@miraland-labs/conduit-bridge 0.16.205 → 0.16.208

package/dist/driver.js

@@ -728,6 +728,25 @@ export function claudeCodeFuelEnv(fuelSource, model) {
         return undefined;
     return { ANTHROPIC_MODEL: model, ANTHROPIC_SMALL_FAST_MODEL: model, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" };
 }
+export function codexSandboxFacts(projection) {
+    return [
+        "SANDBOX FACTS",
+        `Sandbox mode: ${projection.sandbox}.`,
+        projection.networkAccess
+            ? "Network is on."
+            : "Network is off, including loopback listen.",
+        projection.sandbox === "workspace-write"
+            ? "Writes are allowed only in the workspace and TMPDIR. HOME and the rest of the filesystem are read-only."
+            : "No writes are allowed. The filesystem is read-only.",
+        "Child processes inherit these limits.",
+        "A registered gate that fails only with EPERM, EROFS, or a refused listen does not test the change.",
+        "Record that run as evidence with the refused calls.",
+        "Mark each criterion that run would settle as unknown with unverified_reason needs_environment.",
+        "Set unverified_detail to name the refusal.",
+        "Do not state in outcome, verification, or limitations that the gate failed.",
+        "Bridge runs every registered gate outside this sandbox after the turn. Its result is the witness.",
+    ].join("\n");
+}
 /**
  * Codex exec arguments. The sandbox is the enforcement boundary: network stays
  * off inside workspace-write unless the class/capabilities require it.
@@ -848,7 +867,7 @@ export const codexDriver = {
             diagnosis: input.workRole === "diagnose",
         });
         // Prompt via stdin avoids ARG_MAX limits on large assignment contracts.
-        const { code, stdout, stderr } = await execute(driverExecutable(codexDriver.name, input.executable), codexExecArgs({ ...input, networkAccess: projected.networkAccess }, projected.sandbox), input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt, input.signal);
+        const { code, stdout, stderr } = await execute(driverExecutable(codexDriver.name, input.executable), codexExecArgs({ ...input, networkAccess: projected.networkAccess }, projected.sandbox), input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource, `${input.prompt}\n\n${codexSandboxFacts(projected)}`, input.signal);
         const parsed = parseCodexJsonl(stdout);
         const resultText = parsed.resultText ?? (stdout || null);
         if (code !== 0) {
@@ -1389,11 +1408,14 @@ export function parseAntigravityModelList(stdout) {
 export function parseAntigravityOutput(stdout) {
     try {
         const parsed = JSON.parse(stdout.trim());
+        const earlyEnd = typeof parsed.finished_reason === "string"
+            && ["print_timeout", "interrupted", "error"].includes(parsed.finished_reason);
         return {
             resultText: typeof parsed.response === "string" ? parsed.response : null,
             sessionId: typeof parsed.conversation_id === "string" ? parsed.conversation_id : null,
-            status: typeof parsed.status === "string" ? parsed.status : null,
-            error: typeof parsed.error === "string" && parsed.error.trim() ? parsed.error : null,
+            status: earlyEnd ? "ERROR" : typeof parsed.status === "string" ? parsed.status : null,
+            error: typeof parsed.error === "string" && parsed.error.trim() ? parsed.error
+                : earlyEnd ? `agy ended early: ${parsed.finished_reason}` : null,
         };
     }
     catch {

package/dist/ensure-test-evidence.js

@@ -572,6 +572,11 @@ async function missingNpmLockReason(directory) {
         return "pnpm-lock.yaml is not an npm install";
     return "no package-lock.json or npm-shrinkwrap.json";
 }
+/** Lock-pinned crates and npm packages, fetched outside the sandbox before a gate runs inside it. */
+export async function prepareVerificationDependencies(workspace) {
+    await fetchLockedDependencies(workspace);
+    await installLockedPackages(workspace);
+}
 export async function installLockedPackages(workspace, options = {}) {
     const installed = [];
     const skipped = [];
@@ -612,7 +617,19 @@ export async function installLockedPackages(workspace, options = {}) {
  * `output` is stdout and stderr together, in the order the lines arrived: a failure detail reads its
  * tail from it.
  */
-export async function runBoundedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+export function runBoundedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+    return runVerificationCommand(command, workspace, timeoutMs, true);
+}
+/**
+ * The same run without the dependency preparation, for a caller that is itself inside the sandbox
+ * (the delivered probe instrument). It has no network, so its own install would fail and leave a
+ * partial `node_modules` that hides the complete one. Bridge prepares that workspace before it
+ * starts the caller (CR31).
+ */
+export function runPreparedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+    return runVerificationCommand(command, workspace, timeoutMs, false);
+}
+async function runVerificationCommand(command, workspace, timeoutMs, prepare) {
     const argv = argvForBoundedCommand(command);
     const bin = argv[0];
     if (!bin)
@@ -670,8 +687,8 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
         partial[stream].append(parts.at(-1));
     };
     const output = () => [lines.text().replace(/\n$/, ""), partial.stdout.text(), partial.stderr.text()].filter(Boolean).join("\n");
-    await fetchLockedDependencies(workspace);
-    await installLockedPackages(workspace);
+    if (prepare)
+        await prepareVerificationDependencies(workspace);
     const tempRoot = untrustedCodeTempRoot(workspace);
     await mkdir(tempRoot, { recursive: true });
     const scratchHome = await mkdtemp(join(tempRoot, "gate-home-"));

package/dist/investigation.js

@@ -7,7 +7,7 @@
  */
 import { redactSecrets, redactSecretsDeep } from "./secret-redaction.js";
 import { z } from "zod";
-import { boundedTail, runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
+import { boundedTail, prepareVerificationDependencies, runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
 import { markAttemptActive } from "./preflight.js";
 import { createAttemptWorktree, removeAttemptWorktree } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl } from "./brief.js";
@@ -690,6 +690,10 @@ async function execDeliveredProbeRun(argv, stdin, workspace, timeoutMs) {
     }
 }
 export async function runDeliveredProbeInstrument(input) {
+    // The delivered instrument runs inside the sandbox and cannot install; its registered commands
+    // read what Bridge installs here, outside it (CR31).
+    if (input.probes.some((probe) => probe.test?.trim()))
+        await (input.prepare ?? prepareVerificationDependencies)(input.workspace);
     const entry = join(input.workspace, PROBE_RUN_ENTRY);
     const timeoutMs = deliveredProbeTimeoutMs(input.probes);
     const stdin = JSON.stringify({ probes: input.probes });

package/dist/probe-run.js

@@ -1,5 +1,6 @@
 /** Delivered probe instrument entry. `{ "probes": [...] }` on stdin, `{ witnesses }` on stdout. */
 import { z } from "zod";
+import { runPreparedVerificationCommand } from "./ensure-test-evidence.js";
 import { runDeliveryVerificationProbes } from "./investigation.js";
 const probeRunInputSchema = z.object({
     probes: z.array(z.object({
@@ -19,7 +20,12 @@ async function readStdin() {
 }
 try {
     const parsed = probeRunInputSchema.parse(JSON.parse(await readStdin()));
-    const witnesses = await runDeliveryVerificationProbes({ workspace: process.cwd(), probes: parsed.probes });
+    // This process is inside the sandbox; Bridge prepared the workspace's dependencies before it started.
+    const witnesses = await runDeliveryVerificationProbes({
+        workspace: process.cwd(),
+        probes: parsed.probes,
+        runCommand: (command, workspace) => runPreparedVerificationCommand(command, workspace),
+    });
     process.stdout.write(`${JSON.stringify({ witnesses })}\n`);
 }
 catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.205",
+  "version": "0.16.208",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {