@miraland-labs/conduit-bridge 0.16.23 → 0.16.24

package/dist/cli.js

@@ -14,6 +14,7 @@ import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from
 import { DRIVERS } from "./driver.js";
 import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, } from "./drivers.js";
 import { buildWorkspaceBrief } from "./brief.js";
+import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts } from "./execution-facts.js";
 import { ensureCheckout } from "./checkout.js";
 import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
 import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
@@ -37,6 +38,12 @@ function parseFuelSource(value) {
         return value;
     throw new Error("Fuel source must be conduit or local");
 }
+function parseBootstrapResult(value) {
+    const result = BOOTSTRAP_RESULTS.find((candidate) => candidate === value);
+    if (!result)
+        throw new Error(`Bootstrap result must be one of: ${BOOTSTRAP_RESULTS.join(", ")}`);
+    return result;
+}
 async function connect() {
     const { values } = parseArgs({ args: process.argv.slice(3), options: { url: { type: "string" }, code: { type: "string" }, fuel: { type: "string" } } });
     if (!values.url || !values.code)
@@ -319,7 +326,7 @@ async function installService() {
     let config = await loadConfig();
     const { values } = parseArgs({ args: process.argv.slice(3), options: {
             workspace: { type: "string" }, interval: { type: "string" }, "agent-timeout-minutes": { type: "string" },
-            "ensure-checkout": { type: "string" },
+            "ensure-checkout": { type: "string" }, "bootstrap-result": { type: "string" },
         } });
     if (!values.workspace) {
         throw new Error(`Usage: ${bridgeUsage("install-service", "--workspace", "<repository-path>", "[--ensure-checkout <repository-url>]")} (workspace required; uses online driver lanes)`);
@@ -329,6 +336,9 @@ async function installService() {
         throw new Error(`No online driver lanes. Run \`${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}\` first.`);
     }
     const workspace = resolve(values.workspace);
+    const bootstrapResult = values["bootstrap-result"]
+        ? parseBootstrapResult(values["bootstrap-result"])
+        : undefined;
     if (values["ensure-checkout"]) {
         const result = await ensureCheckout(workspace, values["ensure-checkout"]);
         console.log(result === "cloned"
@@ -340,6 +350,7 @@ async function installService() {
         interval: values.interval,
         agentTimeoutMinutes: values["agent-timeout-minutes"],
         ensureCheckout: values["ensure-checkout"],
+        bootstrapResult,
     });
     console.log(`Installed Conduit Bridge v${bridgeVersion()} (protocol ${BRIDGE_PROTOCOL_VERSION}) runner service (${result.platform}): ${result.path}`);
     console.log(`Online lanes: ${onlineDriverIds(config).join(", ")}. Toggle with \`${bridgeUsage("drivers", "online|offline", "…")}\`.`);
@@ -466,9 +477,13 @@ async function runner() {
     const { values } = parseArgs({ args: process.argv.slice(3), options: {
             workspace: { type: "string" }, interval: { type: "string" }, once: { type: "boolean" },
             "agent-timeout-minutes": { type: "string" }, fuel: { type: "string" }, "ensure-checkout": { type: "string" },
+            "bootstrap-result": { type: "string" },
         } });
     let config = await loadConfig();
     const fuelOverride = parseFuelSource(values.fuel);
+    const bootstrapResult = values["bootstrap-result"]
+        ? parseBootstrapResult(values["bootstrap-result"])
+        : undefined;
     if (fuelOverride) {
         config.fuelSource = fuelOverride;
         await saveConfigPrefs(config);
@@ -511,7 +526,7 @@ async function runner() {
             const preflight = workspace
                 ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined })
                 : unavailableWorkspacePreflight({ config });
-            const hb = await heartbeat(client, config, workspace, currentBrief, preflight);
+            const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
             if (hb.staleBridge) {
                 console.error(`Bridge update required: running protocol ${BRIDGE_PROTOCOL_VERSION}; control plane requires protocol ${hb.requiredProtocol ?? "unknown"} (minimum Bridge ${hb.minimumVersion ?? "unknown"}). Reinstall the latest Bridge, then restart this runner.`);
                 await new Promise((resolveSleep) => setTimeout(resolveSleep, Math.max(intervalMs, 60_000)));
@@ -548,7 +563,7 @@ async function runner() {
             }
             const intentProof = buildOnShiftIntentProof({ currentWorkspace: workspace, onShift: hb.on_shift });
             if (intentProof) {
-                await heartbeat(client, config, workspace, currentBrief, preflight, intentProof);
+                await heartbeat(client, config, workspace, currentBrief, preflight, intentProof, bootstrapResult);
             }
             await renewLeases(client, config);
             if (workspace && onlineDriverIds(config).length) {
@@ -561,7 +576,7 @@ async function runner() {
                     heartbeat: async () => {
                         const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
                         const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined });
-                        await heartbeat(client, config, workspace, currentBrief, preflight);
+                        await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                     },
                     beforeClaim: async (driverId) => {
                         // Never let the five-minute heartbeat cache span a CLI upgrade into a certified claim.
@@ -569,7 +584,7 @@ async function runner() {
                         // exact version frozen onto the claim response and event.
                         const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
                         const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, { force: true });
-                        const hb = await heartbeat(client, config, workspace, currentBrief, preflight);
+                        const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                         if (hb.staleBridge)
                             return false;
                         const lane = preflight.drivers.find((candidate) => candidate.id === driverId);
@@ -590,19 +605,29 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
-async function heartbeat(client, config, workspacePath, brief, preflight, intentProof) {
+async function heartbeat(client, config, workspacePath, brief, preflight, intentProof, bootstrapResult) {
     const online = onlineDriverIds(config);
     const status = heartbeatStatusForDrivers(online);
+    const version = bridgeVersion();
+    const executionFacts = await buildSovereignExecutionFacts({
+        workspace: workspacePath,
+        brief,
+        workspaceClean: preflight.workspace_clean,
+        bridgeVersion: version,
+        bridgeProtocol: BRIDGE_PROTOCOL_VERSION,
+        bootstrapResult,
+    });
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,
             capabilities: config.capabilities,
             lease_capacity: config.leaseCapacity,
             workspace_path: workspacePath,
             fuel_source: config.fuelSource === "local" ? "local" : "conduit",
-            bridge_version: bridgeVersion(),
+            bridge_version: version,
             bridge_protocol: BRIDGE_PROTOCOL_VERSION,
             drivers: driversHeartbeatReport(config, config.activeAttempts),
             preflight,
+            execution_facts: executionFacts,
             ...(intentProof ? { on_shift_intent_proof: intentProof } : {}),
             ...(brief ? { workspace_brief: brief } : {}),
         }) });

package/dist/execution-facts.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { access, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { normalizeRepositoryUrl } from "./brief.js";
+const execFileAsync = promisify(execFile);
+export const EXECUTION_CLASSES = ["observe", "observe_network", "publish_artifact", "verify", "mutate_repo"];
+export const BOOTSTRAP_RESULTS = ["not_applicable", "not_run", "installed", "failed"];
+/**
+ * Lockfiles are hashed, never uploaded. The set is intentionally explicit and root-scoped so a
+ * dependency change becomes a durable identity without moving repository contents onto Conduit.
+ */
+const LOCKFILE_NAMES = [
+    "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml",
+    "Cargo.lock", "poetry.lock", "Pipfile.lock", "go.sum", "Gemfile.lock", "composer.lock",
+];
+/** Stable identity for the exact bounded verification command list used by Bridge. */
+export function verificationCommandsDigest(commands) {
+    const normalized = [...new Set(commands.map((command) => command.trim()).filter(Boolean))];
+    if (!normalized.length)
+        return null;
+    return createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+}
+/**
+ * Hash the root lockfiles in deterministic name order. Missing or unreadable lockfiles are simply
+ * absent from the identity; a workspace with no readable lockfile reports null rather than an
+ * invented digest.
+ */
+export async function lockfileDigest(workspace) {
+    const hash = createHash("sha256");
+    let found = false;
+    for (const name of LOCKFILE_NAMES) {
+        try {
+            const contents = await readFile(join(workspace, name));
+            hash.update(name);
+            hash.update("\0");
+            hash.update(contents);
+            hash.update("\0");
+            found = true;
+        }
+        catch {
+            // A missing or unreadable optional lockfile contributes no claim.
+        }
+    }
+    return found ? hash.digest("hex") : null;
+}
+/**
+ * Report whether a JavaScript workspace has dependencies installed. This is an observed state, not
+ * a promise that Bridge will run a package manager during execution. Managed installs already run
+ * `npm ci` before the service is advertised, so a present node_modules directory is the durable
+ * local evidence available on later heartbeats.
+ */
+export async function bootstrapResultForWorkspace(workspace) {
+    if (!workspace)
+        return "not_applicable";
+    try {
+        await access(join(workspace, "package.json"));
+    }
+    catch {
+        return "not_applicable";
+    }
+    try {
+        const lockfile = await Promise.any(LOCKFILE_NAMES.map(async (name) => {
+            await access(join(workspace, name));
+            return true;
+        }));
+        void lockfile;
+    }
+    catch {
+        return "not_run";
+    }
+    try {
+        const dependencies = await stat(join(workspace, "node_modules"));
+        return dependencies.isDirectory() ? "installed" : "not_run";
+    }
+    catch {
+        return "not_run";
+    }
+}
+/** Read the source/attempt tree's Git cleanliness without returning its contents. */
+export async function workspaceIsClean(workspace) {
+    try {
+        const result = await execFileAsync("git", ["-C", workspace, "status", "--porcelain", "--untracked-files=normal"], {
+            timeout: 15_000,
+            windowsHide: true,
+        });
+        return result.stdout.trim().length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read only the bounded HEAD identity retained when an attempt terminates. */
+export async function finalCommitForWorkspace(workspace) {
+    try {
+        const result = await execFileAsync("git", ["-C", workspace, "rev-parse", "HEAD"], {
+            timeout: 15_000,
+            windowsHide: true,
+        });
+        return commitOrNull(result.stdout.trim());
+    }
+    catch {
+        return null;
+    }
+}
+function commitOrNull(value) {
+    return value && /^[0-9a-f]{40,64}$/i.test(value) ? value.toLowerCase() : null;
+}
+/** Build one self-contained heartbeat/attempt snapshot from existing Bridge observations. */
+export async function buildSovereignExecutionFacts(input) {
+    const repository = input.brief?.repository?.trim();
+    return {
+        os: process.platform,
+        architecture: process.arch,
+        repository_fingerprint: repository ? normalizeRepositoryUrl(repository) : null,
+        claimed_head: commitOrNull(input.claimedHead ?? input.brief?.base_commit),
+        lockfile_digest: input.workspace ? await lockfileDigest(input.workspace) : null,
+        bootstrap_result: input.bootstrapResult ?? await bootstrapResultForWorkspace(input.workspace),
+        bridge_version: input.bridgeVersion,
+        bridge_protocol: input.bridgeProtocol,
+        execution_class: input.executionClass ?? null,
+        verification_commands_digest: verificationCommandsDigest(input.brief?.verification ?? []),
+        workspace_clean: input.workspaceClean,
+        final_commit: commitOrNull(input.finalCommit),
+    };
+}

package/dist/execution.js

@@ -10,6 +10,9 @@ import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quaran
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
+import { buildSovereignExecutionFacts, bootstrapResultForWorkspace, finalCommitForWorkspace, workspaceIsClean } from "./execution-facts.js";
+import { BRIDGE_PROTOCOL_VERSION } from "./preflight.js";
+import { bridgeVersion } from "./version.js";
 import { ensureDeliveryPullRequest } from "./ensure-pull-request.js";
 import { ensureLandCommit } from "./ensure-land-commit.js";
 import { AgentNoLandCommitError, agentNoLandCommitMessage, requiresLandCommit } from "./land-contract.js";
@@ -907,8 +910,20 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             normativeRefs: normativeMaterialized,
         });
     const resuming = Boolean(options.forceResumeSessionId);
+    const executionFacts = await buildSovereignExecutionFacts({
+        workspace: attemptWorkspace,
+        brief: attemptBrief,
+        workspaceClean: await workspaceIsClean(workspace),
+        bridgeVersion: bridgeVersion(),
+        bridgeProtocol: BRIDGE_PROTOCOL_VERSION,
+        executionClass,
+        claimedHead: executionContract.claimed_head ?? startCommit,
+        bootstrapResult: await bootstrapResultForWorkspace(workspace),
+    });
+    await client.updateAttempt(taskId, { executionFacts });
     await client.attemptRequest(taskId, "progress", {
         phase: diagnosis ? "inspecting" : "changing",
+        execution_facts: executionFacts,
         message: resuming
             ? `Resuming ${driver.name} after Bridge restart with proven session and worktree.`
             : diagnosis
@@ -1595,6 +1610,10 @@ async function submitFinishedDelivery(client, taskId) {
     const active = client.attempt(taskId);
     if (!active.delivery)
         throw new Error("Finished agent run is missing its persisted Delivery data");
+    const finalCommit = active.delivery.report.head_commit?.toLowerCase() ?? null;
+    if (finalCommit && active.executionFacts) {
+        await client.updateAttempt(taskId, { executionFacts: { ...active.executionFacts, final_commit: finalCommit } });
+    }
     const terminal = await prepareDelivery(client, active.attemptId, taskId, active.delivery.report);
     await client.attemptRequest(taskId, "progress", { phase: "preparing_delivery", message: "Agent finished; submitting the Delivery.", idempotency_key: `bridge:progress:${active.attemptId}:delivery` });
     return queueTerminal(client, taskId, terminal);
@@ -1870,7 +1889,19 @@ function retainDiagnosticWorktree(response) {
     return response.retain_worktree === true || response.status === "invalid_lease";
 }
 async function queueTerminal(client, taskId, terminal) {
-    await client.updateAttempt(taskId, { phase: "terminal_pending", terminal });
+    const active = client.attempt(taskId);
+    let executionFacts = active.executionFacts;
+    if (executionFacts && executionFacts.final_commit === null && active.worktreePath) {
+        const finalCommit = await finalCommitForWorkspace(active.worktreePath);
+        if (finalCommit) {
+            executionFacts = { ...executionFacts, final_commit: finalCommit };
+            await client.updateAttempt(taskId, { executionFacts });
+        }
+    }
+    const body = executionFacts && !terminal.body.execution_facts
+        ? { ...terminal.body, execution_facts: executionFacts }
+        : terminal.body;
+    await client.updateAttempt(taskId, { phase: "terminal_pending", terminal: { ...terminal, body } });
     return flushTerminal(client, taskId);
 }
 export async function flushTerminal(client, taskId) {

package/dist/ops.js

@@ -570,6 +570,7 @@ export async function runOps(verb, argv = [], deps = {}) {
         }
         const workspace = resolve(expandOpsValue(installEnv.CONDUIT_WORKSPACE));
         const drivers = await (deps.resolveInstallDrivers ?? resolveInstallDrivers)(installEnv, installArgv);
+        let bootstrapResult;
         if (installEnv.CONDUIT_REPO) {
             const checkout = deps.ensureCheckout ?? ensureCheckout;
             const result = await checkout(workspace, installEnv.CONDUIT_REPO);
@@ -587,7 +588,7 @@ export async function runOps(verb, argv = [], deps = {}) {
                 && !isAbsolute(managedRelative));
             if (managedCheckout) {
                 const bootstrap = deps.bootstrapWorkspace ?? bootstrapManagedWorkspace;
-                const bootstrapResult = bootstrap(workspace);
+                bootstrapResult = bootstrap(workspace);
                 if (bootstrapResult === "installed")
                     console.log(`Installed locked project dependencies in ${workspace}`);
             }
@@ -616,6 +617,8 @@ export async function runOps(verb, argv = [], deps = {}) {
         const installArgs = ["install-service", "--workspace", workspace];
         if (installEnv.CONDUIT_REPO)
             installArgs.push("--ensure-checkout", installEnv.CONDUIT_REPO);
+        if (bootstrapResult)
+            installArgs.push("--bootstrap-result", bootstrapResult);
         console.log(`Bridge: v${bridgeVersion()} (protocol ${BRIDGE_PROTOCOL_VERSION})`);
         console.log(`Installing runner for ${workspace} (drivers: ${drivers.join(", ")})`);
         runBridge(installArgs);

package/dist/service.js

@@ -30,6 +30,8 @@ export function runnerProgramArguments(options = {}) {
         args.push("--interval", options.interval);
     if (options.agentTimeoutMinutes)
         args.push("--agent-timeout-minutes", options.agentTimeoutMinutes);
+    if (options.bootstrapResult)
+        args.push("--bootstrap-result", options.bootstrapResult);
     return args;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.23",
+  "version": "0.16.24",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {