@miraland-labs/conduit-bridge 0.11.4 → 0.11.9

package/dist/cli.js

@@ -334,7 +334,7 @@ async function initOps() {
     console.log(`Config file (separate): ${envPath}`);
     console.log("");
     console.log("Works the same on macOS, Linux, and Windows via:");
-    console.log(`  ${bridgeUsage("ops", "<connect|install|online|offline|status|disconnect|uninstall>")}`);
+    console.log(`  ${bridgeUsage("ops", "<connect|install|switch|online|offline|status|disconnect|uninstall>")}`);
     console.log("");
     console.log("1. Edit env once:");
     console.log(`   Create folder: ${configDir}`);
@@ -358,7 +358,7 @@ async function initOps() {
 async function opsCommand() {
     const verb = process.argv[3];
     if (!verb || !OPS_VERBS.includes(verb)) {
-        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|online|offline|status|doctor|disconnect|uninstall>", "[driver…]")}`);
+        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|switch|online|offline|status|doctor|disconnect|uninstall>", "[driver…]")}`);
     }
     await runOps(verb, process.argv.slice(4));
 }

package/dist/ensure-pull-request.js

@@ -5,7 +5,10 @@
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { normalizeRepositoryUrl } from "./brief.js";
 const execFileAsync = promisify(execFile);
+/** Mirror execution.ts FORGE_TRANSPORT_PATTERN — keep local to avoid import cycles. */
+const FORGE_TRANSPORT_PATTERN = /unable to access '?https?:\/\/|error in the http2 framing layer|could not resolve host|connection (?:reset|timed out|refused)|\bcurl\b.*\b(?:52|55|56|92)\b|remote end hung up unexpectedly|\brpc failed\b|tls handshake|network is unreachable|operation timed out/i;
 export function needsPullRequest(report, spec, grants) {
     return Boolean(grants.includes("pr_create")
         && (spec.change_scope?.length ?? 0) > 0
@@ -28,6 +31,57 @@ export function commitsMatch(reported, actual) {
         return false;
     return left === right || left.startsWith(right) || right.startsWith(left);
 }
+/** Forge owner/repo identity from a PR / merge-request URL (host/path form used as fingerprint). */
+export function fingerprintFromChangeRequestUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const github = parsed.pathname.match(/^\/([^/]+)\/([^/]+)\/pull\/\d+\/?$/i);
+        if (github)
+            return normalizeRepositoryUrl(`${parsed.host}/${github[1]}/${github[2]}`);
+        const gitlab = parsed.pathname.match(/^\/(.+)\/-\/merge_requests\/\d+\/?$/i);
+        if (gitlab)
+            return normalizeRepositoryUrl(`${parsed.host}/${gitlab[1]}`);
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function pullRequestMatchesRepositoryFingerprint(url, repositoryFingerprint) {
+    if (!repositoryFingerprint)
+        return false;
+    const fromUrl = fingerprintFromChangeRequestUrl(url);
+    if (!fromUrl)
+        return false;
+    return fromUrl === normalizeRepositoryUrl(repositoryFingerprint);
+}
+/**
+ * Agents often put the PR URL only on evidence.uri and omit pull_request_url.
+ * Adopt it so finalize does not re-push and die on a forge blip after the PR already exists —
+ * but only when the URI is this work package's repository (Invariant 11).
+ */
+export function adoptPullRequestUrlFromEvidence(report, repositoryFingerprint) {
+    if (report.pull_request_url && isAbsoluteHttpsUrl(report.pull_request_url)) {
+        if (repositoryFingerprint
+            && !pullRequestMatchesRepositoryFingerprint(report.pull_request_url, repositoryFingerprint)) {
+            throw new Error("pull_request_url does not match the work package repository");
+        }
+        return report;
+    }
+    if (!repositoryFingerprint)
+        return report;
+    for (const item of report.evidence) {
+        const uri = item.uri?.trim();
+        if (!uri || !isAbsoluteHttpsUrl(uri))
+            continue;
+        if (!/\/(?:pull|merge_requests)\/\d+/i.test(uri))
+            continue;
+        if (!pullRequestMatchesRepositoryFingerprint(uri, repositoryFingerprint))
+            continue;
+        return { ...report, pull_request_url: uri };
+    }
+    return report;
+}
 async function workspaceHeadCommit(workspace) {
     const { stdout } = await execFileAsync("git", ["-C", workspace, "rev-parse", "HEAD"], {
         timeout: 30_000,
@@ -38,13 +92,72 @@ async function workspaceHeadCommit(workspace) {
         throw new Error("Could not determine workspace HEAD commit");
     return head;
 }
+function execErrorMessage(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const err = error;
+    const parts = [err.message, err.stderr, err.stdout].filter((part) => Boolean(part && String(part).trim()));
+    return parts.join("\n");
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Push with short forge-transport retries; succeed if remote already has HEAD. */
+export async function pushOriginHead(workspace, options = {}) {
+    const attempts = options.attempts ?? 3;
+    const execGit = options.execGit ?? (async (args) => {
+        const { stdout, stderr } = await execFileAsync("git", ["-C", workspace, ...args], {
+            timeout: 120_000,
+            maxBuffer: 2_000_000,
+        });
+        return { stdout: String(stdout), stderr: String(stderr) };
+    });
+    let lastMessage = "git push failed";
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            await execGit(["push", "-u", "origin", "HEAD"]);
+            return;
+        }
+        catch (error) {
+            lastMessage = execErrorMessage(error);
+            // Remote may already have the branch from the agent's own push.
+            try {
+                const head = (await execGit(["rev-parse", "HEAD"])).stdout.trim().toLowerCase();
+                const remote = (await execGit(["ls-remote", "origin", "HEAD"])).stdout.trim().split(/\s+/)[0]?.toLowerCase() ?? "";
+                // Also check the current branch tip on origin.
+                const branch = (await execGit(["branch", "--show-current"])).stdout.trim();
+                const remoteBranch = branch
+                    ? (await execGit(["ls-remote", "origin", `refs/heads/${branch}`])).stdout.trim().split(/\s+/)[0]?.toLowerCase() ?? ""
+                    : "";
+                if (head && (commitsMatch(head, remote) || commitsMatch(head, remoteBranch))) {
+                    return;
+                }
+            }
+            catch {
+                // fall through to retry / throw
+            }
+            if (attempt < attempts && FORGE_TRANSPORT_PATTERN.test(lastMessage)) {
+                await sleep(750 * attempt);
+                continue;
+            }
+            if (attempt < attempts && /Command failed:\s*git\b.*\bpush\b/i.test(lastMessage) && !lastMessage.includes("rejected")) {
+                // Empty stderr push failures are often transient HTTP/2; retry once more.
+                await sleep(750 * attempt);
+                continue;
+            }
+            throw new Error(lastMessage);
+        }
+    }
+    throw new Error(lastMessage);
+}
 /**
  * Bind reported head_commit to the checkout HEAD, then open a PR when still needed.
  * Agent-supplied PR URLs skip creation but still require HEAD identity.
  */
 export async function ensureDeliveryPullRequest(input) {
     const readHead = input.readHeadCommit ?? workspaceHeadCommit;
-    let report = input.report;
+    const push = input.pushOriginHead ?? pushOriginHead;
+    let report = adoptPullRequestUrlFromEvidence(input.report, input.repositoryFingerprint);
     if (report.head_commit && (input.spec.change_scope?.length ?? 0) > 0) {
         const head = await readHead(input.workspace);
         if (!commitsMatch(report.head_commit, head)) {
@@ -54,10 +167,7 @@ export async function ensureDeliveryPullRequest(input) {
     }
     if (!needsPullRequest(report, input.spec, input.grants))
         return report;
-    await execFileAsync("git", ["-C", input.workspace, "push", "-u", "origin", "HEAD"], {
-        timeout: 120_000,
-        maxBuffer: 2_000_000,
-    });
+    await push(input.workspace);
     const headAfterPush = await readHead(input.workspace);
     if (!report.head_commit || !commitsMatch(report.head_commit, headAfterPush)) {
         throw new Error(`Workspace HEAD changed during push (${report.head_commit} → ${headAfterPush})`);

package/dist/ensure-test-evidence.js

@@ -0,0 +1,125 @@
+/**
+ * When the contract requires test evidence and the agent forgot to paste command output,
+ * Bridge runs one bounded verification command and attaches the verbatim result — same
+ * mechanical-land pattern as ensureDeliveryPullRequest.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { isBoundedVerificationCommand } from "./execution-class.js";
+const execFileAsync = promisify(execFile);
+const TEST_EVIDENCE_DETAILS_MIN = 32;
+export function needsTestEvidence(report, spec, grants) {
+    if (!grants.includes("test_run"))
+        return false;
+    if (!(spec.required_evidence ?? []).includes("test"))
+        return false;
+    const existing = report.evidence.filter((item) => item.kind === "test");
+    if (existing.length === 0)
+        return true;
+    return existing.every((item) => item.details.join("\n").trim().length < TEST_EVIDENCE_DETAILS_MIN);
+}
+export function pickVerificationCommand(commands) {
+    for (const command of commands) {
+        const trimmed = command.trim();
+        if (trimmed && isBoundedVerificationCommand(trimmed))
+            return trimmed;
+    }
+    return null;
+}
+function argvForBoundedCommand(command) {
+    return command.trim().split(/\s+/);
+}
+async function defaultRunCommand(command, workspace) {
+    const argv = argvForBoundedCommand(command);
+    const bin = argv[0];
+    if (!bin)
+        throw new Error("Verification command is empty");
+    try {
+        const { stdout, stderr } = await execFileAsync(bin, argv.slice(1), {
+            cwd: workspace,
+            timeout: 120_000,
+            maxBuffer: 2_000_000,
+            env: process.env,
+        });
+        return { stdout: String(stdout), stderr: String(stderr), code: 0 };
+    }
+    catch (error) {
+        const err = error;
+        return {
+            stdout: String(err.stdout ?? ""),
+            stderr: String(err.stderr ?? err.message ?? "verification failed"),
+            code: typeof err.code === "number" ? err.code : 1,
+        };
+    }
+}
+/**
+ * Bridge may attach genuine command output; it must not invent which criteria that output proves.
+ * Reuse only criteria the agent already mapped onto a test-kind evidence entry (including thin ones
+ * we are replacing). Empty mapping lets validateDeliveryReport reject met-without-evidence.
+ */
+export function criteriaForTestEvidence(report) {
+    const mapped = new Set();
+    for (const item of report.evidence) {
+        if (item.kind !== "test")
+            continue;
+        for (const criterion of item.acceptance_criteria ?? []) {
+            if (criterion)
+                mapped.add(criterion);
+        }
+    }
+    return [...mapped];
+}
+/**
+ * If test evidence is required and missing/thin, run one bounded verification command
+ * in the attempt workspace and attach verbatim stdout/stderr.
+ */
+export async function ensureTestEvidence(input) {
+    if (!needsTestEvidence(input.report, input.spec, input.grants))
+        return input.report;
+    const command = pickVerificationCommand(input.verificationCommands);
+    if (!command) {
+        throw new Error("Agent report is missing required evidence: test (no bounded verification command available for Bridge to run)");
+    }
+    const run = input.runCommand ?? defaultRunCommand;
+    const result = await run(command, input.workspace);
+    // Silent success is valid for bounded targets like `make test` (`@test -f …` prints nothing).
+    // Still record an explicit no-output line so control-plane verbatim-detail checks pass.
+    const stdoutLines = result.stdout.trim() ? result.stdout.trim().split("\n") : [];
+    const stderrLines = result.stderr.trim() ? result.stderr.trim().split("\n") : [];
+    const details = [
+        `$ ${command}`,
+        ...stdoutLines,
+        ...stderrLines,
+        ...(stdoutLines.length === 0 && stderrLines.length === 0
+            ? ["(no stdout/stderr — command exited with the status below)"]
+            : []),
+        `exit ${result.code}`,
+    ].map((line) => line.slice(0, 4_000)).slice(0, 100);
+    if (result.code !== 0) {
+        // Prefix must match FINALIZE_CONTRACT_PATTERN ("Agent report") — not Bridge-fault laundering.
+        throw new Error(`Agent report: Verification failed (${command}): ${details.join("\n").slice(0, 2_000)}`);
+    }
+    if (details.join("\n").trim().length < TEST_EVIDENCE_DETAILS_MIN) {
+        throw new Error(`Agent report: Verification produced insufficient output for test evidence (${command})`);
+    }
+    const withoutThinTest = input.report.evidence.filter((item) => {
+        if (item.kind !== "test")
+            return true;
+        return item.details.join("\n").trim().length >= TEST_EVIDENCE_DETAILS_MIN;
+    });
+    return {
+        ...input.report,
+        verification: input.report.verification.includes(command)
+            ? input.report.verification
+            : [...input.report.verification, `${command} — exit ${result.code}`],
+        evidence: [
+            ...withoutThinTest,
+            {
+                kind: "test",
+                name: command,
+                details,
+                acceptance_criteria: criteriaForTestEvidence(input.report),
+            },
+        ],
+    };
+}

package/dist/execution.js

@@ -8,6 +8,7 @@ import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
 import { ensureDeliveryPullRequest } from "./ensure-pull-request.js";
+import { ensureTestEvidence } from "./ensure-test-evidence.js";
 /** Feedback text for changes_requested summaries (plain string or `{ feedback }`). */
 function changesRequestedFeedback(summary) {
     if (!summary)
@@ -543,6 +544,15 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                 spec,
                 grants,
                 title: task.objective,
+                repositoryFingerprint: executionContract.repository_fingerprint,
+            });
+            // Mechanical test path: agent often forgets verbatim make test / npm test output.
+            report = await ensureTestEvidence({
+                workspace: attemptWorkspace,
+                report,
+                spec,
+                grants,
+                verificationCommands: liveBrief?.verification ?? [],
             });
             validateDeliveryReport(report, spec, grants);
         }

package/dist/ops.js

@@ -3,13 +3,15 @@
  * Invoked as: npx @miraland-labs/conduit-bridge ops <connect|install|…>
  */
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { ConduitClient } from "./client.js";
 import { loadConfig } from "./config.js";
 import { describePreflightIssue, runBridgePreflight } from "./preflight.js";
 export const OPS_VERBS = [
-    "connect", "install", "online", "offline", "status", "doctor", "disconnect", "uninstall",
+    "connect", "install", "switch", "online", "offline", "status", "doctor", "disconnect", "uninstall",
 ];
 const LOCAL_FUEL_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity"]);
 export function defaultOpsEnvPath(home = homedir()) {
@@ -88,6 +90,36 @@ export function requireOpsEnv(env) {
 export function splitOpsList(value) {
     return value.split(/[,\s]+/).map((item) => item.trim()).filter(Boolean);
 }
+/** Update keys in an existing ops.env (or create from current values). Preserves comments/unknown keys when possible. */
+export function writeOpsEnvFile(path, patch, existingText) {
+    mkdirSync(dirname(path), { recursive: true });
+    const keys = ["CONDUIT_URL", "CONDUIT_ORG", "CONDUIT_WORKSPACE", "CONDUIT_REPO", "CONDUIT_DRIVERS", "CONDUIT_ROLES"];
+    const current = existingText ?? (existsSync(path) ? readFileSync(path, "utf8") : "");
+    const lines = current ? current.split(/\r?\n/) : [];
+    const seen = new Set();
+    const next = lines.map((raw) => {
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            return raw;
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            return raw;
+        const key = trimmed.slice(0, eq).trim();
+        if (!keys.includes(key))
+            return raw;
+        seen.add(key);
+        const value = patch[key];
+        if (value === undefined)
+            return raw;
+        return `${key}=${value}`;
+    });
+    for (const key of keys) {
+        if (seen.has(key) || patch[key] === undefined)
+            continue;
+        next.push(`${key}=${patch[key]}`);
+    }
+    writeFileSync(path, `${next.filter((line, index) => !(index === next.length - 1 && line === "")).join("\n").replace(/\n*$/, "\n")}`, { mode: 0o600 });
+}
 export function resolveDrivers(env, argv) {
     const fromArgs = argv.map((item) => item.trim()).filter(Boolean);
     const drivers = fromArgs.length ? fromArgs : splitOpsList(env.CONDUIT_DRIVERS);
@@ -175,6 +207,52 @@ export async function runOps(verb, argv = [], deps = {}) {
         return;
     }
     requireOpsEnv(env);
+    if (verb === "switch") {
+        const { values } = parseArgs({
+            args: argv,
+            options: {
+                project: { type: "string" },
+                workspace: { type: "string" },
+                repo: { type: "string" },
+            },
+            allowPositionals: true,
+        });
+        const projectId = values.project?.trim();
+        if (!projectId) {
+            throw new Error("Usage: ops switch --project <project-id> [--workspace <path>] [--repo <url>]");
+        }
+        const workspaceRaw = values.workspace?.trim() || env.CONDUIT_WORKSPACE;
+        if (!workspaceRaw)
+            throw new Error(`Set CONDUIT_WORKSPACE in ${defaultOpsEnvPath()} or pass --workspace`);
+        const workspace = resolve(expandOpsValue(workspaceRaw));
+        const repo = (values.repo?.trim() || env.CONDUIT_REPO || "").trim();
+        const envPath = env.loadedFrom ?? defaultOpsEnvPath();
+        // Control plane first — do not rewrite ops.env if affinity replace fails.
+        const config = await (deps.loadBridgeConfig ?? loadConfig)();
+        const client = new ConduitClient(config);
+        const result = await client.request("/runner/v1/machine/switch-project", {
+            method: "POST",
+            body: JSON.stringify({ project_id: projectId }),
+        });
+        console.log(`Control plane on-shift: ${String(result.project_id ?? projectId)} (${String(result.binding_status ?? "pending")})`);
+        writeOpsEnvFile(envPath, {
+            CONDUIT_WORKSPACE: workspace,
+            ...(repo ? { CONDUIT_REPO: repo } : {}),
+        });
+        console.log(`Updated ${envPath}`);
+        console.log(`On-shift workspace: ${workspace}${repo ? ` (${repo})` : ""}`);
+        // Same install path as ops install — restart runner against the new checkout.
+        const switched = loadOpsEnv();
+        await runOps("install", [], {
+            ...deps,
+            env: {
+                ...switched,
+                CONDUIT_WORKSPACE: workspace,
+                CONDUIT_REPO: repo || switched.CONDUIT_REPO,
+            },
+        });
+        return;
+    }
     if (verb === "connect") {
         if (!env.CONDUIT_URL)
             throw new Error(`Set CONDUIT_URL in ${defaultOpsEnvPath()}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.11.4",
+  "version": "0.11.9",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {