@miraland-labs/conduit-bridge 0.6.1 → 0.7.0

package/dist/attempt-worktree.js

@@ -2,8 +2,9 @@
  * F-07 slice 1: one Git worktree per attempt. The install-service source checkout is never the
  * agent cwd; retries must not inherit dirty files from a failed run.
  */
-import { appendFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { access, appendFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { join, resolve } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
@@ -54,6 +55,28 @@ export async function removeAttemptWorktree(sourceWorkspace, worktreePath) {
         }).catch(() => undefined);
     }
 }
+/**
+ * F-07 safe resume: prove the interrupted attempt still owns this worktree path.
+ * Does not check session identity — caller requires config.sessions[taskId] separately.
+ */
+export async function proveResumeWorktree(sourceWorkspace, attemptId, worktreePath) {
+    if (!worktreePath?.trim())
+        return false;
+    const expected = attemptWorktreePath(sourceWorkspace, attemptId);
+    if (resolve(worktreePath) !== resolve(expected))
+        return false;
+    try {
+        await access(worktreePath, constants.F_OK);
+        const { stdout } = await execFileAsync("git", ["-C", worktreePath, "rev-parse", "HEAD"], {
+            timeout: 15_000,
+            maxBuffer: 1_000_000,
+        });
+        return /^[0-9a-f]{40,64}$/i.test(stdout.trim());
+    }
+    catch {
+        return false;
+    }
+}
 /** Hold a crashed attempt tree for local diagnosis; never reused as agent cwd. */
 export async function quarantineAttemptWorktree(sourceWorkspace, worktreePath, attemptId) {
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");

package/dist/cli.js

@@ -6,13 +6,13 @@ import { spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { ConduitClient } from "./client.js";
-import { BRIDGE_LEASE_CAPACITY, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, savePendingConnection, suggestMachineName, } from "./config.js";
+import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
 import { DRIVERS } from "./driver.js";
 import { buildWorkspaceBrief } from "./brief.js";
 import { ensureCheckout } from "./checkout.js";
-import { executeNextAssignment, renewLeases } from "./execution.js";
+import { pumpExecutionSlots, renewLeases } from "./execution.js";
 import { installRunnerService, uninstallRunnerService } from "./service.js";
 const [command] = process.argv.slice(2);
 /** Read our own package version so every runner start logs exactly which build is live. */
@@ -91,10 +91,11 @@ async function join() {
         const operatorName = values.operator?.trim() || userInfo().username;
         const machineName = values.machine?.trim() || suggestMachineName(hostname(), installationId);
         const capabilities = values.capability?.map((item) => item.trim()).filter(Boolean) ?? ["implement"];
-        if (values.capacity && Number(values.capacity) !== BRIDGE_LEASE_CAPACITY) {
-            throw new Error("Conduit Bridge currently runs one assignment at a time; --capacity must be 1");
+        const requestedCapacity = values.capacity ? Number(values.capacity) : BRIDGE_LEASE_CAPACITY;
+        if (!Number.isInteger(requestedCapacity) || requestedCapacity < 1 || requestedCapacity > BRIDGE_MAX_LEASE_CAPACITY) {
+            throw new Error(`--capacity must be an integer from 1 to ${BRIDGE_MAX_LEASE_CAPACITY} (concurrent attempt slots)`);
         }
-        const leaseCapacity = BRIDGE_LEASE_CAPACITY;
+        const leaseCapacity = clampLeaseCapacity(requestedCapacity);
         console.log("\nRequesting a Conduit connection:");
         console.log(`Operator: ${operatorName}`);
         console.log(`Computer: ${machineName}`);
@@ -193,7 +194,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
         runnerKey: String(data.runner_secret),
         capabilities: data.capabilities,
         grants: data.grants,
-        leaseCapacity: Number(data.lease_capacity),
+        leaseCapacity: clampLeaseCapacity(data.lease_capacity),
         activeAttempts: {},
         fuelSource: resolvedFuel,
         ...(Object.keys(fuel).length ? { fuel } : {}),
@@ -326,24 +327,28 @@ async function runner() {
     if (!driver || !workspace) {
         console.warn(`WARNING: heartbeat only — no work will execute. Use: ${bridgeUsage("runner", "--agent", AGENT_PLACEHOLDER, "--workspace", "<repo>")}`);
     }
-    console.log(`Conduit runner (bridge v${bridgeVersion()}) connected to ${config.baseUrl}${driver ? ` — executing via ${driver.name} in ${workspace}` : " — heartbeat only (no --agent)"} (fuel: ${fuelLabel})`);
+    console.log(`Conduit runner (bridge v${bridgeVersion()}) connected to ${config.baseUrl}${driver ? ` — executing via ${driver.name} in ${workspace}` : " — heartbeat only (no --agent)"} (fuel: ${fuelLabel}; slots: ${config.leaseCapacity})`);
+    const running = new Map();
     for (;;) {
-        let executed = false;
+        let progressed = false;
         try {
             await heartbeat(client, config, workspace ? await buildWorkspaceBrief(workspace).catch(() => brief) : null);
             await renewLeases(client, config);
             if (driver && workspace) {
-                executed = await executeNextAssignment(client, config, driver, workspace, brief, timeoutMs, {
+                progressed = await pumpExecutionSlots(client, config, driver, workspace, brief, timeoutMs, {
                     heartbeat: async () => heartbeat(client, config, await buildWorkspaceBrief(workspace).catch(() => brief)),
                     heartbeatIntervalMs: intervalMs,
-                });
+                }, running);
             }
         }
         catch (error) {
             console.error(`Runner cycle failed; retrying: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}`);
         }
-        if (values.once && executed)
+        if (values.once && progressed) {
+            if (running.size)
+                await Promise.allSettled([...running.values()]);
             return;
+        }
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }

package/dist/config.js

@@ -2,7 +2,16 @@ import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+/** Default when join omits --capacity. */
 export const BRIDGE_LEASE_CAPACITY = 1;
+/** Hard ceiling for truthful concurrent Bridge slots (one agent + worktree each). */
+export const BRIDGE_MAX_LEASE_CAPACITY = 4;
+export function clampLeaseCapacity(value) {
+    const n = typeof value === "number" ? value : Number(value);
+    if (!Number.isInteger(n) || n < 1)
+        return BRIDGE_LEASE_CAPACITY;
+    return Math.min(n, BRIDGE_MAX_LEASE_CAPACITY);
+}
 const directory = process.env.CONDUIT_BRIDGE_CONFIG_DIR?.trim()
     ? resolve(process.env.CONDUIT_BRIDGE_CONFIG_DIR)
     : join(homedir(), ".config", "conduit");
@@ -39,9 +48,8 @@ export async function loadConfigIfPresent() {
         active.phase ??= "agent_running";
     if (config.fuelSource !== "local" && config.fuelSource !== "conduit")
         config.fuelSource = "conduit";
-    // The built-in Bridge runs one agent process synchronously. Keep legacy
-    // configurations truthful until isolated concurrent slot workers exist.
-    config.leaseCapacity = BRIDGE_LEASE_CAPACITY;
+    // Clamp to what concurrent slot workers can run (1..BRIDGE_MAX_LEASE_CAPACITY).
+    config.leaseCapacity = clampLeaseCapacity(config.leaseCapacity ?? BRIDGE_LEASE_CAPACITY);
     return config;
 }
 export async function saveConfig(config) {

package/dist/execution.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets } from "./config.js";
 import { agentReportTemplate, buildAssignmentPrompt, evidenceKinds, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
-import { attemptWorktreePath, createAttemptWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
+import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, isBaseCommitAncestor, normalizeRepositoryUrl } from "./brief.js";
 const assignmentSchema = z.object({
     id: z.string().uuid(),
@@ -66,13 +66,22 @@ export async function renewLeases(client, config) {
         }
     }
 }
-export async function recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision) {
-    const active = Object.values(config.activeAttempts)[0];
+export async function recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision, taskId) {
+    const active = taskId ? config.activeAttempts[taskId] : Object.values(config.activeAttempts)[0];
     if (!active)
         return false;
     if (active.phase === "agent_running") {
-        // F-07: never resume a dirty shared checkout. Quarantine/remove the attempt worktree first.
         const worktree = active.worktreePath ?? attemptWorktreePath(workspace, active.attemptId);
+        const sessionId = config.sessions?.[active.taskId]?.trim() || "";
+        // F-07 safe resume: only when session + worktree identity are both proven. Otherwise interrupt.
+        if (sessionId && await proveResumeWorktree(workspace, active.attemptId, worktree)) {
+            console.log(`Resuming interrupted attempt ${active.attemptId} with proven worktree and session.`);
+            await runClaimedAssignment(client, config, driver, workspace, brief, active.taskId, timeoutMs, supervision, {
+                existingWorktree: worktree,
+                forceResumeSessionId: sessionId,
+            });
+            return true;
+        }
         await quarantineAttemptWorktree(workspace, worktree, active.attemptId).catch(() => removeAttemptWorktree(workspace, worktree).catch(() => undefined));
         await client.updateAttempt(active.taskId, { worktreePath: undefined });
         await queueTerminal(client, active.taskId, {
@@ -92,17 +101,51 @@ export async function recoverActiveAttempt(client, config, driver, workspace, br
     await runClaimedAssignment(client, config, driver, workspace, brief, active.taskId, timeoutMs, supervision);
     return true;
 }
-export async function executeNextAssignment(client, config, driver, workspace, brief, timeoutMs, supervision) {
-    if (Object.keys(config.activeAttempts).length)
-        return recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision);
+/**
+ * F-07 multi-slot: keep up to leaseCapacity concurrent agent runs (each with its own worktree).
+ * `running` is owned by the runner loop and must outlive a single pump call.
+ */
+export async function pumpExecutionSlots(client, config, driver, workspace, brief, timeoutMs, supervision, running) {
+    let progressed = running.size > 0;
+    for (const id of Object.keys(config.activeAttempts)) {
+        if (running.has(id))
+            continue;
+        progressed = true;
+        const slot = recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision, id)
+            .catch((error) => {
+            console.error(`Slot recovery failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
+        })
+            .then(() => undefined)
+            .finally(() => { running.delete(id); });
+        running.set(id, slot);
+    }
+    while (running.size < config.leaseCapacity) {
+        const taskId = await claimNextAssignment(client, config, workspace, brief);
+        if (!taskId)
+            break;
+        progressed = true;
+        const slot = runClaimedAssignment(client, config, driver, workspace, brief, taskId, timeoutMs, supervision)
+            .catch((error) => {
+            console.error(`Slot execution failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
+        })
+            .then(() => undefined)
+            .finally(() => { running.delete(taskId); });
+        running.set(taskId, slot);
+    }
+    return progressed;
+}
+/** Claim one assignment when under capacity; does not start the agent (multi-slot pump does). */
+export async function claimNextAssignment(client, config, workspace, brief) {
+    if (Object.keys(config.activeAttempts).length >= config.leaseCapacity)
+        return null;
     const data = await client.request("/runner/v1/assignments");
     const assignments = z.array(assignmentSchema).parse(data.assignments ?? []);
     const assignment = assignments[0];
     if (!assignment)
-        return false;
+        return null;
     if (assignment.execution_mode === "human") {
         console.log(`Human takeover assignment ${assignment.id} — use Bridge MCP tools to claim and submit (agent runner skips).`);
-        return false;
+        return null;
     }
     const liveBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
     const liveRepository = liveBrief?.repository ? normalizeRepositoryUrl(liveBrief.repository) : null;
@@ -122,14 +165,22 @@ export async function executeNextAssignment(client, config, driver, workspace, b
             body: JSON.stringify({ attempt_id: assignment.attempt_id, reason: rejection, idempotency_key: `bridge:preflight-reject:${assignment.attempt_id}:${rejection}` }),
         });
         console.error(`Assignment ${assignment.id} rejected before claim: ${rejection}`);
-        return true;
+        return null;
     }
     console.log(`Claiming assignment ${assignment.id} (attempt ${assignment.attempt_id})`);
     await client.claim(assignment.id, assignment.attempt_id);
-    await runClaimedAssignment(client, config, driver, workspace, brief, assignment.id, timeoutMs, supervision);
+    return assignment.id;
+}
+export async function executeNextAssignment(client, config, driver, workspace, brief, timeoutMs, supervision) {
+    if (Object.keys(config.activeAttempts).length)
+        return recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision);
+    const taskId = await claimNextAssignment(client, config, workspace, brief);
+    if (!taskId)
+        return false;
+    await runClaimedAssignment(client, config, driver, workspace, brief, taskId, timeoutMs, supervision);
     return true;
 }
-async function runClaimedAssignment(client, config, driver, workspace, brief, taskId, timeoutMs, supervision) {
+async function runClaimedAssignment(client, config, driver, workspace, brief, taskId, timeoutMs, supervision, options = {}) {
     const active = client.attempt(taskId);
     const detail = await client.request(`/runner/v1/tasks/${taskId}`);
     const task = taskDetailSchema.parse(detail.task);
@@ -157,27 +208,39 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         return;
     }
     let attemptWorkspace;
-    try {
-        attemptWorkspace = await createAttemptWorktree({
-            sourceWorkspace: workspace,
-            attemptId: active.attemptId,
-            startCommit,
-        });
+    if (options.existingWorktree) {
+        attemptWorkspace = options.existingWorktree;
     }
-    catch (error) {
-        const code = error instanceof Error ? error.message : "worktree_create_failed";
-        const message = code === "source_workspace_dirty"
-            ? "Source workspace has uncommitted changes; refuse to start an isolated attempt"
-            : `Unable to create attempt worktree: ${code}`;
-        await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: true, idempotency_key: `bridge:worktree:${active.attemptId}:${code}` } });
-        console.error(`Assignment ${taskId} worktree create failed: ${redactSecrets(message)}`);
-        return;
+    else {
+        try {
+            attemptWorkspace = await createAttemptWorktree({
+                sourceWorkspace: workspace,
+                attemptId: active.attemptId,
+                startCommit,
+            });
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.message : "worktree_create_failed";
+            const message = code === "source_workspace_dirty"
+                ? "Source workspace has uncommitted changes; refuse to start an isolated attempt"
+                : `Unable to create attempt worktree: ${code}`;
+            await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: true, idempotency_key: `bridge:worktree:${active.attemptId}:${code}` } });
+            console.error(`Assignment ${taskId} worktree create failed: ${redactSecrets(message)}`);
+            return;
+        }
+        await client.updateAttempt(taskId, { worktreePath: attemptWorkspace });
     }
-    await client.updateAttempt(taskId, { worktreePath: attemptWorkspace });
     // Same list the driver hands to the permission contract, so the prompt states exactly what is
     // executable rather than leaving the agent to guess and hit rejections.
     const prompt = buildAssignmentPrompt({ taskId, objective: task.objective, spec, grants, workspace: attemptWorkspace, currentHead: startCommit, reworkFeedback, workPackage, verificationCommands: liveBrief?.verification ?? [] });
-    await client.attemptRequest(taskId, "progress", { phase: "changing", message: `Starting ${driver.name} for this assignment${reworkFeedback ? " with review feedback" : ""}.`, idempotency_key: `bridge:progress:${active.attemptId}:start` });
+    const resuming = Boolean(options.forceResumeSessionId);
+    await client.attemptRequest(taskId, "progress", {
+        phase: "changing",
+        message: resuming
+            ? `Resuming ${driver.name} after Bridge restart with proven session and worktree.`
+            : `Starting ${driver.name} for this assignment${reworkFeedback ? " with review feedback" : ""}.`,
+        idempotency_key: resuming ? `bridge:progress:${active.attemptId}:resume` : `bridge:progress:${active.attemptId}:start`,
+    });
     const fuelSource = config.fuelSource === "local" ? "local" : "conduit";
     let fuel;
     if (fuelSource === "conduit") {
@@ -193,10 +256,12 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
     // that was chosen. updateAttempt alone only moves local runner state, which the database never sees.
     await client.attemptRequest(taskId, "progress", {
         phase: "agent_running",
-        message: `Started ${driver.name}${selection.model ? ` on ${selection.model}` : " on its CLI default"}.`,
-        idempotency_key: `bridge:progress:${active.attemptId}:agent-start`,
+        message: resuming
+            ? `Resumed ${driver.name}${selection.model ? ` on ${selection.model}` : " on its CLI default"}.`
+            : `Started ${driver.name}${selection.model ? ` on ${selection.model}` : " on its CLI default"}.`,
+        idempotency_key: resuming ? `bridge:progress:${active.attemptId}:agent-resume` : `bridge:progress:${active.attemptId}:agent-start`,
     });
-    await client.updateAttempt(taskId, { phase: "agent_running", fuelMode: fuelSource });
+    await client.updateAttempt(taskId, { phase: "agent_running", fuelMode: fuelSource, worktreePath: attemptWorkspace });
     const renewTimer = setInterval(() => { void renewLeases(client, config).catch((error) => console.error(`Lease renewal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`)); }, 60_000);
     let heartbeatRunning = false;
     const heartbeatTimer = supervision ? setInterval(() => {
@@ -208,15 +273,17 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             .finally(() => { heartbeatRunning = false; });
     }, supervision.heartbeatIntervalMs) : null;
     try {
+        // Resume for (1) Bridge restart with proven session+worktree, or (2) review rework.
+        // A fresh attempt after a failed delivery must start clean: resuming a session whose last
+        // turn already "finished" makes the agent reply conversationally without the report block.
+        const resumeSessionId = options.forceResumeSessionId
+            ?? (reworkFeedback ? config.sessions?.[taskId] : undefined);
         const result = await driver.run({
             prompt,
             workspace: attemptWorkspace,
             grants,
             verificationCommands: liveBrief?.verification ?? [],
-            // Resume only for review rework, where continuing the prior conversation is the point.
-            // A fresh attempt after a failed delivery must start clean: resuming a session whose last
-            // turn already "finished" makes the agent reply conversationally without the report block.
-            resumeSessionId: reworkFeedback ? config.sessions?.[taskId] : undefined,
+            resumeSessionId,
             timeoutMs,
             model: selection.model,
             fuel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Conduit Bridge CLI — join, connect, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {