@bridge4dev/runner 0.45.1 → 0.47.0

package/dist/config.d.ts

@@ -15,12 +15,12 @@ declare const ConfigSchema: z.ZodObject<{
         name: z.ZodString;
         token: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        id: string;
         name: string;
+        id: string;
         token: string;
     }, {
-        id: string;
         name: string;
+        id: string;
         token: string;
     }>;
     mcp: z.ZodOptional<z.ZodObject<{
@@ -83,14 +83,36 @@ declare const ConfigSchema: z.ZodObject<{
     }, {
         enabled?: boolean | undefined;
     }>>;
+    /**
+     * #371: the machine owner's veto over installing agent CLIs.
+     *
+     * `agent_install` downloads and runs a vendor's software on this server on a
+     * word from the dashboard. The payload is not the server's to choose — the
+     * package and the installer URL are compiled into this runner — but «which
+     * version of Codex runs here» is still a decision about somebody else's
+     * machine, and its owner gets the last word on whether we may make it at all.
+     *
+     * Same shape and same rule as `[verify]` and `[checkpoints]`:
+     * `install_enabled = false` means the capability is not announced and
+     * `agent_install` is not offered as a command, so the dashboard draws no
+     * button rather than a button that answers «refused». The server cannot
+     * switch it back on: it is read from a root-owned file, here.
+     */
+    agents: z.ZodOptional<z.ZodObject<{
+        install_enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        install_enabled: boolean;
+    }, {
+        install_enabled?: boolean | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     api: {
         url: string;
         ws_url: string;
     };
     server: {
-        id: string;
         name: string;
+        id: string;
         token: string;
     };
     checkpoints?: {
@@ -109,14 +131,17 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled: boolean;
     } | undefined;
+    agents?: {
+        install_enabled: boolean;
+    } | undefined;
 }, {
     api: {
         url: string;
         ws_url: string;
     };
     server: {
-        id: string;
         name: string;
+        id: string;
         token: string;
     };
     checkpoints?: {
@@ -135,10 +160,25 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled?: boolean | undefined;
     } | undefined;
+    agents?: {
+        install_enabled?: boolean | undefined;
+    } | undefined;
 }>;
 export type RunnerConfig = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): RunnerConfig | null;
 export declare function requireConfig(): RunnerConfig;
+/**
+ * The config a re-pairing should write: the new server's identity, everything
+ * else as the machine's owner left it.
+ *
+ * Lives here, beside the schema, rather than inline in `cmdPair` — because the
+ * failure mode is a section that is simply not mentioned. `saveConfig` re-parses
+ * and rewrites the whole file, so a key forgotten in this merge is not «left
+ * alone», it is **deleted from disk**: re-pairing a machine would silently lift
+ * the owner's veto over installing agents, or move Codex back to a shared
+ * credential store. Every optional section of `ConfigSchema` must be listed.
+ */
+export declare function mergeIntoPairedConfig(existing: RunnerConfig | null, paired: Pick<RunnerConfig, 'api' | 'server'>): RunnerConfig;
 export declare function saveConfig(config: RunnerConfig): void;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -76,6 +76,26 @@ const ConfigSchema = z.object({
         enabled: z.boolean().default(true),
     })
         .optional(),
+    /**
+     * #371: the machine owner's veto over installing agent CLIs.
+     *
+     * `agent_install` downloads and runs a vendor's software on this server on a
+     * word from the dashboard. The payload is not the server's to choose — the
+     * package and the installer URL are compiled into this runner — but «which
+     * version of Codex runs here» is still a decision about somebody else's
+     * machine, and its owner gets the last word on whether we may make it at all.
+     *
+     * Same shape and same rule as `[verify]` and `[checkpoints]`:
+     * `install_enabled = false` means the capability is not announced and
+     * `agent_install` is not offered as a command, so the dashboard draws no
+     * button rather than a button that answers «refused». The server cannot
+     * switch it back on: it is read from a root-owned file, here.
+     */
+    agents: z
+        .object({
+        install_enabled: z.boolean().default(true),
+    })
+        .optional(),
 });
 export function loadConfig() {
     const file = configFilePath();
@@ -91,6 +111,29 @@ export function requireConfig() {
     }
     return config;
 }
+/**
+ * The config a re-pairing should write: the new server's identity, everything
+ * else as the machine's owner left it.
+ *
+ * Lives here, beside the schema, rather than inline in `cmdPair` — because the
+ * failure mode is a section that is simply not mentioned. `saveConfig` re-parses
+ * and rewrites the whole file, so a key forgotten in this merge is not «left
+ * alone», it is **deleted from disk**: re-pairing a machine would silently lift
+ * the owner's veto over installing agents, or move Codex back to a shared
+ * credential store. Every optional section of `ConfigSchema` must be listed.
+ */
+export function mergeIntoPairedConfig(existing, paired) {
+    return {
+        api: paired.api,
+        server: paired.server,
+        ...(existing?.mcp ? { mcp: existing.mcp } : {}),
+        ...(existing?.codex ? { codex: existing.codex } : {}),
+        ...(existing?.limits ? { limits: existing.limits } : {}),
+        ...(existing?.verify ? { verify: existing.verify } : {}),
+        ...(existing?.checkpoints ? { checkpoints: existing.checkpoints } : {}),
+        ...(existing?.agents ? { agents: existing.agents } : {}),
+    };
+}
 export function saveConfig(config) {
     ConfigSchema.parse(config);
     const dir = configDir();

package/dist/file-publish.d.ts

@@ -0,0 +1,27 @@
+export interface PublishFileArgs {
+    /** Корень рабочей копии сессии. */
+    root: string;
+    /** Путь относительно корня. */
+    relPath: string;
+    /** Одноразовый слот, выданный API. */
+    slotId: string;
+    /** Сколько байт разрешено, по мнению API. */
+    maxBytes: number;
+    /** Адрес API, с которым спарен ЭТОТ раннер. */
+    apiUrl: string;
+    /** Токен этого раннера. */
+    token: string;
+    fetchImpl?: typeof fetch;
+}
+export interface PublishFileResult {
+    fileName: string;
+    size: number;
+}
+/** Прочитать файл по правилам просмотра и убедиться, что его можно отдать. */
+export declare function readFileForPublish(root: string, relPath: string, maxBytes: number): {
+    buffer: Buffer;
+    fileName: string;
+    displayPath: string;
+};
+export declare function publishFile(args: PublishFileArgs): Promise<PublishFileResult>;
+//# sourceMappingURL=file-publish.d.ts.map

package/dist/file-publish.js

@@ -0,0 +1,82 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveInsideRoot } from './fsview.js';
+import { isSecretPath } from './policy.js';
+import { log } from './log.js';
+/**
+ * Выложить файл с этой машины в хранилище платформы (0.46.0).
+ *
+ * Что здесь происходит и почему именно так:
+ *
+ *  - **Адрес собирается из СВОЕГО `apiUrl`, а не из присланного.** Команда с
+ *    той стороны говорит только «какой файл» и «в какой слот», но не «куда
+ *    отправить». Тот же принцип, по которому раннер отказывается брать код
+ *    откуда угодно, кроме сервера, с которым спарен: иначе одна подделанная
+ *    команда превращается в способ вытащить файл с чужой машины на чужой хост.
+ *
+ *  - **Правила пути — те же, что у просмотра.** `resolveInsideRoot` (выход за
+ *    корень, символические ссылки, `.git`) плюс `isSecretPath` (`.env`, ключи).
+ *    Своих правил здесь нет ни одного.
+ *
+ *  - **Содержимое НЕ маскируется.** `fs_view` заменяет секреты в предпросмотре,
+ *    но опубликованный архив с подменёнными байтами — битый архив, а документ с
+ *    тихо изменённым текстом — ложь. Защита здесь — отказ по `isSecretPath` и
+ *    то, что файл выбирает человек, а не агент.
+ */
+/**
+ * Свой потолок поверх присланного.
+ *
+ * Присланное число — просьба, а не приказ: сторона API может однажды попросить
+ * прочитать гигабайт, и машина владельца не обязана соглашаться.
+ */
+const HARD_MAX_BYTES = 64 * 1024 * 1024;
+const UPLOAD_TIMEOUT_MS = 120_000;
+/** Прочитать файл по правилам просмотра и убедиться, что его можно отдать. */
+export function readFileForPublish(root, relPath, maxBytes) {
+    const target = resolveInsideRoot(root, relPath);
+    if (isSecretPath(target) || isSecretPath(path.basename(target))) {
+        throw new Error('This path is protected by runner policy');
+    }
+    const stat = fs.statSync(target);
+    if (!stat.isFile())
+        throw new Error('Not a regular file');
+    if (stat.size === 0)
+        throw new Error('The file is empty');
+    const ceiling = Math.min(maxBytes, HARD_MAX_BYTES);
+    if (stat.size > ceiling) {
+        throw new Error(`The file is larger than ${Math.round(ceiling / 1024 / 1024)}MB and cannot be published`);
+    }
+    const rootReal = fs.realpathSync(root);
+    return {
+        buffer: fs.readFileSync(target),
+        fileName: path.basename(target),
+        displayPath: path.relative(rootReal, target) || path.basename(target),
+    };
+}
+export async function publishFile(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const { buffer, fileName, displayPath } = readFileForPublish(args.root, args.relPath, args.maxBytes);
+    const base = args.apiUrl.replace(/\/$/, '');
+    const response = await doFetch(`${base}/api/v1/dev/runner/uploads/${encodeURIComponent(args.slotId)}`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${args.token}`,
+            'Content-Type': 'application/octet-stream',
+            // Имя файла и путь — в заголовках, а не в теле: тело здесь это ровно
+            // байты файла и ничего больше. Кодирование обязательно — в заголовок
+            // нельзя положить произвольный UTF-8 и уж точно нельзя перевод строки.
+            'X-Devbridge-File-Name': encodeURIComponent(fileName),
+            'X-Devbridge-File-Path': encodeURIComponent(displayPath),
+        },
+        body: new Uint8Array(buffer),
+        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        const body = (await response.json().catch(() => null));
+        const reason = body?.error?.message ?? `HTTP ${response.status}`;
+        log.warn('file-publish: upload rejected', { slotId: args.slotId, reason });
+        throw new Error(reason);
+    }
+    return { fileName, size: buffer.length };
+}
+//# sourceMappingURL=file-publish.js.map

package/dist/fsview.d.ts

@@ -16,5 +16,13 @@ export interface FsEntry {
     type: 'dir' | 'file';
     size: number | null;
 }
+/**
+ * Разрешение пути внутри корня рабочей копии.
+ *
+ * Экспортируется, потому что публикация файла (`file-publish.ts`) обязана
+ * применять РОВНО те же правила, что и просмотр: своя копия этой функции — это
+ * второй набор правил, который однажды разойдётся с первым.
+ */
+export declare function resolveInsideRoot(root: string, relPath: string): string;
 export declare function fsView(root: string, relPath?: string): FsViewResult;
 //# sourceMappingURL=fsview.d.ts.map

package/dist/fsview.js

@@ -18,7 +18,14 @@ function assertRepoRoot(rootReal) {
         throw new Error('The workspace path is not a git repository');
     }
 }
-function resolveInsideRoot(root, relPath) {
+/**
+ * Разрешение пути внутри корня рабочей копии.
+ *
+ * Экспортируется, потому что публикация файла (`file-publish.ts`) обязана
+ * применять РОВНО те же правила, что и просмотр: своя копия этой функции — это
+ * второй набор правил, который однажды разойдётся с первым.
+ */
+export function resolveInsideRoot(root, relPath) {
     let rootReal;
     try {
         rootReal = fs.realpathSync(root);

package/dist/index.js

@@ -8,8 +8,8 @@ import { promisify } from 'node:util';
 import { ClaudeAdapter } from './adapters/claude.js';
 import { CodexAdapter } from './adapters/codex.js';
 import { ensureCodexHome } from './adapters/codex-home.js';
-import { claudeCliPath } from './agent-binary.js';
-import { loadConfig, requireConfig, saveConfig } from './config.js';
+import { sessionClaudePath } from './agent-binary.js';
+import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig, } from './config.js';
 import { log } from './log.js';
 import { installIsWritable, installPrefixFor, isSupervisedProcess, manualUpdateCommand, resolveInstalledPackageDir, } from './self-update.js';
 import { applyStoredClaudeToken } from './agent-auth.js';
@@ -63,6 +63,11 @@ function argValue(args, flag) {
  * create a session that immediately fails.
  */
 function installedAgents() {
+    // #371: this list and the `agent_versions` frame answer about the same file
+    // as of C2 — `sessionClaudePath()` follows `USE_BUNDLED_CLAUDE`, so while the
+    // constant is true it still reports the SDK's bundled binary (today's
+    // behaviour, unchanged), and the moment it flips both speak about the system
+    // `claude` on PATH. One switch, not two lists drifting apart.
     const agents = [];
     // Claude comes with the Agent SDK — but «comes with» is a claim about THIS
     // installation, not a law (ticket #225). The CLI is an optional platform
@@ -70,7 +75,7 @@ function installedAgents() {
     // Claude, accepts Claude sessions, and cannot start a single one. Reported as
     // measured, so the dashboard greys the agent out instead of offering a
     // session that dies before its first word.
-    if (claudeCliPath())
+    if (sessionClaudePath())
         agents.push('claude');
     if (hasExecutable('codex'))
         agents.push('codex');
@@ -138,6 +143,7 @@ function runnerCapabilities(apiUrlOverride) {
     const verifyEnabled = config?.verify?.enabled !== false;
     // Ticket #126: the same veto, for restore points. Default on.
     const checkpointsEnabled = config?.checkpoints?.enabled !== false;
+    const agentInstallEnabled = config?.agents?.install_enabled !== false;
     return {
         agents: installedAgents(),
         git: true,
@@ -145,6 +151,14 @@ function runnerCapabilities(apiUrlOverride) {
         resumeEpoch: true,
         /** Session 8: understands `maxSessions` and runs sessions side by side. */
         parallelSessions: true,
+        /**
+         * 0.46.0: reports which sessions are actually holding a seat here, so the
+         * API stops having to guess the occupancy of this machine from its own
+         * rows. Announced rather than inferred from the version, because the API
+         * runs a compatibility sweep for runners that cannot say it — and that
+         * sweep must switch off the moment this one can.
+         */
+        sessionSlots: true,
         /**
          * Session 9: can update itself on command. Reported as a capability rather
          * than inferred from the version, because the dashboard must not offer a
@@ -178,6 +192,27 @@ function runnerCapabilities(apiUrlOverride) {
             claude: hasExecutable('claude'),
             codex: hasExecutable('codex'),
         },
+        /**
+         * This build measures agent versions and can be told to install one (0.47.0).
+         *
+         * One flag for both halves on purpose. The dashboard needs to know whether
+         * an empty version row means «not installed» or «this runner cannot say»,
+         * and the API needs to know whether `agent_install` will be understood —
+         * and there is no build where one is true and the other is not.
+         *
+         * Kept out of the version data itself: capabilities are computed once per
+         * process and replayed on every reconnect (`ws-client.ts`), so a version
+         * put here would freeze at daemon start. Versions travel in the
+         * `agent_versions` frame.
+         *
+         * Withheld entirely when the machine owner said no (`[agents]
+         * install_enabled = false`), like `[verify]` and `[checkpoints]`: a control
+         * that is switched off must not look like a control that is broken. The
+         * measuring half keeps working — reading a version is not installing one.
+         */
+        ...(agentInstallEnabled
+            ? { agentInstall: true }
+            : { agentInstallBlocked: 'disabled-by-config' }),
         /**
          * Where npm put this package, and the command that updates it here
          * (0.27.0).
@@ -234,6 +269,13 @@ function runnerCapabilities(apiUrlOverride) {
          * anything the previous version could not.
          */
         gitRefs: true,
+        /**
+         * 0.46.0: умеет выложить файл из рабочей копии в хранилище платформы
+         * (`fs_publish`). Без флага дашборд не рисует кнопку «Опубликовать», а
+         * объясняет, что раннер надо обновить — кнопка, чей фрейм старый раннер
+         * молча уронит, хуже отсутствующей кнопки.
+         */
+        filePublish: true,
         /**
          * Session 14: reads `.devbridge/project.json`. Announced even when
          * verification is switched off — «this machine will not run recipes» and
@@ -422,6 +464,7 @@ function runnerCapabilities(apiUrlOverride) {
             ...(verifyEnabled
                 ? ['verify_start', 'verify_status', 'verify_cancel', 'preview_checkout', 'preview_stop']
                 : []),
+            ...(agentInstallEnabled ? ['agent_install'] : []),
         ],
     };
 }
@@ -449,15 +492,14 @@ async function cmdPair(args) {
         fail(`pairing failed (HTTP ${response.status}): ${body?.error?.message ?? 'unknown error'}. ` +
             'The code is one-time and expires in 10 minutes — generate a fresh one in the dashboard if needed.');
     }
-    const existing = loadConfig();
-    const config = {
+    // Everything the machine's owner wrote by hand survives the re-pairing —
+    // `saveConfig` rewrites the whole file, so a section not carried across is a
+    // section deleted. The rule lives in `config.ts` beside the schema it has to
+    // keep up with, and is tested there.
+    const config = mergeIntoPairedConfig(loadConfig(), {
         api: { url: apiUrl, ws_url: body.data.wsUrl },
         server: { id: body.data.serverId, name: body.data.serverName, token: body.data.token },
-        ...(existing?.mcp ? { mcp: existing.mcp } : {}),
-        // Carry settings the user wrote by hand — saveConfig re-parses through the
-        // schema, so a section dropped here is a section deleted from disk.
-        ...(existing?.codex ? { codex: existing.codex } : {}),
-    };
+    });
     saveConfig(config);
     print(`Paired as "${body.data.serverName}" (server ${body.data.serverId}).`);
     print('Start the daemon with: devbridge-runner install-service   (or: devbridge-runner daemon)');
@@ -693,6 +735,7 @@ async function cmdDaemon() {
         // frame from an API that has not noticed still cannot start a run.
         verifyEnabled: config.verify?.enabled !== false,
         checkpointsEnabled: config.checkpoints?.enabled !== false,
+        agentInstallEnabled: config.agents?.install_enabled !== false,
         apiUrl: config.api.url,
         // Used to fetch the files a user attaches to a message (session 10) — the
         // same token the WS connection authenticates with, never passed onwards.
@@ -1047,13 +1090,19 @@ async function agentChecks() {
     checks.push({
         ok: cliPresent.claude,
         name: 'claude cli',
+        // Since 0.47.0 this is not a warning about signing in — it is «no Claude
+        // sessions on this machine at all». The bundled binary is switched off
+        // (`USE_BUNDLED_CLAUDE`), so the CLI on PATH is the one every session runs.
         detail: cliPresent.claude
             ? `on ${me.user}'s PATH`
-            : `not installed for ${me.user} — sessions still run (the SDK bundles its own), but signing in needs the CLI`,
+            : `not installed for ${me.user} — Claude sessions cannot start on this server`,
         ...(cliPresent.claude
             ? {}
             : {
-                fix: `sudo -iu ${me.user} sh -lc 'curl -fsSL https://claude.ai/install.sh | bash'`,
+                // The dashboard is the way in (Р9): it picks the version, checks the
+                // disk first and puts the old binary back if the new one will not run.
+                // The command stays for a machine nobody can reach the dashboard from.
+                fix: `press «Install» on the Claude row of this server's card in DevBridge — or, by hand: sudo -iu ${me.user} sh -lc 'curl -fsSL https://claude.ai/install.sh | bash'`,
             }),
     });
     // Codex is optional: plenty of machines only ever run Claude sessions, and a