@bridge4dev/runner 0.60.0 → 0.62.0

package/dist/journal.js

@@ -21,6 +21,23 @@ export class SessionJournal {
     lastStatus = null;
     /** The agent's conversation tip, and the provider session it lives in. */
     lastAnchor = null;
+    /**
+     * Every card this journal has published, and whether it is still open —
+     * in the order they were asked (#392).
+     *
+     * The persistent twin of the supervisor's `running.openQuestions`: that set
+     * dies with the process, and a process that dies ungracefully never gets to
+     * `shutdown()`, which is the only place it withdraws them. This one is
+     * rebuilt from the file, so the next process can close what the last one
+     * left open — the card in the browser does not know the runner restarted.
+     *
+     * Closed cards are remembered too, not only dropped: «this card was closed
+     * by somebody» is the fact that stops a SECOND tombstone. A queued answer
+     * that reaches the next process after a restore has already closed the card
+     * must rescue the words and say nothing more about the card — and the only
+     * witness that the card was closed is this file.
+     */
+    asks = new Map();
     constructor(sessionId, dir = journalDir()) {
         this.sessionId = sessionId;
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -50,6 +67,16 @@ export class SessionJournal {
                 });
                 if (parsed.seq >= this.nextSeq)
                     this.nextSeq = parsed.seq + 1;
+                // The event lines carry the same fact as `ask_open`/`ask_closed`, and
+                // replaying both is harmless: the set is a set.
+                this.trackAsk(parsed.eventType, parsed.payload, false);
+            }
+            else if (parsed.kind === 'ask_open') {
+                if (this.asks.get(parsed.askId) !== 'closed')
+                    this.asks.set(parsed.askId, 'open');
+            }
+            else if (parsed.kind === 'ask_closed') {
+                this.asks.set(parsed.askId, 'closed');
             }
             else if (parsed.kind === 'ack') {
                 this.unackedBySeq.delete(parsed.seq);
@@ -107,6 +134,11 @@ export class SessionJournal {
         if (this.lastAnchor) {
             lines.push({ kind: 'anchor', ...this.lastAnchor });
         }
+        // AFTER the event lines: an unacked `question` re-written above would
+        // otherwise reopen, on the next replay, a card these lines say is closed.
+        for (const [askId, state] of this.asks) {
+            lines.push({ kind: state === 'open' ? 'ask_open' : 'ask_closed', askId });
+        }
         if (this.lastStatus) {
             lines.push({
                 kind: 'status',
@@ -182,8 +214,58 @@ export class SessionJournal {
         const event = { seq: this.nextSeq++, eventType, payload };
         this.write({ kind: 'event', ...event, ts: new Date().toISOString() });
         this.unackedBySeq.set(event.seq, event);
+        this.trackAsk(eventType, payload, true);
         return event;
     }
+    /**
+     * Keep `openAsks` in step with the cards going out through `append` (#392).
+     *
+     * Here and not in the supervisor, because `append` is the one door every
+     * event takes: a card that was published was published through it, and so
+     * was every resolution — the adapter's own, `withdrawOpenQuestions`, the
+     * `not_open` miss. A set kept beside the callers would need every one of
+     * them to remember it, which is exactly how the in-memory set came to be
+     * empty at the moment it was needed.
+     *
+     * A resolution for a card this journal never published writes nothing:
+     * there is nothing to close, and remembering strangers would only grow the
+     * file.
+     */
+    trackAsk(eventType, payload, persist) {
+        if (eventType !== 'question' && eventType !== 'question_resolved')
+            return;
+        const askId = payload['askId'];
+        if (typeof askId !== 'string' || !askId)
+            return;
+        const state = this.asks.get(askId);
+        if (eventType === 'question') {
+            // A card is asked once; a replayed event line for one already closed
+            // (compaction keeps unacked events) must not reopen it.
+            if (state !== undefined)
+                return;
+            this.asks.set(askId, 'open');
+            if (persist)
+                this.write({ kind: 'ask_open', askId });
+            return;
+        }
+        if (state !== 'open')
+            return;
+        this.asks.set(askId, 'closed');
+        if (persist)
+            this.write({ kind: 'ask_closed', askId });
+    }
+    /** The cards still waiting on a person, oldest first (#392). */
+    openAskIds() {
+        return [...this.asks].filter(([, state]) => state === 'open').map(([askId]) => askId);
+    }
+    /**
+     * What this journal knows about one card (#392): `open`, `closed`, or
+     * nothing at all — a card asked by a runner from before these lines existed,
+     * or one this state directory never saw.
+     */
+    askState(askId) {
+        return this.asks.get(askId);
+    }
     /**
      * Never reuse a seq the API already stored: after a runner state-dir wipe the
      * local counter restarts at 1 and every replayed event would collide with an

package/dist/policy.d.ts

@@ -40,6 +40,33 @@ export interface AgentGitPolicy {
     agentAllowForcePush?: boolean;
     /** `git reset --hard` and `git clean`. `undefined` and `false` mean no. */
     agentAllowDestructiveGit?: boolean;
+    /**
+     * #418: may the agent read and write OUTSIDE the folder this session works
+     * in — other projects on the same machine included?
+     *
+     * READ AS `=== true`. `undefined` means an API too old to send the field, or
+     * a value the protocol schema threw away, and there the answer must be what
+     * it has always been: confined to the folder. The same direction as
+     * `agentAllowForcePush` two fields up, the opposite of `agentPushBan` at the
+     * top — one names a permission, the other names a ban, and silence refuses
+     * in both readings (gotcha 193).
+     *
+     * **Not a git setting, and it lives in a git-named object on purpose.** The
+     * whole delivery pipe for the project's per-agent policy already exists —
+     * descriptor → `gitPolicyOf` → `SessionSpec` → `policyContextFor` →
+     * `PolicyContext`, with `workspace_settings` for a live change — and it moves
+     * this object WHOLE at every hop. A field of its own beside it would have
+     * been a second branch in the supervisor, a second one in the live frame and
+     * a second chance to forget one of them (plan R8). The name is the price;
+     * this comment is the receipt.
+     *
+     * What it does NOT lift: `isSecretPath`, `isGitInternalPath`,
+     * `ctx.agentPromptFile`, `DENIED_COMMAND_PATTERNS`, `SECRET_COMMAND_PATTERNS`,
+     * the git policy above, the auto-commit refusal and the heap ceiling. It
+     * lifts exactly one rule — «this path is not inside the folder» — and leaves
+     * every other reason to refuse standing.
+     */
+    agentAllowOutsideFolder?: boolean;
 }
 export interface PolicyContext extends AgentGitPolicy {
     trustMode: TrustMode;

package/dist/policy.js

@@ -11,6 +11,8 @@ function resolveGitPolicy(ctx) {
         protectedBranches: ctx.agentProtectedBranches ?? DEFAULT_PROTECTED_BRANCHES,
         allowForcePush: ctx.agentAllowForcePush === true,
         allowDestructiveGit: ctx.agentAllowDestructiveGit === true,
+        // `=== true`: silence keeps the agent in its folder (#418).
+        allowOutsideFolder: ctx.agentAllowOutsideFolder === true,
     };
 }
 // ─── Secret masking (plan §8.7) ──────────────────────────────────────
@@ -1309,6 +1311,18 @@ export function evaluateToolUse(toolName, input, ctx) {
     if (READ_TOOLS.has(toolName) || WRITE_TOOLS.has(toolName)) {
         const rawPath = String(input['file_path'] ?? input['path'] ?? input['notebook_path'] ?? '');
         const resolved = rawPath ? normalize(rawPath, ctx.worktreePath) : ctx.worktreePath;
+        /**
+         * #418: this project answered «yes» to «may the agent work outside the
+         * project folder», so «not inside the folder» stops being a reason on its
+         * own. Resolved through `resolveGitPolicy` rather than read off `ctx` here,
+         * because that function is the one place in this file where an absent field
+         * is given its safe meaning — and «unknown» here has to mean «stay in».
+         *
+         * It moves exactly one rule out of the way. Everything checked above and
+         * below this line — secret paths, `.git` internals, the session's own
+         * prompt file — is checked in the same order and refuses the same things.
+         */
+        const outsideAllowed = resolveGitPolicy(ctx).allowOutsideFolder;
         if (isSecretPath(resolved)) {
             return { decision: 'deny', reason: 'protected secret path' };
         }
@@ -1328,7 +1342,9 @@ export function evaluateToolUse(toolName, input, ctx) {
                 reason: 'writing inside .git is not allowed — a hook or a config entry is code git runs on its own, past every rule here',
             };
         }
-        if (WRITE_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
+        if (WRITE_TOOLS.has(toolName) &&
+            !outsideAllowed &&
+            !isInsideWorktree(resolved, ctx.worktreePath)) {
             return { decision: 'deny', reason: 'writes outside the session worktree are not allowed' };
         }
         // The project's own prompt file — the same rule as `.git` above, for the
@@ -1344,10 +1360,27 @@ export function evaluateToolUse(toolName, input, ctx) {
         }
         if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
-        if (READ_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
-            return trust === 'AUTO'
-                ? { decision: 'allow', reason: 'auto mode' }
-                : { decision: 'ask', reason: 'read outside the worktree' };
+        if (!isInsideWorktree(resolved, ctx.worktreePath)) {
+            /**
+             * #418. Below STRICT — which asked one line up and goes on asking, which
+             * is the whole of «Strict still asks» — a path outside the folder is now
+             * an ORDINARY path for a project that allowed it: no card, no refusal,
+             * and the same answer for a read and for a write.
+             *
+             * Its own reason string rather than falling through to «inside worktree»
+             * below: that sentence goes to the log, and about a file in another
+             * folder it would simply be false.
+             */
+            if (outsideAllowed) {
+                return { decision: 'allow', reason: 'outside the project folder, allowed by this project' };
+            }
+            // Reads only: a write outside was refused above unless the project
+            // allowed it, so nothing else reaches this line.
+            if (READ_TOOLS.has(toolName)) {
+                return trust === 'AUTO'
+                    ? { decision: 'allow', reason: 'auto mode' }
+                    : { decision: 'ask', reason: 'read outside the worktree' };
+            }
         }
         return { decision: 'allow', reason: 'inside worktree' };
     }

package/dist/protocol.d.ts

@@ -32,6 +32,20 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
      * behaviour every runner had before this release.
      */
     pausedUntil: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    /**
+     * Subagents the API still believes to be alive in this session (#393).
+     *
+     * The number is the dead process's last word, kept by the API: a runner
+     * restart takes every subagent with it, and the new process seeds its own
+     * count at zero — so the descriptor is the only place the number survives
+     * long enough to be written down. The API sends it only while it still
+     * believes it (its own trust window on the count's age); absent or zero
+     * means «nothing to say», and a restore says nothing.
+     *
+     * `.catch(undefined)` like its neighbours: one malformed value must cost
+     * its own session a line at most, never the frame (QA-100 MAJOR-1).
+     */
+    backgroundTasks: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
     /**
      * The newest published version of THIS session's agent — Р13, §4.8.
      *
@@ -99,6 +113,18 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
         agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
         agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+        /**
+         * #418: may the agent read and write OUTSIDE the project folder?
+         *
+         * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above, and
+         * safe here for the same reason as `agentPushBan` — though the polarity
+         * runs the other way. `policy.ts` resolves this one with `=== true`, so a
+         * value this schema throws away leaves the session confined to its folder:
+         * strictly more restricted, never less. Rubbish in this field therefore
+         * costs a project its permission, which is the direction a dropped value is
+         * allowed to fail in.
+         */
+        agentAllowOutsideFolder: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
         budgetUsd: z.ZodNullable<z.ZodNumber>;
         budgetMinutes: z.ZodNullable<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
@@ -114,6 +140,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentProtectedBranches?: string[] | undefined;
         agentAllowForcePush?: boolean | undefined;
         agentAllowDestructiveGit?: boolean | undefined;
+        agentAllowOutsideFolder?: boolean | undefined;
     }, {
         path: string;
         id: string;
@@ -127,6 +154,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentProtectedBranches?: unknown;
         agentAllowForcePush?: unknown;
         agentAllowDestructiveGit?: unknown;
+        agentAllowOutsideFolder?: unknown;
     }>;
     /**
      * «Run this one without the project's agent prompt.» Absent means no — both
@@ -234,6 +262,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentProtectedBranches?: string[] | undefined;
         agentAllowForcePush?: boolean | undefined;
         agentAllowDestructiveGit?: boolean | undefined;
+        agentAllowOutsideFolder?: boolean | undefined;
     };
     tickets: {
         number: number;
@@ -246,6 +275,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     } | undefined;
     workMode?: "DIRECT" | "BRANCH" | undefined;
     pausedUntil?: string | null | undefined;
+    backgroundTasks?: number | undefined;
     agentLatestVersion?: string | undefined;
     skipAgentPrompt?: boolean | undefined;
     branchHint?: string | undefined;
@@ -275,6 +305,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentProtectedBranches?: unknown;
         agentAllowForcePush?: unknown;
         agentAllowDestructiveGit?: unknown;
+        agentAllowOutsideFolder?: unknown;
     };
     tickets: {
         number: number;
@@ -295,6 +326,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     activeMsBase?: number | undefined;
     extraBudgetMinutes?: number | null | undefined;
     pausedUntil?: unknown;
+    backgroundTasks?: unknown;
     agentLatestVersion?: unknown;
     skipAgentPrompt?: unknown;
     branchHint?: unknown;
@@ -450,6 +482,20 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
          * behaviour every runner had before this release.
          */
         pausedUntil: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        /**
+         * Subagents the API still believes to be alive in this session (#393).
+         *
+         * The number is the dead process's last word, kept by the API: a runner
+         * restart takes every subagent with it, and the new process seeds its own
+         * count at zero — so the descriptor is the only place the number survives
+         * long enough to be written down. The API sends it only while it still
+         * believes it (its own trust window on the count's age); absent or zero
+         * means «nothing to say», and a restore says nothing.
+         *
+         * `.catch(undefined)` like its neighbours: one malformed value must cost
+         * its own session a line at most, never the frame (QA-100 MAJOR-1).
+         */
+        backgroundTasks: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
         /**
          * The newest published version of THIS session's agent — Р13, §4.8.
          *
@@ -517,6 +563,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
             agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            /**
+             * #418: may the agent read and write OUTSIDE the project folder?
+             *
+             * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above, and
+             * safe here for the same reason as `agentPushBan` — though the polarity
+             * runs the other way. `policy.ts` resolves this one with `=== true`, so a
+             * value this schema throws away leaves the session confined to its folder:
+             * strictly more restricted, never less. Rubbish in this field therefore
+             * costs a project its permission, which is the direction a dropped value is
+             * allowed to fail in.
+             */
+            agentAllowOutsideFolder: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             budgetUsd: z.ZodNullable<z.ZodNumber>;
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
@@ -532,6 +590,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         }, {
             path: string;
             id: string;
@@ -545,6 +604,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         }>;
         /**
          * «Run this one without the project's agent prompt.» Absent means no — both
@@ -652,6 +712,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -664,6 +725,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
         workMode?: "DIRECT" | "BRANCH" | undefined;
         pausedUntil?: string | null | undefined;
+        backgroundTasks?: number | undefined;
         agentLatestVersion?: string | undefined;
         skipAgentPrompt?: boolean | undefined;
         branchHint?: string | undefined;
@@ -693,6 +755,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         };
         tickets: {
             number: number;
@@ -713,6 +776,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase?: number | undefined;
         extraBudgetMinutes?: number | null | undefined;
         pausedUntil?: unknown;
+        backgroundTasks?: unknown;
         agentLatestVersion?: unknown;
         skipAgentPrompt?: unknown;
         branchHint?: unknown;
@@ -747,6 +811,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -759,6 +824,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
         workMode?: "DIRECT" | "BRANCH" | undefined;
         pausedUntil?: string | null | undefined;
+        backgroundTasks?: number | undefined;
         agentLatestVersion?: string | undefined;
         skipAgentPrompt?: boolean | undefined;
         branchHint?: string | undefined;
@@ -794,6 +860,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         };
         tickets: {
             number: number;
@@ -814,6 +881,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase?: number | undefined;
         extraBudgetMinutes?: number | null | undefined;
         pausedUntil?: unknown;
+        backgroundTasks?: unknown;
         agentLatestVersion?: unknown;
         skipAgentPrompt?: unknown;
         branchHint?: unknown;
@@ -883,6 +951,20 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
          * behaviour every runner had before this release.
          */
         pausedUntil: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        /**
+         * Subagents the API still believes to be alive in this session (#393).
+         *
+         * The number is the dead process's last word, kept by the API: a runner
+         * restart takes every subagent with it, and the new process seeds its own
+         * count at zero — so the descriptor is the only place the number survives
+         * long enough to be written down. The API sends it only while it still
+         * believes it (its own trust window on the count's age); absent or zero
+         * means «nothing to say», and a restore says nothing.
+         *
+         * `.catch(undefined)` like its neighbours: one malformed value must cost
+         * its own session a line at most, never the frame (QA-100 MAJOR-1).
+         */
+        backgroundTasks: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
         /**
          * The newest published version of THIS session's agent — Р13, §4.8.
          *
@@ -950,6 +1032,18 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
             agentAllowForcePush: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             agentAllowDestructiveGit: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+            /**
+             * #418: may the agent read and write OUTSIDE the project folder?
+             *
+             * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above, and
+             * safe here for the same reason as `agentPushBan` — though the polarity
+             * runs the other way. `policy.ts` resolves this one with `=== true`, so a
+             * value this schema throws away leaves the session confined to its folder:
+             * strictly more restricted, never less. Rubbish in this field therefore
+             * costs a project its permission, which is the direction a dropped value is
+             * allowed to fail in.
+             */
+            agentAllowOutsideFolder: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
             budgetUsd: z.ZodNullable<z.ZodNumber>;
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
@@ -965,6 +1059,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         }, {
             path: string;
             id: string;
@@ -978,6 +1073,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         }>;
         /**
          * «Run this one without the project's agent prompt.» Absent means no — both
@@ -1085,6 +1181,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -1097,6 +1194,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
         workMode?: "DIRECT" | "BRANCH" | undefined;
         pausedUntil?: string | null | undefined;
+        backgroundTasks?: number | undefined;
         agentLatestVersion?: string | undefined;
         skipAgentPrompt?: boolean | undefined;
         branchHint?: string | undefined;
@@ -1126,6 +1224,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         };
         tickets: {
             number: number;
@@ -1146,6 +1245,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase?: number | undefined;
         extraBudgetMinutes?: number | null | undefined;
         pausedUntil?: unknown;
+        backgroundTasks?: unknown;
         agentLatestVersion?: unknown;
         skipAgentPrompt?: unknown;
         branchHint?: unknown;
@@ -1180,6 +1280,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: string[] | undefined;
             agentAllowForcePush?: boolean | undefined;
             agentAllowDestructiveGit?: boolean | undefined;
+            agentAllowOutsideFolder?: boolean | undefined;
         };
         tickets: {
             number: number;
@@ -1192,6 +1293,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
         workMode?: "DIRECT" | "BRANCH" | undefined;
         pausedUntil?: string | null | undefined;
+        backgroundTasks?: number | undefined;
         agentLatestVersion?: string | undefined;
         skipAgentPrompt?: boolean | undefined;
         branchHint?: string | undefined;
@@ -1224,6 +1326,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentProtectedBranches?: unknown;
             agentAllowForcePush?: unknown;
             agentAllowDestructiveGit?: unknown;
+            agentAllowOutsideFolder?: unknown;
         };
         tickets: {
             number: number;
@@ -1244,6 +1347,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         activeMsBase?: number | undefined;
         extraBudgetMinutes?: number | null | undefined;
         pausedUntil?: unknown;
+        backgroundTasks?: unknown;
         agentLatestVersion?: unknown;
         skipAgentPrompt?: unknown;
         branchHint?: unknown;
@@ -1405,6 +1509,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     agentProtectedBranches: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     agentAllowForcePush: z.ZodOptional<z.ZodBoolean>;
     agentAllowDestructiveGit: z.ZodOptional<z.ZodBoolean>;
+    agentAllowOutsideFolder: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     type: "workspace_settings";
     workspaceId: string;
@@ -1414,6 +1519,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     agentProtectedBranches?: string[] | undefined;
     agentAllowForcePush?: boolean | undefined;
     agentAllowDestructiveGit?: boolean | undefined;
+    agentAllowOutsideFolder?: boolean | undefined;
 }, {
     type: "workspace_settings";
     workspaceId: string;
@@ -1423,6 +1529,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     agentProtectedBranches?: string[] | undefined;
     agentAllowForcePush?: boolean | undefined;
     agentAllowDestructiveGit?: boolean | undefined;
+    agentAllowOutsideFolder?: boolean | undefined;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"session_settings">;
     sessionId: z.ZodString;

package/dist/protocol.js

@@ -59,6 +59,20 @@ export const SessionDescriptorSchema = z.object({
      * behaviour every runner had before this release.
      */
     pausedUntil: z.string().max(40).nullable().optional().catch(undefined),
+    /**
+     * Subagents the API still believes to be alive in this session (#393).
+     *
+     * The number is the dead process's last word, kept by the API: a runner
+     * restart takes every subagent with it, and the new process seeds its own
+     * count at zero — so the descriptor is the only place the number survives
+     * long enough to be written down. The API sends it only while it still
+     * believes it (its own trust window on the count's age); absent or zero
+     * means «nothing to say», and a restore says nothing.
+     *
+     * `.catch(undefined)` like its neighbours: one malformed value must cost
+     * its own session a line at most, never the frame (QA-100 MAJOR-1).
+     */
+    backgroundTasks: z.number().int().min(0).optional().catch(undefined),
     /**
      * The newest published version of THIS session's agent — Р13, §4.8.
      *
@@ -137,6 +151,18 @@ export const SessionDescriptorSchema = z.object({
             .catch(undefined),
         agentAllowForcePush: z.boolean().optional().catch(undefined),
         agentAllowDestructiveGit: z.boolean().optional().catch(undefined),
+        /**
+         * #418: may the agent read and write OUTSIDE the project folder?
+         *
+         * `.optional().catch(undefined)` for the QA-100 MAJOR-1 reason above, and
+         * safe here for the same reason as `agentPushBan` — though the polarity
+         * runs the other way. `policy.ts` resolves this one with `=== true`, so a
+         * value this schema throws away leaves the session confined to its folder:
+         * strictly more restricted, never less. Rubbish in this field therefore
+         * costs a project its permission, which is the direction a dropped value is
+         * allowed to fail in.
+         */
+        agentAllowOutsideFolder: z.boolean().optional().catch(undefined),
         budgetUsd: z.number().nullable(),
         budgetMinutes: z.number().nullable(),
     }),
@@ -377,6 +403,9 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
             .optional(),
         agentAllowForcePush: z.boolean().optional(),
         agentAllowDestructiveGit: z.boolean().optional(),
+        // #418 — read on every file tool call, so it belongs in the live frame with
+        // its neighbours: switching it back off must not mean stopping the agent.
+        agentAllowOutsideFolder: z.boolean().optional(),
     }),
     z.object({
         type: z.literal('session_settings'),