@miraland-labs/conduit-bridge 0.16.6 → 0.16.7

package/dist/driver.js

@@ -99,6 +99,16 @@ export function buildAssignmentPrompt(context) {
     }
     if (changeScope?.length)
         lines.push("", `CHANGE SCOPE — only modify paths under\n${changeScope.map((item) => `- ${item}`).join("\n")}`);
+    const integrationObligations = spec.integration_obligations ?? [];
+    if (integrationObligations.length) {
+        lines.push("", "INTEGRATION OBLIGATIONS — finalize fails unless these hold");
+        for (const obligation of integrationObligations) {
+            if (obligation.kind !== "symbol_referenced_from")
+                continue;
+            const globs = obligation.from_globs?.length ? obligation.from_globs.join(", ") : "runtime entrypoints";
+            lines.push(`- symbol "${obligation.symbol}" must be referenced from ${globs}`);
+        }
+    }
     if (context.normativeRefs?.length) {
         lines.push("", "NORMATIVE REFERENCES — read-only contract files; your implementation must align. Do not edit anything under .conduit/normative/.");
         for (const ref of context.normativeRefs) {

package/dist/ensure-change-evidence.js

@@ -22,8 +22,14 @@ export async function ensureChangeEvidence(input) {
         return input.report;
     const paths = input.changedPaths
         ?? (input.baseCommit ? await changedPathsSince(input.workspace, input.baseCommit) : null);
-    if (!paths?.length)
+    if (paths === null)
         return input.report;
+    if (!paths.length) {
+        return {
+            ...input.report,
+            evidence: input.report.evidence.filter((item) => item.kind !== "change"),
+        };
+    }
     const stat = input.baseCommit ? await diffStatSince(input.workspace, input.baseCommit) : null;
     const baseLabel = input.baseCommit?.slice(0, 12) ?? "base";
     const details = [

package/dist/execution.js

@@ -1209,10 +1209,9 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                 repositoryFingerprint: executionContract.repository_fingerprint,
             });
             // Ask git what changed before trusting what the report says changed.
-            const startCommit = executionContract.requested_base_commit && executionContract.claimed_head
-                ? await resolveAttemptStartCommit(workspace, executionContract.requested_base_commit, executionContract.claimed_head)
+            const actualPaths = /^[0-9a-f]{7,40}$/i.test(worktreeStart)
+                ? await changedPathsSince(attemptWorkspace, worktreeStart)
                 : null;
-            const actualPaths = startCommit ? await changedPathsSince(attemptWorkspace, startCommit) : null;
             // Mechanical test path: agent often forgets verbatim make test / npm test output.
             report = await ensureTestEvidence({
                 workspace: attemptWorkspace,
@@ -1223,7 +1222,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             });
             report = await ensureChangeEvidence({
                 workspace: attemptWorkspace,
-                baseCommit: startCommit,
+                baseCommit: /^[0-9a-f]{7,40}$/i.test(worktreeStart) ? worktreeStart : startCommit,
                 report,
                 spec,
                 grants,

package/dist/integration-obligations.js

@@ -41,7 +41,7 @@ export function parseIntegrationObligations(value) {
 async function symbolReferencedFrom(workspace, symbol, globs) {
     const pathspecs = globs.map((glob) => `:(glob)${glob}`);
     try {
-        const { stdout } = await execFileAsync("git", ["-C", workspace, "grep", "-l", "-F", symbol, "--", ...pathspecs], { timeout: 30_000, maxBuffer: 4_000_000 });
+        const { stdout } = await execFileAsync("git", ["-C", workspace, "grep", "-l", "-F", "--untracked", symbol, "--", ...pathspecs], { timeout: 30_000, maxBuffer: 4_000_000 });
         return stdout.trim().length > 0;
     }
     catch (error) {

package/dist/land-git-reality.js

@@ -84,7 +84,7 @@ export function agentClaimsRepositoryWork(text) {
     }
     if (NO_CHANGE_OUTCOME.test(text))
         return false;
-    return /\b(rewrote|replaced|implemented|fetcher\.rs|head_commit|"changes"\s*:\s*\[)/i.test(text);
+    return /\b(rewrote|replaced|implemented|fetcher\.rs|head_commit|"changes"\s*:\s*\[\s*")/i.test(text);
 }
 /** Parsed Delivery claims repository work (stricter than free text). */
 export function reportClaimsRepositoryWork(report) {

package/dist/normative-refs.js

@@ -48,9 +48,17 @@ function validateNormativePath(path) {
 function cacheDir(sourceWorkspace, repository) {
     return join(sourceWorkspace, ".conduit", "normative-cache", fingerprint(repository).replaceAll("/", "__"));
 }
+const GIT_NO_PROMPT = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
 function cloneUrl(repository) {
     return `https://${fingerprint(repository)}.git`;
 }
+function assertPublicGitHost(repository) {
+    const host = fingerprint(repository).split("/")[0] ?? "";
+    if (!host || !host.includes(".") || host === "localhost" || host.endsWith(".localhost")
+        || host.endsWith(".internal") || /^\d/.test(host) || host.includes(":")) {
+        throw new Error(`${NORMATIVE_REF_PREFIX}: repository host is not a public git host`);
+    }
+}
 async function pathExists(path) {
     try {
         await access(path, constants.F_OK);
@@ -72,7 +80,11 @@ async function readPinnedRevision(repoDir) {
         return null;
     }
 }
+async function gitNoPrompt(args, timeout, maxBuffer) {
+    await execFileAsync("git", args, { timeout, maxBuffer, env: GIT_NO_PROMPT });
+}
 async function ensureRepoCache(sourceWorkspace, ref) {
+    assertPublicGitHost(ref.repository);
     const dir = cacheDir(sourceWorkspace, ref.repository);
     const wantedRevision = ref.revision ?? "HEAD";
     const marker = join(dir, ".conduit-normative-revision");
@@ -89,7 +101,7 @@ async function ensureRepoCache(sourceWorkspace, ref) {
         }
         cloneArgs.push(cloneUrl(ref.repository), dir);
         try {
-            await execFileAsync("git", cloneArgs, { timeout: 180_000, maxBuffer: 4_000_000 });
+            await gitNoPrompt(cloneArgs, 180_000, 4_000_000);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -98,32 +110,23 @@ async function ensureRepoCache(sourceWorkspace, ref) {
     }
     else if (ref.revision && cachedRevision !== wantedRevision) {
         try {
-            if (/^[0-9a-f]{40}$/i.test(ref.revision)) {
-                await execFileAsync("git", ["-C", dir, "fetch", "--depth", "1", "origin", ref.revision], {
-                    timeout: 120_000,
-                    maxBuffer: 4_000_000,
-                });
-                await execFileAsync("git", ["-C", dir, "checkout", "--detach", "FETCH_HEAD"], {
-                    timeout: 60_000,
-                    maxBuffer: 1_000_000,
-                });
-            }
-            else {
-                await execFileAsync("git", ["-C", dir, "fetch", "--depth", "1", "origin", ref.revision], {
-                    timeout: 120_000,
-                    maxBuffer: 4_000_000,
-                });
-                await execFileAsync("git", ["-C", dir, "checkout", "--detach", "FETCH_HEAD"], {
-                    timeout: 60_000,
-                    maxBuffer: 1_000_000,
-                });
-            }
+            await gitNoPrompt(["-C", dir, "fetch", "--depth", "1", "origin", ref.revision], 120_000, 4_000_000);
+            await gitNoPrompt(["-C", dir, "checkout", "--detach", "FETCH_HEAD"], 60_000, 1_000_000);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             throw new Error(`${NORMATIVE_REF_PREFIX}: could not checkout ${ref.revision} in ${fingerprint(ref.repository)} (${message})`);
         }
     }
+    else if (!ref.revision) {
+        try {
+            await gitNoPrompt(["-C", dir, "fetch", "--depth", "1", "origin", "HEAD"], 120_000, 4_000_000);
+            await gitNoPrompt(["-C", dir, "checkout", "--detach", "FETCH_HEAD"], 60_000, 1_000_000);
+        }
+        catch {
+            // Keep the last successful cache when origin is unreachable (offline tests, private host already rejected).
+        }
+    }
     const revision = (await readPinnedRevision(dir)) ?? wantedRevision;
     await writeFile(marker, `${revision}\n`, "utf8");
     return { dir, revision };
@@ -170,10 +173,12 @@ export function assertNormativeRefsMaterialized(refs, materialized) {
         }
     }
 }
+function isConduitPath(path) {
+    const normalized = path.replaceAll("\\", "/");
+    return normalized === ".conduit" || normalized.startsWith(".conduit/");
+}
 async function markerPresent(workspace, marker, paths) {
-    const args = ["-C", workspace, "grep", "-l", "-F", marker];
-    if (paths?.length)
-        args.push("--", ...paths);
+    const args = ["-C", workspace, "grep", "-l", "-F", "--untracked", marker, "--", ...paths];
     try {
         const { stdout } = await execFileAsync("git", args, {
             timeout: 30_000,
@@ -192,14 +197,19 @@ export async function checkNormativeMarkers(workspace, refs, changedPaths) {
     const scoped = refs.filter((ref) => ref.markers?.length);
     if (!scoped.length)
         return { ok: true };
-    const searchPaths = changedPaths?.length ? changedPaths : null;
+    if (changedPaths === null) {
+        return { ok: false, failures: ["changed files are unknown; required markers cannot be verified"] };
+    }
+    const searchPaths = changedPaths.filter((path) => path && !isConduitPath(path));
+    if (!searchPaths.length) {
+        return { ok: false, failures: ["no changed files to search for required markers"] };
+    }
     const failures = [];
     for (const ref of scoped) {
         for (const marker of ref.markers ?? []) {
             const found = await markerPresent(workspace, marker, searchPaths);
             if (!found) {
-                const scope = searchPaths ? "changed files" : "workspace";
-                failures.push(`marker "${marker}" from ${ref.label} not found in ${scope}`);
+                failures.push(`marker "${marker}" from ${ref.label} not found in changed files`);
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.6",
+  "version": "0.16.7",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {