@miraland-labs/conduit-bridge 0.12.2 → 0.12.4

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.11.4` — finalize transport flakes stay **retryable**; stamped **ExecutionClass** is required (fail closed if missing). Heartbeat requires **protocol 2 + preflight** (protocol 1 rejected). Bring lanes online with `drivers online`, then `runner --workspace` or `install-service` (no `--agent` process override). Prefs commands (`fuel`, `drivers online|offline`) do not heartbeat a fake not-ready preflight over a live runner. In-flight claims prefer `runtime.json`; a one-time migrate still adopts legacy `config.json` claims when runtime is absent. Ordinary grants derive server-side as classMax ∩ project ceiling; landing is package `lands`.
+**Package version:** `0.12.3` — `ops connect` asks which org unless `--organization` is passed (does **not** silently reuse a leftover `CONDUIT_ORG` from `ops.env`); `ops install --workspace/--repo` persists declared intent without hand-editing the file; stamped **ExecutionClass** required; heartbeat **protocol 2 + preflight**. Prefer the Connect UI **join** command when switching organizations.
 
 ## Prerequisites
 
@@ -18,19 +18,27 @@ Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connect
 
 ## Easy path (all platforms)
 
-One config file + the same `ops` commands on macOS, Linux, and Windows:
+**Preferred:** copy **join** from Conduit → Computers (includes `--organization` for the org you are signed into), approve, then:
+
+```bash
+npx @miraland-labs/conduit-bridge@latest ops install \
+  --workspace /path/to/repo \
+  --repo https://github.com/org/repo
+npx @miraland-labs/conduit-bridge@latest ops status
+```
+
+**Alternate** (optional `ops.env` for URL/workspace defaults):
 
 ```bash
-# 1) Config once
 mkdir -p ~/.config/conduit
 # Windows: mkdir %USERPROFILE%\.config\conduit
 npx @miraland-labs/conduit-bridge@latest init-ops
 cp ~/conduit/ops/env.example ~/.config/conduit/ops.env
-# edit ops.env  (URL, WORKSPACE, optional REPO, DRIVERS, ROLES)
+# edit: CONDUIT_URL; leave CONDUIT_ORG unset (or commented) so connect asks
 
-# 2) Connect → approve in browser → install
-npx @miraland-labs/conduit-bridge@latest ops connect
-npx @miraland-labs/conduit-bridge@latest ops install
+npx @miraland-labs/conduit-bridge@latest ops connect                 # asks "Join which org?"
+# or: ops connect --organization your-org-slug
+npx @miraland-labs/conduit-bridge@latest ops install --workspace /path/to/repo
 npx @miraland-labs/conduit-bridge@latest ops status
 ```
 
@@ -39,7 +47,7 @@ Later:
 ```bash
 npx @miraland-labs/conduit-bridge@latest ops online cursor
 npx @miraland-labs/conduit-bridge@latest ops offline cursor
-npx @miraland-labs/conduit-bridge@latest ops disconnect
+npx @miraland-labs/conduit-bridge@latest ops disconnect   # then join again to change organizations
 ```
 
 Optional local shortcuts after `init-ops` (same verbs):
@@ -51,7 +59,7 @@ Optional local shortcuts after `init-ops` (same verbs):
 
 **Windows note:** `ops install` brings lanes online and prints a `runner --workspace …` command to keep open (no LaunchAgent). macOS/Linux install a background service.
 
-`ops.env` keys: `CONDUIT_URL`, `CONDUIT_ORG` (optional), `CONDUIT_WORKSPACE`, `CONDUIT_REPO` (optional), `CONDUIT_DRIVERS` (default: auto-detect installed agents), `CONDUIT_ROLES` (default `implement research review`). Values expand `$HOME`, `%USERPROFILE%`, and `~`.
+`ops.env` keys: `CONDUIT_URL`, `CONDUIT_ORG` (optional; leave unset for interactive org prompt on `ops connect`), `CONDUIT_WORKSPACE`, `CONDUIT_REPO` (optional), `CONDUIT_DRIVERS` (default: auto-detect installed agents), `CONDUIT_ROLES` (default `implement research review`). Values expand `$HOME`, `%USERPROFILE%`, and `~`. Prefer `ops install --workspace/--repo` over hand-editing workspace keys.
 
 ## Advanced CLI
 

package/dist/ensure-test-evidence.js

@@ -30,6 +30,61 @@ export function pickVerificationCommand(commands) {
 function argvForBoundedCommand(command) {
     return command.trim().split(/\s+/);
 }
+/**
+ * Why an agent failure needs its own verification run.
+ *
+ * When a driver run fails, `result.error` is `stderr || resultText` — and a coding agent runs its
+ * own verification *inside its tool loop*, so that output never reaches Bridge's stderr. Production
+ * proved the consequence: the failure reason reaching Conduit was a bare git SHA or a chunk of the
+ * agent's echoed source, and Conductor had nothing to diagnose from.
+ *
+ * Running the project's own bounded verification command in the attempt worktree recovers the real
+ * compiler/test output. Read-only by construction: the same bounded command list Bridge already
+ * trusts for test evidence, in the workspace the failed attempt left behind.
+ */
+/**
+ * Bounded commands to try for failure diagnosis. Unlike `pickVerificationCommand` (used for
+ * delivery test evidence), do **not** prefer `npm run test` alone: a green test suite must not
+ * hide a failed typecheck/lint/build that the agent broke.
+ */
+export function diagnosisVerificationCommands(commands) {
+    const bounded = commands
+        .map((command) => command.trim())
+        .filter((command) => command && isBoundedVerificationCommand(command));
+    const nonTest = bounded.filter((command) => !isPreferentialTestCommand(command));
+    const tests = bounded.filter((command) => isPreferentialTestCommand(command));
+    return [...nonTest, ...tests];
+}
+export async function captureVerificationFailure(input) {
+    const commands = diagnosisVerificationCommands(input.verificationCommands);
+    if (commands.length === 0)
+        return null;
+    const run = input.runCommand ?? defaultRunCommand;
+    // Try each bounded command until one fails. First non-zero wins (typecheck before test when both exist).
+    for (const command of commands) {
+        let result;
+        try {
+            result = await run(command, input.workspace);
+        }
+        catch {
+            // Diagnosis is best-effort: try the next command rather than failing the attempt again.
+            continue;
+        }
+        if (result.code === 0)
+            continue;
+        const lines = [
+            `$ ${command}`,
+            ...(result.stdout.trim() ? result.stdout.trim().split("\n") : []),
+            ...(result.stderr.trim() ? result.stderr.trim().split("\n") : []),
+            `exit ${result.code}`,
+        ].map((line) => line.slice(0, 4_000)).slice(0, 120);
+        const text = lines.join("\n").slice(0, 12_000);
+        if (text.trim())
+            return text;
+    }
+    // Every bounded command passed (or none could start): agent failed for another reason.
+    return null;
+}
 async function defaultRunCommand(command, workspace) {
     const argv = argvForBoundedCommand(command);
     const bin = argv[0];

package/dist/execution.js

@@ -8,7 +8,7 @@ import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
 import { ensureDeliveryPullRequest } from "./ensure-pull-request.js";
-import { ensureTestEvidence } from "./ensure-test-evidence.js";
+import { captureVerificationFailure, ensureTestEvidence } from "./ensure-test-evidence.js";
 /** Feedback text for changes_requested summaries (plain string or `{ feedback }`). */
 function changesRequestedFeedback(summary) {
     if (!summary)
@@ -468,8 +468,22 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         if (result.sessionId)
             config.sessions = { ...config.sessions, [taskId]: result.sessionId };
         if (result.status === "failed") {
-            const message = result.error ?? "Agent execution failed";
-            await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: retryableAgentFailure(message), idempotency_key: `bridge:fail:${active.attemptId}` } });
+            const agentMessage = result.error ?? "Agent execution failed";
+            // The agent verifies inside its own tool loop, so its compiler/test output never reaches
+            // result.error — production saw a bare git SHA and echoed source arrive as the "failure
+            // reason", leaving Conductor nothing to diagnose. Re-run the project's bounded verification
+            // in the attempt worktree to recover the real errors. Best-effort: keep the agent's own
+            // message when there is no command, the command cannot run, or the tree actually verifies.
+            const verificationDetail = await captureVerificationFailure({
+                workspace: attemptWorkspace,
+                verificationCommands: liveBrief?.verification ?? [],
+            });
+            const message = verificationDetail
+                ? `Verification failed after the agent run.\n${verificationDetail}`
+                : agentMessage;
+            // Retryability stays keyed to what the agent reported; a recovered verification log describes
+            // the same run and must not silently reclassify an unretryable failure.
+            await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: retryableAgentFailure(agentMessage), idempotency_key: `bridge:fail:${active.attemptId}` } });
             console.error(`Assignment ${taskId} failed: ${redactSecrets(message)}`);
             return;
         }

package/dist/ops.js

@@ -310,14 +310,43 @@ export async function runOps(verb, argv = [], deps = {}) {
         return;
     }
     if (verb === "connect") {
-        if (!env.CONDUIT_URL)
-            throw new Error(`Set CONDUIT_URL in ${defaultOpsEnvPath()}`);
-        const args = ["join", "--url", env.CONDUIT_URL];
-        if (env.CONDUIT_ORG)
-            args.push("--organization", env.CONDUIT_ORG);
+        const { values } = parseArgs({
+            args: argv,
+            options: {
+                organization: { type: "string", short: "o" },
+                url: { type: "string" },
+            },
+            allowPositionals: true,
+        });
+        const url = (values.url?.trim() || env.CONDUIT_URL).trim();
+        if (!url)
+            throw new Error(`Set CONDUIT_URL in ${defaultOpsEnvPath()} or pass --url`);
+        // Never silently reuse CONDUIT_ORG from ops.env — a leftover public-org slug skipped
+        // "Join which org?" and enrolled the wrong workspace. Pass --organization explicitly, or
+        // omit it so join prompts interactively (and suggest the prior slug when present).
+        const organization = values.organization?.trim().toLowerCase() || "";
+        if (organization && !/^[a-z0-9][a-z0-9-]{0,62}$/.test(organization)) {
+            throw new Error("Organization must be its lowercase workspace slug");
+        }
+        const envPath = env.loadedFrom ?? defaultOpsEnvPath();
+        writeOpsEnvFile(envPath, {
+            CONDUIT_URL: url,
+            ...(organization ? { CONDUIT_ORG: organization } : {}),
+        });
+        const args = ["join", "--url", url];
+        if (organization)
+            args.push("--organization", organization);
         for (const role of splitOpsList(env.CONDUIT_ROLES))
             args.push("--capability", role);
-        console.log(`Connecting to ${env.CONDUIT_URL} (roles: ${env.CONDUIT_ROLES})`);
+        console.log(`Connecting to ${url} (roles: ${env.CONDUIT_ROLES})`);
+        if (organization) {
+            console.log(`Organization: ${organization}`);
+        }
+        else {
+            console.log(env.CONDUIT_ORG
+                ? `Organization not set on the command — join will ask. (ops.env still has ${env.CONDUIT_ORG}; type the slug you want now.)`
+                : "Organization not set — join will ask which org to connect.");
+        }
         console.log("Approve this computer in Connect when the browser opens.");
         runBridge(args);
         return;

package/ops/env.example

@@ -8,6 +8,9 @@
 #
 # Replace the placeholders below with YOUR org, local checkout, and (optional) git remote.
 CONDUIT_URL=https://api.conduit.miraland.io
+# Leave CONDUIT_ORG unset so `ops connect` asks "Join which org?".
+# Or pass once: ops connect --organization your-org-slug
+# Prefer the Connect UI join command (includes the org you are signed into).
 # CONDUIT_ORG=your-org-slug
 CONDUIT_WORKSPACE=$HOME/path/to/your-repo
 # CONDUIT_REPO=https://github.com/your-org/your-repo.git

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.12.2",
+  "version": "0.12.4",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {