@miraland-labs/conduit-bridge 0.16.41 → 0.16.70

package/dist/brief.js

@@ -12,7 +12,7 @@ const MANIFESTS = [
 ];
 /** Prefer test before typecheck/lint so discovery order matches what pickVerificationCommand wants. */
 const VERIFICATION_SCRIPTS = ["test", "verify", "typecheck", "lint", "build"];
-const MAKE_VERIFICATION_TARGETS = ["test", "check", "verify", "replay", "typecheck", "lint", "build"];
+export const MAKE_VERIFICATION_TARGETS = ["test", "check", "verify", "replay", "typecheck", "lint", "build"];
 const EXCLUDED_DIRECTORIES = new Set(["node_modules", "dist", "build", "target", "coverage", ".venv", "venv"]);
 export async function buildWorkspaceBrief(workspace) {
     const entries = await readdir(workspace, { withFileTypes: true });
@@ -168,6 +168,8 @@ export async function resolveAttemptStartCommit(workspace, requestedBase, claime
  * recipe body was always repository-authored.
  */
 const MAX_DECLARED_VERIFICATION = 8;
+/** Keep in sync with `workspaceBriefSchema.verification` in `src/runner/routes.ts`. */
+const MAX_VERIFICATION_COMMANDS = 10;
 export function parseDeclaredVerification(text) {
     const declared = [];
     for (const raw of text.split("\n")) {
@@ -182,12 +184,30 @@ export function parseDeclaredVerification(text) {
     return declared;
 }
 export async function readDeclaredVerification(workspace) {
+    let text;
     try {
-        return parseDeclaredVerification(await readFile(join(workspace, ".conduit", "verification"), "utf8"));
+        text = await readFile(join(workspace, ".conduit", "verification"), "utf8");
     }
     catch {
         return []; // no declaration, or unreadable: discovery still applies
     }
+    const declared = parseDeclaredVerification(text);
+    // A line the shape check refuses, or a line after the eighth, was dropped with no reason given:
+    // the gate was then absent from every list and the operator had nothing to read. One line per
+    // dropped declaration says which line went and why it can go.
+    for (const raw of text.split("\n")) {
+        const line = raw.split("#")[0].trim();
+        if (!line || declared.includes(line))
+            continue;
+        console.warn(JSON.stringify({
+            event: "declared_verification_dropped",
+            line: line.slice(0, 200),
+            reason: isBoundedVerificationCommand(line)
+                ? `more than ${MAX_DECLARED_VERIFICATION} declared commands`
+                : "not a bounded verification command",
+        }));
+    }
+    return declared;
 }
 export async function discoverVerificationCommands(workspace, files) {
     // Declared first: the order is a preference order for every reader that takes one command.
@@ -240,5 +260,8 @@ export async function discoverVerificationCommands(workspace, files) {
         if (files.has("gradlew"))
             commands.push("./gradlew test");
     }
-    return [...new Set(commands)];
+    // The heartbeat schema caps `verification` at 10. A gate-rich checkout discovers more than that,
+    // and the whole heartbeat was then refused: the computer went dark with no reason on any card.
+    // Declared commands come first, so the cap removes only the least preferred discovered names.
+    return [...new Set(commands)].slice(0, MAX_VERIFICATION_COMMANDS);
 }

package/dist/cli.js

@@ -11,8 +11,8 @@ import { ConduitClient, ConduitRequestError } from "./client.js";
 import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearLocalConnection, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, saveConfigPrefs, saveDriverQuota, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
-import { DRIVERS } from "./driver.js";
-import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, laneDispatchBlock, laneStatuses, } from "./drivers.js";
+import { DRIVERS, MODEL_TIERS } from "./driver.js";
+import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriverModels, setDriversOnline, formatLaneTiers, laneDispatchBlock, laneStatuses, } from "./drivers.js";
 import { buildWorkspaceBrief } from "./brief.js";
 import { parseAgentTimeoutMinutes } from "./execution-budget.js";
 import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts } from "./execution-facts.js";
@@ -21,7 +21,8 @@ import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-app
 import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { pumpExecutionSlots, renewLeases } from "./execution.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
-import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, unavailableWorkspacePreflight } from "./preflight.js";
+import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, PREFLIGHT_CACHE_TTL_MS, unavailableWorkspacePreflight } from "./preflight.js";
+import { refreshSourceWorkspace } from "./workspace-refresh.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
 const [command] = process.argv.slice(2);
@@ -444,12 +445,16 @@ async function driversCommand() {
             // Printing the count is the only way an operator sees why dispatch keeps avoiding this lane.
             const slow = lane.timeouts ? `  timeouts=${lane.timeouts} (demoted)` : "";
             console.log(`  ${lane.id.padEnd(14)} ${lane.state.padEnd(8)} fuel=${lane.fuel}  allowance=${lane.allowance}${when}${reset}${slow}  (${lane.label})`);
+            // An unbound tier runs the CLI default and Holds on the first vendor abort, so the map is
+            // printed here — the operator learned a typo such as `fast` only from that Hold before.
+            console.log(`                 tiers  ${formatLaneTiers(lane.tiers)}`);
         }
         const blocked = laneDispatchBlock(laneStatuses(config));
         console.log(blocked
             ? `Dispatch: BLOCKED — ${blocked}.`
             : `Dispatch: ready — eligible ${laneStatuses(config).filter((lane) => lane.eligible).map((lane) => lane.id).join(", ")}.`);
         const online = onlineDriverIds(config);
+        console.log(`Bind a tier: ${bridgeUsage("drivers", "models", "<driver-id>", MODEL_TIERS.join("|"), "<model…>")}`);
         console.log(online.length
             ? `Toggle a lane: ${bridgeUsage("drivers", "online|offline", "<id…>")}`
             : `All offline — no new claims. Bring one online: ${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}`);
@@ -500,7 +505,20 @@ async function driversCommand() {
         console.log(`${driverLabel(id)} lane fuel set to ${mode}`);
         return;
     }
-    throw new Error(`Usage: ${bridgeUsage("drivers", "[list|online|offline|fuel|quota]", "…")}`);
+    if (sub === "models") {
+        const id = process.argv[4]?.trim();
+        const tier = process.argv[5]?.trim();
+        const names = process.argv.slice(6).map((name) => name.trim()).filter(Boolean);
+        if (!id || !tier || !MODEL_TIERS.includes(tier) || !names.length) {
+            throw new Error(`Usage: ${bridgeUsage("drivers", "models", "<driver-id>", MODEL_TIERS.join("|"), "<model…>")}`);
+        }
+        config = seedDriverLanes(config, [id]).config;
+        config = setDriverModels(config, id, tier, names);
+        await saveConfigPrefs(config);
+        console.log(`${driverLabel(id)} lane ${tier} tier: ${names.join(", ")}`);
+        return;
+    }
+    throw new Error(`Usage: ${bridgeUsage("drivers", "[list|online|offline|fuel|models|quota]", "…")}`);
 }
 async function runner() {
     applyRunnerToolPath();
@@ -562,9 +580,12 @@ async function runner() {
             config.drivers = latest.drivers;
             config.fuelSource = latest.fuelSource;
             config.leaseCapacity = latest.leaseCapacity;
+            // Refresh before discovery: the brief and the readiness report must describe origin's code,
+            // not whatever this checkout was left on. Cadence is the readiness report's own, not the beat.
+            const refresh = workspace ? await reportedRefresh(workspace) : null;
             const currentBrief = workspace ? await buildWorkspaceBrief(workspace).catch(() => brief) : null;
             const preflight = workspace
-                ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined })
+                ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined, refresh })
                 : unavailableWorkspacePreflight({ config });
             const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
             if (hb.staleBridge) {
@@ -614,8 +635,9 @@ async function runner() {
             if (workspace && onlineDriverIds(config).length) {
                 // Read the workspace again, then publish it. The last brief stands if the read fails.
                 const publishWorkspaceState = async (options = {}) => {
+                    const refresh = await reportedRefresh(workspace, options);
                     const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                    const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, options);
+                    const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined, refresh }, options);
                     const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                     return { preflight, hb };
                 };
@@ -648,6 +670,34 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
+/** Last state announced, so a workspace that stays diverged does not print on every cycle. */
+let lastRefreshState = null;
+/** Last refresh and when it ran, so the fetch keeps the readiness report's cadence. */
+let lastRefresh = null;
+/**
+ * Fast-forward the source workspace and announce only what changed.
+ *
+ * The fetch runs on the readiness report's cadence, not the heartbeat's: forced before every claim,
+ * and at most once every five minutes otherwise. A fetch on every fifteen-second beat is traffic
+ * nothing can use, because the readiness report it feeds only recomputes on that same cadence.
+ */
+async function reportedRefresh(workspace, options = {}) {
+    if (!options.force && lastRefresh && Date.now() - lastRefresh.at < PREFLIGHT_CACHE_TTL_MS)
+        return lastRefresh.result;
+    const refresh = await refreshSourceWorkspace(workspace).catch(() => null);
+    lastRefresh = { at: Date.now(), result: refresh };
+    const state = refresh ? `${refresh.state}:${refresh.local_commits}` : null;
+    if (state !== lastRefreshState) {
+        lastRefreshState = state;
+        if (refresh?.state === "fast_forwarded") {
+            console.log(`Workspace fast-forwarded to origin/${refresh.branch}.`);
+        }
+        else if (refresh?.state === "diverged") {
+            console.error(`Workspace cannot fast-forward: ${refresh.local_commits} local-only commit(s) on ${refresh.branch}. Park or push them; this computer takes no work until it can follow origin.`);
+        }
+    }
+    return refresh;
+}
 async function heartbeat(client, config, workspacePath, brief, preflight, intentProof, bootstrapResult) {
     const online = onlineDriverIds(config);
     const status = heartbeatStatusForDrivers(online);

package/dist/client.js

@@ -2,10 +2,14 @@ import { removeRuntimeAttempt, saveConfigPrefs, saveRuntime } from "./config.js"
 export class ConduitRequestError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    details;
+    constructor(message, status, code, 
+    /** The control plane's own structured reason, e.g. which execution fact changed. */
+    details) {
         super(message);
         this.status = status;
         this.code = code;
+        this.details = details;
     }
 }
 export class ConduitClient {
@@ -36,7 +40,7 @@ export class ConduitClient {
         });
         const data = await response.json();
         if (!response.ok)
-            throw new ConduitRequestError(data.error?.message ?? `Conduit request failed (${response.status})`, response.status, data.error?.code);
+            throw new ConduitRequestError(data.error?.message ?? `Conduit request failed (${response.status})`, response.status, data.error?.code, data.error?.details);
         return data;
     }
     async claim(taskId, attemptId, extras) {

package/dist/config.js

@@ -2,6 +2,7 @@ import { chmod, mkdir, open, readFile, rename, unlink, writeFile, stat } from "n
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { MODEL_TIERS } from "./driver.js";
 /** Serialize config writes in-process so concurrent claim/phase updates cannot clobber each other. */
 let saveChain = Promise.resolve();
 /** Default when join omits --capacity. */
@@ -84,18 +85,59 @@ export async function loadConfigIfPresent() {
             if (!lane || typeof lane !== "object")
                 continue;
             const state = lane.state === "online" ? "online" : "offline";
+            const modelsPolicy = lane.models_policy === "declared" ? "declared" : undefined;
             const fuel = lane.fuel === "local" || lane.fuel === "conduit" ? lane.fuel : undefined;
             // Every field a lane carries must be listed here. This sanitizer duplicates the shape check in
             // `normalizeDrivers` (drivers.ts) — importing it would close the loop config → drivers → driver
             // → config — so a new lane field has to be added in both, and forgetting here is silent: the
             // value survives in memory, then vanishes on the next load. `quota` was lost exactly that way.
             const quota = plainQuota(lane.quota);
-            cleaned[id] = { state, ...(fuel ? { fuel } : {}), ...(quota ? { quota } : {}) };
+            const models = plainTierModels(lane.models, `drivers.${id}.models`);
+            cleaned[id] = { state, ...(modelsPolicy ? { models_policy: modelsPolicy } : {}), ...(fuel ? { fuel } : {}), ...(quota ? { quota } : {}),
+                ...(models && Object.keys(models).length ? { models } : {}) };
         }
         config.drivers = cleaned;
     }
+    if (config.models !== undefined)
+        config.models = plainTierModels(config.models, "models");
     return config;
 }
+/** Tier keys already reported. The runner reloads the config every 15 seconds; one warning is enough. */
+const warnedTierKeys = new Set();
+/**
+ * Keep only the three intelligence tiers, and name each other key one time.
+ *
+ * A key such as `fast` is not a tier, so it binds nothing: every package of that risk runs the
+ * CLI default and the first vendor abort Holds. Dropping the key silently is what made that typo
+ * findable only from the Hold, hours later.
+ */
+function plainTierModels(raw, where) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const kept = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (MODEL_TIERS.includes(key)) {
+            if (typeof value === "string" || Array.isArray(value))
+                kept[key] = value;
+            continue;
+        }
+        const named = `${where}.${key}`;
+        if (warnedTierKeys.has(named))
+            continue;
+        warnedTierKeys.add(named);
+        console.warn(`Bridge configuration: \`${named}\` is not an intelligence tier and is ignored. The tiers are ${MODEL_TIERS.join(", ")}.`);
+    }
+    return kept;
+}
+/**
+ * Model candidates for one tier on one lane, best first: the lane's own map, then the machine-wide
+ * map. One reader for every surface — resolution, the preflight report and the operator printers.
+ */
+export function tierCandidates(config, driverId, tier) {
+    const configured = config.drivers?.[driverId]?.models?.[tier] ?? config.models?.[tier];
+    const listed = !configured ? [] : (Array.isArray(configured) ? configured : [configured]);
+    return listed.filter((candidate) => typeof candidate === "string" && candidate.trim().length > 0);
+}
 /** A stored quota record, or nothing. Malformed is dropped rather than thrown — see normalizeQuota. */
 function plainQuota(raw) {
     if (!raw || typeof raw !== "object")
@@ -394,5 +436,14 @@ export function suggestMachineName(host, installationId) {
     return `${base.slice(0, 199 - suffix.length)}-${suffix}`;
 }
 export function redactSecrets(value) {
-    return value.replace(/(runner_sk_|gateway_sk_|lease_|connect_)[A-Za-z0-9-]+/g, "$1[redacted]");
+    // Conduit's own key classes, then the provider and forge shapes an agent's own environment
+    // carries (ANTHROPIC_API_KEY, XAI_API_KEY, GEMINI_API_KEY, a GitHub token, a bearer header) —
+    // an agent that prints its environment on failure must not leak them through this terminal.
+    return value
+        .replace(/(runner_sk_|gateway_sk_|lease_|connect_)[A-Za-z0-9-]+/g, "$1[redacted]")
+        .replace(/sk-[A-Za-z0-9_-]{8,}/g, "sk-[redacted]")
+        .replace(/xai-[A-Za-z0-9]+/g, "xai-[redacted]")
+        .replace(/AIza[0-9A-Za-z_-]{35}/g, "AIza[redacted]")
+        .replace(/(ghp_|gho_|github_pat_|glpat-)[A-Za-z0-9_-]+/g, "$1[redacted]")
+        .replace(/Bearer\s+\S+/g, "Bearer [redacted]");
 }