@miraland-labs/conduit-bridge 0.16.182 → 0.16.185

package/dist/cli.js

@@ -676,7 +676,9 @@ async function runner() {
             if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning) {
                 // Read the workspace again, then publish it. The last brief stands if the read fails.
                 const publishWorkspaceState = async (options = {}) => {
-                    const refresh = await reportedRefresh(workspace, options);
+                    // Not while an investigation runs: its observation-only check compares the source checkout
+                    // before and after, and the runner's own fast-forward must not fail that check (CR18).
+                    const refresh = investigationRunning ? lastRefresh?.result ?? null : await reportedRefresh(workspace, options);
                     const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
                     const preflight = await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh, agentTimeoutMs: timeoutMs }, options);
                     const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
@@ -687,11 +689,17 @@ async function runner() {
                 };
                 // Observation runs before authoring: an owner waiting on an answer should not queue behind
                 // a long delivery, and the control plane already counted this slot as busy.
-                progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs, {
-                    managedRoot: hb.on_shift?.managed_workspace_root ?? null,
-                    heartbeat: publishHeartbeat,
-                    heartbeatIntervalMs: intervalMs,
-                }) || progressed;
+                investigationRunning = true;
+                try {
+                    progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs, {
+                        managedRoot: hb.on_shift?.managed_workspace_root ?? null,
+                        heartbeat: publishHeartbeat,
+                        heartbeatIntervalMs: intervalMs,
+                    }) || progressed;
+                }
+                finally {
+                    investigationRunning = false;
+                }
                 progressed = await pumpExecutionSlots(client, config, workspace, brief, timeoutMs, {
                     heartbeat: publishHeartbeat,
                     beforeClaim: async (driverId) => {
@@ -723,6 +731,8 @@ async function runner() {
 }
 /** True while the gate rehearsal runs in the background; the loop keeps beating but claims nothing. */
 let gateRehearsalRunning = false;
+/** An observation fingerprints the source checkout; a fast-forward under it reads as the observer writing. */
+let investigationRunning = false;
 /** The rehearsals the heartbeat reports, one per on-shift repository; empty reports no field. */
 let reportedGateRehearsals = [];
 /** The last on-shift snapshot, so the next cycle knows every repository this computer serves. */

package/dist/driver.js

@@ -2021,6 +2021,8 @@ export function untrustedCodeEnvironment(scratchHome) {
         GIT_SSH_COMMAND: "ssh -F /dev/null -o BatchMode=yes -o IdentitiesOnly=yes -o IdentityAgent=none -i /dev/null",
     };
 }
+/** Where a bwrap gate sees its TMPDIR; /tmp is a fresh tmpfs per spawn, so the name never collides. */
+export const SANDBOX_TEMP = "/tmp/gate";
 /** Pure spawn projection; parent mounts precede their writable children. */
 export function buildUntrustedCodeSpawn(input, host) {
     const direct = { command: input.command, argv: input.argv, cwd: input.cwd, env: input.env };
@@ -2034,6 +2036,9 @@ export function buildUntrustedCodeSpawn(input, host) {
         const argv = ["--die-with-parent", "--new-session", "--unshare-net", "--unshare-pid", "--unshare-ipc", "--unshare-uts",
             "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc",
             ...["/tmp", "/run", "/home", "/root"].flatMap((path) => ["--tmpfs", path]),
+            // Before every path bind: a nested sandbox's cwd and home live under /tmp/gate, and a later
+            // mount here would shadow them (CR17g, 2026-10-22: 8 of Conduit's own gate tests inside a gate).
+            ...(host.tempMount ? ["--bind", host.tempMount.source, host.tempMount.target] : []),
             ...(host.sourceRepository ? ["--ro-bind", host.sourceRepository, host.sourceRepository] : []),
             ...(host.toolchainRead ?? []).flatMap((path) => ["--ro-bind", path, path]),
             ...(rootWorkspace ? ["--bind", input.cwd, input.cwd] : []),
@@ -2202,8 +2207,12 @@ export async function untrustedCodeSpawn(input) {
     const home = await realpath(input.env.HOME);
     const temp = join(home, "tmp");
     await mkdir(temp, { recursive: true });
+    // CR17f (2026-10-22): under an attempt worktree this temp is ~150 bytes deep, past the 108-byte
+    // Unix socket limit, and a listen there fails or collides. bwrap shows it at a short path instead.
+    const tempMount = sandbox.os_sandbox === "bwrap" ? { source: temp, target: SANDBOX_TEMP } : undefined;
+    const visibleTemp = tempMount?.target ?? temp;
     const env = { ...input.env, PATH: (await sandboxPathDirectories(input.env)).join(delimiter), HOME: home, XDG_CONFIG_HOME: join(home, "config"),
-        XDG_CACHE_HOME: join(home, "cache"), XDG_DATA_HOME: join(home, "data"), TMPDIR: temp, TMP: temp, TEMP: temp };
+        XDG_CACHE_HOME: join(home, "cache"), XDG_DATA_HOME: join(home, "data"), TMPDIR: visibleTemp, TMP: visibleTemp, TEMP: visibleTemp };
     const writable = [cwd, home, temp];
     for (const key of ["CARGO_TARGET_DIR", "CARGO_HOME"]) {
         const path = input.env[key];
@@ -2218,7 +2227,7 @@ export async function untrustedCodeSpawn(input) {
         toolchainRead.push(await realpath(input.env.RUSTUP_HOME));
     const repository = await sandboxRepositoryPaths(cwd);
     return buildUntrustedCodeSpawn({ ...input, command, cwd, env, writable }, {
-        ...sandbox, home: await realpath(homedir()), toolchainRead, ...repository, ephemeral: await sandboxNodeScratch(cwd, repository.sourceRepository),
+        ...sandbox, home: await realpath(homedir()), toolchainRead, ...repository, ephemeral: await sandboxNodeScratch(cwd, repository.sourceRepository), tempMount,
     });
 }
 const sandboxExecFile = promisify(execFile);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.182",
+  "version": "0.16.185",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {