@bridge4dev/runner 0.61.0 → 0.63.0

package/dist/git.js

@@ -94,6 +94,44 @@ export class WorktreePrepareError extends Error {
             this.baseSha = base.baseSha;
     }
 }
+/**
+ * A repository with no commits cannot hand out a copy of itself (#137).
+ *
+ * The mirror of `NO_COMMITS_YET_MESSAGE` in `@devbridge/shared`, which this
+ * package cannot import — it is published to npm on its own, and the import
+ * would make the tarball unresolvable (`recipe-schema.ts` explains it in full).
+ * Same arrangement as the level-event constants and the session limits: the
+ * text lives twice and a test pins the two copies together, because the API
+ * refuses this case before a session exists and the runner refuses it again if
+ * one ever gets that far — and the person must read one sentence, not two.
+ *
+ * `git.test.ts` compares this against the shared copy byte for byte.
+ */
+// #region no-commits-yet-mirror
+export const NO_COMMITS_YET_MESSAGE = 'This repository has no commits yet — start a session in the project folder itself; a branch of its own becomes possible after the first commit';
+export async function headState(workspacePath) {
+    const [symbolic, commit] = await Promise.all([
+        git(workspacePath, 'symbolic-ref', '--short', 'HEAD').catch(() => null),
+        // `--verify --quiet` is the whole point: an unborn HEAD is exit 1 and
+        // SILENCE here, where the plain form is exit 128 and three lines of git.
+        //
+        // And the exit code is read rather than caught away, the same way the
+        // branch probe in `looksHalfCreated` reads it and for the same reason:
+        // exit 1 is «there is no commit», while 128, a signal or a
+        // dubious-ownership fatal is git failing to LOOK. `unborn` authorises
+        // real things — it is what offers the project folder for work and what
+        // makes a restore point start from the empty tree — so «could not look»
+        // must never arrive here dressed as «no commits yet».
+        git(workspacePath, 'rev-parse', '--verify', '--quiet', 'HEAD').then((sha) => ({ sha, absent: false }), (error) => ({
+            sha: null,
+            absent: error.code === 1,
+        })),
+    ]);
+    const branch = symbolic ? symbolic.trim() : '';
+    if (!branch)
+        return { branch: null, unborn: false, detached: Boolean(commit.sha) };
+    return { branch, unborn: commit.absent, detached: false };
+}
 /**
  * Can this runner actually work in this directory — as the user it runs as?
  *
@@ -190,17 +228,27 @@ export async function validateWorkspacePath(workspacePath) {
                 `Give that user write access to the repository (for example \`chown -R ${me.user} ${workspacePath}\`), then try again.`,
         };
     }
-    const branch = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
+    // #137: read through `headState`, not `rev-parse --abbrev-ref HEAD`. The old
+    // call was the LAST thing this function did and the only one of six branch
+    // reads in this file left uncaught — so a directory with `git init` and no
+    // commit in it failed binding with git's manual page forwarded to a browser,
+    // after every real check above had already passed.
+    const head = await headState(workspacePath);
     // Binding is the one moment we are guaranteed to be looking at this repository
     // with somebody waiting for the answer, so it is where the main branch is
     // learned (ADR 0004). `branch` above is «what the folder is on right now» — a
     // drifting value, and the reason #361 exists; these two must not be confused.
+    //
+    // On a repository with no commits there is no branch to learn: nothing has
+    // been pushed anywhere and no conventional branch exists yet, so the binding's
+    // `main_branch` stays «not known yet» and learns itself later (ADR 0004).
     const defaultBranch = await remoteDefaultBranch(workspacePath);
     return {
         ok: true,
         exists: true,
         isGitRepo: true,
-        branch,
+        ...(head.branch ? { branch: head.branch } : {}),
+        ...(head.unborn ? { unborn: true } : {}),
         ...(defaultBranch ? { defaultBranch } : {}),
     };
 }
@@ -308,6 +356,18 @@ export function sanitizeBranch(hint) {
  * in the workspace repo, so the work survives worktree cleanup.
  */
 export async function ensureSessionWorktree(workspacePath, sessionId, branchHint, options = {}) {
+    // #137: a repository with no commits cannot have a copy of itself, and this
+    // is the only honest place to say so. Git refuses both halves of the
+    // arrangement — `worktree add -b x main|HEAD` is «invalid reference», and
+    // `merge --squash` into an unborn HEAD is «Squash commit into empty head not
+    // supported yet» — so a session started this way would be created, would
+    // fail here in git's own words, and, had it survived, could never be applied.
+    // The plan's decision (S3a) is to refuse early rather than to make the copy
+    // work: nobody makes the person's first commit for them.
+    const head = await headState(workspacePath);
+    if (head.unborn) {
+        throw new Error(NO_COMMITS_YET_MESSAGE);
+    }
     const short = sessionShortId(sessionId);
     // A ticket group gets a branch named after its tickets so the work reads as
     // one thing in git history. The worktree DIRECTORY stays id-derived — it is
@@ -743,16 +803,27 @@ export async function prepareDirectWorkspace(workspacePath) {
     if (inside !== 'true') {
         throw new Error(`${workspacePath} is not a git work tree`);
     }
-    const branch = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD').catch(() => null);
-    if (!branch || branch === 'HEAD') {
+    // #137: `rev-parse --abbrev-ref HEAD` answered the literal word `HEAD` for a
+    // detached checkout AND threw for a repository with no commits, so caught it
+    // collapsed both into the detached refusal below — and a folder sitting
+    // perfectly well on `main`, one `git init` old, was told to «check a branch
+    // out there», which it already had. `headState` tells the two apart.
+    const head = await headState(workspacePath);
+    if (!head.branch) {
         throw new Error('The project folder is not on a branch (detached HEAD) — check a branch out there before starting a session');
     }
     const top = await git(workspacePath, 'rev-parse', '--show-toplevel').catch(() => null);
-    const baseSha = await git(workspacePath, 'rev-parse', 'HEAD').catch(() => undefined);
+    // No commits yet means no fork point, and that is not a failure: DIRECT mode
+    // forks from nothing anyway — the session's workplace IS this folder and this
+    // branch. The field simply stays absent, which is what it already did for
+    // every other reason a base sha could be missing.
+    const baseSha = head.unborn
+        ? undefined
+        : await git(workspacePath, 'rev-parse', 'HEAD').catch(() => undefined);
     return {
-        branch,
+        branch: head.branch,
         worktreePath: top || workspacePath,
-        baseBranch: branch,
+        baseBranch: head.branch,
         ...(baseSha ? { baseSha } : {}),
     };
 }

package/dist/gitops.d.ts

@@ -1,3 +1,9 @@
+/**
+ * git's own name for «nothing», and the only thing a repository without a
+ * single commit can be diffed against. Constant in every git repository ever
+ * made — it is the SHA-1 of the empty tree object.
+ */
+export declare const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 export interface GitFileEntry {
     path: string;
     /** A | M | D | R (git name-status letter). */
@@ -324,6 +330,22 @@ export interface GitBranchesResult {
     branches: GitBranchEntry[];
     /** What the project folder is on right now. */
     currentBranch: string | null;
+    /**
+     * #137: `currentBranch` above is a branch with no commit on it yet, so it is
+     * in no list here — `for-each-ref refs/heads/` has nothing to list until the
+     * first commit exists. Without this field the API sees a branch name that is
+     * absent from the branches and refuses the session as «Branch main does not
+     * exist in this project»; with it, the folder is offered and a copy of its
+     * own is refused early and in words.
+     */
+    unborn: boolean;
+    /**
+     * #137: HEAD is a commit rather than a branch. `currentBranch` is null for
+     * this AND for «the runner could not read the folder», and the wizard has to
+     * tell them apart: one is fixed by checking a branch out, the other is not
+     * the person's to fix at all.
+     */
+    detached: boolean;
     currentSha: string | null;
     /**
      * The repository's own main branch (ADR 0004) — not the same question as
@@ -537,6 +559,13 @@ export declare function gitRefs(workspacePath: string): Promise<GitRefsResult>;
 export interface WorkspaceStateResult {
     /** The branch the project folder is on; null when HEAD is detached. */
     branch: string | null;
+    /**
+     * #137: that branch has no commit on it yet. `branch` is still its name and
+     * the folder is still perfectly workable — this is what stops every reader
+     * downstream from turning «no sha» into «detached HEAD», which is what the
+     * run's precondition and the session feed were both doing.
+     */
+    unborn: boolean;
     sha: string | null;
     subject: string;
     /** Committer date of that commit, ISO-8601. */

package/dist/gitops.js

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { firstConventionalBranch, remoteDefaultBranch, sanitizeBranch } from './git.js';
+import { firstConventionalBranch, headState, remoteDefaultBranch, sanitizeBranch } from './git.js';
 import { isSecretPath, maskString } from './policy.js';
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 30_000;
@@ -13,7 +13,7 @@ const DIFF_CAP_BYTES = 200_000;
  * single commit can be diffed against. Constant in every git repository ever
  * made — it is the SHA-1 of the empty tree object.
  */
-const EMPTY_TREE_SHA = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
+export const EMPTY_TREE_SHA = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 /**
  * Global git switches every call in this module needs.
  *
@@ -246,8 +246,21 @@ async function resolveBase(workspacePath, sessionBranch, pinnedBase) {
     return { ...(await guessBase(workspacePath, sessionBranch)), pinned: false, baseMissing: false };
 }
 async function guessBase(workspacePath, sessionBranch) {
-    const current = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
-    if (current !== sessionBranch && current !== 'HEAD') {
+    // #137: this read had no `.catch` at all, so on a repository with no commits
+    // git's own manual page («ambiguous argument 'HEAD'») travelled out of the
+    // runner, through the API and into a 409 toast. Every refusal that can be
+    // reached from a screen leaves here as a sentence somebody can act on.
+    const head = await headState(workspacePath);
+    // #137: NOT the branch-picker's sentence. That one says «start a session in
+    // the project folder itself», which is advice for somebody choosing where a
+    // session will work — and whoever reads THIS is already inside one, looking
+    // at a file list or a history tab. True but unactionable is the exact shape
+    // this ticket is about, so each place says the thing its own reader can do.
+    if (head.unborn) {
+        throw new Error('This repository has no commits yet, so there is nothing to compare this session against. Make the first commit and it will start working.');
+    }
+    const current = head.branch;
+    if (current && current !== sessionBranch) {
         return { baseBranch: current, baseRef: current };
     }
     // One list, one order, one place — the same helper the binding uses to learn
@@ -255,7 +268,9 @@ async function guessBase(workspacePath, sessionBranch) {
     const conventional = await firstConventionalBranch(workspacePath);
     if (conventional)
         return { baseBranch: conventional, baseRef: conventional };
-    throw new Error(`Cannot determine the base branch (workspace is on ${current})`);
+    throw new Error(current
+        ? `Cannot determine the base branch (the project folder is on ${current}, the session's own branch)`
+        : 'Cannot determine the base branch: the project folder is not on a branch (a detached HEAD) — check one out there');
 }
 /** How far apart two refs are, in one call: `[behind, ahead]`. */
 async function aheadBehind(cwd, baseRef, branchRef) {
@@ -1136,7 +1151,27 @@ async function applySessionImpl(input) {
             error: WORKSPACE_DIRTY_MESSAGE,
         };
     }
-    const workspaceBranch = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
+    // #137: read through `headState`. The bare call threw git's manual page into
+    // the «Apply» toast on a repository with no commits, and answered the literal
+    // word `HEAD` on a detached one — a value that then went on to be compared
+    // with a branch name and merged into.
+    const workspaceHead = await headState(workspacePath);
+    if (workspaceHead.unborn) {
+        // Its own sentence, for the same reason as `guessBase` above: whoever
+        // pressed «Apply» is not choosing where to work, and telling them to start
+        // a session in the project folder answers a question they did not ask.
+        return {
+            applied: false,
+            error: 'The project folder has no commits yet, and git cannot fold work into a branch that has none. Make the first commit there, then apply.',
+        };
+    }
+    const workspaceBranch = workspaceHead.branch;
+    if (!workspaceBranch) {
+        return {
+            applied: false,
+            error: 'The project folder is not on a branch (a detached HEAD), so there is nowhere to apply this to — check a branch out there first',
+        };
+    }
     if (workspaceBranch === sessionBranch) {
         return { applied: false, error: 'The workspace is checked out on the session branch itself' };
     }
@@ -1156,6 +1191,7 @@ async function applySessionImpl(input) {
         await git(worktreePath, 'commit', '-m', 'chore(devbridge): session changes before apply');
     }
     const branchSha = await git(workspacePath, 'rev-parse', sessionBranch);
+    // Safe unconditionally now: an unborn HEAD left through the refusal above.
     const baseShaBefore = await git(workspacePath, 'rev-parse', 'HEAD');
     // Captured BEFORE anything is written, so a failed merge can tell its own
     // leftovers from somebody's work that appeared meanwhile.
@@ -1339,10 +1375,15 @@ const MAX_BRANCHES = 200;
  * not after the worktree command fails.
  */
 export async function gitBranches(workspacePath) {
-    const [rawBranches, rawWorktrees, currentBranch, remotesRaw] = await Promise.all([
+    const [rawBranches, rawWorktrees, head, remotesRaw] = await Promise.all([
         git(workspacePath, 'for-each-ref', `--count=${MAX_BRANCHES + 1}`, '--sort=-committerdate', '--format=%(refname:short)%00%(objectname)%00%(committerdate:iso-strict)%00%(subject)', 'refs/heads/'),
         git(workspacePath, 'worktree', 'list', '--porcelain').catch(() => ''),
-        git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD').catch(() => null),
+        // #137: through `headState`, not `rev-parse --abbrev-ref HEAD`. Caught, that
+        // call answered `null` for a folder one `git init` old and the literal word
+        // `HEAD` for a detached one — so the wizard could not tell a repository
+        // waiting for its first commit from a checkout nobody should commit into,
+        // and greyed out «In the project folder» for both.
+        headState(workspacePath),
         git(workspacePath, 'remote').catch(() => ''),
     ]);
     // `worktree list --porcelain` emits stanzas: `worktree <path>` … `branch <ref>`.
@@ -1380,8 +1421,12 @@ export async function gitBranches(workspacePath) {
         branch.merged = mergedSet.has(branch.name);
     return {
         branches,
-        currentBranch: currentBranch === 'HEAD' ? null : currentBranch,
-        currentSha: await git(workspacePath, 'rev-parse', 'HEAD').catch(() => null),
+        currentBranch: head.branch,
+        unborn: head.unborn,
+        detached: head.detached,
+        currentSha: head.unborn
+            ? null
+            : await git(workspacePath, 'rev-parse', 'HEAD').catch(() => null),
         defaultBranch: await remoteDefaultBranch(workspacePath).catch(() => null),
         remotes: remotesRaw.split('\n').filter(Boolean).slice(0, 20),
         truncated,
@@ -1886,11 +1931,16 @@ const MAX_REFS = 500;
  * short name.
  */
 export async function gitRefs(workspacePath) {
-    const [raw, rawWorktrees, currentBranch, currentSha, remotesRaw] = await Promise.all([
+    const [raw, rawWorktrees, head, currentSha, remotesRaw] = await Promise.all([
         git(workspacePath, 'for-each-ref', `--count=${MAX_REFS + 1}`, '--sort=-committerdate', '--format=%(refname)%00%(objectname)%00%(committerdate:iso-strict)%00%(upstream:short)%00%(subject)', 'refs/heads', 'refs/remotes', 'refs/tags'),
         git(workspacePath, 'worktree', 'list', '--porcelain').catch(() => ''),
-        git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD').catch(() => null),
-        git(workspacePath, 'rev-parse', 'HEAD').catch(() => null),
+        // #137: the fifth reader of the same question, and the one left behind by
+        // the first pass. Caught, so no raw git escapes — but it answered «no
+        // branch» for a folder the wizard, the run's precondition and the session
+        // feed all report as standing on `main`, and one screen disagreeing with
+        // three about the same folder is how this class of bug starts again.
+        headState(workspacePath),
+        git(workspacePath, 'rev-parse', '--verify', '--quiet', 'HEAD').catch(() => null),
         git(workspacePath, 'remote').catch(() => ''),
     ]);
     const checkedOut = new Map();
@@ -1925,7 +1975,7 @@ export async function gitRefs(workspacePath) {
         refs.push({
             name: name.slice(0, 200),
             type,
-            isHead: type === 'head' && name === currentBranch,
+            isHead: type === 'head' && name === head.branch,
             sha,
             subject: maskString(subjectParts.join('\0')).slice(0, 300),
             date: (date ?? '').slice(0, 40),
@@ -1935,7 +1985,7 @@ export async function gitRefs(workspacePath) {
     }
     return {
         refs,
-        currentBranch: currentBranch === 'HEAD' ? null : currentBranch,
+        currentBranch: head.branch,
         currentSha,
         remotes: remotesRaw.split('\n').filter(Boolean).slice(0, 20),
         truncated,
@@ -1949,21 +1999,26 @@ export async function gitRefs(workspacePath) {
  * question behind «how do I know docker was not rebuilt». Read-only.
  */
 export async function workspaceState(workspacePath) {
-    const [branchRaw, sha, porcelain, upstreamRaw, remotesRaw, meta] = await Promise.all([
-        git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD').catch(() => null),
-        git(workspacePath, 'rev-parse', 'HEAD').catch(() => null),
+    const [head, sha, porcelain, upstreamRaw, remotesRaw, meta] = await Promise.all([
+        // #137: `rev-parse --abbrev-ref HEAD` could not tell «no commits yet» from
+        // «detached HEAD» — both arrived here as `null` — and this value is what the
+        // run's precondition reads, so a fresh `git init` was refused with a
+        // sentence about checking a branch out that it could not act on.
+        headState(workspacePath),
+        git(workspacePath, 'rev-parse', '--verify', '--quiet', 'HEAD').catch(() => null),
         git(workspacePath, 'status', '--porcelain').catch(() => ''),
         git(workspacePath, 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}').catch(() => null),
         git(workspacePath, 'remote').catch(() => ''),
         git(workspacePath, 'log', '-1', '--format=%s%x00%cI', 'HEAD', '--').catch(() => ''),
     ]);
-    const branch = branchRaw === 'HEAD' ? null : branchRaw;
+    const branch = head.branch;
     const upstream = upstreamRaw ? sanitizeBranch(upstreamRaw) : null;
     const distance = upstream ? await aheadBehind(workspacePath, upstream, 'HEAD') : null;
     const [subject, date] = meta.split('\0');
     const dirtyLines = porcelain.split('\n').filter(Boolean);
     return {
         branch,
+        unborn: head.unborn,
         sha,
         subject: maskString(subject ?? '').slice(0, SUBJECT_CAP),
         date: (date ?? '').slice(0, 40),

package/dist/index.js

@@ -381,6 +381,31 @@ function runnerCapabilities(apiUrlOverride) {
          * been handed a worse problem.
          */
         agentGitPolicy: true,
+        /**
+         * #418: «the agent may work outside the project folder» is a setting of the
+         * project, and this runner honours it.
+         *
+         * Its own flag rather than a second meaning for `agentGitPolicy`: the two
+         * ship a release apart, and a server on 0.61.x announces the git policy
+         * perfectly honestly while ignoring this field completely. Announced so the
+         * settings card can say so — warn, not refuse, for the same reason as the
+         * git policy: a manager must be able to record the decision before the last
+         * machine in the fleet is up to date.
+         */
+        agentOutsideFolder: true,
+        /**
+         * #137: this runner can read a repository that has no commits yet.
+         *
+         * Announced for one reason, and it is a message rather than a refusal: when
+         * an OLDER runner meets that repository it answers with git's own manual
+         * page, and the API turns anything it cannot parse into «run `git status`
+         * on that server and see». For this particular case that advice is a dead
+         * end — `git status` there prints «On branch main / No commits yet», which
+         * looks perfectly healthy, and the person is none the wiser. With this flag
+         * the API can say the true thing instead: the runner on that machine is too
+         * old for this, update it.
+         */
+        unbornHead: true,
         /**
          * Session 16: git is git.
          *

package/dist/policy.d.ts

@@ -40,6 +40,33 @@ export interface AgentGitPolicy {
     agentAllowForcePush?: boolean;
     /** `git reset --hard` and `git clean`. `undefined` and `false` mean no. */
     agentAllowDestructiveGit?: boolean;
+    /**
+     * #418: may the agent read and write OUTSIDE the folder this session works
+     * in — other projects on the same machine included?
+     *
+     * READ AS `=== true`. `undefined` means an API too old to send the field, or
+     * a value the protocol schema threw away, and there the answer must be what
+     * it has always been: confined to the folder. The same direction as
+     * `agentAllowForcePush` two fields up, the opposite of `agentPushBan` at the
+     * top — one names a permission, the other names a ban, and silence refuses
+     * in both readings (gotcha 193).
+     *
+     * **Not a git setting, and it lives in a git-named object on purpose.** The
+     * whole delivery pipe for the project's per-agent policy already exists —
+     * descriptor → `gitPolicyOf` → `SessionSpec` → `policyContextFor` →
+     * `PolicyContext`, with `workspace_settings` for a live change — and it moves
+     * this object WHOLE at every hop. A field of its own beside it would have
+     * been a second branch in the supervisor, a second one in the live frame and
+     * a second chance to forget one of them (plan R8). The name is the price;
+     * this comment is the receipt.
+     *
+     * What it does NOT lift: `isSecretPath`, `isGitInternalPath`,
+     * `ctx.agentPromptFile`, `DENIED_COMMAND_PATTERNS`, `SECRET_COMMAND_PATTERNS`,
+     * the git policy above, the auto-commit refusal and the heap ceiling. It
+     * lifts exactly one rule — «this path is not inside the folder» — and leaves
+     * every other reason to refuse standing.
+     */
+    agentAllowOutsideFolder?: boolean;
 }
 export interface PolicyContext extends AgentGitPolicy {
     trustMode: TrustMode;

package/dist/policy.js

@@ -11,6 +11,8 @@ function resolveGitPolicy(ctx) {
         protectedBranches: ctx.agentProtectedBranches ?? DEFAULT_PROTECTED_BRANCHES,
         allowForcePush: ctx.agentAllowForcePush === true,
         allowDestructiveGit: ctx.agentAllowDestructiveGit === true,
+        // `=== true`: silence keeps the agent in its folder (#418).
+        allowOutsideFolder: ctx.agentAllowOutsideFolder === true,
     };
 }
 // ─── Secret masking (plan §8.7) ──────────────────────────────────────
@@ -1309,6 +1311,18 @@ export function evaluateToolUse(toolName, input, ctx) {
     if (READ_TOOLS.has(toolName) || WRITE_TOOLS.has(toolName)) {
         const rawPath = String(input['file_path'] ?? input['path'] ?? input['notebook_path'] ?? '');
         const resolved = rawPath ? normalize(rawPath, ctx.worktreePath) : ctx.worktreePath;
+        /**
+         * #418: this project answered «yes» to «may the agent work outside the
+         * project folder», so «not inside the folder» stops being a reason on its
+         * own. Resolved through `resolveGitPolicy` rather than read off `ctx` here,
+         * because that function is the one place in this file where an absent field
+         * is given its safe meaning — and «unknown» here has to mean «stay in».
+         *
+         * It moves exactly one rule out of the way. Everything checked above and
+         * below this line — secret paths, `.git` internals, the session's own
+         * prompt file — is checked in the same order and refuses the same things.
+         */
+        const outsideAllowed = resolveGitPolicy(ctx).allowOutsideFolder;
         if (isSecretPath(resolved)) {
             return { decision: 'deny', reason: 'protected secret path' };
         }
@@ -1328,7 +1342,9 @@ export function evaluateToolUse(toolName, input, ctx) {
                 reason: 'writing inside .git is not allowed — a hook or a config entry is code git runs on its own, past every rule here',
             };
         }
-        if (WRITE_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
+        if (WRITE_TOOLS.has(toolName) &&
+            !outsideAllowed &&
+            !isInsideWorktree(resolved, ctx.worktreePath)) {
             return { decision: 'deny', reason: 'writes outside the session worktree are not allowed' };
         }
         // The project's own prompt file — the same rule as `.git` above, for the
@@ -1344,10 +1360,27 @@ export function evaluateToolUse(toolName, input, ctx) {
         }
         if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
-        if (READ_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
-            return trust === 'AUTO'
-                ? { decision: 'allow', reason: 'auto mode' }
-                : { decision: 'ask', reason: 'read outside the worktree' };
+        if (!isInsideWorktree(resolved, ctx.worktreePath)) {
+            /**
+             * #418. Below STRICT — which asked one line up and goes on asking, which
+             * is the whole of «Strict still asks» — a path outside the folder is now
+             * an ORDINARY path for a project that allowed it: no card, no refusal,
+             * and the same answer for a read and for a write.
+             *
+             * Its own reason string rather than falling through to «inside worktree»
+             * below: that sentence goes to the log, and about a file in another
+             * folder it would simply be false.
+             */
+            if (outsideAllowed) {
+                return { decision: 'allow', reason: 'outside the project folder, allowed by this project' };
+            }
+            // Reads only: a write outside was refused above unless the project
+            // allowed it, so nothing else reaches this line.
+            if (READ_TOOLS.has(toolName)) {
+                return trust === 'AUTO'
+                    ? { decision: 'allow', reason: 'auto mode' }
+                    : { decision: 'ask', reason: 'read outside the worktree' };
+            }
         }
         return { decision: 'allow', reason: 'inside worktree' };
     }