@miraland-labs/conduit-bridge 0.16.70 → 0.16.100

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.16.27` — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
+**Package version:** `0.16.95` — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 

package/dist/attempt-watchdog.js

@@ -0,0 +1,88 @@
+/**
+ * T90: an attempt that stops answering must end, not hold its lease for ever.
+ *
+ * Field, 2026-09-07: a cursor attempt was claimed at 15:24 and was still `running` at 18:30 with
+ * the lease renewed on every heartbeat, while the runner had no child process and the journal had
+ * printed nothing since the model line. One awaited step never returned, and the Bridge had no
+ * clock of its own above the agent turn: the attempt could only end when that step answered.
+ *
+ * The watchdog is that clock. It carries the phase the attempt is in, prints each transition to
+ * the journal, and rejects `stalled` when the phase has not moved for its own budget. The phase
+ * name travels with the failure, so the next reader knows which step never returned.
+ */
+/** How long a phase may stay silent after the step that can answer has finished. */
+export const ATTEMPT_STALL_GRACE_MS = 15 * 60_000;
+/**
+ * Phases that may run an agent turn or the project's own gates, so their budget is the turn budget
+ * plus the grace. Every other phase is bookkeeping the machine does alone: the grace is enough, and
+ * a shorter clock reports a stall sooner.
+ */
+const AGENT_TURN_PHASES = new Set([
+    "claim",
+    "agent",
+    "verification",
+    "report_repair",
+    "land",
+]);
+/** The end of an attempt that stopped answering, naming the step that never returned. */
+export class AttemptStalledError extends Error {
+    phase;
+    waitedMs;
+    constructor(phase, waitedMs) {
+        super(`bridge_attempt_stalled: phase=${phase}; the step gave no answer for ${Math.round(waitedMs / 60_000)} minutes`);
+        this.phase = phase;
+        this.waitedMs = waitedMs;
+        this.name = "AttemptStalledError";
+    }
+}
+/** Bound one awaited step. The rejection names the phase, as a stall report does. */
+export function withTimeout(promise, ms, phase) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new AttemptStalledError(phase, ms)), ms);
+        timer.unref?.();
+        promise.then((value) => { clearTimeout(timer); resolve(value); }, (error) => { clearTimeout(timer); reject(error); });
+    });
+}
+export function createAttemptWatchdog(input) {
+    let fail = () => undefined;
+    const stalled = new Promise((_resolve, reject) => { fail = reject; });
+    // The attempt usually wins the race and nobody ever reads this rejection.
+    stalled.catch(() => undefined);
+    const journal = input.journal ?? ((line) => console.log(line));
+    let turnBudgetMs = input.turnBudgetMs;
+    let current = "claim";
+    let timer = null;
+    let stopped = false;
+    const arm = (ms) => {
+        if (timer)
+            clearTimeout(timer);
+        if (stopped)
+            return;
+        timer = setTimeout(() => fail(new AttemptStalledError(current, ms)), ms);
+        timer.unref?.();
+    };
+    const budgetFor = (name) => AGENT_TURN_PHASES.has(name) ? turnBudgetMs + ATTEMPT_STALL_GRACE_MS : ATTEMPT_STALL_GRACE_MS;
+    arm(budgetFor(current));
+    return {
+        stalled,
+        phase(name) {
+            if (stopped)
+                return;
+            current = name;
+            journal(`Assignment ${input.taskId} phase: ${name}`);
+            arm(budgetFor(name));
+        },
+        budget(next) {
+            if (stopped || !(next > 0))
+                return;
+            turnBudgetMs = next;
+            arm(budgetFor(current));
+        },
+        stop() {
+            stopped = true;
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+        },
+    };
+}

package/dist/brief.js

@@ -59,7 +59,8 @@ export async function isBaseCommitAncestor(workspace, baseCommit, headCommit) {
         throw error;
     }
 }
-async function fetchOrigin(workspace) {
+/** Refresh every origin ref; deepens a shallow clone enough to see a commit a tip fetch missed. */
+export async function fetchOrigin(workspace) {
     await execFileAsync("git", ["-C", workspace, "fetch", "--no-tags", "origin"], {
         timeout: 120_000,
         windowsHide: true,

package/dist/cli.js

@@ -7,7 +7,7 @@ import { createInterface } from "node:readline/promises";
 import { chmodSync, cpSync, existsSync, mkdirSync, readdirSync } from "node:fs";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
-import { ConduitClient, ConduitRequestError } from "./client.js";
+import { assignmentPollBehindServer, ConduitClient, ConduitRequestError } from "./client.js";
 import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearLocalConnection, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, saveConfigPrefs, saveDriverQuota, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
@@ -46,6 +46,16 @@ function parseBootstrapResult(value) {
         throw new Error(`Bootstrap result must be one of: ${BOOTSTRAP_RESULTS.join(", ")}`);
     return result;
 }
+/** Managed authority comes from this Bridge installation's ops.env, never from the control plane. */
+function configuredManagedRoot() {
+    try {
+        const configured = loadOpsEnv().CONDUIT_MANAGED_ROOT.trim();
+        return configured ? resolve(configured) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function connect() {
     const { values } = parseArgs({ args: process.argv.slice(3), options: { url: { type: "string" }, code: { type: "string" }, fuel: { type: "string" } } });
     if (!values.url || !values.code)
@@ -278,7 +288,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
     const client = new ConduitClient(config);
     let heartbeatOk = true;
     try {
-        await heartbeat(client, config, null, null, unavailableWorkspacePreflight({ config }));
+        await heartbeat(client, config, null, null, unavailableWorkspacePreflight({ config, managedRoot: configuredManagedRoot() }));
     }
     catch {
         heartbeatOk = false;
@@ -408,7 +418,7 @@ async function initOps() {
 async function opsCommand() {
     const verb = process.argv[3];
     if (!verb || !OPS_VERBS.includes(verb)) {
-        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|switch|online|offline|quota-clear|status|doctor|disconnect|uninstall>", "[driver…]")} (install also takes --workspace <path> [--repo <url>])`);
+        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|switch|online|offline|quota-clear|status|workspace|doctor|disconnect|uninstall>", "[driver…]")} (install also takes --workspace <path> [--repo <url>])`);
     }
     await runOps(verb, process.argv.slice(4));
 }
@@ -543,6 +553,7 @@ async function runner() {
         throw new Error("--ensure-checkout requires --workspace <repository-path>");
     }
     const workspace = values.workspace ? resolve(values.workspace) : null;
+    const managedRoot = configuredManagedRoot();
     if (workspace && values["ensure-checkout"]) {
         const result = await ensureCheckout(workspace, values["ensure-checkout"]);
         console.log(result === "cloned"
@@ -585,8 +596,8 @@ async function runner() {
             const refresh = workspace ? await reportedRefresh(workspace) : null;
             const currentBrief = workspace ? await buildWorkspaceBrief(workspace).catch(() => brief) : null;
             const preflight = workspace
-                ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined, refresh })
-                : unavailableWorkspacePreflight({ config });
+                ? await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh })
+                : unavailableWorkspacePreflight({ config, managedRoot });
             const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
             if (hb.staleBridge) {
                 console.error(`Bridge update required: running protocol ${BRIDGE_PROTOCOL_VERSION}; control plane requires protocol ${hb.requiredProtocol ?? "unknown"} (minimum Bridge ${hb.minimumVersion ?? "unknown"}). Reinstall the latest Bridge, then restart this runner.`);
@@ -630,14 +641,16 @@ async function runner() {
             if (workspace && onlineDriverIds(config).length) {
                 // Observation runs before authoring: an owner waiting on an answer should not queue behind
                 // a long delivery, and the control plane already counted this slot as busy.
-                progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs) || progressed;
+                progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs, {
+                    managedRoot: hb.on_shift?.managed_workspace_root ?? null,
+                }) || progressed;
             }
             if (workspace && onlineDriverIds(config).length) {
                 // Read the workspace again, then publish it. The last brief stands if the read fails.
                 const publishWorkspaceState = async (options = {}) => {
                     const refresh = await reportedRefresh(workspace, options);
                     const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                    const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined, refresh }, options);
+                    const preflight = await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh }, options);
                     const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                     return { preflight, hb };
                 };
@@ -656,7 +669,9 @@ async function runner() {
                         return preflight.ready && lane?.ready === true && typeof lane.version === "string" && lane.version.length > 0;
                     },
                     heartbeatIntervalMs: intervalMs,
-                }, running, {});
+                    // T86: a computer on shift for several projects moves to the assignment's repository
+                    // under this root when it claims.
+                }, running, { managedRoot: hb.on_shift?.managed_workspace_root ?? null });
             }
         }
         catch (error) {
@@ -710,6 +725,16 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
         bridgeProtocol: BRIDGE_PROTOCOL_VERSION,
         bootstrapResult,
     });
+    // T98: an assignments poll that has failed schema validation flags this runner as behind the
+    // server, so the control plane can tell the operator to restart it instead of leaving the runner
+    // to fail every poll silently. Merged in here rather than into runBridgePreflight itself: the
+    // preflight probe is cached for minutes at a time, and this fact must reach the very next
+    // heartbeat.
+    const preflightToSend = {
+        ...preflight,
+        ...(assignmentPollBehindServer() ? { runner_behind_server: true } : {}),
+        ...(process.env.CONDUIT_RUNNER_SERVICE === "container" ? { runner_service: "container" } : {}),
+    };
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,
             capabilities: config.capabilities,
@@ -719,7 +744,7 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
             bridge_version: version,
             bridge_protocol: BRIDGE_PROTOCOL_VERSION,
             drivers: driversHeartbeatReport(config, config.activeAttempts),
-            preflight,
+            preflight: preflightToSend,
             execution_facts: executionFacts,
             ...(intentProof ? { on_shift_intent_proof: intentProof } : {}),
             ...(brief ? { workspace_brief: brief } : {}),

package/dist/client.js

@@ -12,6 +12,34 @@ export class ConduitRequestError extends Error {
         this.details = details;
     }
 }
+// T98: a server wire-shape change (e.g. T96's released_worktree_attempt_ids) can move ahead of an
+// older runner's schema. The old failure mode printed the full zod issue dump on every poll — one
+// stranded runner logged the same 25-issue dump every cycle and never said what to do about it.
+// This runner logs one short line per minute instead, and flags itself on the next heartbeat so the
+// control plane can tell the operator to restart it.
+let assignmentPollShapeUnderstood = true;
+let lastAssignmentPollShapeWarningAt = 0;
+const ASSIGNMENT_POLL_SHAPE_WARNING_INTERVAL_MS = 60_000;
+/** Call when the /runner/v1/assignments response fails schema validation. */
+export function reportAssignmentPollShapeMismatch(bridgeVersion) {
+    assignmentPollShapeUnderstood = false;
+    const now = Date.now();
+    if (now - lastAssignmentPollShapeWarningAt < ASSIGNMENT_POLL_SHAPE_WARNING_INTERVAL_MS)
+        return;
+    lastAssignmentPollShapeWarningAt = now;
+    console.error(`assignment poll: response shape not understood — this runner (v${bridgeVersion}) is behind the server; restart it`);
+}
+/** True once an assignments poll has failed schema validation. Read by the next heartbeat. */
+export function assignmentPollBehindServer() {
+    return !assignmentPollShapeUnderstood;
+}
+/** Test-only: put the module back to its just-started state between cases. */
+export function resetAssignmentPollShapeState() {
+    assignmentPollShapeUnderstood = true;
+    lastAssignmentPollShapeWarningAt = 0;
+}
+/** The longest one control-plane call may take before the caller gets an error instead of a wait. */
+const CONTROL_PLANE_TIMEOUT_MS = 120_000;
 export class ConduitClient {
     config;
     persistRuntime;
@@ -36,6 +64,9 @@ export class ConduitClient {
     async request(path, init = {}) {
         const response = await fetch(`${this.config.baseUrl}${path}`, {
             ...init,
+            // T90: every control-plane call of an attempt is bounded. A request that never answers used
+            // to be an awaited step with no clock above it, and the attempt could not end.
+            signal: init.signal ?? AbortSignal.timeout(CONTROL_PLANE_TIMEOUT_MS),
             headers: { authorization: `Bearer ${this.config.runnerKey}`, "content-type": "application/json", ...init.headers },
         });
         const data = await response.json();
@@ -57,6 +88,7 @@ export class ConduitClient {
                 ...(extras?.driverId ? { driver_id: extras.driverId } : {}),
                 ...(extras?.fuelMode ? { fuel_mode: extras.fuelMode } : {}),
                 ...(extras?.fuelProvenance ? { fuel_provenance: extras.fuelProvenance } : {}),
+                ...(extras?.startCommit ? { start_commit: extras.startCommit } : {}),
             }),
         });
         const active = {
@@ -69,6 +101,7 @@ export class ConduitClient {
             ...(extras?.fuelMode ? { fuelMode: extras.fuelMode } : {}),
             ...(extras?.executionKind ? { executionKind: extras.executionKind } : {}),
             ...(extras?.sourceAttemptId ? { sourceAttemptId: extras.sourceAttemptId } : {}),
+            ...(extras?.sourceWorkspace ? { sourceWorkspace: extras.sourceWorkspace } : {}),
         };
         this.config.activeAttempts[taskId] = active;
         await this.persistRuntime(this.config);

package/dist/config.js

@@ -146,7 +146,10 @@ function plainQuota(raw) {
         return undefined;
     if (raw.resets_at !== null && typeof raw.resets_at !== "string")
         return undefined;
-    return { exhausted: raw.exhausted, resets_at: raw.resets_at, observed_at: raw.observed_at };
+    // The vendor is half the record's key, so it must survive the write. Losing it here would make
+    // every stored refusal lane-wide again on the next load.
+    const vendor = typeof raw.vendor === "string" && raw.vendor.trim() ? raw.vendor : undefined;
+    return { exhausted: raw.exhausted, resets_at: raw.resets_at, observed_at: raw.observed_at, ...(vendor ? { vendor } : {}) };
 }
 async function loadRuntime() {
     try {