@bridge4dev/runner 0.60.0 → 0.62.0

package/README.md

@@ -49,12 +49,18 @@ it. If you would rather run it in the foreground, or under your own supervisor,
 
 ## What it does on your machine
 
-- Creates a **git worktree and a branch per session**, so an agent never works in your
-  working copy and never touches your current branch.
-- Enforces a local policy layer the dashboard **cannot** raise: an allow/deny list for
-  commands, secret masking in everything it streams, and its own ceiling on how many
-  sessions may run at once. Anything the server asks for is bounded by what this config
-  permits.
+- Runs a session either **in the project folder itself** — the default: the branch it is
+  already on, nothing to apply afterwards — or in a **git worktree on a session branch of
+  its own**, which DevBridge asks for when the folder is busy or a branch was named. Which
+  one a session gets is decided per session, in the dashboard.
+- Enforces a local policy layer. Part of it the dashboard **cannot** raise: secret files and
+  keys are never read, nothing is written into any repository's `.git`, and `sudo`, service
+  control, docker and the firewall are refused in every trust level. Part of it is the bound
+  project's own setting, chosen by a manager in DevBridge: whether the agent may `git push`
+  and to which branches, and whether it may read and change files **outside the project
+  folder** — other projects on the same machine included. Out of the box the agent pushes
+  nothing and stays in its folder. Plus secret masking in everything it streams, and its own
+  ceiling on how many sessions may run at once.
 - Streams the session journal with sequence numbers and acknowledgements, so a restart of
   either side resumes instead of losing work.
 - Never uploads your source. Diffs and file views are requested per file, and files

package/dist/adapters/claude.js

@@ -8,7 +8,7 @@ import { mcpConfigPath } from '../paths.js';
 import { lowerPriority } from '../process-priority.js';
 import { cageSpawn, noteSessionAgentPid, memoryDeathSentence, releaseSessionScope, sessionMemoryEnv, sessionMemoryPromptLine, } from '../session-cage.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
-import { availableModes, cardDescription, DIRECT_BRANCH_RULE, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
+import { availableModes, cardDescription, DIRECT_BRANCH_RULE, folderRuleFor, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './rate-limits.js';
 import { applyUsagePercentages, lastUsageRows, readUsageRows } from './claude-usage.js';
 import { assertClaudeInstalled, claudeExecutableOption, sessionClaudePath, } from '../agent-binary.js';
@@ -166,14 +166,19 @@ const MODE_TO_PERMISSION = {
  * no line: the agent plans around a restriction that is not there, or walks
  * into one it was told did not exist.
  */
-function systemAppendFor(spec) {
+function systemAppendFor(spec, mode) {
     const pushBanned = spec.gitPolicy?.agentPushBan !== false;
+    // #418: which folder line this session gets, if any — see `folderRuleFor`.
+    const folderRule = folderRuleFor(spec, mode);
     const guarded = spec.gitPolicy?.agentProtectedBranches ?? ['main', 'master'];
     const memoryLine = sessionMemoryPromptLine(spec.sessionId);
     return [
         'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
         'Rules:',
-        '- Work ONLY inside the current working directory.',
+        // #418. The three cases live in `folderRuleFor` — one copy for both
+        // adapters, and the Codex adapter asks the same function whether a mode
+        // switch would change what the agent was told.
+        ...(folderRule === null ? [] : [folderRule]),
         // Session 13: pushing was refused outright by layer 1 in every trust mode,
         // and saying so here saved the agent a turn spent discovering it. Session
         // 18 makes it the project's decision — so the sentence has to follow the
@@ -203,8 +208,8 @@ function systemAppendFor(spec) {
     ].join('\n');
 }
 /** DevBridge's own rules, then whatever this workspace adds (session 13). */
-function composeSystemAppend(spec) {
-    const base = systemAppendFor(spec);
+function composeSystemAppend(spec, mode) {
+    const base = systemAppendFor(spec, mode);
     return spec.workspaceContext ? `${base}\n\n${spec.workspaceContext}` : base;
 }
 /**
@@ -585,7 +590,7 @@ class ClaudeSession {
             systemPrompt: {
                 type: 'preset',
                 preset: 'claude_code',
-                append: composeSystemAppend(spec),
+                append: composeSystemAppend(spec, this.mode),
             },
             canUseTool: (toolName, input, opts) => this.onCanUseTool(toolName, input, opts),
             // Ticket #113: a running subagent forks its own conversation every ~30s
@@ -2180,6 +2185,65 @@ class ClaudeSession {
     conversationAnchor() {
         return this.lastMessageUuid;
     }
+    /** A compaction the CLI has announced and not yet ended (#348). */
+    compacting = false;
+    /**
+     * `system:status` — the CLI's own word on what it is doing (#348).
+     *
+     * Read the way the CLI's own remote client reads it (`noteInbound`):
+     * «compacting» opens a compaction, `requesting` says nothing about one (the
+     * summary itself is a model request, and this status arrives DURING a
+     * compaction), and any other status closes it — with `compact_result` when
+     * the CLI says how it went, and as «skipped» when it does not: a PreCompact
+     * hook that said no, or a reactive compaction that found nothing to fold,
+     * both end on a bare `status: null`. Left unclosed, that start line would
+     * keep the dashboard saying «compacting» until the turn ended, minutes later.
+     *
+     * De-duplicated here as well as in the supervisor: the CLI re-says
+     * «compacting» every thirty seconds while it waits on a precomputed summary.
+     *
+     * No `standalone` on this agent: `/compact` is a turn, and its `result`
+     * settles the status the ordinary way.
+     */
+    noteStatus(msg) {
+        const status = msg.status;
+        if (status === 'requesting')
+            return;
+        if (status === 'compacting') {
+            if (this.compacting)
+                return;
+            this.compacting = true;
+            this.emit({ type: 'compaction', phase: 'started' });
+            return;
+        }
+        // An end is only an end of something that began: without a start on
+        // record there is nothing to close, and the second of two endings (a
+        // `compact_result` after a `compact_boundary`) must not open a second
+        // pair. A mode change also travels on this message — `{status: null,
+        // permissionMode}` on every `setPermissionMode` in CLI 2.1.271 — and says
+        // nothing about a compaction at all.
+        if (!this.compacting)
+            return;
+        const compactResult = msg.compact_result;
+        if (compactResult === undefined && msg.permissionMode !== undefined)
+            return;
+        this.compacting = false;
+        if (compactResult === 'failed') {
+            this.emit({
+                type: 'compaction',
+                phase: 'finished',
+                ok: false,
+                error: maskString(String(msg.compact_error ?? 'unknown')).slice(0, 300),
+            });
+            return;
+        }
+        this.emit({
+            type: 'compaction',
+            phase: 'finished',
+            ok: true,
+            ...(compactResult === 'success' ? {} : { skipped: true }),
+        });
+    }
     /**
      * `/compact` — the CLI's own command, delivered as ordinary user input.
      *
@@ -2296,19 +2360,15 @@ class ClaudeSession {
                             this.refreshUsage();
                         }
                         else if (msg.subtype === 'status') {
-                            const status = msg.status;
-                            const compactResult = msg.compact_result;
-                            if (status === 'compacting') {
-                                this.emit({ type: 'notice', level: 'info', text: 'Compacting the conversation…' });
-                            }
-                            else if (compactResult) {
-                                this.emit({
-                                    type: 'notice',
-                                    level: compactResult === 'failed' ? 'warn' : 'info',
-                                    text: compactResult === 'failed'
-                                        ? `Compaction failed: ${maskString(String(msg.compact_error ?? 'unknown')).slice(0, 300)}`
-                                        : 'Conversation compacted',
-                                });
+                            this.noteStatus(msg);
+                        }
+                        else if (msg.subtype === 'compact_boundary') {
+                            // The summary is in place: this marker is the end of a
+                            // compaction whether or not a status said so first (#348) — the
+                            // CLI's own remote client reads it the same way.
+                            if (this.compacting) {
+                                this.compacting = false;
+                                this.emit({ type: 'compaction', phase: 'finished', ok: true });
                             }
                         }
                         else if (msg.subtype === 'api_retry') {
@@ -2440,6 +2500,10 @@ class ClaudeSession {
                         break;
                     }
                     case 'result': {
+                        // A turn's end is the end of any compaction it carried (#348):
+                        // the supervisor closes the pair on `turn_end`, and the flag here
+                        // has to agree, or the next «compacting» would be read as a repeat.
+                        this.compacting = false;
                         this.emit({
                             type: 'cost',
                             costUsd: msg.total_cost_usd,

package/dist/adapters/codex.js

@@ -6,7 +6,7 @@ import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, RpcError, RpcTimeoutError, str, } from './codex-protocol.js';
 import { truncate } from './claude.js';
-import { availableModes, cardDescription, DIRECT_BRANCH_RULE, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
+import { availableModes, cardDescription, DIRECT_BRANCH_RULE, folderRuleFor, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { clampPercent, rateWindowKeyFromMinutes } from './rate-limits.js';
 import { answerSummary, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
@@ -60,6 +60,37 @@ const MODE_POLICY = {
     // exactly like Claude's bypassPermissions. The dashboard says so.
     full: { approvalPolicy: 'never', sandbox: 'danger-full-access', plan: false },
 };
+/**
+ * Where a `workspace-write` turn may write (#418).
+ *
+ * Codex confines writes in the KERNEL, not in our policy: under `auto` the
+ * sandbox is `workspace-write` with `writableRoots: [cwd]`, so a write outside
+ * fails inside the CLI, comes back as a «retry without sandbox?» approval, and
+ * only then reaches layer 1. With the project's permission on, that round trip
+ * is exactly the refusal the ticket exists to remove — so the ROOT is widened.
+ *
+ * **The sandbox is widened, never dropped**, and that is the whole safety of
+ * this function. `danger-full-access` looks like the simpler answer and is the
+ * wrong one: for Codex the kernel sandbox refusing something IS the only
+ * channel that reaches `evaluateToolUse` (the adapter calls it from
+ * `onApproval` and nowhere else). Remove the sandbox and nothing ever
+ * escalates, so `sudo`, docker, the firewall, secret paths, any repository's
+ * `.git`, the project's prompt file and the project's own git policy would all
+ * stop being enforced for Codex — the very list the setting promises to keep.
+ * Keeping `workspaceWrite` keeps that channel, and keeps `networkAccess: false`
+ * with it, so the permission moves one boundary and no other.
+ *
+ * **STRICT does not widen.** There a step outside must still raise a card, and
+ * the only way to raise one for Codex is to let the sandbox refuse it first.
+ *
+ * Read on every turn rather than captured at launch, because the setting can be
+ * switched while the session runs.
+ */
+function writableRootsFor(spec) {
+    if (spec.trustMode === 'STRICT')
+        return [spec.cwd];
+    return spec.gitPolicy?.agentAllowOutsideFolder === true ? ['/'] : [spec.cwd];
+}
 /**
  * DevBridge's own rules — composed per session since session 18, and kept
  * deliberately in step with `systemAppendFor` in the Claude adapter.
@@ -69,14 +100,19 @@ const MODE_POLICY = {
  * `workMode: DIRECT` (the default since session 16), and the push sentence is
  * only true when the project has «Принудительно запретить push» switched on.
  */
-function systemAppendFor(spec) {
+function systemAppendFor(spec, mode) {
     const pushBanned = spec.gitPolicy?.agentPushBan !== false;
+    // #418: which folder line this session gets, if any — see `folderRuleFor`.
+    const folderRule = folderRuleFor(spec, mode);
     const guarded = spec.gitPolicy?.agentProtectedBranches ?? ['main', 'master'];
     const memoryLine = sessionMemoryPromptLine(spec.sessionId);
     return [
         'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
         'Rules:',
-        '- Work ONLY inside the current working directory.',
+        // #418. The three cases live in `folderRuleFor` — one copy for both
+        // adapters, and the Codex adapter asks the same function whether a mode
+        // switch would change what the agent was told.
+        ...(folderRule === null ? [] : [folderRule]),
         pushBanned
             ? '- Commit your work in the current branch with clear messages. You cannot push: `git push` is blocked for this project. A human presses «Push» and «Apply» in DevBridge when the branch is ready.'
             : guarded.length > 0
@@ -96,8 +132,8 @@ function systemAppendFor(spec) {
     ].join('\n');
 }
 /** DevBridge's own rules, then whatever this workspace adds (session 13). */
-function composeSystemAppend(spec) {
-    const base = systemAppendFor(spec);
+function composeSystemAppend(spec, mode) {
+    const base = systemAppendFor(spec, mode);
     return spec.workspaceContext ? `${base}\n\n${spec.workspaceContext}` : base;
 }
 // Allowlist, not denylist: whatever secrets live in the daemon's environment
@@ -534,8 +570,14 @@ class CodexSession {
         return {
             cwd: this.spec.cwd,
             approvalPolicy: policy.approvalPolicy,
+            // #418 does NOT change this one, and that is deliberate. The thread-level
+            // channel takes the CLI-style MODE string, which has no way to say «this
+            // root»; the mode itself is unchanged (`workspace-write` stays
+            // `workspace-write`), and the roots travel with every turn below. Both
+            // channels therefore still describe the same sandbox, which is what R10
+            // of the plan asks for — there is no second shape to keep in step.
             sandbox: policy.sandbox,
-            developerInstructions: composeSystemAppend(this.spec),
+            developerInstructions: composeSystemAppend(this.spec, this.mode),
             ...(this.model ? { model: this.model } : {}),
             ...(this.spec.mcp ? { config: this.mcpOverlay() } : {}),
         };
@@ -582,7 +624,8 @@ class CodexSession {
             // [] is accepted, null is rejected outright.
             input: [{ type: 'text', text, text_elements: [] }],
             approvalPolicy: policy.approvalPolicy,
-            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec.cwd),
+            // #418: the roots live here and only here — see `writableRootsFor`.
+            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec),
             ...(this.model ? { model: this.model } : {}),
             // "Override the reasoning effort for this turn and subsequent turns" —
             // the same sticky-override channel the model uses (there is still no
@@ -793,12 +836,29 @@ class CodexSession {
         this.refreshCapabilities();
     }
     /**
-     * Codex needs no new process for any mode: `approvalPolicy` and the sandbox
-     * policy travel with the next `turn/start`, so the change is in force from
-     * the next turn whatever it is (ticket #156).
+     * Codex needs no new process for its POLICY: `approvalPolicy` and the sandbox
+     * travel with the next `turn/start`, so the change is in force from the next
+     * turn whatever it is (ticket #156).
+     *
+     * Its RULES are the other half, and they cannot follow (#418). DevBridge's
+     * own instructions reach Codex ONLY as the thread's `developerInstructions`,
+     * fixed when the thread opens: this protocol version has no `settings/update`,
+     * and putting the text on the turn instead is the duplicated-prompt defect of
+     * ticket #179. So a line that has to DISAPPEAR in «Unrestricted» — where
+     * layer 1 is never consulted and the sentence would be the only thing left
+     * enforcing it — can only disappear with a new thread.
+     *
+     * Asked precisely rather than by hard-coding the `full` boundary: would the
+     * folder line actually change? With «may work outside the project folder» ON
+     * the answer is never — the sentence is then the same in every mode — so
+     * those projects keep Codex's free, instant mode switching. Only a session
+     * that would be told something different pays for a new process, and it pays
+     * exactly what a Claude session has always paid for the same move.
      */
-    modeSwitchNeedsRelaunch(_mode) {
-        return false;
+    modeSwitchNeedsRelaunch(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode))
+            return false;
+        return folderRuleFor(this.spec, mode) !== folderRuleFor(this.spec, this.mode);
     }
     async setMode(mode) {
         if (!availableModes(this.spec.trustMode).includes(mode)) {
@@ -876,6 +936,7 @@ class CodexSession {
             return false;
         try {
             await this.client.request('thread/compact/start', { threadId: this.threadId });
+            this.requestedCompaction = true;
             return true;
         }
         catch (error) {
@@ -883,6 +944,14 @@ class CodexSession {
             return false;
         }
     }
+    /**
+     * A compaction THIS adapter asked for with `thread/compact/start` (#348) —
+     * the one kind that runs outside any turn and therefore has nothing to
+     * settle the session status behind it. The agent's own compaction inside a
+     * turn is not it, even when its item happens to complete before the
+     * `turn/started` that announces the turn.
+     */
+    requestedCompaction = false;
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -1472,8 +1541,19 @@ class CodexSession {
                 return;
             }
             case 'contextCompaction': {
-                if (done)
-                    this.notice('info', 'Conversation compacted');
+                // #348: an event, not a notice — see `AgentEvent['compaction']`. A
+                // compaction started from the dashboard runs outside any turn on this
+                // agent (`thread/compact/start` creates none), so nothing will settle
+                // the status behind it; `standalone` tells the supervisor to.
+                if (method === 'item/started') {
+                    this.emit({ type: 'compaction', phase: 'started' });
+                    return;
+                }
+                if (done) {
+                    const standalone = this.requestedCompaction && this.activeTurnId === null;
+                    this.requestedCompaction = false;
+                    this.emit({ type: 'compaction', phase: 'finished', ok: true, standalone });
+                }
                 return;
             }
             case 'webSearch':
@@ -2235,9 +2315,10 @@ class CodexSession {
 }
 class ResumeFailed extends Error {
 }
-function sandboxPolicyFor(mode, cwd) {
+function sandboxPolicyFor(mode, spec) {
     // turn/start takes the structured SandboxPolicy, while thread/start takes the
-    // CLI-style SandboxMode string. Same intent, two shapes.
+    // CLI-style SandboxMode string. Same intent, two shapes — and only this one
+    // can name the writable roots, which is why #418 lives here.
     switch (mode) {
         case 'read-only':
             return { type: 'readOnly', networkAccess: false };
@@ -2246,7 +2327,11 @@ function sandboxPolicyFor(mode, cwd) {
         default:
             return {
                 type: 'workspaceWrite',
-                writableRoots: [cwd],
+                writableRoots: writableRootsFor(spec),
+                // Unchanged by #418, on purpose: the permission is about the file
+                // system, and letting the network out with it would be a second
+                // boundary nobody asked to move. A network command still fails in the
+                // sandbox, still escalates, and still ends at layer 1.
                 networkAccess: false,
                 excludeTmpdirEnvVar: false,
                 excludeSlashTmp: false,

package/dist/adapters/questions.js

@@ -110,6 +110,7 @@ const INVALIDATION_PHRASES = {
     turn_aborted: 'the turn was interrupted',
     agent_cancelled: 'the agent withdrew it',
     budget_spent: 'the session ran out of its allowed working time',
+    not_held: 'the agent no longer holds this question',
 };
 /** The question was taken away from the user — say why, never fake an answer. */
 export function invalidationMessage(reason) {

package/dist/adapters/types.d.ts

@@ -322,6 +322,56 @@ export declare function cardDescription(verdict: PolicyDecision, own: string | u
  * into a card.
  */
 export declare const DIRECT_BRANCH_RULE = "- This session works directly in the project folder, which other sessions and people share. Stay on the current branch: do not `git checkout <branch>` or `git switch` here. To put a file back use `git checkout -- <path>` or `git restore <path>`.";
+/**
+ * «Stay in this folder» — the line layer 1 used to back up (#418).
+ *
+ * Here, beside `DIRECT_BRANCH_RULE` and for the same reason: the two
+ * `systemAppendFor` texts are hand-synced copies of each other, and a rule that
+ * has to appear in one of them and not the other is the kind of thing that
+ * drifts silently. Exported so the tests can name the exact string rather than
+ * a substring of it.
+ *
+ * NOT written when the session is «Unrestricted» — there the CLI never asks
+ * layer 1 anything, so this sentence was the only thing left enforcing it, and
+ * a rule with nothing underneath is a rule the agent refuses itself by — nor
+ * when the project has switched «may work outside the project folder» on, where
+ * `outsideFolderRule` takes its place.
+ */
+export declare const WORKING_DIRECTORY_RULE = "- Work ONLY inside the current working directory.";
+/**
+ * What replaces the line above when the project allows work outside the folder
+ * (#418).
+ *
+ * It says three things and no more: where the agent is, that it may go
+ * elsewhere when the task needs it, and what it gives up by doing so — nothing
+ * outside the folder reaches «Changes», «Apply» or a restore point. That last
+ * half is the part the agent cannot discover for itself and the part a person
+ * would otherwise find out from a diff that is missing a file.
+ */
+export declare function outsideFolderRule(cwd: string): string;
+/**
+ * Which of the two lines above this session gets, or neither (#418).
+ *
+ * One function rather than the same three-way choice written out in both
+ * `systemAppendFor` texts — and it has a second caller that made it worth
+ * extracting: the Codex adapter asks it whether a MODE SWITCH would change what
+ * the agent was told, because Codex's developer instructions are fixed when the
+ * thread opens and cannot be edited afterwards.
+ *
+ * The three cases, in order:
+ *  - the project allows work outside the folder → say where the folder is and
+ *    what leaving it costs, in EVERY mode (the permission does not depend on
+ *    the mode, so neither does the sentence);
+ *  - «Unrestricted» → `null`, nothing at all. Layer 1 is never consulted there,
+ *    so this line would be the only thing enforcing the rule: the agent refuses
+ *    itself by a sentence nothing backs up, which is the complaint #418 came
+ *    from;
+ *  - otherwise → the rule as it has always been, with layer 1 behind it.
+ *
+ * The mode passed in must be the one the session is actually IN, not the one it
+ * was asked for: a `full` refused on a STRICT workspace keeps the line.
+ */
+export declare function folderRuleFor(spec: SessionSpec, mode: AgentMode | undefined): string | null;
 /**
  * One question inside an agent's question call (session 12).
  *
@@ -366,7 +416,16 @@ export interface AgentQuestionAnswer {
     notes?: string;
 }
 /** Why a question was taken away from the user without them answering it. */
-export type QuestionInvalidationReason = 'session_stopped' | 'session_parked' | 'runner_restarted' | 'turn_aborted' | 'agent_cancelled' | 'budget_spent';
+export type QuestionInvalidationReason = 'session_stopped' | 'session_parked' | 'runner_restarted' | 'turn_aborted' | 'agent_cancelled' | 'budget_spent'
+/**
+ * An answer arrived for a card no live process holds (#392): the card
+ * outlived the process that asked, or the ask was withdrawn before the
+ * answer got here. The runner does not know which, and says only what it
+ * does know. Never handed to an agent — there is no agent holding the ask
+ * to hand it to — so its phrase in `INVALIDATION_PHRASES` is for the type
+ * checker; the words a person reads are the dashboard's.
+ */
+ | 'not_held';
 /** The dashboard's answer to one open ask. */
 export interface QuestionReply {
     askId: string;
@@ -502,6 +561,38 @@ export type AgentEvent = {
     type: 'notice';
     level: 'info' | 'warn';
     text: string;
+}
+/**
+ * The conversation is being folded into a summary, or just was (#348).
+ *
+ * Its own event and not a `notice` on purpose: adapter notices are
+ * de-duplicated per session on their text (gotcha §148), so «Conversation
+ * compacted» reached the feed once and every later compaction was silence.
+ * A compaction is a fact the feed has to hear every time — the dashboard's
+ * «compacting…» indicator is read off the feed, and a second compaction
+ * with no lines is a second compaction the person cannot see end.
+ *
+ * `standalone` on the ending: `true` when NO turn is going to close behind
+ * this compaction, so the supervisor has to settle the session status
+ * itself. Codex runs a compaction started from the dashboard outside any
+ * turn (`thread/compact/start`); Claude delivers `/compact` as a turn, and
+ * that turn's own ending settles the status the ordinary way.
+ */
+ | {
+    type: 'compaction';
+    phase: 'started';
+} | {
+    type: 'compaction';
+    phase: 'finished';
+    ok: boolean;
+    error?: string;
+    standalone?: boolean;
+    /**
+     * It ended without a summary: the CLI decided not to compact after all
+     * (a PreCompact hook said no, or it found nothing worth folding). Not a
+     * failure — nothing broke — and not a compaction either.
+     */
+    skipped?: boolean;
 } | {
     type: 'cost';
     costUsd: number;

package/dist/adapters/types.js

@@ -100,6 +100,65 @@ export function cardDescription(verdict, own) {
  * into a card.
  */
 export const DIRECT_BRANCH_RULE = '- This session works directly in the project folder, which other sessions and people share. Stay on the current branch: do not `git checkout <branch>` or `git switch` here. To put a file back use `git checkout -- <path>` or `git restore <path>`.';
+/**
+ * «Stay in this folder» — the line layer 1 used to back up (#418).
+ *
+ * Here, beside `DIRECT_BRANCH_RULE` and for the same reason: the two
+ * `systemAppendFor` texts are hand-synced copies of each other, and a rule that
+ * has to appear in one of them and not the other is the kind of thing that
+ * drifts silently. Exported so the tests can name the exact string rather than
+ * a substring of it.
+ *
+ * NOT written when the session is «Unrestricted» — there the CLI never asks
+ * layer 1 anything, so this sentence was the only thing left enforcing it, and
+ * a rule with nothing underneath is a rule the agent refuses itself by — nor
+ * when the project has switched «may work outside the project folder» on, where
+ * `outsideFolderRule` takes its place.
+ */
+export const WORKING_DIRECTORY_RULE = '- Work ONLY inside the current working directory.';
+/**
+ * What replaces the line above when the project allows work outside the folder
+ * (#418).
+ *
+ * It says three things and no more: where the agent is, that it may go
+ * elsewhere when the task needs it, and what it gives up by doing so — nothing
+ * outside the folder reaches «Changes», «Apply» or a restore point. That last
+ * half is the part the agent cannot discover for itself and the part a person
+ * would otherwise find out from a diff that is missing a file.
+ */
+export function outsideFolderRule(cwd) {
+    return (`- Your working directory is ${cwd}; you may read and change files elsewhere on this server ` +
+        `when the task needs it. Only what is inside ${cwd} shows up in the DevBridge diff and restore points.`);
+}
+/**
+ * Which of the two lines above this session gets, or neither (#418).
+ *
+ * One function rather than the same three-way choice written out in both
+ * `systemAppendFor` texts — and it has a second caller that made it worth
+ * extracting: the Codex adapter asks it whether a MODE SWITCH would change what
+ * the agent was told, because Codex's developer instructions are fixed when the
+ * thread opens and cannot be edited afterwards.
+ *
+ * The three cases, in order:
+ *  - the project allows work outside the folder → say where the folder is and
+ *    what leaving it costs, in EVERY mode (the permission does not depend on
+ *    the mode, so neither does the sentence);
+ *  - «Unrestricted» → `null`, nothing at all. Layer 1 is never consulted there,
+ *    so this line would be the only thing enforcing the rule: the agent refuses
+ *    itself by a sentence nothing backs up, which is the complaint #418 came
+ *    from;
+ *  - otherwise → the rule as it has always been, with layer 1 behind it.
+ *
+ * The mode passed in must be the one the session is actually IN, not the one it
+ * was asked for: a `full` refused on a STRICT workspace keeps the line.
+ */
+export function folderRuleFor(spec, mode) {
+    // `=== true` — silence keeps the agent in, exactly as `policy.ts` resolves the
+    // same field.
+    if (spec.gitPolicy?.agentAllowOutsideFolder === true)
+        return outsideFolderRule(spec.cwd);
+    return mode === 'full' ? null : WORKING_DIRECTORY_RULE;
+}
 /**
  * The name our MCP server is registered under inside an agent session.
  *

package/dist/index.js

@@ -381,6 +381,18 @@ function runnerCapabilities(apiUrlOverride) {
          * been handed a worse problem.
          */
         agentGitPolicy: true,
+        /**
+         * #418: «the agent may work outside the project folder» is a setting of the
+         * project, and this runner honours it.
+         *
+         * Its own flag rather than a second meaning for `agentGitPolicy`: the two
+         * ship a release apart, and a server on 0.61.x announces the git policy
+         * perfectly honestly while ignoring this field completely. Announced so the
+         * settings card can say so — warn, not refuse, for the same reason as the
+         * git policy: a manager must be able to record the decision before the last
+         * machine in the fleet is up to date.
+         */
+        agentOutsideFolder: true,
         /**
          * Session 16: git is git.
          *

package/dist/journal.d.ts

@@ -58,6 +58,23 @@ export declare class SessionJournal {
         anchor: string;
         providerSessionId: string;
     } | null;
+    /**
+     * Every card this journal has published, and whether it is still open —
+     * in the order they were asked (#392).
+     *
+     * The persistent twin of the supervisor's `running.openQuestions`: that set
+     * dies with the process, and a process that dies ungracefully never gets to
+     * `shutdown()`, which is the only place it withdraws them. This one is
+     * rebuilt from the file, so the next process can close what the last one
+     * left open — the card in the browser does not know the runner restarted.
+     *
+     * Closed cards are remembered too, not only dropped: «this card was closed
+     * by somebody» is the fact that stops a SECOND tombstone. A queued answer
+     * that reaches the next process after a restore has already closed the card
+     * must rescue the words and say nothing more about the card — and the only
+     * witness that the card was closed is this file.
+     */
+    private readonly asks;
     constructor(sessionId: string, dir?: string);
     private replay;
     private write;
@@ -86,6 +103,29 @@ export declare class SessionJournal {
     recordStatus(status: string, extra?: Record<string, unknown>, epoch?: number): void;
     /** Assign the next seq and persist the event before it is sent. */
     append(eventType: string, payload: Record<string, unknown>): JournalEvent;
+    /**
+     * Keep `openAsks` in step with the cards going out through `append` (#392).
+     *
+     * Here and not in the supervisor, because `append` is the one door every
+     * event takes: a card that was published was published through it, and so
+     * was every resolution — the adapter's own, `withdrawOpenQuestions`, the
+     * `not_open` miss. A set kept beside the callers would need every one of
+     * them to remember it, which is exactly how the in-memory set came to be
+     * empty at the moment it was needed.
+     *
+     * A resolution for a card this journal never published writes nothing:
+     * there is nothing to close, and remembering strangers would only grow the
+     * file.
+     */
+    private trackAsk;
+    /** The cards still waiting on a person, oldest first (#392). */
+    openAskIds(): string[];
+    /**
+     * What this journal knows about one card (#392): `open`, `closed`, or
+     * nothing at all — a card asked by a runner from before these lines existed,
+     * or one this state directory never saw.
+     */
+    askState(askId: string): 'open' | 'closed' | undefined;
     /**
      * Never reuse a seq the API already stored: after a runner state-dir wipe the
      * local counter restarts at 1 and every replayed event would collide with an