@miraland-labs/conduit-bridge 0.9.0 → 0.9.1

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Current npm:** `0.8.0` — **multi-driver lanes** on one Connect computer (`drivers online|offline`), shared concurrent slots **1–4** (sum across online IDEs, not per IDE), per-attempt worktrees, optional `--ensure-checkout`, safe resume.
+**Current npm:** `0.9.1` — **disconnect/disengage**, join org prompt when `--organization` is omitted, multi-driver lanes (`drivers online|offline`), shared concurrent slots **1–4**, worktrees, optional `--ensure-checkout`.
 
 ## Prerequisites
 
@@ -20,6 +20,14 @@ Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connect
 
 ```bash
 npx @miraland-labs/conduit-bridge join --url <https://your-conduit> --organization <slug>
+# If --organization is omitted, the CLI asks: Join which org?
+```
+
+Disengage (leave the organization; then you can join the same or another org):
+
+```bash
+npx @miraland-labs/conduit-bridge disconnect
+# Or non-interactive: disconnect --yes
 ```
 
 After approval, seed detects installed CLIs as **offline lanes**. Bring one or more online (subscription failover / concurrent lanes):

package/dist/cli.js

@@ -3,10 +3,12 @@ import { parseArgs } from "node:util";
 import { resolve, dirname, join as pathJoin } from "node:path";
 import { hostname, userInfo } from "node:os";
 import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
 import { readFileSync } from "node:fs";
+import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
-import { ConduitClient } from "./client.js";
-import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, saveConfigPrefs, savePendingConnection, suggestMachineName, } from "./config.js";
+import { ConduitClient, ConduitRequestError } from "./client.js";
+import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearLocalConnection, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, saveConfigPrefs, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
 import { DRIVERS } from "./driver.js";
@@ -54,6 +56,27 @@ async function connect() {
         throw new Error(data.error?.message ?? `Connect failed (${response.status})`);
     await finishConnection(baseUrl, data, parseFuelSource(values.fuel));
 }
+async function promptLine(question) {
+    if (!input.isTTY || !output.isTTY) {
+        throw new Error("Interactive input is unavailable; pass the value on the command line");
+    }
+    const rl = createInterface({ input, output });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+async function resolveJoinOrganization(explicit) {
+    const raw = explicit?.trim() || await promptLine("Join which org? ");
+    const organization = raw.toLowerCase();
+    if (!organization)
+        throw new Error("Organization slug is required");
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(organization))
+        throw new Error("Organization must be its lowercase workspace slug");
+    return organization;
+}
 async function join() {
     const { values } = parseArgs({ args: process.argv.slice(3), options: {
             url: { type: "string" }, resume: { type: "boolean" }, machine: { type: "string" }, operator: { type: "string" },
@@ -75,13 +98,11 @@ async function join() {
     if (pending && !values.resume)
         console.log(`Resuming the pending connection request for ${pending.baseUrl}.`);
     if (!pending) {
-        if (!values.url || !values.organization) {
-            throw new Error(`Usage: ${bridgeUsage("join", "--url", "<worker-url>", "--organization", "<slug>", "[--machine <name>]", "[--capability <role>]", "[--fuel conduit|local]")}`);
+        if (!values.url) {
+            throw new Error(`Usage: ${bridgeUsage("join", "--url", "<worker-url>", "[--organization <slug>]", "[--machine <name>]", "[--capability <role>]", "[--fuel conduit|local]")}`);
         }
         const baseUrl = normalizeBaseUrl(values.url);
-        const organization = values.organization.trim().toLowerCase();
-        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(organization))
-            throw new Error("Organization must be its lowercase workspace slug");
+        const organization = await resolveJoinOrganization(values.organization);
         // A config that fails validation (for example pre-organization) must not
         // block rejoining — join replaces it with a complete identity.
         const connected = await loadConfigIfPresent().catch(() => null);
@@ -448,11 +469,45 @@ async function heartbeat(client, config, brief, processOnlineIds) {
             ...(brief ? { workspace_brief: brief } : {}),
         }) });
 }
+async function disconnect() {
+    const { values } = parseArgs({ args: process.argv.slice(3), options: { yes: { type: "boolean", short: "y" } } });
+    const config = await loadConfigIfPresent().catch(() => null);
+    if (!config) {
+        await clearLocalConnection();
+        console.log("This Bridge is not connected to an organization.");
+        return;
+    }
+    if (!values.yes) {
+        const answer = (await promptLine(`Disengage this computer from the organization and clear local credentials? [y/N] `)).toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            console.log("Cancelled.");
+            return;
+        }
+    }
+    try {
+        await new ConduitClient(config).request("/runner/v1/disengage", { method: "POST", body: "{}" });
+        console.log("Conduit disengaged this computer from the organization.");
+    }
+    catch (error) {
+        // Local clear still proceeds when the server already revoked the key (admin disengage).
+        if (error instanceof ConduitRequestError && (error.status === 401 || error.status === 404)) {
+            console.warn(`Server disengage skipped (${error.status}): ${redactSecrets(error.message)}`);
+        }
+        else {
+            throw error;
+        }
+    }
+    await clearLocalConnection();
+    console.log("Local Bridge credentials cleared. Run join to connect again (same or another org).");
+    console.log(`Tip: stop a background runner with \`${bridgeUsage("uninstall-service")}\` if one is installed.`);
+}
 try {
     if (command === "connect")
         await connect();
     else if (command === "join")
         await join();
+    else if (command === "disconnect")
+        await disconnect();
     else if (command === "fuel")
         await fuelCommand();
     else if (command === "drivers")
@@ -466,7 +521,7 @@ try {
     else if (command === "uninstall-service")
         await uninstallService();
     else
-        throw new Error(`Usage: ${BRIDGE_NPX} <join|connect|fuel|drivers|mcp|runner|install-service|uninstall-service>`);
+        throw new Error(`Usage: ${BRIDGE_NPX} <join|disconnect|connect|fuel|drivers|mcp|runner|install-service|uninstall-service>`);
 }
 catch (error) {
     console.error(error instanceof Error ? redactSecrets(error.message) : "Conduit command failed");

package/dist/config.js

@@ -260,6 +260,17 @@ export async function clearPendingConnection() {
             throw error;
     });
 }
+/** Drop local org credentials after a server-side disengage. Keeps installation.json. */
+export async function clearLocalConnection() {
+    await withConfigLock(async () => {
+        for (const target of [path, runtimePath, pendingPath]) {
+            await unlink(target).catch((error) => {
+                if (error.code !== "ENOENT")
+                    throw error;
+            });
+        }
+    });
+}
 export async function loadOrCreateInstallationId() {
     try {
         const identity = JSON.parse(await readFile(installationPath, "utf8"));

package/dist/execution.js

@@ -44,6 +44,7 @@ const taskSpecSchema = z.object({
     change_scope: z.array(z.string()).optional(), work_role: z.string().optional(),
     repository: z.object({ url: z.string().optional(), base_commit: z.string().optional() }).nullable().optional(),
     risk_level: z.string().optional(),
+    deliverable: z.enum(["repository", "artifact"]).optional().default("repository"),
 });
 const executionContractSchema = z.object({
     repository_fingerprint: z.string().nullable().optional().default(null),
@@ -58,6 +59,7 @@ const workPackageSchema = z.object({
     acceptance: z.array(z.string()).optional(),
     change_scope: z.array(z.string()).optional(),
     required_evidence: z.array(z.string()).optional(),
+    deliverable: z.enum(["repository", "artifact"]).optional().default("repository"),
     initiative: z.object({
         title: z.string().nullable().optional(),
         desired_outcome: z.string().nullable().optional(),
@@ -272,7 +274,10 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
     const task = taskDetailSchema.parse(detail.task);
     const executionContract = executionContractSchema.parse(detail.execution_contract ?? {});
     const workPackage = workPackageSchema.parse(detail.work_package) ?? null;
-    const spec = parseTaskSpec(task.spec_json);
+    const parsedSpec = parseTaskSpec(task.spec_json);
+    const deliverable = workPackage?.deliverable ?? parsedSpec.deliverable;
+    const spec = { ...parsedSpec, deliverable };
+    const artifactDelivery = deliverable === "artifact";
     const grants = z.array(z.string()).parse(task.grants_json ? JSON.parse(task.grants_json) : []);
     const reworkFeedback = task.delivery_state === "changes_requested" ? changesRequestedFeedback(task.delivery_summary) : null;
     // Recompile current state at claim time — earlier packages may have moved the repo.
@@ -309,6 +314,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         }
     }
     let attemptWorkspace;
+    let deliverySubmitted = false;
     if (options.existingWorktree) {
         attemptWorkspace = options.existingWorktree;
     }
@@ -486,20 +492,26 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         }
         await client.updateAttempt(taskId, { phase: "agent_finished", delivery: { spec, report } });
         await submitFinishedDelivery(client, taskId);
+        deliverySubmitted = true;
         console.log(`Assignment ${taskId} delivered for review and acceptance.`);
     }
     finally {
         clearInterval(renewTimer);
         if (heartbeatTimer)
             clearInterval(heartbeatTimer);
-        // F-07: dispose the attempt worktree so the next claim cannot inherit edits.
-        // Terminal submit may already have cleared activeAttempts — never throw from cleanup.
-        const path = config.activeAttempts[taskId]?.worktreePath ?? attemptWorkspace;
-        await removeAttemptWorktree(workspace, path).catch((error) => {
-            console.error(`Attempt worktree cleanup failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
-        });
-        if (config.activeAttempts[taskId]) {
-            await client.updateAttempt(taskId, { worktreePath: undefined }).catch(() => undefined);
+        if (artifactDelivery && !deliverySubmitted) {
+            console.error(`Artifact delivery was not submitted; retained generated files at ${attemptWorkspace}`);
+        }
+        else {
+            // F-07: dispose the attempt worktree so the next claim cannot inherit edits.
+            // Terminal submit may already have cleared activeAttempts — never throw from cleanup.
+            const path = config.activeAttempts[taskId]?.worktreePath ?? attemptWorkspace;
+            await removeAttemptWorktree(workspace, path).catch((error) => {
+                console.error(`Attempt worktree cleanup failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
+            });
+            if (config.activeAttempts[taskId]) {
+                await client.updateAttempt(taskId, { worktreePath: undefined }).catch(() => undefined);
+            }
         }
     }
 }
@@ -658,6 +670,24 @@ async function prepareDelivery(client, attemptId, taskId, report) {
 }
 export function validateDeliveryReport(report, spec, grants = []) {
     validateChangeScope(report, spec.change_scope ?? []);
+    if (spec.deliverable === "artifact") {
+        const published = report.evidence.some((item) => {
+            if (!["preview", "research", "documentation"].includes(item.kind))
+                return false;
+            if (!item.uri || !item.digest || !/^sha256:[0-9a-f]{64}$/i.test(item.digest))
+                return false;
+            try {
+                const protocol = new URL(item.uri).protocol;
+                return protocol === "https:" || protocol === "http:";
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!published) {
+            throw new Error("Artifact delivery requires a published HTTP(S) URL and sha256 digest");
+        }
+    }
     // Invariant 9: grants bound what an attempt may do. Cursor/plan-mode are soft hints the headless
     // agent can leave, so repository-write authority is enforced here on the reported delivery: a task
     // without repo_write must not report repository changes.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.9.0",
-  "description": "Conduit Bridge CLI — join, connect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
+  "version": "0.9.1",
+  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {
     "conduit": "dist/cli.js"