@miraland-labs/conduit-bridge 0.16.187 → 0.16.189

package/dist/cli.js

@@ -20,7 +20,7 @@ import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts, workspaceIsClean } fro
 import { ensureCheckout } from "./checkout.js";
 import { buildOnShiftIntentProof, managedWorkspacePath, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
 import { expandOpsValue, loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
-import { pumpExecutionSlots, renewLeases } from "./execution.js";
+import { assignmentsPending, pumpExecutionSlots, renewLeases } from "./execution.js";
 import { createRehearsalWorktree, rehearsalWorktreePath, removeAttemptWorktree } from "./attempt-worktree.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
 import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, gateRehearsalLockHeld, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
@@ -667,9 +667,17 @@ async function runner() {
                 await heartbeat(client, config, workspace, currentBrief, preflight, intentProof, bootstrapResult);
             }
             await renewLeases(client, config);
+            // Dispatched work outranks a rehearsal already running. Stop it with nothing recorded, release
+            // the lock, and claim on this same cycle. The rehearsal stays due.
+            if (gateRehearsalRunning && await assignmentsPending(client)) {
+                gateRehearsalAbort?.abort();
+                await gateRehearsalDone;
+            }
             // Another runner on this computer rehearsing its gate: claim as usual, rehearse on a later cycle.
+            // An assignment already waiting is claimed below; this cycle does not start a rehearsal.
             if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning && rehearsalPlan?.due
-                && running.size === 0 && Object.keys(config.activeAttempts).length === 0 && !gateRehearsalLockHeld()) {
+                && running.size === 0 && Object.keys(config.activeAttempts).length === 0 && !gateRehearsalLockHeld()
+                && !await assignmentsPending(client)) {
                 startGateRehearsal(rehearsalPlan.due.workspace, rehearsalPlan.due.plan);
             }
             // No claim while the gate rehearses: the rehearsal measures the gate alone, never beside an attempt.
@@ -729,8 +737,10 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
-/** True while the gate rehearsal runs in the background; the loop keeps beating but claims nothing. */
+/** True while the gate rehearsal runs in the background. A dispatched assignment aborts it, then this cycle claims. */
 let gateRehearsalRunning = false;
+let gateRehearsalAbort = null;
+let gateRehearsalDone = Promise.resolve();
 /** An observation fingerprints the source checkout; a fast-forward under it reads as the observer writing. */
 let investigationRunning = false;
 /** The rehearsals the heartbeat reports, one per on-shift repository; empty reports no field. */
@@ -777,21 +787,30 @@ async function rehearsalCheckouts(workspace, brief, refresh) {
  */
 function startGateRehearsal(workspace, plan) {
     gateRehearsalRunning = true;
+    const abort = new AbortController();
+    gateRehearsalAbort = abort;
     const rehearsalPath = rehearsalWorktreePath(workspace);
     console.log(`Rehearsing the gate in ${workspace}: ${plan.commands.join(", ")}`);
-    void createRehearsalWorktree(workspace, plan.commit)
+    gateRehearsalDone = createRehearsalWorktree(workspace, plan.commit)
         .then((path) => runGateRehearsal(path, plan, {
+        signal: abort.signal,
         freshWorkspace: (warmUpSeconds) => {
             console.log(`Gate warm-up took ${warmUpSeconds} s; measuring again in a fresh worktree`);
             return createRehearsalWorktree(workspace, plan.commit);
         },
     }))
-        .then((rehearsal) => { if (rehearsal === "busy")
-        console.log("Gate rehearsal deferred: another runner on this computer is rehearsing"); })
+        .then((rehearsal) => {
+        if (rehearsal === "busy")
+            console.log("Gate rehearsal deferred: another runner on this computer is rehearsing");
+        else if (abort.signal.aborted)
+            console.log("Gate rehearsal stopped: an assignment is waiting");
+    })
         .catch((error) => console.error(`Gate rehearsal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}`))
         .finally(async () => {
         await removeAttemptWorktree(workspace, rehearsalPath);
         gateRehearsalRunning = false;
+        if (gateRehearsalAbort === abort)
+            gateRehearsalAbort = null;
     });
 }
 /** Last state announced, so a workspace that stays diverged does not print on every cycle. */

package/dist/ensure-test-evidence.js

@@ -5,8 +5,9 @@
  */
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdir, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { access, copyFile, mkdir, mkdtemp, readFile, readdir, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative, sep } from "node:path";
 import { untrustedCodeTempRoot, untrustedCodeSpawn, untrustedCodeEnvironment, criterionKey, resolveCriterionReference, signalGroup, STDIO_DRAIN_MS, CHILD_STOP_GRACE_MS, OWN_PROCESS_GROUP, trackProcessGroup, untrackProcessGroup } from "./driver.js";
 import { isBoundedVerificationCommand, isRunnableVerificationCommand } from "./execution-class.js";
 import { workspaceDependenciesMissingFailure } from "./failure-signal.js";
@@ -417,6 +418,190 @@ export async function fetchLockedDependencies(workspace, options = {}) {
         console.error(redactSecrets(`[bridge] cargo fetch --locked exited ${result.code} in ${workspace}: ${result.stderr.trim().split("\n").slice(-10).join("\n")}`));
     return { ran: true, code: result.code };
 }
+const NPM_CI_ARGV = ["ci", "--ignore-scripts", "--no-audit", "--no-fund", "--prefer-offline"];
+/** Root is depth 0. `web/` is depth 1. `packages/<name>/` is depth 2. Nothing deeper. */
+const MAX_PACKAGE_DIRECTORY_DEPTH = 2;
+/** Discovery does not enter these directories. `node_modules` is recorded separately and not entered. */
+const PACKAGE_DISCOVERY_EXCLUDED = new Set([".conduit", ".git", "dist", "target"]);
+/** Package-directory realpath + npm lock sha256 already attempted by this process. */
+const installedLocks = new Set();
+/**
+ * The gate runs without network, so a package the lock pins must already be on disk. Node resolves
+ * from the directory that holds the gate and walks upward: a repository whose JavaScript lives in
+ * `web/` with its own lock, and whose root is not a package, never reaches an install. `npm ci`
+ * fills that directory outside the sandbox and refuses to change the lock. Once per lock file per
+ * process, including a failed install. A failed install does not stop the gate: its own output
+ * names the cause.
+ *
+ * `package-lock.json` and `npm-shrinkwrap.json` are npm locks. A package with only `yarn.lock` or
+ * `pnpm-lock.yaml`, a package with no npm lock, and a package whose `node_modules` git does not
+ * ignore are skipped and logged. Discovery does not enter `.git`, `.conduit`, `dist`, `node_modules`,
+ * or `target`.
+ */
+function runGit(argv, cwd, env = process.env) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const finish = (code, stdout) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ code, stdout });
+        };
+        const child = spawn("git", argv, { cwd, env, stdio: ["ignore", "pipe", "ignore"] });
+        let stdout = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            if (stdout.length < 8192)
+                stdout = `${stdout}${chunk}`.slice(0, 8192);
+        });
+        timer = setTimeout(() => { child.kill("SIGKILL"); finish(124, stdout); }, VERIFICATION_TIMEOUT_MS);
+        child.on("error", () => finish(127, stdout));
+        child.on("close", (code) => finish(code ?? 1, stdout));
+    });
+}
+function gitCommandEnv() {
+    const env = { ...process.env };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_INDEX_FILE;
+    return env;
+}
+/** A directory outside `workspace`, so a crash cannot leave a probe inside the attempt tree. */
+function probeParentDirectory(workspace) {
+    for (const candidate of [tmpdir(), "/tmp", "/var/tmp"]) {
+        const rel = relative(workspace, candidate);
+        if (rel === ".." || rel.startsWith(`..${sep}`))
+            return candidate;
+    }
+    return tmpdir();
+}
+async function copyGitignoreIfPresent(from, to) {
+    try {
+        await copyFile(join(from, ".gitignore"), join(to, ".gitignore"));
+        return true;
+    }
+    catch (error) {
+        return error.code === "ENOENT";
+    }
+}
+/**
+ * A directory-only rule (`node_modules/`) matches only a directory on disk. The probe directory is
+ * created in a temporary work tree, never in the attempt tree. `-c core.excludesFile=/dev/null`
+ * keeps the repository's own ignore rules and drops the runner's global excludes, so a personal
+ * ignore cannot hide a node_modules git would track.
+ */
+async function nodeModulesIsGitIgnored(directory) {
+    const env = gitCommandEnv();
+    const located = await runGit(["rev-parse", "--show-toplevel", "--absolute-git-dir", "--show-prefix"], directory, env);
+    if (located.code !== 0)
+        return false;
+    const lines = located.stdout.split("\n");
+    const toplevel = lines[0]?.trim() ?? "";
+    const gitDir = lines[1]?.trim() ?? "";
+    const prefix = lines[2] ?? "";
+    if (!toplevel || !gitDir)
+        return false;
+    const temp = await mkdtemp(join(probeParentDirectory(directory), "conduit-npm-ignore-"));
+    try {
+        let source = toplevel;
+        let target = temp;
+        if (!await copyGitignoreIfPresent(source, target))
+            return false;
+        for (const segment of prefix.split("/").filter(Boolean)) {
+            source = join(source, segment);
+            target = join(target, segment);
+            await mkdir(target, { recursive: true });
+            if (!await copyGitignoreIfPresent(source, target))
+                return false;
+        }
+        await mkdir(join(target, "node_modules"));
+        const relativeDir = prefix === "" || prefix.endsWith("/") ? prefix : `${prefix}/`;
+        const checked = await runGit([
+            "--git-dir", gitDir, "--work-tree", temp, "-c", "core.excludesFile=/dev/null",
+            "check-ignore", "-q", "--", `${relativeDir}node_modules`,
+        ], temp, env);
+        return checked.code === 0;
+    }
+    finally {
+        await rm(temp, { recursive: true, force: true });
+    }
+}
+async function scanPackageDirectories(root) {
+    const packages = [];
+    const skipped = [];
+    const walk = async (directory, depth) => {
+        if (await readFile(join(directory, "package.json")).then(() => true, () => false))
+            packages.push(directory);
+        if (depth >= MAX_PACKAGE_DIRECTORY_DEPTH)
+            return;
+        const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const child = join(directory, entry.name);
+            if (entry.name === "node_modules") {
+                skipped.push({ directory: child, reason: "package is under node_modules" });
+                continue;
+            }
+            if (PACKAGE_DISCOVERY_EXCLUDED.has(entry.name))
+                continue;
+            await walk(child, depth + 1);
+        }
+    };
+    await walk(root, 0);
+    packages.sort();
+    return { packages, skipped };
+}
+/** npm uses `npm-shrinkwrap.json` when both lock files exist. */
+async function readNpmLock(directory) {
+    const shrink = await readFile(join(directory, "npm-shrinkwrap.json")).catch(() => null);
+    if (shrink)
+        return shrink;
+    return readFile(join(directory, "package-lock.json")).catch(() => null);
+}
+async function missingNpmLockReason(directory) {
+    const yarn = await access(join(directory, "yarn.lock")).then(() => true, () => false);
+    const pnpm = await access(join(directory, "pnpm-lock.yaml")).then(() => true, () => false);
+    if (yarn && pnpm)
+        return "yarn.lock and pnpm-lock.yaml are not npm installs";
+    if (yarn)
+        return "yarn.lock is not an npm install";
+    if (pnpm)
+        return "pnpm-lock.yaml is not an npm install";
+    return "no package-lock.json or npm-shrinkwrap.json";
+}
+export async function installLockedPackages(workspace, options = {}) {
+    const installed = [];
+    const skipped = [];
+    const run = options.run ?? runFetchOutsideSandbox;
+    const scan = await scanPackageDirectories(workspace);
+    skipped.push(...scan.skipped);
+    for (const directory of scan.packages) {
+        const lock = await readNpmLock(directory);
+        if (!lock) {
+            skipped.push({ directory, reason: await missingNpmLockReason(directory) });
+            continue;
+        }
+        const key = `${await realpath(directory)}\0${createHash("sha256").update(lock).digest("hex")}`;
+        if (installedLocks.has(key))
+            continue;
+        if (!await nodeModulesIsGitIgnored(directory)) {
+            skipped.push({ directory, reason: "node_modules is not git-ignored" });
+            continue;
+        }
+        const result = await run("npm", [...NPM_CI_ARGV], directory);
+        installedLocks.add(key);
+        if (result.code !== 0)
+            console.error(redactSecrets(`[bridge] npm ci --ignore-scripts --no-audit --no-fund --prefer-offline exited ${result.code} in ${directory}: ${result.stderr.trim().split("\n").slice(-10).join("\n")}`));
+        installed.push({ directory, code: result.code });
+    }
+    skipped.sort((left, right) => left.directory < right.directory ? -1 : left.directory > right.directory ? 1 : 0);
+    for (const skip of skipped)
+        console.error(redactSecrets(`[bridge] npm ci skipped ${skip.directory}: ${skip.reason}`));
+    return { installed, skipped };
+}
 /**
  * The bounded runner every Bridge-run verification uses: the declared command, in the given
  * workspace, with the verification timeout and buffer. A non-zero exit is a result, not a throw.
@@ -486,6 +671,7 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
     };
     const output = () => [lines.text().replace(/\n$/, ""), partial.stdout.text(), partial.stderr.text()].filter(Boolean).join("\n");
     await fetchLockedDependencies(workspace);
+    await installLockedPackages(workspace);
     const tempRoot = untrustedCodeTempRoot(workspace);
     await mkdir(tempRoot, { recursive: true });
     const scratchHome = await mkdtemp(join(tempRoot, "gate-home-"));

package/dist/execution.js

@@ -832,6 +832,21 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
     }
     return progressed;
 }
+/**
+ * True when `/runner/v1/assignments` lists work for this machine. A failed poll is not waiting
+ * work: the caller keeps the current cycle. The claim path still parses and claims.
+ */
+export async function assignmentsPending(client) {
+    try {
+        const data = await client.request("/runner/v1/assignments");
+        if (!data || typeof data !== "object" || !("assignments" in data))
+            return false;
+        return Array.isArray(data.assignments) && data.assignments.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
 /** Claim one assignment when under capacity; does not start the agent (multi-slot pump does). */
 export async function claimNextAssignment(client, config, workspace, brief, driverId, processOnlineIds, options = {}) {
     if (Object.keys(config.activeAttempts).length >= config.leaseCapacity)

package/dist/preflight.js

@@ -10,7 +10,7 @@ import { bridgeConfigDirectory } from "./config.js";
 import { runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS, verificationEvidenceCommands } from "./ensure-test-evidence.js";
 import { lockfileDigest } from "./execution-facts.js";
 import { resolveAgentTimeout, resolveMaxTurns } from "./execution-budget.js";
-import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, } from "./driver.js";
+import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, stopTrackedProcessGroups, } from "./driver.js";
 import { laneQuota, laneTierBindings, localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 /** Protocol 3: read-only diagnosis can reuse a retained failed-attempt worktree. */
 // 4: each driver snapshot reports diagnosis_read_only, so the control plane can require a
@@ -421,23 +421,70 @@ async function acquireGateRehearsalLock(lockPath) {
         await unlink(claim).catch(() => undefined);
     }
 }
+/** Resolve when `work` settles, or with "aborted" when `signal` aborts first. */
+function untilAbort(work, signal) {
+    if (!signal)
+        return work;
+    if (signal.aborted)
+        return Promise.resolve("aborted");
+    return new Promise((resolve, reject) => {
+        const onAbort = () => resolve("aborted");
+        signal.addEventListener("abort", onAbort, { once: true });
+        work.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(signal.aborted ? "aborted" : value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            if (signal.aborted)
+                resolve("aborted");
+            else
+                reject(error);
+        });
+    });
+}
+/** Call `stop` if `signal` aborts after this returns. An already-aborted signal has no command yet. */
+function stopWhenAborted(signal, stop) {
+    if (!signal || signal.aborted)
+        return () => undefined;
+    signal.addEventListener("abort", stop, { once: true });
+    return () => signal.removeEventListener("abort", stop);
+}
+async function runRehearsalCommand(run, command, cwd, timeoutMs, signal) {
+    if (signal?.aborted)
+        return "aborted";
+    const work = (signal ? run(command, cwd, timeoutMs, signal) : run(command, cwd, timeoutMs)).catch(() => null);
+    const result = await untilAbort(work, signal);
+    if (result === "aborted" || signal?.aborted)
+        return "aborted";
+    return result;
+}
 /**
- * Run the planned gate once and remember it for the day. Null when no command could start.
- * "busy" when another rehearsal on this computer holds the lock: nothing is run or remembered, so
- * the gate is still due and the next cycle tries again.
+ * Run the planned gate once and remember it for the day. Null when no command could start, or when
+ * `signal` aborts: the command is stopped, nothing is remembered, and the lock is released, so the
+ * gate stays due. "busy" when another rehearsal on this computer holds the lock: nothing is run or
+ * remembered, so the gate is still due and the next cycle tries again.
  */
 export async function runGateRehearsal(workspace, plan, options = {}) {
+    if (options.signal?.aborted)
+        return null;
     const lockPath = options.lockPath ?? gateRehearsalLockPath();
     if (!await acquireGateRehearsalLock(lockPath))
         return "busy";
+    const releaseAbort = stopWhenAborted(options.signal, stopTrackedProcessGroups);
     try {
+        if (options.signal?.aborted)
+            return null;
         return await rehearseGate(workspace, plan, options);
     }
     finally {
+        releaseAbort();
         await unlink(lockPath).catch(() => undefined);
     }
 }
 async function rehearseGate(workspace, plan, options) {
+    const signal = options.signal;
+    if (signal?.aborted)
+        return null;
     const now = options.now ?? Date.now;
     const run = options.runCommand ?? runBoundedVerificationCommand;
     const commands = [];
@@ -445,7 +492,10 @@ async function rehearseGate(workspace, plan, options) {
     for (const command of plan.commands) {
         const started = now();
         // A command that cannot start measured nothing; the dry run skips it the same way.
-        const result = await run(command, cwd, REHEARSAL_TIMEOUT_MS).catch(() => null);
+        // An abort measures nothing either: the gate stays due for the next quiet cycle.
+        const result = await runRehearsalCommand(run, command, cwd, REHEARSAL_TIMEOUT_MS, signal);
+        if (result === "aborted")
+            return null;
         if (!result)
             continue;
         const elapsed = now() - started;
@@ -456,10 +506,16 @@ async function rehearseGate(workspace, plan, options) {
         }
         // The pass fit only the rehearsal's limit: it was a warm-up. Measure once more, in a fresh
         // checkout with the attempt's limit, so the report shows what an attempt will see.
-        if (options.freshWorkspace)
-            cwd = await options.freshWorkspace(seconds);
+        if (options.freshWorkspace) {
+            const fresh = await untilAbort(options.freshWorkspace(seconds), signal);
+            if (fresh === "aborted")
+                return null;
+            cwd = fresh;
+        }
         const again = now();
-        const second = await run(command, cwd, VERIFICATION_TIMEOUT_MS).catch(() => null);
+        const second = await runRehearsalCommand(run, command, cwd, VERIFICATION_TIMEOUT_MS, signal);
+        if (second === "aborted")
+            return null;
         if (!second) {
             commands.push({ command, seconds, exit_code: result.code, timed_out: false });
             continue;
@@ -472,6 +528,8 @@ async function rehearseGate(workspace, plan, options) {
             warm_up_seconds: seconds,
         });
     }
+    if (signal?.aborted)
+        return null;
     const at = now();
     const rehearsal = commands.length
         ? { repository: plan.repository, commit: plan.commit, rehearsed_at: new Date(at).toISOString(), commands }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.187",
+  "version": "0.16.189",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {