@bridge4dev/runner 0.63.0 → 0.65.0

package/dist/git.js

@@ -2,8 +2,10 @@ import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { previewsDir, worktreesDir } from './paths.js';
-import { firstUnreachableAncestor, inspectPath, looksLikeDubiousOwnership, runnerIdentity, safeDirectoryCommand, } from './environment.js';
+import { previewsDir, stateDir, worktreesDir } from './paths.js';
+import { cleanGitEnv, firstUnreachableAncestor, inspectPath, looksLikeDubiousOwnership, runnerIdentity, safeDirectoryCommand, } from './environment.js';
+import { isGitInternalPath, isInsideWorktree, isSecretPath } from './policy.js';
+import { log } from './log.js';
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 30_000;
 /**
@@ -14,12 +16,27 @@ const GIT_TIMEOUT_MS = 30_000;
  * Ninety seconds is the owner's number (plan §9, 06.09.2026).
  */
 const WORKTREE_ADD_TIMEOUT_MS = 90_000;
+/**
+ * Every git call in this file names its repository with `cwd` and nothing else,
+ * so an inherited `GIT_DIR` (or index, or object store) can only ever point
+ * somewhere we did not mean — see `cleanGitEnv`. Free everywhere; load-bearing
+ * in `initProjectDir`, where `git init` under an inherited `GIT_DIR` would
+ * initialise a different directory and report success (#417).
+ */
 async function git(cwd, ...args) {
-    const { stdout } = await execFileAsync('git', args, { cwd, timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await execFileAsync('git', args, {
+        cwd,
+        timeout: GIT_TIMEOUT_MS,
+        env: cleanGitEnv(),
+    });
     return stdout.trim();
 }
 async function gitSlow(cwd, timeoutMs, ...args) {
-    const { stdout } = await execFileAsync('git', args, { cwd, timeout: timeoutMs });
+    const { stdout } = await execFileAsync('git', args, {
+        cwd,
+        timeout: timeoutMs,
+        env: cleanGitEnv(),
+    });
     return stdout.trim();
 }
 /**
@@ -252,6 +269,311 @@ export async function validateWorkspacePath(workspacePath) {
         ...(defaultBranch ? { defaultBranch } : {}),
     };
 }
+/**
+ * The branch a repository created from the binding window starts on (#417).
+ *
+ * One name, here, because two calls ask for it — `git init --initial-branch`
+ * and the `symbolic-ref` that stands in for it on a git older than 2.28 — and a
+ * folder that came out on `master` because the two disagreed would be a bug
+ * nobody sees until a push.
+ */
+const INITIAL_BRANCH = 'main';
+/**
+ * Directories a project folder is never created inside (#417).
+ *
+ * The root itself and the trees a Linux system is assembled from. Deliberately
+ * a short, literal list rather than a clever rule: everything here is a place
+ * where `mkdir` succeeding is worse than it failing, and a person who typed one
+ * of them meant something else. `/opt`, `/srv`, `/home`, `/var/www` are NOT on
+ * it — those are exactly where projects live.
+ *
+ * `/usr/local` and friends are covered by their parents: the test is «is this
+ * path at or below one of these».
+ */
+const SYSTEM_DIRECTORIES = [
+    '/etc',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib32',
+    '/lib64',
+    '/libx32',
+    '/boot',
+    '/proc',
+    '/sys',
+    '/dev',
+    '/run',
+];
+function refuseInit(error) {
+    return { ok: false, created: false, exists: false, error };
+}
+/**
+ * Why this path may not be created, or `null` — asked of a STRING (#417).
+ *
+ * Pulled out of `initProjectDir` because it has to be asked twice: once about
+ * what the person typed, and again about where that path really lands once the
+ * filesystem has had its say. See `realLandingPlace`.
+ */
+function pathClassRefusal(candidate) {
+    if (isGitInternalPath(candidate)) {
+        return `${candidate} is inside a .git directory, which belongs to git itself — pick a folder for the project instead`;
+    }
+    if (candidate === path.sep || SYSTEM_DIRECTORIES.some((dir) => isAtOrBelow(candidate, dir))) {
+        return `${candidate} is a system directory on this server — pick a folder for the project instead`;
+    }
+    // Said separately from the line above, because it would not be true there:
+    // `~/.ssh` is not a system directory, and a refusal that misnames what it is
+    // refusing teaches the person the wrong thing about their own machine.
+    if (isSecretPath(candidate)) {
+        return `${candidate} is on this server's protected list — pick a folder for the project instead`;
+    }
+    // `isSecretPath` cannot answer this one: the runner tree is on its list, but
+    // `worktrees/` and `previews/` are excused from it so an agent can read its
+    // own workspace. Everything under the state directory is the runner's own
+    // bookkeeping either way, and a project living inside it would be rewritten by
+    // the next session cleanup. Both sides go through the real filesystem, because
+    // `stateDir()` is built from `os.homedir()` and a symlinked home would
+    // otherwise make the two paths look unrelated.
+    const state = realPathOf(stateDir());
+    if (isAtOrBelow(candidate, state)) {
+        return `${candidate} is inside the runner's own state directory — pick a folder for the project instead`;
+    }
+    return null;
+}
+/** `realpathSync` where it works, the path itself where it does not. */
+function realPathOf(target) {
+    try {
+        return fs.realpathSync(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+/**
+ * Where `mkdir` would actually land, symlinks and all (#417).
+ *
+ * Every refusal above is string work — `path.resolve` does not follow symlinks,
+ * `isSecretPath` normalises nothing, and containment is `path.relative`. The
+ * kernel disagrees: on a stock Debian `/var/run` IS `/run`, so `/var/run/shop`
+ * passes a list that exists to refuse exactly that, and the repository ends up
+ * on tmpfs and is gone at the next reboot.
+ *
+ * `policy.ts` solves the same problem in `normalize()` by resolving the parent
+ * and putting the last segment back on. That is not enough here, because this
+ * is asked BEFORE anything about the parent is known: with `/tmp/link -> /etc`
+ * and the path `/tmp/link/new/project`, the parent does not exist, its
+ * `realpath` fails, and the fallback is the unresolved string — which would then
+ * earn the advice «create /tmp/link/new first», i.e. make a folder in `/etc`. So
+ * the walk goes up to the deepest ancestor that DOES exist, resolves that, and
+ * puts every missing segment back on.
+ */
+function realLandingPlace(resolved) {
+    const missing = [];
+    let existing = resolved;
+    for (;;) {
+        try {
+            const real = fs.realpathSync(existing);
+            return path.join(real, ...missing.reverse());
+        }
+        catch {
+            const up = path.dirname(existing);
+            if (up === existing)
+                return resolved;
+            missing.push(path.basename(existing));
+            existing = up;
+        }
+    }
+}
+/**
+ * Is `target` at or below `root`?
+ *
+ * `isInsideWorktree` is the containment helper this package already has, and it
+ * answers exactly this question — the name says worktree because that was its
+ * first caller, not because it knows anything about worktrees.
+ */
+function isAtOrBelow(target, root) {
+    return isInsideWorktree(target, root);
+}
+/**
+ * Create the project folder and initialise git in it, from the binding window
+ * (#417).
+ *
+ * Two things and no more: ONE directory — the last segment of the path, never a
+ * chain of parents — and `git init` with `main` as the branch. No first commit:
+ * an empty repository is a legitimate state (#137, and the runner has known how
+ * to work in one since 0.63.0), while an «Initial commit» nobody asked for is
+ * the thing that makes `git pull` from an existing remote refuse with
+ * «unrelated histories» later on.
+ *
+ * Its own refusal list, because `validateWorkspacePath` has none to share: that
+ * function asks «can the runner work here», which is a question about
+ * permissions, and every answer it gives is about reaching, reading and writing.
+ * «Should anything be created here at all» is a different question and this is
+ * the only place that asks it. The API cannot ask it either — it sees the
+ * runner's verdict and nothing of the machine — so the list lives here.
+ */
+export async function initProjectDir(target) {
+    const me = runnerIdentity();
+    // The same rule the API's `WorkspacePathSchema` applies, re-derived here: the
+    // runner is the process that actually calls `mkdir`, and it must not trust the
+    // wire (QA-99 MAJOR-4 is the same argument for `validate_path`).
+    if (!target.startsWith('/') || target.split('/').includes('..')) {
+        return refuseInit('The project folder must be an absolute path with no ".." segments');
+    }
+    const resolved = path.resolve(target);
+    // The cheap pass, on what the person typed: nothing touches the disk for a
+    // path that is obviously not a project folder.
+    const typedRefusal = pathClassRefusal(resolved);
+    if (typedRefusal)
+        return refuseInit(typedRefusal);
+    // The second pass, and the one that decides: where would `mkdir` LAND? A
+    // symlinked ancestor otherwise walks straight through every refusal above,
+    // and `/var/run/shop` on a stock Debian is not a hypothetical: that directory
+    // IS `/run`, and the repository would sit on tmpfs until the next reboot.
+    //
+    // Asked BEFORE any permission check, and that order is the point (the 0.64.0
+    // build had it the other way round and was never published): for a runner that is
+    // not root, `/tmp/link -> /etc` failed «can the runner write to the parent»
+    // first — and the refusal then advised `chown <runner> /tmp/link`, which is
+    // `chown` on `/etc`. «This is a system directory» must win over «grant
+    // yourself access to it».
+    const landing = realLandingPlace(resolved);
+    if (landing !== resolved) {
+        const realRefusal = pathClassRefusal(landing);
+        // Both paths named, in that order: the person recognises what they typed,
+        // and then learns where it actually goes — which is the fact they have to
+        // act on.
+        if (realRefusal)
+            return refuseInit(`${resolved} leads to ${realRefusal}`);
+    }
+    const here = inspectPath(resolved);
+    if (here.unreachable) {
+        const blocked = firstUnreachableAncestor(resolved) ?? resolved;
+        return refuseInit(`The runner runs as ${me.user} and is not allowed into ${blocked}, so it cannot create ${resolved}. ` +
+            `Grant that user access to the directory (for example \`chmod o+x ${blocked}\`, ` +
+            `or \`setfacl -m u:${me.user}:x ${blocked}\`), then try again.`);
+    }
+    if (here.exists) {
+        // Not a refusal, and deliberately not a `mkdir` either: a directory that is
+        // already there is the ordinary case of pressing the button twice, and the
+        // window's next move — bind it — is the right one.
+        if (here.isDirectory)
+            return { ok: true, created: false, exists: true };
+        return refuseInit(`${resolved} already exists and is not a directory`);
+    }
+    const parent = path.dirname(resolved);
+    const above = inspectPath(parent);
+    if (above.unreachable) {
+        const blocked = firstUnreachableAncestor(parent) ?? parent;
+        return refuseInit(`The runner runs as ${me.user} and is not allowed into ${blocked}, so it cannot create ${resolved}. ` +
+            `Grant that user access to the directory (for example \`chmod o+x ${blocked}\`, ` +
+            `or \`setfacl -m u:${me.user}:x ${blocked}\`), then try again.`);
+    }
+    if (!above.exists || !above.isDirectory) {
+        return refuseInit(`${parent} does not exist on this server, and the runner creates only the last folder of the path. ` +
+            `Create ${parent} there first (\`mkdir -p ${parent}\` as a user who may write to it), then try again.`);
+    }
+    if (!above.writable) {
+        return refuseInit(`The runner runs as ${me.user} and cannot write to ${parent}, so it cannot create ${resolved} there. ` +
+            `Give that user write access (for example \`setfacl -m u:${me.user}:rwx ${parent}\`, ` +
+            `or \`chown ${me.user} ${parent}\` if the directory is meant to be theirs), then try again.`);
+    }
+    try {
+        // Deliberately NOT `recursive: true`: the chain of parents is somebody
+        // else's decision about the layout of their machine, and a button that
+        // quietly makes `/opt/a/b/c` out of a typo is worse than one that says the
+        // folder above is missing.
+        fs.mkdirSync(resolved);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'EEXIST') {
+            // Somebody else got there between `inspectPath` and here — or the name was
+            // never free at all: `mkdir(2)` answers EEXIST for ANY existing name, and
+            // a dangling symlink is invisible to the `statSync` above, which follows
+            // it and reports «not there». Look again rather than assume: «a directory
+            // is there» is what the window binds on next.
+            const now = inspectPath(resolved);
+            if (now.exists && now.isDirectory)
+                return { ok: true, created: false, exists: true };
+            return refuseInit(`${resolved} already exists and is not a directory`);
+        }
+        return refuseInit(`The runner runs as ${me.user} and could not create ${resolved} (${code ?? 'unknown error'}). ` +
+            `Check that ${parent} is writable by that user, then try again.`);
+    }
+    try {
+        await initRepositoryOnMain(resolved);
+    }
+    catch (error) {
+        // All-or-nothing, like laying out a worktree (#360): a folder that exists
+        // but is not a repository binds and then fails on «Not a git work tree»,
+        // which is a worse place to learn about it. `rmdirSync` refuses a directory
+        // with anything in it, which is exactly the safety wanted here — we are only
+        // ever removing the empty one made three lines up.
+        let takenBack = true;
+        try {
+            fs.rmdirSync(resolved);
+        }
+        catch {
+            // It is not empty, so it is not only ours to remove. Leave it — and say
+            // so, because the two outcomes want opposite things from the person.
+            takenBack = false;
+        }
+        // Git's own words go to the runner's log, where the person who can act on
+        // them is; the sentence that travels names the folder and what to do next.
+        // `describeGitFailure` would have carried `fatal: …` into a browser, and
+        // the API's net for that (`actionableRunnerRefusal`) rewrites the WHOLE
+        // text — so forwarding it would have cost this sentence as well.
+        log.warn('init_project_dir: git init failed', {
+            path: resolved,
+            takenBack,
+            error: describeGitFailure(error),
+        });
+        const said = takenBack
+            ? `Git would not start in ${resolved}, so the folder was removed again and nothing was left behind. ` +
+                `The runner's log on this server has git's own words — check that git is installed and that the disk is writable, then try again.`
+            : `${resolved} was created, but git would not start in it, and the folder is still there. ` +
+                `The runner's log on this server has git's own words. Run \`git init -b main\` in that folder yourself, or remove it and try again.`;
+        return { ok: false, created: !takenBack, exists: !takenBack, error: said };
+    }
+    // Read back rather than reported from intent: on a git old enough to need the
+    // fallback below, «main» is something we asked for, not something we saw.
+    const head = await headState(resolved);
+    return {
+        ok: true,
+        created: true,
+        exists: true,
+        ...(head.branch ? { branch: head.branch } : {}),
+    };
+}
+/**
+ * `git init` with `main` as the initial branch, on every git the fleet has.
+ *
+ * `--initial-branch` arrived in git 2.28 (2020); Debian 10 and CentOS 7 ship
+ * older ones and are still out there. The fallback is not a lesser outcome —
+ * `symbolic-ref` on a repository with no commits in it is exactly what `-b`
+ * does — it just takes two calls.
+ *
+ * Tried rather than version-parsed on purpose: the question is whether THIS git
+ * accepts the flag, and the flag itself answers it in one cheap call.
+ */
+async function initRepositoryOnMain(repoPath) {
+    try {
+        await git(repoPath, 'init', '--quiet', '--initial-branch', INITIAL_BRANCH);
+        return;
+    }
+    catch {
+        // Falls through: either the flag is unknown, or `git init` itself failed —
+        // and the plain form below tells the two apart by either working or
+        // throwing the real reason to the caller.
+    }
+    await git(repoPath, 'init', '--quiet');
+    // Best effort, and deliberately not fatal: `git init` has already made a
+    // working repository, and the caller reads the branch back off it rather than
+    // trusting this call. Throwing here would throw away a folder that is fine.
+    await git(repoPath, 'symbolic-ref', 'HEAD', `refs/heads/${INITIAL_BRANCH}`).catch(() => undefined);
+}
 /**
  * The repository's main branch, read locally (ADR 0004).
  *

package/dist/index.js

@@ -566,6 +566,11 @@ function runnerCapabilities(apiUrlOverride) {
             // это чтение, а не установка, и машину, чей владелец запретил ставить из
             // дашборда, спросить о том, что на ней стоит, по-прежнему можно.
             'agent_versions_refresh',
+            // #417: create the project folder and `git init` in it, from the
+            // binding window. Announced here and nowhere else — the API refuses the
+            // button on a machine that does not name this command, because an older
+            // runner drops a command it cannot parse and never answers.
+            'init_project_dir',
             // #396. Listed unconditionally, unlike the `restart` flag above: the
             // flag is what the dashboard draws a button from, and this list is what
             // `runCommand` dispatches on. A machine that cannot restart still

package/dist/supervisor.d.ts

@@ -1076,6 +1076,26 @@ export declare class Supervisor {
      */
     private armCompactionWatchdog;
     private clearCompactionWatchdog;
+    /**
+     * A card that interrupted a RESTING session has been answered: go back to
+     * rest instead of reporting a turn (#382).
+     *
+     * Which card it was does not matter — a Codex helper's approval, a Claude
+     * background subagent's, an ask either of them parked while the session was
+     * already the person's. What matters is that no turn of this session was
+     * running when the card went out, so there is no turn to go back to and
+     * nothing that would end one: on Codex the helper's own ending is explicitly
+     * not the session's, so «Working» stood until somebody typed.
+     *
+     * Only when the burst is over — both card sets empty — because answering one
+     * of three still leaves the session parked on the other two. The frame
+     * carries the background count like every other status report, so the badge
+     * and the Inbox see «resting, with helpers» rather than «your turn».
+     *
+     * Returns true when it handled the resolution, so the callers' «the human
+     * answered, bill again» branches stay out of it.
+     */
+    private restAfterCard;
     /**
      * Record how many subagents are alive, and say so when it matters (#236).
      *

package/dist/supervisor.js

@@ -9,7 +9,7 @@ import { classifyFailure, isRepeatOfSameFailure, MAX_RETRIES_PER_SESSION, retryD
 import { evaluateRecipeCommand, maskSecrets, maskString } from './policy.js';
 import { agentPromptSizeLabel, inspectAgentPrompt, quotePath, readAgentPrompt, } from './agent-prompt.js';
 import { JournalStore } from './journal.js';
-import { deleteSessionBranch, ensurePreviewWorktree, ensureSessionWorktree, prepareDirectWorkspace, previewWorktreePath, removePreviewWorktree, removeSessionWorktree, repoKeyFor, sessionWorktreePath, validateWorkspacePath, WorktreePrepareError, } from './git.js';
+import { deleteSessionBranch, ensurePreviewWorktree, ensureSessionWorktree, initProjectDir, prepareDirectWorkspace, previewWorktreePath, removePreviewWorktree, removeSessionWorktree, repoKeyFor, sessionWorktreePath, validateWorkspacePath, WorktreePrepareError, } from './git.js';
 import { readRecipeProposal } from './recipe.js';
 import { RECIPE_STEP_NAMES, parseProjectRecipe } from './recipe-schema.js';
 import { proposeCommitMessage } from './commit-message.js';
@@ -3404,6 +3404,39 @@ export class Supervisor {
         clearTimeout(running.compactionWatchdog);
         delete running.compactionWatchdog;
     }
+    /**
+     * A card that interrupted a RESTING session has been answered: go back to
+     * rest instead of reporting a turn (#382).
+     *
+     * Which card it was does not matter — a Codex helper's approval, a Claude
+     * background subagent's, an ask either of them parked while the session was
+     * already the person's. What matters is that no turn of this session was
+     * running when the card went out, so there is no turn to go back to and
+     * nothing that would end one: on Codex the helper's own ending is explicitly
+     * not the session's, so «Working» stood until somebody typed.
+     *
+     * Only when the burst is over — both card sets empty — because answering one
+     * of three still leaves the session parked on the other two. The frame
+     * carries the background count like every other status report, so the badge
+     * and the Inbox see «resting, with helpers» rather than «your turn».
+     *
+     * Returns true when it handled the resolution, so the callers' «the human
+     * answered, bill again» branches stay out of it.
+     */
+    restAfterCard(running) {
+        const back = running.restBeforeCard;
+        if (!back)
+            return false;
+        if (running.openPermissions.size > 0 || running.openQuestions.size > 0)
+            return true;
+        // `reportStatus` clears the memory — the status it sends is the newest
+        // truth about this session, whatever it is.
+        this.reportStatus(running.descriptor.id, back, {
+            costUsd: running.costUsd,
+            activeMs: Supervisor.spentMs(running),
+        });
+        return true;
+    }
     /**
      * Record how many subagents are alive, and say so when it matters (#236).
      *
@@ -3817,6 +3850,8 @@ export class Supervisor {
                     source: event.source,
                     reason: event.reason,
                 });
+                if (this.restAfterCard(running))
+                    return;
                 if (event.source === 'user' &&
                     event.allow &&
                     running.lastReported === 'WAITING_PERMISSION') {
@@ -3844,6 +3879,11 @@ export class Supervisor {
                 // is the bug session 7 removed (five of the first twelve prod sessions
                 // died having spent their budget waiting for a human).
                 running.openQuestions.add(event.askId);
+                // #382, the same as a permission card: an ask from work that outlives
+                // the turn finds the session at rest, and the answer must put it back.
+                if (running.lastReported === 'WAITING_INPUT' || running.lastReported === 'REVIEW') {
+                    running.restBeforeCard = running.lastReported;
+                }
                 this.sendEvent(running, 'question', {
                     askId: event.askId,
                     questions: event.questions,
@@ -3872,6 +3912,8 @@ export class Supervisor {
                 // `openQuestions.size` matters: both agents can park several asks at
                 // once, and reporting RUNNING while another card is still waiting would
                 // bill a human's thinking time all over again (QA-106 M4).
+                if (this.restAfterCard(running))
+                    return;
                 if (event.source === 'user' &&
                     running.openQuestions.size === 0 &&
                     running.lastReported === 'WAITING_INPUT') {
@@ -6140,6 +6182,37 @@ export class Supervisor {
                         ...(validation.ok ? {} : { error: validation.error }),
                     });
                 }
+                /**
+                 * «Create this folder and put git in it», from the binding window
+                 * (#417).
+                 *
+                 * Next to `validate_path` because it is the same conversation: that
+                 * command answers «the folder is not there», and this one is what the
+                 * person presses next. Everything it is allowed and not allowed to do
+                 * is decided in `initProjectDir` — the API sees a verdict and never the
+                 * machine.
+                 *
+                 * Under the repository lock like every other operation on a folder,
+                 * even though there is no repository yet: `repoKeyFor` falls back to the
+                 * path itself when git cannot answer, so two presses of the button
+                 * serialise against each other rather than racing into one `mkdir`.
+                 */
+                case 'init_project_dir': {
+                    const path = typeof frame.args?.['path'] === 'string' ? frame.args['path'] : null;
+                    if (!path)
+                        return void reply({ ok: false, error: 'path argument is required' });
+                    const init = await this.withRepoLockFor(path, () => initProjectDir(path));
+                    // Remembered for the same reason `validate_path` remembers it: this
+                    // is a real project directory now, and `devbridge-runner doctor`
+                    // checks the permissions of the ones it knows about.
+                    if (init.ok)
+                        rememberWorkspacePath(path);
+                    return void reply({
+                        ok: init.ok,
+                        result: init,
+                        ...(init.ok ? {} : { error: init.error }),
+                    });
+                }
                 case 'clean': {
                     const sessionId = frame.sessionId;
                     if (!sessionId)
@@ -7532,6 +7605,13 @@ export class Supervisor {
             // The API infers WAITING_PERMISSION from the event itself, so this never
             // goes through reportStatus — but the budget clock still has to stop, or
             // an ask-mode session bills every second the human spends reading the card.
+            //
+            // #382: remember what the card interrupted. A card from work that
+            // outlives the turn finds the session at rest, and the answer must put it
+            // back there rather than into a turn nobody is running.
+            if (running.lastReported === 'WAITING_INPUT' || running.lastReported === 'REVIEW') {
+                running.restBeforeCard = running.lastReported;
+            }
             running.lastReported = 'WAITING_PERMISSION';
             this.syncBudgetClock(running);
         }
@@ -7541,6 +7621,8 @@ export class Supervisor {
         const running = this.sessions.get(sessionId);
         if (running) {
             running.lastReported = status;
+            // #382: any status report is newer than the rest a card interrupted.
+            delete running.restBeforeCard;
             // Coming to rest ends the busy period the once-per-turn notices were
             // limited to: the next one is about a new answer and deserves saying.
             if (!Supervisor.MID_TURN_STATUSES.includes(status)) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.63.0";
+export declare const RUNNER_VERSION = "0.65.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.63.0';
+export const RUNNER_VERSION = '0.65.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",