@bridge4dev/runner 0.57.0 → 0.58.1

package/dist/adapters/claude.js

@@ -6,7 +6,7 @@ import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { mcpConfigPath } from '../paths.js';
 import { lowerPriority } from '../process-priority.js';
-import { cageSpawn, memoryDeathSentence, releaseSessionScope } from '../session-cage.js';
+import { cageSpawn, noteSessionAgentPid, memoryDeathSentence, releaseSessionScope, sessionMemoryEnv, sessionMemoryPromptLine, } from '../session-cage.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
 import { availableModes, cardDescription, DIRECT_BRANCH_RULE, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './rate-limits.js';
@@ -100,11 +100,19 @@ export function scrubbedEnv() {
  * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
  * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
  */
-function agentEnv(mode) {
+function agentEnv(mode, sessionId) {
     const env = scrubbedEnv();
     if (mode === 'full' && process.getuid?.() === 0)
         env['IS_SANDBOX'] = '1';
-    return env;
+    /**
+     * The two numbers of this session's cage (#398 S5).
+     *
+     * Here and not in `scrubbedEnv()`, which is a FILTER over `process.env` and is
+     * shared with the one-shot commit-message run — that run has no session and no
+     * cage. `cageSpawn` merges its own variables LAST at the spawn, so nothing
+     * here can collide with them.
+     */
+    return { ...env, ...sessionMemoryEnv(sessionId) };
 }
 // Normalized mode → Claude permission mode (session-5 plan §2). `full` is the
 // owner's explicit call (2026-07-24): "same as Claude works now, we don't
@@ -161,6 +169,7 @@ const MODE_TO_PERMISSION = {
 function systemAppendFor(spec) {
     const pushBanned = spec.gitPolicy?.agentPushBan !== false;
     const guarded = spec.gitPolicy?.agentProtectedBranches ?? ['main', 'master'];
+    const memoryLine = sessionMemoryPromptLine(spec.sessionId);
     return [
         'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
         'Rules:',
@@ -183,6 +192,11 @@ function systemAppendFor(spec) {
         '- The user is not in a terminal, but they DO answer: when you need a decision, use the AskUserQuestion tool. It is rendered as a card in the DevBridge dashboard and the call waits — however long it takes — until a human answers it. Only ask in plain text if the tool is unavailable.',
         '- Never decide for the user when you asked them a question. If the tool comes back saying the question was withdrawn, stop and wait rather than guessing.',
         '- Never print secrets (tokens, API keys, private keys) in your output.',
+        // #398 S5: the cage's numbers, said in words. Half of the incident this
+        // came from was an agent raising its own heap twice — 4 GB, then 6 GB,
+        // against a wall of 4296 MB — because nothing had ever told it there was a
+        // wall. Absent on a machine with no cage: there is nothing to promise.
+        ...(memoryLine === null ? [] : [memoryLine]),
         // #361 п. 5 — only where the folder is shared. Layer 1 asks about these
         // commands anyway; this is so the agent learns the rule before a card.
         ...(spec.workMode === 'DIRECT' ? [DIRECT_BRANCH_RULE] : []),
@@ -517,7 +531,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: agentEnv(this.mode),
+            env: agentEnv(this.mode, spec.sessionId),
             // Empty while `USE_BUNDLED_CLAUDE` — the SDK keeps resolving its own
             // bundled binary, exactly as before. After C3 this pins the system
             // `claude`, which is the file the card measures and the button installs.
@@ -683,6 +697,11 @@ class ClaudeSession {
         // `systemd-run --scope` execs into the same pid and nice survives `exec`,
         // so this still lands on the CLI itself.
         lowerPriority(child.pid);
+        // Which process in this cage is the agent (#403). The stall mechanism may
+        // stop a command; it may never stop the agent, and it tells them apart by
+        // this rather than by «its parent is outside the scope» — an MCP server
+        // whose launcher exited looks the same by that rule.
+        noteSessionAgentPid(this.spec.sessionId, child.pid);
         // Read `Result` and clear the unit once the process is gone. Only an
         // `exit` listener: stdout belongs to the SDK, and attaching a reader to it
         // here would put the stream in flowing mode and steal the conversation.

package/dist/adapters/codex-protocol.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { log } from '../log.js';
 import { lowerPriority } from '../process-priority.js';
-import { cageSpawn, killedBeforeExec, releaseSessionScope } from '../session-cage.js';
+import { cageSpawn, killedBeforeExec, noteSessionAgentPid, releaseSessionScope, } from '../session-cage.js';
 export class RpcError extends Error {
     code;
     method;
@@ -59,6 +59,11 @@ export class AppServerClient {
         // renices the app-server it turns into. On a machine with no cage this is
         // the only containment there is.
         lowerPriority(this.child.pid);
+        // Which process in this cage is the agent (#403). The stall mechanism may
+        // stop a command; it may never stop the agent, and it tells them apart by
+        // this rather than by «its parent is outside the scope» — an MCP server
+        // whose launcher exited looks the same by that rule.
+        noteSessionAgentPid(opts.sessionId, this.child.pid);
         this.child.stdout.setEncoding('utf8');
         this.child.stdout.on('data', (chunk) => {
             this.sawOutput = true;

package/dist/adapters/codex.js

@@ -1,7 +1,7 @@
 import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
-import { memoryDeathSentence } from '../session-cage.js';
+import { memoryDeathSentence, sessionMemoryEnv, sessionMemoryPromptLine } from '../session-cage.js';
 import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, RpcError, RpcTimeoutError, str, } from './codex-protocol.js';
@@ -72,6 +72,7 @@ const MODE_POLICY = {
 function systemAppendFor(spec) {
     const pushBanned = spec.gitPolicy?.agentPushBan !== false;
     const guarded = spec.gitPolicy?.agentProtectedBranches ?? ['main', 'master'];
+    const memoryLine = sessionMemoryPromptLine(spec.sessionId);
     return [
         'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
         'Rules:',
@@ -84,6 +85,11 @@ function systemAppendFor(spec) {
         '- If DevBridge MCP tools are available and the task mentions tickets: fetch the ticket first, set its status to IN_PROGRESS when you start and READY_FOR_REVIEW when your implementation is complete, and leave a short summary comment.',
         '- The user is not in a terminal: if you need a decision, use your question tool or ask in plain text and end your turn.',
         '- Never print secrets (tokens, API keys, private keys) in your output.',
+        // #398 S5: the cage's numbers, said in words. Half of the incident this
+        // came from was an agent raising its own heap twice — 4 GB, then 6 GB,
+        // against a wall of 4296 MB — because nothing had ever told it there was a
+        // wall. Absent on a machine with no cage: there is nothing to promise.
+        ...(memoryLine === null ? [] : [memoryLine]),
         // #361 п. 5 — only where the folder is shared. Layer 1 asks about these
         // commands anyway; this is so the agent learns the rule before a card.
         ...(spec.workMode === 'DIRECT' ? [DIRECT_BRANCH_RULE] : []),
@@ -209,7 +215,10 @@ class CodexSession {
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
         const wiring = {
-            env: scrubbedEnv(home.path),
+            // The cage's two numbers ride along (#398 S5). Built here rather than
+            // inside `scrubbedEnv`, which has no access to the session — and merged
+            // BEFORE `cageSpawn`'s own variables, which win any collision.
+            env: { ...scrubbedEnv(home.path), ...sessionMemoryEnv(spec.sessionId) },
             onNotification: (method, params) => this.onNotification(method, params),
             onServerRequest: (request) => this.onServerRequest(request),
             onExit: (info) => this.onExit(info),

package/dist/adapters/types.js

@@ -1,3 +1,4 @@
+import { sessionMemoryFor } from '../session-cage.js';
 export const AGENT_MODES = ['ask', 'plan', 'auto', 'full'];
 export function isAgentMode(value) {
     return typeof value === 'string' && AGENT_MODES.includes(value);
@@ -61,6 +62,19 @@ export function policyContextFor(spec, mode) {
         // gives every absent field its safe reading, and an object assembled here
         // with three of the four would be a fourth place to get a polarity wrong.
         ...(spec.gitPolicy ?? {}),
+        /**
+         * This session's memory ceiling, read at the moment of the decision rather
+         * than captured at start (#398 S5): the wall moves with the machine, and a
+         * gate judging against a number from an hour ago would refuse a command the
+         * cage would now allow, or allow one it will now stop.
+         *
+         * Absent on a machine with no cage — and there the gate does not fire at
+         * all, because there is no ceiling to be over.
+         */
+        ...(() => {
+            const memory = sessionMemoryFor(spec.sessionId);
+            return memory === null ? {} : { sessionMemoryMaxBytes: memory.maxBytes };
+        })(),
         worktreePath: spec.cwd,
     };
 }

package/dist/cage-authority.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Who is allowed to change anything on this machine's systemd, and who is only
+ * allowed to look (#403).
+ *
+ * On 10.09.2026 a test run of this package stopped three live agent sessions
+ * belonging to other people. Nothing in it was malicious and nothing in it was
+ * unusual: `sweepOrphanSessionScopes` treats every scope that is not in its own
+ * register as litter, and in a process that is not the daemon that register is
+ * empty by construction — so every real cage on the machine looked like litter.
+ *
+ * A guard for exactly that existed (`supervisor.ts`, «would STOP THE LIVE
+ * SESSIONS OF WHOEVER IS WORKING ON IT») and it rested on an assumption about
+ * what tests happen to do: no test calls the real `initSessionCage()`. One new
+ * test did, and the assumption was gone — silently, because an assumption about
+ * other people's future code cannot fail loudly.
+ *
+ * This module replaces the assumption with a right that has to be taken. Every
+ * command that CHANGES something goes through here, the right is claimed once,
+ * explicitly, by the entry point that legitimately needs it, and a test process
+ * cannot claim it at all. Reading is not restricted to anybody: `doctor`, the
+ * machine card and every measurement keep working from any process.
+ *
+ * Two independent things, deliberately kept apart:
+ *
+ *  - **Knowing** what the cage looks like. Tests need this — half of
+ *    `session-cage.test.ts` is about the formulas, and they need a machine that
+ *    answers `scope`. Knowledge is not restricted.
+ *  - **Acting** on the machine. This is what is taken away, and taking it away
+ *    from a test process is unconditional.
+ */
+/** What a process is allowed to do to this machine's systemd. */
+export type CageRole = 
+/** Look only. Every process starts here, including this daemon before it claims. */
+'none'
+/** May run the cage probe and clean up after it: `pair`, `doctor`. */
+ | 'probe'
+/** May also manage the runner's OWN service unit: `install-service`, `doctor --fix`. */
+ | 'install'
+/** May also act on session cages: the daemon, and only the daemon. */
+ | 'daemon';
+/** Thrown when a process asks for a right it cannot have. Never caught silently. */
+export declare class CageAuthorityError extends Error {
+    constructor(message: string);
+}
+/**
+ * Take the right to change this machine, once, at a known entry point.
+ *
+ * Called from `index.ts` and nowhere else. A test process is refused
+ * unconditionally and loudly: the throw is the point, because a test that
+ * genuinely needs to reach the machine is a test that has to be rewritten, not
+ * a case to be accommodated.
+ */
+export declare function claimCageAuthority(claimed: Exclude<CageRole, 'none'>): void;
+/** What this process may do right now. */
+export declare function cageAuthority(): CageRole;
+/**
+ * Give the right back.
+ *
+ * Exists for the tests of THIS module and for a daemon that is shutting down;
+ * production has no other reason to call it. It cannot hand a right to anybody,
+ * so it is safe wherever it is called from.
+ */
+export declare function releaseCageAuthority(): void;
+/**
+ * May this exact call go through? Answers without doing anything, so callers
+ * that would rather degrade than throw can ask first.
+ */
+export declare function maySystemctl(args: readonly string[], forRole?: CageRole): boolean;
+/** May this process start a new cage (`systemd-run --scope`)? */
+export declare function mayStartScope(unit: string, forRole?: CageRole): boolean;
+/** May this process send signals to processes it did not spawn? */
+export declare function maySignalProcesses(forRole?: CageRole): boolean;
+/**
+ * May this process stop, reset or re-limit the cages of sessions?
+ *
+ * Asked BEFORE the work rather than left to the door below it, wherever a
+ * refusal would otherwise be swallowed: the orphan sweep catches every failed
+ * `systemctl` on purpose (a failed scope has nothing to stop), so without this
+ * it would report units as removed that it never touched.
+ */
+export declare function mayActOnSessionCages(forRole?: CageRole): boolean;
+/**
+ * Run `systemctl --user`, if this process is allowed to.
+ *
+ * The door is INSIDE the real executor rather than in front of the functions
+ * that call it, and that is deliberate: a guard in front of `sweepOrphan…` and
+ * `releaseSessionScope` would have to be repeated at every new call site, and
+ * the one that got forgotten would be the one that mattered.
+ */
+export declare function runSystemctl(args: readonly string[], options?: {
+    timeout?: number;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Run `systemd-run --user`, if this process is allowed to.
+ *
+ * `--version` is a read and goes through unchecked; anything that would create
+ * a unit is checked against the name it would create.
+ */
+export declare function runSystemdRun(args: readonly string[], options?: {
+    timeout?: number;
+    env?: NodeJS.ProcessEnv;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Signal a process, if this process is allowed to.
+ *
+ * The same door, for the other way of ending somebody's work. A stall that
+ * takes the biggest command out of a session is a `process.kill` and nothing
+ * else, so a test process reaching this line would be the incident again with a
+ * different verb.
+ */
+export declare function killProcess(pid: number, signal: NodeJS.Signals): void;
+//# sourceMappingURL=cage-authority.d.ts.map

package/dist/cage-authority.js

@@ -0,0 +1,241 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { systemdUserEnv } from './environment.js';
+import { log } from './log.js';
+const execFileAsync = promisify(execFile);
+/** Thrown when a process asks for a right it cannot have. Never caught silently. */
+export class CageAuthorityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CageAuthorityError';
+    }
+}
+let role = 'none';
+/**
+ * Unit-name prefixes each role may act on.
+ *
+ * A verb alone is not enough. `daemon` may stop a session cage and must not be
+ * able to stop `user@0.service`, and the difference is the target, not the
+ * verb — so the check is «this verb, on these units», and an unrecognised unit
+ * is refused even to the daemon.
+ */
+const TARGETS = {
+    none: [],
+    probe: ['devbridge-cage-probe-'],
+    install: ['devbridge-cage-probe-', 'devbridge-runner'],
+    // `verify` needs no prefix of its own: it cages its run through the same
+    // `cageSpawn`, so its unit is a `devbridge-session-verify-…` too.
+    daemon: ['devbridge-cage-probe-', 'devbridge-runner', 'devbridge-session-'],
+};
+/**
+ * Verbs that only read. Everything else is a change, INCLUDING a verb this list
+ * has never heard of.
+ *
+ * The default direction is the whole point: a systemd that grows a new
+ * destructive verb, or a caller that reaches for one nobody thought about, must
+ * come out refused rather than allowed. The cost of the mistake is asymmetric —
+ * a refused read is a broken report, a permitted stop is somebody's work.
+ */
+const READ_VERBS = new Set([
+    'show',
+    'show-environment',
+    'cat',
+    'status',
+    'list-units',
+    'list-unit-files',
+    'list-dependencies',
+    'list-jobs',
+    'is-active',
+    'is-enabled',
+    'is-failed',
+    'is-system-running',
+]);
+/**
+ * Verbs that change something but name no unit — they act on the manager.
+ *
+ * `daemon-reload` is the one that matters: the runner ships a drop-in and has
+ * to make systemd read it. It is a change, so `none` may not do it, and it has
+ * no target to check.
+ */
+const MANAGER_VERBS = new Set(['daemon-reload', 'daemon-reexec']);
+/** Is this process one where acting on the machine can never be right? */
+function isTestProcess() {
+    const env = process.env;
+    return (env['VITEST'] !== undefined ||
+        env['VITEST_WORKER_ID'] !== undefined ||
+        env['NODE_ENV'] === 'test' ||
+        env['DEVBRIDGE_NO_SYSTEMD'] === '1' ||
+        '__vitest_worker__' in globalThis);
+}
+/**
+ * Take the right to change this machine, once, at a known entry point.
+ *
+ * Called from `index.ts` and nowhere else. A test process is refused
+ * unconditionally and loudly: the throw is the point, because a test that
+ * genuinely needs to reach the machine is a test that has to be rewritten, not
+ * a case to be accommodated.
+ */
+export function claimCageAuthority(claimed) {
+    if (isTestProcess()) {
+        throw new CageAuthorityError(`a test process may not claim systemd authority (asked for «${claimed}»). ` +
+            'Inject the executor the code under test takes, or assert on the arguments instead.');
+    }
+    if (role !== 'none' && role !== claimed) {
+        log.warn('cage authority: the claimed role changed', { from: role, to: claimed });
+    }
+    role = claimed;
+}
+/** What this process may do right now. */
+export function cageAuthority() {
+    return role;
+}
+/**
+ * Give the right back.
+ *
+ * Exists for the tests of THIS module and for a daemon that is shutting down;
+ * production has no other reason to call it. It cannot hand a right to anybody,
+ * so it is safe wherever it is called from.
+ */
+export function releaseCageAuthority() {
+    role = 'none';
+}
+/** The verb of a `systemctl` call, ignoring the flags around it. */
+function verbOf(args) {
+    for (const arg of args) {
+        if (arg.startsWith('-'))
+            continue;
+        return arg;
+    }
+    return null;
+}
+/**
+ * The units a call names, as opposed to the flags and property assignments
+ * around them.
+ *
+ * `set-property --runtime devbridge-session-x.scope MemoryHigh=123` names one
+ * unit; the two after it are a flag and a property. Anything with an `=` in it
+ * is an assignment, not a unit — systemd's own rule.
+ */
+function targetsOf(args) {
+    const verb = verbOf(args);
+    if (verb === null)
+        return [];
+    const rest = args.slice(args.indexOf(verb) + 1);
+    return rest.filter((arg) => !arg.startsWith('-') && !arg.includes('='));
+}
+/** Does this unit name belong to something the role is allowed to touch? */
+function allowedTarget(unit, forRole) {
+    return TARGETS[forRole].some((prefix) => unit.startsWith(prefix));
+}
+/**
+ * May this exact call go through? Answers without doing anything, so callers
+ * that would rather degrade than throw can ask first.
+ */
+export function maySystemctl(args, forRole = role) {
+    const verb = verbOf(args);
+    // A call with no verb reads the manager's own state (`systemctl --version`).
+    if (verb === null)
+        return true;
+    if (READ_VERBS.has(verb))
+        return true;
+    if (forRole === 'none')
+        return false;
+    if (MANAGER_VERBS.has(verb))
+        return true;
+    const targets = targetsOf(args);
+    // A change with no named unit is a change to everything: `systemctl --user
+    // stop` with a glob that expanded to nothing still is not ours to make.
+    if (targets.length === 0)
+        return false;
+    return targets.every((unit) => allowedTarget(unit, forRole));
+}
+/** May this process start a new cage (`systemd-run --scope`)? */
+export function mayStartScope(unit, forRole = role) {
+    if (forRole === 'none')
+        return false;
+    return allowedTarget(unit, forRole);
+}
+/** May this process send signals to processes it did not spawn? */
+export function maySignalProcesses(forRole = role) {
+    return forRole === 'daemon';
+}
+/**
+ * May this process stop, reset or re-limit the cages of sessions?
+ *
+ * Asked BEFORE the work rather than left to the door below it, wherever a
+ * refusal would otherwise be swallowed: the orphan sweep catches every failed
+ * `systemctl` on purpose (a failed scope has nothing to stop), so without this
+ * it would report units as removed that it never touched.
+ */
+export function mayActOnSessionCages(forRole = role) {
+    return forRole === 'daemon';
+}
+function refuse(what, detail) {
+    /**
+     * Loud, always, and at `error` — a refusal here means somebody built a path
+     * to the machine that was not meant to exist, and the whole value of this
+     * module is that such a path cannot pass unnoticed.
+     */
+    log.error('cage authority: refused a command that would change this machine', {
+        role,
+        what,
+        ...detail,
+    });
+    return new CageAuthorityError(`this process (role «${role}») may not run: ${what}. ` +
+        'Only the daemon acts on session cages; everything else may read.');
+}
+/**
+ * Run `systemctl --user`, if this process is allowed to.
+ *
+ * The door is INSIDE the real executor rather than in front of the functions
+ * that call it, and that is deliberate: a guard in front of `sweepOrphan…` and
+ * `releaseSessionScope` would have to be repeated at every new call site, and
+ * the one that got forgotten would be the one that mattered.
+ */
+export async function runSystemctl(args, options = {}) {
+    if (!maySystemctl(args)) {
+        throw refuse(`systemctl --user ${args.join(' ')}`, { args: [...args] });
+    }
+    const { stdout, stderr } = await execFileAsync('systemctl', ['--user', ...args], {
+        timeout: options.timeout ?? 15_000,
+        env: systemdUserEnv(),
+    });
+    return { stdout, stderr };
+}
+/**
+ * Run `systemd-run --user`, if this process is allowed to.
+ *
+ * `--version` is a read and goes through unchecked; anything that would create
+ * a unit is checked against the name it would create.
+ */
+export async function runSystemdRun(args, options = {}) {
+    const versionOnly = args.length === 1 && args[0] === '--version';
+    if (!versionOnly) {
+        const unitFlag = args.find((arg) => arg.startsWith('--unit='));
+        const unit = unitFlag === undefined ? '' : unitFlag.slice('--unit='.length);
+        if (unit === '' || !mayStartScope(unit)) {
+            throw refuse(`systemd-run --user ${args.join(' ')}`, { unit });
+        }
+    }
+    const env = options.env ?? (versionOnly ? undefined : systemdUserEnv());
+    const { stdout, stderr } = await execFileAsync('systemd-run', [...args], {
+        timeout: options.timeout ?? 30_000,
+        ...(env === undefined ? {} : { env }),
+    });
+    return { stdout, stderr };
+}
+/**
+ * Signal a process, if this process is allowed to.
+ *
+ * The same door, for the other way of ending somebody's work. A stall that
+ * takes the biggest command out of a session is a `process.kill` and nothing
+ * else, so a test process reaching this line would be the incident again with a
+ * different verb.
+ */
+export function killProcess(pid, signal) {
+    if (!maySignalProcesses()) {
+        throw refuse(`kill -${signal} ${pid}`, { pid, signal });
+    }
+    process.kill(pid, signal);
+}
+//# sourceMappingURL=cage-authority.js.map

package/dist/config.d.ts

@@ -41,11 +41,79 @@ declare const ConfigSchema: z.ZodObject<{
         auth?: "link" | "own" | undefined;
     }>>;
     limits: z.ZodOptional<z.ZodObject<{
-        max_sessions: z.ZodNumber;
+        /**
+         * OPTIONAL since 0.58.0, and the change is a bug fix rather than a
+         * loosening.
+         *
+         * `loadConfig()` uses `.parse`, not `safeParse`, and a ZodError from it
+         * reaches `main().catch` and exits 1 — under systemd that is a restart
+         * loop. So while this field was required, a machine owner who opened
+         * `config.toml` to add any OTHER key under `[limits]` and did not happen
+         * to have this one would have taken their dev server down, and `doctor`
+         * could not have told them why: it dies on the same parse.
+         *
+         * The default is unchanged — absence means «the API's number decides»,
+         * which is what `get maxSessions()` already did.
+         */
+        max_sessions: z.ZodOptional<z.ZodNumber>;
+        /**
+         * #398 S6: the emergency switch back to the pre-0.58.0 behaviour.
+         *
+         * `false` puts every session on the fixed `max(pot / 3, 2 GiB)` share
+         * that shipped in 0.55.0, computed once at daemon start and never moved.
+         * It exists because this formula travels to dev servers nobody here has
+         * ever seen, and the two previous memory rules were both reasonable on
+         * the author's machine and destructive somewhere else. A machine owner
+         * who has to get work done tonight needs a way back that does not involve
+         * downgrading the runner.
+         */
+        adaptive_memory: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * The guarantee, in megabytes — what a session on this machine will not
+         * have taken away.
+         *
+         * The default is 2048, sized over the 1571 MB peak measured for a
+         * workspace `pnpm typecheck`. Lower it on a machine that runs lighter
+         * work and wants more sessions; raise it on one that runs heavier.
+         */
+        session_memory_min: z.ZodOptional<z.ZodNumber>;
+        /**
+         * A ceiling on the ceiling, in megabytes — the most any single session
+         * may be allowed to grow to, whatever the machine has free.
+         *
+         * For the owner who wants agents to leave room for something the runner
+         * cannot see (a build they run by hand, a database that spikes).
+         */
+        session_memory_max: z.ZodOptional<z.ZodNumber>;
+        /**
+         * How long a session that has stopped moving is given before its biggest
+         * command is stopped, in seconds. Default 180 (decision D6).
+         */
+        memory_stall_grace_sec: z.ZodOptional<z.ZodNumber>;
+        /**
+         * What happens when that time runs out: `stop-command` (the default) or
+         * `report-only`.
+         *
+         * `report-only` is for the owner who would rather have a session stand
+         * still than have a command stopped under it. It changes nothing else —
+         * the deadline still runs and the strip still shows it, so the person can
+         * act; only DevBridge stops acting on their behalf.
+         */
+        memory_stall_action: z.ZodOptional<z.ZodEnum<["stop-command", "report-only"]>>;
     }, "strip", z.ZodTypeAny, {
-        max_sessions: number;
+        max_sessions?: number | undefined;
+        adaptive_memory?: boolean | undefined;
+        session_memory_min?: number | undefined;
+        session_memory_max?: number | undefined;
+        memory_stall_grace_sec?: number | undefined;
+        memory_stall_action?: "stop-command" | "report-only" | undefined;
     }, {
-        max_sessions: number;
+        max_sessions?: number | undefined;
+        adaptive_memory?: boolean | undefined;
+        session_memory_min?: number | undefined;
+        session_memory_max?: number | undefined;
+        memory_stall_grace_sec?: number | undefined;
+        memory_stall_action?: "stop-command" | "report-only" | undefined;
     }>>;
     /**
      * Session 14: the machine owner's veto over running project recipes.
@@ -126,7 +194,12 @@ declare const ConfigSchema: z.ZodObject<{
         auth: "link" | "own";
     } | undefined;
     limits?: {
-        max_sessions: number;
+        max_sessions?: number | undefined;
+        adaptive_memory?: boolean | undefined;
+        session_memory_min?: number | undefined;
+        session_memory_max?: number | undefined;
+        memory_stall_grace_sec?: number | undefined;
+        memory_stall_action?: "stop-command" | "report-only" | undefined;
     } | undefined;
     verify?: {
         enabled: boolean;
@@ -155,7 +228,12 @@ declare const ConfigSchema: z.ZodObject<{
         auth?: "link" | "own" | undefined;
     } | undefined;
     limits?: {
-        max_sessions: number;
+        max_sessions?: number | undefined;
+        adaptive_memory?: boolean | undefined;
+        session_memory_min?: number | undefined;
+        session_memory_max?: number | undefined;
+        memory_stall_grace_sec?: number | undefined;
+        memory_stall_action?: "stop-command" | "report-only" | undefined;
     } | undefined;
     verify?: {
         enabled?: boolean | undefined;