@bridge4dev/runner 0.59.1 → 0.61.0

package/dist/self-update.d.ts

@@ -116,6 +116,28 @@ export declare function installIsWritable(packageDir?: string | null): boolean;
  * that would work is recoverable, disappearing from the user's server is not.
  */
 export declare function isSupervisedProcess(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The `hello` pair that decides whether the card draws a «Restart runner»
+ * button (#396, plan `workflow-stage-restart` R13).
+ *
+ * The same shape as `selfUpdate` / `selfUpdateBlocked`, and for the same
+ * reason: an older runner drops a command it cannot parse without answering, so
+ * the dashboard must gate on an announced capability rather than on a version.
+ *
+ * Only `isSupervisedProcess()`, and NOT `selfUpdatable()`: replacing the
+ * package needs an installed, writable npm package, restarting needs only
+ * something that will start us again. A daemon run from a source checkout under
+ * systemd — the dogfood box — restarts perfectly well and must get the button.
+ *
+ * Lives here rather than beside the other capabilities in `index.ts` because
+ * that file exports nothing and is the CLI entry point: a key spelled wrong
+ * there is caught by nobody, and `capabilities` is an untyped bag on both ends.
+ */
+export declare function restartCapability(env?: NodeJS.ProcessEnv): {
+    restart: true;
+} | {
+    restartBlocked: 'unsupervised';
+};
 /**
  * Same origin as the API we are paired with, and it really is a tarball.
  *

package/dist/self-update.js

@@ -148,6 +148,28 @@ export function installIsWritable(packageDir = resolveInstalledPackageDir()) {
 export function isSupervisedProcess(env = process.env) {
     return typeof env['INVOCATION_ID'] === 'string' && env['INVOCATION_ID'].length > 0;
 }
+/**
+ * The `hello` pair that decides whether the card draws a «Restart runner»
+ * button (#396, plan `workflow-stage-restart` R13).
+ *
+ * The same shape as `selfUpdate` / `selfUpdateBlocked`, and for the same
+ * reason: an older runner drops a command it cannot parse without answering, so
+ * the dashboard must gate on an announced capability rather than on a version.
+ *
+ * Only `isSupervisedProcess()`, and NOT `selfUpdatable()`: replacing the
+ * package needs an installed, writable npm package, restarting needs only
+ * something that will start us again. A daemon run from a source checkout under
+ * systemd — the dogfood box — restarts perfectly well and must get the button.
+ *
+ * Lives here rather than beside the other capabilities in `index.ts` because
+ * that file exports nothing and is the CLI entry point: a key spelled wrong
+ * there is caught by nobody, and `capabilities` is an untyped bag on both ends.
+ */
+export function restartCapability(env = process.env) {
+    // The literal string matters: the dashboard renders the explanatory sentence
+    // for exactly this value and silently draws nothing for any other.
+    return isSupervisedProcess(env) ? { restart: true } : { restartBlocked: 'unsupervised' };
+}
 /**
  * Same origin as the API we are paired with, and it really is a tarball.
  *

package/dist/supervisor.d.ts

@@ -39,6 +39,20 @@ export interface SupervisorOptions {
      * reports the new version only after the next manual restart.
      */
     onRestartRequested?: (outcome: SelfUpdateOutcome) => void;
+    /**
+     * Called after a `runner_restart` the machine agreed to, once the reply is on
+     * the wire (#396). Separate from `onRestartRequested` rather than folded into
+     * it: that one is typed on `SelfUpdateOutcome` and its handler logs the
+     * version it is restarting INTO, which a plain restart has no answer for.
+     */
+    onRestartCommanded?: (note: string | null) => void;
+    /**
+     * Build an adapter for an agent that was not on PATH when the daemon started
+     * (#395). Returning `null` means «still not here», and the session is refused
+     * in the same words as before. Only the entry point can supply this: it owns
+     * the config the adapters are built from.
+     */
+    makeAdapter?: (agent: 'CLAUDE' | 'CODEX') => AgentAdapter | null;
     /**
      * Local ceiling on concurrent agent processes, from the runner's own config
      * (layer 1). When set it wins over the API's number if it is stricter — the
@@ -216,6 +230,8 @@ export interface SupervisorOptions {
      * `BACKGROUND_TASKS_HEARTBEAT_MS`. Real one is five minutes.
      */
     backgroundTasksHeartbeatMs?: number;
+    /** #348: the compaction net, as a test seam over `COMPACTION_WATCHDOG_MS`. */
+    compactionWatchdogMs?: number;
 }
 /**
  * How often a resting session says «I still hold N background tasks» — the
@@ -260,6 +276,8 @@ export declare class Supervisor {
     private static readonly EMPTY_TURN_SETTLE_MS;
     /** The window actually used — the constant, or a test's own shorter one. */
     private readonly emptyTurnSettleMs;
+    /** The compaction net actually used — the constant, or a test's own. */
+    private readonly compactionWatchdogMs;
     private readonly rateLimitsResendMs;
     /** The stop-settle window actually used — the constant, or a test's own. */
     private readonly stopSettleMs;
@@ -305,8 +323,31 @@ export declare class Supervisor {
      * which of the two is running.
      */
     private installInFlight;
+    /**
+     * A `runner_restart` has been agreed to and the exit is coming (#396).
+     *
+     * Never cleared: the process has ~1.5 s left, and everything it must refuse in
+     * that window it must refuse for good.
+     */
+    private restarting;
     /** A restore-point collection is running; a second reconnect must not start another (#388). */
     private checkpointGcInFlight;
+    /**
+     * Sessions the current `hello_ack` names, while `reconcile` is walking them
+     * (#392).
+     *
+     * The unacked replay at the top of `reconcile` sends every journal's
+     * leftovers before a single session is registered, and the acks come back
+     * while the loop is still awaiting an earlier session's worktree. The ack
+     * handler deletes the journal of a session it does not know once nothing is
+     * unacked — which used to be exactly the journal the loop was about to
+     * restore from: its open cards, its queued messages, its anchor, gone a
+     * moment before they were read. Membership here is what «this session is
+     * known» means until the loop reaches it.
+     */
+    private readonly reconciling;
+    /** How long a dashboard-requested compaction may go unreported before the session is handed back. */
+    private static readonly COMPACTION_WATCHDOG_MS;
     /** Session 14: one project-recipe run per machine, and its verdict queue. */
     private readonly verify;
     private readonly verifyReports;
@@ -322,6 +363,21 @@ export declare class Supervisor {
      * sent — the next `hello_ack` or the hourly tick carries the same fact, and
      * the measurement behind it is cached, so retrying is nearly free.
      */
+    /**
+     * The adapter for this agent — built now if it was not there at boot (#395).
+     *
+     * `opts.adapters` is assembled once, when the daemon starts, from what was on
+     * PATH at that moment. That is the SAME frozen snapshot `capabilities.agents`
+     * was, one layer down: press «Install Codex» on a running machine and the
+     * measurement updates, the card lights up, the API lets the session through —
+     * and this map still has no CODEX in it, so the session is created and dies
+     * at once. Asking the factory closes the last of the three lists.
+     *
+     * Built at most once per process and remembered: preparing Codex's isolated
+     * home clones ~90 MB on a machine that has never run it, and that is a price
+     * to pay on the first session, not on every one.
+     */
+    private adapterFor;
     /**
      * Why an install cannot start right now, in words for the person who pressed.
      *
@@ -877,6 +933,26 @@ export declare class Supervisor {
      * chance, and the alternative there is a card that stays clickable forever.
      */
     private withdrawOpenQuestions;
+    /**
+     * Close out the asks a PREVIOUS process of this runner left open (#392).
+     *
+     * `withdrawOpenQuestions` above reads `running.openQuestions`, and that set
+     * is memory: a process that died without reaching `shutdown()` — killed,
+     * crashed, machine rebooted — took it along, and the restore used to create
+     * a fresh empty set and write only «Runner reconnected». The card in the
+     * browser is closed by one thing, a `question_resolved` with its askId in
+     * the feed, so it stayed answerable for ever, and everything typed into it
+     * was lost (the 07.09.2026 session in the ticket: six restarts, zero
+     * tombstones).
+     *
+     * The journal is the set that survived: `SessionJournal.append` notes every
+     * card this runner published and every resolution it published, whoever
+     * wrote it. That is also the «already closed» check the plan asks to name:
+     * a graceful `shutdown()` sends its `question_resolved` through the same
+     * `append`, so by the time a restore runs, a card closed that way is no
+     * longer in the set — one tombstone per card, never two.
+     */
+    private withdrawJournaledQuestions;
     /**
      * Deliver messages that were held because every slot was taken.
      *
@@ -983,6 +1059,23 @@ export declare class Supervisor {
      * phantom can never fire after the turn it belonged to has closed properly.
      */
     private clearEmptyTurn;
+    /**
+     * A compaction is over for a reason other than the agent saying so (#348):
+     * the turn it rode on ended, the process died, a new process was launched.
+     * The feed gets its closing line so the pair is complete, and the runner's
+     * own state is dropped so the NEXT compaction opens a new pair — left set,
+     * every later start would be read as a repeat and written nowhere (QA S4).
+     */
+    private endCompaction;
+    /** A compaction has begun: say so in the feed, once, and remember who started it (#348). */
+    private openCompaction;
+    /**
+     * The net under a dashboard-requested compaction (#348) — see
+     * `RunningSession.compactionWatchdog`. Fires only into a session that has
+     * said nothing since: every agent event and every ending clears it.
+     */
+    private armCompactionWatchdog;
+    private clearCompactionWatchdog;
     /**
      * Record how many subagents are alive, and say so when it matters (#236).
      *
@@ -1024,8 +1117,9 @@ export declare class Supervisor {
      * It happens for real: a background subagent's report wakes a new turn inside
      * the agent process (SDK 0.3.226 emits a second `system:init` and a `result`
      * carrying `origin: {kind:'task-notification'}`), and nothing here reports a
-     * turn the runner did not start. Compaction does the same, and so does a
-     * question this runner withdraws by itself.
+     * turn the runner did not start. So does a question this runner withdraws by
+     * itself. (A compaction used to be the third case; `compact_context` reports
+     * RUNNING itself now, and #348 gave the compaction lines of its own.)
      *
      * An open question is the one thing that must survive: there, WAITING_INPUT
      * means a tool call is parked on a person, and the agent narrating around its
@@ -1376,7 +1470,34 @@ export declare class Supervisor {
      * anything down. The name says what it does.
      */
     private finishSession;
+    /**
+     * The terminal status a reconnect should replay for this session instead
+     * of restoring it, or null (QA-96 F1).
+     *
+     * Only a terminal status from THIS life of the session. A resumed session
+     * carries a higher epoch, and replaying the FAILED it was resumed from would
+     * kill it again the moment the runner reconnects. A journal written by a
+     * runner from before session 13 could hold a `DONE` — it is no longer a
+     * status this runner may report, and replaying one would close the session
+     * for the user. Drop it and let the session be picked back up like any
+     * other. Pure: reads the journal and decides, so the pre-registration pass
+     * and the loop answer the question the same way.
+     */
+    private terminalStatusToReplay;
+    /**
+     * Build and register the entry for a session a runner restart interrupted,
+     * and close the cards its dead process left open (#392).
+     *
+     * Synchronous on purpose, and called for EVERY such session before the
+     * reconnect awaits anything: registered, the session is known (a message
+     * for it waits in its queue behind the `starting` gate of #401 instead of
+     * coming back as `session_unknown`), and its cards go dark first thing —
+     * above the line about the restart, so a person reading down sees the card
+     * close before they read why.
+     */
+    private registerRestoredSession;
     private reconcile;
+    private reconcileKnown;
     /**
      * Housekeeping for the journal directory. Safe to call any time: live
      * sessions are skipped and a journal still holding unacked events survives