@miraland-labs/conduit-bridge 0.16.21 → 0.16.23

package/dist/cli.js

@@ -520,7 +520,7 @@ async function runner() {
             const applied = await maybeApplyOnShiftIntent({
                 currentWorkspace: workspace,
                 onShift: hb.on_shift,
-                runInstall: async (nextWorkspace, repo) => {
+                runInstall: async (nextWorkspace, repo, managedRoot) => {
                     let env;
                     try {
                         env = loadOpsEnv();
@@ -530,7 +530,14 @@ async function runner() {
                     }
                     await runOps("install", [], {
                         env: env
-                            ? { ...env, CONDUIT_WORKSPACE: nextWorkspace, CONDUIT_REPO: repo }
+                            ? {
+                                ...env,
+                                CONDUIT_WORKSPACE: nextWorkspace,
+                                CONDUIT_REPO: repo,
+                                CONDUIT_MANAGED_ROOT: managedRoot === undefined
+                                    ? env.CONDUIT_MANAGED_ROOT
+                                    : managedRoot ?? "",
+                            }
                             : undefined,
                     });
                 },
@@ -556,6 +563,18 @@ async function runner() {
                         const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined });
                         await heartbeat(client, config, workspace, currentBrief, preflight);
                     },
+                    beforeClaim: async (driverId) => {
+                        // Never let the five-minute heartbeat cache span a CLI upgrade into a certified claim.
+                        // Publish the fresh probe first; the Control Plane then remains the authority for the
+                        // exact version frozen onto the claim response and event.
+                        const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
+                        const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, { force: true });
+                        const hb = await heartbeat(client, config, workspace, currentBrief, preflight);
+                        if (hb.staleBridge)
+                            return false;
+                        const lane = preflight.drivers.find((candidate) => candidate.id === driverId);
+                        return preflight.ready && lane?.ready === true && typeof lane.version === "string" && lane.version.length > 0;
+                    },
                     heartbeatIntervalMs: intervalMs,
                 }, running, {});
             }

package/dist/execution.js

@@ -538,7 +538,9 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
         }
         if (!laneDriver || !driverId)
             break;
-        const claimed = await claimNextAssignment(client, config, workspace, brief, driverId, processOnlineIds);
+        const claimed = await claimNextAssignment(client, config, workspace, brief, driverId, processOnlineIds, {
+            beforeClaim: supervision?.beforeClaim,
+        });
         if (!claimed)
             break;
         const taskId = claimed.taskId;
@@ -557,7 +559,7 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
     return progressed;
 }
 /** Claim one assignment when under capacity; does not start the agent (multi-slot pump does). */
-export async function claimNextAssignment(client, config, workspace, brief, driverId, processOnlineIds) {
+export async function claimNextAssignment(client, config, workspace, brief, driverId, processOnlineIds, options = {}) {
     if (Object.keys(config.activeAttempts).length >= config.leaseCapacity)
         return null;
     const data = await client.request("/runner/v1/assignments");
@@ -607,6 +609,10 @@ export async function claimNextAssignment(client, config, workspace, brief, driv
         console.error(`Assignment ${assignment.id} rejected before claim: ${rejection}`);
         return null;
     }
+    if (selectedDriverId && options.beforeClaim && !await options.beforeClaim(selectedDriverId)) {
+        console.warn(`Assignment ${assignment.id} held before claim: driver ${selectedDriverId} preflight is not ready`);
+        return null;
+    }
     console.log(`Claiming ${assignment.execution_kind} assignment ${assignment.id} (attempt ${assignment.attempt_id})`);
     const fuelMode = selectedDriverId ? resolveDriverFuel(config, selectedDriverId) : undefined;
     const fuelProvenance = selectedDriverId ? resolveDriverFuelProvenance(config, selectedDriverId) : undefined;
@@ -631,7 +637,9 @@ export async function executeNextAssignment(client, config, driver, workspace, b
     if (Object.keys(config.activeAttempts).length)
         return recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision);
     const preferredDriverId = Object.entries(DRIVERS).find(([, candidate]) => candidate === driver)?.[0] ?? null;
-    const claimed = await claimNextAssignment(client, config, workspace, brief, preferredDriverId);
+    const claimed = await claimNextAssignment(client, config, workspace, brief, preferredDriverId, null, {
+        beforeClaim: supervision?.beforeClaim,
+    });
     if (!claimed)
         return false;
     const selectedDriver = claimedAssignmentDriver(driver, claimed.driverId);

package/dist/land-contract.js

@@ -19,11 +19,6 @@ export const AGENT_NO_LAND_COMMIT_PREFIX = "Agent did not land repository change
 export function agentNoLandCommitMessage(baseCommit) {
     return `${AGENT_NO_LAND_COMMIT_PREFIX}: the attempt branch has no commit after base ${baseCommit.slice(0, 12)}.`;
 }
-/** Legacy ensureDeliveryPullRequest text — kept recognizable for stored failures. */
-export const LEGACY_NO_LAND_COMMIT_PATTERN = /no commit after base .*; this run produced no change to deliver/i;
-export function isAgentNoLandCommitMessage(message) {
-    return message.startsWith(AGENT_NO_LAND_COMMIT_PREFIX) || LEGACY_NO_LAND_COMMIT_PATTERN.test(message);
-}
 export class AgentNoLandCommitError extends Error {
     baseCommit;
     constructor(baseCommit) {

package/dist/on-shift-apply.js

@@ -47,6 +47,6 @@ export async function maybeApplyOnShiftIntent(input) {
             return false;
     }
     console.log(`Applying on-shift workspace intent: ${target}${repo ? ` (${repo})` : ""}`);
-    await input.runInstall(target, repo);
+    await input.runInstall(target, repo, input.onShift?.managed_workspace_root);
     return true;
 }

package/dist/preflight.js

@@ -16,9 +16,31 @@ function modelsFingerprint(config) {
     }).join(";");
     return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
-// Protocol 8 reports the resolved lane fuel and credential provenance in heartbeat and claim, so
-// the control plane can freeze what will actually run before the agent spends tokens.
-export const BRIDGE_PROTOCOL_VERSION = 8;
+// Protocol 9 adds the Bridge-observed driver interface cohort to every preflight lane.
+export const BRIDGE_PROTOCOL_VERSION = 9;
+/** Keep the version identity within the same bound accepted by the heartbeat schema. */
+export const MAX_DRIVER_VERSION_LENGTH = 200;
+/**
+ * Turn one successful CLI version probe into a stable, bounded identity.
+ *
+ * A probe is deliberately stricter than "some output": warnings, multiple lines, control
+ * sequences, and overlong output cannot be assigned to a particular CLI version. Returning null
+ * makes the lane unready, so a stale/truncated prefix can never be used for certification.
+ */
+export function parseDriverVersion(result) {
+    if (result.code !== 0)
+        return null;
+    const streams = [result.stdout, result.stderr]
+        .filter((value) => typeof value === "string")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    if (streams.length !== 1)
+        return null;
+    const version = streams[0];
+    if (version.length > MAX_DRIVER_VERSION_LENGTH || /[\r\n\u0000-\u001f\u007f]/u.test(version))
+        return null;
+    return version;
+}
 const execFileAsync = promisify(execFile);
 async function defaultCommandRunner(command, args, cwd) {
     try {
@@ -44,6 +66,55 @@ const DRIVER_COMMAND = {
 function executableFor(driver) {
     return driver === "codex" ? resolveCodexExecutable() : DRIVER_COMMAND[driver] ?? driver;
 }
+/**
+ * Primary-driver interface surfaces used by the existing AgentDriver implementations. This is
+ * deliberately not a hash of all help prose: vendor copy edits must not manufacture a new cohort.
+ */
+const DRIVER_INTERFACE_CONTRACTS = {
+    "claude-code": {
+        adapter_revision: 1,
+        help_args: ["--help"],
+        required: ["outputformat", "allowedtools", "disallowedtools"],
+        observed: ["outputformat", "allowedtools", "disallowedtools", "permissionmode", "resume", "model"],
+    },
+    codex: {
+        adapter_revision: 1,
+        help_args: ["exec", "--help"],
+        required: ["json", "sandbox"],
+        observed: ["json", "sandbox", "model", "config"],
+    },
+    cursor: {
+        adapter_revision: 1,
+        help_args: ["--help"],
+        required: ["outputformat", "workspace"],
+        observed: ["outputformat", "workspace", "trust", "force", "resume", "model"],
+    },
+};
+function normalizedHelpSurface(value) {
+    return value.toLowerCase().replace(/[-_\s]/g, "");
+}
+/**
+ * Fingerprint only what a bounded, non-spending interface probe can prove. It is not a claim that
+ * vendor semantics or model quality stayed identical; per-attempt gates and field outcomes remain
+ * authoritative for those facts.
+ */
+async function driverCompatibilityFingerprint(driver, workspace, run) {
+    const contract = DRIVER_INTERFACE_CONTRACTS[driver];
+    if (!contract)
+        return null;
+    const help = await run(executableFor(driver), contract.help_args, workspace);
+    if (help.code !== 0)
+        return null;
+    const surface = normalizedHelpSurface(`${help.stdout}\n${help.stderr}`);
+    if (!contract.required.every((signal) => surface.includes(signal)))
+        return null;
+    const features = contract.observed.map((signal) => [signal, surface.includes(signal)]);
+    return createHash("sha256").update(JSON.stringify({
+        driver,
+        adapter_revision: contract.adapter_revision,
+        features,
+    })).digest("hex");
+}
 async function localAuthenticationReady(driver, workspace, run) {
     if (driver === "claude-code")
         return hasClaudeLogin();
@@ -106,23 +177,25 @@ export async function runBridgePreflight(input, deps = {}) {
         const diagnosisReadOnly = supportsReadOnlyDiagnosis(driver);
         const fuel = resolveDriverFuel(input.config, driver);
         if (localFuelOnlyDriver(driver) && fuel !== "local") {
-            return { issue: { code: "driver_fuel_mismatch", driver }, snapshot: { id: driver, version: null, ready: false, diagnosis_read_only: diagnosisReadOnly } };
+            return { issue: { code: "driver_fuel_mismatch", driver }, snapshot: { id: driver, version: null, ready: false, diagnosis_read_only: diagnosisReadOnly, compatibility_fingerprint: null } };
         }
         const version = await run(executableFor(driver), ["--version"], input.workspace);
-        const versionText = `${version.stdout}${version.stderr}`.trim().slice(0, 200) || null;
-        if (version.code !== 0 || !`${version.stdout}${version.stderr}`.trim()) {
-            return { issue: { code: "driver_missing", driver }, snapshot: { id: driver, version: versionText, ready: false, diagnosis_read_only: diagnosisReadOnly } };
+        const versionText = parseDriverVersion(version);
+        if (!versionText) {
+            return { issue: { code: "driver_missing", driver }, snapshot: { id: driver, version: null, ready: false, diagnosis_read_only: diagnosisReadOnly, compatibility_fingerprint: null } };
         }
         if (fuel === "local" && !await localAuthenticationReady(driver, input.workspace, run)) {
-            return { issue: { code: "driver_not_authenticated", driver }, snapshot: { id: driver, version: versionText, ready: false, diagnosis_read_only: diagnosisReadOnly } };
+            return { issue: { code: "driver_not_authenticated", driver }, snapshot: { id: driver, version: versionText, ready: false, diagnosis_read_only: diagnosisReadOnly, compatibility_fingerprint: null } };
         }
         // Reported, not probed: the window state was learned from the vendor's last refusal and read
         // back through laneQuota, which retires a passed reset. Nothing is executed here, so a lane
         // running dry costs the heartbeat nothing.
         const quota = fuel === "local" ? laneQuota(input.config, driver) ?? undefined : undefined;
+        const compatibilityFingerprint = await driverCompatibilityFingerprint(driver, input.workspace, run);
         return {
             issue: null,
-            snapshot: { id: driver, version: versionText, ready: quota?.exhausted !== true, diagnosis_read_only: diagnosisReadOnly, ...(quota ? { quota } : {}) },
+            snapshot: { id: driver, version: versionText, ready: quota?.exhausted !== true, diagnosis_read_only: diagnosisReadOnly,
+                compatibility_fingerprint: compatibilityFingerprint, ...(quota ? { quota } : {}) },
         };
     }));
     issues.push(...driverChecks.map((check) => check.issue).filter((issue) => issue !== null));
@@ -137,10 +210,10 @@ export async function runBridgePreflight(input, deps = {}) {
 }
 let cached = null;
 /** Keep auth probes off the 15-second heartbeat hot path while still expiring readiness promptly. */
-export async function cachedBridgePreflight(input) {
+export async function cachedBridgePreflight(input, options = {}) {
     const online = input.processOnlineIds?.length ? input.processOnlineIds : onlineDriverIds(input.config);
     const key = JSON.stringify([input.workspace, input.expectedRepository ?? "", online, input.config.fuelSource, input.config.drivers]);
-    if (cached?.key === key && Date.now() - cached.at < 5 * 60_000)
+    if (!options.force && cached?.key === key && Date.now() - cached.at < 5 * 60_000)
         return cached.report;
     const report = await runBridgePreflight(input);
     cached = { key, at: Date.now(), report };
@@ -157,7 +230,7 @@ export function unavailableWorkspacePreflight(input) {
         ready: false,
         checked_at: new Date().toISOString(),
         workspace_clean: false,
-        drivers: online.map((id) => ({ id, version: null, ready: false, diagnosis_read_only: supportsReadOnlyDiagnosis(id) })),
+        drivers: online.map((id) => ({ id, version: null, ready: false, diagnosis_read_only: supportsReadOnlyDiagnosis(id), compatibility_fingerprint: null })),
         models_fingerprint: modelsFingerprint(input.config),
         issues,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.21",
+  "version": "0.16.23",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {