@miraland-labs/conduit-bridge 0.16.8 → 0.16.10

package/dist/execution-class.js

@@ -141,7 +141,7 @@ export function projectCursor(executionClass, input) {
         if (grants.includes("test_run")) {
             allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Shell(${command})`));
         }
-        if (executionClass === "mutate_repo") {
+        if (executionClass === "mutate_repo" && !input.diagnosis) {
             if (grants.includes("branch_create"))
                 allow.push(...branchCreateCommands.map((command) => `Shell(${command})`));
             if (grants.includes("pr_create"))
@@ -169,6 +169,19 @@ export function projectClaude(executionClass, input) {
     if (executionClass === "observe" || executionClass === "observe_network") {
         return { allowedTools: ["Read", "Glob", "Grep", ...fetchTools], disallowedTools, acceptEdits: false };
     }
+    // Diagnosis is read-only whatever class the assignment was stamped with — the same
+    // class-independent rule Cursor, Codex, and Grok already enforce on the flag itself.
+    if (input.diagnosis) {
+        return {
+            allowedTools: [
+                "Read", "Glob", "Grep",
+                ...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Bash(${command}:*)`),
+                ...fetchTools,
+            ],
+            disallowedTools,
+            acceptEdits: false,
+        };
+    }
     if (executionClass === "publish_artifact") {
         return {
             allowedTools: ["Read", "Glob", "Grep", "Edit", "Write", "Bash", ...fetchTools],
@@ -180,7 +193,6 @@ export function projectClaude(executionClass, input) {
         return {
             allowedTools: [
                 "Read",
-                ...(input.diagnosis ? ["Glob", "Grep"] : []),
                 ...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Bash(${command}:*)`),
                 ...fetchTools,
             ],

package/dist/normative-refs.js

@@ -4,7 +4,7 @@
  * Cached under {sourceWorkspace}/.conduit/normative-cache/ so sibling-repo specs are
  * fetched once per machine checkout, not once per attempt.
  */
-import { access, cp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, cp, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { constants } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { execFile } from "node:child_process";
@@ -15,7 +15,7 @@ const execFileAsync = promisify(execFile);
 export const normativeRefSchema = z.object({
     label: z.string().trim().min(1).max(120),
     repository: z.string().trim().min(3).max(500),
-    paths: z.array(z.string().trim().min(1).max(500)).min(1).max(20),
+    paths: z.array(z.string().trim().min(1).max(500)).max(20),
     revision: z.string().trim().min(1).max(120).optional(),
     markers: z.array(z.string().trim().min(1).max(500)).max(20).optional(),
 });
@@ -131,6 +131,32 @@ async function ensureRepoCache(sourceWorkspace, ref) {
     await writeFile(marker, `${revision}\n`, "utf8");
     return { dir, revision };
 }
+const CONTRACT_SURFACE = [
+    "README.md", "README", "README.rst", "README.txt",
+    "docs", "openapi.yaml", "openapi.yml", "openapi.json",
+    "CONTRACT.md", "NORMATIVE.md", "SPEC.md",
+];
+/** Bounded files/dirs Bridge copies when the pin names a repo but not paths. */
+export async function discoverNormativePaths(cacheRepo) {
+    const found = [];
+    for (const name of CONTRACT_SURFACE) {
+        if (await pathExists(join(cacheRepo, name)))
+            found.push(name);
+    }
+    if (found.length)
+        return found.slice(0, 20);
+    const entries = await readdir(cacheRepo, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        if (!entry.isFile() || entry.name.startsWith("."))
+            continue;
+        if (!/\.(md|markdown)$/i.test(entry.name))
+            continue;
+        found.push(entry.name);
+        if (found.length >= 20)
+            break;
+    }
+    return found;
+}
 async function copyNormativePath(cacheRepo, attemptWorkspace, label, path) {
     validateNormativePath(path);
     const src = join(cacheRepo, path);
@@ -148,8 +174,12 @@ export async function materializeNormativeRefs(input) {
     const materialized = [];
     for (const ref of input.refs) {
         const { dir, revision } = await ensureRepoCache(input.sourceWorkspace, ref);
+        const paths = ref.paths.length ? ref.paths : await discoverNormativePaths(dir);
+        if (!paths.length) {
+            throw new Error(`${NORMATIVE_REF_PREFIX}: no published-contract files found in ${fingerprint(ref.repository)}`);
+        }
         const workspace_paths = [];
-        for (const path of ref.paths) {
+        for (const path of paths) {
             workspace_paths.push(await copyNormativePath(dir, input.attemptWorkspace, ref.label, path));
         }
         materialized.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.8",
+  "version": "0.16.10",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {