@miraland-labs/conduit-bridge 0.16.149 → 0.16.151

package/dist/attempt-worktree.js

@@ -2,7 +2,7 @@
  * F-07 slice 1: one Git worktree per attempt. The install-service source checkout is never the
  * agent cwd; retries must not inherit dirty files from a failed run.
  */
-import { access, appendFile, mkdir, readFile, rm } from "node:fs/promises";
+import { access, appendFile, mkdir, readdir, readFile, rm, stat } from "node:fs/promises";
 import { constants } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { execFile } from "node:child_process";
@@ -118,6 +118,45 @@ export async function removeAttemptWorktree(sourceWorkspace, worktreePath) {
     }
     return true;
 }
+/** A retained worktree the control plane never released is swept after this long. */
+export const STALE_ATTEMPT_WORKTREE_MS = 7 * 24 * 60 * 60_000;
+/**
+ * Removes every retained attempt worktree older than seven days that no attempt of this Bridge is
+ * running in. The control plane releases a retained tree only when its repair settles; a repair
+ * that never settles left the tree on disk for ever (four September trees deleted by hand,
+ * 2026-10-03). A diagnosis runs inside its source attempt's tree, so that tree counts as in use.
+ * Answers the paths it removed.
+ */
+export async function sweepStaleAttemptWorktrees(sourceWorkspace, activeAttempts, now = Date.now()) {
+    const root = join(sourceWorkspace, ".conduit", "attempts");
+    let entries;
+    try {
+        entries = await readdir(root);
+    }
+    catch {
+        return [];
+    }
+    const inUse = new Set();
+    for (const attempt of Object.values(activeAttempts)) {
+        inUse.add(resolve(root, attempt.attemptId));
+        if (attempt.sourceAttemptId)
+            inUse.add(resolve(root, attempt.sourceAttemptId));
+        if (attempt.worktreePath)
+            inUse.add(resolve(attempt.worktreePath));
+    }
+    const removed = [];
+    for (const entry of entries) {
+        const path = join(root, entry);
+        if (inUse.has(resolve(path)))
+            continue;
+        const modified = await stat(path).then((info) => info.isDirectory() ? info.mtimeMs : null, () => null);
+        if (modified === null || now - modified < STALE_ATTEMPT_WORKTREE_MS)
+            continue;
+        if (await removeAttemptWorktree(sourceWorkspace, path))
+            removed.push(path);
+    }
+    return removed;
+}
 /**
  * F-07 safe resume: prove the interrupted attempt still owns this worktree path.
  * Does not check session identity — caller requires config.sessions[taskId] separately.

package/dist/cli.js

@@ -22,7 +22,7 @@ import { buildOnShiftIntentProof, managedWorkspacePath, maybeApplyOnShiftIntent
 import { expandOpsValue, loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { discardWorktreeWrites, pumpExecutionSlots, renewLeases } from "./execution.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
-import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
+import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, gateRehearsalLockHeld, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
 import { refreshSourceWorkspace } from "./workspace-refresh.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
@@ -666,8 +666,9 @@ async function runner() {
                 await heartbeat(client, config, workspace, currentBrief, preflight, intentProof, bootstrapResult);
             }
             await renewLeases(client, config);
+            // Another runner on this computer rehearsing its gate: claim as usual, rehearse on a later cycle.
             if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning && rehearsalPlan?.due
-                && running.size === 0 && Object.keys(config.activeAttempts).length === 0) {
+                && running.size === 0 && Object.keys(config.activeAttempts).length === 0 && !gateRehearsalLockHeld()) {
                 startGateRehearsal(rehearsalPlan.due.workspace, rehearsalPlan.due.plan);
             }
             // No claim while the gate rehearses: the rehearsal measures the gate alone, never beside an attempt.
@@ -767,6 +768,8 @@ function startGateRehearsal(workspace, plan) {
     gateRehearsalRunning = true;
     console.log(`Rehearsing the gate in ${workspace}: ${plan.commands.join(", ")}`);
     void runGateRehearsal(workspace, plan)
+        .then((rehearsal) => { if (rehearsal === "busy")
+        console.log("Gate rehearsal deferred: another runner on this computer is rehearsing"); })
         .catch((error) => console.error(`Gate rehearsal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}`))
         .finally(async () => {
         if (!await workspaceIsClean(workspace))

package/dist/ensure-test-evidence.js

@@ -569,6 +569,23 @@ export class VerificationGateRanNothingError extends Error {
         this.vendorMessage = vendorMessage;
     }
 }
+/**
+ * A declared gate the verification timeout stopped after the agent run: it never exited, so it says
+ * nothing about the change. Carries the command and the output tails the timeout signal needs — the
+ * classifier holds this on the computer operator and never diagnoses or repairs it.
+ */
+export class VerificationGateTimedOutError extends Error {
+    command;
+    stdout;
+    stderr;
+    constructor(command, stdout, stderr, detail) {
+        super(`Agent report: Verification gate did not finish (${command}): ${detail}`);
+        this.name = "VerificationGateTimedOutError";
+        this.command = command;
+        this.stdout = stdout;
+        this.stderr = stderr;
+    }
+}
 /**
  * If test evidence is required, run the bounded verification commands in the attempt workspace
  * and attach verbatim stdout/stderr with Bridge witness markers.
@@ -593,6 +610,13 @@ export async function ensureTestEvidence(input) {
         const result = await run(command, input.workspace);
         const stdoutLines = result.stdout.trim() ? result.stdout.trim().split("\n") : [];
         const stderrLines = result.stderr.trim() ? result.stderr.trim().split("\n") : [];
+        // First, as in the dry run: a gate the timeout stopped never exited, so its partial output and
+        // exit code say nothing about the change. Read as a failed test, it sent a slow computer's
+        // timeout to diagnosis and repair (2026-10-10).
+        if (result.timedOut) {
+            const detail = boundedFailureDetail(command, outputLines(result), result.code);
+            throw new VerificationGateTimedOutError(command, result.stdout, result.stderr, detail);
+        }
         // Checked ahead of both the exit-code and the pass path: `go test` on an empty package exits 0
         // and would otherwise be witnessed as a passing test run that tested nothing.
         const ranNothing = detectGateRanNothing(command, result.stdout, result.stderr, result.code);

package/dist/execution.js

@@ -11,7 +11,7 @@ import { saveDriverOutcome, saveDriverQuota, tierCandidates } from "./config.js"
 import { DRIVERS, acceptanceCriteriaLines, acceptanceReportSkeleton, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, extractAgentReportJsonText, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseJsonObjectCandidate, pickModelCandidate, isSafeModelName, driverExecutable, requireStampedExecutionClass, tierForRisk } from "./driver.js";
 import { assertClassFloor } from "./execution-class.js";
 import { pickDriverForClaim, recordDriverQuota, resolveDriverFuel, resolveDriverFuelProvenance, supportsReadOnlyDiagnosis, clearDriverOutcome, recordDriverTimeout } from "./drivers.js";
-import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
+import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, removeAttemptWorktree, sweepStaleAttemptWorktrees, } from "./attempt-worktree.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, ensureCommitAvailable, fetchOrigin, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
@@ -28,7 +28,7 @@ import { checkpointWorkInProgress, ensureLandCommit } from "./ensure-land-commit
 import { AGENT_NO_LAND_COMMIT_PREFIX, AgentNoLandCommitError, agentNoLandCommitMessage, requiresLandCommit } from "./land-contract.js";
 import { agentClaimsRepositoryWork, claimsVsGitMismatch, isLandTreeEmpty, reportClaimsRepositoryWork, } from "./land-git-reality.js";
 const execFileAsync = promisify(execFile);
-import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
+import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError, VerificationGateTimedOutError, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureDemonstrationEvidence } from "./ensure-demonstration-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
@@ -856,6 +856,14 @@ export async function claimNextAssignment(client, config, workspace, brief, driv
             console.error(`Diagnostic worktree release failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
         }
     }
+    try {
+        for (const swept of await sweepStaleAttemptWorktrees(workspace, config.activeAttempts)) {
+            console.log(`Released stale diagnostic worktree ${swept}`);
+        }
+    }
+    catch (error) {
+        console.error(`Stale worktree sweep failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
+    }
     const assignment = assignments[0];
     if (!assignment)
         return null;
@@ -2244,6 +2252,24 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             validateDeliveryReport(report, spec, grants, actualPaths ?? undefined, deliveryBaseCommit);
         }
         catch (error) {
+            // A gate the timeout stopped never exited, so nothing says the change is at fault: the same
+            // timeout signal the dry run emits, held on the computer operator — never a diagnosis or a
+            // repair brief. Task ce673ef1 (2026-10-10) ran two diagnoses on a CPU-starved `npm run test`.
+            if (error instanceof VerificationGateTimedOutError) {
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: {
+                        error: error.message,
+                        retryable: false,
+                        signal: verificationGateTimeoutSignal({ command: error.command, stderr: error.stderr, stdout: error.stdout }),
+                        ...(report.pull_request_url ? { pull_request_url: report.pull_request_url } : {}),
+                        idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
+                    },
+                });
+                retainAttemptWorktree = response.retain_worktree === true;
+                console.error(`Assignment ${taskId} verification gate did not finish: ${redactSecrets(error.message)}`);
+                return;
+            }
             // A gate that ran no tests is a misconfigured gate, not a failed verification: the delivery
             // pack may be entirely correct. Emit the T1 typed signal and Hold on the computer operator —
             // never a repair attempt or a blind retry, which is what burned six deliveries on 2026-09-04

package/dist/failure-signal.js

@@ -403,6 +403,9 @@ export function verificationRedBaseSignal(input) {
  * The signal Bridge emits when the verification timeout stops a gate on the base commit, before the
  * agent starts. The gate never exited, so it says nothing about the base: read as exit 1, a gate
  * that hung (waiting for input or the network, or on a slow computer) was a red base on the author.
+ *
+ * The delivery gate after the agent run emits it without a base commit: the gate ran on the change,
+ * and a gate that never exited says nothing about the change either.
  */
 export function verificationGateTimeoutSignal(input) {
     return {
@@ -410,7 +413,7 @@ export function verificationGateTimeoutSignal(input) {
         witness: "bridge",
         kind: "timeout",
         command: input.command,
-        base_commit: input.baseCommit,
+        ...(input.baseCommit ? { base_commit: input.baseCommit } : {}),
         exit_code: null,
         ...(input.stderr?.trim() ? { stderr_tail: bounded2k(input.stderr) } : {}),
         ...(input.stdout?.trim() ? { stdout_tail: bounded2k(input.stdout) } : {}),
@@ -562,13 +565,16 @@ export function classifyFailureSignal(signal) {
     // base commit nor a change is known to be at fault. The generic rule read it as a failed test.
     if (signal.phase === "verification" && signal.kind === "timeout") {
         const command = signal.command ?? "the declared gate";
-        const base = signal.base_commit ? shortCommit(signal.base_commit) : "the base commit";
+        // No base commit: the delivery gate after the agent run, on the agent's change.
+        const message = signal.base_commit
+            ? `The verification gate \`${command}\` did not finish on the base commit ${shortCommit(signal.base_commit)} within Bridge's 10-minute limit, so Bridge stopped it before any change was made.`
+            : `The verification gate \`${command}\` did not finish on the agent's change within Bridge's 10-minute limit, so Bridge stopped it before delivery.`;
         return {
             code: "verification_gate_timeout",
             class: "environment",
             disposition: "hold",
             responsible_party: "computer_operator",
-            message: `The verification gate \`${command}\` did not finish on the base commit ${base} within Bridge's 10-minute limit, so Bridge stopped it before any change was made.`,
+            message,
             next_action: `Run \`${command}\` on this computer and find where it hangs — a test that waits for input or the network, or a computer too slow for the gate — then fix it and Recheck. Conduit does not retry or repair a gate that does not finish.`,
             diagnostic_detail: [`$ ${command}`, "stopped after 10 minutes", signal.stderr_tail, signal.stdout_tail].filter(Boolean).join("\n"),
         };

package/dist/preflight.js

@@ -1,6 +1,8 @@
 import { execFile } from "node:child_process";
-import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { link, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
@@ -352,8 +354,78 @@ export async function planGateRehearsals(checkouts, options = {}) {
     }
     return { reports, due };
 }
-/** Run the planned gate once and remember it for the day. Null when no command could start. */
+/**
+ * One gate rehearsal at a time on a computer. The VPS runs two runner services (conduit-runner and
+ * forge-runner); on 2026-10-03 both rehearsed together, each gate slowed the other, and the times
+ * recorded were wrong. Each installation has its own config directory, so the lock lives in the
+ * user's cache directory, which every runner of that user shares. The lock names its holder's
+ * process; a lock whose process is gone is taken over.
+ */
+export function gateRehearsalLockPath() {
+    return join(homedir(), ".cache", "conduit", "gate-rehearsal.lock");
+}
+/** A live process holds the gate rehearsal lock. */
+export function gateRehearsalLockHeld(lockPath = gateRehearsalLockPath()) {
+    let pid;
+    try {
+        pid = Number.parseInt(readFileSync(lockPath, "utf8"), 10);
+    }
+    catch {
+        return false;
+    }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** Take the lock, or answer false when a live process holds it. */
+async function acquireGateRehearsalLock(lockPath) {
+    await mkdir(dirname(lockPath), { recursive: true });
+    // Linked into place whole, so the lock never exists without its holder's pid in it.
+    const claim = `${lockPath}.${randomUUID()}`;
+    await writeFile(claim, `${process.pid}\n`);
+    try {
+        for (let tries = 0; tries < 2; tries += 1) {
+            try {
+                await link(claim, lockPath);
+                return true;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            if (gateRehearsalLockHeld(lockPath))
+                return false;
+            await unlink(lockPath).catch(() => undefined);
+        }
+        return false;
+    }
+    finally {
+        await unlink(claim).catch(() => undefined);
+    }
+}
+/**
+ * Run the planned gate once and remember it for the day. Null when no command could start.
+ * "busy" when another rehearsal on this computer holds the lock: nothing is run or remembered, so
+ * the gate is still due and the next cycle tries again.
+ */
 export async function runGateRehearsal(workspace, plan, options = {}) {
+    const lockPath = options.lockPath ?? gateRehearsalLockPath();
+    if (!await acquireGateRehearsalLock(lockPath))
+        return "busy";
+    try {
+        return await rehearseGate(workspace, plan, options);
+    }
+    finally {
+        await unlink(lockPath).catch(() => undefined);
+    }
+}
+async function rehearseGate(workspace, plan, options) {
     const now = options.now ?? Date.now;
     const run = options.runCommand ?? runBoundedVerificationCommand;
     const commands = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.149",
+  "version": "0.16.151",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {