@miraland-labs/conduit-bridge 0.16.133 → 0.16.137

package/dist/config.js

@@ -29,22 +29,6 @@ const runtimePath = join(directory, "runtime.json");
 const lockPath = join(directory, "config.lock");
 const pendingPath = join(directory, "pending-connect.json");
 const installationPath = join(directory, "installation.json");
-/**
- * Prefer runtime.json; when absent, adopt legacy activeAttempts/sessions still on config.json
- * so one Bridge upgrade does not strand in-flight claims.
- */
-export function adoptLegacyRuntimeClaims(input) {
-    if (input.runtime) {
-        return {
-            activeAttempts: input.runtime.activeAttempts ?? {},
-            sessions: input.runtime.sessions,
-        };
-    }
-    return {
-        activeAttempts: input.legacyAttempts,
-        sessions: input.legacySessions,
-    };
-}
 export async function loadConfig() {
     const config = await loadConfigIfPresent();
     if (!config)
@@ -71,13 +55,9 @@ export async function loadConfigIfPresent() {
         }
     }
     const runtime = await loadRuntime();
-    const adopted = adoptLegacyRuntimeClaims({
-        runtime,
-        legacyAttempts: config.activeAttempts && typeof config.activeAttempts === "object" ? config.activeAttempts : {},
-        legacySessions: config.sessions && typeof config.sessions === "object" ? config.sessions : undefined,
-    });
-    config.activeAttempts = adopted.activeAttempts;
-    config.sessions = adopted.sessions;
+    // Claims live only in runtime.json; a fresh install has none.
+    config.activeAttempts = runtime?.activeAttempts ?? {};
+    config.sessions = runtime?.sessions;
     for (const active of Object.values(config.activeAttempts))
         active.phase ??= "agent_running";
     if (config.fuelSource !== "local" && config.fuelSource !== "conduit")
@@ -264,24 +244,10 @@ export async function saveConfig(config, options = {}) {
                 diskPrefs = JSON.parse(await readFile(path, "utf8"));
             }
             catch { /* no prior config */ }
-            // One-time migrate: if runtime.json is missing, preserve legacy activeAttempts from config.json.
-            const existingRuntime = await loadRuntime();
-            if (!existingRuntime && diskPrefs) {
-                const legacyAttempts = diskPrefs.activeAttempts && typeof diskPrefs.activeAttempts === "object"
-                    ? diskPrefs.activeAttempts
-                    : {};
-                const legacySessions = diskPrefs.sessions && typeof diskPrefs.sessions === "object"
-                    ? diskPrefs.sessions
-                    : undefined;
-                if (Object.keys(legacyAttempts).length || legacySessions) {
-                    await writeJsonAtomic(runtimePath, { activeAttempts: legacyAttempts, sessions: legacySessions });
-                }
-            }
             const prefs = { ...snapshot, drivers: mergeCurrentDriverQuota(diskPrefs, snapshot.drivers) };
             delete prefs.activeAttempts;
             delete prefs.sessions;
-            const prefsForDisk = { ...prefs, activeAttempts: {}, sessions: undefined };
-            await writeJsonAtomic(path, prefsForDisk);
+            await writeJsonAtomic(path, prefs);
             if (!options.prefsOnly) {
                 const disk = await loadRuntime();
                 await writeJsonAtomic(runtimePath, mergeRuntimeState(disk, {
@@ -342,7 +308,7 @@ async function updateDriverLane(driverId, update) {
             if (!lane || typeof lane !== "object")
                 return;
             update(lane);
-            await writeJsonAtomic(path, { ...prefs, activeAttempts: {}, sessions: undefined });
+            await writeJsonAtomic(path, prefs);
         });
     };
     const next = saveChain.then(run, run);

package/dist/driver.js

@@ -787,15 +787,6 @@ export function claudeCodeFuelEnv(fuelSource, model) {
         return undefined;
     return { ANTHROPIC_MODEL: model, ANTHROPIC_SMALL_FAST_MODEL: model, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" };
 }
-/** Map Conduit grants → Codex sandbox (privileged grants never widen the sandbox). */
-export function codexSandboxForGrants(grants) {
-    if (grants.includes("repo_write") || grants.includes("branch_create") || grants.includes("pr_create") || grants.includes("test_run")) {
-        return "workspace-write";
-    }
-    if (grants.includes("repo_read"))
-        return "read-only";
-    return null;
-}
 /**
  * Codex exec arguments. The sandbox is the enforcement boundary: network stays
  * off inside workspace-write unless the class/capabilities require it.
@@ -2075,12 +2066,6 @@ export function hasGrokLogin(env = process.env) {
     // `~/.grok` exists after install; auth.json is the `grok login` / cached_token file.
     return Boolean(home && existsSync(join(home, ".grok", "auth.json")));
 }
-/** True when local fuel can use a host vendor login for at least one supported agent. */
-export function hasLocalVendorLogin(env = process.env) {
-    return hasClaudeLogin(env) || hasOpenAiLogin(env) || hasCursorLogin(env)
-        || hasOpenCodeLogin(env) || hasKiroLogin(env) || hasAntigravityLogin(env)
-        || hasGrokLogin(env);
-}
 /** Exported for tests — builds the stripped process env with optional Conduit fuel. */
 export function agentProcessEnv(fuel, fuelSource = "conduit", extraEnv) {
     return boundedEnvironment(fuel, fuelSource, extraEnv);

package/dist/ensure-test-evidence.js

@@ -210,7 +210,7 @@ export async function captureVerificationFailure(input) {
         // shown to be the same bug.
         const text = boundedFailureDetail(command, result.stdout.trim() ? result.stdout.trim().split("\n") : [], result.stderr.trim() ? result.stderr.trim().split("\n") : [], result.code, DIAGNOSIS_DETAIL_MAX_CHARS);
         if (text.trim())
-            return text;
+            return { command, detail: text };
     }
     // Every bounded command passed (or none could start): agent failed for another reason.
     return null;
@@ -456,6 +456,18 @@ export function detectGateRanNothing(command, stdout, stderr, code) {
     }
     return null;
 }
+/**
+ * A declared gate that ran and failed. Carries the command as a field so the verification signal
+ * can name the gate without reading it back out of this error's text.
+ */
+export class VerificationFailedError extends Error {
+    command;
+    constructor(command, detail) {
+        super(`Agent report: Verification failed (${command}): ${detail}`);
+        this.name = "VerificationFailedError";
+        this.command = command;
+    }
+}
 /**
  * A declared gate that ran no tests, or that only printed its own usage text: a misconfigured gate,
  * not a failed one. Carries the typed fields `execution.ts` needs to emit the T1 signal — the
@@ -520,7 +532,7 @@ export async function ensureTestEvidence(input) {
                 elided: detail.includes("omitted"),
                 ends_with_exit: detail.trimEnd().endsWith(`exit ${result.code}`),
             }));
-            throw new Error(`Agent report: Verification failed (${command}): ${detail}`);
+            throw new VerificationFailedError(command, detail);
         }
         // Empty exit-0 is not proof — a no-op recipe (`@true`) must not clear required_evidence: test.
         if (stdoutLines.length === 0 && stderrLines.length === 0) {

package/dist/execution.js

@@ -26,7 +26,7 @@ import { ensureLandCommit } from "./ensure-land-commit.js";
 import { AGENT_NO_LAND_COMMIT_PREFIX, AgentNoLandCommitError, agentNoLandCommitMessage, requiresLandCommit } from "./land-contract.js";
 import { agentClaimsRepositoryWork, claimsVsGitMismatch, isLandTreeEmpty, reportClaimsRepositoryWork, } from "./land-git-reality.js";
 const execFileAsync = promisify(execFile);
-import { boundedTail, captureVerificationFailure, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationGateRanNothingError } from "./ensure-test-evidence.js";
+import { boundedTail, captureVerificationFailure, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError } from "./ensure-test-evidence.js";
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureDemonstrationEvidence } from "./ensure-demonstration-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
@@ -472,8 +472,8 @@ export function parseDiagnosticRepairBrief(text) {
     return parsed.data;
 }
 /**
- * The gate command inside the witness line Bridge itself wrote. Mirrored as
- * VERIFICATION_GATE_PATTERN in src/conductor/repair.ts.
+ * The gate command inside the witness line, for the diagnosis prompt. Repair names the gate from
+ * the typed signal; this pattern stays until that prompt moves.
  */
 const VERIFICATION_GATE_PATTERN = /Verification failed \(([^)]+)\)/;
 /** Prompt for Option C: IDE-depth understanding in the retained tree, with write authority absent. */
@@ -1484,7 +1484,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // gate that moved instead of showing two hex strings.
     await client.updateAttempt(taskId, { executionFacts, verificationCommands });
     await client.attemptRequest(taskId, "progress", {
-        phase: diagnosis ? "inspecting" : "changing",
+        phase: diagnosis ? "inspecting" : "agent_running",
         execution_facts: executionFacts,
         message: resuming
             ? `Resuming ${driver.name} after Bridge restart with proven session and worktree.`
@@ -1728,15 +1728,22 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             // transient retry — the one verdict that would run the capped work again at the same price.
             const turnCapReached = result.signal?.kind === "turn_cap";
             const recoverVerification = grants.includes("test_run") && !subscriptionExhausted(agentMessage) && !turnCapReached;
-            if (recoverVerification)
+            if (recoverVerification) {
                 watchdog.phase("verification");
-            const verificationDetail = recoverVerification
+                await client.attemptRequest(taskId, "progress", {
+                    phase: "verifying",
+                    message: "Bridge is running the project's verification commands to read the failure.",
+                    idempotency_key: `bridge:progress:${active.attemptId}:verify-failure`,
+                });
+            }
+            const capturedVerification = recoverVerification
                 ? await captureVerificationFailure({
                     workspace: attemptWorkspace,
                     verificationCommands: attemptBrief?.verification ?? [],
                     acceptance: spec.acceptance ?? [],
                 })
                 : null;
+            const verificationDetail = capturedVerification?.detail ?? null;
             // The vendor named the model as the cause, so the model is what the retry must change. The
             // model rides in the prefix: the control plane cannot read Bridge's selection any other way.
             const diffStat = verificationDetail && attemptWorkspace && startCommit
@@ -1771,8 +1778,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 : subscriptionExhausted(agentMessage)
                     ? { phase: "agent", witness: "vendor", kind: "quota", vendor_message: agentMessage.slice(0, 2_000) }
                     : result.signal
-                        ? verificationDetail
-                            ? { ...result.signal, phase: "verification", witness: "bridge", stderr_tail: undefined, stdout_tail: undefined, ...(diffStat ? { diff_stat: diffStat } : {}) }
+                        ? capturedVerification
+                            ? { ...result.signal, phase: "verification", witness: "bridge", kind: "verification_failed", command: capturedVerification.command, stderr_tail: undefined, stdout_tail: undefined, ...(diffStat ? { diff_stat: diffStat } : {}) }
                             : result.signal
                         : undefined;
             const response = await queueTerminal(client, taskId, { action: "fail", body: {
@@ -2144,6 +2151,13 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 ? await changedPathsSince(attemptWorkspace, deliveryBaseCommit)
                 : null;
             // Mechanical test path: agent often forgets verbatim make test / npm test output.
+            if (grants.includes("test_run")) {
+                await client.attemptRequest(taskId, "progress", {
+                    phase: "verifying",
+                    message: "Bridge is running the project's verification commands.",
+                    idempotency_key: `bridge:progress:${active.attemptId}:verify`,
+                });
+            }
             report = await ensureTestEvidence({
                 workspace: attemptWorkspace,
                 report,
@@ -2221,7 +2235,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             // the same verify-class pre-delivery failure as the driver-failed path above: preserve the
             // exact tree and send the witness marker that arms Conductor diagnosis. Treating it as a
             // delivery-envelope defect would stop before Invariant 23 ever ran.
-            const verificationFailed = /^Agent report: Verification failed \(/.test(message);
+            // The command is the field on the throw, never a parse of this message.
+            const verificationFailed = error instanceof VerificationFailedError;
             const diffStat = verificationFailed && attemptWorkspace
                 ? await diffStatSince(attemptWorkspace, deliveryBaseCommit)
                     .then((stat) => stat?.slice(0, 8_000) ?? null)
@@ -2244,6 +2259,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                             phase: "verification",
                             witness: "bridge",
                             kind: "verification_failed",
+                            command: error.command,
                             ...(diffStat ? { diff_stat: diffStat } : {}),
                         } } : {}),
                     // A rework's own PR may already be open (ensureDeliveryPullRequest ran before this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.133",
+  "version": "0.16.137",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {