limitSettleTimer === undefined) {
+            this.limitSettleTimer = setTimeout(() => {
+                this.limitSettleTimer = undefined;
+                if (this.stopped || this.activeTurnId === null)
+                    return;
+                // Codex never closed the turn. End it the way `onTurnCompleted` would
+                // have, so the session lands in a status a human can act on instead of
+                // saying «working» for ever.
+                //
+                // Remembered by id, because Codex closing it LATE is the likelier
+                // outcome than never — it was seventy-one seconds late in the incident
+                // — and a second `turn_end` for one turn would report the session back
+                // out of the pause this one is arming.
+                this.selfSettledTurnId = this.activeTurnId;
+                // The turn is over as far as this adapter is concerned. Leaving
+                // `activeTurnId` set would make everything downstream believe an agent
+                // is still working — a steer would be aimed at a turn that has ended,
+                // and the next real turn would look like a turn already in flight.
+                this.activeTurnId = null;
+                this.emit({
+                    type: 'turn_end',
+                    ok: false,
+                    errorMessage: maskString(str(error['message']) ?? 'The plan limit is spent').slice(0, 500),
+                    ...(this.consumeLimitBlock() ? { limitBlocked: true } : {}),
+                    ...(this.turnProduced ? { produced: true } : {}),
+                });
+            }, CodexSession.LIMIT_SETTLE_MS);
+            this.limitSettleTimer.unref?.();
+        }
+        return true;
+    }
+    /** Read the refusal flag and clear it: one refusal marks exactly one ending. */
+    consumeLimitBlock() {
+        const blocked = this.limitBlockPending;
+        this.limitBlockPending = false;
+        this.clearLimitSettle();
+        return blocked;
+    }
+    clearLimitSettle() {
+        if (this.limitSettleTimer === undefined)
+            return;
+        clearTimeout(this.limitSettleTimer);
+        this.limitSettleTimer = undefined;
+    }
     rateLimitRefusal(error) {
         // The machine-readable cause FIRST. Codex 0.147.0 says `usageLimitExceeded`
         // — Exceeded, not Reached — so not one of the four substrings below ever
@@ -1521,12 +1703,29 @@ class CodexSession {
         // `activeTurnId` so a steered turn anchors on what the thread actually
         // recorded.
         this.lastCompletedTurnId = str(turn['id']) ?? this.activeTurnId ?? this.lastCompletedTurnId;
+        // We already ended this one ourselves when the plan refusal arrived and
+        // Codex did not close the turn in time. Its late ending is the same event,
+        // not a second one — and reporting it would move the session out of the
+        // pause the first ending armed.
+        if (this.selfSettledTurnId !== null && str(turn['id']) === this.selfSettledTurnId) {
+            this.selfSettledTurnId = null;
+            // `activeTurnId` is deliberately untouched. It was cleared when we
+            // settled, so anything sitting in it now belongs to a NEWER turn that
+            // started while Codex was still catching up with this one.
+            return;
+        }
         this.activeTurnId = null;
         // A held plan means the turn ended by proposing, not by finishing the work.
         if (this.heldPlan)
             return;
         if (status === 'failed') {
             const error = asRecord(turn['error']);
+            // #344. A refused sign-in ends the SESSION, not just this turn, so it
+            // leaves through the one funnel below rather than as a turn failure
+            // carrying Codex's own English at the person. Checked before the rate
+            // limit, because the two are alternatives and this one is terminal.
+            if (this.endedOnAuthFailure(str(error['message']) ?? ''))
+                return;
             // Ticket #258. Codex says «you were refused»; it does NOT have to say
             // when the refusal lifts, because `account/rateLimits/updated` has been
             // telling us that all along. So the error only has to be recognised, and
@@ -1535,6 +1734,20 @@ class CodexSession {
             const blocked = this.rateLimitRefusal(error);
             if (blocked)
                 this.emitRateLimits(blocked);
+            // The refusal may have been recognised already, on the `error`
+            // notification that precedes this by up to a minute — `consumeLimitBlock`
+            // is what carries it across that gap. Either source is enough; a Codex
+            // that stops carrying the marker on one of the two frames must not cost
+            // the session its pause.
+            //
+            // Consumed on its own line, NEVER as the right-hand side of `||`: in the
+            // production sequence the marker rides on BOTH frames, so short-circuit
+            // evaluation would skip the consume and leave the pending flag set and
+            // the settle timer armed. The timer would then fire a second ending for
+            // a turn that is already over, and the stale flag would mark the next,
+            // unrelated turn as refused.
+            const carried = this.consumeLimitBlock();
+            const refused = Boolean(blocked) || carried;
             // #252: the machine-readable cause, beside the sentence. `codexErrorInfo`
             // is Codex's own enum (`usageLimitExceeded`, `httpConnectionFailed`,
             // `responseStreamConnectionFailed`, `contextWindowExceeded`, …) and it is
@@ -1549,7 +1762,7 @@ class CodexSession {
                 // Without this the session goes FAILED — terminal — and the pause armed
                 // one line earlier would ring into a dead row and throw the person's
                 // queued words away instead of sending them.
-                ...(blocked ? { limitBlocked: true } : {}),
+                ...(refused ? { limitBlocked: true } : {}),
                 ...(failureCode !== undefined ? { failureCode } : {}),
                 ...(typeof failureStatus === 'number' ? { failureStatus } : {}),
                 ...(this.turnProduced ? { produced: true } : {}),
@@ -1564,6 +1777,11 @@ class CodexSession {
             type: 'turn_end',
             ok: true,
             ...(status === 'interrupted' ? { aborted: true } : {}),
+            // #258: a refusal can end the turn EITHER way, so the flag rides on both
+            // branches exactly as it does in the Claude adapter. Consuming it here
+            // also disarms the settle timer — a turn that ended is not a turn we are
+            // still owed an ending for.
+            ...(this.consumeLimitBlock() ? { limitBlocked: true } : {}),
             // #300, the twin of the failing branch above: a turn that ended well
             // having produced nothing is usually no turn at all, and the supervisor
             // holds it rather than saying «your turn» over a working agent.
@@ -1738,20 +1956,70 @@ class CodexSession {
                 message: 'The previous Codex thread could not be resumed — starting a fresh one',
                 code: 'resume_failed',
             });
-            return;
+            return 'resume_failed';
         }
         if (isAuthError(message)) {
             const probe = this.probeAuth();
+            const code = probe === 'missing' ? 'auth_missing' : 'auth_expired';
             this.emit({
                 type: 'error',
                 message: probe === 'missing'
                     ? 'Codex is not signed in on this server — sign in from the Server panel'
                     : 'Codex authentication was rejected — sign in again from the Server panel',
-                code: probe === 'missing' ? 'auth_missing' : 'auth_expired',
+                code,
             });
-            return;
+            return code;
         }
         this.emit({ type: 'error', message: `Codex session error: ${message.slice(0, 1_000)}` });
+        return null;
+    }
+    /**
+     * The one way a refused sign-in leaves this adapter (#344).
+     *
+     * Codex reports it through three unrelated doors — the `error` notification,
+     * a rejected `turn/start`, and a `turn/failed` — and only the first went
+     * through the classifier. The other two shipped the provider's own sentence
+     * with no machine-readable code, which is the same as shipping nothing: the
+     * supervisor decides from codes, and so does the dashboard's «Sign in».
+     *
+     * Ending the session is the second half, and it is not tidiness. A credential
+     * the provider has refused will be refused for every later turn, so leaving
+     * the process alive achieves nothing — and the supervisor's one-shot auth
+     * relaunch is discharged in `handleExit`, i.e. only when the process is gone.
+     * That is why the retry it announced never once happened here while Claude's
+     * did: Claude's SDK loop ends its stream on the same failure.
+     *
+     * `stop()` and NOT `finish()`, and the difference is a leaked child: `finish()`
+     * ends the event queue and sets `stopped`, after which `stop()` returns on its
+     * first line and the `codex app-server` process outlives the session. `stop()`
+     * withdraws the open cards, kills the client, and its exit handler calls
+     * `finish()` for us.
+     */
+    endedOnAuthFailure(message) {
+        if (!isAuthError(maskString(message)))
+            return false;
+        /**
+         * One refusal, one report — even though the refusal arrives twice.
+         *
+         * `stop()` is graceful (stdin, SIGTERM, SIGKILL only after five seconds),
+         * and the queue closes on the child's exit, so for those seconds this
+         * object is still dispatching. The production sequence had two of the three
+         * doors fire **20 ms apart** — the `error` notification and then the
+         * rejected `turn/start` — so without this guard the very incident this
+         * change exists for would now print two identical red lines, each with its
+         * own «Sign in» button, and file the session FAILED twice.
+         *
+         * `true`, not `false`: the caller must still suppress its own turn ending.
+         * The refusal HAS been reported; it just was not reported by this call.
+         *
+         * The test fake could not see this — its `kill()` ends the queue
+         * synchronously, which no real child does. Found by independent QA.
+         */
+        if (this.stopped)
+            return true;
+        this.classifyAndEmitFailure(new Error(message));
+        this.stop();
+        return true;
     }
     /**
      * Second opinion on the sign-in.
@@ -1770,6 +2038,7 @@ class CodexSession {
     }
     finish() {
         this.stopped = true;
+        this.clearLimitSettle();
         this.output.end();
     }
 }
@@ -1970,6 +2239,21 @@ export function codexResetsAt(raw) {
         return null;
     return new Date(raw * 1000).toISOString();
 }
+/**
+ * The reset time as a sentence, not as a machine stamp.
+ *
+ * `2026-08-31T14:02:42.000Z` in the middle of a feed reads like a log line that
+ * escaped. The hour and minute in UTC is what a person actually needs, and UTC
+ * is named rather than converted: this runs on a dev server whose timezone has
+ * nothing to do with the reader's, and a silently wrong local time is worse
+ * than an explicit foreign one.
+ */
+export function describeResetTime(iso) {
+    const at = Date.parse(iso);
+    if (Number.isNaN(at))
+        return iso;
+    return `${new Date(at).toISOString().slice(11, 16)} UTC`;
+}
 function stringifyMcpResult(item) {
     const errorMessage = str(asRecord(item['error'])['message']);
     if (errorMessage)

package/dist/adapters/types.d.ts

@@ -648,4 +648,20 @@ export interface AgentAdapter {
     readonly id: 'claude' | 'codex';
     startSession(spec: SessionSpec): AgentSession;
 }
+/**
+ * The name our MCP server is registered under inside an agent session.
+ *
+ * Both adapters register it under this key, and since #346 the Codex adapter
+ * also has to tell OUR server apart from the CLI's own built-in ones before it
+ * may claim that a failed handshake cost the agent its tickets. It claimed that
+ * about every server for months — including over a `devbridge` that was up with
+ * all 29 tools — and a false alarm is what teaches people to ignore the true
+ * one. So the name is compared, and a name that is compared must not be a
+ * literal spelled in three places.
+ *
+ * Unrelated to the `devbridge-<projectId>` naming the MCP setup tab generates
+ * for a user's OWN CLI config: that one is global and has to be unique per
+ * project, this one is scoped to a single session we launch ourselves.
+ */
+export declare const DEVBRIDGE_MCP_SERVER_NAME = "devbridge";
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/types.js

@@ -33,4 +33,20 @@ export const MODE_WITHDRAWN_TEXT = 'This project was just set to Strict trust, s
 export function availableModes(trustMode) {
     return trustMode === 'STRICT' ? AGENT_MODES.filter((mode) => mode !== 'full') : [...AGENT_MODES];
 }
+/**
+ * The name our MCP server is registered under inside an agent session.
+ *
+ * Both adapters register it under this key, and since #346 the Codex adapter
+ * also has to tell OUR server apart from the CLI's own built-in ones before it
+ * may claim that a failed handshake cost the agent its tickets. It claimed that
+ * about every server for months — including over a `devbridge` that was up with
+ * all 29 tools — and a false alarm is what teaches people to ignore the true
+ * one. So the name is compared, and a name that is compared must not be a
+ * literal spelled in three places.
+ *
+ * Unrelated to the `devbridge-<projectId>` naming the MCP setup tab generates
+ * for a user's OWN CLI config: that one is global and has to be unique per
+ * project, this one is scoped to a single session we launch ourselves.
+ */
+export const DEVBRIDGE_MCP_SERVER_NAME = 'devbridge';
 //# sourceMappingURL=types.js.map

package/dist/file-publish.d.ts

@@ -0,0 +1,27 @@
+export interface PublishFileArgs {
+    /** Корень рабочей копии сессии. */
+    root: string;
+    /** Путь относительно корня. */
+    relPath: string;
+    /** Одноразовый слот, выданный API. */
+    slotId: string;
+    /** Сколько байт разрешено, по мнению API. */
+    maxBytes: number;
+    /** Адрес API, с которым спарен ЭТОТ раннер. */
+    apiUrl: string;
+    /** Токен этого раннера. */
+    token: string;
+    fetchImpl?: typeof fetch;
+}
+export interface PublishFileResult {
+    fileName: string;
+    size: number;
+}
+/** Прочитать файл по правилам просмотра и убедиться, что его можно отдать. */
+export declare function readFileForPublish(root: string, relPath: string, maxBytes: number): {
+    buffer: Buffer;
+    fileName: string;
+    displayPath: string;
+};
+export declare function publishFile(args: PublishFileArgs): Promise<PublishFileResult>;
+//# sourceMappingURL=file-publish.d.ts.map

package/dist/file-publish.js

@@ -0,0 +1,82 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveInsideRoot } from './fsview.js';
+import { isSecretPath } from './policy.js';
+import { log } from './log.js';
+/**
+ * Выложить файл с этой машины в хранилище платформы (0.46.0).
+ *
+ * Что здесь происходит и почему именно так:
+ *
+ *  - **Адрес собирается из СВОЕГО `apiUrl`, а не из присланного.** Команда с
+ *    той стороны говорит только «какой файл» и «в какой слот», но не «куда
+ *    отправить». Тот же принцип, по которому раннер отказывается брать код
+ *    откуда угодно, кроме сервера, с которым спарен: иначе одна подделанная
+ *    команда превращается в способ вытащить файл с чужой машины на чужой хост.
+ *
+ *  - **Правила пути — те же, что у просмотра.** `resolveInsideRoot` (выход за
+ *    корень, символические ссылки, `.git`) плюс `isSecretPath` (`.env`, ключи).
+ *    Своих правил здесь нет ни одного.
+ *
+ *  - **Содержимое НЕ маскируется.** `fs_view` заменяет секреты в предпросмотре,
+ *    но опубликованный архив с подменёнными байтами — битый архив, а документ с
+ *    тихо изменённым текстом — ложь. Защита здесь — отказ по `isSecretPath` и
+ *    то, что файл выбирает человек, а не агент.
+ */
+/**
+ * Свой потолок поверх присланного.
+ *
+ * Присланное число — просьба, а не приказ: сторона API может однажды попросить
+ * прочитать гигабайт, и машина владельца не обязана соглашаться.
+ */
+const HARD_MAX_BYTES = 64 * 1024 * 1024;
+const UPLOAD_TIMEOUT_MS = 120_000;
+/** Прочитать файл по правилам просмотра и убедиться, что его можно отдать. */
+export function readFileForPublish(root, relPath, maxBytes) {
+    const target = resolveInsideRoot(root, relPath);
+    if (isSecretPath(target) || isSecretPath(path.basename(target))) {
+        throw new Error('This path is protected by runner policy');
+    }
+    const stat = fs.statSync(target);
+    if (!stat.isFile())
+        throw new Error('Not a regular file');
+    if (stat.size === 0)
+        throw new Error('The file is empty');
+    const ceiling = Math.min(maxBytes, HARD_MAX_BYTES);
+    if (stat.size > ceiling) {
+        throw new Error(`The file is larger than ${Math.round(ceiling / 1024 / 1024)}MB and cannot be published`);
+    }
+    const rootReal = fs.realpathSync(root);
+    return {
+        buffer: fs.readFileSync(target),
+        fileName: path.basename(target),
+        displayPath: path.relative(rootReal, target) || path.basename(target),
+    };
+}
+export async function publishFile(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const { buffer, fileName, displayPath } = readFileForPublish(args.root, args.relPath, args.maxBytes);
+    const base = args.apiUrl.replace(/\/$/, '');
+    const response = await doFetch(`${base}/api/v1/dev/runner/uploads/${encodeURIComponent(args.slotId)}`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${args.token}`,
+            'Content-Type': 'application/octet-stream',
+            // Имя файла и путь — в заголовках, а не в теле: тело здесь это ровно
+            // байты файла и ничего больше. Кодирование обязательно — в заголовок
+            // нельзя положить произвольный UTF-8 и уж точно нельзя перевод строки.
+            'X-Devbridge-File-Name': encodeURIComponent(fileName),
+            'X-Devbridge-File-Path': encodeURIComponent(displayPath),
+        },
+        body: new Uint8Array(buffer),
+        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        const body = (await response.json().catch(() => null));
+        const reason = body?.error?.message ?? `HTTP ${response.status}`;
+        log.warn('file-publish: upload rejected', { slotId: args.slotId, reason });
+        throw new Error(reason);
+    }
+    return { fileName, size: buffer.length };
+}
+//# sourceMappingURL=file-publish.js.map

package/dist/fsview.d.ts

@@ -16,5 +16,13 @@ export interface FsEntry {
     type: 'dir' | 'file';
     size: number | null;
 }
+/**
+ * Разрешение пути внутри корня рабочей копии.
+ *
+ * Экспортируется, потому что публикация файла (`file-publish.ts`) обязана
+ * применять РОВНО те же правила, что и просмотр: своя копия этой функции — это
+ * второй набор правил, который однажды разойдётся с первым.
+ */
+export declare function resolveInsideRoot(root: string, relPath: string): string;
 export declare function fsView(root: string, relPath?: string): FsViewResult;
 //# sourceMappingURL=fsview.d.ts.map

package/dist/fsview.js

@@ -18,7 +18,14 @@ function assertRepoRoot(rootReal) {
         throw new Error('The workspace path is not a git repository');
     }
 }
-function resolveInsideRoot(root, relPath) {
+/**
+ * Разрешение пути внутри корня рабочей копии.
+ *
+ * Экспортируется, потому что публикация файла (`file-publish.ts`) обязана
+ * применять РОВНО те же правила, что и просмотр: своя копия этой функции — это
+ * второй набор правил, который однажды разойдётся с первым.
+ */
+export function resolveInsideRoot(root, relPath) {
     let rootReal;
     try {
         rootReal = fs.realpathSync(root);