@miraland-labs/conduit-bridge 0.9.10 → 0.9.12

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.9.10` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` so headless fetches are not auto-rejected. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
+**Package version:** `0.9.12` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` and pass `--force` (required for headless fetch); research-only networked runs also deny `Shell(*)` / `Write(**)`. Artifact evidence digests normalize bare 64-hex to `sha256:<hex>`. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
 
 ## Prerequisites
 

package/dist/driver.js

@@ -174,7 +174,7 @@ export function buildAssignmentPrompt(context) {
                 // `git status` stays clean — which is the point for a content pack, and mandatory for
                 // anything binary.
                 "- This assignment delivers an artifact, not repository content. Write your output under `.conduit/artifacts/` — that path is excluded from git, so do not commit anything and do not report a head_commit.",
-                "- Publish the artifact to its destination and report each output in your evidence with the published URL and a sha256 digest. An artifact nobody can fetch is not a delivery.",
+                "- Publish the artifact to its destination and report each output in your evidence with the published HTTPS URL and digest exactly as `sha256:` plus the 64-character hex hash (bare hex from shasum is normalized, but prefer the prefixed form). An artifact nobody can fetch is not a delivery.",
             ]
             : ["- You have no repository write authority for this assignment. Do not create, modify, or commit any file; a delivery reporting repository changes will be rejected. Record all findings, verification output, and conclusions in your final report instead."]), "- Never merge, deploy, force-push, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", 
     // A met claim with nothing backing it is rejected server-side ("Met acceptance criteria require
@@ -222,6 +222,19 @@ export function parseAgentReport(text, acceptance) {
     }
     return { ...parsed.data, acceptance_results: parsed.data.acceptance_results.map((item) => ({ ...item, evidence_artifact_ids: [] })) };
 }
+/**
+ * Artifact publication receipts require `sha256:<64 hex>`. Agents often paste bare `shasum` output;
+ * accept that and canonicalize. Already-prefixed digests pass through (case-normalized hex).
+ */
+export function normalizeEvidenceDigest(digest) {
+    const trimmed = digest.trim();
+    const prefixed = /^sha256:([0-9a-f]{64})$/i.exec(trimmed);
+    if (prefixed)
+        return `sha256:${prefixed[1].toLowerCase()}`;
+    if (/^[0-9a-f]{64}$/i.test(trimmed))
+        return `sha256:${trimmed.toLowerCase()}`;
+    return trimmed;
+}
 /**
  * Tolerate benign agent-output noise before strict validation: drop empty/whitespace-only entries from
  * string arrays and remove empty optional scalars, so a single stray "" does not fail an otherwise-valid
@@ -251,6 +264,8 @@ function sanitizeReportShape(raw) {
             // Agents emit null/"" for optional fields they have no value for — treat as absent.
             if ("digest" in evidence && (typeof evidence.digest !== "string" || evidence.digest.trim() === ""))
                 delete evidence.digest;
+            else if (typeof evidence.digest === "string")
+                evidence.digest = normalizeEvidenceDigest(evidence.digest);
             // Drop non-URL / empty uris so an optional bad uri doesn't fail the whole report.
             if ("uri" in evidence && (typeof evidence.uri !== "string" || !z.string().url().max(4_000).safeParse(evidence.uri).success))
                 delete evidence.uri;
@@ -440,10 +455,12 @@ export const codexDriver = {
  * Current Cursor Agent schema accepts only `permissions.{allow,deny}` (no
  * `version` / `approvalMode`). Outside the allow list is denied without --force.
  *
- * `external_network` maps to WebFetch(*) — without it, headless `-p` runs get
- * "User Rejected" on every fetch (no interactive approval). Deliberately not
- * `--force`/`--yolo`: that would also auto-allow unlisted Shell commands.
- * Codex's parallel is sandbox_workspace_write.network_access=true.
+ * `external_network` maps to WebFetch(*) plus `--force` on the run (see
+ * cursorRunArgs). Field evidence: allow-listing WebFetch alone still yields
+ * "User Rejected" under headless `-p`; `--force` is required for fetch to
+ * succeed. Because `--force` auto-allows unlisted tools, research-only
+ * networked assignments also deny Shell(*) and Write(**). Codex's parallel is
+ * sandbox_workspace_write.network_access=true.
  */
 export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = []) {
     const allow = [];
@@ -457,7 +474,16 @@ export function cursorPermissionsForGrants(grants, verificationCommands = [], ca
     // Cursor docs: WebFetch(domainOrPattern); WebFetch(*) auto-approves any domain.
     if (capabilities.includes("external_network"))
         allow.push("WebFetch(*)");
-    return { allow, deny: deniedCommands.map((command) => `Shell(${command})`) };
+    const deny = deniedCommands.map((command) => `Shell(${command})`);
+    // --force opens anything not denied; lock shell/write when the assignment has no mutate/shell grants.
+    if (capabilities.includes("external_network")
+        && !grants.includes("repo_write")
+        && !grants.includes("test_run")
+        && !grants.includes("branch_create")
+        && !grants.includes("pr_create")) {
+        deny.push("Shell(*)", "Write(**)");
+    }
+    return { allow, deny };
 }
 /**
  * Cursor CLI arguments. Deliberately no `--mode plan` for read-only assignments: plan mode is not an
@@ -475,6 +501,9 @@ export function cursorRunArgs(input) {
     const args = ["-p", "--output-format", "json", "--workspace", input.workspace];
     if (input.trustWorkspace)
         args.push("--trust");
+    // Headless WebFetch requires --force even when WebFetch(*) is allow-listed (Cursor CLI 2026.07+).
+    if (input.capabilities?.includes("external_network"))
+        args.push("--force");
     if (input.model)
         args.push("--model", input.model);
     if (input.resumeSessionId)

package/dist/execution.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets } from "./config.js";
-import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
+import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
 import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
@@ -629,9 +629,9 @@ async function prepareDelivery(client, attemptId, taskId, report) {
         // Publication receipts require a digest on every acceptance artifact. Textual agent
         // evidence has no file to hash, so default to a canonical content digest of the
         // evidence itself — deterministic and verifiable against the stored metadata.
-        const digest = item.digest ?? `sha256:${createHash("sha256")
+        const digest = normalizeEvidenceDigest(item.digest ?? `sha256:${createHash("sha256")
             .update(JSON.stringify({ kind: item.kind, name: item.name, details: item.details, acceptance_criteria: item.acceptance_criteria }))
-            .digest("hex")}`;
+            .digest("hex")}`);
         const response = await client.attemptRequest(taskId, "artifacts", {
             kind: item.kind, name: item.name, uri, digest,
             metadata: { details: item.details, acceptance_criteria: item.acceptance_criteria },
@@ -666,7 +666,10 @@ export function validateDeliveryReport(report, spec, grants = []) {
         const published = report.evidence.some((item) => {
             if (!["preview", "research", "documentation"].includes(item.kind))
                 return false;
-            if (!item.uri || !item.digest || !/^sha256:[0-9a-f]{64}$/i.test(item.digest))
+            if (!item.uri || !item.digest)
+                return false;
+            const digest = normalizeEvidenceDigest(item.digest);
+            if (!/^sha256:[0-9a-f]{64}$/i.test(digest))
                 return false;
             try {
                 const protocol = new URL(item.uri).protocol;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {