@bridge4dev/runner 0.68.0 → 0.69.0

package/dist/adapters/error-policy.js

@@ -120,6 +120,21 @@ export const ERROR_RULES = [
         note: 'The API refused the request itself. Deterministic — it will refuse the identical request ' +
             'identically. Often a malformed transcript, which a repeat can only make worse.',
     },
+    {
+        id: 'claude.model_refusal',
+        provider: 'claude',
+        match: { codeIn: ['model_refusal'] },
+        retry: false,
+        verified: true,
+        note: 'The provider’s own safety filter refused the answer and no fallback model took the turn ' +
+            '(#435, first item). `model_refusal` is OURS, not the SDK’s: the closed enum on the ' +
+            'assistant frame has no member for this, so the adapter mints the code from the machine ' +
+            'fields that do carry it — `stop_reason: "refusal"` with `stop_details.category`, or the ' +
+            '`model_refusal_no_fallback` frame with `api_refusal_category`. Listed rather than left to ' +
+            'the default for one concrete reason: without it a refusal that named no other cause fell ' +
+            'through to `server_error` and would have been REPEATED five times, and re-sending a ' +
+            'refused request is the one repeat that actively harms the account (see `codex.policy`).',
+    },
     {
         id: 'claude.model_not_found',
         provider: 'claude',
@@ -218,6 +233,45 @@ export const ERROR_RULES = [
         note: 'Refused on content policy — about what was asked, not about their weather. Re-sending a ' +
             'refused request is the one repeat that actively harms the account.',
     },
+    /**
+     * The one 4xx that is worth carrying on from — and it sits ABOVE the status
+     * range on purpose, because first match wins.
+     *
+     * 2026-09-18, 20:27:44 UTC, DEV-COMPLECTA: OpenAI answered a turn with
+     * `{"error":{"code":"unsupported_parameter","param":"access_programs.cyber"},
+     * "status":400}`. The parameter is one the Codex CLI adds by itself — it is
+     * in no request this platform writes — and the organisation is not in the
+     * programme it names. The session died, the stage stopped as «unknown» and a
+     * run with three stages ahead of it went to NEEDS_YOU. Fifteen other sessions
+     * on the same machine, the same account and the same model ran that day
+     * without it, including the neighbouring stage of the same run four minutes
+     * earlier. Known upstream: openai/codex#46398.
+     *
+     * `continue`, not `retry`: the owner pressed Retry on the live run at 21:10
+     * and it continued the SAME conversation (`resume_count = 2`) and finished
+     * `done`. What worked by hand is what the runner should do — and what it must
+     * not do is send the turn again.
+     *
+     * `attempts: 1` and not the 2 the ticket asked for. The clamp below gives a
+     * `continue` one attempt whatever the row says, and raising the clamp would
+     * widen every `continue` rule at once. It also buys nothing: the second
+     * attempt of the SAME rule is refused by `isRepeatOfSameFailure` anyway, so 2
+     * would be a number that never happened.
+     */
+    {
+        id: 'codex.api.access_program_not_enabled',
+        provider: 'codex',
+        match: { codeIn: ['api:unsupported_parameter:access_programs'] },
+        retry: true,
+        bucket: 'continue',
+        attempts: 1,
+        backoff: 'standard',
+        refusedWhole: true,
+        verified: true,
+        note: 'The provider rejected the whole request over a parameter the CLI adds, not the person — ' +
+            'so nothing was produced and nothing is repeated by carrying the conversation on. Verified ' +
+            'on the live run of 2026-09-18 (#446), not on a guess.',
+    },
     {
         id: 'codex.http_4xx',
         provider: 'codex',
@@ -233,6 +287,7 @@ const DEFAULT_DECISION = {
     attempts: 0,
     backoff: 'standard',
     ruleId: null,
+    refusedWhole: false,
 };
 function matches(rule, signal) {
     if (rule.provider !== signal.provider)
@@ -261,9 +316,24 @@ const PARTIAL_PHRASES = ['may be incomplete', 'mid-response'];
  * ran a fifteen-minute command twice, four minutes apart.
  */
 function refine(bucket, signal) {
-    // Something irreversible already happened this turn. Neither repeating nor
-    // resuming is safe enough to do without a person looking.
-    if (signal.irreversible === true)
+    /**
+     * Something irreversible already happened this turn. Neither repeating nor
+     * resuming is safe enough to do without a person looking.
+     *
+     * **One exception, and it is the narrowest shape that works (#446 п. 5).**
+     * The rule itself has to have asked to CARRY THE CONVERSATION ON. When it
+     * has, «send the turn again after a commit» stays impossible by
+     * construction: `refine` cannot manufacture a `continue`, it only receives
+     * the row's own bucket, so nothing here can turn a `retry` row into one.
+     *
+     * Why it has to exist: the turn this came from had run `git commit` one
+     * second before the provider threw the request away, so `irreversible` was
+     * true and the answer was an unconditional `stop` — for a failure where
+     * nothing at all had run on the provider's side. Carrying the conversation
+     * on repeats nothing; it is exactly what the owner did by hand on the live
+     * run, and it finished.
+     */
+    if (signal.irreversible === true && bucket !== 'continue')
         return 'stop';
     // Work was produced, so «send it again» is off the table whatever the cause says.
     if (signal.produced === true && bucket === 'retry')
@@ -308,6 +378,7 @@ export function classifyFailure(signal) {
             attempts: bucket === 'stop' ? 0 : bucket === 'continue' ? 1 : Math.max(0, rule.attempts ?? 0),
             backoff: rule.backoff ?? 'standard',
             ruleId: rule.id,
+            refusedWhole: rule.refusedWhole === true,
         };
     }
     return DEFAULT_DECISION;

package/dist/adapters/types.d.ts

@@ -654,6 +654,18 @@ export type AgentEvent = {
     failureCode?: string;
     /** HTTP status, when the provider named one alongside the cause. */
     failureStatus?: number;
+    /**
+     * The category the provider's own safety filter named when it refused to
+     * answer (#435, first item): `reasoning_extraction`, `cyber`, `bio`, …,
+     * or `unknown` when the frame named none.
+     *
+     * Separate from `failureCode` because the two answer different
+     * questions: the code decides what may happen next, the category is what
+     * a person is told and what the platform stores. Absent means the CLI
+     * sent no such frame — an older one, or a turn that was not refused —
+     * and everything behaves exactly as it did before.
+     */
+    refusalCategory?: string;
     /**
      * Did this turn put anything at all on the wire before it broke — a text
      * block, a thought, a tool call?

package/dist/policy.d.ts

@@ -182,6 +182,31 @@ export declare function isInsideWorktree(p: string, worktreePath: string): boole
  * next git invocation. Neither is ever ordinary agent work.
  */
 export declare function isGitInternalPath(p: string): boolean;
+/**
+ * Does this segment tell git to run a program of the caller's choosing? (#443)
+ *
+ * The hole this closes was open from 2026-08-30 to this release and survived
+ * runner 0.59 through 0.68: `git fetch --upload-pack='touch /tmp/x' /path` is
+ * on the safe list (it starts `git fetch`), carries no shell metacharacter, and
+ * so ran with no permission card at all under the DEFAULT trust level. The
+ * flag is not a niche one — git executes it even when the fetch itself then
+ * fails with code 128.
+ *
+ * Three things this must not do, each of them a mistake somebody already paid
+ * for on this file:
+ *
+ *  - **no regex over the command.** `git -c` forty-four times in a row once
+ *    froze the runner for minutes inside a normal turn (see `GIT_PUSH`), and
+ *    this runs synchronously on every Bash call of every session on the
+ *    machine. Everything below is a single pass over `words()` and string
+ *    compares;
+ *  - **no searching for the flag as a substring.** See `PROGRAM_FLAGS`;
+ *  - **the refusal has to catch the form with no shell metacharacter in it.**
+ *    The proof-of-concept in the 2026-08-30 audit used `;`, which the
+ *    metacharacter filter already caught, so a test written from it would have
+ *    gone green against an unfixed runner.
+ */
+export declare function gitRunsAProgram(command: string): PolicyDecision | null;
 /**
  * The project's git rules, applied to one Bash command.
  *
@@ -200,6 +225,20 @@ export declare function isGitInternalPath(p: string): boolean;
  * and the loop reads to the end.
  */
 export declare function evaluateGitPolicy(command: string, ctx: PolicyContext): PolicyDecision | null;
+/**
+ * Does this shell command name a path the agent must not touch?
+ *
+ * Exported for the `PreToolUse` guard (#399), which is the one check that
+ * survives `bypassPermissions` — where `evaluateToolUse` below is never called
+ * at all. One list, one function, two callers: a second copy of these patterns
+ * would drift, and the drift would be silent.
+ *
+ * Both spellings are tested here rather than at the call site, so a caller
+ * cannot forget the one that matters: `cat "/root/.cla""ude/…"` collapses only
+ * under `dequote`, and forgetting it is how quote-splitting got past a rule
+ * once already (QA-96 F8/F9).
+ */
+export declare function commandMentionsSecretPath(command: string): boolean;
 export interface RecipeCommandContext {
     /**
      * The docker compose project this preview owns, from `preview.project` in the