@miraland-labs/conduit-bridge 0.16.186 → 0.16.188

package/dist/cli.js

@@ -780,7 +780,12 @@ function startGateRehearsal(workspace, plan) {
     const rehearsalPath = rehearsalWorktreePath(workspace);
     console.log(`Rehearsing the gate in ${workspace}: ${plan.commands.join(", ")}`);
     void createRehearsalWorktree(workspace, plan.commit)
-        .then((path) => runGateRehearsal(path, plan))
+        .then((path) => runGateRehearsal(path, plan, {
+        freshWorkspace: (warmUpSeconds) => {
+            console.log(`Gate warm-up took ${warmUpSeconds} s; measuring again in a fresh worktree`);
+            return createRehearsalWorktree(workspace, plan.commit);
+        },
+    }))
         .then((rehearsal) => { if (rehearsal === "busy")
         console.log("Gate rehearsal deferred: another runner on this computer is rehearsing"); })
         .catch((error) => console.error(`Gate rehearsal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}`))

package/dist/ensure-test-evidence.js

@@ -5,8 +5,9 @@
  */
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdir, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { access, copyFile, mkdir, mkdtemp, readFile, readdir, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative, sep } from "node:path";
 import { untrustedCodeTempRoot, untrustedCodeSpawn, untrustedCodeEnvironment, criterionKey, resolveCriterionReference, signalGroup, STDIO_DRAIN_MS, CHILD_STOP_GRACE_MS, OWN_PROCESS_GROUP, trackProcessGroup, untrackProcessGroup } from "./driver.js";
 import { isBoundedVerificationCommand, isRunnableVerificationCommand } from "./execution-class.js";
 import { workspaceDependenciesMissingFailure } from "./failure-signal.js";
@@ -417,6 +418,190 @@ export async function fetchLockedDependencies(workspace, options = {}) {
         console.error(redactSecrets(`[bridge] cargo fetch --locked exited ${result.code} in ${workspace}: ${result.stderr.trim().split("\n").slice(-10).join("\n")}`));
     return { ran: true, code: result.code };
 }
+const NPM_CI_ARGV = ["ci", "--ignore-scripts", "--no-audit", "--no-fund", "--prefer-offline"];
+/** Root is depth 0. `web/` is depth 1. `packages/<name>/` is depth 2. Nothing deeper. */
+const MAX_PACKAGE_DIRECTORY_DEPTH = 2;
+/** Discovery does not enter these directories. `node_modules` is recorded separately and not entered. */
+const PACKAGE_DISCOVERY_EXCLUDED = new Set([".conduit", ".git", "dist", "target"]);
+/** Package-directory realpath + npm lock sha256 already attempted by this process. */
+const installedLocks = new Set();
+/**
+ * The gate runs without network, so a package the lock pins must already be on disk. Node resolves
+ * from the directory that holds the gate and walks upward: a repository whose JavaScript lives in
+ * `web/` with its own lock, and whose root is not a package, never reaches an install. `npm ci`
+ * fills that directory outside the sandbox and refuses to change the lock. Once per lock file per
+ * process, including a failed install. A failed install does not stop the gate: its own output
+ * names the cause.
+ *
+ * `package-lock.json` and `npm-shrinkwrap.json` are npm locks. A package with only `yarn.lock` or
+ * `pnpm-lock.yaml`, a package with no npm lock, and a package whose `node_modules` git does not
+ * ignore are skipped and logged. Discovery does not enter `.git`, `.conduit`, `dist`, `node_modules`,
+ * or `target`.
+ */
+function runGit(argv, cwd, env = process.env) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const finish = (code, stdout) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ code, stdout });
+        };
+        const child = spawn("git", argv, { cwd, env, stdio: ["ignore", "pipe", "ignore"] });
+        let stdout = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            if (stdout.length < 8192)
+                stdout = `${stdout}${chunk}`.slice(0, 8192);
+        });
+        timer = setTimeout(() => { child.kill("SIGKILL"); finish(124, stdout); }, VERIFICATION_TIMEOUT_MS);
+        child.on("error", () => finish(127, stdout));
+        child.on("close", (code) => finish(code ?? 1, stdout));
+    });
+}
+function gitCommandEnv() {
+    const env = { ...process.env };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_INDEX_FILE;
+    return env;
+}
+/** A directory outside `workspace`, so a crash cannot leave a probe inside the attempt tree. */
+function probeParentDirectory(workspace) {
+    for (const candidate of [tmpdir(), "/tmp", "/var/tmp"]) {
+        const rel = relative(workspace, candidate);
+        if (rel === ".." || rel.startsWith(`..${sep}`))
+            return candidate;
+    }
+    return tmpdir();
+}
+async function copyGitignoreIfPresent(from, to) {
+    try {
+        await copyFile(join(from, ".gitignore"), join(to, ".gitignore"));
+        return true;
+    }
+    catch (error) {
+        return error.code === "ENOENT";
+    }
+}
+/**
+ * A directory-only rule (`node_modules/`) matches only a directory on disk. The probe directory is
+ * created in a temporary work tree, never in the attempt tree. `-c core.excludesFile=/dev/null`
+ * keeps the repository's own ignore rules and drops the runner's global excludes, so a personal
+ * ignore cannot hide a node_modules git would track.
+ */
+async function nodeModulesIsGitIgnored(directory) {
+    const env = gitCommandEnv();
+    const located = await runGit(["rev-parse", "--show-toplevel", "--absolute-git-dir", "--show-prefix"], directory, env);
+    if (located.code !== 0)
+        return false;
+    const lines = located.stdout.split("\n");
+    const toplevel = lines[0]?.trim() ?? "";
+    const gitDir = lines[1]?.trim() ?? "";
+    const prefix = lines[2] ?? "";
+    if (!toplevel || !gitDir)
+        return false;
+    const temp = await mkdtemp(join(probeParentDirectory(directory), "conduit-npm-ignore-"));
+    try {
+        let source = toplevel;
+        let target = temp;
+        if (!await copyGitignoreIfPresent(source, target))
+            return false;
+        for (const segment of prefix.split("/").filter(Boolean)) {
+            source = join(source, segment);
+            target = join(target, segment);
+            await mkdir(target, { recursive: true });
+            if (!await copyGitignoreIfPresent(source, target))
+                return false;
+        }
+        await mkdir(join(target, "node_modules"));
+        const relativeDir = prefix === "" || prefix.endsWith("/") ? prefix : `${prefix}/`;
+        const checked = await runGit([
+            "--git-dir", gitDir, "--work-tree", temp, "-c", "core.excludesFile=/dev/null",
+            "check-ignore", "-q", "--", `${relativeDir}node_modules`,
+        ], temp, env);
+        return checked.code === 0;
+    }
+    finally {
+        await rm(temp, { recursive: true, force: true });
+    }
+}
+async function scanPackageDirectories(root) {
+    const packages = [];
+    const skipped = [];
+    const walk = async (directory, depth) => {
+        if (await readFile(join(directory, "package.json")).then(() => true, () => false))
+            packages.push(directory);
+        if (depth >= MAX_PACKAGE_DIRECTORY_DEPTH)
+            return;
+        const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const child = join(directory, entry.name);
+            if (entry.name === "node_modules") {
+                skipped.push({ directory: child, reason: "package is under node_modules" });
+                continue;
+            }
+            if (PACKAGE_DISCOVERY_EXCLUDED.has(entry.name))
+                continue;
+            await walk(child, depth + 1);
+        }
+    };
+    await walk(root, 0);
+    packages.sort();
+    return { packages, skipped };
+}
+/** npm uses `npm-shrinkwrap.json` when both lock files exist. */
+async function readNpmLock(directory) {
+    const shrink = await readFile(join(directory, "npm-shrinkwrap.json")).catch(() => null);
+    if (shrink)
+        return shrink;
+    return readFile(join(directory, "package-lock.json")).catch(() => null);
+}
+async function missingNpmLockReason(directory) {
+    const yarn = await access(join(directory, "yarn.lock")).then(() => true, () => false);
+    const pnpm = await access(join(directory, "pnpm-lock.yaml")).then(() => true, () => false);
+    if (yarn && pnpm)
+        return "yarn.lock and pnpm-lock.yaml are not npm installs";
+    if (yarn)
+        return "yarn.lock is not an npm install";
+    if (pnpm)
+        return "pnpm-lock.yaml is not an npm install";
+    return "no package-lock.json or npm-shrinkwrap.json";
+}
+export async function installLockedPackages(workspace, options = {}) {
+    const installed = [];
+    const skipped = [];
+    const run = options.run ?? runFetchOutsideSandbox;
+    const scan = await scanPackageDirectories(workspace);
+    skipped.push(...scan.skipped);
+    for (const directory of scan.packages) {
+        const lock = await readNpmLock(directory);
+        if (!lock) {
+            skipped.push({ directory, reason: await missingNpmLockReason(directory) });
+            continue;
+        }
+        const key = `${await realpath(directory)}\0${createHash("sha256").update(lock).digest("hex")}`;
+        if (installedLocks.has(key))
+            continue;
+        if (!await nodeModulesIsGitIgnored(directory)) {
+            skipped.push({ directory, reason: "node_modules is not git-ignored" });
+            continue;
+        }
+        const result = await run("npm", [...NPM_CI_ARGV], directory);
+        installedLocks.add(key);
+        if (result.code !== 0)
+            console.error(redactSecrets(`[bridge] npm ci --ignore-scripts --no-audit --no-fund --prefer-offline exited ${result.code} in ${directory}: ${result.stderr.trim().split("\n").slice(-10).join("\n")}`));
+        installed.push({ directory, code: result.code });
+    }
+    skipped.sort((left, right) => left.directory < right.directory ? -1 : left.directory > right.directory ? 1 : 0);
+    for (const skip of skipped)
+        console.error(redactSecrets(`[bridge] npm ci skipped ${skip.directory}: ${skip.reason}`));
+    return { installed, skipped };
+}
 /**
  * The bounded runner every Bridge-run verification uses: the declared command, in the given
  * workspace, with the verification timeout and buffer. A non-zero exit is a result, not a throw.
@@ -486,6 +671,7 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
     };
     const output = () => [lines.text().replace(/\n$/, ""), partial.stdout.text(), partial.stderr.text()].filter(Boolean).join("\n");
     await fetchLockedDependencies(workspace);
+    await installLockedPackages(workspace);
     const tempRoot = untrustedCodeTempRoot(workspace);
     await mkdir(tempRoot, { recursive: true });
     const scratchHome = await mkdtemp(join(tempRoot, "gate-home-"));

package/dist/preflight.js

@@ -7,7 +7,8 @@ import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
 import { bridgeConfigDirectory } from "./config.js";
-import { runBoundedVerificationCommand, verificationEvidenceCommands } from "./ensure-test-evidence.js";
+import { runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS, verificationEvidenceCommands } from "./ensure-test-evidence.js";
+import { lockfileDigest } from "./execution-facts.js";
 import { resolveAgentTimeout, resolveMaxTurns } from "./execution-budget.js";
 import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, } from "./driver.js";
 import { laneQuota, laneTierBindings, localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
@@ -315,18 +316,29 @@ async function readGateRehearsals(statePath) {
         return {};
     }
 }
+/**
+ * The rehearsal's own limit. The first run after a dependency change can compile a whole dependency
+ * tree: on 2026-10-22 acme-sim's registry crates took more than ten minutes, the attempt limit
+ * stopped the rehearsal mid-compile, the shared target directory stayed cold, and the next attempt
+ * stopped at the same limit before any agent started. The rehearsal absorbs that warm-up.
+ */
+export const REHEARSAL_TIMEOUT_MS = 3_600_000;
 /** UTC calendar day: a push to main costs no run, and a new day measures the cache again. */
 function rehearsalDay(at) {
     return new Date(at).toISOString().slice(0, 10);
 }
-/** The last rehearsal of this workspace's repository, and the gate to run when one is due today. */
+/**
+ * The last rehearsal of this workspace's repository, and the gate to run when one is due: once a
+ * day, and again when the workspace's lockfiles change, because new dependencies need a new warm-up.
+ */
 export async function planGateRehearsal(brief, options = {}) {
     const commands = verificationEvidenceCommands(brief.verification, brief.declared_verification, null);
     if (!brief.repository || !brief.base_commit || !commands.length)
         return { report: null, due: null };
     const repository = normalizeRepositoryUrl(brief.repository);
     const stored = (await readGateRehearsals(options.statePath ?? gateRehearsalStatePath()))[repository] ?? null;
-    const digest = createHash("sha256").update(commands.join("\n")).digest("hex").slice(0, 16);
+    const lockfiles = options.workspace ? await lockfileDigest(options.workspace) : null;
+    const digest = createHash("sha256").update(commands.join("\n")).update(lockfiles ?? "").digest("hex").slice(0, 16);
     const day = rehearsalDay((options.now ?? Date.now)());
     if (stored && stored.day === day && stored.digest === digest)
         return { report: stored.rehearsal, due: null };
@@ -342,7 +354,7 @@ export async function planGateRehearsals(checkouts, options = {}) {
     const seen = new Set();
     let due = null;
     for (const checkout of checkouts) {
-        const planned = await planGateRehearsal(checkout.brief, options);
+        const planned = await planGateRehearsal(checkout.brief, { ...options, workspace: checkout.workspace });
         const repository = planned.report?.repository ?? planned.due?.repository;
         if (!repository || seen.has(repository))
             continue;
@@ -429,13 +441,36 @@ async function rehearseGate(workspace, plan, options) {
     const now = options.now ?? Date.now;
     const run = options.runCommand ?? runBoundedVerificationCommand;
     const commands = [];
+    let cwd = workspace;
     for (const command of plan.commands) {
         const started = now();
         // A command that cannot start measured nothing; the dry run skips it the same way.
-        const result = await run(command, workspace).catch(() => null);
+        const result = await run(command, cwd, REHEARSAL_TIMEOUT_MS).catch(() => null);
         if (!result)
             continue;
-        commands.push({ command, seconds: Math.round((now() - started) / 1_000), exit_code: result.code, timed_out: result.timedOut === true });
+        const elapsed = now() - started;
+        const seconds = Math.round(elapsed / 1_000);
+        if (result.code !== 0 || result.timedOut === true || elapsed <= VERIFICATION_TIMEOUT_MS) {
+            commands.push({ command, seconds, exit_code: result.code, timed_out: result.timedOut === true });
+            continue;
+        }
+        // The pass fit only the rehearsal's limit: it was a warm-up. Measure once more, in a fresh
+        // checkout with the attempt's limit, so the report shows what an attempt will see.
+        if (options.freshWorkspace)
+            cwd = await options.freshWorkspace(seconds);
+        const again = now();
+        const second = await run(command, cwd, VERIFICATION_TIMEOUT_MS).catch(() => null);
+        if (!second) {
+            commands.push({ command, seconds, exit_code: result.code, timed_out: false });
+            continue;
+        }
+        commands.push({
+            command,
+            seconds: Math.round((now() - again) / 1_000),
+            exit_code: second.code,
+            timed_out: second.timedOut === true,
+            warm_up_seconds: seconds,
+        });
     }
     const at = now();
     const rehearsal = commands.length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.186",
+  "version": "0.16.188",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {