@bridge4dev/runner 0.46.1 → 0.48.0

package/dist/config.d.ts

@@ -15,12 +15,12 @@ declare const ConfigSchema: z.ZodObject<{
         name: z.ZodString;
         token: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        id: string;
         name: string;
+        id: string;
         token: string;
     }, {
-        id: string;
         name: string;
+        id: string;
         token: string;
     }>;
     mcp: z.ZodOptional<z.ZodObject<{
@@ -83,14 +83,36 @@ declare const ConfigSchema: z.ZodObject<{
     }, {
         enabled?: boolean | undefined;
     }>>;
+    /**
+     * #371: the machine owner's veto over installing agent CLIs.
+     *
+     * `agent_install` downloads and runs a vendor's software on this server on a
+     * word from the dashboard. The payload is not the server's to choose — the
+     * package and the installer URL are compiled into this runner — but «which
+     * version of Codex runs here» is still a decision about somebody else's
+     * machine, and its owner gets the last word on whether we may make it at all.
+     *
+     * Same shape and same rule as `[verify]` and `[checkpoints]`:
+     * `install_enabled = false` means the capability is not announced and
+     * `agent_install` is not offered as a command, so the dashboard draws no
+     * button rather than a button that answers «refused». The server cannot
+     * switch it back on: it is read from a root-owned file, here.
+     */
+    agents: z.ZodOptional<z.ZodObject<{
+        install_enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        install_enabled: boolean;
+    }, {
+        install_enabled?: boolean | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     api: {
         url: string;
         ws_url: string;
     };
     server: {
-        id: string;
         name: string;
+        id: string;
         token: string;
     };
     checkpoints?: {
@@ -109,14 +131,17 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled: boolean;
     } | undefined;
+    agents?: {
+        install_enabled: boolean;
+    } | undefined;
 }, {
     api: {
         url: string;
         ws_url: string;
     };
     server: {
-        id: string;
         name: string;
+        id: string;
         token: string;
     };
     checkpoints?: {
@@ -135,10 +160,25 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled?: boolean | undefined;
     } | undefined;
+    agents?: {
+        install_enabled?: boolean | undefined;
+    } | undefined;
 }>;
 export type RunnerConfig = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): RunnerConfig | null;
 export declare function requireConfig(): RunnerConfig;
+/**
+ * The config a re-pairing should write: the new server's identity, everything
+ * else as the machine's owner left it.
+ *
+ * Lives here, beside the schema, rather than inline in `cmdPair` — because the
+ * failure mode is a section that is simply not mentioned. `saveConfig` re-parses
+ * and rewrites the whole file, so a key forgotten in this merge is not «left
+ * alone», it is **deleted from disk**: re-pairing a machine would silently lift
+ * the owner's veto over installing agents, or move Codex back to a shared
+ * credential store. Every optional section of `ConfigSchema` must be listed.
+ */
+export declare function mergeIntoPairedConfig(existing: RunnerConfig | null, paired: Pick<RunnerConfig, 'api' | 'server'>): RunnerConfig;
 export declare function saveConfig(config: RunnerConfig): void;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -76,6 +76,26 @@ const ConfigSchema = z.object({
         enabled: z.boolean().default(true),
     })
         .optional(),
+    /**
+     * #371: the machine owner's veto over installing agent CLIs.
+     *
+     * `agent_install` downloads and runs a vendor's software on this server on a
+     * word from the dashboard. The payload is not the server's to choose — the
+     * package and the installer URL are compiled into this runner — but «which
+     * version of Codex runs here» is still a decision about somebody else's
+     * machine, and its owner gets the last word on whether we may make it at all.
+     *
+     * Same shape and same rule as `[verify]` and `[checkpoints]`:
+     * `install_enabled = false` means the capability is not announced and
+     * `agent_install` is not offered as a command, so the dashboard draws no
+     * button rather than a button that answers «refused». The server cannot
+     * switch it back on: it is read from a root-owned file, here.
+     */
+    agents: z
+        .object({
+        install_enabled: z.boolean().default(true),
+    })
+        .optional(),
 });
 export function loadConfig() {
     const file = configFilePath();
@@ -91,6 +111,29 @@ export function requireConfig() {
     }
     return config;
 }
+/**
+ * The config a re-pairing should write: the new server's identity, everything
+ * else as the machine's owner left it.
+ *
+ * Lives here, beside the schema, rather than inline in `cmdPair` — because the
+ * failure mode is a section that is simply not mentioned. `saveConfig` re-parses
+ * and rewrites the whole file, so a key forgotten in this merge is not «left
+ * alone», it is **deleted from disk**: re-pairing a machine would silently lift
+ * the owner's veto over installing agents, or move Codex back to a shared
+ * credential store. Every optional section of `ConfigSchema` must be listed.
+ */
+export function mergeIntoPairedConfig(existing, paired) {
+    return {
+        api: paired.api,
+        server: paired.server,
+        ...(existing?.mcp ? { mcp: existing.mcp } : {}),
+        ...(existing?.codex ? { codex: existing.codex } : {}),
+        ...(existing?.limits ? { limits: existing.limits } : {}),
+        ...(existing?.verify ? { verify: existing.verify } : {}),
+        ...(existing?.checkpoints ? { checkpoints: existing.checkpoints } : {}),
+        ...(existing?.agents ? { agents: existing.agents } : {}),
+    };
+}
 export function saveConfig(config) {
     ConfigSchema.parse(config);
     const dir = configDir();

package/dist/index.js

@@ -8,8 +8,8 @@ import { promisify } from 'node:util';
 import { ClaudeAdapter } from './adapters/claude.js';
 import { CodexAdapter } from './adapters/codex.js';
 import { ensureCodexHome } from './adapters/codex-home.js';
-import { claudeCliPath } from './agent-binary.js';
-import { loadConfig, requireConfig, saveConfig } from './config.js';
+import { sessionClaudePath } from './agent-binary.js';
+import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig, } from './config.js';
 import { log } from './log.js';
 import { installIsWritable, installPrefixFor, isSupervisedProcess, manualUpdateCommand, resolveInstalledPackageDir, } from './self-update.js';
 import { applyStoredClaudeToken } from './agent-auth.js';
@@ -63,6 +63,11 @@ function argValue(args, flag) {
  * create a session that immediately fails.
  */
 function installedAgents() {
+    // #371: this list and the `agent_versions` frame answer about the same file
+    // as of C2 — `sessionClaudePath()` follows `USE_BUNDLED_CLAUDE`, so while the
+    // constant is true it still reports the SDK's bundled binary (today's
+    // behaviour, unchanged), and the moment it flips both speak about the system
+    // `claude` on PATH. One switch, not two lists drifting apart.
     const agents = [];
     // Claude comes with the Agent SDK — but «comes with» is a claim about THIS
     // installation, not a law (ticket #225). The CLI is an optional platform
@@ -70,7 +75,7 @@ function installedAgents() {
     // Claude, accepts Claude sessions, and cannot start a single one. Reported as
     // measured, so the dashboard greys the agent out instead of offering a
     // session that dies before its first word.
-    if (claudeCliPath())
+    if (sessionClaudePath())
         agents.push('claude');
     if (hasExecutable('codex'))
         agents.push('codex');
@@ -138,6 +143,7 @@ function runnerCapabilities(apiUrlOverride) {
     const verifyEnabled = config?.verify?.enabled !== false;
     // Ticket #126: the same veto, for restore points. Default on.
     const checkpointsEnabled = config?.checkpoints?.enabled !== false;
+    const agentInstallEnabled = config?.agents?.install_enabled !== false;
     return {
         agents: installedAgents(),
         git: true,
@@ -186,6 +192,27 @@ function runnerCapabilities(apiUrlOverride) {
             claude: hasExecutable('claude'),
             codex: hasExecutable('codex'),
         },
+        /**
+         * This build measures agent versions and can be told to install one (0.47.0).
+         *
+         * One flag for both halves on purpose. The dashboard needs to know whether
+         * an empty version row means «not installed» or «this runner cannot say»,
+         * and the API needs to know whether `agent_install` will be understood —
+         * and there is no build where one is true and the other is not.
+         *
+         * Kept out of the version data itself: capabilities are computed once per
+         * process and replayed on every reconnect (`ws-client.ts`), so a version
+         * put here would freeze at daemon start. Versions travel in the
+         * `agent_versions` frame.
+         *
+         * Withheld entirely when the machine owner said no (`[agents]
+         * install_enabled = false`), like `[verify]` and `[checkpoints]`: a control
+         * that is switched off must not look like a control that is broken. The
+         * measuring half keeps working — reading a version is not installing one.
+         */
+        ...(agentInstallEnabled
+            ? { agentInstall: true }
+            : { agentInstallBlocked: 'disabled-by-config' }),
         /**
          * Where npm put this package, and the command that updates it here
          * (0.27.0).
@@ -437,6 +464,7 @@ function runnerCapabilities(apiUrlOverride) {
             ...(verifyEnabled
                 ? ['verify_start', 'verify_status', 'verify_cancel', 'preview_checkout', 'preview_stop']
                 : []),
+            ...(agentInstallEnabled ? ['agent_install'] : []),
         ],
     };
 }
@@ -464,15 +492,14 @@ async function cmdPair(args) {
         fail(`pairing failed (HTTP ${response.status}): ${body?.error?.message ?? 'unknown error'}. ` +
             'The code is one-time and expires in 10 minutes — generate a fresh one in the dashboard if needed.');
     }
-    const existing = loadConfig();
-    const config = {
+    // Everything the machine's owner wrote by hand survives the re-pairing —
+    // `saveConfig` rewrites the whole file, so a section not carried across is a
+    // section deleted. The rule lives in `config.ts` beside the schema it has to
+    // keep up with, and is tested there.
+    const config = mergeIntoPairedConfig(loadConfig(), {
         api: { url: apiUrl, ws_url: body.data.wsUrl },
         server: { id: body.data.serverId, name: body.data.serverName, token: body.data.token },
-        ...(existing?.mcp ? { mcp: existing.mcp } : {}),
-        // Carry settings the user wrote by hand — saveConfig re-parses through the
-        // schema, so a section dropped here is a section deleted from disk.
-        ...(existing?.codex ? { codex: existing.codex } : {}),
-    };
+    });
     saveConfig(config);
     print(`Paired as "${body.data.serverName}" (server ${body.data.serverId}).`);
     print('Start the daemon with: devbridge-runner install-service   (or: devbridge-runner daemon)');
@@ -708,6 +735,7 @@ async function cmdDaemon() {
         // frame from an API that has not noticed still cannot start a run.
         verifyEnabled: config.verify?.enabled !== false,
         checkpointsEnabled: config.checkpoints?.enabled !== false,
+        agentInstallEnabled: config.agents?.install_enabled !== false,
         apiUrl: config.api.url,
         // Used to fetch the files a user attaches to a message (session 10) — the
         // same token the WS connection authenticates with, never passed onwards.
@@ -1062,13 +1090,19 @@ async function agentChecks() {
     checks.push({
         ok: cliPresent.claude,
         name: 'claude cli',
+        // Since 0.47.0 this is not a warning about signing in — it is «no Claude
+        // sessions on this machine at all». The bundled binary is switched off
+        // (`USE_BUNDLED_CLAUDE`), so the CLI on PATH is the one every session runs.
         detail: cliPresent.claude
             ? `on ${me.user}'s PATH`
-            : `not installed for ${me.user} — sessions still run (the SDK bundles its own), but signing in needs the CLI`,
+            : `not installed for ${me.user} — Claude sessions cannot start on this server`,
         ...(cliPresent.claude
             ? {}
             : {
-                fix: `sudo -iu ${me.user} sh -lc 'curl -fsSL https://claude.ai/install.sh | bash'`,
+                // The dashboard is the way in (Р9): it picks the version, checks the
+                // disk first and puts the old binary back if the new one will not run.
+                // The command stays for a machine nobody can reach the dashboard from.
+                fix: `press «Install» on the Claude row of this server's card in DevBridge — or, by hand: sudo -iu ${me.user} sh -lc 'curl -fsSL https://claude.ai/install.sh | bash'`,
             }),
     });
     // Codex is optional: plenty of machines only ever run Claude sessions, and a

package/dist/levels.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Mirror of the `#region level-events-mirror` block in
+ * `packages/shared/src/constants/realtime.ts` – the DevBridge side is the
+ * source of truth, exactly like `agent-registry.ts` mirrors the agent registry
+ * and `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ *
+ * CHECKED: `levels.test.ts` reads both files and compares the region between
+ * the markers character by character. Edit the shared file first, then paste
+ * the region here – nothing but the region, and nothing of the region left out.
+ */
+/**
+ * Level signals on the dev-session stream – frames that carry a whole current
+ * value rather than a step of the conversation (#366).
+ *
+ * `agent_tasks` (#113), `context_usage` and `rate_limits` (#279) are LEVELS:
+ * every frame replaces the previous one, so a dropped frame costs freshness and
+ * never correctness. In production they were 61 % of every Codex session's
+ * rows (57 008 + 56 591 of ~185 000, 05.09.2026) while drawing not one line in
+ * the transcript – and each one re-rendered the whole page. So they are treated
+ * differently at every hop, and this block is the one place that says how:
+ *
+ *  - the runner sends one only when the value moved (the thresholds below);
+ *  - the API publishes it as a META frame (no `id:`) and never stores a row;
+ *  - the dashboard keeps it beside the feed, never in it.
+ *
+ * Mirrored verbatim into `packages/runner/src/levels.ts` – the runner cannot
+ * import this package (it is published to npm on its own). `levels.test.ts`
+ * compares the two regions character by character.
+ */
+export declare const LEVEL_EVENT_TYPES: readonly ["agent_tasks", "context_usage", "rate_limits"];
+/**
+ * A context-meter move smaller than BOTH of these is not worth a frame. The
+ * same pair gates the API's mirror onto the session row, so the ring a reload
+ * draws from the row and the ring the live frame draws agree to the percent.
+ */
+export declare const CONTEXT_USAGE_MIN_DELTA_TOKENS = 2000;
+export declare const CONTEXT_USAGE_MIN_DELTA_RATIO = 0.01;
+/**
+ * An unchanged plan-usage snapshot is re-sent no more often than this. It is
+ * re-sent at all because the limits panel dates its figure by ARRIVAL
+ * («updated 12 min ago»): silence would read as staleness. Three minutes is
+ * the interval the Claude adapter already probes `/usage` at.
+ */
+export declare const RATE_LIMITS_RESEND_INTERVAL_MS: number;
+//# sourceMappingURL=levels.d.ts.map

package/dist/levels.js

@@ -0,0 +1,51 @@
+/**
+ * Mirror of the `#region level-events-mirror` block in
+ * `packages/shared/src/constants/realtime.ts` – the DevBridge side is the
+ * source of truth, exactly like `agent-registry.ts` mirrors the agent registry
+ * and `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ *
+ * CHECKED: `levels.test.ts` reads both files and compares the region between
+ * the markers character by character. Edit the shared file first, then paste
+ * the region here – nothing but the region, and nothing of the region left out.
+ */
+// #region level-events-mirror
+/**
+ * Level signals on the dev-session stream – frames that carry a whole current
+ * value rather than a step of the conversation (#366).
+ *
+ * `agent_tasks` (#113), `context_usage` and `rate_limits` (#279) are LEVELS:
+ * every frame replaces the previous one, so a dropped frame costs freshness and
+ * never correctness. In production they were 61 % of every Codex session's
+ * rows (57 008 + 56 591 of ~185 000, 05.09.2026) while drawing not one line in
+ * the transcript – and each one re-rendered the whole page. So they are treated
+ * differently at every hop, and this block is the one place that says how:
+ *
+ *  - the runner sends one only when the value moved (the thresholds below);
+ *  - the API publishes it as a META frame (no `id:`) and never stores a row;
+ *  - the dashboard keeps it beside the feed, never in it.
+ *
+ * Mirrored verbatim into `packages/runner/src/levels.ts` – the runner cannot
+ * import this package (it is published to npm on its own). `levels.test.ts`
+ * compares the two regions character by character.
+ */
+export const LEVEL_EVENT_TYPES = ['agent_tasks', 'context_usage', 'rate_limits'];
+/**
+ * A context-meter move smaller than BOTH of these is not worth a frame. The
+ * same pair gates the API's mirror onto the session row, so the ring a reload
+ * draws from the row and the ring the live frame draws agree to the percent.
+ */
+export const CONTEXT_USAGE_MIN_DELTA_TOKENS = 2_000;
+export const CONTEXT_USAGE_MIN_DELTA_RATIO = 0.01;
+/**
+ * An unchanged plan-usage snapshot is re-sent no more often than this. It is
+ * re-sent at all because the limits panel dates its figure by ARRIVAL
+ * («updated 12 min ago»): silence would read as staleness. Three minutes is
+ * the interval the Claude adapter already probes `/usage` at.
+ */
+export const RATE_LIMITS_RESEND_INTERVAL_MS = 3 * 60 * 1000;
+// #endregion level-events-mirror
+//# sourceMappingURL=levels.js.map