@miraland-labs/conduit-bridge 0.16.110 → 0.16.112

package/dist/driver.js

@@ -7,6 +7,18 @@ import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { z } from "zod";
 import { allowsExternalFetch, deniedCommands, executionClassPromptRules, isRunnableVerificationCommand, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+/**
+ * Classify one Cursor `status` / Kiro `whoami` probe. Signed-out phrases win; an unanswered
+ * probe (timeout, spawn error, empty output, or text that names neither state) is unknown.
+ */
+export function readSignInStatus(result, signedInPattern) {
+    const text = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+    if (/not logged in|not authenticated|login required/i.test(text))
+        return "signed_out";
+    if (result.code === 0 && signedInPattern.test(text))
+        return "signed_in";
+    return "unknown";
+}
 /**
  * The bound for this turn.
  *
@@ -1017,10 +1029,10 @@ export const cursorDriver = {
             return { status: "failed", resultText: null, sessionId: null, error: "cursor preflight found no bounded verification command for the test_run grant" };
         }
         // A ~/.cursor directory exists even after logout — ask the CLI itself.
-        // `agent status` exits 0 either way, so the text is the signal.
+        // `agent status` exits 0 either way; only a definite signed_out fails closed.
         if (!process.env.CURSOR_API_KEY) {
             const status = await execute(executable, ["status"], input.workspace, 15_000, undefined, "local");
-            if (status.code !== 0 || !/logged in as/i.test(`${status.stdout}\n${status.stderr}`)) {
+            if (readSignInStatus(status, /logged in as/i) === "signed_out") {
                 return { status: "failed", resultText: null, sessionId: null, error: "cursor has no login (set CURSOR_API_KEY or run `agent login`)" };
             }
         }

package/dist/investigation.js

@@ -18,11 +18,20 @@ import { diffStatSince } from "./git-witness.js";
 import { switchManagedWorkspace } from "./on-shift-apply.js";
 import { execFile } from "node:child_process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { isRunnableVerificationCommand } from "./execution-class.js";
 const execFileAsync = promisify(execFile);
+const tsxLoader = (() => {
+    try {
+        return createRequire(import.meta.url).resolve("tsx");
+    }
+    catch {
+        return "tsx";
+    }
+})();
 const budgetSchema = z.object({
     max_files: z.number().int().min(1).max(24).optional().default(8),
     max_duration_ms: z.number().int().min(10_000).max(15 * 60_000).optional().default(5 * 60_000),
@@ -265,6 +274,29 @@ const PROBE_MAX = 20;
 const PROBE_COMMAND_MAX = 300;
 const PROBE_CHECKS_MAX = 500;
 const PROBE_KEY_MAX = 40;
+const PROBE_HOLDS_LINE = "PROBE HOLDS";
+const PROBE_FAILS_LINE = "PROBE FAILS";
+function lastNonEmptyLine(text) {
+    const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    return lines.at(-1) ?? "";
+}
+function sourceProbeVerdict(exitCode, stdout) {
+    const last = lastNonEmptyLine(stdout);
+    if (exitCode === 0 && last === PROBE_HOLDS_LINE)
+        return "holds";
+    if (exitCode === 1 && last === PROBE_FAILS_LINE)
+        return "fails";
+    return "broken";
+}
+function testProbeVerdict(ran, exitCode) {
+    if (!ran)
+        return "broken";
+    return exitCode === 0 ? "holds" : "fails";
+}
+function probeTail(stderr, stdout) {
+    const stderrTail = stderr.length > PROBE_TAIL_CHARS ? stderr.slice(stderr.length - PROBE_TAIL_CHARS) : stderr;
+    return boundedTail(`${stderrTail}\n${stdout}`, PROBE_TAIL_CHARS);
+}
 function probeEnv() {
     const env = {};
     if (process.env.PATH !== undefined)
@@ -282,14 +314,14 @@ function probeInterpreter(language) {
 }
 function probeFilename(language) {
     if (language === "ts")
-        return "probe.ts";
+        return "probe.mts";
     if (language === "py")
         return "probe.py";
     return "probe.sh";
 }
 function probeArgv(language, file) {
     if (language === "ts")
-        return ["node", "--import", "tsx", file];
+        return ["node", "--import", tsxLoader, file];
     if (language === "py")
         return ["python3", file];
     return ["bash", file];
@@ -314,9 +346,11 @@ async function execProbe(argv, workspace) {
         const err = error;
         if (typeof err.code === "string")
             throw error;
+        const stdout = String(err.stdout ?? "");
+        const stderr = String(err.stderr ?? "");
         return {
-            stdout: String(err.stdout ?? ""),
-            stderr: String(err.stderr || err.message || "probe failed"),
+            stdout,
+            stderr: stdout === "" && stderr === "" ? String(err.message || "probe failed") : stderr,
             code: err.killed === true || typeof err.code !== "number" ? -1 : err.code,
         };
     }
@@ -327,8 +361,9 @@ function witnessRecord(input) {
         kind: input.kind,
         command: clipWitnessField(input.command, PROBE_COMMAND_MAX),
         exit_code: input.exitCode,
-        tail: boundedTail(`${input.stderr.trim()}\n${input.stdout.trim()}`.trim(), PROBE_TAIL_CHARS),
+        tail: probeTail(input.stderr, input.stdout),
         checks: clipWitnessField(input.checks, PROBE_CHECKS_MAX),
+        verdict: input.verdict,
     };
 }
 /**
@@ -346,17 +381,20 @@ export async function runDeliveryVerificationProbes(input) {
             if (!isRunnableVerificationCommand(named)) {
                 witnesses.push(witnessRecord({
                     key: probe.key, kind: "test", command: named, exitCode: -1, stdout: "", stderr: "not a registered command", checks,
+                    verdict: "broken",
                 }));
                 continue;
             }
             let exitCode = -1;
             let stdout = "";
             let stderr = "";
+            let ran = false;
             try {
                 const result = await (input.runCommand ?? runBoundedVerificationCommand)(named, input.workspace);
                 exitCode = result.code;
                 stdout = result.stdout;
                 stderr = result.stderr;
+                ran = true;
             }
             catch (error) {
                 stderr = error instanceof Error ? error.message : String(error);
@@ -364,6 +402,7 @@ export async function runDeliveryVerificationProbes(input) {
             }
             witnesses.push(witnessRecord({
                 key: probe.key, kind: "test", command: named, exitCode, stdout, stderr, checks,
+                verdict: testProbeVerdict(ran, exitCode),
             }));
             continue;
         }
@@ -394,6 +433,7 @@ export async function runDeliveryVerificationProbes(input) {
         }
         witnesses.push(witnessRecord({
             key: probe.key, kind: "probe", command, exitCode, stdout, stderr, checks,
+            verdict: sourceProbeVerdict(exitCode, stdout),
         }));
     }
     return witnesses;

package/dist/preflight.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
 import { resolveMaxTurns } from "./execution-budget.js";
-import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, } from "./driver.js";
+import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, } from "./driver.js";
 import { laneQuota, laneTierBindings, localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 /** Protocol 3: read-only diagnosis can reuse a retained failed-attempt worktree. */
 // 4: each driver snapshot reports diagnosis_read_only, so the control plane can require a
@@ -128,7 +128,35 @@ async function driverCompatibilityFingerprint(driver, workspace, run) {
         features,
     })).digest("hex");
 }
-async function localAuthenticationReady(driver, workspace, run) {
+/** Last definite Cursor/Kiro sign-in answer. Unknown never writes here. */
+export const lastSignIn = new Map();
+export function resetSignInMemoryForTests() {
+    lastSignIn.clear();
+}
+/** Retry once on unknown, then the last definite answer, then signed-in with a warning. */
+export async function resolveSignInAnswer(driver, probe) {
+    const once = async () => {
+        try {
+            return await probe();
+        }
+        catch {
+            return "unknown";
+        }
+    };
+    let answer = await once();
+    if (answer === "unknown")
+        answer = await once();
+    if (answer !== "unknown") {
+        lastSignIn.set(driver, answer);
+        return answer;
+    }
+    const previous = lastSignIn.get(driver);
+    if (previous)
+        return previous;
+    console.warn(`sign-in unverified (${driver})`);
+    return "signed_in";
+}
+export async function localAuthenticationReady(driver, workspace, run) {
     if (driver === "claude-code")
         return hasClaudeLogin();
     if (driver === "codex")
@@ -142,14 +170,12 @@ async function localAuthenticationReady(driver, workspace, run) {
     if (driver === "cursor") {
         if (process.env.CURSOR_API_KEY)
             return true;
-        const status = await run(driverExecutable(driver), ["status"], workspace);
-        return status.code === 0 && /logged in as/i.test(`${status.stdout}\n${status.stderr}`);
+        return (await resolveSignInAnswer(driver, async () => readSignInStatus(await run(driverExecutable(driver), ["status"], workspace), /logged in as/i))) !== "signed_out";
     }
     if (driver === "kiro") {
         if (process.env.KIRO_API_KEY)
             return true;
-        const status = await run(driverExecutable(driver), ["whoami"], workspace);
-        return status.code === 0 && !/not logged in|not authenticated|login required/i.test(`${status.stdout}\n${status.stderr}`);
+        return (await resolveSignInAnswer(driver, async () => readSignInStatus(await run(driverExecutable(driver), ["whoami"], workspace), /\S/))) !== "signed_out";
     }
     // Pi stores provider auth in its own config; CLI has no stable whoami — version probe is enough.
     if (driver === "pi")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.110",
+  "version": "0.16.112",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {