@miraland-labs/conduit-bridge 0.16.40 → 0.16.41

package/dist/driver.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { boundedTail } from "./ensure-test-evidence.js";
 import { resolveAgentTimeout } from "./execution-budget.js";
+import { unknownAgentSignal, vendorKindForAntigravity } from "./failure-signal.js";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
@@ -524,7 +525,7 @@ export const claudeCodeDriver = {
         }
         const sessionId = message?.session_id ?? null;
         if (code !== 0 || !message || message.is_error) {
-            return { status: "failed", resultText: message?.result ?? null, sessionId, error: boundedTail(message?.result || stderr || `agent exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText: message?.result ?? null, sessionId, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(message?.result || stderr || `agent exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText: message.result ?? "", sessionId };
     },
@@ -625,7 +626,7 @@ export const codexDriver = {
         const parsed = parseCodexJsonl(stdout);
         const resultText = parsed.resultText ?? (stdout || null);
         if (code !== 0) {
-            return { status: "failed", resultText, sessionId: parsed.sessionId, error: boundedTail(stderr || stdout || `codex exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText, sessionId: parsed.sessionId, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(stderr || stdout || `codex exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText, sessionId: parsed.sessionId };
     },
@@ -757,7 +758,7 @@ export const cursorDriver = {
         const { code, stdout, stderr } = configured;
         const parsed = parseCursorOutput(stdout);
         if (code !== 0 || parsed.isError) {
-            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(stderr || parsed.resultText || `cursor agent exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(stderr || parsed.resultText || `cursor agent exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
@@ -924,7 +925,7 @@ export const openCodeDriver = {
         const { code, stdout, stderr } = await withOpenCodePermissions(input.workspace, () => execute(input.executable ?? "opencode", args, input.workspace, agentTurnTimeoutMs(input), fuelSource === "conduit" ? input.fuel : undefined, fuelSource));
         const parsed = parseOpenCodeOutput(stdout);
         if (code !== 0 || parsed.isError) {
-            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(stderr || parsed.resultText || `opencode exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(stderr || parsed.resultText || `opencode exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
@@ -989,7 +990,7 @@ export const kiroDriver = {
         args.push(input.prompt);
         const { code, stdout, stderr } = await execute(executable, args, input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         if (code !== 0) {
-            return { status: "failed", resultText: stdout || null, sessionId: null, error: boundedTail(stderr || stdout || `kiro-cli exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText: stdout || null, sessionId: null, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(stderr || stdout || `kiro-cli exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText: stdout, sessionId: null };
     },
@@ -1218,6 +1219,24 @@ async function withAntigravityPermissions(workspace, allow, run) {
         release();
     }
 }
+/**
+ * The typed signal for a refused agy run: the envelope's own status and reason become the witness,
+ * and the vendor's vocabulary names the kind — so the control plane can hold a spent allowance
+ * without any generic prose table knowing agy at all.
+ */
+function agySignal(code, status, message, stderr, stdout) {
+    const kind = vendorKindForAntigravity(status, message);
+    if (kind === "unknown")
+        return unknownAgentSignal({ exit_code: code, stderr, stdout });
+    return {
+        phase: "agent",
+        witness: "vendor",
+        kind,
+        exit_code: code,
+        ...(status ? { vendor_status: status.slice(0, 200) } : {}),
+        ...(message ? { vendor_message: boundedTail(message, 2_000) } : {}),
+    };
+}
 export const antigravityDriver = {
     name: "antigravity",
     async listModels(executable = "agy", workspace = process.cwd()) {
@@ -1260,12 +1279,20 @@ export const antigravityDriver = {
         // it is the only text that names the cause (a spent allowance and when it refills).
         const refused = code !== 0 || (parsed.status !== null && parsed.status.toUpperCase() !== "SUCCESS");
         if (refused) {
-            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(parsed.error || stderr || parsed.resultText || `agy exited with code ${code}`, 20_000) };
+            return {
+                status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId,
+                signal: agySignal(code, parsed.status, parsed.error, stderr, stdout),
+                error: boundedTail(parsed.error || stderr || parsed.resultText || `agy exited with code ${code}`, 20_000),
+            };
         }
         // An empty response with a denial on stderr is a refused run: report it instead of an empty reply.
         const denial = parsed.resultText?.trim() ? null : antigravityDenialNotice(stderr);
         if (denial) {
-            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(`agy returned no response: ${denial}`, 20_000) };
+            return {
+                status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId,
+                signal: { phase: "agent", witness: "vendor", kind: "denied_tool", vendor_status: parsed.status ?? "ERROR", vendor_message: boundedTail(denial, 2_000) },
+                error: boundedTail(`agy returned no response: ${denial}`, 20_000),
+            };
         }
         return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
@@ -1318,6 +1345,7 @@ export const piDriver = {
                 status: "failed",
                 resultText: parsed.resultText,
                 sessionId: parsed.sessionId,
+                signal: unknownAgentSignal({ exit_code: code, stderr, stdout }),
                 error: boundedTail(stderr || parsed.resultText || `pi exited with code ${code}`, 20_000),
             };
         }
@@ -1450,7 +1478,7 @@ export const grokDriver = {
         const { code, stdout, stderr } = await execute(executable, grokRunArgs(input), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
         const parsed = parseGrokOutput(stdout);
         if (code !== 0 || parsed.isError) {
-            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(stderr || parsed.resultText || `grok exited with code ${code}`, 20_000) };
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, signal: unknownAgentSignal({ exit_code: code, stderr, stdout }), error: boundedTail(stderr || parsed.resultText || `grok exited with code ${code}`, 20_000) };
         }
         return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },

package/dist/execution.js

@@ -13,6 +13,7 @@ import { promisify } from "node:util";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
 import { buildSovereignExecutionFacts, bootstrapResultForWorkspace, workspaceIsClean } from "./execution-facts.js";
 import { forgeTransportFailure } from "./transport-fault.js";
+import { formatResetMinute, parseQuotaResetAt } from "./quota-reset.js";
 import { headCommitOrNull } from "./git.js";
 import { BRIDGE_PROTOCOL_VERSION } from "./preflight.js";
 import { bridgeVersion } from "./version.js";
@@ -96,14 +97,18 @@ export function providerQuotaRefusal(message) {
  */
 export function providerQuotaFailure(detail) {
     const resets = /resets? in ([^.\n]{1,40})/i.exec(detail);
+    // The absolute time wins when the vendor's words parse into one — an owner reads a clock, not
+    // arithmetic. The vendor's own phrasing is the fallback, and no reset stated stays unsaid.
+    const absolute = parseQuotaResetAt(detail);
+    const refills = absolute
+        ? `It refills at ${formatResetMinute(absolute)}.`
+        : resets ? `It refills in ${resets[1].trim()}.` : "";
     return {
         code: "driver_quota_exhausted",
         class: "environment",
         disposition: "hold",
         responsible_party: "computer_operator",
-        message: resets
-            ? `The agent lane on this computer has spent its subscription allowance. It refills in ${resets[1].trim()}.`
-            : "The agent lane on this computer has spent its subscription allowance.",
+        message: `The agent lane on this computer has spent its subscription allowance.${refills ? ` ${refills}` : ""}`,
         next_action: "Wait for the allowance to refill, bring another agent lane online to start sooner, or point this lane's model settings at a model that still has allowance.",
         diagnostic_detail: detail,
     };
@@ -159,66 +164,6 @@ function timeoutFailureBody(resolution, attemptId) {
 }
 class AgentTurnTimeoutError extends Error {
 }
-/**
- * When the window refills, if the vendor said so.
- *
- * Vendors phrase this as an absolute clock time ("resets at 3pm"), a duration ("try again in 2h
- * 14m"), or a Unix epoch. Returning null when none matches is fine — `laneQuota` treats a record
- * without a reset as exhausted until something proves otherwise, and the next successful run clears
- * it. Guessing a reset time would be worse: an invented one un-darks the lane early and the owner
- * watches the same refusal twice.
- */
-export function parseQuotaResetAt(message, now = Date.now()) {
-    const epoch = /\bresets?[ _-]?(?:at|in)?\b\D{0,12}(\d{10})\b/i.exec(message);
-    if (epoch)
-        return plausibleReset(Number(epoch[1]) * 1000, now);
-    // Units must end where they claim to. Unanchored, `m` swallowed the "m" of "500ms" and of
-    // "2 months" and read both as minutes — turning a 500-millisecond backoff into an eight-hour
-    // blackout of the only local lane.
-    const duration = /\b(?:try again|retry|resets?|available again)\b[^.\n]{0,24}?\bin\b\s*(?:(\d+)\s*(?:h|hrs?|hours?)\b(?!\w))?\s*(?:(\d+)\s*(?:m|mins?|minutes?)\b(?!\w))?\s*(?:(\d+)\s*(?:s|secs?|seconds?)\b(?!\w))?\s*(?:(\d+)\s*(?:ms|msecs?|milliseconds?)\b(?!\w))?/i.exec(message);
-    if (duration && (duration[1] || duration[2] || duration[3] || duration[4])) {
-        const ms = (Number(duration[1] ?? 0) * 3_600 + Number(duration[2] ?? 0) * 60 + Number(duration[3] ?? 0)) * 1_000
-            + Number(duration[4] ?? 0);
-        if (ms > 0)
-            return plausibleReset(now + ms, now);
-    }
-    const iso = /\bresets?\b[^.\n]{0,24}?(\d{4}-\d{2}-\d{2}T[\d:.]+Z?)/i.exec(message);
-    if (iso)
-        return plausibleReset(Date.parse(iso[1]), now);
-    return null;
-}
-/**
- * A reset time worth believing, or none at all.
- *
- * Two failure modes this closes. A number lifted from prose is not always a clock — a request id
- * that happens to be ten digits reads as a date in 2286 and would dark the lane for centuries. And
- * `new Date(x).toISOString()` *throws* on a non-finite or out-of-range value, which here would
- * escape between the driver returning and `queueTerminal`, stranding the attempt in `agent_running`.
- * Anything outside a plausible billing window is treated as "no reset stated", which is the honest
- * answer and already a supported state.
- */
-function plausibleReset(ms, now) {
-    if (!Number.isFinite(ms))
-        return null;
-    if (ms > now + MAX_PLAUSIBLE_RESET_MS)
-        return null;
-    // A reset that has just passed is kept, not discarded. Rejecting it returned null, which does not
-    // mean "already refilled" — it means "no reset stated", the one case trusted for a whole week. A
-    // second of clock skew or a slow stderr flush would then dark the lane for seven days instead of
-    // clearing it at once. Keeping the stale timestamp lets `laneQuota` retire it on the next read.
-    if (ms < now - MAX_STALE_RESET_MS)
-        return null;
-    try {
-        return new Date(ms).toISOString();
-    }
-    catch {
-        return null;
-    }
-}
-/** No vendor window runs longer than a month; past that the parse was a coincidence, not a clock. */
-const MAX_PLAUSIBLE_RESET_MS = 31 * 24 * 3_600_000;
-/** How far back a reset may sit and still be a real one the run simply outlived. */
-const MAX_STALE_RESET_MS = 24 * 3_600_000;
 /** Environment faults that must Hold — mirror CP ENVIRONMENT_FAILURES message patterns. */
 const FINALIZE_ENVIRONMENT_PATTERN = /base[_ ]not[_ ]ancestor|required base commit is not available|source[_ ]workspace[_ ]dirty|uncommitted changes|dirty workspace|workspace[_ ]head[_ ]changed|workspace[_ ]repository|workspace[_ ]unavailable|driver[_ ]not[_ ]authenticated|not logged in|no login|not authenticated|login required|no[_ ]online[_ ]driver|bridge[_ ]preflight|stale bridge|bridge version/i;
 /** Delivery-report / grant / evidence contract defects (non-retryable rework). */
@@ -1290,10 +1235,19 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             // Keep the tree until the replay-safe terminal response explicitly says whether diagnosis was
             // queued. A network fault here must not delete the evidence before Bridge can replay terminal.
             retainAttemptWorktree = true;
+            // The driver's typed cause rides beside the prose, never instead of it. A recovered
+            // verification log describes the same run: the signal becomes Bridge's verification witness
+            // and the prose carries the evidence, so the verify class stays typed without new tables.
+            const signal = result.signal
+                ? verificationDetail
+                    ? { ...result.signal, phase: "verification", witness: "bridge", stderr_tail: undefined, stdout_tail: undefined }
+                    : result.signal
+                : undefined;
             const response = await queueTerminal(client, taskId, { action: "fail", body: {
                     error: message,
                     retryable: retryableAgentFailure(agentMessage),
                     ...(providerQuotaRefusal(agentMessage) ? { failure: providerQuotaFailure(agentMessage) } : {}),
+                    ...(signal ? { signal } : {}),
                     idempotency_key: `bridge:fail:${active.attemptId}`,
                 } });
             retainAttemptWorktree = response.retain_worktree === true;

package/dist/failure-signal.js

@@ -0,0 +1,180 @@
+import { z } from "zod";
+/**
+ * A typed failure signal from Bridge: what ended the run, from the witness that saw it.
+ *
+ * Bridge reports failures as prose (`error`), and both sides classify the prose with regex tables
+ * kept in step by a test. Anything the tables do not name became `agent_execution_failed` /
+ * `transient` / `retry` — the one classification that spends attempts silently. The signal rides
+ * beside the prose: drivers that hold structured knowledge (a vendor envelope status, an exit
+ * code, the denied tool) emit it, and classification reads the signal first, the regex second.
+ *
+ * This file is mirrored byte-identical as packages/conduit-bridge/src/failure-signal.ts and
+ * src/conductor/failure-signal.ts. Bridge cannot import from the control plane, and the other
+ * way round, so test/failure-signal.test.ts pins the two files together instead of trusting
+ * them to stay in step.
+ */
+export const failureSignalSchema = z.object({
+    phase: z.enum(["claim", "checkout", "bootstrap", "agent", "verification", "delivery_report", "land"]),
+    /** Who produced the evidence for this signal: Bridge itself, the agent CLI, or the vendor. */
+    witness: z.enum(["bridge", "agent", "vendor"]),
+    kind: z.enum(["exit_code", "timeout", "denied_tool", "quota", "usage_error", "no_output", "contract", "verification_failed", "unknown"]),
+    /** The exact command when phase is verification or bootstrap. */
+    command: z.string().max(2_000).optional(),
+    exit_code: z.number().int().nullable().optional(),
+    /** The vendor envelope's own status, e.g. agy's "ERROR". */
+    vendor_status: z.string().max(200).optional(),
+    /** The vendor envelope's own reason, bounded. */
+    vendor_message: z.string().max(2_000).optional(),
+    stderr_tail: z.string().max(2_000).optional(),
+    stdout_tail: z.string().max(2_000).optional(),
+    /** ISO time when kind is quota and the vendor said. */
+    resets_at: z.string().max(64).nullable().optional(),
+});
+/** A reset time as a person reads it: "2026-09-10 09:36 UTC". Every reset is stored ISO in UTC. */
+function resetClock(resetsAt) {
+    return `${resetsAt.slice(0, 16).replace("T", " ")} UTC`;
+}
+/** Signal tails are bounded: one runaway log cannot fill the wire or the card. */
+function bounded2k(text) {
+    return text.length > 2_000 ? `${text.slice(0, 1_999)}…` : text;
+}
+/** The signal a driver that cannot say more emits: the run ended, here is its last output. */
+export function unknownAgentSignal(input) {
+    return {
+        phase: "agent",
+        witness: "agent",
+        kind: "unknown",
+        exit_code: input.exit_code ?? null,
+        ...(input.stderr?.trim() ? { stderr_tail: bounded2k(input.stderr) } : {}),
+        ...(input.stdout?.trim() ? { stdout_tail: bounded2k(input.stdout) } : {}),
+    };
+}
+/** The vendor's own reason, kept inside the 2,000-char message bound. */
+function quotedVendorText(signal) {
+    const text = signal.vendor_message ?? signal.stderr_tail ?? "";
+    return text.length > 400 ? `${text.slice(0, 399)}…` : text;
+}
+/**
+ * Classify one typed signal. Null when the signal carries no typed verdict (`kind: "unknown"`):
+ * the caller then lets its regex tables name the cause as an upgrade, and an unknown that survives
+ * them is held by `unknownSignalHold` — never retried blind.
+ *
+ * Rules, in order:
+ * 1. quota → the lane's allowance is spent: Hold, the computer operator's wait, reset quoted.
+ * 2. denied_tool / usage_error → the driver and vendor cannot run this assignment: Hold.
+ * 3. verification run by Bridge → the verify class: diagnose the retained tree and brief a repair.
+ * 4. contract, or a delivery_report phase → the delivery contract codes: rework.
+ * 5. timeout → the turn reached its execution limit: stop.
+ */
+export function classifyFailureSignal(signal) {
+    if (signal.kind === "quota") {
+        const refill = signal.resets_at
+            ? ` It refills at ${resetClock(signal.resets_at)}.`
+            : signal.vendor_message
+                ? ` The vendor said: ${quotedVendorText(signal)}`
+                : "";
+        return {
+            code: "driver_quota_exhausted",
+            class: "environment",
+            disposition: "hold",
+            responsible_party: "computer_operator",
+            message: `The agent lane on this computer has spent its subscription allowance.${refill}`,
+            next_action: "Wait for the allowance to refill, bring another agent lane online to start sooner, or point this lane's model settings at a model that still has allowance.",
+            diagnostic_detail: signal.vendor_message ?? signal.stderr_tail,
+        };
+    }
+    if (signal.kind === "denied_tool" || signal.kind === "usage_error") {
+        return {
+            code: "driver_incompatible",
+            class: "environment",
+            disposition: "hold",
+            responsible_party: "computer_operator",
+            message: signal.kind === "denied_tool"
+                ? "The agent CLI refused a tool this assignment requires, so it cannot run here as configured."
+                : "The agent CLI rejected how this assignment was handed to it, so every retry fails the same way.",
+            next_action: "The computer operator or Bridge must fix the lane's tool mapping or driver flags. The product owner does not author technical constraints.",
+            diagnostic_detail: signal.vendor_message ?? signal.stderr_tail,
+        };
+    }
+    if (signal.phase === "verification" && signal.witness === "bridge") {
+        return {
+            code: "agent_execution_failed",
+            class: "transient",
+            disposition: "retry",
+            responsible_party: "conduit",
+            message: "The agent run failed its own verification before delivery.",
+            next_action: "Conduit will diagnose the retained failed run and brief the next authoring attempt.",
+            diagnostic_detail: [signal.command ? `$ ${signal.command}` : null, signal.stderr_tail, signal.stdout_tail].filter(Boolean).join("\n") || undefined,
+        };
+    }
+    if (signal.phase === "delivery_report" || signal.kind === "contract") {
+        return signal.phase === "delivery_report"
+            ? {
+                code: "delivery_report_invalid",
+                class: "contract",
+                disposition: "rework",
+                responsible_party: "conduit",
+                message: "The delivery report did not satisfy the delivery contract.",
+                next_action: "Bridge's report-only repair turns ran; review the report defect and rework it.",
+                diagnostic_detail: signal.vendor_message ?? signal.stderr_tail,
+            }
+            : {
+                code: "execution_contract_failed",
+                class: "contract",
+                disposition: "rework",
+                responsible_party: "conduit",
+                message: "The agent could not satisfy the approved execution contract.",
+                next_action: "Review the last run and rework the same contract; change the plan only if its authority or outcome is wrong.",
+                diagnostic_detail: signal.vendor_message ?? signal.stderr_tail,
+            };
+    }
+    if (signal.kind === "timeout") {
+        return {
+            code: "agent_turn_timeout",
+            class: "platform",
+            disposition: "stop",
+            responsible_party: "conduit",
+            message: "The agent turn reached its configured execution limit.",
+            next_action: "Conduit must compare the package budget with the computer ceiling and resume with a larger bounded turn or checkpoint. The product owner does not need to author implementation constraints.",
+            diagnostic_detail: signal.stderr_tail,
+        };
+    }
+    return null;
+}
+/**
+ * The one verdict for an unknown that survived every table: Hold, on Conduit.
+ *
+ * An unknown signal used to fall through to `transient` and burn attempts silently. The owner now
+ * sees the run's own last words — the bounded stderr tail — and Conduit owes the diagnosis, because
+ * nobody can yet name the cause.
+ */
+export function unknownSignalHold(signal, proseDetail) {
+    const tail = signal.stderr_tail ?? signal.stdout_tail ?? "";
+    return {
+        code: "agent_run_unexplained",
+        class: "environment",
+        disposition: "hold",
+        responsible_party: "conduit",
+        message: tail
+            ? `The agent run failed and neither Bridge nor Conduit can yet name the cause. The run's last output: ${quotedVendorText(signal)}`
+            : "The agent run failed and neither Bridge nor Conduit can yet name the cause.",
+        next_action: "Conduit will diagnose the retained run before any retry. The product owner does not need to author technical constraints.",
+        diagnostic_detail: proseDetail || tail || undefined,
+    };
+}
+/**
+ * agy's JSON envelope status/error mapped to a typed kind, from the vendor's own vocabulary.
+ *
+ * This is vendor knowledge, not a classification table: it reads the words agy itself prints in
+ * its envelope, so the signal can carry `quota` (etc.) and the generic tables stay empty of agy.
+ */
+export function vendorKindForAntigravity(vendorStatus, vendorMessage) {
+    const text = `${vendorStatus ?? ""}\n${vendorMessage ?? ""}`;
+    if (/individual quota reached|quota reached|upgrade your subscription/i.test(text))
+        return "quota";
+    if (/no output produced|headless mode cannot prompt for|was auto-denied|permission/i.test(text))
+        return "denied_tool";
+    if (/took "[^"]*" as its prompt|Usage of agy|unknown (?:option|argument)|unrecognized (?:option|argument)/i.test(text))
+        return "usage_error";
+    return "unknown";
+}

package/dist/quota-reset.js

@@ -0,0 +1,88 @@
+/**
+ * The refill time a vendor states in a quota refusal, as an absolute clock.
+ *
+ * This file is mirrored byte-identical as packages/conduit-bridge/src/quota-reset.ts and
+ * src/conductor/quota-reset.ts. Bridge cannot import from the control plane, and the other way
+ * round, so test/failure-classification.test.ts pins the two files together instead of trusting
+ * them to stay in step.
+ *
+ * Vendors phrase the refill as an absolute clock time (RFC 1123), a duration ("try again in 2h
+ * 14m", or agy's Go form "Resets in 165h48m43s"), or a Unix epoch. Returning null when none
+ * matches is fine — `laneQuota` treats a record without a reset as exhausted until something
+ * proves otherwise, and the next successful run clears it. Guessing a reset time would be worse:
+ * an invented one un-darks the lane early, and the owner watches the same refusal twice.
+ */
+export function parseQuotaResetAt(message, now = Date.now()) {
+    const epoch = /\bresets?[ _-]?(?:at|in)?\b\D{0,12}(\d{10})\b/i.exec(message);
+    if (epoch)
+        return plausibleReset(Number(epoch[1]) * 1000, now);
+    // Units must end where they claim to. Unanchored, `m` swallowed the "m" of "500ms" and of
+    // "2 months" and read both as minutes — turning a 500-millisecond backoff into an eight-hour
+    // blackout of the only local lane.
+    const duration = /\b(?:try again|retry|resets?|available again)\b[^.\n]{0,24}?\bin\b\s*(?:(\d+)\s*(?:h|hrs?|hours?)\b(?!\w))?\s*(?:(\d+)\s*(?:m|mins?|minutes?)\b(?!\w))?\s*(?:(\d+)\s*(?:s|secs?|seconds?)\b(?!\w))?\s*(?:(\d+)\s*(?:ms|msecs?|milliseconds?)\b(?!\w))?/i.exec(message);
+    if (duration && (duration[1] || duration[2] || duration[3] || duration[4])) {
+        const ms = (Number(duration[1] ?? 0) * 3_600 + Number(duration[2] ?? 0) * 60 + Number(duration[3] ?? 0)) * 1_000
+            + Number(duration[4] ?? 0);
+        if (ms > 0)
+            return plausibleReset(now + ms, now);
+    }
+    // Go prints the same duration with the units glued to the numbers ("Resets in 165h48m43s",
+    // under an hour "48m43s", "45m0s"), where no unit ends at a boundary and the spaced pattern
+    // above cannot see it. Match the token whole, then let the trailing `\b(?!\w)` reject a glued
+    // "ms": "1h30ms" is one hour plus 30 milliseconds, and reading that 30 as minutes is the
+    // eight-hour blackout the spaced rule guards against.
+    const compact = /\b(?:try again|retry|resets?|available again)\b[^.\n]{0,24}?\bin\s+((?:(\d{1,5})h)?(?:(\d{1,2})m)?(?:(\d{1,2})s)?)\b(?!\w)/i.exec(message);
+    if (compact && (compact[2] || compact[3] || compact[4])) {
+        const ms = Number(compact[2] ?? 0) * 3_600_000 + Number(compact[3] ?? 0) * 60_000 + Number(compact[4] ?? 0) * 1_000;
+        if (ms > 0)
+            return plausibleReset(now + ms, now);
+    }
+    const iso = /\bresets?\b[^.\n]{0,24}?(\d{4}-\d{2}-\d{2}T[\d:.]+Z?)/i.exec(message);
+    if (iso)
+        return plausibleReset(Date.parse(iso[1]), now);
+    const rfc1123 = /\bresets?\b[^.\n]{0,24}?((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{1,2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT)\b/i.exec(message);
+    if (rfc1123)
+        return plausibleReset(Date.parse(rfc1123[1]), now);
+    return null;
+}
+/**
+ * A reset time worth believing, or none at all.
+ *
+ * Two failure modes this closes. A number lifted from prose is not always a clock — a request id
+ * that happens to be ten digits reads as a date in 2286 and would dark the lane for centuries. And
+ * `new Date(x).toISOString()` *throws* on a non-finite or out-of-range value, which here would
+ * escape between the driver returning and the failure being queued, stranding the attempt in a
+ * running state. Anything outside a plausible billing window is treated as "no reset stated",
+ * which is the honest answer and already a supported state.
+ */
+function plausibleReset(ms, now) {
+    if (!Number.isFinite(ms))
+        return null;
+    if (ms > now + MAX_PLAUSIBLE_RESET_MS)
+        return null;
+    // A reset that has just passed is kept, not discarded. Rejecting it returned null, which does not
+    // mean "already refilled" — it means "no reset stated", the one case trusted for a whole week. A
+    // second of clock skew or a slow stderr flush would then dark the lane for seven days instead of
+    // clearing it at once. Keeping the stale timestamp lets `laneQuota` retire it on the next read.
+    if (ms < now - MAX_STALE_RESET_MS)
+        return null;
+    try {
+        return new Date(ms).toISOString();
+    }
+    catch {
+        return null;
+    }
+}
+/** No vendor window runs longer than a month; past that the parse was a coincidence, not a clock. */
+const MAX_PLAUSIBLE_RESET_MS = 31 * 24 * 3_600_000;
+/** How far back a reset may sit and still be a real one the run simply outlived. */
+const MAX_STALE_RESET_MS = 24 * 3_600_000;
+/**
+ * The absolute reset as a person reads it: "2026-09-10 09:36 UTC".
+ *
+ * Every reset is stored as ISO in UTC, so the same cut of the string is the same moment on both
+ * sides of the wire, and no locale can make the two screens disagree.
+ */
+export function formatResetMinute(resetsAt) {
+    return `${resetsAt.slice(0, 16).replace("T", " ")} UTC`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.40",
+  "version": "0.16.41",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {