@miraland-labs/conduit-bridge 0.1.0 → 0.4.1

package/README.md

@@ -5,29 +5,54 @@ Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connect
 ## Prerequisites
 
 - Node.js 20+
-- **Claude Code** (`claude` on PATH) for automated execution today
+- One supported agent CLI on PATH:
+  - **Claude Code** — `claude` (Conduit pump or Anthropic login)
+  - **Codex** — `codex` (Conduit pump or ChatGPT/OpenAI login). Since the July 2026 ChatGPT desktop merge, Bridge also finds the CLI bundled inside ChatGPT.app when `codex` is not on PATH (macOS)
+  - **OpenCode** — `opencode` (Conduit pump or local provider login)
+  - **Cursor Agent** — `agent` (requires `conduit fuel local` + `CURSOR_API_KEY` / Cursor login)
+  - **Kiro CLI** — `kiro-cli` (requires `conduit fuel local` + `KIRO_API_KEY` / `kiro-cli login`)
+  - **Antigravity** — `agy` (requires `conduit fuel local` + `GEMINI_API_KEY` / `agy login`)
 - macOS or Linux for `install-service` (Windows: keep a terminal runner open)
 
 ## Install / run
 
-No global install required:
-
 ```bash
 npx @miraland-labs/conduit-bridge join --url <https://your-conduit> --organization <slug>
 ```
 
-After approval, keep the computer executing work (not heartbeat-only):
+After approval:
 
 ```bash
 npx @miraland-labs/conduit-bridge runner --agent claude-code --workspace /path/to/repo
-npx @miraland-labs/conduit-bridge install-service --agent claude-code --workspace /path/to/repo
+npx @miraland-labs/conduit-bridge runner --agent codex --workspace /path/to/repo
+npx @miraland-labs/conduit-bridge runner --agent opencode --workspace /path/to/repo
+npx @miraland-labs/conduit-bridge fuel local   # required before cursor / kiro / antigravity
+npx @miraland-labs/conduit-bridge runner --agent cursor --workspace /path/to/repo
+npx @miraland-labs/conduit-bridge runner --agent kiro --workspace /path/to/repo
+npx @miraland-labs/conduit-bridge runner --agent antigravity --workspace /path/to/repo
 ```
 
-Optional global install creates a `conduit` shim on PATH:
+Persist (macOS/Linux):
 
 ```bash
-npm install -g @miraland-labs/conduit-bridge
-conduit join --url <https://your-conduit> --organization <slug>
+npx @miraland-labs/conduit-bridge install-service --agent <claude-code|codex|cursor|opencode|kiro|antigravity> --workspace /path/to/repo
 ```
 
-Detected IDEs (Cursor, VS Code, Codex) are diagnostics only. Execution drivers today: `claude-code` only.
+## Grant enforcement
+
+Every driver enforces the assignment's granted actions with its CLI's native mechanism — never just the prompt:
+
+| Driver | Fuel | Mechanism |
+| --- | --- | --- |
+| `claude-code` | pump or local | `--allowedTools` / `--disallowedTools` per grant; bounded verification commands |
+| `codex` | pump or local | sandbox `read-only` / `workspace-write`; network enabled only with `pr_create`; resumes by thread id |
+| `opencode` | pump or local | `plan`/`build` agents; per-run `opencode.json` bash deny list (shared `deniedCommands`); `--session` resume; `--format json` |
+| `cursor` | local only | per-run `.cursor/cli.json` allowlist (`approvalMode: allowlist`, shared deny list, no `--force`); read-only runs in `--mode plan` |
+| `kiro` | local only | `--trust-tools=fs_read,fs_write,execute_bash` allowlist; `--no-interactive`; `--resume-id`. Tool-level only — no per-command scoping, so a bash grant trusts `execute_bash` wholesale (Antigravity-tier) |
+| `antigravity` | local only | `-p --mode plan` (read-only) / `--mode accept-edits --sandbox` (write). Mode-level, coarser than per-tool; plain-text output; resume not surfaced |
+
+Every driver refuses to start when grants map to nothing, fails closed on missing logins, and shares one denied-command list (merge, force-push, deploy, kubectl, terraform).
+
+**Verification status:**
+- `claude-code`, `codex`, `cursor`, `opencode`, `antigravity` — verified end-to-end against their real CLIs (agy 1.1.3: `-p --mode` args, Google login, plain-text output confirmed through the driver).
+- `kiro` — flag surface and login preflight verified against kiro-cli 2.13.0 (`chat --no-interactive --trust-tools --resume-id`; tool names; `whoami`-based login check that avoids the browser-login hang). A full run is **pending a `KIRO_API_KEY`** — kiro-cli requires auth to execute and cannot be exercised offline.

package/dist/cli.js

@@ -17,6 +17,8 @@ const BRIDGE_NPX = "npx @miraland-labs/conduit-bridge";
 function bridgeUsage(...args) {
     return `${BRIDGE_NPX} ${args.join(" ")}`;
 }
+/** Single source for the --agent placeholder so CLI help never drifts from DRIVERS. */
+const AGENT_PLACEHOLDER = `<${Object.keys(DRIVERS).join("|")}>`;
 function parseFuelSource(value) {
     if (value === undefined)
         return undefined;
@@ -85,7 +87,7 @@ async function join() {
         console.log(`Assignments at once: ${leaseCapacity}`);
         if (fuelSource)
             console.log(`Fuel source: ${fuelSource === "local" ? "local subscription" : "Conduit pump"}`);
-        console.log("Execution today requires Claude Code (`claude` on PATH). Other detected clients are diagnostics only.");
+        console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/kiro/antigravity require local fuel).`);
         console.log("Use --machine <name> to override the computer label.\n");
         const response = await fetch(`${baseUrl}/runner/v1/connect/requests`, {
             method: "POST",
@@ -193,9 +195,9 @@ async function finishConnection(baseUrl, data, fuelSource) {
     console.log(`Fuel source: ${config.fuelSource === "local" ? "local subscription" : "Conduit pump"}`);
     console.log("Heartbeats report capabilities for diagnostics only; matching uses the Connect confirmation. Detected clients never receive grants automatically.");
     console.log(`MCP setup: {"mcpServers":{"conduit":{"command":"npx","args":["-y","@miraland-labs/conduit-bridge","mcp"]}}}`);
-    console.log(`Execute work: ${bridgeUsage("runner", "--agent", "claude-code", "--workspace", "<repo>")}`);
-    console.log(`Keep on shift (macOS/Linux): ${bridgeUsage("install-service", "--agent", "claude-code", "--workspace", "<repo>")}`);
-    console.log(`Flip fuel later: ${bridgeUsage("fuel", "local|conduit")}`);
+    console.log(`Execute work: ${bridgeUsage("runner", "--agent", AGENT_PLACEHOLDER, "--workspace", "<repo>")}`);
+    console.log(`Keep on shift (macOS/Linux): ${bridgeUsage("install-service", "--agent", AGENT_PLACEHOLDER, "--workspace", "<repo>")}`);
+    console.log(`Flip fuel later: ${bridgeUsage("fuel", "local|conduit")} (cursor/kiro/antigravity require local fuel)`);
     console.log("Windows: keep the runner terminal open — install-service is macOS/Linux only.");
     if (Object.keys(fuel).length) {
         console.log(`Fleet fueling: ${Object.keys(fuel).length} project key(s) configured for Conduit /v1`);
@@ -223,7 +225,7 @@ async function installService() {
             agent: { type: "string" }, workspace: { type: "string" }, interval: { type: "string" }, "agent-timeout-minutes": { type: "string" },
         } });
     if (!values.agent || !values.workspace) {
-        throw new Error(`Usage: ${bridgeUsage("install-service", "--agent", "claude-code", "--workspace", "<repository-path>")} (agent + workspace required; heartbeat-only services are not supported)`);
+        throw new Error(`Usage: ${bridgeUsage("install-service", "--agent", AGENT_PLACEHOLDER, "--workspace", "<repository-path>")} (agent + workspace required; heartbeat-only services are not supported)`);
     }
     if (!DRIVERS[values.agent]) {
         throw new Error(`Unknown agent driver: ${values.agent}. Available: ${Object.keys(DRIVERS).join(", ")}`);
@@ -279,7 +281,7 @@ async function runner() {
     const timeoutMs = values["agent-timeout-minutes"] ? Number(values["agent-timeout-minutes"]) * 60_000 : undefined;
     const fuelLabel = config.fuelSource === "local" ? "local subscription" : "Conduit pump";
     if (!driver || !workspace) {
-        console.warn(`WARNING: heartbeat only — no work will execute. Use: ${bridgeUsage("runner", "--agent", "claude-code", "--workspace", "<repo>")}`);
+        console.warn(`WARNING: heartbeat only — no work will execute. Use: ${bridgeUsage("runner", "--agent", AGENT_PLACEHOLDER, "--workspace", "<repo>")}`);
     }
     console.log(`Conduit runner connected to ${config.baseUrl}${driver ? ` — executing via ${driver.name} in ${workspace}` : " — heartbeat only (no --agent)"} (fuel: ${fuelLabel})`);
     for (;;) {

package/dist/client.js

@@ -52,13 +52,21 @@ export class ConduitClient {
         delete this.config.activeAttempts[taskId];
         await this.persist(this.config);
     }
-    /** Rotate and cache a project-scoped gateway fuel key for agent /v1 calls. */
+    /**
+     * Ensure a project-scoped gateway fuel key for agent /v1 calls.
+     * GET creates once (returns secret) or reports provisioned; cache miss after
+     * that uses POST …/rotate so heartbeats never rotate on every claim.
+     */
     async ensureFuel(projectId) {
         const cached = this.config.fuel?.[projectId]?.gatewayKey;
         if (cached)
             return cached;
-        const data = await this.request(`/runner/v1/fuel/${projectId}`);
-        const gatewayKey = String(data.gateway_secret);
+        const peeked = await this.request(`/runner/v1/fuel/${projectId}`);
+        let gatewayKey = typeof peeked.gateway_secret === "string" ? peeked.gateway_secret : "";
+        if (!gatewayKey) {
+            const rotated = await this.request(`/runner/v1/fuel/${projectId}/rotate`, { method: "POST", body: "{}" });
+            gatewayKey = String(rotated.gateway_secret);
+        }
         this.config.fuel = { ...this.config.fuel, [projectId]: { gatewayKey } };
         await this.persist(this.config);
         return gatewayKey;

package/dist/detect.js

@@ -1,9 +1,14 @@
 import { access, constants } from "node:fs/promises";
 import { delimiter, join } from "node:path";
+/** PATH probes for Connect diagnostics — not proof of a Bridge driver. */
 const CLIENTS = [
-    { command: "codex", label: "Codex CLI" },
     { command: "claude", label: "Claude Code" },
+    { command: "codex", label: "Codex CLI" },
+    { command: "opencode", label: "OpenCode" },
+    { command: "agent", label: "Cursor Agent" },
     { command: "cursor", label: "Cursor" },
+    { command: "kiro-cli", label: "Kiro CLI" },
+    { command: "agy", label: "Antigravity" },
     { command: "code", label: "Visual Studio Code" },
 ];
 export async function detectInstalledClients(pathValue = process.env.PATH ?? "", platform = process.platform) {

package/dist/driver.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
 export const evidenceKinds = ["change", "test", "preview", "research", "documentation"];
@@ -20,11 +21,13 @@ export function claudeToolsForGrants(grants, verificationCommands = []) {
         tools.push("Bash(git push:*)", "Bash(gh pr create:*)");
     return tools;
 }
-export const claudeDeniedTools = [
-    "Bash(git merge:*)", "Bash(git rebase:*)", "Bash(git reset --hard:*)", "Bash(git push --force:*)",
-    "Bash(npm run deploy:*)", "Bash(pnpm deploy:*)", "Bash(yarn deploy:*)", "Bash(wrangler deploy:*)",
-    "Bash(kubectl:*)", "Bash(terraform apply:*)",
+/** Commands no driver may ever run, regardless of grants — one source for every driver's deny list. */
+export const deniedCommands = [
+    "git merge", "git rebase", "git reset --hard", "git push --force",
+    "npm run deploy", "pnpm deploy", "yarn deploy", "wrangler deploy",
+    "kubectl", "terraform apply",
 ];
+export const claudeDeniedTools = deniedCommands.map((command) => `Bash(${command}:*)`);
 function isBoundedVerificationCommand(command) {
     return /^(npm run (verify|typecheck|lint|test|build)|pnpm (verify|typecheck|lint|test|build)|yarn (verify|typecheck|lint|test|build)|cargo (test|check)|go test(?: \.\/\.\.\.)?|make (test|check))$/.test(command);
 }
@@ -70,7 +73,7 @@ export function buildAssignmentPrompt(context) {
     }
     if (rework)
         lines.push("", `REWORK FEEDBACK — an independent review returned this delivery; address every point\n${rework}`);
-    lines.push("", "RULES", "- Stay within the change scope and boundaries.", "- Run the relevant verification commands if your permissions allow it, and report their real results.", "- Never merge, deploy, push to protected branches, or touch production.", "- Do not invent evidence. Report unknown when you could not verify a criterion.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", '{"outcome": "one-paragraph summary", "changes": ["path — what changed"], "verification": ["command — result"], "acceptance_results": [{"criterion": "exact criterion text", "status": "met|not_met|unknown"}], "evidence": [{"kind": "change|test|preview|research|documentation", "name": "concise evidence name", "uri": "external URL if one exists", "digest": "optional digest", "details": ["observable result"], "acceptance_criteria": ["exact criterion text supported by this evidence"]}], "assumptions": [], "risks": [], "limitations": [], "head_commit": "full sha of your final commit, omit if none"}');
+    lines.push("", "RULES", "- Stay within the change scope and boundaries.", "- Run the relevant verification commands if your permissions allow it, and report their real results.", "- Never merge, deploy, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", '{"outcome": "one-paragraph summary", "changes": ["path — what changed"], "verification": ["command — result"], "acceptance_results": [{"criterion": "exact criterion text", "status": "met|not_met|unknown"}], "evidence": [{"kind": "change|test|preview|research|documentation", "name": "concise evidence name", "uri": "external URL if one exists", "digest": "optional digest", "details": ["observable result"], "acceptance_criteria": ["exact criterion text supported by this evidence"]}], "assumptions": [], "risks": [], "limitations": [], "head_commit": "full sha of your final commit, omit if none"}');
     return lines.join("\n");
 }
 /** Parse the agent's final fenced JSON block into a bounded report. */
@@ -112,12 +115,12 @@ export const claudeCodeDriver = {
     name: "claude-code",
     async run(input) {
         const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
-        if (fuelSource === "local" && !hasLocalVendorLogin()) {
+        if (fuelSource === "local" && !hasClaudeLogin()) {
             return {
                 status: "failed",
                 resultText: null,
                 sessionId: null,
-                error: "machine set to local fuel but claude-code has no login",
+                error: "machine set to local fuel but claude-code has no login (ANTHROPIC_* or ~/.claude)",
             };
         }
         const tools = claudeToolsForGrants(input.grants, input.verificationCommands);
@@ -153,22 +156,484 @@ export const claudeCodeDriver = {
         return { status: "completed", resultText: message.result ?? "", sessionId };
     },
 };
-export const DRIVERS = { "claude-code": claudeCodeDriver };
-function execute(executable, args, cwd, timeoutMs, fuel, fuelSource = "conduit") {
+/** Map Conduit grants → Codex sandbox (privileged grants never widen the sandbox). */
+export function codexSandboxForGrants(grants) {
+    if (grants.includes("repo_write") || grants.includes("branch_create") || grants.includes("pr_create") || grants.includes("test_run")) {
+        return "workspace-write";
+    }
+    if (grants.includes("repo_read"))
+        return "read-only";
+    return null;
+}
+/**
+ * Codex exec arguments. The sandbox is the enforcement boundary: network stays
+ * off inside workspace-write unless the assignment actually holds pr_create.
+ */
+export function codexExecArgs(input, sandbox) {
+    // exec is non-interactive by design (no approval flag), and `exec resume`
+    // takes the sandbox only as a -c override, not --sandbox.
+    const args = input.resumeSessionId
+        ? ["exec", "resume", "--json", "-c", `sandbox_mode="${sandbox}"`]
+        : ["exec", "--json", "--sandbox", sandbox];
+    if (sandbox === "workspace-write" && input.grants.includes("pr_create")) {
+        args.push("-c", "sandbox_workspace_write.network_access=true");
+    }
+    if (input.resumeSessionId)
+        args.push(input.resumeSessionId);
+    args.push("-");
+    return args;
+}
+/**
+ * Since the July 2026 desktop merge, macOS machines often carry the codex CLI
+ * only inside the ChatGPT app bundle rather than on PATH.
+ */
+export const CODEX_APP_BUNDLE_BINARY = "/Applications/ChatGPT.app/Contents/Resources/codex";
+export function resolveCodexExecutable(env = process.env, platform = process.platform) {
+    const onPath = (env.PATH ?? "").split(":").some((dir) => dir && existsSync(join(dir, "codex")));
+    if (onPath)
+        return "codex";
+    if (platform === "darwin" && existsSync(CODEX_APP_BUNDLE_BINARY))
+        return CODEX_APP_BUNDLE_BINARY;
+    return "codex";
+}
+/** Pull the thread id and final agent message out of `codex exec --json` JSONL events. */
+export function parseCodexJsonl(stdout) {
+    let sessionId = null;
+    let resultText = null;
+    for (const line of stdout.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("{"))
+            continue;
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (typeof event.thread_id === "string")
+            sessionId = event.thread_id;
+        if (event.item?.type === "agent_message" && typeof event.item.text === "string")
+            resultText = event.item.text;
+    }
+    return { sessionId, resultText };
+}
+export const codexDriver = {
+    name: "codex",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        if (fuelSource === "local" && !hasOpenAiLogin()) {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "machine set to local fuel but codex has no login (OPENAI_API_KEY / CODEX_API_KEY / ~/.codex)",
+            };
+        }
+        const sandbox = codexSandboxForGrants(input.grants);
+        if (!sandbox) {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "No Bridge-mapped Codex sandbox for active grants; refusing to start agent",
+            };
+        }
+        // Prompt via stdin avoids ARG_MAX limits on large assignment contracts.
+        const { code, stdout, stderr } = await execute(input.executable ?? resolveCodexExecutable(), codexExecArgs(input, sandbox), input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt);
+        const parsed = parseCodexJsonl(stdout);
+        const resultText = parsed.resultText ?? (stdout || null);
+        if (code !== 0) {
+            return { status: "failed", resultText, sessionId: parsed.sessionId, error: (stderr || stdout || `codex exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText, sessionId: parsed.sessionId };
+    },
+};
+/**
+ * Grants → Cursor CLI permissions (project .cursor/cli.json). With
+ * approvalMode "allowlist" and no --force, any command outside this list is
+ * denied in print mode — the same fail-closed contract as Claude's tool lists.
+ */
+export function cursorPermissionsForGrants(grants, verificationCommands = []) {
+    const allow = [];
+    if (grants.includes("test_run")) {
+        allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Shell(${command})`));
+    }
+    if (grants.includes("branch_create")) {
+        allow.push("Shell(git status)", "Shell(git diff)", "Shell(git add)", "Shell(git commit)", "Shell(git branch)", "Shell(git switch)");
+    }
+    if (grants.includes("pr_create"))
+        allow.push("Shell(git push)", "Shell(gh pr create)");
+    return { allow, deny: deniedCommands.map((command) => `Shell(${command})`) };
+}
+/** Cursor CLI arguments. Read-only assignments run in plan mode — edits are impossible, not just discouraged. */
+export function cursorRunArgs(input) {
+    const args = ["-p", "--output-format", "json", "--workspace", input.workspace];
+    const canChange = ["repo_write", "test_run", "branch_create", "pr_create"].some((grant) => input.grants.includes(grant));
+    if (!canChange)
+        args.push("--mode", "plan");
+    if (input.resumeSessionId)
+        args.push("--resume", input.resumeSessionId);
+    args.push(input.prompt);
+    return args;
+}
+/** Tolerant parse of `--output-format json`: accept the documented shape, fall back to raw text. */
+export function parseCursorOutput(stdout) {
+    try {
+        const parsed = JSON.parse(stdout);
+        const resultText = typeof parsed.result === "string" ? parsed.result : typeof parsed.text === "string" ? parsed.text : stdout;
+        const sessionCandidate = [parsed.session_id, parsed.chat_id, parsed.chatId].find((value) => typeof value === "string");
+        return { resultText, sessionId: sessionCandidate ?? null, isError: parsed.is_error === true || parsed.subtype === "error" };
+    }
+    catch {
+        return { resultText: stdout || null, sessionId: null, isError: false };
+    }
+}
+export const cursorDriver = {
+    name: "cursor",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        // Cursor Agent authenticates with CURSOR_API_KEY / IDE login — not Conduit /v1 Anthropic/OpenAI shims.
+        if (fuelSource === "conduit") {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "cursor driver requires local fuel (CURSOR_API_KEY or Cursor login). Run: npx @miraland-labs/conduit-bridge fuel local",
+            };
+        }
+        if (!input.grants.includes("repo_read") && !input.grants.includes("repo_write")) {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "No Bridge-mapped Cursor access for active grants; refusing to start agent",
+            };
+        }
+        const executable = input.executable ?? "agent";
+        // A ~/.cursor directory exists even after logout — ask the CLI itself.
+        // `agent status` exits 0 either way, so the text is the signal.
+        if (!process.env.CURSOR_API_KEY) {
+            const status = await execute(executable, ["status"], input.workspace, 15_000, undefined, "local");
+            if (status.code !== 0 || /not logged in/i.test(status.stdout)) {
+                return { status: "failed", resultText: null, sessionId: null, error: "cursor has no login (set CURSOR_API_KEY or run `agent login`)" };
+            }
+        }
+        const configured = await withCursorPermissions(input.workspace, cursorPermissionsForGrants(input.grants, input.verificationCommands), () => execute(executable, cursorRunArgs(input), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
+        const { code, stdout, stderr } = configured;
+        const parsed = parseCursorOutput(stdout);
+        if (code !== 0 || parsed.isError) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `cursor agent exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
+    },
+};
+/** Write the assignment's permission contract to .cursor/cli.json for the run, restoring whatever was there before. */
+async function withCursorPermissions(workspace, permissions, run) {
+    const configDir = join(workspace, ".cursor");
+    const configPath = join(configDir, "cli.json");
+    let previous = null;
+    try {
+        previous = await readFile(configPath, "utf8");
+    }
+    catch {
+        previous = null;
+    }
+    let config = { version: 1 };
+    if (previous) {
+        try {
+            config = { ...JSON.parse(previous) };
+        }
+        catch {
+            config = { version: 1 };
+        }
+    }
+    config.permissions = permissions;
+    config.approvalMode = "allowlist";
+    await mkdir(configDir, { recursive: true });
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    try {
+        return await run();
+    }
+    finally {
+        if (previous === null)
+            await rm(configPath, { force: true });
+        else
+            await writeFile(configPath, previous, "utf8");
+    }
+}
+/**
+ * OpenCode routes through any OpenAI/Anthropic-compatible endpoint, so it runs
+ * on Conduit pump fuel or a local login. Read-only assignments use its `plan`
+ * agent (no edit/bash tools); write assignments use `build`.
+ */
+export function openCodeAgentForGrants(grants) {
+    if (["repo_write", "test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant)))
+        return "build";
+    if (grants.includes("repo_read"))
+        return "plan";
+    return null;
+}
+export function openCodeRunArgs(input, agent) {
+    const args = ["run", "--format", "json", "--agent", agent];
+    // plan can never write, so --auto only widens the already-bounded build agent.
+    if (agent === "build")
+        args.push("--auto");
+    if (input.resumeSessionId)
+        args.push("--session", input.resumeSessionId);
+    return args;
+}
+/** Shared deny list as OpenCode `permission.bash` rules (enforced even with `--auto`). */
+export function openCodePermissionConfig() {
+    const bash = {};
+    for (const command of deniedCommands)
+        bash[`${command} *`] = "deny";
+    return { permission: { bash } };
+}
+/** Write opencode.json permission deny rules for the run, restoring any prior file. */
+async function withOpenCodePermissions(workspace, run) {
+    const configPath = join(workspace, "opencode.json");
+    let previous = null;
+    try {
+        previous = await readFile(configPath, "utf8");
+    }
+    catch {
+        previous = null;
+    }
+    let config = {};
+    if (previous) {
+        try {
+            config = { ...JSON.parse(previous) };
+        }
+        catch {
+            config = {};
+        }
+    }
+    const deny = openCodePermissionConfig();
+    const existingPermission = (config.permission && typeof config.permission === "object" && !Array.isArray(config.permission))
+        ? { ...config.permission }
+        : {};
+    const existingBash = (existingPermission.bash && typeof existingPermission.bash === "object" && !Array.isArray(existingPermission.bash))
+        ? { ...existingPermission.bash }
+        : {};
+    config.permission = {
+        ...existingPermission,
+        bash: { ...existingBash, ...deny.permission.bash },
+    };
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    try {
+        return await run();
+    }
+    finally {
+        if (previous === null)
+            await rm(configPath, { force: true });
+        else
+            await writeFile(configPath, previous, "utf8");
+    }
+}
+/**
+ * OpenCode `--format json` streams JSONL events. Verified against opencode 1.18:
+ * assistant text arrives as `{type:"text", part:{type:"text", text:"…"}}`, the
+ * session id is `sessionID` on every event, and failures are `{type:"error",
+ * error:{…}}`. Concatenate text parts so the delivery report's fenced block
+ * survives multi-step runs.
+ */
+export function parseOpenCodeOutput(stdout) {
+    const texts = [];
+    let sessionId = null;
+    let isError = false;
+    let errorMessage = null;
+    const whole = stdout.trim();
+    for (const line of whole.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("{"))
+            continue;
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        const session = [event.sessionID, event.session_id].find((value) => typeof value === "string");
+        if (typeof session === "string")
+            sessionId = session;
+        if (event.type === "text" && event.part?.type === "text" && typeof event.part.text === "string")
+            texts.push(event.part.text);
+        if (event.type === "error") {
+            isError = true;
+            const err = event.error;
+            errorMessage = typeof err === "string" ? err : (typeof err?.data?.message === "string" ? err.data.message : typeof err?.message === "string" ? err.message : null);
+        }
+    }
+    const resultText = texts.length ? texts.join("\n") : (isError && errorMessage ? errorMessage : (whole || null));
+    return { resultText, sessionId, isError };
+}
+export const openCodeDriver = {
+    name: "opencode",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        if (fuelSource === "local" && !hasOpenCodeLogin()) {
+            return { status: "failed", resultText: null, sessionId: null, error: "machine set to local fuel but opencode has no login (auth.json / provider key in ~/.local/share/opencode or ~/.config/opencode)" };
+        }
+        const agent = openCodeAgentForGrants(input.grants);
+        if (!agent) {
+            return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped OpenCode agent for active grants; refusing to start agent" };
+        }
+        const args = openCodeRunArgs(input, agent);
+        args.push(input.prompt);
+        const { code, stdout, stderr } = await withOpenCodePermissions(input.workspace, () => execute(input.executable ?? "opencode", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource));
+        const parsed = parseOpenCodeOutput(stdout);
+        if (code !== 0 || parsed.isError) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `opencode exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
+    },
+};
+/**
+ * Kiro CLI grant map (verified flag surface against kiro-cli 2.13.0).
+ * `--trust-tools` takes a comma-separated allowlist of tool NAMES; anything
+ * outside it prompts, which in `--no-interactive` mode is a hard stop — the
+ * fail-closed contract. Tool names confirmed from the CLI help: fs_read,
+ * fs_write, execute_bash. Note the coarseness: kiro-cli's --trust-tools has no
+ * per-command scoping, so any bash-requiring grant trusts execute_bash wholesale
+ * (Antigravity-tier, not Claude-tier). Fine-grained command allowlisting would
+ * need a kiro agent config file — deferred until it can be verified with a login.
+ */
+export function kiroTrustedTools(grants) {
+    const tools = [];
+    if (grants.includes("repo_read"))
+        tools.push("fs_read");
+    if (grants.includes("repo_write"))
+        tools.push("fs_write");
+    if (["test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant)))
+        tools.push("execute_bash");
+    return tools;
+}
+export function kiroChatArgs(input, trustedTools) {
+    const args = ["chat", "--no-interactive"];
+    if (input.resumeSessionId)
+        args.push("--resume-id", input.resumeSessionId);
+    // Fail closed: an empty allowlist would trust nothing, but we already refused
+    // upstream; passing the explicit list keeps ungranted tools blocked.
+    args.push("--trust-tools", trustedTools.join(","));
+    return args;
+}
+export const kiroDriver = {
+    name: "kiro",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        // Kiro authenticates with KIRO_API_KEY or Builder ID login — not Conduit /v1 shims.
+        if (fuelSource === "conduit") {
+            return { status: "failed", resultText: null, sessionId: null, error: "kiro driver requires local fuel (KIRO_API_KEY or `kiro-cli login`). Run: npx @miraland-labs/conduit-bridge fuel local" };
+        }
+        const trusted = kiroTrustedTools(input.grants);
+        if (!trusted.length) {
+            return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Kiro tools for active grants; refusing to start agent" };
+        }
+        const executable = input.executable ?? "kiro-cli";
+        // ~/.kiro exists even when logged out, so ask the CLI. `whoami` exits non-zero
+        // and prints "Not logged in" when unauthenticated — check before the run so we
+        // never hang on the interactive browser login in --no-interactive mode.
+        if (!hasKiroLogin()) {
+            const who = await execute(executable, ["whoami"], input.workspace, 15_000, undefined, "local");
+            if (who.code !== 0 || /not logged in/i.test(who.stdout + who.stderr)) {
+                return { status: "failed", resultText: null, sessionId: null, error: "kiro has no login (set KIRO_API_KEY or run `kiro-cli login`)" };
+            }
+        }
+        const args = kiroChatArgs(input, trusted);
+        args.push(input.prompt);
+        const { code, stdout, stderr } = await execute(executable, args, input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        if (code !== 0) {
+            return { status: "failed", resultText: stdout || null, sessionId: null, error: (stderr || stdout || `kiro-cli exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText: stdout, sessionId: null };
+    },
+};
+/**
+ * Antigravity's `agy` CLI (verified against agy 1.1.3): non-interactive runs use
+ * `-p`/`--print` with `--mode plan` (read-only) or `--mode accept-edits`. Its
+ * enforcement is mode-level, not per-tool — coarser than Claude, the Cursor tier.
+ * Write mode adds `--sandbox` for terminal restrictions. Output is plain text.
+ */
+export function antigravityModeForGrants(grants) {
+    if (["repo_write", "test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant)))
+        return "accept-edits";
+    if (grants.includes("repo_read"))
+        return "plan";
+    return null;
+}
+export function antigravityRunArgs(input, mode) {
+    const args = ["-p", "--mode", mode];
+    if (mode === "accept-edits")
+        args.push("--sandbox");
+    args.push(input.prompt);
+    return args;
+}
+export const antigravityDriver = {
+    name: "antigravity",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        // Antigravity authenticates with a Google login / GEMINI_API_KEY — not Conduit /v1 shims.
+        if (fuelSource === "conduit") {
+            return { status: "failed", resultText: null, sessionId: null, error: "antigravity driver requires local fuel (GEMINI_API_KEY or `agy` Google login). Run: npx @miraland-labs/conduit-bridge fuel local" };
+        }
+        if (!hasAntigravityLogin()) {
+            return { status: "failed", resultText: null, sessionId: null, error: "antigravity has no login (set GEMINI_API_KEY or sign in with `agy`)" };
+        }
+        const mode = antigravityModeForGrants(input.grants);
+        if (!mode) {
+            return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Antigravity mode for active grants; refusing to start agent" };
+        }
+        // agy print mode emits plain text and does not surface a resumable id, so rework resume is not wired.
+        const { code, stdout, stderr } = await execute(input.executable ?? "agy", antigravityRunArgs({ prompt: input.prompt, grants: input.grants }, mode), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        if (code !== 0) {
+            return { status: "failed", resultText: stdout || null, sessionId: null, error: (stderr || stdout || `agy exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText: stdout, sessionId: null };
+    },
+};
+/** Stable driver ids shown in Connect / CLI. Order is product preference, not exclusivity. */
+export const SUPPORTED_AGENTS = [
+    { id: "claude-code", label: "Claude Code", executableHint: "claude" },
+    { id: "codex", label: "Codex (ChatGPT)", executableHint: "codex" },
+    { id: "cursor", label: "Cursor Agent", executableHint: "agent" },
+    { id: "opencode", label: "OpenCode", executableHint: "opencode" },
+    { id: "kiro", label: "Kiro CLI", executableHint: "kiro-cli" },
+    { id: "antigravity", label: "Antigravity (agy)", executableHint: "agy" },
+];
+export const DRIVERS = {
+    "claude-code": claudeCodeDriver,
+    codex: codexDriver,
+    cursor: cursorDriver,
+    opencode: openCodeDriver,
+    kiro: kiroDriver,
+    antigravity: antigravityDriver,
+};
+function execute(executable, args, cwd, timeoutMs, fuel, fuelSource = "conduit", stdinText) {
     return new Promise((resolve, reject) => {
-        const child = spawn(executable, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: boundedEnvironment(fuel, fuelSource) });
+        const child = spawn(executable, args, {
+            cwd,
+            stdio: [stdinText !== undefined ? "pipe" : "ignore", "pipe", "pipe"],
+            env: boundedEnvironment(fuel, fuelSource),
+        });
         let stdout = "";
         let stderr = "";
         const timer = setTimeout(() => { child.kill("SIGTERM"); setTimeout(() => child.kill("SIGKILL"), 10_000).unref(); }, timeoutMs);
-        child.stdout.on("data", (chunk) => { stdout += chunk.toString(); });
-        child.stderr.on("data", (chunk) => { stderr += chunk.toString(); });
+        child.stdout?.on("data", (chunk) => { stdout += chunk.toString(); });
+        child.stderr?.on("data", (chunk) => { stderr += chunk.toString(); });
         child.on("error", (error) => { clearTimeout(timer); reject(error); });
         child.on("close", (code) => { clearTimeout(timer); resolve({ code, stdout, stderr: stderr.slice(0, 20_000) }); });
+        if (stdinText !== undefined && child.stdin) {
+            child.stdin.write(stdinText);
+            child.stdin.end();
+        }
     });
 }
 const LOCAL_VENDOR_ENV = [
     "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL",
-    "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_API_BASE",
+    "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_API_BASE", "CODEX_API_KEY",
+    "CURSOR_API_KEY", "KIRO_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY",
 ];
 function boundedEnvironment(fuel, fuelSource = "conduit") {
     // Proxy and TLS variables stay: fueled agents must reach Conduit's /v1 on
@@ -183,17 +648,53 @@ function boundedEnvironment(fuel, fuelSource = "conduit") {
         env.ANTHROPIC_BASE_URL = v1;
         env.OPENAI_API_KEY = fuel.gatewayKey;
         env.OPENAI_BASE_URL = v1;
+        env.CODEX_API_KEY = fuel.gatewayKey;
     }
     return env;
 }
-/** True when local fuel can use a host vendor login (env key or Claude credentials dir). */
-export function hasLocalVendorLogin(env = process.env) {
-    if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN || env.OPENAI_API_KEY)
+export function hasClaudeLogin(env = process.env) {
+    if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN)
+        return true;
+    const home = env.HOME;
+    return Boolean(home && existsSync(join(home, ".claude")));
+}
+export function hasOpenAiLogin(env = process.env) {
+    if (env.OPENAI_API_KEY || env.CODEX_API_KEY)
+        return true;
+    const home = env.HOME;
+    return Boolean(home && existsSync(join(home, ".codex", "auth.json")));
+}
+export function hasCursorLogin(env = process.env) {
+    if (env.CURSOR_API_KEY)
+        return true;
+    const home = env.HOME;
+    return Boolean(home && (existsSync(join(home, ".cursor")) || existsSync(join(home, ".config", "cursor"))));
+}
+export function hasOpenCodeLogin(env = process.env) {
+    if (env.OPENAI_API_KEY || env.ANTHROPIC_API_KEY || env.OPENROUTER_API_KEY)
         return true;
     const home = env.HOME;
     if (!home)
         return false;
-    return existsSync(join(home, ".claude"));
+    return existsSync(join(home, ".local", "share", "opencode", "auth.json")) || existsSync(join(home, ".config", "opencode"));
+}
+export function hasKiroLogin(env = process.env) {
+    // Only KIRO_API_KEY is a reliable headless signal: ~/.kiro exists even when
+    // logged out (the IDE creates it), so a login is confirmed at spawn via
+    // `kiro-cli whoami` rather than a directory probe.
+    return Boolean(env.KIRO_API_KEY);
+}
+export function hasAntigravityLogin(env = process.env) {
+    if (env.GEMINI_API_KEY || env.GOOGLE_API_KEY)
+        return true;
+    const home = env.HOME;
+    // agy 1.1.3 stores its Google session state under ~/.gemini (shared with the IDE).
+    return Boolean(home && (existsSync(join(home, ".gemini")) || existsSync(join(home, ".antigravity"))));
+}
+/** True when local fuel can use a host vendor login for at least one supported agent. */
+export function hasLocalVendorLogin(env = process.env) {
+    return hasClaudeLogin(env) || hasOpenAiLogin(env) || hasCursorLogin(env)
+        || hasOpenCodeLogin(env) || hasKiroLogin(env) || hasAntigravityLogin(env);
 }
 /** Exported for tests — builds the stripped process env with optional Conduit fuel. */
 export function agentProcessEnv(fuel, fuelSource = "conduit") {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.1.0",
-  "description": "Conduit Bridge CLI — join, connect, and run local agent work for a Conduit organization",
+  "version": "0.4.1",
+  "description": "Conduit Bridge CLI — join, connect, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {
     "conduit": "dist/cli.js"