@miraland-labs/conduit-bridge 0.16.18 → 0.16.20

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.12.3` — `ops connect` asks which org unless `--organization` is passed (does **not** silently reuse a leftover `CONDUIT_ORG` from `ops.env`); `ops install --workspace/--repo` persists declared intent without hand-editing the file; stamped **ExecutionClass** required; heartbeat **protocol 2 + preflight**. Prefer the Connect UI **join** command when switching organizations.
+**Package version:** `0.16.20` — `ops disconnect` now asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 

package/dist/cli.js

@@ -15,7 +15,7 @@ import { DRIVERS } from "./driver.js";
 import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, } from "./drivers.js";
 import { buildWorkspaceBrief } from "./brief.js";
 import { ensureCheckout } from "./checkout.js";
-import { maybeApplyOnShiftIntent } from "./on-shift-apply.js";
+import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
 import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { pumpExecutionSlots, renewLeases } from "./execution.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
@@ -123,7 +123,7 @@ async function join() {
         console.log(`Detected local clients: ${detected.join(", ") || "none"}`);
         console.log(`Proposed roles: ${capabilities.join(", ")}`);
         console.log(`Assignments at once: ${leaseCapacity}`);
-        console.log(`Fuel source: ${plannedFuel === "local" ? "local subscription" : "Conduit pump"}`
+        console.log(`Fuel source: ${plannedFuel === "local" ? "local agent login or environment API key" : "Conduit pump"}`
             + (!fuelSource && plannedFuel === "local" ? " (auto: only local-fuel agents detected)" : ""));
         console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/pi/kiro/antigravity/grok require local fuel).`);
         console.log("Use --machine <name> to override the computer label.\n");
@@ -269,7 +269,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
     const client = new ConduitClient(config);
     let heartbeatOk = true;
     try {
-        await heartbeat(client, config, null, unavailableWorkspacePreflight({ config }));
+        await heartbeat(client, config, null, null, unavailableWorkspacePreflight({ config }));
     }
     catch {
         heartbeatOk = false;
@@ -283,7 +283,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
     }
     console.log(`Confirmed capabilities (matching): ${config.capabilities.join(", ") || "none"}`);
     console.log(`Allowed actions: ${config.grants.join(", ") || "none"}`);
-    console.log(`Fuel source: ${config.fuelSource === "local" ? "local subscription" : "Conduit /v1 (project owner BYOK on open orgs; org credentials on invite-only)"}`
+    console.log(`Fuel source: ${config.fuelSource === "local" ? "local agent login or environment API key" : "Conduit /v1 (project owner BYOK on open orgs; org credentials on invite-only)"}`
         + (fuelAutoLocal ? " (auto: only local-fuel agents detected)" : ""));
     const localOnly = localFuelOnlyClients(detected);
     if (config.fuelSource === "conduit" && localOnly.length) {
@@ -371,9 +371,9 @@ async function initOps() {
     console.log(`Config file (separate): ${envPath}`);
     console.log("");
     console.log("Works the same on macOS, Linux, and Windows via:");
-    console.log(`  ${bridgeUsage("ops", "<connect|install|switch|online|offline|status|disconnect|uninstall>")}`);
+    console.log(`  ${bridgeUsage("ops", "<connect|install|switch|online|offline|status|doctor|disconnect|uninstall>")}`);
     console.log("");
-    console.log("1. Edit env once:");
+    console.log("1. Set enrollment/bootstrap defaults once:");
     console.log(`   Create folder: ${configDir}`);
     console.log(`   Copy ${pathJoin(target, "env.example")} → ${envPath}`);
     console.log(`   # edit ${envPath}`);
@@ -408,7 +408,7 @@ async function fuelCommand() {
     config.fuelSource = mode;
     await saveConfigPrefs(config);
     // Do not heartbeat here: a workspace-less preflight would overwrite a live runner's ready report.
-    console.log(`Machine fuel source set to ${mode === "local" ? "local subscription" : "Conduit pump"}. The runner reports it on the next heartbeat.`);
+    console.log(`Machine fuel source set to ${mode === "local" ? "local agent login or environment API key" : "Conduit pump"}. The runner reports exact lane provenance on the next heartbeat.`);
 }
 async function driversCommand() {
     const sub = process.argv[3];
@@ -511,14 +511,13 @@ async function runner() {
             const preflight = workspace
                 ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined })
                 : unavailableWorkspacePreflight({ config });
-            const hb = await heartbeat(client, config, currentBrief, preflight);
+            const hb = await heartbeat(client, config, workspace, currentBrief, preflight);
             if (hb.staleBridge) {
                 console.error(`Bridge update required: running protocol ${BRIDGE_PROTOCOL_VERSION}; control plane requires protocol ${hb.requiredProtocol ?? "unknown"} (minimum Bridge ${hb.minimumVersion ?? "unknown"}). Reinstall the latest Bridge, then restart this runner.`);
                 await new Promise((resolveSleep) => setTimeout(resolveSleep, Math.max(intervalMs, 60_000)));
                 continue;
             }
             const applied = await maybeApplyOnShiftIntent({
-                client,
                 currentWorkspace: workspace,
                 onShift: hb.on_shift,
                 runInstall: async (nextWorkspace, repo) => {
@@ -531,7 +530,7 @@ async function runner() {
                     }
                     await runOps("install", [], {
                         env: env
-                            ? { ...env, CONDUIT_WORKSPACE: nextWorkspace, CONDUIT_REPO: repo || env.CONDUIT_REPO }
+                            ? { ...env, CONDUIT_WORKSPACE: nextWorkspace, CONDUIT_REPO: repo }
                             : undefined,
                     });
                 },
@@ -540,6 +539,10 @@ async function runner() {
                 console.log("On-shift workspace applied; exiting so the background service restarts on the new checkout.");
                 process.exit(0);
             }
+            const intentProof = buildOnShiftIntentProof({ currentWorkspace: workspace, onShift: hb.on_shift });
+            if (intentProof) {
+                await heartbeat(client, config, workspace, currentBrief, preflight, intentProof);
+            }
             await renewLeases(client, config);
             if (workspace && onlineDriverIds(config).length) {
                 // Observation runs before authoring: an owner waiting on an answer should not queue behind
@@ -551,7 +554,7 @@ async function runner() {
                     heartbeat: async () => {
                         const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
                         const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined });
-                        await heartbeat(client, config, currentBrief, preflight);
+                        await heartbeat(client, config, workspace, currentBrief, preflight);
                     },
                     heartbeatIntervalMs: intervalMs,
                 }, running, {});
@@ -568,18 +571,20 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
-async function heartbeat(client, config, brief, preflight) {
+async function heartbeat(client, config, workspacePath, brief, preflight, intentProof) {
     const online = onlineDriverIds(config);
     const status = heartbeatStatusForDrivers(online);
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,
             capabilities: config.capabilities,
             lease_capacity: config.leaseCapacity,
+            workspace_path: workspacePath,
             fuel_source: config.fuelSource === "local" ? "local" : "conduit",
             bridge_version: bridgeVersion(),
             bridge_protocol: BRIDGE_PROTOCOL_VERSION,
             drivers: driversHeartbeatReport(config, config.activeAttempts),
             preflight,
+            ...(intentProof ? { on_shift_intent_proof: intentProof } : {}),
             ...(brief ? { workspace_brief: brief } : {}),
         }) });
     const compatibility = response.bridge_compatibility && typeof response.bridge_compatibility === "object"

package/dist/client.js

@@ -44,7 +44,17 @@ export class ConduitClient {
         // its hash, so the client mints it and re-sends the identical token if it ever retries the
         // claim (the idempotency key is deterministic per attempt exactly so that replay works).
         const leaseToken = `lease_${crypto.randomUUID()}${crypto.randomUUID()}`;
-        const data = await this.request(`/runner/v1/tasks/${taskId}/claim`, { method: "POST", body: JSON.stringify({ attempt_id: attemptId, lease_token: leaseToken, idempotency_key: `bridge:claim:${attemptId}` }) });
+        const data = await this.request(`/runner/v1/tasks/${taskId}/claim`, {
+            method: "POST",
+            body: JSON.stringify({
+                attempt_id: attemptId,
+                lease_token: leaseToken,
+                idempotency_key: `bridge:claim:${attemptId}`,
+                ...(extras?.driverId ? { driver_id: extras.driverId } : {}),
+                ...(extras?.fuelMode ? { fuel_mode: extras.fuelMode } : {}),
+                ...(extras?.fuelProvenance ? { fuel_provenance: extras.fuelProvenance } : {}),
+            }),
+        });
         const active = {
             taskId,
             attemptId,
@@ -52,6 +62,7 @@ export class ConduitClient {
             leaseExpiresAt: String(data.lease_expires_at),
             phase: "claimed",
             ...(extras?.driverId ? { driverId: extras.driverId } : {}),
+            ...(extras?.fuelMode ? { fuelMode: extras.fuelMode } : {}),
             ...(extras?.executionKind ? { executionKind: extras.executionKind } : {}),
             ...(extras?.sourceAttemptId ? { sourceAttemptId: extras.sourceAttemptId } : {}),
         };

package/dist/detect.js

@@ -42,7 +42,7 @@ export function probeAgentHealth(detected, env = process.env) {
         label: "Claude Code",
         installed: claudeInstalled,
         authenticated: claudeInstalled,
-        authMethod: env.ANTHROPIC_API_KEY ? "environment_key" : claudeAuth ? "local_login" : "conduit_pump",
+        authMethod: (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN) ? "environment_key" : claudeAuth ? "local_login" : "conduit_pump",
     });
     const codexInstalled = detectedSet.has("Codex CLI");
     const codexAuth = hasOpenAiLogin(env);

package/dist/drivers.js

@@ -173,6 +173,26 @@ export function resolveDriverFuel(config, driverId) {
         return lane.fuel;
     return config.fuelSource === "local" ? "local" : "conduit";
 }
+/**
+ * Credential class the selected lane will actually pass to its agent process. Secret values never
+ * leave the machine; only this bounded provenance is reported to the Control Plane.
+ */
+export function resolveDriverFuelProvenance(config, driverId, env = process.env, fuelMode = resolveDriverFuel(config, driverId)) {
+    if (fuelMode === "conduit")
+        return "conduit_gateway";
+    const apiKeys = {
+        "claude-code": ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
+        codex: ["OPENAI_API_KEY", "CODEX_API_KEY"],
+        cursor: ["CURSOR_API_KEY"],
+        opencode: ["OPENAI_API_KEY", "ANTHROPIC_API_KEY"],
+        pi: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "CODEX_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY", "XAI_API_KEY"],
+        kiro: ["KIRO_API_KEY"],
+        antigravity: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+        grok: ["XAI_API_KEY"],
+    };
+    const names = isSupportedDriverId(driverId) ? apiKeys[driverId] ?? [] : [];
+    return names.some((name) => Boolean(env[name]?.trim())) ? "environment_api_key" : "local_login";
+}
 export function setDriverFuel(config, driverId, fuel) {
     if (!isSupportedDriverId(driverId))
         throw new Error(`Unknown driver: ${driverId}`);
@@ -197,7 +217,7 @@ export function advertiseLeaseCapacity(approved, onlineIds) {
         return 1; // schema/heartbeat min; status standby prevents matching
     return approved;
 }
-export function driversHeartbeatReport(config, activeAttempts, processOnlineIds) {
+export function driversHeartbeatReport(config, activeAttempts, processOnlineIds, env = process.env) {
     const processOnline = new Set(processOnlineIds ?? []);
     const busyByDriver = new Map();
     for (const active of Object.values(activeAttempts)) {
@@ -212,6 +232,7 @@ export function driversHeartbeatReport(config, activeAttempts, processOnlineIds)
         state: processOnline.has(lane.id) ? "online" : lane.state,
         busy: (busyByDriver.get(lane.id) ?? 0) > 0,
         fuel: lane.fuel,
+        fuel_provenance: resolveDriverFuelProvenance(config, lane.id, env),
     }));
 }
 /**

package/dist/ensure-test-evidence.js

@@ -1,6 +1,6 @@
 /**
- * When the contract requires test evidence, Bridge runs one bounded verification
- * command and attaches the verbatim result. Agent prose may supplement that run;
+ * When the contract requires test evidence, Bridge runs the bounded verification
+ * commands and attaches their verbatim results. Agent prose may supplement those runs;
  * it never substitutes for it.
  */
 import { execFile } from "node:child_process";
@@ -31,6 +31,14 @@ export function pickVerificationCommand(commands) {
         .filter((command) => command && isBoundedVerificationCommand(command));
     return bounded.find(isPreferentialTestCommand) ?? bounded[0] ?? null;
 }
+/** Prefer one project-defined aggregate; otherwise witness every distinct bounded command. */
+export function verificationEvidenceCommands(commands) {
+    const bounded = [...new Set(commands
+            .map((command) => command.trim())
+            .filter((command) => command && isBoundedVerificationCommand(command)))];
+    const aggregate = bounded.find((command) => /^(?:npm run|pnpm|yarn) verify$|^make check$/.test(command));
+    return aggregate ? [aggregate] : bounded;
+}
 function argvForBoundedCommand(command) {
     return command.trim().split(/\s+/);
 }
@@ -118,11 +126,29 @@ async function defaultRunCommand(command, workspace) {
  * Reuse only criteria the agent already mapped onto a test-kind evidence entry (including thin ones
  * we are replacing). Empty mapping lets validateDeliveryReport reject met-without-evidence.
  */
-export function criteriaForTestEvidence(report) {
+function verificationCommandNames(command) {
+    const normalized = command.trim().replace(/\s+/g, " ").toLowerCase();
+    const names = new Set([normalized]);
+    if (!isBoundedVerificationCommand(normalized))
+        return names;
+    const script = normalized.match(/^(?:npm|pnpm|yarn) run ([^\s]+)(?:\s|$)/)?.[1]
+        ?? normalized.match(/^(?:pnpm|yarn) ([^\s]+)(?:\s|$)/)?.[1]
+        ?? normalized.match(/^npm ([^\s]+)(?:\s|$)/)?.[1];
+    if (script)
+        names.add(script);
+    return names;
+}
+export function criteriaForTestEvidence(report, command) {
+    const testEvidence = report.evidence.filter((item) => item.kind === "test");
+    const commandNames = command ? verificationCommandNames(command) : null;
+    const sources = commandNames
+        ? testEvidence.filter((item) => {
+            const evidenceNames = verificationCommandNames(item.name);
+            return [...commandNames].some((name) => evidenceNames.has(name));
+        })
+        : testEvidence;
     const mapped = new Set();
-    for (const item of report.evidence) {
-        if (item.kind !== "test")
-            continue;
+    for (const item of sources) {
         for (const criterion of item.acceptance_criteria ?? []) {
             if (criterion)
                 mapped.add(criterion);
@@ -131,42 +157,52 @@ export function criteriaForTestEvidence(report) {
     return [...mapped];
 }
 /**
- * If test evidence is required, run one bounded verification command in the attempt workspace
- * and attach verbatim stdout/stderr with a Bridge witness marker.
+ * If test evidence is required, run the bounded verification commands in the attempt workspace
+ * and attach verbatim stdout/stderr with Bridge witness markers.
  */
 export async function ensureTestEvidence(input) {
     if (!needsTestEvidence(input.report, input.spec, input.grants))
         return input.report;
-    const command = pickVerificationCommand(input.verificationCommands);
-    if (!command) {
+    const commands = verificationEvidenceCommands(input.verificationCommands);
+    if (commands.length === 0) {
         throw new Error("Agent report is missing required evidence: test (no bounded verification command available for Bridge to run)");
     }
     const run = input.runCommand ?? defaultRunCommand;
-    const result = await run(command, input.workspace);
-    const stdoutLines = result.stdout.trim() ? result.stdout.trim().split("\n") : [];
-    const stderrLines = result.stderr.trim() ? result.stderr.trim().split("\n") : [];
-    if (result.code !== 0) {
-        // Prefix must match FINALIZE_CONTRACT_PATTERN ("Agent report") — not Bridge-fault laundering.
-        const failedDetails = [
+    const witnessed = [];
+    for (const command of commands) {
+        const result = await run(command, input.workspace);
+        const stdoutLines = result.stdout.trim() ? result.stdout.trim().split("\n") : [];
+        const stderrLines = result.stderr.trim() ? result.stderr.trim().split("\n") : [];
+        if (result.code !== 0) {
+            // Prefix must match FINALIZE_CONTRACT_PATTERN ("Agent report") — not Bridge-fault laundering.
+            const failedDetails = [
+                `$ ${command}`,
+                ...stdoutLines,
+                ...stderrLines,
+                `exit ${result.code}`,
+            ].map((line) => line.slice(0, 4_000)).slice(0, 100);
+            throw new Error(`Agent report: Verification failed (${command}): ${failedDetails.join("\n").slice(0, 2_000)}`);
+        }
+        // Empty exit-0 is not proof — a no-op recipe (`@true`) must not clear required_evidence: test.
+        if (stdoutLines.length === 0 && stderrLines.length === 0) {
+            throw new Error(`Agent report: Verification produced no output for test evidence (${command}). A bounded test command must print observable stdout or stderr.`);
+        }
+        const details = [
             `$ ${command}`,
             ...stdoutLines,
             ...stderrLines,
             `exit ${result.code}`,
         ].map((line) => line.slice(0, 4_000)).slice(0, 100);
-        throw new Error(`Agent report: Verification failed (${command}): ${failedDetails.join("\n").slice(0, 2_000)}`);
-    }
-    // Empty exit-0 is not proof — a no-op recipe (`@true`) must not clear required_evidence: test.
-    if (stdoutLines.length === 0 && stderrLines.length === 0) {
-        throw new Error(`Agent report: Verification produced no output for test evidence (${command}). A bounded test command must print observable stdout or stderr.`);
-    }
-    const details = [
-        `$ ${command}`,
-        ...stdoutLines,
-        ...stderrLines,
-        `exit ${result.code}`,
-    ].map((line) => line.slice(0, 4_000)).slice(0, 100);
-    if (details.join("\n").trim().length < TEST_EVIDENCE_DETAILS_MIN) {
-        throw new Error(`Agent report: Verification produced insufficient output for test evidence (${command})`);
+        if (details.join("\n").trim().length < TEST_EVIDENCE_DETAILS_MIN) {
+            throw new Error(`Agent report: Verification produced insufficient output for test evidence (${command})`);
+        }
+        witnessed.push({
+            kind: "test",
+            name: command,
+            details,
+            acceptance_criteria: criteriaForTestEvidence(input.report, command),
+            witness: "bridge",
+        });
     }
     // Keep agent test prose as supplement; Bridge witness is the authoritative entry.
     const withoutThinTest = input.report.evidence.filter((item) => {
@@ -176,18 +212,14 @@ export async function ensureTestEvidence(input) {
     });
     return {
         ...input.report,
-        verification: input.report.verification.includes(command)
-            ? input.report.verification
-            : [...input.report.verification, `${command} — exit ${result.code}`],
+        verification: [
+            ...input.report.verification,
+            ...commands.filter((command) => !input.report.verification.some((item) => item.startsWith(`${command} —`)))
+                .map((command) => `${command} — exit 0`),
+        ],
         evidence: [
             ...withoutThinTest,
-            {
-                kind: "test",
-                name: command,
-                details,
-                acceptance_criteria: criteriaForTestEvidence(input.report),
-                witness: "bridge",
-            },
+            ...witnessed,
         ],
     };
 }

package/dist/execution.js

@@ -5,7 +5,7 @@ import { ConduitRequestError } from "./client.js";
 import { redactSecrets, saveDriverQuota } from "./config.js";
 import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, extractAgentReportJsonText, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseJsonObjectCandidate, pickModelCandidate, requireStampedExecutionClass, tierForRisk } from "./driver.js";
 import { assertClassFloor } from "./execution-class.js";
-import { pickDriverForClaim, recordDriverQuota, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
+import { pickDriverForClaim, recordDriverQuota, resolveDriverFuel, resolveDriverFuelProvenance, supportsReadOnlyDiagnosis } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -608,8 +608,12 @@ export async function claimNextAssignment(client, config, workspace, brief, driv
         return null;
     }
     console.log(`Claiming ${assignment.execution_kind} assignment ${assignment.id} (attempt ${assignment.attempt_id})`);
+    const fuelMode = selectedDriverId ? resolveDriverFuel(config, selectedDriverId) : undefined;
+    const fuelProvenance = selectedDriverId ? resolveDriverFuelProvenance(config, selectedDriverId) : undefined;
     await client.claim(assignment.id, assignment.attempt_id, {
         ...(selectedDriverId ? { driverId: selectedDriverId } : {}),
+        ...(fuelMode ? { fuelMode } : {}),
+        ...(fuelProvenance ? { fuelProvenance } : {}),
         executionKind: assignment.execution_kind,
         ...(assignment.source_attempt_id ? { sourceAttemptId: assignment.source_attempt_id } : {}),
     });
@@ -909,7 +913,8 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         ?? "unknown";
     if (!active.driverId && driverId !== "unknown")
         await client.updateAttempt(taskId, { driverId });
-    const fuelSource = resolveDriverFuel(config, driverId);
+    const fuelSource = active.fuelMode ?? resolveDriverFuel(config, driverId);
+    const fuelProvenance = resolveDriverFuelProvenance(config, driverId, process.env, fuelSource);
     let fuel;
     if (fuelSource === "conduit") {
         const gatewayKey = await client.ensureFuel(task.project_id);
@@ -918,6 +923,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
     const selection = await resolveAssignmentModel(driver, config, spec, taskId, attemptWorkspace, fuel);
     await client.attemptRequest(taskId, "model-selection", {
         risk: selection.risk, tier: selection.tier, model: selection.model ?? null, driver: driver.name,
+        fuel_mode: fuelSource, fuel_provenance: fuelProvenance,
         ...(selection.model ? {} : { note: "cli-default" }), idempotency_key: `model:${active.attemptId}`,
     });
     // Persist the start *after* model selection, so audit history proves the agent ran with the model
@@ -1683,7 +1689,7 @@ function parseTaskSpec(value) {
     }
 }
 async function prepareDelivery(client, attemptId, taskId, report) {
-    const fuelMode = client.attempt(taskId).fuelMode === "local" ? "local" : "conduit";
+    const fuelMode = client.attempt(taskId).fuelMode;
     const evidence = [];
     const evidenceByCriterion = new Map();
     for (const [index, item] of report.evidence.entries()) {
@@ -1717,7 +1723,7 @@ async function prepareDelivery(client, attemptId, taskId, report) {
     return {
         action: "complete",
         body: {
-            delivery_packet: { ...body, acceptance_results: acceptanceResults, ...(head_commit ? { head_commit } : {}), ...(pull_request_url ? { pull_request_url } : {}), references, fuel_mode: fuelMode },
+            delivery_packet: { ...body, acceptance_results: acceptanceResults, ...(head_commit ? { head_commit } : {}), ...(pull_request_url ? { pull_request_url } : {}), references, ...(fuelMode ? { fuel_mode: fuelMode } : {}) },
             evidence,
             idempotency_key: `bridge:complete:${attemptId}`,
         },

package/dist/on-shift-apply.js

@@ -1,15 +1,31 @@
 /**
- * Phase 2: when Connect queued a workspace intent, Bridge applies it once
- * (ops.env + install/restart) then acks. Ack runs only after install succeeds so a
- * failed apply leaves the intent queued for the next heartbeat (manual ops switch remains fallback).
- * After a successful restart, currentWorkspace matches the target so we do not re-apply.
+ * When Connect queues a workspace intent, Bridge applies it without rewriting the
+ * machine-wide ops.env. The rebound runner's matching heartbeat clears the intent;
+ * installation alone is not proof that the new process is actually bound.
  */
 import { resolve } from "node:path";
-import { homedir } from "node:os";
-import { defaultOpsEnvPath, expandOpsValue, loadOpsEnv, writeOpsEnvFile } from "./ops.js";
+import { expandOpsValue } from "./ops.js";
 function pathsEqual(left, right) {
     return resolve(expandOpsValue(left)) === resolve(expandOpsValue(right));
 }
+/** Prove a historical path alias only after this Bridge resolves it to its current workspace. */
+export function buildOnShiftIntentProof(input) {
+    const intent = input.onShift?.on_shift_intent;
+    if (input.onShift?.binding_status !== "bound"
+        || !input.currentWorkspace
+        || !intent?.workspace_path?.trim()
+        || !intent.intent_at)
+        return null;
+    const current = resolve(expandOpsValue(input.currentWorkspace));
+    if (!pathsEqual(current, intent.workspace_path))
+        return null;
+    return {
+        workspace_path: intent.workspace_path,
+        resolved_workspace_path: current,
+        repository_url: intent.repository_url,
+        intent_at: intent.intent_at,
+    };
+}
 /**
  * If control-plane intent names a different workspace than this runner, apply and return true
  * (caller should exit so install-service / LaunchAgent restarts).
@@ -20,36 +36,17 @@ export async function maybeApplyOnShiftIntent(input) {
         return false;
     const target = resolve(expandOpsValue(intentPath));
     const current = input.currentWorkspace ? resolve(expandOpsValue(input.currentWorkspace)) : null;
-    if (current && pathsEqual(current, target)) {
-        // Already on the declared path — leave intent for Bound clear on heartbeat.
-        return false;
-    }
     const repo = (input.onShift?.on_shift_intent?.repository_url
         ?? input.onShift?.expected_repository
         ?? "").trim();
-    if (input.writeEnv) {
-        input.writeEnv(target, repo);
-    }
-    else {
-        let envPath = defaultOpsEnvPath(homedir());
-        try {
-            envPath = loadOpsEnv().loadedFrom ?? envPath;
-        }
-        catch {
-            // First apply may create ops.env at the default path.
-        }
-        writeOpsEnvFile(envPath, {
-            CONDUIT_WORKSPACE: target,
-            ...(repo ? { CONDUIT_REPO: repo } : {}),
-        });
+    if (current && pathsEqual(current, target)) {
+        // A matching path is sufficient only when there is no repository target, or when the
+        // control plane already observed the target fingerprint. Same path + different repo must
+        // still run checkout/install; path-only equality caused stale-project loops.
+        if (!repo || input.onShift?.binding_status === "bound")
+            return false;
     }
     console.log(`Applying on-shift workspace intent: ${target}${repo ? ` (${repo})` : ""}`);
     await input.runInstall(target, repo);
-    // Ack only after install succeeds. A rebound service that already matches the target
-    // short-circuits above and will not re-apply; Bound clears any leftover intent.
-    await input.client.request("/runner/v1/machine/ack-on-shift-intent", {
-        method: "POST",
-        body: "{}",
-    });
     return true;
 }

package/dist/ops.js

@@ -6,6 +6,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
 import { ConduitClient } from "./client.js";
 import { loadConfig } from "./config.js";
@@ -13,7 +15,7 @@ import { ensureCheckout } from "./checkout.js";
 import { detectInstalledClients, probeAgentHealth } from "./detect.js";
 import { driverIdsFromDetectedLabels } from "./drivers.js";
 import { BRIDGE_PROTOCOL_VERSION, describePreflightIssue, runBridgePreflight } from "./preflight.js";
-import { applyRunnerToolPath, runnerServiceWorkspaceWarnings } from "./service.js";
+import { applyRunnerToolPath, readActiveRunnerServiceWorkspace, readStoredRunnerServiceOptions, runnerServiceWorkspaceWarnings } from "./service.js";
 import { bridgeVersion } from "./version.js";
 import { bootstrapManagedWorkspace } from "./workspace-bootstrap.js";
 export const OPS_VERBS = [
@@ -51,7 +53,7 @@ export function expandOpsValue(value, home = homedir()) {
     }
     next = next.replace(/%USERPROFILE%/gi, home).replace(/%HOME%/gi, home);
     next = next.replace(/\$HOME\b/g, home).replace(/\$\{HOME\}/g, home);
-    if (next.startsWith("~/") || next === "~")
+    if (next.startsWith("~/") || next.startsWith("~\\") || next === "~")
         next = join(home, next.slice(2));
     return next;
 }
@@ -67,7 +69,12 @@ export function parseOpsEnvFile(text, home = homedir()) {
         const key = line.slice(0, eq).trim();
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
             continue;
-        out[key] = expandOpsValue(line.slice(eq + 1), home);
+        // Drop a trailing annotation such as `CONDUIT_WORKSPACE=$HOME/repo # laptop`, so it does not
+        // become part of the path. A quoted value keeps everything inside its quotes, and a `#` with no
+        // space before it stays in the value.
+        const rawValue = line.slice(eq + 1).trim();
+        const quoted = rawValue.startsWith('"') || rawValue.startsWith("'");
+        out[key] = expandOpsValue(quoted ? rawValue : rawValue.replace(/\s+#.*$/, ""), home);
     }
     return out;
 }
@@ -88,7 +95,10 @@ export function loadOpsEnv(home = homedir(), cwd = process.cwd()) {
     }
     const pick = (key, fallback) => {
         const fromEnv = process.env[key];
-        if (fromEnv !== undefined && fromEnv !== "")
+        // An explicit empty value clears a stale file default (notably CONDUIT_REPO when a new
+        // project has no declared repository yet). Process authority must not resurrect old project
+        // context from ops.env.
+        if (fromEnv !== undefined)
             return expandOpsValue(fromEnv, home);
         if (fileValues[key])
             return fileValues[key];
@@ -182,6 +192,20 @@ export function shellQuoteArgs(args) {
         return `"${arg.replaceAll('"', '\\"')}"`;
     }).join(" ");
 }
+/** Ask the operator to approve a step that cannot be undone. Non-interactive shells must pass --yes. */
+async function confirmOps(question) {
+    if (!input.isTTY || !output.isTTY) {
+        throw new Error("This step needs confirmation. Re-run with --yes to approve it without a prompt.");
+    }
+    const rl = createInterface({ input, output });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer === "y" || answer === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}
 function defaultRunBridge(args, options = {}) {
     // Re-enter this package's CLI in a child so ops stays a thin orchestrator.
     const cli = process.argv[1];
@@ -202,6 +226,13 @@ export async function runOps(verb, argv = [], deps = {}) {
     const runBridge = deps.runBridge ?? defaultRunBridge;
     const env = deps.env ?? loadOpsEnv();
     if (verb === "disconnect") {
+        // Ask here, not in the child command: this verb also removes the runner service, and the
+        // child's own prompt would come too late to stop that.
+        const approved = argv.includes("--yes") || argv.includes("-y") || await (deps.confirm ?? confirmOps)("Disengage this computer from the organization, remove the runner service, and clear local credentials? [y/N] ");
+        if (!approved) {
+            console.log("Cancelled.");
+            return;
+        }
         runBridge(["uninstall-service"], { allowFail: true });
         runBridge(["disconnect", "--yes"]);
         console.log("Disconnected. Run: npx @miraland-labs/conduit-bridge@latest ops connect");
@@ -236,37 +267,49 @@ export async function runOps(verb, argv = [], deps = {}) {
         if (env.loadedFrom) {
             console.log(`Env: ${env.loadedFrom}`);
             console.log(`URL: ${env.CONDUIT_URL || "(unset)"}`);
-            console.log(`Workspace: ${env.CONDUIT_WORKSPACE || "(unset)"}`);
-            console.log(`Repo: ${env.CONDUIT_REPO || "(none)"}`);
+            console.log(`Bootstrap workspace: ${env.CONDUIT_WORKSPACE || "(unset)"}`);
+            console.log(`Bootstrap repo: ${env.CONDUIT_REPO || "(none)"}`);
             console.log(`Drivers: ${env.CONDUIT_DRIVERS || "(auto-detect installed agents)"}`);
             console.log(`Roles: ${env.CONDUIT_ROLES}`);
-            if (env.CONDUIT_WORKSPACE) {
-                for (const warning of runnerServiceWorkspaceWarnings(resolve(expandOpsValue(env.CONDUIT_WORKSPACE)))) {
-                    console.warn(`WARNING: ${warning}`);
-                }
-            }
             console.log("");
         }
         else {
             console.log("No ops.env loaded (showing drivers only).\n");
         }
+        console.log(`Active runner workspace: ${await (deps.readActiveRunnerServiceWorkspace ?? readActiveRunnerServiceWorkspace)() ?? "(not installed)"}`);
         runBridge(["drivers"]);
         return;
     }
     if (verb === "doctor") {
-        requireOpsEnv(env);
-        if (!env.CONDUIT_WORKSPACE)
-            throw new Error(`Set CONDUIT_WORKSPACE in ${defaultOpsEnvPath()}`);
+        const { values } = parseArgs({
+            args: argv,
+            options: {
+                workspace: { type: "string" },
+                repo: { type: "string" },
+                "skip-service-alignment": { type: "boolean" },
+            },
+            allowPositionals: false,
+        });
+        const stored = await (deps.readStoredRunnerServiceOptions ?? readStoredRunnerServiceOptions)();
+        const workspaceRaw = values.workspace?.trim() || stored?.workspace || env.CONDUIT_WORKSPACE;
+        const expectedRepository = values.repo !== undefined
+            ? values.repo.trim()
+            : stored?.ensureCheckout ?? env.CONDUIT_REPO;
+        requireOpsEnv({ ...env, CONDUIT_WORKSPACE: workspaceRaw });
+        if (!workspaceRaw)
+            throw new Error(`Install a runner service or set a bootstrap CONDUIT_WORKSPACE in ${defaultOpsEnvPath()}`);
         applyRunnerToolPath();
         const config = await (deps.loadBridgeConfig ?? loadConfig)();
-        const workspace = resolve(expandOpsValue(env.CONDUIT_WORKSPACE));
-        for (const warning of runnerServiceWorkspaceWarnings(workspace)) {
-            console.warn(`WARNING: ${warning}`);
+        const workspace = resolve(expandOpsValue(workspaceRaw));
+        if (!values["skip-service-alignment"]) {
+            for (const warning of runnerServiceWorkspaceWarnings(workspace)) {
+                console.warn(`WARNING: ${warning}`);
+            }
         }
         const report = await (deps.preflight ?? runBridgePreflight)({
             config,
             workspace,
-            expectedRepository: env.CONDUIT_REPO || undefined,
+            expectedRepository: expectedRepository || undefined,
         });
         const installed = await detectInstalledClients();
         const health = probeAgentHealth(installed, process.env);
@@ -287,8 +330,8 @@ export async function runOps(verb, argv = [], deps = {}) {
             console.log("");
         }
         if (report.ready) {
-            const serviceWarnings = runnerServiceWorkspaceWarnings(workspace);
-            if (serviceWarnings.length) {
+            const serviceWarnings = values["skip-service-alignment"] ? [] : runnerServiceWorkspaceWarnings(workspace);
+            if (serviceWarnings.length > 0) {
                 for (const warning of serviceWarnings)
                     console.warn(`WARNING: ${warning}`);
                 throw new Error("Background runner service workspace does not match ops.env");
@@ -306,8 +349,8 @@ export async function runOps(verb, argv = [], deps = {}) {
         runBridge(["drivers", verb, ...drivers]);
         return;
     }
-    // `ops install --workspace <path> [--repo <url>]` persists declared intent into ops.env so the
-    // Connect UI path works without hand-editing a config file first.
+    // Explicit install arguments are active-run inputs, not machine-wide defaults. Enrollment may
+    // seed ops.env once; later project changes must not mutate it.
     let installEnv = env;
     let installArgv = argv;
     if (verb === "install") {
@@ -323,20 +366,14 @@ export async function runOps(verb, argv = [], deps = {}) {
         const declaredWorkspace = values.workspace?.trim();
         const declaredRepo = values.repo?.trim();
         if (declaredWorkspace || declaredRepo) {
-            const envPath = env.loadedFrom ?? defaultOpsEnvPath();
-            writeOpsEnvFile(envPath, {
-                ...(declaredWorkspace ? { CONDUIT_WORKSPACE: declaredWorkspace } : {}),
-                ...(declaredRepo ? { CONDUIT_REPO: declaredRepo } : {}),
-            });
-            console.log(`Saved ${[
-                declaredWorkspace ? `workspace ${declaredWorkspace}` : "",
-                declaredRepo ? `repo ${declaredRepo}` : "",
-            ].filter(Boolean).join(" and ")} to ${envPath}`);
             installEnv = {
                 ...env,
-                ...(declaredWorkspace ? { CONDUIT_WORKSPACE: declaredWorkspace } : {}),
+                ...(declaredWorkspace ? {
+                    CONDUIT_WORKSPACE: declaredWorkspace,
+                    // A new explicit workspace must not inherit the prior bootstrap repository.
+                    CONDUIT_REPO: declaredRepo ?? "",
+                } : {}),
                 ...(declaredRepo ? { CONDUIT_REPO: declaredRepo } : {}),
-                loadedFrom: env.loadedFrom ?? envPath,
             };
         }
     }
@@ -355,13 +392,26 @@ export async function runOps(verb, argv = [], deps = {}) {
         if (!projectId) {
             throw new Error("Usage: ops switch --project <project-id> [--workspace <path>] [--repo <url>]");
         }
-        const workspaceRaw = values.workspace?.trim() || env.CONDUIT_WORKSPACE;
+        const declaredWorkspace = values.workspace?.trim();
+        const declaredRepo = values.repo?.trim();
+        const [activeWorkspace, stored] = await Promise.all([
+            (deps.readActiveRunnerServiceWorkspace ?? readActiveRunnerServiceWorkspace)(),
+            (deps.readStoredRunnerServiceOptions ?? readStoredRunnerServiceOptions)(),
+        ]);
+        const workspaceRaw = declaredWorkspace || activeWorkspace || stored?.workspace || env.CONDUIT_WORKSPACE;
         if (!workspaceRaw)
             throw new Error(`Set CONDUIT_WORKSPACE in ${defaultOpsEnvPath()} or pass --workspace`);
         const workspace = resolve(expandOpsValue(workspaceRaw));
-        const repo = (values.repo?.trim() || env.CONDUIT_REPO || "").trim();
-        const envPath = env.loadedFrom ?? defaultOpsEnvPath();
-        // Control plane first — do not rewrite ops.env if affinity replace fails.
+        const storedWorkspace = stored?.workspace ? resolve(expandOpsValue(stored.workspace)) : null;
+        const repo = (declaredRepo ?? (declaredWorkspace
+            ? ""
+            : storedWorkspace === workspace
+                ? stored?.ensureCheckout ?? ""
+                : activeWorkspace || stored?.workspace
+                    ? ""
+                    : env.CONDUIT_REPO)).trim();
+        // Control plane first. Its intent is the target authority; the installed runner command is
+        // the local runtime authority. ops.env remains enrollment/bootstrap input only.
         const config = await (deps.loadBridgeConfig ?? loadConfig)();
         const client = new ConduitClient(config);
         const result = await client.request("/runner/v1/machine/switch-project", {
@@ -373,29 +423,17 @@ export async function runOps(verb, argv = [], deps = {}) {
             }),
         });
         console.log(`Control plane on-shift: ${String(result.project_id ?? projectId)} (${String(result.binding_status ?? "pending")})`);
-        writeOpsEnvFile(envPath, {
-            CONDUIT_WORKSPACE: workspace,
-            ...(repo ? { CONDUIT_REPO: repo } : {}),
-        });
-        console.log(`Updated ${envPath}`);
         console.log(`On-shift workspace: ${workspace}${repo ? ` (${repo})` : ""}`);
         // Same install path as ops install — restart runner against the new checkout.
-        const switched = loadOpsEnv();
         await runOps("install", [], {
             ...deps,
             env: {
-                ...switched,
+                ...env,
                 CONDUIT_WORKSPACE: workspace,
-                CONDUIT_REPO: repo || switched.CONDUIT_REPO,
+                CONDUIT_REPO: repo,
             },
         });
-        // Clear queued intent only after install succeeds so a failed apply can retry via heartbeat.
-        try {
-            await client.request("/runner/v1/machine/ack-on-shift-intent", { method: "POST", body: "{}" });
-        }
-        catch {
-            // Older control planes omit ack — local ops.env still wins.
-        }
+        // The target runner heartbeat clears the queued intent only after it proves Bound.
         return;
     }
     if (verb === "connect") {
@@ -466,29 +504,32 @@ export async function runOps(verb, argv = [], deps = {}) {
          * intent and Bridge clones into <root>/<owner>/<repo> and restarts on it.
          */
         const managed = values.managed !== undefined;
-        const managedRoot = managed ? (values.managed?.trim() || DEFAULT_MANAGED_ROOT) : "";
-        const workspace = managed ? managedRoot : (values.workspace?.trim() || env.CONDUIT_WORKSPACE);
-        const repo = managed ? "" : (values.repo?.trim() || env.CONDUIT_REPO);
+        const managedRoot = managed ? resolve(expandOpsValue(values.managed?.trim() || DEFAULT_MANAGED_ROOT)) : "";
+        const declaredWorkspace = values.workspace?.trim();
+        const declaredRepo = values.repo?.trim();
+        const workspace = managed ? managedRoot : (declaredWorkspace || env.CONDUIT_WORKSPACE);
+        const repo = managed ? "" : (declaredRepo ?? (declaredWorkspace ? "" : env.CONDUIT_REPO));
         const machine = values.machine?.trim();
         const envPath = env.loadedFrom ?? defaultOpsEnvPath();
         writeOpsEnvFile(envPath, {
             CONDUIT_URL: url,
             ...(workspace ? { CONDUIT_WORKSPACE: workspace } : {}),
-            ...(repo ? { CONDUIT_REPO: repo } : {}),
-            ...(managed ? { CONDUIT_MANAGED_ROOT: managedRoot } : {}),
+            CONDUIT_REPO: repo,
+            CONDUIT_MANAGED_ROOT: managedRoot,
         });
+        const enrollmentEnv = {
+            ...env,
+            CONDUIT_URL: url,
+            CONDUIT_WORKSPACE: workspace,
+            CONDUIT_REPO: repo,
+            CONDUIT_MANAGED_ROOT: managedRoot,
+            loadedFrom: envPath,
+        };
         // Resolve the local lane before redeeming the single-use token. A missing coding agent is a
         // local prerequisite, not an enrollment failure, and must leave the token available to retry.
         // `--no-install` remains the explicit credential-only escape hatch.
         const installDrivers = !values["no-install"] && workspace
-            ? await (deps.resolveInstallDrivers ?? resolveInstallDrivers)({
-                ...env,
-                CONDUIT_URL: url,
-                CONDUIT_WORKSPACE: workspace,
-                CONDUIT_REPO: repo,
-                CONDUIT_MANAGED_ROOT: managedRoot,
-                loadedFrom: envPath,
-            }, [])
+            ? await (deps.resolveInstallDrivers ?? resolveInstallDrivers)(enrollmentEnv, [])
             : [];
         if (managed)
             mkdirSync(resolve(expandOpsValue(managedRoot)), { recursive: true });
@@ -519,8 +560,7 @@ export async function runOps(verb, argv = [], deps = {}) {
             return;
         }
         if (workspace) {
-            const refreshedEnv = loadOpsEnv();
-            await runOps("install", installDrivers, { ...deps, env: refreshedEnv });
+            await runOps("install", installDrivers, { ...deps, env: enrollmentEnv });
         }
         return;
     }
@@ -566,7 +606,12 @@ export async function runOps(verb, argv = [], deps = {}) {
             && !installEnv.CONDUIT_REPO);
         if (!waitingOnManagedAssignment) {
             // Prove the exact local environment before installing a service that advertises availability.
-            runBridge(["ops", "doctor"]);
+            runBridge([
+                "ops", "doctor",
+                "--workspace", workspace,
+                "--repo", installEnv.CONDUIT_REPO,
+                "--skip-service-alignment",
+            ]);
         }
         const installArgs = ["install-service", "--workspace", workspace];
         if (installEnv.CONDUIT_REPO)

package/dist/preflight.js

@@ -16,9 +16,9 @@ function modelsFingerprint(config) {
     }).join(";");
     return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
-// Protocol 5 makes the lease-token claim contract explicit. Older Bridges may report a green
-// preflight but cannot claim against the current control plane, so they must be admitted as stale.
-export const BRIDGE_PROTOCOL_VERSION = 7;
+// Protocol 8 reports the resolved lane fuel and credential provenance in heartbeat and claim, so
+// the control plane can freeze what will actually run before the agent spends tokens.
+export const BRIDGE_PROTOCOL_VERSION = 8;
 const execFileAsync = promisify(execFile);
 async function defaultCommandRunner(command, args, cwd) {
     try {
@@ -181,7 +181,7 @@ export function describePreflightIssue(issue) {
     // Named before the fallback: an exhausted lane fell through to "requires local fuel", which sends
     // the operator to change a fuel setting when the lane is configured correctly and simply spent.
     if (issue.code === "driver_quota_exhausted") {
-        return "Every online agent lane has spent its subscription allowance; work resumes when a window refills, or bring another lane online";
+        return "Every online local-fuel lane is unavailable; work resumes when a reported provider allowance recovers, or bring another lane online";
     }
     return `Agent lane requires local fuel${lane}`;
 }

package/dist/service.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, readdir, unlink, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { existsSync, realpathSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 export const SERVICE_LABEL = "io.miraland.conduit-runner";
@@ -95,7 +95,7 @@ ${argsXml}
 `;
 }
 export function systemdUserUnit(programArguments, workingDirectory, pathEnv = runnerServicePath()) {
-    const execStart = programArguments.map(escapeSystemd).join(" ");
+    const execStart = programArguments.map(escapeSystemdExecArgument).join(" ");
     return `[Unit]
 Description=Conduit Bridge runner
 After=network-online.target
@@ -103,8 +103,9 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-WorkingDirectory=${workingDirectory}
-Environment=PATH=${escapeSystemd(pathEnv)}
+WorkingDirectory=${escapeSystemdUnitValue(workingDirectory)}
+Environment=PATH=${escapeSystemdUnitValue(pathEnv)}
+Environment=CONDUIT_RUNNER_SERVICE=systemd
 ExecStart=${execStart}
 Restart=always
 RestartSec=5
@@ -116,10 +117,16 @@ WantedBy=default.target
 function escapeXml(value) {
     return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
-function escapeSystemd(value) {
-    if (/[\s"'\\]/.test(value))
-        return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-    return value;
+function escapeSystemdUnitValue(value) {
+    // Unit values expand % specifiers. Environment= and WorkingDirectory= keep $ literal.
+    const literal = value.replaceAll("%", "%%");
+    if (/[\s"'\\]/.test(literal))
+        return `"${literal.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+    return literal;
+}
+function escapeSystemdExecArgument(value) {
+    // Exec*= additionally expands $ environment references; $$ passes one literal dollar.
+    return escapeSystemdUnitValue(value.replaceAll("$", () => "$$"));
 }
 function launchAgentsPath() {
     return join(homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
@@ -137,52 +144,53 @@ export function parseRunnerWorkspaceFromProgramArguments(args) {
 }
 export function parseRunnerWorkspaceFromExecStart(execStart) {
     const match = /--workspace(?:=|\s+)(?:"([^"]+)"|'([^']+)'|([^\s]+))/.exec(execStart);
-    return match?.[1] ?? match?.[2] ?? match?.[3] ?? null;
+    const value = match?.[1] ?? match?.[2] ?? match?.[3] ?? null;
+    return value?.replaceAll("%%", "%").replaceAll("$$", "$") ?? null;
 }
-function dropInOverridesExecStart(content) {
-    return /^\s*ExecStart\s*=/m.test(content);
+/** Parse the effective drop-ins reported by systemd without reading their contents. */
+export function parseSystemdDropInPaths(value) {
+    return value.trim().split(/\s+/).filter((path) => path.endsWith(".conf"));
 }
-/** Drop-in fragments that override ExecStart can silently hijack ops install — strip them. */
-export async function removeExecStartOverridesFromSystemdDropIns(home = homedir()) {
+/** Any effective drop-in can change workspace, identity, fuel, PATH, or restart behaviour. */
+export async function systemdDropInConflicts(home = homedir()) {
+    const conflicts = new Set();
     const dir = systemdDropInDir(home);
-    if (!existsSync(dir))
-        return [];
-    const removed = [];
-    for (const name of await readdir(dir)) {
-        if (!name.endsWith(".conf"))
-            continue;
-        const path = join(dir, name);
-        const content = await readFile(path, "utf8");
-        if (!dropInOverridesExecStart(content))
-            continue;
-        const kept = content.split(/\r?\n/).filter((line) => {
-            const trimmed = line.trim();
-            return trimmed && !trimmed.startsWith("#") && !/^ExecStart\s*=/.test(trimmed);
-        });
-        if (kept.length === 0) {
-            await unlink(path);
+    if (existsSync(dir)) {
+        for (const name of await readdir(dir)) {
+            if (name.endsWith(".conf"))
+                conflicts.add(name);
         }
-        else {
-            const next = content.split(/\r?\n/).filter((line) => !/^\s*ExecStart\s*=/.test(line)).join("\n").trimEnd();
-            await writeFile(path, next ? `${next}\n` : "", { mode: 0o644 });
-            if (!next)
-                await unlink(path).catch(() => undefined);
+    }
+    if (platform() === "linux") {
+        const effective = spawnSync("systemctl", ["--user", "show", "conduit-runner.service", "--property=DropInPaths", "--value"], { encoding: "utf8" });
+        if (effective.status === 0) {
+            for (const path of parseSystemdDropInPaths(effective.stdout))
+                conflicts.add(basename(path));
         }
-        removed.push(name);
     }
-    return removed;
+    return [...conflicts].sort();
 }
-export async function readStoredRunnerServiceWorkspace(home = homedir()) {
+export async function readStoredRunnerServiceOptions() {
     try {
         const stored = JSON.parse(await readFile(serviceStatePath(), "utf8"));
-        return stored.options.workspace
-            ?? parseRunnerWorkspaceFromProgramArguments(stored.programArguments)
-            ?? null;
+        return {
+            ...stored.options,
+            workspace: stored.options.workspace
+                ?? parseRunnerWorkspaceFromProgramArguments(stored.programArguments)
+                ?? undefined,
+        };
     }
     catch {
         return null;
     }
 }
+export async function readStoredRunnerServiceWorkspace() {
+    return (await readStoredRunnerServiceOptions())?.workspace ?? null;
+}
+/** Installed supervisor command is the active workspace authority; service.json is fallback. */
+export async function readActiveRunnerServiceWorkspace(home = homedir()) {
+    return readEffectiveLinuxRunnerWorkspace(home) ?? await readStoredRunnerServiceWorkspace();
+}
 /** Effective workspace from the installed supervisor (systemd user unit on Linux). */
 export function readEffectiveLinuxRunnerWorkspace(home = homedir()) {
     if (platform() !== "linux")
@@ -264,6 +272,21 @@ function sleepMs(ms) {
 export function runningInsideRunnerLaunchAgent() {
     return process.env.XPC_SERVICE_NAME === SERVICE_LABEL;
 }
+/** True when install-service was invoked by the systemd runner it is replacing. */
+export function runningInsideRunnerSystemd(env = process.env) {
+    return env.CONDUIT_RUNNER_SERVICE === "systemd";
+}
+/**
+ * Reloading a unit does not replace an already-running ExecStart. Interactive installs restart
+ * explicitly; the resident runner must return to its caller and exit normally, after which
+ * Restart=always starts the rewritten unit.
+ */
+export function systemdActivationCommands(insideRunner) {
+    return [
+        ["--user", "enable", "conduit-runner.service"],
+        ...(!insideRunner ? [["--user", "restart", "conduit-runner.service"]] : []),
+    ];
+}
 /**
  * Boot out (ignore miss), bootstrap with retries, then enable + kickstart.
  * Returns whether `launchctl print` sees the service.
@@ -336,16 +359,18 @@ export async function installRunnerService(options = {}) {
         return { path: plistPath, platform: "darwin" };
     }
     const unitPath = systemdUnitPath();
-    const removedDropIns = await removeExecStartOverridesFromSystemdDropIns();
-    if (removedDropIns.length) {
-        console.warn(`Removed stale systemd drop-in(s) that overrode ExecStart: ${removedDropIns.join(", ")}. ` +
-            "Those files can silently point the runner at the wrong checkout after ops switch.");
+    const dropIns = await systemdDropInConflicts();
+    if (dropIns.length) {
+        throw new Error(`Refusing to install with conduit-runner.service drop-in(s): ${dropIns.join(", ")}. ` +
+            "Review and migrate or remove them, then run ops install again.");
     }
     await mkdir(dirname(unitPath), { recursive: true });
     await mkdir(linuxLogDir(), { recursive: true });
     await writeFile(unitPath, systemdUserUnit(programArguments, configDir()), { mode: 0o644 });
     run("systemctl", ["--user", "daemon-reload"]);
-    run("systemctl", ["--user", "enable", "--now", "conduit-runner.service"]);
+    for (const args of systemdActivationCommands(runningInsideRunnerSystemd())) {
+        run("systemctl", args);
+    }
     await writeFile(serviceStatePath(), `${JSON.stringify({ platform: "linux", programArguments, options, installed_at: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
     return { path: unitPath, platform: "linux" };
 }

package/ops/conduit-ops.cmd

@@ -4,5 +4,5 @@ if "%~1"=="" (
   echo Usage: %~nx0 ^<connect^|install^|online^|offline^|status^|doctor^|disconnect^|uninstall^> [args…]
   exit /b 1
 )
-npx --yes @miraland-labs/conduit-bridge@latest ops %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/connect.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use connect.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops connect %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops connect %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/disconnect.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use disconnect.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops disconnect %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops disconnect %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/doctor.cmd

@@ -1,3 +1,3 @@
 @echo off
-npx --yes @miraland-labs/conduit-bridge@latest ops doctor %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops doctor %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/env.example

@@ -1,4 +1,5 @@
-# Configuration (not scripts). Copy to ~/.config/conduit/ops.env and edit once.
+# Enrollment/bootstrap defaults. Copy to ~/.config/conduit/ops.env and edit once.
+# Project switches come from Conduit and the installed runner command; do not edit this file per project.
 # Same file works on macOS, Linux, and Windows ($HOME / %USERPROFILE% / ~ are expanded).
 #
 # Cross-platform commands (any OS):
@@ -6,13 +7,14 @@
 #   npx @miraland-labs/conduit-bridge@latest ops install
 # Local shortcuts after init-ops: ~/conduit/ops/*.sh (Mac/Linux) or *.cmd (Windows)
 #
-# Replace the placeholders below with YOUR org, local checkout, and (optional) git remote.
+# Replace the placeholders below with initial connection defaults.
 CONDUIT_URL=https://api.conduit.miraland.io
 # Leave CONDUIT_ORG unset so `ops connect` asks "Join which org?".
 # Or pass once: ops connect --organization your-org-slug
 # Prefer the Connect UI join command (includes the org you are signed into).
 # CONDUIT_ORG=your-org-slug
-CONDUIT_WORKSPACE=$HOME/path/to/your-repo
+# Optional bootstrap checkout for the first install. Later switches do not rewrite these values.
+# CONDUIT_WORKSPACE=$HOME/path/to/your-repo
 # CONDUIT_REPO=https://github.com/your-org/your-repo.git
 # Leave CONDUIT_DRIVERS unset to auto-detect the coding agents installed on this computer.
 # Pin explicitly only when you want a subset, e.g.:

package/ops/install.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use install.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops install %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops install %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/offline.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use offline.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops offline %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops offline %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/online.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use online.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops online %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops online %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/status.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use status.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops status %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops status %*
 if errorlevel 1 exit /b %errorlevel%

package/ops/uninstall.cmd

@@ -1,4 +1,4 @@
 @echo off
 REM Windows launcher. macOS/Linux: use uninstall.sh
-npx --yes @miraland-labs/conduit-bridge@latest ops uninstall %*
+call npx --yes @miraland-labs/conduit-bridge@latest ops uninstall %*
 if errorlevel 1 exit /b %errorlevel%

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.18",
+  "version": "0.16.20",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {