@bridge4dev/runner 0.47.0 → 0.49.0

package/dist/adapters/claude.js

@@ -2012,12 +2012,18 @@ class ClaudeSession {
         this.aborting = true;
         try {
             await this.q.interrupt();
+            return 'accepted';
         }
         catch (error) {
             // The abort never reached the SDK, so any failure that arrives now is the
             // agent's own and must be reported as one.
             this.aborting = false;
             log.warn('claude: interrupt failed', { error: String(error) });
+            // #373: answered rather than swallowed. `stopped` is the honest reading of
+            // «we closed this query ourselves» — the SDK rejects every outstanding
+            // control request with «Query closed before response received» on close,
+            // and calling that a refusal would turn our own park into a failure.
+            return this.stopped ? 'idle' : 'refused';
         }
     }
     conversationAnchor() {
@@ -2281,6 +2287,19 @@ class ClaudeSession {
                         const aborted = this.aborting;
                         this.aborting = false;
                         const failure = msg.subtype === 'success' ? '' : classifyError(msg.subtype, msg.errors);
+                        // #373, plan stage D. What the incident could not answer: the second
+                        // result's origin was never recorded, so «is this the same turn
+                        // twice or a turn the CLI started by itself» had no evidence either
+                        // way. An allowlist of shapes the SDK marks optional, read through
+                        // type guards so a build that has none of them logs none of them —
+                        // no message text, no tool input, no environment, nothing to mask.
+                        log.info('claude: turn result', {
+                            sessionId: this.spec.sessionId,
+                            subtype: msg.subtype,
+                            aborted,
+                            produced: this.turnProduced,
+                            ...optionalDiagnostics(msg),
+                        });
                         if (failure && isRewindError(failure)) {
                             // Not a failed turn — a refused resume. The CLI answers a bad
                             // `resumeSessionAt` with exactly this and nothing else (no
@@ -2351,6 +2370,12 @@ class ClaudeSession {
                 type: 'error',
                 message: classifyRunError(message),
                 ...(code ? { code } : {}),
+                // #373: this catch is the CLI process falling over under the read loop —
+                // the only place in this adapter where that is what happened. Our own
+                // `q.close()` does NOT come through here (the SDK ends the input stream
+                // and the iteration finishes cleanly), so the flag stays an honest
+                // answer to «did the process die on its own».
+                processGone: true,
             });
         }
         finally {
@@ -2367,6 +2392,41 @@ class ClaudeSession {
         }
     }
 }
+/**
+ * The optional shapes a `result` may carry, and nothing else (#373).
+ *
+ * An allowlist rather than «log the message»: an SDK message holds the whole
+ * turn, and a runner log is not a place for a person's words, a tool's input or
+ * an environment. Each field is read through a type guard and simply absent when
+ * the build does not have it — no private SDK methods, and no minimum CLI
+ * version required to read an optional field.
+ *
+ *  - `uuid`            names the RESULT, not the turn. Two results of one stop
+ *                      have two of these, which is why it is evidence and not an
+ *                      identifier to key anything on.
+ *  - `origin.kind`     `task-notification` is a turn a background subagent woke
+ *                      from inside the CLI — the one thing that tells a genuinely
+ *                      new internal turn from a duplicate ending.
+ *  - `terminal_reason` the CLI's own word for why it stopped.
+ */
+function optionalDiagnostics(msg) {
+    if (!msg || typeof msg !== 'object')
+        return {};
+    const record = msg;
+    const out = {};
+    if (typeof record['uuid'] === 'string')
+        out['resultUuid'] = record['uuid'];
+    if (typeof record['terminal_reason'] === 'string') {
+        out['terminalReason'] = record['terminal_reason'];
+    }
+    const origin = record['origin'];
+    if (origin && typeof origin === 'object') {
+        const kind = origin['kind'];
+        if (typeof kind === 'string')
+            out['originKind'] = kind;
+    }
+    return out;
+}
 // Recursive: MultiEdit-style inputs nest long strings inside arrays — a
 // shallow pass let them blow past the API's 128KB event cap (QA-96 F2).
 function truncateDeep(value, limit) {

package/dist/adapters/codex-protocol.d.ts

@@ -7,6 +7,19 @@ export declare class RpcError extends Error {
     readonly method: string;
     constructor(code: number, message: string, method: string);
 }
+/**
+ * The far end never answered in time (#370).
+ *
+ * A class of its own rather than a number the caller has to recognise: opening
+ * a conversation has to tell «Codex refused» from «Codex was too slow», and the
+ * only other way to ask was the sentence in `message`. That sentence is prose,
+ * and prose is exactly what turned a slow `thread/resume` into a dead session —
+ * `isMissingRollout` matched «no rollout found», not «timed out after 60000ms»,
+ * so none of the recovery already written for a refusal ever ran.
+ */
+export declare class RpcTimeoutError extends RpcError {
+    constructor(method: string, timeoutMs: number);
+}
 export interface ServerRequest {
     id: number | string;
     method: string;

package/dist/adapters/codex-protocol.js

@@ -10,6 +10,22 @@ export class RpcError extends Error {
         this.name = 'RpcError';
     }
 }
+/**
+ * The far end never answered in time (#370).
+ *
+ * A class of its own rather than a number the caller has to recognise: opening
+ * a conversation has to tell «Codex refused» from «Codex was too slow», and the
+ * only other way to ask was the sentence in `message`. That sentence is prose,
+ * and prose is exactly what turned a slow `thread/resume` into a dead session —
+ * `isMissingRollout` matched «no rollout found», not «timed out after 60000ms»,
+ * so none of the recovery already written for a refusal ever ran.
+ */
+export class RpcTimeoutError extends RpcError {
+    constructor(method, timeoutMs) {
+        super(-32000, `${method} timed out after ${timeoutMs}ms`, method);
+        this.name = 'RpcTimeoutError';
+    }
+}
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
 /** A line longer than this means the far end is misbehaving — drop the buffer. */
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
@@ -134,7 +150,7 @@ export class AppServerClient {
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {
                 this.pending.delete(id);
-                reject(new RpcError(-32000, `${method} timed out after ${timeoutMs}ms`, method));
+                reject(new RpcTimeoutError(method, timeoutMs));
             }, timeoutMs);
             timer.unref();
             this.pending.set(id, {

package/dist/adapters/codex.js

@@ -3,7 +3,7 @@ import { log } from '../log.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
 import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
-import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
+import { AppServerClient, asRecord, num, RpcError, RpcTimeoutError, str, } from './codex-protocol.js';
 import { truncate } from './claude.js';
 import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { clampPercent, rateWindowKeyFromMinutes } from './rate-limits.js';
@@ -326,13 +326,69 @@ class CodexSession {
      * second; losing the conversation costs the whole context.
      */
     static RESUME_RETRY_DELAY_MS = 1_500;
+    /**
+     * How long opening an existing conversation may take (#370).
+     *
+     * Its own budget rather than the protocol's 60 s default, because it is not a
+     * command — it is the app-server reading a conversation off disk, and the
+     * work grows with the conversation. Session #61 on Athanor died on exactly
+     * that: ~6 900 events, `thread/resume timed out after 60000ms`, twice, and
+     * the session was gone for good.
+     *
+     * Measured here on 06.09.2026, codex-cli 0.153.4, against a real 14 MB
+     * rollout (1 460 lines):
+     *
+     *   without `excludeTurns` — 5 744 ms, a 4.41 MB response line
+     *   with    `excludeTurns` —   673 ms, a 27 KB response line
+     *
+     * So 120 s is ~20× the slowest answer this transport can even carry: the
+     * stdout reader drops any line over 8 MB (`MAX_LINE_BYTES`), which at the
+     * measured 0.77 MB/s is about ten seconds of hydration. The margin is not for
+     * a bigger conversation — it is for a loaded or slow machine, which is what
+     * #370 is actually about.
+     */
+    static RESUME_REQUEST_TIMEOUT_MS = 120_000;
+    /**
+     * Does this build take `excludeTurns`? (#364)
+     *
+     * Remembered per session rather than probed: the answer belongs to the
+     * installed binary, and one refusal is enough to stop asking for the life of
+     * this process. Same shape as the `experimentalApi` fallback below it.
+     */
+    excludeTurnsRefused = false;
+    /**
+     * Open a thread without asking for its whole history (#364).
+     *
+     * The history was always thrown away — `readThread` reads the id and the
+     * model and nothing else — so asking for it bought a deprecation warning in
+     * the user's feed, several megabytes through a pipe that drops anything over
+     * eight, and the seconds that killed #370. Old builds that do not know the
+     * field are answered by retrying once without it.
+     */
+    async openThreadRequest(method, params) {
+        if (!this.excludeTurnsRefused) {
+            try {
+                return asRecord(await this.client.request(method, { ...params, excludeTurns: true }, CodexSession.RESUME_REQUEST_TIMEOUT_MS));
+            }
+            catch (error) {
+                if (!isUnknownParam(error))
+                    throw error;
+                this.excludeTurnsRefused = true;
+                log.warn('codex: this build does not take excludeTurns — asking for the full history', {
+                    sessionId: this.spec.sessionId,
+                    method,
+                });
+            }
+        }
+        return asRecord(await this.client.request(method, params, CodexSession.RESUME_REQUEST_TIMEOUT_MS));
+    }
     /** Branch the thread at `lastTurnId`, dropping every later turn. */
     async forkThread(threadId, lastTurnId) {
-        const result = asRecord(await this.client.request('thread/fork', {
+        const result = await this.openThreadRequest('thread/fork', {
             threadId,
             lastTurnId,
             ...this.threadParams(),
-        }));
+        });
         const thread = asRecord(result['thread']);
         const id = str(thread['id']);
         if (!id)
@@ -344,10 +400,10 @@ class CodexSession {
         // overlay lives only in memory, so resuming with just a thread id brings the
         // conversation back without DevBridge access — the agent then hunts for
         // tickets it can no longer reach (found in the live check).
-        const result = asRecord(await this.client.request('thread/resume', {
+        const result = await this.openThreadRequest('thread/resume', {
             threadId: resumeId,
             ...this.threadParams(),
-        }));
+        });
         const thread = asRecord(result['thread']);
         const id = str(thread['id']);
         if (!id)
@@ -392,9 +448,10 @@ class CodexSession {
                 let error = firstError;
                 // Matched on the message rather than the error class: the same failure
                 // can arrive as an RPC error or as a transport error, and a missed match
-                // would fail the session instead of retrying it.
-                if (isMissingRollout(error)) {
-                    log.warn('codex: thread/resume rejected — retrying once', {
+                // would fail the session instead of retrying it. The one exception is a
+                // timeout, which IS an error class (#370) — see `isResumeRecoverable`.
+                if (isResumeRecoverable(error)) {
+                    log.warn('codex: thread/resume did not open the conversation — retrying once', {
                         sessionId: this.spec.sessionId,
                         threadId: resumeId,
                         error: maskString(describe(error)).slice(0, 300),
@@ -411,14 +468,14 @@ class CodexSession {
                         error = retryError;
                     }
                 }
-                if (isMissingRollout(error)) {
+                if (isResumeRecoverable(error)) {
                     // Losing the conversation is expensive, so record WHY. Verified live
                     // (2026-07-25): resuming this exact thread with these exact params
                     // succeeds in isolation, so a failure here is transient — most likely
                     // the previous agent process still holding the thread during a rapid
                     // stop→continue cycle. Without this line the only trace is a feed
                     // notice that says the context is gone and nothing about the cause.
-                    log.warn('codex: thread/resume rejected — falling back to a fresh thread', {
+                    log.warn('codex: thread/resume gave up — falling back to a fresh thread', {
                         sessionId: this.spec.sessionId,
                         threadId: resumeId,
                         error: maskString(describe(error)).slice(0, 300),
@@ -767,18 +824,23 @@ class CodexSession {
         }
     }
     async interrupt() {
+        // No turn of our own to stop — and that is not a failure (#373): a pause
+        // that lands between turns has nothing to interrupt and must not be read as
+        // a control channel that said no.
         if (!this.threadId || !this.activeTurnId)
-            return;
+            return 'idle';
         try {
             await this.client.request('turn/interrupt', {
                 threadId: this.threadId,
                 turnId: this.activeTurnId,
             });
+            return 'accepted';
         }
         catch (error) {
             if (/no active turn/i.test(describe(error)))
-                return;
+                return 'idle';
             log.warn('codex: interrupt failed', { error: describe(error) });
+            return this.stopped ? 'idle' : 'refused';
         }
     }
     conversationAnchor() {
@@ -1157,10 +1219,13 @@ class CodexSession {
                 }
                 return;
             }
-            // #279. Removed from `OPT_OUT_NOTIFICATIONS` on purpose: it is not a
-            // delta stream — Codex sends it when a turn changes the account's usage,
-            // which is orders of magnitude rarer than the text deltas that list
-            // defends against.
+            // #279. Kept out of `OPT_OUT_NOTIFICATIONS` on purpose, but NOT because
+            // it is rare: Codex sends it after every model request, as often as
+            // `thread/tokenUsage/updated` (production count 56 591 against 57 008,
+            // 05.09.2026 – #366). What keeps it off the wire is the supervisor's
+            // level gate, which forwards a snapshot only when it changed, carries a
+            // refusal (`blocked`), or is older than the resend floor. Opting the
+            // notification out here instead would silence the refusal too.
             case 'account/rateLimits/updated': {
                 this.onRateLimits(params);
                 return;
@@ -1802,6 +1867,9 @@ class CodexSession {
             this.emit({
                 type: 'error',
                 message: `codex app-server exited before the session was ready (code ${info.code ?? 'null'})`,
+                // #373: the process is what ended, not a turn. `stopped` is already
+                // excluded above, so this is always an exit nobody here asked for.
+                processGone: true,
             });
         }
         this.finish();
@@ -2096,6 +2164,51 @@ function describe(error) {
 function isMissingRollout(error) {
     return /no rollout found|not found/i.test(describe(error));
 }
+/**
+ * The conversation did not open, and a fresh one is the way out (#370).
+ *
+ * Two ways for that to happen, and until this ticket only the first counted:
+ *
+ *  - the app-server REFUSED — there is no such rollout. Survivable: the retry
+ *    below, then a fresh thread, and the branch and files are untouched.
+ *  - the app-server never ANSWERED. Read as «something we do not recognise»,
+ *    which fails the session outright — so a conversation that had merely grown
+ *    slow was more fatal than one that had been thrown away.
+ *
+ * The timeout is recognised by its class and not by its sentence: `RpcTimeoutError`
+ * is minted in exactly one place, whereas «timed out» is a phrase any layer
+ * between here and the provider may use about something else entirely.
+ */
+function isResumeRecoverable(error) {
+    return error instanceof RpcTimeoutError || isMissingRollout(error);
+}
+/**
+ * Did the app-server refuse a parameter it does not know? (#364)
+ *
+ * JSON-RPC says «invalid params» is -32602, and that code alone is taken at its
+ * word. App-server also answers -32600 for a field gated behind a capability,
+ * but -32600 is what a stale rollout arrives as too (see the QA-101 tests), so
+ * there the message has to name the field as well — reading a lost conversation
+ * as «this build is old» would double every attempt on the one path that is
+ * already losing it.
+ *
+ * Anything else — a timeout, a missing rollout, a transport failure — must NOT
+ * be re-sent, or one slow resume would become two.
+ */
+function isUnknownParam(error) {
+    if (error instanceof RpcTimeoutError)
+        return false;
+    if (!(error instanceof RpcError))
+        return false;
+    // A stale rollout also arrives as -32600 (see the QA-101 tests), and reading
+    // that as «this build is old» would double every resume attempt on the very
+    // path that is already losing a conversation.
+    if (isMissingRollout(error))
+        return false;
+    if (error.code === -32602)
+        return true;
+    return /unknown field|unknown parameter|unexpected field|excludeTurns/i.test(error.message);
+}
 function delay(ms) {
     return new Promise((resolve) => {
         const timer = setTimeout(resolve, ms);

package/dist/adapters/types.d.ts

@@ -543,7 +543,45 @@ export type AgentEvent = {
      * all. Both still have to withdraw the feed cut and say what happened.
      */
     recovered?: boolean;
+    /**
+     * The agent PROCESS ended with this — it is not an error the running
+     * agent reported (#373).
+     *
+     * Set only where the adapter's own read loop broke, i.e. where the CLI
+     * exited under it. The supervisor needs the difference to tell the tail of
+     * a stop it asked for from a process that died on its own: closing a
+     * process during a pause produces an ending, and an ending must not read
+     * as a failure — while a process that fell over BEFORE we closed it has
+     * genuinely failed and must still say so.
+     *
+     * A flag rather than a sentence on purpose. The wording of these errors
+     * comes from the CLI and changes with it; «who ended this process» is a
+     * fact only the adapter knows.
+     */
+    processGone?: boolean;
 };
+/**
+ * What became of an interrupt request (#373).
+ *
+ * `interrupt()` used to answer `void`, so «the CLI took the stop» and «the
+ * control channel refused it» were the same event from the supervisor's side —
+ * and a refusal that arrived one line before a pause was filed as a clean
+ * cancellation. The three outcomes are what a stop coordinator has to tell
+ * apart to decide whether the process may be closed quietly.
+ */
+export type InterruptOutcome = 
+/** The CLI acknowledged the request. A result for the turn should follow. */
+'accepted'
+/**
+ * There is nothing to stop.
+ *
+ * Either no turn was running, or this session has already been closed — by us
+ * — and the control request went with it. Both mean the same thing to the
+ * caller: no result is coming, and nobody refused anything.
+ */
+ | 'idle'
+/** The control channel said no, or died answering. The turn may still run. */
+ | 'refused';
 export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
     events: AsyncIterable<AgentEvent>;
@@ -615,8 +653,14 @@ export interface AgentSession {
          */
         gitPolicy?: AgentGitPolicy;
     }): void;
-    /** Interrupt the current turn (session stays resumable). */
-    interrupt(): Promise<void>;
+    /**
+     * Interrupt the current turn (session stays resumable).
+     *
+     * Answers what became of the request (#373). The supervisor closes the
+     * process itself after a pause, and «may I close it quietly» has a different
+     * answer for a stop the CLI took and one it refused.
+     */
+    interrupt(): Promise<InterruptOutcome>;
     /**
      * An opaque id naming the conversation as it stands RIGHT NOW (ticket #126).
      *

package/dist/levels.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Mirror of the `#region level-events-mirror` block in
+ * `packages/shared/src/constants/realtime.ts` – the DevBridge side is the
+ * source of truth, exactly like `agent-registry.ts` mirrors the agent registry
+ * and `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ *
+ * CHECKED: `levels.test.ts` reads both files and compares the region between
+ * the markers character by character. Edit the shared file first, then paste
+ * the region here – nothing but the region, and nothing of the region left out.
+ */
+/**
+ * Level signals on the dev-session stream – frames that carry a whole current
+ * value rather than a step of the conversation (#366).
+ *
+ * `agent_tasks` (#113), `context_usage` and `rate_limits` (#279) are LEVELS:
+ * every frame replaces the previous one, so a dropped frame costs freshness and
+ * never correctness. In production they were 61 % of every Codex session's
+ * rows (57 008 + 56 591 of ~185 000, 05.09.2026) while drawing not one line in
+ * the transcript – and each one re-rendered the whole page. So they are treated
+ * differently at every hop, and this block is the one place that says how:
+ *
+ *  - the runner sends one only when the value moved (the thresholds below);
+ *  - the API publishes it as a META frame (no `id:`) and never stores a row;
+ *  - the dashboard keeps it beside the feed, never in it.
+ *
+ * Mirrored verbatim into `packages/runner/src/levels.ts` – the runner cannot
+ * import this package (it is published to npm on its own). `levels.test.ts`
+ * compares the two regions character by character.
+ */
+export declare const LEVEL_EVENT_TYPES: readonly ["agent_tasks", "context_usage", "rate_limits"];
+/**
+ * A context-meter move smaller than BOTH of these is not worth a frame. The
+ * same pair gates the API's mirror onto the session row, so the ring a reload
+ * draws from the row and the ring the live frame draws agree to the percent.
+ */
+export declare const CONTEXT_USAGE_MIN_DELTA_TOKENS = 2000;
+export declare const CONTEXT_USAGE_MIN_DELTA_RATIO = 0.01;
+/**
+ * An unchanged plan-usage snapshot is re-sent no more often than this. It is
+ * re-sent at all because the limits panel dates its figure by ARRIVAL
+ * («updated 12 min ago»): silence would read as staleness. Three minutes is
+ * the interval the Claude adapter already probes `/usage` at.
+ */
+export declare const RATE_LIMITS_RESEND_INTERVAL_MS: number;
+//# sourceMappingURL=levels.d.ts.map

package/dist/levels.js

@@ -0,0 +1,51 @@
+/**
+ * Mirror of the `#region level-events-mirror` block in
+ * `packages/shared/src/constants/realtime.ts` – the DevBridge side is the
+ * source of truth, exactly like `agent-registry.ts` mirrors the agent registry
+ * and `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ *
+ * CHECKED: `levels.test.ts` reads both files and compares the region between
+ * the markers character by character. Edit the shared file first, then paste
+ * the region here – nothing but the region, and nothing of the region left out.
+ */
+// #region level-events-mirror
+/**
+ * Level signals on the dev-session stream – frames that carry a whole current
+ * value rather than a step of the conversation (#366).
+ *
+ * `agent_tasks` (#113), `context_usage` and `rate_limits` (#279) are LEVELS:
+ * every frame replaces the previous one, so a dropped frame costs freshness and
+ * never correctness. In production they were 61 % of every Codex session's
+ * rows (57 008 + 56 591 of ~185 000, 05.09.2026) while drawing not one line in
+ * the transcript – and each one re-rendered the whole page. So they are treated
+ * differently at every hop, and this block is the one place that says how:
+ *
+ *  - the runner sends one only when the value moved (the thresholds below);
+ *  - the API publishes it as a META frame (no `id:`) and never stores a row;
+ *  - the dashboard keeps it beside the feed, never in it.
+ *
+ * Mirrored verbatim into `packages/runner/src/levels.ts` – the runner cannot
+ * import this package (it is published to npm on its own). `levels.test.ts`
+ * compares the two regions character by character.
+ */
+export const LEVEL_EVENT_TYPES = ['agent_tasks', 'context_usage', 'rate_limits'];
+/**
+ * A context-meter move smaller than BOTH of these is not worth a frame. The
+ * same pair gates the API's mirror onto the session row, so the ring a reload
+ * draws from the row and the ring the live frame draws agree to the percent.
+ */
+export const CONTEXT_USAGE_MIN_DELTA_TOKENS = 2_000;
+export const CONTEXT_USAGE_MIN_DELTA_RATIO = 0.01;
+/**
+ * An unchanged plan-usage snapshot is re-sent no more often than this. It is
+ * re-sent at all because the limits panel dates its figure by ARRIVAL
+ * («updated 12 min ago»): silence would read as staleness. Three minutes is
+ * the interval the Claude adapter already probes `/usage` at.
+ */
+export const RATE_LIMITS_RESEND_INTERVAL_MS = 3 * 60 * 1000;
+// #endregion level-events-mirror
+//# sourceMappingURL=levels.js.map