@miraland-labs/conduit-bridge 0.16.174 → 0.16.180

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.16.125` — the workspace brief reports `declared_demonstration` so the planner knows whether the repository can show itself (docs/historical/KERNEL_HISTORY_2026-09.md §51). Earlier (0.16.124) — when a project declares `.conduit/demonstrate`, Bridge runs that bounded command at the delivered head and attaches a stamped `preview` row (docs/historical/KERNEL_HISTORY_2026-09.md §47). Earlier (0.16.95) — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
+**Package version:** `0.16.176`. Earlier (0.16.125) — the workspace brief reports `declared_demonstration` so the planner knows whether the repository can show itself (docs/historical/KERNEL_HISTORY_2026-09.md §51). Earlier (0.16.124) — when a project declares `.conduit/demonstrate`, Bridge runs that bounded command at the delivered head and attaches a stamped `preview` row (docs/historical/KERNEL_HISTORY_2026-09.md §47). Earlier (0.16.95) — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 
@@ -84,7 +84,7 @@ persisted and excludes only that lane; `online`/`offline` does not erase it. `op
 installation and authentication, not remaining vendor allowance. After deliberately changing an
 account or plan, run `ops quota-clear <driver>` to clear the old observation; this does not probe the
 provider, and the next real claim records another refusal if the new allowance is still unavailable.
-Fix the named issue and let a fresh heartbeat land before choosing **Recheck** in Activity.
+Fix the named issue and let a fresh heartbeat land before choosing **Recheck** in Tasks.
 
 Conduit labels an exact driver/CLI version **Certified** only after two consecutive real canaries:
 repository delivery with PR/evidence and a successful rework cycle. All other lanes are

package/dist/cli.js

@@ -12,7 +12,7 @@ import { assignmentPollBehindServer, ConduitClient, ConduitRequestError } from "
 import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearLocalConnection, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, saveConfig, saveConfigPrefs, saveDriverQuota, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
-import { DRIVERS, MODEL_TIERS } from "./driver.js";
+import { DRIVERS, MODEL_TIERS, probeUntrustedCodeSandbox } from "./driver.js";
 import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriverModels, setDriversOnline, formatLaneTiers, laneDispatchBlock, laneStatuses, } from "./drivers.js";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
 import { parseAgentTimeoutMinutes, parseMaxTurns, resolveMaxTurns } from "./execution-budget.js";
@@ -826,6 +826,7 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
     // heartbeat.
     const preflightToSend = {
         ...preflight,
+        untrusted_code_isolation: await probeUntrustedCodeSandbox(),
         ...(assignmentPollBehindServer() ? { runner_behind_server: true } : {}),
         ...(process.env.CONDUIT_RUNNER_SERVICE === "container" ? { runner_service: "container" } : {}),
         ...(workspacePath && reportedGateRehearsals.length ? { gate_rehearsals: reportedGateRehearsals } : {}),
@@ -890,6 +891,7 @@ async function disconnect() {
     console.log(`Tip: stop a background runner with \`${bridgeUsage("uninstall-service")}\` if one is installed.`);
 }
 try {
+    await probeUntrustedCodeSandbox();
     if (command === "connect")
         await connect();
     else if (command === "join")

package/dist/driver.js

@@ -1,10 +1,15 @@
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { boundedTail } from "./ensure-test-evidence.js";
 import { resolveAgentTimeout, resolveMaxTurns } from "./execution-budget.js";
 import { agentExitSignal, turnCapSignal, vendorKindForAntigravity } from "./failure-signal.js";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { createServer } from "node:net";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { homedir, tmpdir } from "node:os";
+import { promisify } from "node:util";
+import { constants, existsSync } from "node:fs";
+import { access, mkdir, mkdtemp, readFile, readdir, realpath, stat, rm, rmdir, writeFile } from "node:fs/promises";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { z } from "zod";
 import { allowsExternalFetch, deniedCommands, executionClassPromptRules, isRunnableVerificationCommand, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
 /**
@@ -1994,6 +1999,249 @@ export function boundedEnvironment(fuel, fuelSource = "conduit", extraEnv) {
         Object.assign(env, extraEnv);
     return env;
 }
+/**
+ * Gates and probes inherit build caches, never runner credentials or proxy settings.
+ * This environment is not an OS sandbox: direct network routes and same-uid filesystem access
+ * remain available until the hosted-runner sandbox lands. CARGO_HOME is an accepted shared cache.
+ */
+export function untrustedCodeEnvironment(scratchHome) {
+    const allowed = ["PATH", "TMPDIR", "TMP", "TEMP", "LANG", "LANGUAGE", "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR",
+        "CARGO_HOME", "RUSTUP_HOME", "CARGO_TARGET_DIR", "CARGO_INCREMENTAL",
+        ...Object.keys(process.env).filter((name) => name.startsWith("LC_") || name.startsWith("CARGO_PROFILE_"))];
+    return {
+        ...Object.fromEntries(allowed.flatMap((name) => process.env[name] === undefined ? [] : [[name, process.env[name]]])),
+        HOME: scratchHome,
+        XDG_CONFIG_HOME: join(scratchHome, "config"),
+        XDG_CACHE_HOME: join(scratchHome, "cache"),
+        XDG_DATA_HOME: join(scratchHome, "data"),
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_ASKPASS: "",
+        GIT_CONFIG_GLOBAL: "/dev/null",
+        GIT_CONFIG_SYSTEM: "/dev/null",
+        GIT_SSH_COMMAND: "ssh -F /dev/null -o BatchMode=yes -o IdentitiesOnly=yes -o IdentityAgent=none -i /dev/null",
+    };
+}
+/** Pure spawn projection; parent mounts precede their writable children. */
+export function buildUntrustedCodeSpawn(input, host) {
+    const direct = { command: input.command, argv: input.argv, cwd: input.cwd, env: input.env };
+    if (host.os_sandbox === "none")
+        return direct;
+    const writable = [...new Set([...input.writable, ...(host.worktreeMetadata ? [host.worktreeMetadata] : [])])]
+        .sort((a, b) => a.split("/").length - b.split("/").length);
+    const hidden = host.sourceRepository ? join(host.sourceRepository, ".conduit") : undefined;
+    const rootWorkspace = input.cwd === host.sourceRepository;
+    if (host.os_sandbox === "bwrap") {
+        const argv = ["--die-with-parent", "--new-session", "--unshare-net", "--unshare-pid", "--unshare-ipc", "--unshare-uts",
+            "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc",
+            ...["/tmp", "/run", "/home", "/root"].flatMap((path) => ["--tmpfs", path]),
+            ...(host.sourceRepository ? ["--ro-bind", host.sourceRepository, host.sourceRepository] : []),
+            ...(host.toolchainRead ?? []).flatMap((path) => ["--ro-bind", path, path]),
+            ...(rootWorkspace ? ["--bind", input.cwd, input.cwd] : []),
+            ...(hidden ? ["--tmpfs", hidden] : []),
+            ...writable.filter((path) => !rootWorkspace || path !== input.cwd).flatMap((path) => ["--bind", path, path]), "--chdir", input.cwd, "--clearenv",
+            ...Object.entries(input.env).flatMap(([key, value]) => value === undefined ? [] : ["--setenv", key, value]),
+            "--", input.command, ...input.argv];
+        return { ...direct, command: host.executable ?? "/usr/bin/bwrap", argv };
+    }
+    const subpaths = (paths) => [...new Set(paths)].map((path) => {
+        const subpath = `(subpath ${JSON.stringify(path)})`;
+        return hidden && hidden.startsWith(`${path}/`)
+            ? `(require-all ${subpath} (require-not (subpath ${JSON.stringify(hidden)})))` : subpath;
+    }).join(" ");
+    const readPaths = [...writable, ...(host.sourceRepository ? [host.sourceRepository] : []),
+        "/usr", "/bin", "/opt/homebrew", "/Library", "/System", "/private/tmp", "/private/var/folders", ...(host.toolchainRead ?? [])];
+    const ancestors = new Set();
+    for (const path of readPaths) {
+        for (let parent = dirname(path);; parent = dirname(parent)) {
+            ancestors.add(parent);
+            if (parent === dirname(parent))
+                break;
+        }
+    }
+    const metadata = [...ancestors].map((path) => `(literal ${JSON.stringify(path)})`).join(" ");
+    const profile = `(version 1) (allow default) (deny network*) (deny file-write*)
+    (allow file-write* ${subpaths(writable)}) (allow file-write-data (literal "/dev/null"))
+    (deny file-read* (subpath ${JSON.stringify(host.home)}) ${hidden ? `(subpath ${JSON.stringify(hidden)})` : ""})
+    (allow file-read* ${subpaths(readPaths)}) (allow file-read-metadata ${metadata})`;
+    return { ...direct, command: host.executable ?? "/usr/bin/sandbox-exec", argv: ["-p", profile, "--", input.command, ...input.argv] };
+}
+/** Resolve the worktree's own Git administration area without granting a sibling's metadata. */
+async function sandboxRepositoryPaths(cwd) {
+    try {
+        const pointer = await readFile(join(cwd, ".git"), "utf8");
+        const match = /^gitdir: (.+)\s*$/.exec(pointer.trim());
+        if (!match)
+            return {};
+        const metadata = await realpath(resolve(cwd, match[1]));
+        const common = await realpath(resolve(metadata, (await readFile(join(metadata, "commondir"), "utf8")).trim()));
+        const backlink = await realpath((await readFile(join(metadata, "gitdir"), "utf8")).trim());
+        if (dirname(metadata) !== join(common, "worktrees") || backlink !== join(cwd, ".git"))
+            return {};
+        return { sourceRepository: dirname(common), worktreeMetadata: metadata };
+    }
+    catch {
+        if (await stat(join(cwd, ".git")).then((entry) => entry.isDirectory(), () => false))
+            return { sourceRepository: cwd };
+        return {};
+    }
+}
+/** A delivered instrument's nested runs stay inside its already isolated scratch directory. */
+export function untrustedCodeTempRoot(workspace) {
+    return process.env.HOME && process.env.TMPDIR === join(process.env.HOME, "tmp")
+        ? process.env.TMPDIR : join(workspace, ".conduit", "tmp");
+}
+async function sandboxPathDirectories(env) {
+    const home = await realpath(homedir());
+    const directories = new Set();
+    for (const path of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
+        try {
+            const canonical = await realpath(path);
+            if (canonical !== home && !home.startsWith(`${canonical}/`) && (await stat(canonical)).isDirectory())
+                directories.add(canonical);
+        }
+        catch { /* A missing PATH entry must not stop execvp inside the read-restricted sandbox. */ }
+    }
+    return [...directories];
+}
+/** Existing PATH directories and Bridge's installed runtime, never an enclosing HOME. */
+async function sandboxToolchainPaths(env) {
+    const home = await realpath(homedir());
+    const paths = new Set();
+    const add = async (path) => {
+        try {
+            const canonical = await realpath(path);
+            if (canonical === home || home.startsWith(`${canonical}/`))
+                return;
+            if ((await stat(canonical)).isDirectory())
+                paths.add(canonical);
+        }
+        catch { /* Absent PATH entries are not toolchain directories. */ }
+    };
+    const visited = new Set();
+    for (const path of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
+        await add(path);
+        try {
+            for (const entry of await readdir(path, { withFileTypes: true })) {
+                if (!entry.isSymbolicLink())
+                    continue;
+                const target = await realpath(join(path, entry.name));
+                if (!(await stat(target)).isFile())
+                    continue;
+                // An executable symlink can need its package's lib/ beside bin/, not the enclosing nvm tree.
+                for (let parent = dirname(target); parent !== home && basename(parent) !== ".nvm"; parent = dirname(parent)) {
+                    if (visited.has(parent) || parent === dirname(parent))
+                        break;
+                    visited.add(parent);
+                    if (existsSync(join(parent, "package.json"))) {
+                        await add(parent);
+                        break;
+                    }
+                }
+            }
+        }
+        catch { /* An unreadable or vanished PATH entry contributes no extra authority. */ }
+    }
+    await add(fileURLToPath(new URL("..", import.meta.url)));
+    // The loader and its dependencies are part of Bridge's installed runtime tree.
+    try {
+        const loader = await realpath(createRequire(import.meta.url).resolve("tsx"));
+        const index = loader.lastIndexOf("/node_modules/");
+        if (index >= 0)
+            await add(loader.slice(0, index + "/node_modules".length));
+    }
+    catch { /* An absent loader is reported by the existing probe command. */ }
+    return [...paths];
+}
+/** Same CR15 environment on unsupported hosts; isolated temp and mounts on supported hosts. */
+export async function untrustedCodeSpawn(input) {
+    const sandbox = await probeUntrustedCodeSandbox();
+    if (sandbox.os_sandbox === "none")
+        return input;
+    const cwd = await realpath(input.cwd);
+    const candidates = input.command.includes("/") ? [resolve(cwd, input.command)]
+        : (input.env.PATH ?? "/usr/bin:/bin").split(":").map((path) => resolve(cwd, path, input.command));
+    let command;
+    let unavailable = "ENOENT";
+    for (const path of candidates) {
+        // Keep the command's own name: a rustup proxy such as `cargo -> rustup` dispatches on argv[0].
+        try {
+            await access(path, constants.X_OK);
+            command = join(await realpath(dirname(path)), basename(path));
+            break;
+        }
+        catch (error) {
+            if (error.code === "EACCES")
+                unavailable = "EACCES";
+        }
+    }
+    if (!command)
+        throw Object.assign(new Error(`spawn ${input.command} ${unavailable}`), { code: unavailable });
+    if (!input.env.HOME)
+        throw new Error("Untrusted code requires a scratch HOME");
+    const home = await realpath(input.env.HOME);
+    const temp = join(home, "tmp");
+    await mkdir(temp, { recursive: true });
+    const env = { ...input.env, PATH: (await sandboxPathDirectories(input.env)).join(delimiter), HOME: home, XDG_CONFIG_HOME: join(home, "config"),
+        XDG_CACHE_HOME: join(home, "cache"), XDG_DATA_HOME: join(home, "data"), TMPDIR: temp, TMP: temp, TEMP: temp };
+    const writable = [cwd, home, temp];
+    for (const key of ["CARGO_TARGET_DIR", "CARGO_HOME"]) {
+        const path = input.env[key];
+        if (!path)
+            continue;
+        await mkdir(path, { recursive: true });
+        writable.push(await realpath(path));
+    }
+    const toolchainRead = await sandboxToolchainPaths(env);
+    // Installed toolchains are read like PATH directories; a gate never rewrites rustc for the next attempt.
+    if (input.env.RUSTUP_HOME && existsSync(input.env.RUSTUP_HOME))
+        toolchainRead.push(await realpath(input.env.RUSTUP_HOME));
+    return buildUntrustedCodeSpawn({ ...input, command, cwd, env, writable }, {
+        ...sandbox, home: await realpath(homedir()), toolchainRead, ...await sandboxRepositoryPaths(cwd),
+    });
+}
+const sandboxExecFile = promisify(execFile);
+let sandboxProbe;
+/** One non-spending probe per process; a missing or unusable primitive is a reported host fact. */
+export function probeUntrustedCodeSandbox() {
+    return sandboxProbe ??= probeHostSandbox();
+}
+async function probeHostSandbox() {
+    const os_sandbox = process.platform === "linux" ? "bwrap" : process.platform === "darwin" ? "seatbelt" : "none";
+    const executable = os_sandbox === "bwrap" ? "/usr/bin/bwrap" : "/usr/bin/sandbox-exec";
+    if (os_sandbox === "none" || !existsSync(executable))
+        return { os_sandbox: "none", reason: "No supported OS sandbox executable is installed" };
+    let scratch;
+    const server = createServer((socket) => socket.end());
+    try {
+        scratch = await realpath(await mkdtemp(join(tmpdir(), "conduit-sandbox-probe-")));
+        const host = { os_sandbox, executable, reason: "", home: await realpath(homedir()),
+            toolchainRead: await sandboxToolchainPaths(process.env) };
+        const env = untrustedCodeEnvironment(scratch);
+        const run = async (command, argv) => {
+            const spawn = buildUntrustedCodeSpawn({ command, argv, cwd: scratch, env, writable: [scratch] }, host);
+            await sandboxExecFile(spawn.command, spawn.argv, { cwd: spawn.cwd, env: spawn.env, timeout: 5_000, maxBuffer: 4_000 });
+        };
+        await run("/usr/bin/true", []);
+        // A live listener is the positive control: a closed port would fail even without isolation.
+        await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", resolve); });
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Sandbox network probe has no listener");
+        await run(process.execPath, ["-e", `const s=require('node:net').connect(${address.port},'127.0.0.1');s.on('connect',()=>{s.destroy();process.exit(1)});s.on('error',()=>process.exit(0));s.setTimeout(2000,()=>{s.destroy();process.exit(0)});`]);
+        return { os_sandbox, reason: "OS sandbox executed a child and blocked the network probe" };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return { os_sandbox: "none", reason: detail.split("\n").find((line) => /bwrap:|sandbox-exec:/.test(line))?.trim().slice(0, 500)
+                ?? detail.split("\n")[0].slice(0, 500) };
+    }
+    finally {
+        if (server.listening)
+            await new Promise((resolve) => server.close(() => resolve()));
+        if (scratch)
+            await rm(scratch, { recursive: true, force: true });
+    }
+}
 /** The `/v1` a fuelled agent is pointed at — and the one its model names are validated against. */
 export function fuelEndpoint(baseUrl) {
     return `${baseUrl.replace(/\/+$/, "")}/v1`;

package/dist/ensure-test-evidence.js

@@ -4,8 +4,20 @@
  * it never substitutes for it.
  */
 import { spawn } from "node:child_process";
-import { boundedEnvironment, criterionKey, resolveCriterionReference, signalGroup, STDIO_DRAIN_MS, CHILD_STOP_GRACE_MS, OWN_PROCESS_GROUP, trackProcessGroup, untrackProcessGroup } from "./driver.js";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { untrustedCodeTempRoot, untrustedCodeSpawn, untrustedCodeEnvironment, criterionKey, resolveCriterionReference, signalGroup, STDIO_DRAIN_MS, CHILD_STOP_GRACE_MS, OWN_PROCESS_GROUP, trackProcessGroup, untrackProcessGroup } from "./driver.js";
 import { isBoundedVerificationCommand, isRunnableVerificationCommand } from "./execution-class.js";
+import { workspaceDependenciesMissingFailure } from "./failure-signal.js";
+/** A typed spawn refusal, distinct from a command that ran and failed. */
+export class VerificationCommandUnavailableError extends Error {
+    failure;
+    constructor(command, code, detail) {
+        super(`Verification command could not start: ${command} (${code}): ${detail}`);
+        this.name = "VerificationCommandUnavailableError";
+        this.failure = workspaceDependenciesMissingFailure(this.message);
+    }
+}
 const TEST_EVIDENCE_DETAILS_MIN = 32;
 /** Cold `cargo test` in an attempt worktree routinely exceeds two minutes of compile. */
 export const VERIFICATION_TIMEOUT_MS = 600_000;
@@ -437,8 +449,19 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
         partial[stream].append(parts.at(-1));
     };
     const output = () => [lines.text().replace(/\n$/, ""), partial.stdout.text(), partial.stderr.text()].filter(Boolean).join("\n");
+    const tempRoot = untrustedCodeTempRoot(workspace);
+    await mkdir(tempRoot, { recursive: true });
+    const scratchHome = await mkdtemp(join(tempRoot, "gate-home-"));
+    const commandSpawn = await untrustedCodeSpawn({ command: bin, argv: argv.slice(1), cwd: workspace, env: untrustedCodeEnvironment(scratchHome) })
+        .catch(async (error) => {
+        await rm(scratchHome, { recursive: true, force: true });
+        const unavailable = error;
+        if (typeof unavailable.code === "string")
+            throw new VerificationCommandUnavailableError(command, unavailable.code, unavailable.message);
+        throw error;
+    });
     return new Promise((resolve, reject) => {
-        const child = spawn(bin, argv.slice(1), { cwd: workspace, env: boundedEnvironment(),
+        const child = spawn(commandSpawn.command, commandSpawn.argv, { cwd: commandSpawn.cwd, env: commandSpawn.env,
             stdio: ["ignore", "pipe", "pipe"], detached: OWN_PROCESS_GROUP });
         const group = OWN_PROCESS_GROUP ? child.pid : undefined;
         if (group !== undefined)
@@ -494,7 +517,7 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
             if (typeof error.code === "string") {
                 settled = true;
                 cleanup();
-                reject(error);
+                reject(new VerificationCommandUnavailableError(command, error.code, error.message));
             }
             else {
                 if (!stderr.text())
@@ -507,7 +530,7 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
             clearTimeout(timer);
             drainTimer = setTimeout(() => settle(code), STDIO_DRAIN_MS);
         });
-    });
+    }).finally(() => rm(scratchHome, { recursive: true, force: true }));
 }
 /**
  * Bridge may attach genuine command output; it must not invent which criteria that output proves.

package/dist/execution.js

@@ -31,7 +31,7 @@ import { agentClaimsRepositoryWork, claimsVsGitMismatch, isLandTreeEmpty, report
 const execFileAsync = promisify(execFile);
 const deliveryReportSchemaPath = fileURLToPath(new URL("../schemas/delivery-report.schema.json", import.meta.url));
 const repairBriefSchemaPath = fileURLToPath(new URL("../schemas/repair-brief.schema.json", import.meta.url));
-import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError, VerificationGateTimedOutError, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
+import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationCommandUnavailableError, VerificationFailedError, VerificationGateRanNothingError, VerificationGateTimedOutError, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureDemonstrationEvidence } from "./ensure-demonstration-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
@@ -1100,6 +1100,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // of the failed code would make the durable retry mechanically impossible.
     let retainAttemptWorktree = diagnosis;
     const reportVerificationGateTimeout = async (input) => {
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, { action: "fail", body: {
                 error: input.detail,
                 retryable: false,
@@ -1107,12 +1108,13 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 ...(input.pullRequestUrl ? { pull_request_url: input.pullRequestUrl } : {}),
                 idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
             } });
-        retainAttemptWorktree = response.retain_worktree === true;
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
         console.error(`Assignment ${taskId} verification gate did not finish: ${redactSecrets(input.detail)}`);
     };
     if (diagnosis) {
         if (!sourceAttemptId) {
-            await queueTerminal(client, taskId, {
+            retainAttemptWorktree = true;
+            const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
                     failure: {
@@ -1129,11 +1131,13 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:diagnosis-source-missing:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             return;
         }
         const retained = options.existingWorktree ?? attemptWorktreePath(workspace, sourceAttemptId);
         if (!(await proveResumeWorktree(workspace, sourceAttemptId, retained))) {
-            await queueTerminal(client, taskId, {
+            retainAttemptWorktree = true;
+            const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
                     failure: {
@@ -1150,6 +1154,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:diagnosis-worktree-missing:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             return;
         }
         attemptWorkspace = retained;
@@ -1161,13 +1166,17 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     }
     else {
         if (!startCommit) {
-            await queueTerminal(client, taskId, { action: "fail", body: { error: "No start commit for attempt worktree", retryable: true, failure: bridgeCause("agent_execution_failed", "No start commit for attempt worktree"), idempotency_key: `bridge:no-start-commit:${active.attemptId}` } });
+            retainAttemptWorktree = true;
+            const response = await queueTerminal(client, taskId, { action: "fail", body: { error: "No start commit for attempt worktree", retryable: true, failure: bridgeCause("agent_execution_failed", "No start commit for attempt worktree"), idempotency_key: `bridge:no-start-commit:${active.attemptId}` } });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             return;
         }
         if (executionContract.requested_base_commit) {
             const resolved = await resolveAttemptStartCommit(workspace, executionContract.requested_base_commit, startCommit);
             if (!resolved) {
-                await queueTerminal(client, taskId, { action: "fail", body: { error: "Required base commit is not available in this workspace", retryable: true, failure: bridgeCause("base_not_ancestor", "Required base commit is not available in this workspace"), idempotency_key: `bridge:base-not-ancestor:${active.attemptId}` } });
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, { action: "fail", body: { error: "Required base commit is not available in this workspace", retryable: true, failure: bridgeCause("base_not_ancestor", "Required base commit is not available in this workspace"), idempotency_key: `bridge:base-not-ancestor:${active.attemptId}` } });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
                 return;
             }
             worktreeStart = resolved;
@@ -1175,7 +1184,9 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         else if (liveBrief?.base_commit && liveBrief.base_commit !== startCommit) {
             const reachable = await ensureCommitAvailable(workspace, startCommit).catch(() => false);
             if (!reachable) {
-                await queueTerminal(client, taskId, { action: "fail", body: { error: "Delivered head is not available in this workspace", retryable: true, failure: bridgeCause("agent_execution_failed", "Delivered head is not available in this workspace"), idempotency_key: `bridge:workspace-mismatch:${active.attemptId}` } });
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, { action: "fail", body: { error: "Delivered head is not available in this workspace", retryable: true, failure: bridgeCause("agent_execution_failed", "Delivered head is not available in this workspace"), idempotency_key: `bridge:workspace-mismatch:${active.attemptId}` } });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
                 console.error(`Assignment ${taskId} preflight failed: Delivered head is not available in this workspace`);
                 return;
             }
@@ -1192,12 +1203,19 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             const message = code === "source_workspace_dirty"
                 ? "Source workspace has uncommitted changes; refuse to start an isolated attempt"
                 : `Unable to create attempt worktree: ${code}`;
-            await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: true, ...(code === "source_workspace_dirty" ? { failure: bridgeCause("workspace_dirty", message) } : {}), idempotency_key: `bridge:worktree:${active.attemptId}:${code}` } });
+            retainAttemptWorktree = true;
+            const response = await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: true, ...(code === "source_workspace_dirty" ? { failure: bridgeCause("workspace_dirty", message) } : {}), idempotency_key: `bridge:worktree:${active.attemptId}:${code}` } });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             console.error(`Assignment ${taskId} worktree create failed: ${redactSecrets(message)}`);
             return;
         }
         await client.updateAttempt(taskId, { worktreePath: attemptWorkspace });
     }
+    const removeReleasedPreflightWorktree = async () => {
+        if (!retainAttemptWorktree) {
+            await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+        }
+    };
     // T136: a first revision's witness starts at the commit the attempt worktree actually checked
     // out. When main has moved past the requested base, that resolved start is the claimed head;
     // diffing from the requested base would report commits that predate the agent as its work.
@@ -1235,7 +1253,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 const message = error instanceof Error ? error.message : String(error);
                 const retryable = message.startsWith(NORMATIVE_REF_PREFIX)
                     && /could not clone|could not checkout|timed out|Could not resolve|connection/i.test(message);
-                await queueTerminal(client, taskId, {
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
                     action: "fail",
                     body: {
                         error: message,
@@ -1246,6 +1265,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                         idempotency_key: `bridge:normative-ref:${active.attemptId}`,
                     },
                 });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                await removeReleasedPreflightWorktree();
                 console.error(`Assignment ${taskId} normative reference materialization failed: ${redactSecrets(message)}`);
                 return;
             }
@@ -1257,11 +1278,6 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // pins the attempt's verification_commands_digest to the tree the gates actually ran in, so a
     // later refresh of the source checkout cannot invalidate a running attempt.
     const attemptBrief = await buildWorkspaceBrief(attemptWorkspace).catch(() => liveBrief);
-    const removeReleasedDiagnosticWorktree = async (response) => {
-        if (diagnosis && !retainDiagnosticWorktree(response)) {
-            await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
-        }
-    };
     // Stamped class is the source of truth (Bridge 0.11+). Do not re-derive from grants.
     let executionClass;
     try {
@@ -1272,21 +1288,26 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         console.error(`Assignment ${taskId}: ${detail}`);
         // Non-retryable: control plane restamps on dispatch/claim. Infinite retry here burned path-4
         // attempt budget when a pre-inversion task row still lacked the stamp.
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: { error: detail, retryable: false, failure: bridgeCause("execution_unclassified", detail), idempotency_key: `bridge:fail:${active.attemptId}:missing-class` },
         });
-        await removeReleasedDiagnosticWorktree(response);
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         return;
     }
     // An artifact deliverable that is not publish_artifact cannot write/publish — fail closed.
     if (artifactDelivery && executionClass !== "publish_artifact") {
         const detail = `Artifact deliverable stamped as execution class ${executionClass}, which cannot write or publish it. Revise the plan to use publish_artifact.`;
         console.error(`Assignment ${taskId}: ${detail}`);
-        await queueTerminal(client, taskId, {
+        retainAttemptWorktree = true;
+        const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: { error: detail, retryable: false, failure: bridgeCause("execution_unclassified", detail), idempotency_key: `bridge:fail:${active.attemptId}:artifact-class` },
         });
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         return;
     }
     // Full classFloor must survive project/machine ceilings (observe/verify need repo_read too).
@@ -1294,16 +1315,19 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     if (!floor.ok) {
         const detail = `Class floor unmet: ${floor.reason}`;
         console.error(`Assignment ${taskId}: ${detail}`);
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: { error: detail, retryable: false, failure: bridgeCause("execution_unclassified", detail), idempotency_key: `bridge:fail:${active.attemptId}:class-floor` },
         });
-        await removeReleasedDiagnosticWorktree(response);
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         return;
     }
     const builtInDriverId = Object.entries(DRIVERS).find(([, candidate]) => candidate === driver)?.[0] ?? null;
     if (diagnosis && builtInDriverId && !supportsReadOnlyDiagnosis(builtInDriverId)) {
         const detail = `${driver.name} cannot combine bounded test execution with enforced read-only repository access.`;
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: {
@@ -1321,12 +1345,14 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 idempotency_key: `bridge:diagnosis-driver-authority:${active.attemptId}`,
             },
         });
-        await removeReleasedDiagnosticWorktree(response);
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         console.error(`Assignment ${taskId} diagnosis held: ${detail}`);
         return;
     }
     const diagnosticFailure = workPackage?.diagnostic_context?.failure_output;
     if (diagnosis && !diagnosticFailure) {
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: {
@@ -1336,7 +1362,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 idempotency_key: `bridge:diagnosis-context-missing:${active.attemptId}`,
             },
         });
-        await removeReleasedDiagnosticWorktree(response);
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         return;
     }
     const evidenceCommands = verificationEvidenceCommands(attemptBrief?.verification ?? [], attemptBrief?.declared_verification ?? [], spec.acceptance ?? []);
@@ -1347,6 +1374,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // reads the same missing_verification Hold.
     if (executionKind === "authoring" && needsTestEvidence(spec, grants) && !evidenceCommands.length) {
         const detail = missingVerificationDetail(worktreeStart);
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: {
@@ -1356,9 +1384,10 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 idempotency_key: `bridge:missing-verification:${active.attemptId}`,
             },
         });
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
         // A fresh tree stands at the base commit and no agent ran, so it holds no diagnostic value. A
         // resumed tree holds the agent's own work and is kept.
-        if (!options.existingWorktree && response.retain_worktree !== true) {
+        if (!options.existingWorktree && !retainAttemptWorktree) {
             await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
         }
         console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
@@ -1382,7 +1411,22 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             declaredVerificationCommands: attemptBrief?.declared_verification ?? [],
             acceptance: spec.acceptance ?? [],
             changeScope: spec.change_scope ?? [],
+        }).catch(async (error) => {
+            if (!(error instanceof VerificationCommandUnavailableError))
+                throw error;
+            retainAttemptWorktree = true;
+            const response = await queueTerminal(client, taskId, { action: "fail", body: {
+                    error: error.message, retryable: false, failure: error.failure,
+                    idempotency_key: `bridge:verification-command-unavailable:${active.attemptId}`,
+                } });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
+            if (!retainAttemptWorktree)
+                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(error.message)}`);
+            return null;
         });
+        if (!dryRun)
+            return;
         if (dryRun.ranNothing) {
             const { command, exitCode, reason } = dryRun.ranNothing;
             const detail = `Verification gate ran nothing on the base commit ${worktreeStart}: ${command} (${reason}, exit ${exitCode})`;
@@ -1397,6 +1441,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 exit_code: exitCode,
                 vendor_message: reason,
             };
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
@@ -1406,8 +1451,9 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:verification-gate-ran-nothing:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (response.retain_worktree !== true) {
+            if (!retainAttemptWorktree) {
                 await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
             }
             console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
@@ -1416,6 +1462,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         if (dryRun.timedOut) {
             const { command, stderrTail, stdoutTail } = dryRun.timedOut;
             const detail = `Verification gate did not finish on the base commit ${worktreeStart}: ${command} (stopped after ${Math.round(VERIFICATION_TIMEOUT_MS / 60_000)} minutes)`;
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
@@ -1425,8 +1472,9 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (response.retain_worktree !== true) {
+            if (!retainAttemptWorktree) {
                 await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
             }
             console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
@@ -1435,6 +1483,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         if (dryRun.redBase) {
             const { command, exitCode, stderrTail, stdoutTail } = dryRun.redBase;
             const detail = `Verification fails on the base commit ${worktreeStart}: ${command} (exit ${exitCode ?? "unknown"})`;
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
@@ -1444,8 +1493,9 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:verification-red-base:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (response.retain_worktree !== true) {
+            if (!retainAttemptWorktree) {
                 await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
             }
             console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
@@ -1453,6 +1503,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         }
         if (dryRun.outsideScope.length) {
             const detail = verificationScopeConflictDetail(dryRun.outsideScope, spec.change_scope ?? []);
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
@@ -1462,9 +1513,10 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     idempotency_key: `bridge:verification-scope-conflict:${active.attemptId}`,
                 },
             });
+            retainAttemptWorktree = retainDiagnosticWorktree(response);
             // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
             // Keep it only when the control plane says it still needs it.
-            if (response.retain_worktree !== true) {
+            if (!retainAttemptWorktree) {
                 await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
             }
             console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
@@ -1499,6 +1551,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     const diagnosisFingerprintBefore = diagnosis ? await worktreeStateFingerprint(attemptWorkspace) : null;
     if (diagnosis && diagnosisFingerprintBefore === null) {
         const detail = "Bridge could not fingerprint the retained worktree before read-only diagnosis.";
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: {
@@ -1517,6 +1570,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             },
         });
         retainAttemptWorktree = retainDiagnosticWorktree(response);
+        await removeReleasedPreflightWorktree();
         console.error(`Assignment ${taskId} diagnosis held: ${detail}`);
         return;
     }
@@ -1539,6 +1593,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     const pinnedFacts = active.phase === "agent_running" ? active.executionFacts : undefined;
     const executionFacts = pinnedFacts ? resumeExecutionFacts(pinnedFacts, observedFacts) : observedFacts;
     const verificationCommands = pinnedFacts ? active.verificationCommands ?? [] : attemptBrief?.verification ?? [];
+    const declaredVerificationCommands = pinnedFacts ? active.declaredVerificationCommands ?? [] : attemptBrief?.declared_verification ?? [];
     // A resumed attempt must still be doing the work it claimed. When a pinned fact moved — the
     // verification command list, the repository, the base commit — the attempt is over: report it
     // once with the fact named, and let the owner's Retry pin the facts again.
@@ -1549,7 +1604,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     }
     // The command list is pinned with the digest it produced: on a later turn the report can name the
     // gate that moved instead of showing two hex strings.
-    await client.updateAttempt(taskId, { executionFacts, verificationCommands });
+    await client.updateAttempt(taskId, { executionFacts, verificationCommands, declaredVerificationCommands });
     await client.attemptRequest(taskId, "progress", {
         phase: diagnosis ? "inspecting" : "agent_running",
         execution_facts: executionFacts,
@@ -1629,18 +1684,18 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // the retry resumes from the head reported here instead of starting over at the base. The tree
     // stays on this computer, where that head is always reachable.
     const reportTurnTimeout = async (message) => {
-        retainAttemptWorktree = true;
         const resume = diagnosis || machineBoundTimeout(agentTimeout) ? null : await checkpointWorkInProgress({
             workspace: attemptWorkspace, spec, grants, baseCommit: deliveryBaseCommit,
         }).catch((error) => {
             console.error(`Work in progress was not committed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
             return null;
         });
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, {
             action: "fail",
             body: timeoutFailureBody(agentTimeout, active.attemptId, resume),
         });
-        retainAttemptWorktree = Boolean(resume) || response.retain_worktree === true;
+        retainAttemptWorktree = Boolean(resume) || retainDiagnosticWorktree(response);
         console.error(`Assignment ${taskId} timed out: ${redactSecrets(message)}`);
     };
     const failAttemptFromDriverResult = async (result) => {
@@ -1678,7 +1733,6 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             })
             : null;
         if (capturedVerification?.timedOut) {
-            retainAttemptWorktree = true;
             await reportVerificationGateTimeout({ command: capturedVerification.command, detail: capturedVerification.detail,
                 stderr: capturedVerification.stderr ?? "", stdout: capturedVerification.stdout ?? "" });
             return retainAttemptWorktree;
@@ -1707,7 +1761,6 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         // the same run and must not silently reclassify an unretryable failure.
         // Keep the tree until the replay-safe terminal response explicitly says whether diagnosis was
         // queued. A network fault here must not delete the evidence before Bridge can replay terminal.
-        retainAttemptWorktree = true;
         // The driver's typed cause rides beside the prose, never instead of it. A recovered
         // verification log describes the same run: the signal becomes Bridge's verification witness
         // and the prose carries the evidence, so the verify class stays typed without new tables.
@@ -1722,6 +1775,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                         ? { ...result.signal, phase: "verification", witness: "bridge", kind: "verification_failed", command: capturedVerification.command, stderr_tail: undefined, stdout_tail: undefined, ...(diffStat ? { diff_stat: diffStat } : {}) }
                         : result.signal
                     : undefined;
+        retainAttemptWorktree = true;
         const response = await queueTerminal(client, taskId, { action: "fail", body: {
                 error: message,
                 retryable: bindingRequired ? false : retryableAgentFailure(agentMessage),
@@ -1734,7 +1788,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 ...(signal ? { signal } : {}),
                 idempotency_key: `bridge:fail:${active.attemptId}`,
             } });
-        retainAttemptWorktree = response.retain_worktree === true;
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
         console.error(`Assignment ${taskId} failed: ${redactSecrets(message)}`);
         return retainAttemptWorktree;
     };
@@ -1842,6 +1896,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 const detail = diagnosisWitness === "changed"
                     ? "The diagnostic lane changed the retained worktree during a read-only run."
                     : "Bridge could not fingerprint the retained worktree after read-only diagnosis.";
+                retainAttemptWorktree = true;
                 const response = await queueTerminal(client, taskId, {
                     action: "fail",
                     body: {
@@ -1870,6 +1925,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 // A spent allowance keeps its prose reading here (the control plane quotes the reset clock
                 // from it); a computer fact in the CLI's words is named by code, as on the authoring path.
                 const diagnosisCause = providerQuotaRefusal(message) ? null : agentOutputCause(message);
+                retainAttemptWorktree = true;
                 const response = await queueTerminal(client, taskId, {
                     action: "fail",
                     body: {
@@ -1892,6 +1948,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : "Diagnostic RepairBrief was invalid";
+                retainAttemptWorktree = true;
                 const response = await queueTerminal(client, taskId, {
                     action: "fail",
                     body: {
@@ -1904,6 +1961,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 console.error(`Assignment ${taskId} diagnosis returned no usable brief: ${redactSecrets(message)}`);
                 return;
             }
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "complete",
                 body: {
@@ -1997,6 +2055,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                         if (await isLandTreeEmpty({ workspace: attemptWorkspace, spec, grants, baseCommit: deliveryBaseCommit })) {
                             const base = spec.repository?.base_commit ?? "unknown";
                             const classified = classifyFinalizeFailure(agentNoLandCommitMessage(base));
+                            retainAttemptWorktree = true;
                             const response = await queueTerminal(client, taskId, {
                                 action: "fail",
                                 body: {
@@ -2016,6 +2075,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 else {
                     const base = spec.repository?.base_commit ?? "unknown";
                     const classified = classifyFinalizeFailure(agentNoLandCommitMessage(base));
+                    retainAttemptWorktree = true;
                     const response = await queueTerminal(client, taskId, {
                         action: "fail",
                         body: {
@@ -2062,7 +2122,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                         idempotency_key: `bridge:no-delivery-report:${active.attemptId}`,
                     },
                 });
-                retainAttemptWorktree = response.retain_worktree === true;
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
                 console.error(`Assignment ${taskId} attempted no delivery report: ${redactSecrets(detail)}`);
                 return;
             }
@@ -2177,6 +2237,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 if (await isLandTreeEmpty({ workspace: attemptWorkspace, spec, grants, baseCommit: deliveryBaseCommit })) {
                     const base = spec.repository?.base_commit ?? "unknown";
                     const classified = classifyFinalizeFailure(agentNoLandCommitMessage(base));
+                    retainAttemptWorktree = true;
                     const response = await queueTerminal(client, taskId, {
                         action: "fail",
                         body: {
@@ -2208,7 +2269,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                 driver,
                 executionClass,
                 capabilities: spec.required_capabilities ?? [],
-                verificationCommands: attemptBrief?.verification ?? [],
+                verificationCommands,
                 objective: task.objective,
                 selection,
                 fuel,
@@ -2257,8 +2318,8 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     report,
                     spec,
                     grants,
-                    verificationCommands: attemptBrief?.verification ?? [],
-                    declaredVerificationCommands: attemptBrief?.declared_verification ?? [],
+                    verificationCommands,
+                    declaredVerificationCommands,
                 });
                 report = await ensureChangeEvidence({
                     workspace: attemptWorkspace,
@@ -2308,7 +2369,6 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             // never a repair attempt or a blind retry, which is what burned six deliveries on 2026-09-04
             // against a bare `python3 -m unittest` that discovered nothing.
             if (error instanceof VerificationGateRanNothingError) {
-                retainAttemptWorktree = true;
                 const signal = {
                     phase: "verification",
                     witness: "bridge",
@@ -2317,6 +2377,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                     exit_code: error.exitCode,
                     vendor_message: error.vendorMessage,
                 };
+                retainAttemptWorktree = true;
                 const response = await queueTerminal(client, taskId, {
                     action: "fail",
                     body: {
@@ -2329,7 +2390,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
                         idempotency_key: `bridge:invalid-delivery:${active.attemptId}`,
                     },
                 });
-                retainAttemptWorktree = response.retain_worktree === true;
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
                 console.error(`Assignment ${taskId} verification gate ran nothing: ${redactSecrets(error.message)}`);
                 const gateReplyTail = reportText.slice(-8_000);
                 console.error(`Assignment ${taskId} agent reply tail (${reportText.length} chars total, redacted): ${redactSecrets(gateReplyTail) || "<empty>"}`);
@@ -2350,15 +2411,16 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             // A report that fell short of the delivery contract is named by its type and travels as the
             // delivery_report signal, so repair routing never reads this message (K3, debt 18 item 3c).
             const reportDefect = error instanceof DeliveryReportDefectError;
-            const classified = verificationFailed
-                ? { retryable: true, error: `Verification failed after the agent run.\n${message}${diffStat ? `\n\nChanged files:\n${diffStat}` : ""}` }
-                : reportDefect
-                    ? { retryable: false, error: message }
-                    // classifyFinalizeFailure: forge transport → retryable; contract/environment/unknown → fail
-                    // closed (unknown prefixed as "Bridge finalize interrupted", not laundered as contract).
-                    : classifyFinalizeFailure(message);
-            if (verificationFailed)
-                retainAttemptWorktree = true;
+            const classified = error instanceof VerificationCommandUnavailableError
+                ? { retryable: false, error: message, failure: error.failure }
+                : verificationFailed
+                    ? { retryable: true, error: `Verification failed after the agent run.\n${message}${diffStat ? `\n\nChanged files:\n${diffStat}` : ""}` }
+                    : reportDefect
+                        ? { retryable: false, error: message }
+                        // classifyFinalizeFailure: forge transport → retryable; contract/environment/unknown → fail
+                        // closed (unknown prefixed as "Bridge finalize interrupted", not laundered as contract).
+                        : classifyFinalizeFailure(message);
+            retainAttemptWorktree = true;
             const response = await queueTerminal(client, taskId, {
                 action: "fail",
                 body: {
@@ -2390,8 +2452,9 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             return;
         }
         await client.updateAttempt(taskId, { phase: "agent_finished", delivery: { spec, report } });
+        retainAttemptWorktree = true;
         const response = await submitFinishedDelivery(client, taskId);
-        retainAttemptWorktree = response.retain_worktree === true;
+        retainAttemptWorktree = retainDiagnosticWorktree(response);
         deliverySubmitted = response.status !== "failed";
         if (deliverySubmitted)
             console.log(`Assignment ${taskId} delivered for review and acceptance.`);
@@ -3003,7 +3066,11 @@ export async function verificationScopeDryRun(input) {
     let redBase = null;
     for (const command of commands) {
         // A gate that cannot start says nothing about the scope; the next one still can.
-        const result = await run(command, input.workspace).catch(() => null);
+        const result = await run(command, input.workspace).catch((error) => {
+            if (error instanceof VerificationCommandUnavailableError)
+                throw error;
+            return null;
+        });
         if (!result)
             continue;
         // A gate that never exited says nothing about the base commit: it is not a red base, and it

package/dist/investigation.js

@@ -13,12 +13,12 @@ import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl } fr
 import { headCommitOrNull } from "./git.js";
 import { ConduitRequestError } from "./client.js";
 import { learnDriverFuel, resolveAssignmentModel, changedPathsSince, runDeliveryVerificationGates, discardWorktreeWrites } from "./execution.js";
-import { DRIVERS, execute, extractAgentReportJsonText } from "./driver.js";
+import { DRIVERS, execute, extractAgentReportJsonText, untrustedCodeTempRoot, untrustedCodeSpawn, untrustedCodeEnvironment } from "./driver.js";
 import { pickDriverForClaim, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 import { diffStatSince } from "./git-witness.js";
 import { switchManagedWorkspace } from "./on-shift-apply.js";
 import { execFile } from "node:child_process";
-import { rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { promisify } from "node:util";
@@ -471,14 +471,6 @@ function probeTail(stderr, stdout) {
     const stderrTail = stderr.length > PROBE_TAIL_CHARS ? stderr.slice(stderr.length - PROBE_TAIL_CHARS) : stderr;
     return boundedTail(`${stderrTail}\n${stdout}`, PROBE_TAIL_CHARS);
 }
-function probeEnv() {
-    const env = {};
-    if (process.env.PATH !== undefined)
-        env.PATH = process.env.PATH;
-    if (process.env.HOME !== undefined)
-        env.HOME = process.env.HOME;
-    return env;
-}
 function probeInterpreter(language) {
     if (language === "ts")
         return "node --import tsx";
@@ -514,12 +506,16 @@ async function execProbe(argv, workspace) {
     const bin = argv[0];
     if (!bin)
         throw new Error("Probe command is empty");
+    const tempRoot = untrustedCodeTempRoot(workspace);
+    await mkdir(tempRoot, { recursive: true });
+    const scratchHome = await mkdtemp(join(tempRoot, "probe-home-"));
     try {
-        const { stdout, stderr } = await execFileAsync(bin, argv.slice(1), {
-            cwd: workspace,
+        const spawn = await untrustedCodeSpawn({ command: bin, argv: argv.slice(1), cwd: workspace, env: untrustedCodeEnvironment(scratchHome) });
+        const { stdout, stderr } = await execFileAsync(spawn.command, spawn.argv, {
+            cwd: spawn.cwd,
             timeout: PROBE_TIMEOUT_MS,
             maxBuffer: PROBE_MAX_BUFFER_BYTES,
-            env: probeEnv(),
+            env: spawn.env,
         });
         return { stdout: String(stdout), stderr: String(stderr), code: 0 };
     }
@@ -535,6 +531,9 @@ async function execProbe(argv, workspace) {
             code: err.killed === true || typeof err.code !== "number" ? -1 : err.code,
         };
     }
+    finally {
+        await rm(scratchHome, { recursive: true, force: true });
+    }
 }
 function witnessRecord(input) {
     return {
@@ -657,14 +656,23 @@ function toStepWitness(witness) {
 /**
  * The delivered instrument runs through the agent runs' own process helper (T90): bounded output,
  * an answer on the child's exit even when a process it left behind holds the pipes, and a stop
- * that escalates to SIGKILL. Its environment stays the probe's own, PATH and HOME only.
+ * that escalates to SIGKILL. Its environment uses a disposable HOME without machine credentials or proxies.
  */
 async function execDeliveredProbeRun(argv, stdin, workspace, timeoutMs) {
     const [file, ...args] = argv;
     if (!file)
         throw new Error("delivered probe command is empty");
-    const result = await execute(file, args, workspace, timeoutMs, undefined, "conduit", stdin, undefined, undefined, probeEnv());
-    return { code: result.code ?? -1, stdout: result.stdout, stderr: result.stderr };
+    const tempRoot = untrustedCodeTempRoot(workspace);
+    await mkdir(tempRoot, { recursive: true });
+    const scratchHome = await mkdtemp(join(tempRoot, "probe-home-"));
+    try {
+        const spawn = await untrustedCodeSpawn({ command: file, argv: args, cwd: workspace, env: untrustedCodeEnvironment(scratchHome) });
+        const result = await execute(spawn.command, spawn.argv, spawn.cwd, timeoutMs, undefined, "conduit", stdin, undefined, undefined, spawn.env);
+        return { code: result.code ?? -1, stdout: result.stdout, stderr: result.stderr };
+    }
+    finally {
+        await rm(scratchHome, { recursive: true, force: true });
+    }
 }
 export async function runDeliveredProbeInstrument(input) {
     const entry = join(input.workspace, PROBE_RUN_ENTRY);

package/dist/ops.js

@@ -9,6 +9,7 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
+import { probeUntrustedCodeSandbox } from "./driver.js";
 import { ConduitClient } from "./client.js";
 import { loadConfig } from "./config.js";
 import { ensureCheckout } from "./checkout.js";
@@ -355,6 +356,8 @@ export async function runOps(verb, argv = [], deps = {}) {
         const installed = await detectInstalledClients();
         const health = probeAgentHealth(installed, process.env);
         console.log(`Bridge preflight: ${report.ready ? "READY" : "BLOCKED"}`);
+        const isolation = await (deps.probeSandbox ?? probeUntrustedCodeSandbox)();
+        console.log(`Untrusted-code isolation = ${isolation.os_sandbox === "none" ? `environment only: ${isolation.reason}` : `os sandbox (${isolation.os_sandbox})`}`);
         const installedAgents = health.filter((h) => h.installed);
         if (installedAgents.length > 0) {
             console.log("\nAgent Diagnostics:");

package/dist/service.js

@@ -198,7 +198,8 @@ export async function systemdDropInConflicts(home = homedir(), name = DEFAULT_SE
                 conflicts.add(name);
         }
     }
-    if (platform() === "linux") {
+    // systemd answers for this user's real unit only; another home's units are not its to report.
+    if (platform() === "linux" && home === homedir()) {
         const effective = spawnSync("systemctl", ["--user", "show", `${name}.service`, "--property=DropInPaths", "--value"], { encoding: "utf8" });
         if (effective.status === 0) {
             for (const path of parseSystemdDropInPaths(effective.stdout))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.174",
+  "version": "0.16.180",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {