@bridge4dev/runner 0.63.0 → 0.64.1

package/dist/checkpoints.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
+import { cleanGitEnv } from './environment.js';
 import { checkpointsDir } from './paths.js';
 import { EMPTY_TREE_SHA } from './gitops.js';
 import { isSecretPath } from './policy.js';
@@ -90,7 +91,7 @@ async function gitIn(cwd, ...args) {
         // The project's own environment must not leak in: a GIT_INDEX_FILE or
         // GIT_DIR inherited from a parent process would silently retarget every
         // command below at the wrong repository.
-        env: cleanEnv(),
+        env: cleanGitEnv(),
     });
     return stdout.replace(/\n$/, '');
 }
@@ -107,7 +108,7 @@ async function gitStore(store, worktreePath, indexFile, ...args) {
         timeout: GIT_TIMEOUT_MS,
         maxBuffer: 32 * 1024 * 1024,
         env: {
-            ...cleanEnv(),
+            ...cleanGitEnv(),
             GIT_DIR: store,
             GIT_WORK_TREE: worktreePath,
             GIT_INDEX_FILE: indexFile,
@@ -119,22 +120,13 @@ async function gitStore(store, worktreePath, indexFile, ...args) {
     });
     return stdout.replace(/\n$/, '');
 }
-function cleanEnv() {
-    const env = { ...process.env };
-    delete env['GIT_DIR'];
-    delete env['GIT_WORK_TREE'];
-    delete env['GIT_INDEX_FILE'];
-    delete env['GIT_OBJECT_DIRECTORY'];
-    delete env['GIT_ALTERNATE_OBJECT_DIRECTORIES'];
-    return env;
-}
 async function ensureStore(worktreePath) {
     const { store, objectDir } = await storeFor(worktreePath);
     if (!fs.existsSync(store)) {
         fs.mkdirSync(path.dirname(store), { recursive: true, mode: 0o700 });
         await execFileAsync('git', ['init', '--quiet', '--bare', store], {
             timeout: GIT_TIMEOUT_MS,
-            env: cleanEnv(),
+            env: cleanGitEnv(),
         });
         fs.chmodSync(store, 0o700);
     }
@@ -326,7 +318,7 @@ async function gitRefs(store, ...args) {
     const { stdout } = await execFileAsync('git', [...GIT_GLOBAL_ARGS, '--git-dir', store, ...args], {
         timeout: GIT_TIMEOUT_MS,
         maxBuffer: 32 * 1024 * 1024,
-        env: cleanEnv(),
+        env: cleanGitEnv(),
     });
     return stdout.replace(/\n$/, '');
 }

package/dist/environment.d.ts

@@ -20,6 +20,21 @@ export interface RunnerIdentity {
     isRoot: boolean;
 }
 export declare function runnerIdentity(): RunnerIdentity;
+/**
+ * The environment git must be run in, with the caller's own repository scrubbed
+ * out of it.
+ *
+ * A `GIT_DIR` or `GIT_INDEX_FILE` inherited from a parent process silently
+ * retargets every git command at a DIFFERENT repository — the runner is started
+ * by systemd, but a session's agent is not, and neither is a test. The restore
+ * points have run this way since #126; #417 needs the same guarantee for a much
+ * blunter reason: `git init` under an inherited `GIT_DIR` initialises somewhere
+ * else entirely and reports success.
+ *
+ * Here rather than in `checkpoints.ts`, where it was written, because it is now
+ * the answer to «how does this package run git» and has two callers.
+ */
+export declare function cleanGitEnv(): NodeJS.ProcessEnv;
 export interface PathAccess {
     path: string;
     exists: boolean;

package/dist/environment.js

@@ -19,6 +19,29 @@ export function runnerIdentity() {
     }
     return { user, uid, gid, home: os.homedir(), isRoot: uid === 0 };
 }
+/**
+ * The environment git must be run in, with the caller's own repository scrubbed
+ * out of it.
+ *
+ * A `GIT_DIR` or `GIT_INDEX_FILE` inherited from a parent process silently
+ * retargets every git command at a DIFFERENT repository — the runner is started
+ * by systemd, but a session's agent is not, and neither is a test. The restore
+ * points have run this way since #126; #417 needs the same guarantee for a much
+ * blunter reason: `git init` under an inherited `GIT_DIR` initialises somewhere
+ * else entirely and reports success.
+ *
+ * Here rather than in `checkpoints.ts`, where it was written, because it is now
+ * the answer to «how does this package run git» and has two callers.
+ */
+export function cleanGitEnv() {
+    const env = { ...process.env };
+    delete env['GIT_DIR'];
+    delete env['GIT_WORK_TREE'];
+    delete env['GIT_INDEX_FILE'];
+    delete env['GIT_OBJECT_DIRECTORY'];
+    delete env['GIT_ALTERNATE_OBJECT_DIRECTORIES'];
+    return env;
+}
 /** As root every access check passes, which is true and worth saying out loud. */
 function canAccess(target, mode) {
     try {

package/dist/git.d.ts

@@ -106,6 +106,42 @@ export interface PathValidation {
  * '/opt/ids'». That sentence is true and unactionable.
  */
 export declare function validateWorkspacePath(workspacePath: string): Promise<PathValidation>;
+/**
+ * What became of «create this folder and put git in it» (#417).
+ *
+ * `created` and `exists` are separate answers on purpose: a folder that was
+ * already there is not a failure — the wizard simply goes on and binds it —
+ * while `created: false, exists: false` is never a success.
+ */
+export interface ProjectDirInit {
+    ok: boolean;
+    /** This call made the directory. */
+    created: boolean;
+    /** There was already a directory at this path when we looked. */
+    exists: boolean;
+    /** The branch the new repository is on, read back rather than assumed. */
+    branch?: string;
+    error?: string;
+}
+/**
+ * Create the project folder and initialise git in it, from the binding window
+ * (#417).
+ *
+ * Two things and no more: ONE directory — the last segment of the path, never a
+ * chain of parents — and `git init` with `main` as the branch. No first commit:
+ * an empty repository is a legitimate state (#137, and the runner has known how
+ * to work in one since 0.63.0), while an «Initial commit» nobody asked for is
+ * the thing that makes `git pull` from an existing remote refuse with
+ * «unrelated histories» later on.
+ *
+ * Its own refusal list, because `validateWorkspacePath` has none to share: that
+ * function asks «can the runner work here», which is a question about
+ * permissions, and every answer it gives is about reaching, reading and writing.
+ * «Should anything be created here at all» is a different question and this is
+ * the only place that asks it. The API cannot ask it either — it sees the
+ * runner's verdict and nothing of the machine — so the list lives here.
+ */
+export declare function initProjectDir(target: string): Promise<ProjectDirInit>;
 /**
  * The repository's main branch, read locally (ADR 0004).
  *

package/dist/git.js

@@ -2,8 +2,10 @@ import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { previewsDir, worktreesDir } from './paths.js';
-import { firstUnreachableAncestor, inspectPath, looksLikeDubiousOwnership, runnerIdentity, safeDirectoryCommand, } from './environment.js';
+import { previewsDir, stateDir, worktreesDir } from './paths.js';
+import { cleanGitEnv, firstUnreachableAncestor, inspectPath, looksLikeDubiousOwnership, runnerIdentity, safeDirectoryCommand, } from './environment.js';
+import { isGitInternalPath, isInsideWorktree, isSecretPath } from './policy.js';
+import { log } from './log.js';
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 30_000;
 /**
@@ -14,12 +16,27 @@ const GIT_TIMEOUT_MS = 30_000;
  * Ninety seconds is the owner's number (plan §9, 06.09.2026).
  */
 const WORKTREE_ADD_TIMEOUT_MS = 90_000;
+/**
+ * Every git call in this file names its repository with `cwd` and nothing else,
+ * so an inherited `GIT_DIR` (or index, or object store) can only ever point
+ * somewhere we did not mean — see `cleanGitEnv`. Free everywhere; load-bearing
+ * in `initProjectDir`, where `git init` under an inherited `GIT_DIR` would
+ * initialise a different directory and report success (#417).
+ */
 async function git(cwd, ...args) {
-    const { stdout } = await execFileAsync('git', args, { cwd, timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await execFileAsync('git', args, {
+        cwd,
+        timeout: GIT_TIMEOUT_MS,
+        env: cleanGitEnv(),
+    });
     return stdout.trim();
 }
 async function gitSlow(cwd, timeoutMs, ...args) {
-    const { stdout } = await execFileAsync('git', args, { cwd, timeout: timeoutMs });
+    const { stdout } = await execFileAsync('git', args, {
+        cwd,
+        timeout: timeoutMs,
+        env: cleanGitEnv(),
+    });
     return stdout.trim();
 }
 /**
@@ -252,6 +269,311 @@ export async function validateWorkspacePath(workspacePath) {
         ...(defaultBranch ? { defaultBranch } : {}),
     };
 }
+/**
+ * The branch a repository created from the binding window starts on (#417).
+ *
+ * One name, here, because two calls ask for it — `git init --initial-branch`
+ * and the `symbolic-ref` that stands in for it on a git older than 2.28 — and a
+ * folder that came out on `master` because the two disagreed would be a bug
+ * nobody sees until a push.
+ */
+const INITIAL_BRANCH = 'main';
+/**
+ * Directories a project folder is never created inside (#417).
+ *
+ * The root itself and the trees a Linux system is assembled from. Deliberately
+ * a short, literal list rather than a clever rule: everything here is a place
+ * where `mkdir` succeeding is worse than it failing, and a person who typed one
+ * of them meant something else. `/opt`, `/srv`, `/home`, `/var/www` are NOT on
+ * it — those are exactly where projects live.
+ *
+ * `/usr/local` and friends are covered by their parents: the test is «is this
+ * path at or below one of these».
+ */
+const SYSTEM_DIRECTORIES = [
+    '/etc',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib32',
+    '/lib64',
+    '/libx32',
+    '/boot',
+    '/proc',
+    '/sys',
+    '/dev',
+    '/run',
+];
+function refuseInit(error) {
+    return { ok: false, created: false, exists: false, error };
+}
+/**
+ * Why this path may not be created, or `null` — asked of a STRING (#417).
+ *
+ * Pulled out of `initProjectDir` because it has to be asked twice: once about
+ * what the person typed, and again about where that path really lands once the
+ * filesystem has had its say. See `realLandingPlace`.
+ */
+function pathClassRefusal(candidate) {
+    if (isGitInternalPath(candidate)) {
+        return `${candidate} is inside a .git directory, which belongs to git itself — pick a folder for the project instead`;
+    }
+    if (candidate === path.sep || SYSTEM_DIRECTORIES.some((dir) => isAtOrBelow(candidate, dir))) {
+        return `${candidate} is a system directory on this server — pick a folder for the project instead`;
+    }
+    // Said separately from the line above, because it would not be true there:
+    // `~/.ssh` is not a system directory, and a refusal that misnames what it is
+    // refusing teaches the person the wrong thing about their own machine.
+    if (isSecretPath(candidate)) {
+        return `${candidate} is on this server's protected list — pick a folder for the project instead`;
+    }
+    // `isSecretPath` cannot answer this one: the runner tree is on its list, but
+    // `worktrees/` and `previews/` are excused from it so an agent can read its
+    // own workspace. Everything under the state directory is the runner's own
+    // bookkeeping either way, and a project living inside it would be rewritten by
+    // the next session cleanup. Both sides go through the real filesystem, because
+    // `stateDir()` is built from `os.homedir()` and a symlinked home would
+    // otherwise make the two paths look unrelated.
+    const state = realPathOf(stateDir());
+    if (isAtOrBelow(candidate, state)) {
+        return `${candidate} is inside the runner's own state directory — pick a folder for the project instead`;
+    }
+    return null;
+}
+/** `realpathSync` where it works, the path itself where it does not. */
+function realPathOf(target) {
+    try {
+        return fs.realpathSync(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+/**
+ * Where `mkdir` would actually land, symlinks and all (#417).
+ *
+ * Every refusal above is string work — `path.resolve` does not follow symlinks,
+ * `isSecretPath` normalises nothing, and containment is `path.relative`. The
+ * kernel disagrees: on a stock Debian `/var/run` IS `/run`, so `/var/run/shop`
+ * passes a list that exists to refuse exactly that, and the repository ends up
+ * on tmpfs and is gone at the next reboot.
+ *
+ * `policy.ts` solves the same problem in `normalize()` by resolving the parent
+ * and putting the last segment back on. That is not enough here, because this
+ * is asked BEFORE anything about the parent is known: with `/tmp/link -> /etc`
+ * and the path `/tmp/link/new/project`, the parent does not exist, its
+ * `realpath` fails, and the fallback is the unresolved string — which would then
+ * earn the advice «create /tmp/link/new first», i.e. make a folder in `/etc`. So
+ * the walk goes up to the deepest ancestor that DOES exist, resolves that, and
+ * puts every missing segment back on.
+ */
+function realLandingPlace(resolved) {
+    const missing = [];
+    let existing = resolved;
+    for (;;) {
+        try {
+            const real = fs.realpathSync(existing);
+            return path.join(real, ...missing.reverse());
+        }
+        catch {
+            const up = path.dirname(existing);
+            if (up === existing)
+                return resolved;
+            missing.push(path.basename(existing));
+            existing = up;
+        }
+    }
+}
+/**
+ * Is `target` at or below `root`?
+ *
+ * `isInsideWorktree` is the containment helper this package already has, and it
+ * answers exactly this question — the name says worktree because that was its
+ * first caller, not because it knows anything about worktrees.
+ */
+function isAtOrBelow(target, root) {
+    return isInsideWorktree(target, root);
+}
+/**
+ * Create the project folder and initialise git in it, from the binding window
+ * (#417).
+ *
+ * Two things and no more: ONE directory — the last segment of the path, never a
+ * chain of parents — and `git init` with `main` as the branch. No first commit:
+ * an empty repository is a legitimate state (#137, and the runner has known how
+ * to work in one since 0.63.0), while an «Initial commit» nobody asked for is
+ * the thing that makes `git pull` from an existing remote refuse with
+ * «unrelated histories» later on.
+ *
+ * Its own refusal list, because `validateWorkspacePath` has none to share: that
+ * function asks «can the runner work here», which is a question about
+ * permissions, and every answer it gives is about reaching, reading and writing.
+ * «Should anything be created here at all» is a different question and this is
+ * the only place that asks it. The API cannot ask it either — it sees the
+ * runner's verdict and nothing of the machine — so the list lives here.
+ */
+export async function initProjectDir(target) {
+    const me = runnerIdentity();
+    // The same rule the API's `WorkspacePathSchema` applies, re-derived here: the
+    // runner is the process that actually calls `mkdir`, and it must not trust the
+    // wire (QA-99 MAJOR-4 is the same argument for `validate_path`).
+    if (!target.startsWith('/') || target.split('/').includes('..')) {
+        return refuseInit('The project folder must be an absolute path with no ".." segments');
+    }
+    const resolved = path.resolve(target);
+    // The cheap pass, on what the person typed: nothing touches the disk for a
+    // path that is obviously not a project folder.
+    const typedRefusal = pathClassRefusal(resolved);
+    if (typedRefusal)
+        return refuseInit(typedRefusal);
+    // The second pass, and the one that decides: where would `mkdir` LAND? A
+    // symlinked ancestor otherwise walks straight through every refusal above,
+    // and `/var/run/shop` on a stock Debian is not a hypothetical: that directory
+    // IS `/run`, and the repository would sit on tmpfs until the next reboot.
+    //
+    // Asked BEFORE any permission check, and that order is the point (the 0.64.0
+    // build had it the other way round and was never published): for a runner that is
+    // not root, `/tmp/link -> /etc` failed «can the runner write to the parent»
+    // first — and the refusal then advised `chown <runner> /tmp/link`, which is
+    // `chown` on `/etc`. «This is a system directory» must win over «grant
+    // yourself access to it».
+    const landing = realLandingPlace(resolved);
+    if (landing !== resolved) {
+        const realRefusal = pathClassRefusal(landing);
+        // Both paths named, in that order: the person recognises what they typed,
+        // and then learns where it actually goes — which is the fact they have to
+        // act on.
+        if (realRefusal)
+            return refuseInit(`${resolved} leads to ${realRefusal}`);
+    }
+    const here = inspectPath(resolved);
+    if (here.unreachable) {
+        const blocked = firstUnreachableAncestor(resolved) ?? resolved;
+        return refuseInit(`The runner runs as ${me.user} and is not allowed into ${blocked}, so it cannot create ${resolved}. ` +
+            `Grant that user access to the directory (for example \`chmod o+x ${blocked}\`, ` +
+            `or \`setfacl -m u:${me.user}:x ${blocked}\`), then try again.`);
+    }
+    if (here.exists) {
+        // Not a refusal, and deliberately not a `mkdir` either: a directory that is
+        // already there is the ordinary case of pressing the button twice, and the
+        // window's next move — bind it — is the right one.
+        if (here.isDirectory)
+            return { ok: true, created: false, exists: true };
+        return refuseInit(`${resolved} already exists and is not a directory`);
+    }
+    const parent = path.dirname(resolved);
+    const above = inspectPath(parent);
+    if (above.unreachable) {
+        const blocked = firstUnreachableAncestor(parent) ?? parent;
+        return refuseInit(`The runner runs as ${me.user} and is not allowed into ${blocked}, so it cannot create ${resolved}. ` +
+            `Grant that user access to the directory (for example \`chmod o+x ${blocked}\`, ` +
+            `or \`setfacl -m u:${me.user}:x ${blocked}\`), then try again.`);
+    }
+    if (!above.exists || !above.isDirectory) {
+        return refuseInit(`${parent} does not exist on this server, and the runner creates only the last folder of the path. ` +
+            `Create ${parent} there first (\`mkdir -p ${parent}\` as a user who may write to it), then try again.`);
+    }
+    if (!above.writable) {
+        return refuseInit(`The runner runs as ${me.user} and cannot write to ${parent}, so it cannot create ${resolved} there. ` +
+            `Give that user write access (for example \`setfacl -m u:${me.user}:rwx ${parent}\`, ` +
+            `or \`chown ${me.user} ${parent}\` if the directory is meant to be theirs), then try again.`);
+    }
+    try {
+        // Deliberately NOT `recursive: true`: the chain of parents is somebody
+        // else's decision about the layout of their machine, and a button that
+        // quietly makes `/opt/a/b/c` out of a typo is worse than one that says the
+        // folder above is missing.
+        fs.mkdirSync(resolved);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'EEXIST') {
+            // Somebody else got there between `inspectPath` and here — or the name was
+            // never free at all: `mkdir(2)` answers EEXIST for ANY existing name, and
+            // a dangling symlink is invisible to the `statSync` above, which follows
+            // it and reports «not there». Look again rather than assume: «a directory
+            // is there» is what the window binds on next.
+            const now = inspectPath(resolved);
+            if (now.exists && now.isDirectory)
+                return { ok: true, created: false, exists: true };
+            return refuseInit(`${resolved} already exists and is not a directory`);
+        }
+        return refuseInit(`The runner runs as ${me.user} and could not create ${resolved} (${code ?? 'unknown error'}). ` +
+            `Check that ${parent} is writable by that user, then try again.`);
+    }
+    try {
+        await initRepositoryOnMain(resolved);
+    }
+    catch (error) {
+        // All-or-nothing, like laying out a worktree (#360): a folder that exists
+        // but is not a repository binds and then fails on «Not a git work tree»,
+        // which is a worse place to learn about it. `rmdirSync` refuses a directory
+        // with anything in it, which is exactly the safety wanted here — we are only
+        // ever removing the empty one made three lines up.
+        let takenBack = true;
+        try {
+            fs.rmdirSync(resolved);
+        }
+        catch {
+            // It is not empty, so it is not only ours to remove. Leave it — and say
+            // so, because the two outcomes want opposite things from the person.
+            takenBack = false;
+        }
+        // Git's own words go to the runner's log, where the person who can act on
+        // them is; the sentence that travels names the folder and what to do next.
+        // `describeGitFailure` would have carried `fatal: …` into a browser, and
+        // the API's net for that (`actionableRunnerRefusal`) rewrites the WHOLE
+        // text — so forwarding it would have cost this sentence as well.
+        log.warn('init_project_dir: git init failed', {
+            path: resolved,
+            takenBack,
+            error: describeGitFailure(error),
+        });
+        const said = takenBack
+            ? `Git would not start in ${resolved}, so the folder was removed again and nothing was left behind. ` +
+                `The runner's log on this server has git's own words — check that git is installed and that the disk is writable, then try again.`
+            : `${resolved} was created, but git would not start in it, and the folder is still there. ` +
+                `The runner's log on this server has git's own words. Run \`git init -b main\` in that folder yourself, or remove it and try again.`;
+        return { ok: false, created: !takenBack, exists: !takenBack, error: said };
+    }
+    // Read back rather than reported from intent: on a git old enough to need the
+    // fallback below, «main» is something we asked for, not something we saw.
+    const head = await headState(resolved);
+    return {
+        ok: true,
+        created: true,
+        exists: true,
+        ...(head.branch ? { branch: head.branch } : {}),
+    };
+}
+/**
+ * `git init` with `main` as the initial branch, on every git the fleet has.
+ *
+ * `--initial-branch` arrived in git 2.28 (2020); Debian 10 and CentOS 7 ship
+ * older ones and are still out there. The fallback is not a lesser outcome —
+ * `symbolic-ref` on a repository with no commits in it is exactly what `-b`
+ * does — it just takes two calls.
+ *
+ * Tried rather than version-parsed on purpose: the question is whether THIS git
+ * accepts the flag, and the flag itself answers it in one cheap call.
+ */
+async function initRepositoryOnMain(repoPath) {
+    try {
+        await git(repoPath, 'init', '--quiet', '--initial-branch', INITIAL_BRANCH);
+        return;
+    }
+    catch {
+        // Falls through: either the flag is unknown, or `git init` itself failed —
+        // and the plain form below tells the two apart by either working or
+        // throwing the real reason to the caller.
+    }
+    await git(repoPath, 'init', '--quiet');
+    // Best effort, and deliberately not fatal: `git init` has already made a
+    // working repository, and the caller reads the branch back off it rather than
+    // trusting this call. Throwing here would throw away a folder that is fine.
+    await git(repoPath, 'symbolic-ref', 'HEAD', `refs/heads/${INITIAL_BRANCH}`).catch(() => undefined);
+}
 /**
  * The repository's main branch, read locally (ADR 0004).
  *

package/dist/index.js

@@ -566,6 +566,11 @@ function runnerCapabilities(apiUrlOverride) {
             // это чтение, а не установка, и машину, чей владелец запретил ставить из
             // дашборда, спросить о том, что на ней стоит, по-прежнему можно.
             'agent_versions_refresh',
+            // #417: create the project folder and `git init` in it, from the
+            // binding window. Announced here and nowhere else — the API refuses the
+            // button on a machine that does not name this command, because an older
+            // runner drops a command it cannot parse and never answers.
+            'init_project_dir',
             // #396. Listed unconditionally, unlike the `restart` flag above: the
             // flag is what the dashboard draws a button from, and this list is what
             // `runCommand` dispatches on. A machine that cannot restart still

package/dist/supervisor.js

@@ -9,7 +9,7 @@ import { classifyFailure, isRepeatOfSameFailure, MAX_RETRIES_PER_SESSION, retryD
 import { evaluateRecipeCommand, maskSecrets, maskString } from './policy.js';
 import { agentPromptSizeLabel, inspectAgentPrompt, quotePath, readAgentPrompt, } from './agent-prompt.js';
 import { JournalStore } from './journal.js';
-import { deleteSessionBranch, ensurePreviewWorktree, ensureSessionWorktree, prepareDirectWorkspace, previewWorktreePath, removePreviewWorktree, removeSessionWorktree, repoKeyFor, sessionWorktreePath, validateWorkspacePath, WorktreePrepareError, } from './git.js';
+import { deleteSessionBranch, ensurePreviewWorktree, ensureSessionWorktree, initProjectDir, prepareDirectWorkspace, previewWorktreePath, removePreviewWorktree, removeSessionWorktree, repoKeyFor, sessionWorktreePath, validateWorkspacePath, WorktreePrepareError, } from './git.js';
 import { readRecipeProposal } from './recipe.js';
 import { RECIPE_STEP_NAMES, parseProjectRecipe } from './recipe-schema.js';
 import { proposeCommitMessage } from './commit-message.js';
@@ -6140,6 +6140,37 @@ export class Supervisor {
                         ...(validation.ok ? {} : { error: validation.error }),
                     });
                 }
+                /**
+                 * «Create this folder and put git in it», from the binding window
+                 * (#417).
+                 *
+                 * Next to `validate_path` because it is the same conversation: that
+                 * command answers «the folder is not there», and this one is what the
+                 * person presses next. Everything it is allowed and not allowed to do
+                 * is decided in `initProjectDir` — the API sees a verdict and never the
+                 * machine.
+                 *
+                 * Under the repository lock like every other operation on a folder,
+                 * even though there is no repository yet: `repoKeyFor` falls back to the
+                 * path itself when git cannot answer, so two presses of the button
+                 * serialise against each other rather than racing into one `mkdir`.
+                 */
+                case 'init_project_dir': {
+                    const path = typeof frame.args?.['path'] === 'string' ? frame.args['path'] : null;
+                    if (!path)
+                        return void reply({ ok: false, error: 'path argument is required' });
+                    const init = await this.withRepoLockFor(path, () => initProjectDir(path));
+                    // Remembered for the same reason `validate_path` remembers it: this
+                    // is a real project directory now, and `devbridge-runner doctor`
+                    // checks the permissions of the ones it knows about.
+                    if (init.ok)
+                        rememberWorkspacePath(path);
+                    return void reply({
+                        ok: init.ok,
+                        result: init,
+                        ...(init.ok ? {} : { error: init.error }),
+                    });
+                }
                 case 'clean': {
                     const sessionId = frame.sessionId;
                     if (!sessionId)

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.63.0";
+export declare const RUNNER_VERSION = "0.64.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.63.0';
+export const RUNNER_VERSION = '0.64.1';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.63.0",
+  "version": "0.64.1",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",