@miraland-labs/conduit-bridge 0.4.0 → 0.4.1

package/README.md

@@ -46,7 +46,7 @@ Every driver enforces the assignment's granted actions with its CLI's native mec
 | --- | --- | --- |
 | `claude-code` | pump or local | `--allowedTools` / `--disallowedTools` per grant; bounded verification commands |
 | `codex` | pump or local | sandbox `read-only` / `workspace-write`; network enabled only with `pr_create`; resumes by thread id |
-| `opencode` | pump or local | `plan` agent (no edit/bash) for read-only, `build` for write; `--session` resume; `--format json` |
+| `opencode` | pump or local | `plan`/`build` agents; per-run `opencode.json` bash deny list (shared `deniedCommands`); `--session` resume; `--format json` |
 | `cursor` | local only | per-run `.cursor/cli.json` allowlist (`approvalMode: allowlist`, shared deny list, no `--force`); read-only runs in `--mode plan` |
 | `kiro` | local only | `--trust-tools=fs_read,fs_write,execute_bash` allowlist; `--no-interactive`; `--resume-id`. Tool-level only — no per-command scoping, so a bash grant trusts `execute_bash` wholesale (Antigravity-tier) |
 | `antigravity` | local only | `-p --mode plan` (read-only) / `--mode accept-edits --sandbox` (write). Mode-level, coarser than per-tool; plain-text output; resume not surfaced |

package/dist/client.js

@@ -52,13 +52,21 @@ export class ConduitClient {
         delete this.config.activeAttempts[taskId];
         await this.persist(this.config);
     }
-    /** Rotate and cache a project-scoped gateway fuel key for agent /v1 calls. */
+    /**
+     * Ensure a project-scoped gateway fuel key for agent /v1 calls.
+     * GET creates once (returns secret) or reports provisioned; cache miss after
+     * that uses POST …/rotate so heartbeats never rotate on every claim.
+     */
     async ensureFuel(projectId) {
         const cached = this.config.fuel?.[projectId]?.gatewayKey;
         if (cached)
             return cached;
-        const data = await this.request(`/runner/v1/fuel/${projectId}`);
-        const gatewayKey = String(data.gateway_secret);
+        const peeked = await this.request(`/runner/v1/fuel/${projectId}`);
+        let gatewayKey = typeof peeked.gateway_secret === "string" ? peeked.gateway_secret : "";
+        if (!gatewayKey) {
+            const rotated = await this.request(`/runner/v1/fuel/${projectId}/rotate`, { method: "POST", body: "{}" });
+            gatewayKey = String(rotated.gateway_secret);
+        }
         this.config.fuel = { ...this.config.fuel, [projectId]: { gatewayKey } };
         await this.persist(this.config);
         return gatewayKey;

package/dist/driver.js

@@ -73,7 +73,7 @@ export function buildAssignmentPrompt(context) {
     }
     if (rework)
         lines.push("", `REWORK FEEDBACK — an independent review returned this delivery; address every point\n${rework}`);
-    lines.push("", "RULES", "- Stay within the change scope and boundaries.", "- Run the relevant verification commands if your permissions allow it, and report their real results.", "- Never merge, deploy, push to protected branches, or touch production.", "- Do not invent evidence. Report unknown when you could not verify a criterion.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", '{"outcome": "one-paragraph summary", "changes": ["path — what changed"], "verification": ["command — result"], "acceptance_results": [{"criterion": "exact criterion text", "status": "met|not_met|unknown"}], "evidence": [{"kind": "change|test|preview|research|documentation", "name": "concise evidence name", "uri": "external URL if one exists", "digest": "optional digest", "details": ["observable result"], "acceptance_criteria": ["exact criterion text supported by this evidence"]}], "assumptions": [], "risks": [], "limitations": [], "head_commit": "full sha of your final commit, omit if none"}');
+    lines.push("", "RULES", "- Stay within the change scope and boundaries.", "- Run the relevant verification commands if your permissions allow it, and report their real results.", "- Never merge, deploy, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", '{"outcome": "one-paragraph summary", "changes": ["path — what changed"], "verification": ["command — result"], "acceptance_results": [{"criterion": "exact criterion text", "status": "met|not_met|unknown"}], "evidence": [{"kind": "change|test|preview|research|documentation", "name": "concise evidence name", "uri": "external URL if one exists", "digest": "optional digest", "details": ["observable result"], "acceptance_criteria": ["exact criterion text supported by this evidence"]}], "assumptions": [], "risks": [], "limitations": [], "head_commit": "full sha of your final commit, omit if none"}');
     return lines.join("\n");
 }
 /** Parse the agent's final fenced JSON block into a bounded report. */
@@ -383,6 +383,54 @@ export function openCodeRunArgs(input, agent) {
         args.push("--session", input.resumeSessionId);
     return args;
 }
+/** Shared deny list as OpenCode `permission.bash` rules (enforced even with `--auto`). */
+export function openCodePermissionConfig() {
+    const bash = {};
+    for (const command of deniedCommands)
+        bash[`${command} *`] = "deny";
+    return { permission: { bash } };
+}
+/** Write opencode.json permission deny rules for the run, restoring any prior file. */
+async function withOpenCodePermissions(workspace, run) {
+    const configPath = join(workspace, "opencode.json");
+    let previous = null;
+    try {
+        previous = await readFile(configPath, "utf8");
+    }
+    catch {
+        previous = null;
+    }
+    let config = {};
+    if (previous) {
+        try {
+            config = { ...JSON.parse(previous) };
+        }
+        catch {
+            config = {};
+        }
+    }
+    const deny = openCodePermissionConfig();
+    const existingPermission = (config.permission && typeof config.permission === "object" && !Array.isArray(config.permission))
+        ? { ...config.permission }
+        : {};
+    const existingBash = (existingPermission.bash && typeof existingPermission.bash === "object" && !Array.isArray(existingPermission.bash))
+        ? { ...existingPermission.bash }
+        : {};
+    config.permission = {
+        ...existingPermission,
+        bash: { ...existingBash, ...deny.permission.bash },
+    };
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    try {
+        return await run();
+    }
+    finally {
+        if (previous === null)
+            await rm(configPath, { force: true });
+        else
+            await writeFile(configPath, previous, "utf8");
+    }
+}
 /**
  * OpenCode `--format json` streams JSONL events. Verified against opencode 1.18:
  * assistant text arrives as `{type:"text", part:{type:"text", text:"…"}}`, the
@@ -434,7 +482,7 @@ export const openCodeDriver = {
         }
         const args = openCodeRunArgs(input, agent);
         args.push(input.prompt);
-        const { code, stdout, stderr } = await execute(input.executable ?? "opencode", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource);
+        const { code, stdout, stderr } = await withOpenCodePermissions(input.workspace, () => execute(input.executable ?? "opencode", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource));
         const parsed = parseOpenCodeOutput(stdout);
         if (code !== 0 || parsed.isError) {
             return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `opencode exited with code ${code}`).slice(0, 20_000) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Conduit Bridge CLI — join, connect, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {