@miraland-labs/conduit-bridge 0.16.207 → 0.16.208

package/dist/ensure-test-evidence.js

@@ -572,6 +572,11 @@ async function missingNpmLockReason(directory) {
         return "pnpm-lock.yaml is not an npm install";
     return "no package-lock.json or npm-shrinkwrap.json";
 }
+/** Lock-pinned crates and npm packages, fetched outside the sandbox before a gate runs inside it. */
+export async function prepareVerificationDependencies(workspace) {
+    await fetchLockedDependencies(workspace);
+    await installLockedPackages(workspace);
+}
 export async function installLockedPackages(workspace, options = {}) {
     const installed = [];
     const skipped = [];
@@ -612,7 +617,19 @@ export async function installLockedPackages(workspace, options = {}) {
  * `output` is stdout and stderr together, in the order the lines arrived: a failure detail reads its
  * tail from it.
  */
-export async function runBoundedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+export function runBoundedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+    return runVerificationCommand(command, workspace, timeoutMs, true);
+}
+/**
+ * The same run without the dependency preparation, for a caller that is itself inside the sandbox
+ * (the delivered probe instrument). It has no network, so its own install would fail and leave a
+ * partial `node_modules` that hides the complete one. Bridge prepares that workspace before it
+ * starts the caller (CR31).
+ */
+export function runPreparedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
+    return runVerificationCommand(command, workspace, timeoutMs, false);
+}
+async function runVerificationCommand(command, workspace, timeoutMs, prepare) {
     const argv = argvForBoundedCommand(command);
     const bin = argv[0];
     if (!bin)
@@ -670,8 +687,8 @@ export async function runBoundedVerificationCommand(command, workspace, timeoutM
         partial[stream].append(parts.at(-1));
     };
     const output = () => [lines.text().replace(/\n$/, ""), partial.stdout.text(), partial.stderr.text()].filter(Boolean).join("\n");
-    await fetchLockedDependencies(workspace);
-    await installLockedPackages(workspace);
+    if (prepare)
+        await prepareVerificationDependencies(workspace);
     const tempRoot = untrustedCodeTempRoot(workspace);
     await mkdir(tempRoot, { recursive: true });
     const scratchHome = await mkdtemp(join(tempRoot, "gate-home-"));

package/dist/investigation.js

@@ -7,7 +7,7 @@
  */
 import { redactSecrets, redactSecretsDeep } from "./secret-redaction.js";
 import { z } from "zod";
-import { boundedTail, runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
+import { boundedTail, prepareVerificationDependencies, runBoundedVerificationCommand, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
 import { markAttemptActive } from "./preflight.js";
 import { createAttemptWorktree, removeAttemptWorktree } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl } from "./brief.js";
@@ -690,6 +690,10 @@ async function execDeliveredProbeRun(argv, stdin, workspace, timeoutMs) {
     }
 }
 export async function runDeliveredProbeInstrument(input) {
+    // The delivered instrument runs inside the sandbox and cannot install; its registered commands
+    // read what Bridge installs here, outside it (CR31).
+    if (input.probes.some((probe) => probe.test?.trim()))
+        await (input.prepare ?? prepareVerificationDependencies)(input.workspace);
     const entry = join(input.workspace, PROBE_RUN_ENTRY);
     const timeoutMs = deliveredProbeTimeoutMs(input.probes);
     const stdin = JSON.stringify({ probes: input.probes });

package/dist/probe-run.js

@@ -1,5 +1,6 @@
 /** Delivered probe instrument entry. `{ "probes": [...] }` on stdin, `{ witnesses }` on stdout. */
 import { z } from "zod";
+import { runPreparedVerificationCommand } from "./ensure-test-evidence.js";
 import { runDeliveryVerificationProbes } from "./investigation.js";
 const probeRunInputSchema = z.object({
     probes: z.array(z.object({
@@ -19,7 +20,12 @@ async function readStdin() {
 }
 try {
     const parsed = probeRunInputSchema.parse(JSON.parse(await readStdin()));
-    const witnesses = await runDeliveryVerificationProbes({ workspace: process.cwd(), probes: parsed.probes });
+    // This process is inside the sandbox; Bridge prepared the workspace's dependencies before it started.
+    const witnesses = await runDeliveryVerificationProbes({
+        workspace: process.cwd(),
+        probes: parsed.probes,
+        runCommand: (command, workspace) => runPreparedVerificationCommand(command, workspace),
+    });
     process.stdout.write(`${JSON.stringify({ witnesses })}\n`);
 }
 catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.207",
+  "version": "0.16.208",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {