@miraland-labs/conduit-bridge 0.16.26 → 0.16.28

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.16.26` — local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
+**Package version:** `0.16.27` — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 

package/dist/cli.js

@@ -12,8 +12,9 @@ import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, c
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
 import { DRIVERS } from "./driver.js";
-import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, } from "./drivers.js";
+import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, laneDispatchBlock, laneStatuses, } from "./drivers.js";
 import { buildWorkspaceBrief } from "./brief.js";
+import { parseAgentTimeoutMinutes } from "./execution-budget.js";
 import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts } from "./execution-facts.js";
 import { ensureCheckout } from "./checkout.js";
 import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
@@ -433,12 +434,21 @@ async function driversCommand() {
             return;
         }
         console.log(`Computer ${config.machineId} — shared capacity ${config.leaseCapacity} (sum across online lanes, not per IDE)`);
-        for (const lane of lanes) {
-            console.log(`  ${lane.id.padEnd(14)} ${lane.state.padEnd(8)} fuel=${lane.fuel}  (${lane.label})`);
+        // Allowance is printed beside state because the two disagree exactly when it matters: a lane can
+        // be installed, logged in and online while the provider is refusing it, and reporting only the
+        // first three reads as "Ready" for a lane dispatch is skipping.
+        for (const lane of laneStatuses(config)) {
+            const when = lane.observed_at ? ` observed=${lane.observed_at}` : "";
+            const reset = lane.resets_at ? ` resets=${lane.resets_at}` : lane.allowance === "unavailable" ? " resets=unknown" : "";
+            console.log(`  ${lane.id.padEnd(14)} ${lane.state.padEnd(8)} fuel=${lane.fuel}  allowance=${lane.allowance}${when}${reset}  (${lane.label})`);
         }
+        const blocked = laneDispatchBlock(laneStatuses(config));
+        console.log(blocked
+            ? `Dispatch: BLOCKED — ${blocked}.`
+            : `Dispatch: ready — eligible ${laneStatuses(config).filter((lane) => lane.eligible).map((lane) => lane.id).join(", ")}.`);
         const online = onlineDriverIds(config);
         console.log(online.length
-            ? `Online: ${online.join(", ")}. Toggle: ${bridgeUsage("drivers", "online|offline", "<id…>")}`
+            ? `Toggle a lane: ${bridgeUsage("drivers", "online|offline", "<id…>")}`
             : `All offline — no new claims. Bring one online: ${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}`);
         return;
     }
@@ -520,7 +530,17 @@ async function runner() {
     }
     const brief = workspace ? await buildWorkspaceBrief(workspace) : null;
     const intervalMs = values.interval ? Math.max(5_000, Number(values.interval)) : 15_000;
-    const timeoutMs = values["agent-timeout-minutes"] ? Number(values["agent-timeout-minutes"]) * 60_000 : undefined;
+    // Validated at startup rather than at use. Number("abc") is NaN, NaN is not nullish, and the
+    // unvalidated value flowed straight past `input.timeoutMs ?? DEFAULT` to become the timer itself.
+    let timeoutMs;
+    try {
+        timeoutMs = parseAgentTimeoutMinutes(values["agent-timeout-minutes"]);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+        return;
+    }
     const canExecute = Boolean(workspace) && onlineDriverIds(config).length > 0;
     if (!workspace) {
         console.warn(`WARNING: heartbeat only — pass --workspace <repo>. Lanes: ${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}`);

package/dist/driver.js

@@ -1,9 +1,20 @@
 import { spawn } from "node:child_process";
+import { resolveAgentTimeout } from "./execution-budget.js";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
 import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+/**
+ * The bound for this turn.
+ *
+ * One place, so the eight call sites cannot drift apart, and so a package budget has a single seam to
+ * arrive through when the contract carries one. `input.timeoutMs` is the machine ceiling the operator
+ * configured; `input.maxDurationMs` is what the package asked for and is treated as payload.
+ */
+function agentTurnTimeoutMs(input) {
+    return resolveAgentTimeout({ machineCeilingMs: input.timeoutMs, packageBudgetMs: input.maxDurationMs }).timeoutMs;
+}
 export { branchCreateCommands, deniedCommands, isBoundedVerificationCommand, prCreateCommands, requireStampedExecutionClass, } from "./execution-class.js";
 function deliveryLanguageRule(language) {
     if (language === "zh") {
@@ -502,7 +513,7 @@ export const claudeCodeDriver = {
         args.push("--disallowedTools", projected.disallowedTools.join(","));
         if (projected.acceptEdits)
             args.push("--permission-mode", "acceptEdits");
-        const { code, stdout, stderr } = await execute(input.executable ?? "claude", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource);
+        const { code, stdout, stderr } = await execute(input.executable ?? "claude", args, input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource);
         let message = null;
         try {
             message = JSON.parse(stdout);
@@ -609,7 +620,7 @@ export const codexDriver = {
             diagnosis: input.workRole === "diagnose",
         });
         // Prompt via stdin avoids ARG_MAX limits on large assignment contracts.
-        const { code, stdout, stderr } = await execute(input.executable ?? resolveCodexExecutable(), codexExecArgs({ ...input, networkAccess: projected.networkAccess }, projected.sandbox), input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt);
+        const { code, stdout, stderr } = await execute(input.executable ?? resolveCodexExecutable(), codexExecArgs({ ...input, networkAccess: projected.networkAccess }, projected.sandbox), input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt);
         const parsed = parseCodexJsonl(stdout);
         const resultText = parsed.resultText ?? (stdout || null);
         if (code !== 0) {
@@ -741,7 +752,7 @@ export const cursorDriver = {
             capabilities: input.capabilities ?? [],
             diagnosis: input.workRole === "diagnose",
         });
-        const configured = await withCursorPermissions(input.workspace, { allow: projected.allow, deny: projected.deny }, () => execute(executable, cursorRunArgs({ ...input, trustWorkspace, executionClass, force: projected.force }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
+        const configured = await withCursorPermissions(input.workspace, { allow: projected.allow, deny: projected.deny }, () => execute(executable, cursorRunArgs({ ...input, trustWorkspace, executionClass, force: projected.force }), input.workspace, agentTurnTimeoutMs(input), undefined, "local"));
         const { code, stdout, stderr } = configured;
         const parsed = parseCursorOutput(stdout);
         if (code !== 0 || parsed.isError) {
@@ -909,7 +920,7 @@ export const openCodeDriver = {
         }
         const args = openCodeRunArgs(input, agent);
         args.push(input.prompt);
-        const { code, stdout, stderr } = await withOpenCodePermissions(input.workspace, () => execute(input.executable ?? "opencode", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource));
+        const { code, stdout, stderr } = await withOpenCodePermissions(input.workspace, () => execute(input.executable ?? "opencode", args, input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource));
         const parsed = parseOpenCodeOutput(stdout);
         if (code !== 0 || parsed.isError) {
             return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `opencode exited with code ${code}`).slice(0, 20_000) };
@@ -975,7 +986,7 @@ export const kiroDriver = {
         }
         const args = kiroChatArgs(input, trusted);
         args.push(input.prompt);
-        const { code, stdout, stderr } = await execute(executable, args, input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const { code, stdout, stderr } = await execute(executable, args, input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         if (code !== 0) {
             return { status: "failed", resultText: stdout || null, sessionId: null, error: (stderr || stdout || `kiro-cli exited with code ${code}`).slice(0, 20_000) };
         }
@@ -1023,7 +1034,7 @@ export const antigravityDriver = {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Antigravity mode for active grants; refusing to start agent" };
         }
         // agy print mode emits plain text and does not surface a resumable id, so rework resume is not wired.
-        const { code, stdout, stderr } = await execute(input.executable ?? "agy", antigravityRunArgs({ prompt: input.prompt, grants: input.grants }, mode), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const { code, stdout, stderr } = await execute(input.executable ?? "agy", antigravityRunArgs({ prompt: input.prompt, grants: input.grants }, mode), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         if (code !== 0) {
             return { status: "failed", resultText: stdout || null, sessionId: null, error: (stderr || stdout || `agy exited with code ${code}`).slice(0, 20_000) };
         }
@@ -1071,7 +1082,7 @@ export const piDriver = {
         if (version.code !== 0 || !(version.stdout || version.stderr).trim()) {
             return { status: "failed", resultText: null, sessionId: null, error: "pi preflight could not verify the installed CLI version" };
         }
-        const { code, stdout, stderr } = await execute(executable, piRunArgs({ prompt: input.prompt, tools: projected.tools, model: input.model }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const { code, stdout, stderr } = await execute(executable, piRunArgs({ prompt: input.prompt, tools: projected.tools, model: input.model }), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         const parsed = parsePiJsonl(stdout);
         if (code !== 0) {
             return {
@@ -1207,7 +1218,7 @@ export const grokDriver = {
         if (input.grants.includes("test_run") && !(input.verificationCommands?.length)) {
             return { status: "failed", resultText: null, sessionId: null, error: "grok preflight found no bounded verification command for the test_run grant" };
         }
-        const { code, stdout, stderr } = await execute(executable, grokRunArgs(input), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const { code, stdout, stderr } = await execute(executable, grokRunArgs(input), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         const parsed = parseGrokOutput(stdout);
         if (code !== 0 || parsed.isError) {
             return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `grok exited with code ${code}`).slice(0, 20_000) };
@@ -1247,7 +1258,12 @@ function execute(executable, args, cwd, timeoutMs, fuel, fuelSource = "conduit",
         });
         let stdout = "";
         let stderr = "";
-        const timer = setTimeout(() => { child.kill("SIGTERM"); setTimeout(() => child.kill("SIGKILL"), 10_000).unref(); }, timeoutMs);
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            setTimeout(() => child.kill("SIGKILL"), 10_000).unref();
+        }, timeoutMs);
         // Bounded: a noisy or hostile local agent could otherwise grow these strings until the runner
         // dies. The report is the last fenced JSON block, so keeping the tail preserves what is parsed
         // while discarding the transcript ahead of it. Truncation is recorded, never silent.
@@ -1269,7 +1285,13 @@ function execute(executable, args, cwd, timeoutMs, fuel, fuelSource = "conduit",
             clearTimeout(timer);
             if (stdoutTruncated)
                 console.error(`Agent output exceeded ${MAX_AGENT_OUTPUT} bytes; kept the tail for report parsing.`);
-            resolve({ code, stdout, stderr: stderr.slice(0, 20_000) });
+            resolve({
+                code,
+                stdout,
+                // Never let vendor stderr appended before SIGTERM turn a local timer into a quota refusal.
+                // This stable prefix is classified by Bridge and the control plane as execution timeout.
+                stderr: timedOut ? `agent_turn_timeout: agent turn exceeded ${timeoutMs}ms` : stderr.slice(0, 20_000),
+            });
         });
         if (stdinText !== undefined && child.stdin) {
             // An agent that exits before reading its prompt closes this pipe, and the write then raises

package/dist/drivers.js

@@ -150,6 +150,34 @@ export function listDriverLanes(config) {
         };
     });
 }
+export function laneStatuses(config, now = Date.now()) {
+    return listDriverLanes(config).map((lane) => {
+        const quota = laneQuota(config, lane.id, now);
+        // A conduit-fuelled lane bills through the control plane, so a local refusal record says nothing
+        // about whether the next claim can run.
+        const local = lane.fuel === "local";
+        const allowance = !local || !quota
+            ? "unknown"
+            : quota.exhausted ? "unavailable" : "available";
+        return {
+            ...lane,
+            allowance,
+            observed_at: quota?.observed_at,
+            resets_at: quota?.resets_at ?? undefined,
+            eligible: lane.state === "online" && allowance !== "unavailable",
+        };
+    });
+}
+/** Why this machine cannot take a claim, or null when at least one lane can. */
+export function laneDispatchBlock(statuses) {
+    if (statuses.some((lane) => lane.eligible))
+        return null;
+    if (!statuses.length)
+        return "no driver lane is registered";
+    if (!statuses.some((lane) => lane.state === "online"))
+        return "every lane is offline";
+    return "every online lane has an allowance the provider refused";
+}
 export function onlineDriverIds(config) {
     const drivers = normalizeDrivers(config.drivers);
     return SUPPORTED_AGENTS.map((agent) => agent.id).filter((id) => drivers[id]?.state === "online");

package/dist/ensure-test-evidence.js

@@ -97,6 +97,48 @@ export async function captureVerificationFailure(input) {
     // Every bounded command passed (or none could start): agent failed for another reason.
     return null;
 }
+/** Longest failure detail Bridge will attach. Enough to diagnose; short enough to store and read. */
+export const FAILURE_DETAIL_MAX_CHARS = 4_000;
+/** Leading lines kept for orientation before the elision. */
+const FAILURE_DETAIL_HEAD_LINES = 3;
+/**
+ * A failure detail that keeps the part which explains the failure.
+ *
+ * This used to keep the first 100 lines and then the first 2,000 characters of the join. A failing
+ * command explains itself at the **end** — the assertion, the stack, the summary line, and the exit
+ * code — so head-truncation discarded exactly the evidence and kept a screen of `... ok`. A real
+ * incident cost three attempts on one task because every report looked like a passing test run cut
+ * short, and nobody could see the actual error.
+ *
+ * So: the command line for orientation, a few opening lines, then the **tail**, and the exit code
+ * always. What was dropped is stated rather than silently vanishing, because a reader must be able
+ * to tell a short failure from a truncated one.
+ */
+export function boundedFailureDetail(command, stdoutLines, stderrLines, code, maxChars = FAILURE_DETAIL_MAX_CHARS) {
+    const cap = (line) => (line.length > 500 ? `${line.slice(0, 500)}…` : line);
+    const body = [...stdoutLines, ...stderrLines].map(cap);
+    const first = `$ ${command}`;
+    const last = `exit ${code}`;
+    // The exit code is never a candidate for elision: it is the one line that always carries meaning.
+    const fixed = `${first}\n${last}`.length;
+    const budget = Math.max(0, maxChars - fixed - 1);
+    const head = body.slice(0, FAILURE_DETAIL_HEAD_LINES);
+    const rest = body.slice(FAILURE_DETAIL_HEAD_LINES);
+    const tail = [];
+    let used = head.join("\n").length;
+    for (let index = rest.length - 1; index >= 0; index -= 1) {
+        const line = rest[index];
+        if (used + line.length + 1 > budget)
+            break;
+        tail.unshift(line);
+        used += line.length + 1;
+    }
+    const dropped = rest.length - tail.length;
+    const middle = dropped > 0
+        ? [...head, `… ${dropped} line${dropped === 1 ? "" : "s"} omitted …`, ...tail]
+        : [...head, ...tail];
+    return [first, ...middle, last].join("\n");
+}
 async function defaultRunCommand(command, workspace) {
     const argv = argvForBoundedCommand(command);
     const bin = argv[0];
@@ -175,13 +217,7 @@ export async function ensureTestEvidence(input) {
         const stderrLines = result.stderr.trim() ? result.stderr.trim().split("\n") : [];
         if (result.code !== 0) {
             // Prefix must match FINALIZE_CONTRACT_PATTERN ("Agent report") — not Bridge-fault laundering.
-            const failedDetails = [
-                `$ ${command}`,
-                ...stdoutLines,
-                ...stderrLines,
-                `exit ${result.code}`,
-            ].map((line) => line.slice(0, 4_000)).slice(0, 100);
-            throw new Error(`Agent report: Verification failed (${command}): ${failedDetails.join("\n").slice(0, 2_000)}`);
+            throw new Error(`Agent report: Verification failed (${command}): ${boundedFailureDetail(command, stdoutLines, stderrLines, result.code)}`);
         }
         // Empty exit-0 is not proof — a no-op recipe (`@true`) must not clear required_evidence: test.
         if (stdoutLines.length === 0 && stderrLines.length === 0) {

package/dist/execution-budget.js

@@ -0,0 +1,77 @@
+/**
+ * How long one agent turn may run.
+ *
+ * Twenty minutes is a safety default for ordinary work, not a statement that longer work is
+ * ill-formed. A package should be split when its deliverables or authority boundaries are
+ * independent — never merely to fit a timer — so a cohesive task that genuinely needs thirty or
+ * sixty minutes must be able to say so.
+ *
+ * Two sources, and the smaller wins: the package asks for what the work needs, the machine caps what
+ * this host will tolerate. The operator's ceiling is the one that cannot be argued with by a payload.
+ */
+export const DEFAULT_AGENT_TIMEOUT_MS = 20 * 60_000;
+/**
+ * The longest turn any configuration may request.
+ *
+ * A bound this generous is not a scheduling opinion; it is the point past which a value is far more
+ * likely to be a mistake — a millisecond figure pasted where minutes were wanted — than an intention.
+ */
+export const MAX_AGENT_TIMEOUT_MS = 4 * 60 * 60_000;
+export const MIN_AGENT_TIMEOUT_MS = 60_000;
+export class InvalidAgentTimeoutError extends Error {
+}
+/**
+ * Minutes from a command line, validated.
+ *
+ * `Number("abc")` is `NaN`, and `NaN` is not nullish — so an unvalidated value flowed straight past
+ * `input.timeoutMs ?? DEFAULT` and became the timer itself. A typo must fail loudly at startup, not
+ * silently produce a turn that never times out or one that fires at once.
+ */
+export function parseAgentTimeoutMinutes(value) {
+    if (value === undefined)
+        return undefined;
+    const minutes = Number(value);
+    if (!Number.isFinite(minutes) || minutes <= 0) {
+        throw new InvalidAgentTimeoutError(`--agent-timeout-minutes must be a positive number of minutes, got ${JSON.stringify(value)}`);
+    }
+    const ms = Math.round(minutes * 60_000);
+    if (ms < MIN_AGENT_TIMEOUT_MS) {
+        throw new InvalidAgentTimeoutError(`--agent-timeout-minutes must be at least ${MIN_AGENT_TIMEOUT_MS / 60_000} minute`);
+    }
+    if (ms > MAX_AGENT_TIMEOUT_MS) {
+        throw new InvalidAgentTimeoutError(`--agent-timeout-minutes must not exceed ${MAX_AGENT_TIMEOUT_MS / 60_000} minutes`);
+    }
+    return ms;
+}
+/**
+ * The effective turn budget, and where it came from.
+ *
+ * The source is returned rather than inferred later because an operator reading a timed-out attempt
+ * needs to know which side set the bound; "it timed out" without that is not actionable.
+ *
+ * A package budget is payload, so it is bounded on both ends before use. A package asking for more
+ * than the machine allows is not an error — the machine simply wins, and the decision records that
+ * it was clamped so the difference is visible rather than mysterious.
+ */
+export function resolveAgentTimeout(inputs = {}) {
+    const ceiling = usableMs(inputs.machineCeilingMs);
+    const requested = usableMs(inputs.packageBudgetMs);
+    if (requested === undefined) {
+        return ceiling === undefined
+            ? { timeoutMs: DEFAULT_AGENT_TIMEOUT_MS, source: "default" }
+            : { timeoutMs: ceiling, source: "machine" };
+    }
+    // With no operator ceiling the default is the ceiling: a payload must not be able to lengthen a
+    // turn on a host whose operator never opted into longer runs.
+    const limit = ceiling ?? DEFAULT_AGENT_TIMEOUT_MS;
+    if (requested > limit)
+        return { timeoutMs: limit, source: "clamped_to_machine" };
+    return { timeoutMs: requested, source: "package" };
+}
+function usableMs(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return undefined;
+    if (value < MIN_AGENT_TIMEOUT_MS || value > MAX_AGENT_TIMEOUT_MS)
+        return undefined;
+    return Math.round(value);
+}

package/dist/execution-facts.js

@@ -123,5 +123,7 @@ export async function buildSovereignExecutionFacts(input) {
         verification_commands_digest: verificationCommandsDigest(input.brief?.verification ?? []),
         workspace_clean: input.workspaceClean,
         final_commit: commitOrNull(input.finalCommit),
+        ...(input.agentTimeoutMs !== undefined ? { agent_timeout_ms: input.agentTimeoutMs } : {}),
+        ...(input.agentTimeoutSource ? { agent_timeout_source: input.agentTimeoutSource } : {}),
     };
 }

package/dist/execution.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { z } from "zod";
+import { resolveAgentTimeout } from "./execution-budget.js";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets, saveDriverQuota } from "./config.js";
 import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, extractAgentReportJsonText, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseJsonObjectCandidate, pickModelCandidate, requireStampedExecutionClass, tierForRisk } from "./driver.js";
@@ -94,8 +95,43 @@ export const SUBSCRIPTION_EXHAUSTED_PATTERN = /\b(?:usage|rate|session)[ _-]?lim
  * sentence in the same string.
  */
 export function subscriptionExhausted(message) {
+    if (agentTurnTimedOut(message))
+        return false;
     return SUBSCRIPTION_EXHAUSTED_PATTERN.test(message);
 }
+export function agentTurnTimedOut(message) {
+    return /^agent_turn_timeout:/i.test(message.trim());
+}
+function timeoutFailureBody(resolution, attemptId) {
+    const machineBound = resolution.source === "default"
+        || resolution.source === "machine"
+        || resolution.source === "clamped_to_machine";
+    const minutes = Math.round(resolution.timeoutMs / 60_000);
+    return {
+        failure: machineBound ? {
+            code: "agent_turn_timeout",
+            class: "environment",
+            disposition: "hold",
+            responsible_party: "computer_operator",
+            message: `The agent turn reached this computer's ${minutes}-minute execution limit.`,
+            next_action: "The computer operator can raise the Bridge agent timeout when this cohesive package needs longer. The product owner does not need to write technical constraints or split the package merely to fit the timer.",
+            diagnostic_detail: `agent_turn_timeout: ${resolution.timeoutMs}ms; source=${resolution.source}`,
+        } : {
+            code: "agent_turn_timeout",
+            class: "platform",
+            disposition: "stop",
+            responsible_party: "conduit",
+            message: `The agent turn reached Conduit's ${minutes}-minute package budget.`,
+            next_action: "Conduit must revise the mechanically derived execution budget or continue from a bounded checkpoint. The product owner does not need to author implementation constraints.",
+            diagnostic_detail: `agent_turn_timeout: ${resolution.timeoutMs}ms; source=${resolution.source}`,
+        },
+        error: `agent_turn_timeout: agent turn exceeded ${resolution.timeoutMs}ms`,
+        retryable: false,
+        idempotency_key: `bridge:agent-timeout:${attemptId}`,
+    };
+}
+class AgentTurnTimeoutError extends Error {
+}
 /**
  * When the window refills, if the vendor said so.
  *
@@ -302,6 +338,7 @@ const workPackageSchema = z.object({
         failure_output: z.string().min(1).max(12_000),
     }).optional(),
     working_language: z.enum(["en", "zh"]).optional(),
+    max_duration_ms: z.number().int().min(60_000).max(4 * 60 * 60_000).optional(),
 }).nullable().optional();
 const diagnosticRepairBriefSchema = z.object({
     root_cause: z.string().trim().min(1).max(2_000),
@@ -728,6 +765,10 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
     const task = taskDetailSchema.parse(detail.task);
     const executionContract = executionContractSchema.parse(detail.execution_contract ?? {});
     const workPackage = workPackageSchema.parse(detail.work_package) ?? null;
+    const agentTimeout = resolveAgentTimeout({
+        machineCeilingMs: timeoutMs,
+        packageBudgetMs: workPackage?.max_duration_ms,
+    });
     const executionKind = task.execution_kind;
     const diagnosis = executionKind === "diagnosis";
     const sourceAttemptId = task.source_attempt_id ?? executionContract.source_attempt_id ?? active.sourceAttemptId ?? null;
@@ -992,6 +1033,8 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         executionClass,
         claimedHead: executionContract.claimed_head ?? startCommit,
         bootstrapResult: await bootstrapResultForWorkspace(workspace),
+        agentTimeoutMs: agentTimeout.timeoutMs,
+        agentTimeoutSource: agentTimeout.source,
     });
     await client.updateAttempt(taskId, { executionFacts });
     await client.attemptRequest(taskId, "progress", {
@@ -1067,6 +1110,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             executionClass,
             resumeSessionId,
             timeoutMs,
+            maxDurationMs: workPackage?.max_duration_ms,
             model: selection.model,
             fuel,
             fuelSource,
@@ -1153,6 +1197,16 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         }
         if (result.status === "failed") {
             const agentMessage = result.error ?? "Agent execution failed";
+            if (agentTurnTimedOut(agentMessage)) {
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: timeoutFailureBody(agentTimeout, active.attemptId),
+                });
+                retainAttemptWorktree = response.retain_worktree === true;
+                console.error(`Assignment ${taskId} timed out: ${redactSecrets(agentMessage)}`);
+                return;
+            }
             // The agent verifies inside its own tool loop, so its compiler/test output never reaches
             // result.error — production saw a bare git SHA and echoed source arrive as the "failure
             // reason", leaving Conductor nothing to diagnose. Re-run the project's bounded verification
@@ -1221,6 +1275,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                 fuel,
                 fuelSource,
                 timeoutMs,
+                maxDurationMs: workPackage?.max_duration_ms,
                 resumeSessionId: agentSessionId,
                 reason: "Agent claimed repository work but git shows none on the attempt branch; starting one land-only continuation turn instead of report-only repair.",
                 idempotencyKey: `bridge:progress:${active.attemptId}:claims-git-gate`,
@@ -1257,6 +1312,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                         fuel,
                         fuelSource,
                         timeoutMs,
+                        maxDurationMs: workPackage?.max_duration_ms,
                         resumeSessionId: agentSessionId,
                         reason: "Agent claimed repository work but git shows none; starting land-only continuation instead of read-only report repair.",
                         idempotencyKey: `bridge:progress:${active.attemptId}:claims-git-gate-parse`,
@@ -1331,6 +1387,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                             executionClass: "observe",
                             resumeSessionId,
                             timeoutMs,
+                            maxDurationMs: workPackage?.max_duration_ms,
                             model: selection.model,
                             fuel,
                             fuelSource,
@@ -1419,6 +1476,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                 fuel,
                 fuelSource,
                 timeoutMs,
+                maxDurationMs: workPackage?.max_duration_ms,
                 resumeSessionId: agentSessionId,
                 reason: "Parsed Delivery claims repository work but git shows none; starting land-only continuation.",
                 idempotencyKey: `bridge:progress:${active.attemptId}:claims-git-gate-report`,
@@ -1466,6 +1524,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                 fuel,
                 fuelSource,
                 timeoutMs,
+                maxDurationMs: workPackage?.max_duration_ms,
                 resumeSessionId: agentSessionId,
                 landContinuationUsed,
             });
@@ -1552,6 +1611,17 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         else
             console.error(`Assignment ${taskId} Delivery was rejected and routed to Conductor repair.`);
     }
+    catch (error) {
+        if (!(error instanceof AgentTurnTimeoutError))
+            throw error;
+        retainAttemptWorktree = true;
+        const response = await queueTerminal(client, taskId, {
+            action: "fail",
+            body: timeoutFailureBody(agentTimeout, active.attemptId),
+        });
+        retainAttemptWorktree = response.retain_worktree === true;
+        console.error(`Assignment ${taskId} timed out: ${redactSecrets(error.message)}`);
+    }
     finally {
         releaseIdleSleep();
         clearInterval(renewTimer);
@@ -1619,12 +1689,15 @@ async function runLandContinuationTurn(input) {
         executionClass: "mutate_repo",
         resumeSessionId: input.resumeSessionId ?? undefined,
         timeoutMs: input.timeoutMs,
+        maxDurationMs: input.maxDurationMs,
         model: input.selection.model ?? undefined,
         fuel: input.fuel,
         fuelSource: input.fuelSource,
     });
     await learnDriverFuel(input.config, input.driver.name, input.fuelSource ?? "conduit", continuation);
     if (continuation.status === "failed") {
+        if (agentTurnTimedOut(continuation.error ?? ""))
+            throw new AgentTurnTimeoutError(continuation.error);
         throw new AgentNoLandCommitError(input.spec.repository?.base_commit ?? "unknown");
     }
     return {
@@ -1679,6 +1752,7 @@ async function finalizeRepositoryLand(input) {
         fuel: input.fuel,
         fuelSource: input.fuelSource,
         timeoutMs: input.timeoutMs,
+        maxDurationMs: input.maxDurationMs,
         resumeSessionId: input.resumeSessionId,
         reason: "Agent finished without landing repository changes; starting one land-only continuation turn.",
         idempotencyKey: `bridge:progress:${input.attemptId}:land-continuation`,

package/dist/ops.js

@@ -13,7 +13,7 @@ import { ConduitClient } from "./client.js";
 import { loadConfig } from "./config.js";
 import { ensureCheckout } from "./checkout.js";
 import { detectInstalledClients, probeAgentHealth } from "./detect.js";
-import { driverIdsFromDetectedLabels } from "./drivers.js";
+import { driverIdsFromDetectedLabels, laneDispatchBlock, laneStatuses } from "./drivers.js";
 import { BRIDGE_PROTOCOL_VERSION, describePreflightIssue, runBridgePreflight } from "./preflight.js";
 import { applyRunnerToolPath, readActiveRunnerServiceWorkspace, readStoredRunnerServiceOptions, runnerServiceWorkspaceWarnings } from "./service.js";
 import { bridgeVersion } from "./version.js";
@@ -245,6 +245,24 @@ export async function runOps(verb, argv = [], deps = {}) {
     if (verb === "status") {
         const packageVersion = bridgeVersion();
         console.log(`Bridge: v${packageVersion} (protocol ${BRIDGE_PROTOCOL_VERSION})`);
+        // Print lanes through the same projection `drivers list` uses. These two commands disagreeing
+        // about whether a lane was usable is what sent an operator looking for a product fault when the
+        // real answer was a spent provider allowance.
+        try {
+            const laneConfig = await (deps.loadBridgeConfig ?? loadConfig)();
+            const statuses = laneStatuses(laneConfig);
+            for (const lane of statuses) {
+                const when = lane.observed_at ? `, observed ${lane.observed_at}` : "";
+                const reset = lane.resets_at ? `, resets ${lane.resets_at}` : lane.allowance === "unavailable" ? ", reset unknown" : "";
+                console.log(`Lane ${lane.id}: ${lane.state}, fuel ${lane.fuel}, allowance ${lane.allowance}${when}${reset}`);
+            }
+            const blocked = laneDispatchBlock(statuses);
+            // Never say READY on the strength of a login alone; dispatch is what the operator is asking about.
+            console.log(blocked ? `Machine dispatch: BLOCKED — ${blocked}` : "Machine dispatch: ready");
+        }
+        catch {
+            console.log("Lanes: unavailable (no local Bridge configuration)");
+        }
         try {
             const config = await (deps.loadBridgeConfig ?? loadConfig)();
             const controller = new AbortController();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.26",
-  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
+  "version": "0.16.28",
+  "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {
     "conduit": "dist/cli.js"