@bridge4dev/runner 0.68.1 → 0.69.0

package/dist/regex-guard.js

@@ -16,6 +16,7 @@
  * ВРЕМЕННАЯ МЕРА. Это обход чужого дефекта, а не его исправление. Когда движок
  * починят — снять целиком (`claude-code-regex-guard.md` §3.3).
  */
+import { commandMentionsSecretPath, gitRunsAProgram, isSecretPath } from './policy.js';
 /**
  * Граница числового счётчика, начиная с которой шаблон считается опасным.
  *
@@ -303,6 +304,61 @@ export function inspectBashCommand(command) {
     }
     return { dangerous: false };
 }
+/**
+ * Второй жилец этого привратника: защищённые пути в командах (#399).
+ *
+ * Почему здесь, а не в политике. Политика (`evaluateToolUse`) в режиме
+ * «Полный доступ» не вызывается ВООБЩЕ: раннер запускает CLI с
+ * `bypassPermissions`, и `canUseTool` из него не приходит ни разу. Именно в
+ * этом режиме идут этапы прогонов. Хук `PreToolUse` переживает любой режим —
+ * проверено живьём 08.09.2026, когда он остановил опасный `grep` в сессии
+ * режима `full`.
+ *
+ * Список и функция — те же, что у политики (`commandMentionsSecretPath`), а не
+ * вторая копия: два списка разошлись бы, и разошлись бы молча.
+ *
+ * Случай, который это закрывает, стоил 47 агентов и 4 сессий за две секунды.
+ * Агент скопировал `/root/.claude/.credentials.json` во временный `HOME` и
+ * запустил там свой `claude`; тот упреждающе обновил токен, записал новую пару
+ * в копию, и refresh-токен машины обесценился. Запрет на этот файл существовал
+ * и тогда — но в том режиме его никто не спрашивал.
+ *
+ * Объём — только `Bash`, осознанно: расширять матчер хука до `Read`/`Write`
+ * значит вставать на пути каждого чтения и записи, а в обычных режимах эти
+ * инструменты и так закрыты политикой.
+ */
+function inspectSecretPaths(command) {
+    if (!commandMentionsSecretPath(command))
+        return { dangerous: false };
+    return {
+        dangerous: true,
+        reason: 'Blocked: this command touches a protected path — a machine login, a key, or an agent ' +
+            'session journal. A copy of a login file is the dangerous one: the token in it is ' +
+            'single-use, so the copy that refreshes it signs every session on this machine out at ' +
+            'once. If you need an isolated run, sign in inside that HOME of its own ' +
+            '(`claude auth login` / `codex login`), or give the run an ANTHROPIC_API_KEY. If you ' +
+            'were after your own notes, those live beside the journals and are open: ' +
+            '`~/.claude/projects/<project>/memory/`.',
+    };
+}
+/**
+ * Третий жилец: флаг git, называющий программу для запуска (#443).
+ *
+ * Дыру закрывает `evaluateGitPolicy`, а её в режиме «Полный доступ» никто не
+ * зовёт — в том самом режиме, в котором идут этапы прогонов. Сторож зовёт
+ * только УЗКУЮ половину правила (`gitRunsAProgram`): проектные настройки git
+ * — запрет push, защищённые ветки, `git clean` — в этом режиме намеренно не
+ * действуют, и тащить их сюда значило бы запрещать работу, ради которой режим
+ * и существует. «Какая программа запустится на чужой машине» к этим
+ * настройкам никогда не относилась: у правила рядом с ним, про
+ * `--receive-pack`, переключателя тоже нет.
+ */
+function inspectGitProgramFlags(command) {
+    const refusal = gitRunsAProgram(command);
+    if (refusal === null)
+        return { dangerous: false };
+    return { dangerous: true, reason: `Blocked: ${refusal.reason}` };
+}
 /**
  * Решение по тому, что прислал Claude Code в хук `PreToolUse`.
  *
@@ -316,14 +372,39 @@ export function decideForTool(toolName, toolInput) {
         return { dangerous: false };
     const input = toolInput;
     if (toolName === 'Bash') {
-        return typeof input['command'] === 'string'
-            ? inspectBashCommand(input['command'])
-            : { dangerous: false };
+        if (typeof input['command'] !== 'string')
+            return { dangerous: false };
+        const secret = inspectSecretPaths(input['command']);
+        if (secret.dangerous)
+            return secret;
+        const runsProgram = inspectGitProgramFlags(input['command']);
+        if (runsProgram.dangerous)
+            return runsProgram;
+        return inspectBashCommand(input['command']);
     }
     // Инструмент Grep проверяется тем же правилом намеренно, хотя движок под ним
     // может быть другим: цена перестраховки — один круг диалога, и она измерена
     // как нулевая на повседневных шаблонах.
     if (toolName === 'Grep') {
+        /**
+         * Независимая проверка этапа: правило по расширению `.jsonl` не может
+         * совпасть с КАТАЛОГОМ, а `Grep` с `path` каталога и `output_mode:
+         * 'content'` отдаёт содержимое всех журналов под ним одним вызовом. В
+         * политике это закрыто правилом на каталог; здесь — той же функцией.
+         *
+         * Матчер хука это НЕ расширяет: `Grep` стоит в нём с самого начала
+         * (`Bash|Grep`), и решение тикета «не доводить сторож до `Read`/`Write`»
+         * остаётся в силе.
+         */
+        const target = input['path'];
+        if (typeof target === 'string' && target !== '' && isSecretPath(target)) {
+            return {
+                dangerous: true,
+                reason: 'Blocked: that path is protected — it holds machine logins, keys, or agent session ' +
+                    'journals. Your own notes are open and live beside them: ' +
+                    '`~/.claude/projects/<project>/memory/`.',
+            };
+        }
         return typeof input['pattern'] === 'string'
             ? inspectPattern(input['pattern'])
             : { dangerous: false };

package/dist/supervisor.d.ts

@@ -1698,6 +1698,21 @@ export declare class Supervisor {
      */
     private stopCages;
 }
+/**
+ * What the runner says to the agent when it carries a conversation on.
+ *
+ * Exported and pure because the alternative is untestable: the sentence is
+ * chosen inside a timer that waits ten to thirty seconds, and an integration
+ * test that waited for it would be slow and flaky. Its own QA found this
+ * branch uncovered, and «uncovered» is how a sentence goes back to being wrong.
+ *
+ * And what it says has to be TRUE, or it costs the agent a search (#446 п. 6).
+ * «Your answer was cut off part-way, check what you had already finished»
+ * is right after a dropped stream and wrong after a request the provider
+ * refused whole, where nothing of it ever reached a model: the agent goes
+ * looking for half-done work that does not exist.
+ */
+export declare function carryOnMessage(refusedWhole: boolean): string;
 /**
  * The first message the agent gets.
  *

package/dist/supervisor.js

@@ -3245,6 +3245,11 @@ export class Supervisor {
             // emits (#300) resets the «three limit pauses in a row» counter one second
             // after the third one, and «woke → refused → slept» never stops.
             ...(event.limitBlocked ? { limitBlocked: true } : {}),
+            // #435 п. 1: the category the provider's filter named. Absent means the
+            // CLI sent no such frame — an older one, or a turn nobody refused. The
+            // API keeps the whole payload as it comes, so nothing there needs to
+            // know this field exists for it to be stored and streamed.
+            ...(event.refusalCategory !== undefined ? { refusalCategory: event.refusalCategory } : {}),
             // ALWAYS present, true or false — the absence of this field is what the
             // API reads as «this runner is older than the fix», and a new runner that
             // sometimes omitted it would be indistinguishable from one.
@@ -3336,6 +3341,17 @@ export class Supervisor {
                 costUsd: running.costUsd,
                 activeMs: Supervisor.spentMs(running),
                 errorMessage: event.errorMessage ?? 'Agent turn failed',
+                // #435 п. 1. The session still FAILS — stopping instead of failing is
+                // the rest of that ticket and needs two buttons on screen that do not
+                // exist yet. What it stops doing is failing ANONYMOUSLY: the reason is
+                // written down, so the platform can tell a filter refusal from a
+                // broken connection without reading anybody's prose.
+                // Spelled out rather than imported: the runner is published as its own
+                // npm package and cannot depend on `@devbridge/shared`. The value is
+                // mirrored there in `DEV_SESSION_END_REASONS.modelRefusal`, and the
+                // API's Zod enum has `.catch(undefined)` — so an API older than this
+                // runner hears no reason rather than dropping the whole frame.
+                ...(event.refusalCategory !== undefined ? { endReason: 'MODEL_REFUSAL' } : {}),
             });
             return;
         }
@@ -4632,7 +4648,7 @@ export class Supervisor {
         const delay = retryDelayMs(decision.backoff, attempt);
         const at = new Date(Date.now() + delay);
         const timer = setTimeout(() => {
-            this.runApiRetry(running, bucket);
+            this.runApiRetry(running, bucket, decision.refusedWhole);
         }, delay);
         timer.unref();
         running.apiRetry = { timer, attempt, ruleId: decision.ruleId };
@@ -4640,9 +4656,18 @@ export class Supervisor {
         // Supervisor-minted rather than an adapter notice: adapter notices are
         // de-duplicated for the session's whole life, so «attempt 2» would appear
         // once and never again (gotcha #148).
+        // Three sentences, not two (#446 п. 6). «The answer was cut off part-way»
+        // is true of a dropped stream and false of a request the provider threw
+        // away whole — and telling a person the connection failed when it did not
+        // is what cost an hour of looking in the wrong place.
+        const why = decision.refusedWhole
+            ? 'The provider rejected the request outright'
+            : bucket === 'continue'
+                ? 'The answer was cut off part-way'
+                : 'The provider could not be reached';
         this.sendEvent(running, 'system_note', {
             code: 'agent_retry',
-            text: `${bucket === 'continue' ? 'The answer was cut off part-way' : 'The provider could not be reached'} — ` +
+            text: `${why} — ` +
                 `attempt ${attempt} of ${decision.attempts}, next at ${at.toISOString().slice(11, 16)} UTC. ` +
                 'This is a fault on the provider’s side, not in the task.',
         });
@@ -4650,7 +4675,7 @@ export class Supervisor {
         return true;
     }
     /** Fire an armed retry — re-checking, at FIRE time, everything that could have changed. */
-    runApiRetry(running, bucket) {
+    runApiRetry(running, bucket, refusedWhole = false) {
         const armed = running.apiRetry;
         if (!armed)
             return;
@@ -4682,9 +4707,7 @@ export class Supervisor {
         // owner used to type by hand. `auto-resume.ts` records the cost of getting
         // this backwards — a re-sent prompt ran a fifteen-minute command twice.
         const text = bucket === 'continue'
-            ? 'The connection to the model dropped part-way through your previous answer — not by ' +
-                'anything you did, and nothing is wrong with the work. Check what you had already ' +
-                'finished before redoing any of it, then continue from where you stopped.'
+            ? carryOnMessage(refusedWhole)
             : (running.lastTurnPrompt ?? 'Continue.');
         running.session.send(text);
         this.reportStatus(running.descriptor.id, 'RUNNING', {});
@@ -8153,6 +8176,29 @@ function isTerminal(status) {
 function isSettled(status) {
     return isTerminal(status) || status === 'REVIEW';
 }
+/**
+ * What the runner says to the agent when it carries a conversation on.
+ *
+ * Exported and pure because the alternative is untestable: the sentence is
+ * chosen inside a timer that waits ten to thirty seconds, and an integration
+ * test that waited for it would be slow and flaky. Its own QA found this
+ * branch uncovered, and «uncovered» is how a sentence goes back to being wrong.
+ *
+ * And what it says has to be TRUE, or it costs the agent a search (#446 п. 6).
+ * «Your answer was cut off part-way, check what you had already finished»
+ * is right after a dropped stream and wrong after a request the provider
+ * refused whole, where nothing of it ever reached a model: the agent goes
+ * looking for half-done work that does not exist.
+ */
+export function carryOnMessage(refusedWhole) {
+    return refusedWhole
+        ? 'The provider rejected your previous request outright — nothing of it ran, and nothing is ' +
+            'wrong with your work or with the task. Carry on from where you were; there is no ' +
+            'half-finished step to look for.'
+        : 'The connection to the model dropped part-way through your previous answer — not by ' +
+            'anything you did, and nothing is wrong with the work. Check what you had already ' +
+            'finished before redoing any of it, then continue from where you stopped.';
+}
 /**
  * The first message the agent gets.
  *

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.68.1";
+export declare const RUNNER_VERSION = "0.69.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.68.1';
+export const RUNNER_VERSION = '0.69.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.68.1",
+  "version": "0.69.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",