@miraland-labs/conduit-bridge 0.15.0 → 0.16.0

package/dist/investigation.js

@@ -11,6 +11,10 @@ import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl } fr
 import { redactSecrets } from "./config.js";
 import { DRIVERS, extractAgentReportJsonText, parseJsonObjectCandidate } from "./driver.js";
 import { pickDriverForClaim, supportsReadOnlyDiagnosis } from "./drivers.js";
+import { changedPathsSince } from "./execution.js";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
 const budgetSchema = z.object({
     max_files: z.number().int().min(1).max(24).optional().default(8),
     max_duration_ms: z.number().int().min(10_000).max(15 * 60_000).optional().default(5 * 60_000),
@@ -25,6 +29,18 @@ export const investigationAssignmentSchema = z.object({
     commit: z.string().nullable().optional().default(null),
     source_attempt_id: z.string().uuid().nullable().optional().default(null),
 });
+/**
+ * Enforcement is a vendor's claim; verification is ours. Both run on every investigation — this only
+ * records which enforcement, if any, was also in force. Lanes with no read-only mode still qualify:
+ * the run happens in a disposable worktree with no remote credential, and it is checked afterwards.
+ */
+export function boundedByForDriver(driverId) {
+    if (driverId === "codex")
+        return "os_sandbox";
+    if (driverId === "claude-code" || driverId === "cursor")
+        return "tool_allowlist";
+    return "observed_clean";
+}
 /** Mirrors the control plane's bounded result contract; anything else is refused before settlement. */
 const investigationBriefSchema = z.object({
     summary: z.string().trim().min(1).max(4_000),
@@ -68,6 +84,42 @@ export function parseInvestigationBrief(text) {
         throw new Error(UNUSABLE_BRIEF);
     return parsed.data;
 }
+/**
+ * Identity of the source workspace: HEAD plus its dirty set. Compared before and after the run so an
+ * observer that reached outside its disposable worktree is caught, not assumed away.
+ */
+async function workspaceFingerprint(workspace) {
+    try {
+        const head = await execFileAsync("git", ["-C", workspace, "rev-parse", "HEAD"], { timeout: 30_000 });
+        const dirty = await execFileAsync("git", ["-C", workspace, "status", "--porcelain"], { timeout: 30_000, maxBuffer: 8_000_000 });
+        return `${head.stdout.trim()}\n${dirty.stdout.trim()}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Prove the run only looked. A write inside the disposable worktree is discarded anyway, but it
+ * means the answer came from a tree that no longer matches the pinned commit — so the brief is not
+ * evidence about that commit and must not be settled as if it were.
+ */
+export async function verifyObservationOnly(input) {
+    const changed = await changedPathsSince(input.attemptWorkspace, input.commit);
+    // Git could not answer. An unverified read-only claim is not a read-only claim.
+    if (changed === null)
+        return { ok: false, error: "observer_unverifiable", detail: "the worktree could not be compared with the pinned commit" };
+    if (changed.length) {
+        return { ok: false, error: "observer_wrote", detail: `${changed.length} path(s) changed under the pinned commit, starting with ${changed.slice(0, 3).join(", ")}` };
+    }
+    const after = await workspaceFingerprint(input.workspace);
+    if (input.fingerprintBefore === null || after === null) {
+        return { ok: false, error: "observer_unverifiable", detail: "the source workspace could not be fingerprinted" };
+    }
+    if (after !== input.fingerprintBefore) {
+        return { ok: false, error: "observer_wrote", detail: "the source workspace changed during the run" };
+    }
+    return { ok: true };
+}
 async function settle(client, investigationId, body) {
     await client.request(`/runner/v1/investigations/${investigationId}/settle`, {
         method: "POST",
@@ -84,12 +136,14 @@ export async function executeNextInvestigation(client, config, workspace, brief,
     const assignment = assignments[0];
     if (!assignment)
         return false;
-    const driverId = pickDriverForClaim(config, null, supportsReadOnlyDiagnosis);
+    // Prefer a lane that enforces read-only, but do not require one. Enforcement is a vendor claim;
+    // the guarantee this lane actually rests on is a disposable worktree plus verification afterwards,
+    // which works the same on every agent — including ones that ship no read-only mode at all.
+    const driverId = pickDriverForClaim(config, null, supportsReadOnlyDiagnosis)
+        ?? pickDriverForClaim(config, null);
     const driver = driverId ? DRIVERS[driverId] : null;
     if (!driver) {
-        // Nothing local can hold the run read-only. Leave it claimable by a capable machine instead of
-        // taking the lease and failing under it.
-        console.error(`Investigation ${assignment.id} skipped: no online lane can enforce read-only access.`);
+        console.error(`Investigation ${assignment.id} skipped: no online lane on this computer.`);
         return false;
     }
     const liveBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
@@ -118,7 +172,8 @@ export async function executeNextInvestigation(client, config, workspace, brief,
         method: "POST",
         body: JSON.stringify({ lease_token: leaseToken }),
     });
-    console.log(`Claiming investigation ${assignment.id} at ${commit}`);
+    console.log(`Claiming investigation ${assignment.id} at ${commit} on ${driverId ?? "the default lane"}`);
+    const fingerprintBefore = await workspaceFingerprint(workspace);
     let attemptWorkspace = null;
     try {
         attemptWorkspace = await createAttemptWorktree({
@@ -144,6 +199,16 @@ export async function executeNextInvestigation(client, config, workspace, brief,
             return true;
         }
         const observed = parseInvestigationBrief(result.resultText ?? "");
+        const check = await verifyObservationOnly({ attemptWorkspace, workspace, commit, fingerprintBefore });
+        if (!check.ok) {
+            // The answer may be perfectly good, but it is no longer an answer about the pinned commit.
+            // Report what happened rather than settling a brief whose ground moved under it.
+            await settle(client, assignment.id, {
+                lease_token: leaseToken, status: "failed", error: `${check.error}: ${check.detail}`.slice(0, 2_000), retryable: true,
+            });
+            console.error(`Investigation ${assignment.id} discarded — ${check.error}: ${check.detail}`);
+            return true;
+        }
         await settle(client, assignment.id, {
             lease_token: leaseToken,
             status: "completed",
@@ -156,6 +221,7 @@ export async function executeNextInvestigation(client, config, workspace, brief,
                     repository_fingerprint: assignment.repository_fingerprint ?? liveRepository ?? "unknown",
                     commit,
                     observed_at: new Date().toISOString(),
+                    bounded_by: boundedByForDriver(driverId),
                     files_read: observed.files_read,
                     bytes_read: observed.bytes_read,
                     commands_run: observed.commands_run,

package/dist/preflight.js

@@ -18,7 +18,7 @@ function modelsFingerprint(config) {
 }
 // Protocol 5 makes the lease-token claim contract explicit. Older Bridges may report a green
 // preflight but cannot claim against the current control plane, so they must be admitted as stale.
-export const BRIDGE_PROTOCOL_VERSION = 6;
+export const BRIDGE_PROTOCOL_VERSION = 7;
 const execFileAsync = promisify(execFile);
 async function defaultCommandRunner(command, args, cwd) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {