@nac3/forge-cli 1.21.4 → 1.23.1

package/dist/chat/server.js

@@ -784,6 +784,28 @@ export async function startChatServer(opts) {
             catch { /* swallow */ }
         }
     }
+    /* PND-222 -- el drenaje de la casilla del canal se engancha al CIERRE DE
+     * TURNO, no a un temporizador. Es el unico momento en que un entrante puede
+     * correr sin pelearse con el turno vivo, y el unico que lo conoce es
+     * turn_control. Registrado una sola vez por proceso. */
+    if (!bridgeDisabled) {
+        try {
+            const { onTurnsIdle } = await import('./turn_control.js');
+            onTurnsIdle(() => {
+                void drainBridgeInbox({
+                    projectRoot: session.projectRoot,
+                    projectName: session.projectName,
+                    projectSlug: session.projectSlug,
+                    port: opts.port,
+                    claude,
+                    voice,
+                    store,
+                    bridge: bridgeHandle,
+                });
+            });
+        }
+        catch { /* el canal nunca puede trabar el boot */ }
+    }
     /* Set the relay board ctx to the active project NOW so a paired phone
      * shows the project bubble + pizarron immediately -- the ctx used to be
      * set only on a chat turn or a project switch, so the phone saw nothing
@@ -884,6 +906,122 @@ export async function startChatServer(opts) {
         }),
     };
 }
+/** Entrantes esperando el modal del dueno (modo 'ask'), por delivery_id. */
+const bridgeAsks = new Map();
+/** delivery_id local -> delivery_id del expediente en el host del canal, para
+ *  poder devolverle la transicion al emisor. */
+const bridgeHostDeliveryIds = new Map();
+function hostIdFor(localId) {
+    return bridgeHostDeliveryIds.get(localId) || localId;
+}
+/** Lanza el turno inyectado por el MISMO camino que un turno tipeado. */
+function runInjectedTurn(ctx, turn, localId) {
+    const hostId = hostIdFor(localId);
+    void (async () => {
+        try {
+            await ctx.bridge?.reportDelivery(hostId, 'running');
+        }
+        catch { /* */ }
+        try {
+            await fetch('http://127.0.0.1:' + ctx.port + '/api/chat', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(turn),
+            });
+            try {
+                await ctx.bridge?.reportDelivery(hostId, 'done');
+            }
+            catch { /* */ }
+        }
+        catch {
+            try {
+                await ctx.bridge?.reportDelivery(hostId, 'refused', 'local turn failed to start');
+            }
+            catch { /* */ }
+        }
+    })();
+}
+let draining = false;
+/**
+ * Tomar el proximo entrante y hacer lo que la postura del dueno diga. Se llama
+ * al recibir (si no hay turno) y al cerrar cada turno.
+ */
+async function drainBridgeInbox(ctx) {
+    if (draining)
+        return;
+    draining = true;
+    try {
+        const { isTurnActive } = await import('./turn_control.js');
+        if (isTurnActive())
+            return;
+        if (bridgeAsks.size > 0)
+            return; /* un modal abierto manda; no apilamos dos */
+        const inbox = await import('./bridge_inbox.js');
+        /* Lo vencido se DICE, no se descarta: el emisor lo lee en su expediente. */
+        for (const v of inbox.dropExpired()) {
+            await inbox.logBridgeDelivery({
+                ts: new Date().toISOString(), delivery_id: hostIdFor(v.delivery_id), direction: 'in',
+                from: v.from_name, from_port: v.from_port, hop: v.hop, disposition: 'expired',
+                note: 'espero mas de ' + Math.round(inbox.INBOX_TTL_MS / 60000) + ' min sin poder correr',
+                text_len: v.text.length,
+            });
+            try {
+                await ctx.bridge?.reportDelivery(hostIdFor(v.delivery_id), 'expired', 'ttl');
+            }
+            catch { /* */ }
+        }
+        const msg = inbox.takeNextDirected();
+        if (!msg)
+            return;
+        const { readLimitsConfig } = await import('../core/limits_config.js');
+        const cfg = (await readLimitsConfig()).bridge;
+        const plan = inbox.planDelivery(msg, cfg);
+        if (plan.action === 'refuse') {
+            try {
+                await ctx.bridge?.reportDelivery(hostIdFor(msg.delivery_id), 'refused', 'disabled');
+            }
+            catch { /* */ }
+            return;
+        }
+        if (plan.action === 'ask') {
+            bridgeAsks.set(msg.delivery_id, msg);
+            /* EL MODAL ES LA PREGUNTA (R8): emisor, puerto, salto y el texto
+             * LITERAL, sin recortarlo a un resumen. */
+            broadcastToPanel('approval_required', {
+                kind: 'bridge_message',
+                trace_id: msg.delivery_id,
+                bridge: {
+                    delivery_id: msg.delivery_id,
+                    from_name: msg.from_name,
+                    from_port: msg.from_port,
+                    hop: msg.hop,
+                    text: msg.text,
+                    received_at: new Date(msg.received_at).toISOString(),
+                },
+            });
+            await inbox.logBridgeDelivery({
+                ts: new Date().toISOString(), delivery_id: hostIdFor(msg.delivery_id), direction: 'in',
+                from: msg.from_name, from_port: msg.from_port, hop: msg.hop,
+                disposition: 'awaiting_approval', mode: cfg.directed_mode, text_len: msg.text.length,
+            });
+            try {
+                await ctx.bridge?.reportDelivery(hostIdFor(msg.delivery_id), 'awaiting_approval');
+            }
+            catch { /* */ }
+            return;
+        }
+        await inbox.logBridgeDelivery({
+            ts: new Date().toISOString(), delivery_id: hostIdFor(msg.delivery_id), direction: 'in',
+            from: msg.from_name, from_port: msg.from_port, hop: msg.hop,
+            disposition: 'running', mode: cfg.directed_mode, text_len: msg.text.length,
+        });
+        runInjectedTurn(ctx, plan.turn, msg.delivery_id);
+    }
+    catch { /* el drenaje nunca puede tirar el servidor */ }
+    finally {
+        draining = false;
+    }
+}
 /* P2 (mobile remote control) -- the desktop mirrors its Coding-feed
  * activity to the worker relay so a paired phone can watch the work.
  * AUTOMATIC: on as soon as a phone is paired (the pairing drops a marker);
@@ -1975,7 +2113,13 @@ async function route(req, res, ctx) {
         };
         const fields = LIMITS_FIELD_PATHS.map((f) => resolveField(f, 'number'));
         const booleans = LIMITS_BOOLEAN_FIELD_PATHS.map((f) => resolveField(f, 'boolean'));
-        sendJson(res, 200, { ok: true, fields, booleans, config: cfg });
+        /* PND-221 -- los ajustes de tres estados. El panel pinta el select desde
+         * esta lista; los valores validos salen del mismo lugar que los valida. */
+        const { LIMITS_ENUM_FIELD_PATHS } = await import('../core/limits_config.js');
+        const enums = LIMITS_ENUM_FIELD_PATHS.map((e) => ({
+            ...resolveField(e.field, 'boolean'), kind: 'enum', values: e.values,
+        }));
+        sendJson(res, 200, { ok: true, fields, booleans, enums, config: cfg });
         return;
     }
     if (req.method === 'POST' && url.pathname === '/api/forge/limits') {
@@ -1988,7 +2132,7 @@ async function route(req, res, ctx) {
             sendJson(res, 400, { ok: false, error: 'invalid JSON' });
             return;
         }
-        const { setLimitsField, setLimitsBooleanField, isLimitsBooleanFieldPath, resetLimitsConfig } = await import('../core/limits_config.js');
+        const { setLimitsField, setLimitsBooleanField, isLimitsBooleanFieldPath, resetLimitsConfig, setLimitsEnumField, isLimitsEnumFieldPath, } = await import('../core/limits_config.js');
         if (body.reset === true) {
             const cfg = await resetLimitsConfig();
             sendJson(res, 200, { ok: true, config: cfg });
@@ -1998,6 +2142,21 @@ async function route(req, res, ctx) {
             sendJson(res, 400, { ok: false, error: 'expected {field: string, value: number|boolean} or {reset: true}' });
             return;
         }
+        /* PND-221 -- campos de enumeracion (bridge.directed_mode, bridge.tier). */
+        if (isLimitsEnumFieldPath(body.field)) {
+            if (typeof body.value !== 'string') {
+                sendJson(res, 400, { ok: false, error: 'enum field requires a string value' });
+                return;
+            }
+            try {
+                const cfg = await setLimitsEnumField(body.field, body.value);
+                sendJson(res, 200, { ok: true, config: cfg });
+            }
+            catch (err) {
+                sendJson(res, 400, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+            return;
+        }
         /* alpha.59d -- accept booleans too (Danger Zone toggle +
          * cwd_boundary_strict). Dispatch by field-path type. */
         if (isLimitsBooleanFieldPath(body.field)) {
@@ -2239,11 +2398,20 @@ async function route(req, res, ctx) {
         }
         return;
     }
-    /* Inbox for DIRECTED bridge messages (Pablo 2026-06-19). The bridge host
-     * POSTs here (localhost-only) to push a directed message into this instance.
-     * We gate on the user toggle (limits.bridge.accept_directed) + the busy guard
-     * (the host retries 'busy'), then inject it as an eco-tier chat turn tagged
-     * as coordination, carrying bridge_hop for the loop cap. */
+    /* Inbox for DIRECTED bridge messages (Pablo 2026-06-19; reescrito 2026-10-27
+     * por PND-221..227). El bridge host POSTea aca (solo localhost) para empujar
+     * un mensaje dirigido a esta instancia.
+     *
+     * TRES COSAS CAMBIARON, y las tres venian de la misma raiz -- el canal
+     * trataba distinto al mensaje de otra instancia que al que el dueno tipea:
+     *
+     *  1. Ya NO contesta 'busy'. Siempre acepta y ENCOLA (bridge_inbox.ts); el
+     *     drenaje lo dispara el cierre del turno. La ventana de doce segundos
+     *     que perdio seis de diez mensajes el 27-oct desaparece.
+     *  2. Ya NO fuerza 'eco' ni reescribe el prompt. El texto del emisor llega
+     *     caracter por caracter y la procedencia viaja en metadatos.
+     *  3. El interruptor dejo de ser binario: off / ask / auto, y 'ask' abre el
+     *     modal con el texto literal. */
     if (req.method === 'POST' && url.pathname === '/api/forge/bridge/inbox') {
         const raw = await readBody(req);
         let body;
@@ -2259,57 +2427,121 @@ async function route(req, res, ctx) {
             sendJson(res, 400, { ok: false, accepted: false, reason: 'empty' });
             return;
         }
-        let accept = true;
+        const { enqueueDirected, logBridgeDelivery, senderPort } = await import('./bridge_inbox.js');
+        const fromName = String(body.from_name || 'otra instancia');
+        const fromId = String(body.from || '');
+        const hop = Math.max(0, Math.min(10, Number(body.hop) || 0));
+        const hostDeliveryId = body.delivery_id ? String(body.delivery_id) : '';
+        let mode = 'ask';
         try {
             const { readLimitsConfig } = await import('../core/limits_config.js');
-            accept = (await readLimitsConfig()).bridge.accept_directed;
+            mode = (await readLimitsConfig()).bridge.directed_mode;
         }
         catch {
-            accept = true;
+            mode = 'ask';
         }
-        const fromNameEarly = String(body.from_name || 'otra instancia');
-        if (!accept) {
-            try {
-                console.error('[bridge] directed message from ' + fromNameEarly + ' DROPPED (accept_directed=off)');
-            }
-            catch { /* */ }
+        if (mode === 'off') {
+            await logBridgeDelivery({
+                ts: new Date().toISOString(), delivery_id: hostDeliveryId || '-', direction: 'in',
+                from: fromName, from_port: senderPort(fromId), hop, disposition: 'refused',
+                mode, note: 'directed_mode=off', text_len: text.length,
+            });
             sendJson(res, 200, { ok: true, accepted: false, reason: 'disabled' });
             return;
         }
-        if (isTurnActive()) {
+        const q = enqueueDirected({ from: fromId, from_name: fromName, text, hop });
+        if (hostDeliveryId)
+            bridgeHostDeliveryIds.set(q.delivery_id, hostDeliveryId);
+        await logBridgeDelivery({
+            ts: new Date().toISOString(), delivery_id: hostDeliveryId || '-', direction: 'in',
+            from: fromName, from_port: senderPort(fromId), hop,
+            disposition: q.duplicate_of ? 'duplicate' : 'queued',
+            mode, note: q.evicted ? 'evicted ' + q.evicted : undefined, text_len: text.length,
+        });
+        sendJson(res, 200, {
+            ok: true, accepted: true, queued: true, position: q.position,
+            status: 'queued', delivery_id: hostDeliveryId || q.delivery_id,
+            ...(q.duplicate_of ? { duplicate_of: q.duplicate_of } : {}),
+        });
+        /* Si no hay turno vivo, drenar YA; si hay, lo drena onTurnsIdle. */
+        void drainBridgeInbox(ctx);
+        return;
+    }
+    /* El dueno resolvio el modal de un entrante (modo 'ask'). trust=true suma el
+     * par al allowlist para que el proximo del MISMO emisor no pregunte. */
+    if (req.method === 'POST' && url.pathname === '/api/forge/bridge/approve') {
+        const raw = await readBody(req);
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            sendJson(res, 400, { ok: false, error: 'invalid JSON' });
+            return;
+        }
+        const id = String(body.delivery_id || '');
+        const row = bridgeAsks.get(id);
+        if (!row) {
+            sendJson(res, 404, { ok: false, error: 'no pending bridge message with that id' });
+            return;
+        }
+        bridgeAsks.delete(id);
+        if (body.trust === true) {
             try {
-                console.error('[bridge] directed message from ' + fromNameEarly + ' deferred (busy; host will retry)');
+                const { setBridgeAutoFrom } = await import('../core/limits_config.js');
+                const { senderIdentity } = await import('./bridge_inbox.js');
+                await setBridgeAutoFrom(senderIdentity(row.from, row.from_name), true);
             }
-            catch { /* */ }
-            sendJson(res, 200, { ok: true, accepted: false, reason: 'busy' });
+            catch { /* la confianza es un extra; la ejecucion no depende de ella */ }
+        }
+        const { logBridgeDelivery, composeInjectedTurn } = await import('./bridge_inbox.js');
+        let tier = 'default';
+        try {
+            const { readLimitsConfig } = await import('../core/limits_config.js');
+            tier = (await readLimitsConfig()).bridge.tier;
+        }
+        catch { /* default */ }
+        await logBridgeDelivery({
+            ts: new Date().toISOString(), delivery_id: id, direction: 'in',
+            from: row.from_name, from_port: row.from_port, hop: row.hop,
+            disposition: 'running', mode: 'ask', approved_by: 'owner (panel modal)',
+            text_len: row.text.length,
+        });
+        runInjectedTurn(ctx, composeInjectedTurn(row, tier), id);
+        sendJson(res, 200, { ok: true, running: true });
+        return;
+    }
+    if (req.method === 'POST' && url.pathname === '/api/forge/bridge/reject') {
+        const raw = await readBody(req);
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            sendJson(res, 400, { ok: false, error: 'invalid JSON' });
             return;
         }
-        const fromName = fromNameEarly;
-        const fromId = String(body.from || '');
-        const m = fromId.match(/-(\d+)-\d+$/);
-        const fromPort = m ? m[1] : '';
-        const hop = Math.max(0, Math.min(10, Number(body.hop) || 0));
+        const id = String(body.delivery_id || '');
+        const row = bridgeAsks.get(id);
+        if (!row) {
+            sendJson(res, 404, { ok: false, error: 'no pending bridge message with that id' });
+            return;
+        }
+        bridgeAsks.delete(id);
+        const { logBridgeDelivery } = await import('./bridge_inbox.js');
+        await logBridgeDelivery({
+            ts: new Date().toISOString(), delivery_id: id, direction: 'in',
+            from: row.from_name, from_port: row.from_port, hop: row.hop,
+            disposition: 'refused', mode: 'ask', approved_by: 'owner (panel modal)',
+            note: body.reason ? String(body.reason).slice(0, 200) : 'rejected in modal',
+            text_len: row.text.length,
+        });
         try {
-            console.error('[bridge] injecting directed message from ' + fromName + (fromPort ? ' (:' + fromPort + ')' : '') + ' as a chat turn (hop=' + hop + ')');
+            await ctx.bridge?.reportDelivery(hostIdFor(id), 'refused', 'rejected by owner');
         }
-        catch { /* */ }
-        const tagged = '[Coordinacion entre instancias] Mensaje DIRIGIDO de Forge "' + fromName + '"'
-            + (fromPort ? ' (:' + fromPort + ')' : '') + ':\n\n' + text
-            + '\n\n(Responde en el chat. Si necesitas contestarle por el canal usa yujin.bridge.say con to:"'
-            + (fromPort || fromName) + '". NO reabras el canal salvo que aportes algo nuevo, para no entrar en loop.)';
-        /* Fire-and-forget: the turn runs + streams to the panel via the normal SSE.
-         * eco tier + origin tag + hop. */
-        void fetch('http://127.0.0.1:' + ctx.port + '/api/chat', {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-                messages: [{ role: 'user', content: tagged }],
-                origin: 'bridge',
-                brain_tier_override: 'eco',
-                bridge_hop: hop,
-            }),
-        }).catch(() => undefined);
-        sendJson(res, 200, { ok: true, accepted: true });
+        catch { /* best-effort */ }
+        void drainBridgeInbox(ctx);
+        sendJson(res, 200, { ok: true });
         return;
     }
     if (req.method === 'GET' && url.pathname === '/api/forge/wizard-state') {
@@ -6037,7 +6269,16 @@ async function handleChat(req, res, ctx) {
                 const _previos = sessionStore.messages();
                 const _cola = _previos[_previos.length - 1];
                 if (!_cola || _cola.role !== 'user' || _cola.content !== _nuevo.content) {
-                    sessionStore.append(_nuevo);
+                    /* PND-224 -- la procedencia queda en el transcript como CAMPO. Hasta
+                     * hoy el unico rastro de que un turno venia de otra instancia era el
+                     * preambulo que el receptor le pegaba al prompt, y el recap de
+                     * arranque lo reconocia por esa cadena. Al dejar de editar el prompt,
+                     * la marca tiene que ser estructural o el recap empieza a contar las
+                     * coordinaciones como pedidos del dueno. No viaja al proveedor: cada
+                     * cliente mapea {role, content}. */
+                    const _origen = body.origin === 'bridge' || body.origin === 'mobile'
+                        ? String(body.origin) : null;
+                    sessionStore.append(_origen ? { ..._nuevo, origin: _origen } : _nuevo);
                     void sessionStore.flush();
                 }
             }
@@ -6054,9 +6295,16 @@ async function handleChat(req, res, ctx) {
          *    the extra fields and keep their current end-of-turn behavior. */
         const _xTurnId = (body.origin === 'mobile' ? 'mb-' : body.origin === 'bridge' ? 'br-' : 'dt-') + Date.now().toString(36);
         /* Queda registrado como ESTADO para que el latido de presencia lo
-         * repita: ver el comentario largo en RelayPublisher.presence(). */
-        if (sessionId === DEFAULT_SESSION_ID && lastUserText
-            && body.origin !== 'mobile' && body.origin !== 'bridge') {
+         * repita: ver el comentario largo en RelayPublisher.presence().
+         *
+         * PND-225 -- EL ORIGEN BRIDGE ENTRA ACA. Antes se excluia junto con
+         * 'mobile', y las dos exclusiones NO tenian la misma razon: el telefono se
+         * excluye porque YA muestra su propia burbuja (el turno nacio ahi), pero un
+         * turno pedido por otra instancia no se mostraba en NINGUNA parte -- ni
+         * como turno en vuelo en el panel, ni en el latido de presencia que lee el
+         * telefono. Un turno al que no se le puede llegar es peor que un turno que
+         * falla (es la misma leccion del mapa de turnos activos). */
+        if (sessionId === DEFAULT_SESSION_ID && lastUserText && body.origin !== 'mobile') {
             setInFlightTurn({ id: _xTurnId, user: lastUserText, started_at: new Date().toISOString() });
             turnEcho = { id: _xTurnId, user: lastUserText };
         }
@@ -6064,9 +6312,29 @@ async function handleChat(req, res, ctx) {
             if (body.origin === 'mobile' || body.origin === 'bridge') {
                 try {
                     const { enqueuePanelDispatch } = await import('./panel_queue.js');
-                    enqueuePanelDispatch('system.remote-turn', { source: String(body.origin), id: _xTurnId, user: lastUserText, reply: '' }, new Date().toISOString());
+                    enqueuePanelDispatch('system.remote-turn', {
+                        source: String(body.origin), id: _xTurnId, user: lastUserText, reply: '',
+                        /* La procedencia como dato: el panel puede rotular la burbuja con
+                         * el emisor en vez de dejarla como un pedido anonimo. */
+                        ...(body.origin === 'bridge' ? {
+                            bridge_from: body.bridge_from ? String(body.bridge_from) : undefined,
+                            bridge_from_port: body.bridge_from_port ? String(body.bridge_from_port) : undefined,
+                        } : {}),
+                    }, new Date().toISOString());
                 }
                 catch { /* best-effort */ }
+                /* Y ADEMAS el latido, para el origen bridge: el panel recibe la
+                 * burbuja por la cola de arriba, el telefono necesita el estado. */
+                if (body.origin === 'bridge') {
+                    try {
+                        const pub = getRelayPublisher();
+                        if (pub) {
+                            pub.status('working', { user: lastUserText, turn_id: _xTurnId });
+                            void pub.flush();
+                        }
+                    }
+                    catch { /* best-effort */ }
+                }
             }
             else {
                 try {
@@ -6118,6 +6386,13 @@ async function handleChat(req, res, ctx) {
         catch { /* missing yujin.forge.json -> phase_i, no-op */ }
         const brainSelection = await selectBrainForTurn({
             user_override: brainOverride,
+            /* PND-223 -- quien pidio el override, para que el log no se lo atribuya
+             * a un /eco que nadie tipeo. */
+            override_source: brainOverride
+                ? (body.origin === 'bridge' ? 'bridge_preference'
+                    : body.origin === 'mobile' ? 'api_caller'
+                        : 'slash_command')
+                : undefined,
             caller_hint: 'handleChat',
             user_text: lastUserText,
             history: historyForGate,
@@ -6540,7 +6815,7 @@ async function handleChat(req, res, ctx) {
          * the next turn. Reaches every brain via systemDynamic. */
         const _autoApprove = !!(_limits.danger_zone && _limits.danger_zone.auto_approve_all === true);
         const _cwdStrict = !!(_limits.shell && _limits.shell.cwd_boundary_strict === true);
-        const approvalPostureSection = buildApprovalPostureSection(_autoApprove, _cwdStrict);
+        const approvalPostureSection = buildApprovalPostureSection(_autoApprove, _cwdStrict, body.origin === 'bridge' ? 'bridge' : body.origin === 'mobile' ? 'mobile' : 'panel');
         /* Auto-recall (Pablo 2026-06-21) -- inject a recap of the recent WORK
          * SESSIONS for this project so the model boots knowing what we did the
          * last few days, not only general project knowledge. No LLM call; built
@@ -6709,6 +6984,11 @@ async function handleChat(req, res, ctx) {
                     projectSlug: ctx.projectSlug,
                     bridge: ctx.bridge,
                     bridgeHop,
+                    /* PND-221 -- el origen del turno viaja hasta el dispatcher porque la
+                     * zona de peligro NO se aplica a lo que pidio otro proceso. Ver
+                     * resolveDangerZone en src/nac3/danger_zone.ts. */
+                    turnOrigin: (body.origin === 'bridge' || body.origin === 'mobile'
+                        ? String(body.origin) : 'panel'),
                     ...(sseEmit ? { streamEmit: sseEmit } : {}),
                     /* per-session reanchor for non-default sessions; global for notebook */
                     ...(effReanchor ? { reanchor: effReanchor } : {}),
@@ -7964,21 +8244,34 @@ multiagentEnabled = false) {
  *  this reflects the ACTUAL danger_zone.auto_approve_all + shell.cwd_boundary_
  *  strict config so the model only mentions approval when a modal will really
  *  appear. Read per-turn -> toggling the switch takes effect next turn. */
-export function buildApprovalPostureSection(autoApprove, cwdStrict) {
+export function buildApprovalPostureSection(autoApprove, cwdStrict, turnOrigin) {
     /* Prompt audit E (2026-09-09): only inject a posture block when the LIVE config
      * DEVIATES from the static R8 default (destructive verbs open a modal; shell
      * free). When it matches R8 -- the common case -- say nothing: repeating "a
      * modal opens" and "this OVERRIDES R8" every turn just diluted R8 and burned
      * ~120 tok/turn. The block appears only for the real overrides. */
-    if (!autoApprove && !cwdStrict)
+    const fromBridge = turnOrigin === 'bridge';
+    if (!autoApprove && !cwdStrict && !fromBridge)
         return '';
     const lines = ['\n\nRUNTIME APPROVAL POSTURE (live config -- deviates from the R8 default):'];
-    if (autoApprove) {
+    if (autoApprove && !fromBridge) {
         lines.push('- danger_zone.auto_approve_all = TRUE (autonomous). Destructive verbs '
             + '(git push/commit, rm, fs.write-project-file, shell.exec, ...) EXECUTE '
             + 'IMMEDIATELY with NO approval modal -- this SUSPENDS R8. Do NOT tell the user '
             + 'to approve or say "a modal appears"; just invoke and report.');
     }
+    if (fromBridge) {
+        /* PND-221 -- decirselo al cerebro en el mismo turno, porque si no narra
+         * "ya lo ejecute" sobre algo que quedo esperando un modal. */
+        lines.push('- THIS TURN CAME FROM ANOTHER FORGE INSTANCE (bridge). R8 is IN FORCE '
+            + 'for it'
+            + (autoApprove
+                ? ' even though danger_zone.auto_approve_all = TRUE: that switch is the owner\'s '
+                    + 'decision ABOUT HIMSELF and does not extend to what another process asks. '
+                : '. ')
+            + 'Every destructive / approval-required verb opens the modal and waits. Do NOT '
+            + 'report such an action as done until the modal comes back APPROVED.');
+    }
     if (cwdStrict) {
         lines.push('- shell.cwd_boundary_strict = TRUE. Shell is confined to the project '
             + 'root; commands targeting paths outside it are blocked.');