@miraland-labs/conduit-bridge 0.12.0 → 0.12.2

package/dist/driver.js

@@ -139,17 +139,68 @@ export function buildAssignmentPrompt(context) {
     "- EVERY criterion you mark \"met\" must appear in the acceptance_criteria list of at least one evidence entry. A met criterion with no evidence mapped to it fails the whole delivery — mark it unknown instead, or add the evidence that supports it.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", agentReportTemplate);
     return lines.join("\n");
 }
+/**
+ * Extract report JSON text from an agent reply. Prefers the last closed ```json fence,
+ * then an unclosed ```json fence (truncated replies), then a balanced top-level object.
+ */
+export function extractAgentReportJsonText(text) {
+    const closed = [...text.matchAll(/```json\s*([\s\S]*?)```/gi)];
+    const fromFence = closed.at(-1)?.[1]?.trim();
+    if (fromFence)
+        return fromFence;
+    const unclosed = /```json\s*([\s\S]*)$/i.exec(text);
+    const fromUnclosed = unclosed?.[1]?.trim();
+    if (fromUnclosed)
+        return fromUnclosed;
+    const start = text.lastIndexOf("{");
+    if (start < 0)
+        throw new Error("Agent did not emit the required structured report");
+    return text.slice(start).trim();
+}
+/** Parse JSON, or the first balanced `{...}` object when the candidate is truncated prose. */
+export function parseJsonObjectCandidate(candidate) {
+    try {
+        return JSON.parse(candidate);
+    }
+    catch {
+        const start = candidate.indexOf("{");
+        if (start < 0)
+            throw new Error("Agent emitted malformed report JSON");
+        let depth = 0;
+        let inString = false;
+        for (let i = start; i < candidate.length; i++) {
+            const ch = candidate[i];
+            if (inString) {
+                if (ch === "\\")
+                    i++;
+                else if (ch === '"')
+                    inString = false;
+            }
+            else if (ch === '"')
+                inString = true;
+            else if (ch === "{")
+                depth++;
+            else if (ch === "}" && --depth === 0) {
+                try {
+                    return JSON.parse(candidate.slice(start, i + 1));
+                }
+                catch {
+                    throw new Error("Agent emitted malformed report JSON");
+                }
+            }
+        }
+        throw new Error("Agent emitted malformed report JSON");
+    }
+}
 /** Parse the agent's final fenced JSON block into a bounded report. */
 export function parseAgentReport(text, acceptance) {
-    const blocks = [...text.matchAll(/```json\s*([\s\S]*?)```/g)];
-    const last = blocks.at(-1)?.[1];
-    if (!last)
-        throw new Error("Agent did not emit the required structured report");
     let raw;
     try {
-        raw = JSON.parse(last);
+        raw = parseJsonObjectCandidate(extractAgentReportJsonText(text));
     }
-    catch {
+    catch (error) {
+        if (error instanceof Error && /structured report|malformed report JSON/.test(error.message))
+            throw error;
         throw new Error("Agent emitted malformed report JSON");
     }
     const stringList = z.array(z.string().trim().min(1).max(4_000)).max(100);

package/dist/ensure-pull-request.js

@@ -151,17 +151,20 @@ export async function pushOriginHead(workspace, options = {}) {
     throw new Error(lastMessage);
 }
 /**
- * Bind reported head_commit to the checkout HEAD, then open a PR when still needed.
+ * Bind head_commit to the checkout HEAD, then open a PR when still needed.
+ * Workspace HEAD is authoritative for scoped repository deliveries: agents (especially
+ * Experimental local-fuel lanes) often invent or paste a wrong SHA. Prefer the worktree
+ * over failing a delivery that already committed correctly.
  * Agent-supplied PR URLs skip creation but still require HEAD identity.
  */
 export async function ensureDeliveryPullRequest(input) {
     const readHead = input.readHeadCommit ?? workspaceHeadCommit;
     const push = input.pushOriginHead ?? pushOriginHead;
     let report = adoptPullRequestUrlFromEvidence(input.report, input.repositoryFingerprint);
-    if (report.head_commit && (input.spec.change_scope?.length ?? 0) > 0) {
+    if ((input.spec.change_scope?.length ?? 0) > 0) {
         const head = await readHead(input.workspace);
-        if (!commitsMatch(report.head_commit, head)) {
-            throw new Error(`Delivered head_commit ${report.head_commit} does not match workspace HEAD ${head}`);
+        if (report.head_commit && !commitsMatch(report.head_commit, head)) {
+            console.error(`Agent head_commit ${report.head_commit} does not match workspace HEAD ${head}; using workspace HEAD`);
         }
         report = { ...report, head_commit: head };
     }

package/dist/execution.js

@@ -479,59 +479,76 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             report = parseAgentReport(reportText, spec.acceptance ?? []);
         }
         catch (error) {
-            const parseError = error instanceof Error ? error.message : "Agent delivery report was invalid";
-            const originalReply = reportText;
-            const replyDigest = createHash("sha256").update(originalReply).digest("hex");
-            await client.attemptRequest(taskId, "progress", {
-                phase: "preparing_delivery",
-                message: `Delivery envelope invalid (${redactSecrets(parseError)}); starting the single report-only repair turn without rerunning implementation. Original reply: ${originalReply.length} characters, sha256:${replyDigest}.`,
-                idempotency_key: `bridge:progress:${active.attemptId}:delivery-repair`,
-            });
-            let repaired;
-            try {
-                repaired = await driver.run({
-                    prompt: buildDeliveryRepairPrompt(parseError, originalReply, spec.acceptance ?? []),
-                    workspace: attemptWorkspace,
-                    // Preserve only existing read authority. No write, test, branch, or push
-                    // capability is available while the agent repairs the response envelope.
-                    grants: grants.filter((grant) => grant === "repo_read"),
-                    capabilities: [],
-                    verificationCommands: [],
-                    // Envelope repair is read-only observe authority regardless of the original class.
-                    executionClass: "observe",
-                    resumeSessionId: result.sessionId ?? undefined,
-                    timeoutMs,
-                    model: selection.model,
-                    fuel,
-                    fuelSource,
+            // Pump fuel keeps one repair turn. Local-fuel Experimental lanes (Pi et al.) get a second
+            // read-only repair — truncated JSON fences are common there and re-implementing is wasteful.
+            const maxRepairs = fuelSource === "local" ? 2 : 1;
+            let parseError = error instanceof Error ? error.message : "Agent delivery report was invalid";
+            let previousReply = reportText;
+            let resumeSessionId = result.sessionId ?? undefined;
+            let repaired = null;
+            let parsed = null;
+            for (let repairTurn = 1; repairTurn <= maxRepairs; repairTurn++) {
+                const replyDigest = createHash("sha256").update(previousReply).digest("hex");
+                await client.attemptRequest(taskId, "progress", {
+                    phase: "preparing_delivery",
+                    message: `Delivery envelope invalid (${redactSecrets(parseError)}); starting report-only repair turn ${repairTurn}/${maxRepairs} without rerunning implementation. Original reply: ${previousReply.length} characters, sha256:${replyDigest}.`,
+                    idempotency_key: `bridge:progress:${active.attemptId}:delivery-repair:${repairTurn}`,
                 });
+                try {
+                    repaired = await driver.run({
+                        prompt: buildDeliveryRepairPrompt(parseError, previousReply, spec.acceptance ?? []),
+                        workspace: attemptWorkspace,
+                        // Preserve only existing read authority. No write, test, branch, or push
+                        // capability is available while the agent repairs the response envelope.
+                        grants: grants.filter((grant) => grant === "repo_read"),
+                        capabilities: [],
+                        verificationCommands: [],
+                        // Envelope repair is read-only observe authority regardless of the original class.
+                        executionClass: "observe",
+                        resumeSessionId,
+                        timeoutMs,
+                        model: selection.model,
+                        fuel,
+                        fuelSource,
+                    });
+                }
+                catch (repairError) {
+                    const message = repairError instanceof Error ? repairError.message : "Delivery report repair failed";
+                    await queueTerminal(client, taskId, { action: "fail", body: { error: `Delivery report repair failed: ${message}`, retryable: retryableAgentFailure(message), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
+                    console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
+                    return;
+                }
+                if (repaired.sessionId) {
+                    config.sessions = { ...config.sessions, [taskId]: repaired.sessionId };
+                    resumeSessionId = repaired.sessionId;
+                }
+                if (repaired.status === "failed") {
+                    const message = repaired.error ?? "Delivery report repair failed";
+                    await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: retryableAgentFailure(message), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
+                    console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
+                    return;
+                }
+                previousReply = repaired.resultText ?? "";
+                try {
+                    parsed = parseAgentReport(previousReply, spec.acceptance ?? []);
+                    break;
+                }
+                catch (repairError) {
+                    parseError = repairError instanceof Error ? repairError.message : "Repaired delivery report was invalid";
+                    if (repairTurn >= maxRepairs) {
+                        await queueTerminal(client, taskId, { action: "fail", body: { error: `Delivery report repair exhausted: ${parseError}`, retryable: false, idempotency_key: `bridge:delivery-repair-invalid:${active.attemptId}` } });
+                        console.error(`Assignment ${taskId} exhausted its report-only repair: ${redactSecrets(parseError)}`);
+                        const replyTail = previousReply.slice(-8_000);
+                        console.error(`Assignment ${taskId} repaired reply tail (${previousReply.length} chars total, redacted): ${redactSecrets(replyTail) || "<empty>"}`);
+                        return;
+                    }
+                    console.error(`Assignment ${taskId} report-only repair turn ${repairTurn} still invalid: ${redactSecrets(parseError)}; retrying`);
+                }
             }
-            catch (repairError) {
-                const message = repairError instanceof Error ? repairError.message : "Delivery report repair failed";
-                await queueTerminal(client, taskId, { action: "fail", body: { error: `Delivery report repair failed: ${message}`, retryable: retryableAgentFailure(message), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
-                console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
+            if (!parsed)
                 return;
-            }
-            if (repaired.sessionId)
-                config.sessions = { ...config.sessions, [taskId]: repaired.sessionId };
-            if (repaired.status === "failed") {
-                const message = repaired.error ?? "Delivery report repair failed";
-                await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: retryableAgentFailure(message), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
-                console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
-                return;
-            }
-            try {
-                reportText = repaired.resultText ?? "";
-                report = parseAgentReport(reportText, spec.acceptance ?? []);
-            }
-            catch (repairError) {
-                const message = repairError instanceof Error ? repairError.message : "Repaired delivery report was invalid";
-                await queueTerminal(client, taskId, { action: "fail", body: { error: `Delivery report repair exhausted: ${message}`, retryable: false, idempotency_key: `bridge:delivery-repair-invalid:${active.attemptId}` } });
-                console.error(`Assignment ${taskId} exhausted its report-only repair: ${redactSecrets(message)}`);
-                const replyTail = (repaired.resultText ?? "").slice(-8_000);
-                console.error(`Assignment ${taskId} repaired reply tail (${(repaired.resultText ?? "").length} chars total, redacted): ${redactSecrets(replyTail) || "<empty>"}`);
-                return;
-            }
+            reportText = previousReply;
+            report = parsed;
         }
         try {
             // Mechanical land path: agent may forget gh; Bridge pushes and the control plane opens the PR.
@@ -604,9 +621,10 @@ function buildDeliveryRepairPrompt(parseError, previousReply, acceptance) {
     return [
         "The implementation turn is complete. Perform exactly one report-only repair.",
         "Do not inspect or modify files. Do not run commands or tools. Do not redo implementation.",
-        "Return only one corrected fenced ```json Delivery object and no other prose.",
+        "Return only one corrected fenced ```json Delivery object and no other prose. Close the fence.",
         "Preserve the previous reply's substantive outcome, changes, verification, acceptance statuses, evidence, assumptions, risks, and limitations.",
         "Use only claims and evidence already present in the previous reply. Do not invent evidence, broaden scope, change reported work, or claim a criterion is met without existing supporting evidence.",
+        "Omit head_commit if uncertain — Bridge binds workspace HEAD. Keep pull_request_url only when the previous reply already had a real PR URL.",
         "",
         "REQUIRED DELIVERY SHAPE",
         agentReportTemplate,

package/dist/service.js

@@ -128,11 +128,55 @@ function shellQuote(value) {
  * the next line never ran, and the machine stayed Binding incomplete with the service unloaded.
  * The swap therefore runs in a detached helper that survives the bootout; failures append to the
  * runner log.
+ *
+ * Interactive `ops install` from a terminal must NOT use only the detached path: on some macOS
+ * hosts `launchctl bootstrap` returns EIO (5) from the helper while an in-process bootstrap of the
+ * same plist succeeds. Prefer a synchronous reload when we are not inside the runner service.
+ * Deprecated `launchctl load -w` also returns EIO on modern macOS — use enable + kickstart instead.
  */
 export function launchdSwapCommand(domain, plistPath, log) {
     const plist = shellQuote(plistPath);
     const logQ = shellQuote(log);
-    return `sleep 1; launchctl bootout ${domain}/${SERVICE_LABEL} 2>>${logQ}; launchctl bootstrap ${domain} ${plist} 2>>${logQ} || launchctl load -w ${plist} 2>>${logQ}`;
+    const label = `${domain}/${SERVICE_LABEL}`;
+    return [
+        "sleep 1",
+        `launchctl bootout ${label} 2>>${logQ}`,
+        `launchctl bootstrap ${domain} ${plist} 2>>${logQ}`,
+        `launchctl enable ${label} 2>>${logQ}`,
+        `launchctl kickstart -k ${label} 2>>${logQ}`,
+    ].join("; ");
+}
+function launchdServiceLoaded(domain) {
+    return spawnSync("launchctl", ["print", `${domain}/${SERVICE_LABEL}`], { encoding: "utf8" }).status === 0;
+}
+function sleepMs(ms) {
+    return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+/** True when this process is the LaunchAgent we are about to boot out. */
+export function runningInsideRunnerLaunchAgent() {
+    return process.env.XPC_SERVICE_NAME === SERVICE_LABEL;
+}
+/**
+ * Boot out (ignore miss), bootstrap with retries, then enable + kickstart.
+ * Returns whether `launchctl print` sees the service.
+ */
+export function reloadLaunchdRunnerSync(domain, plistPath) {
+    const label = `${domain}/${SERVICE_LABEL}`;
+    spawnSync("launchctl", ["bootout", label], { encoding: "utf8" });
+    for (let attempt = 0; attempt < 6; attempt++) {
+        const boot = spawnSync("launchctl", ["bootstrap", domain, plistPath], { encoding: "utf8" });
+        if (boot.status === 0 || launchdServiceLoaded(domain))
+            break;
+        spawnSync("launchctl", ["bootout", label], { encoding: "utf8" });
+        // Brief backoff — EIO (5) is often transient right after bootout.
+        const start = Date.now();
+        while (Date.now() - start < 400 * (attempt + 1)) {
+            /* spin */
+        }
+    }
+    spawnSync("launchctl", ["enable", label], { encoding: "utf8" });
+    spawnSync("launchctl", ["kickstart", "-k", label], { encoding: "utf8" });
+    return launchdServiceLoaded(domain);
 }
 export async function installRunnerService(options = {}) {
     const host = platform();
@@ -145,16 +189,25 @@ export async function installRunnerService(options = {}) {
         await mkdir(dirname(plistPath), { recursive: true });
         await mkdir(dirname(logPath()), { recursive: true });
         await writeFile(plistPath, launchdPlist(programArguments, logPath()), { mode: 0o644 });
-        // Detached helper (bootout → bootstrap → load fallback): see launchdSwapCommand for why the
-        // swap must survive this process dying at bootout.
         const domain = `gui/${process.getuid?.() ?? 501}`;
-        spawn("/bin/sh", ["-c", launchdSwapCommand(domain, plistPath, logPath())], { detached: true, stdio: "ignore" }).unref();
-        // Confirm the reloaded service when this process survives to see it (an interactive install).
-        // A self-replacing runner dies at the helper's bootout and the helper still finishes the swap.
         let loaded = false;
-        for (let attempt = 0; attempt < 16 && !loaded; attempt++) {
-            await new Promise((resolveSleep) => setTimeout(resolveSleep, attempt === 0 ? 2000 : 500));
-            loaded = spawnSync("launchctl", ["print", `${domain}/${SERVICE_LABEL}`], { encoding: "utf8" }).status === 0;
+        if (runningInsideRunnerLaunchAgent()) {
+            // Detached helper must survive bootout of this process.
+            spawn("/bin/sh", ["-c", launchdSwapCommand(domain, plistPath, logPath())], { detached: true, stdio: "ignore" }).unref();
+            for (let attempt = 0; attempt < 20 && !loaded; attempt++) {
+                await sleepMs(attempt === 0 ? 2000 : 500);
+                loaded = launchdServiceLoaded(domain);
+            }
+        }
+        else {
+            // Interactive ops install: reload in-process (avoids helper EIO flakiness).
+            loaded = reloadLaunchdRunnerSync(domain, plistPath);
+            for (let attempt = 0; attempt < 10 && !loaded; attempt++) {
+                await sleepMs(500);
+                loaded = launchdServiceLoaded(domain);
+                if (!loaded)
+                    loaded = reloadLaunchdRunnerSync(domain, plistPath);
+            }
         }
         if (!loaded)
             throw new Error(`launchd did not load ${SERVICE_LABEL}; see ${logPath()}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {