@miraland-labs/conduit-bridge 0.9.11 → 0.9.12

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.9.11` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` and pass `--force` (required for headless fetch); research-only networked runs also deny `Shell(*)` / `Write(**)`. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
+**Package version:** `0.9.12` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` and pass `--force` (required for headless fetch); research-only networked runs also deny `Shell(*)` / `Write(**)`. Artifact evidence digests normalize bare 64-hex to `sha256:<hex>`. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
 
 ## Prerequisites
 

package/dist/driver.js

@@ -174,7 +174,7 @@ export function buildAssignmentPrompt(context) {
                 // `git status` stays clean — which is the point for a content pack, and mandatory for
                 // anything binary.
                 "- This assignment delivers an artifact, not repository content. Write your output under `.conduit/artifacts/` — that path is excluded from git, so do not commit anything and do not report a head_commit.",
-                "- Publish the artifact to its destination and report each output in your evidence with the published URL and a sha256 digest. An artifact nobody can fetch is not a delivery.",
+                "- Publish the artifact to its destination and report each output in your evidence with the published HTTPS URL and digest exactly as `sha256:` plus the 64-character hex hash (bare hex from shasum is normalized, but prefer the prefixed form). An artifact nobody can fetch is not a delivery.",
             ]
             : ["- You have no repository write authority for this assignment. Do not create, modify, or commit any file; a delivery reporting repository changes will be rejected. Record all findings, verification output, and conclusions in your final report instead."]), "- Never merge, deploy, force-push, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", 
     // A met claim with nothing backing it is rejected server-side ("Met acceptance criteria require
@@ -222,6 +222,19 @@ export function parseAgentReport(text, acceptance) {
     }
     return { ...parsed.data, acceptance_results: parsed.data.acceptance_results.map((item) => ({ ...item, evidence_artifact_ids: [] })) };
 }
+/**
+ * Artifact publication receipts require `sha256:<64 hex>`. Agents often paste bare `shasum` output;
+ * accept that and canonicalize. Already-prefixed digests pass through (case-normalized hex).
+ */
+export function normalizeEvidenceDigest(digest) {
+    const trimmed = digest.trim();
+    const prefixed = /^sha256:([0-9a-f]{64})$/i.exec(trimmed);
+    if (prefixed)
+        return `sha256:${prefixed[1].toLowerCase()}`;
+    if (/^[0-9a-f]{64}$/i.test(trimmed))
+        return `sha256:${trimmed.toLowerCase()}`;
+    return trimmed;
+}
 /**
  * Tolerate benign agent-output noise before strict validation: drop empty/whitespace-only entries from
  * string arrays and remove empty optional scalars, so a single stray "" does not fail an otherwise-valid
@@ -251,6 +264,8 @@ function sanitizeReportShape(raw) {
             // Agents emit null/"" for optional fields they have no value for — treat as absent.
             if ("digest" in evidence && (typeof evidence.digest !== "string" || evidence.digest.trim() === ""))
                 delete evidence.digest;
+            else if (typeof evidence.digest === "string")
+                evidence.digest = normalizeEvidenceDigest(evidence.digest);
             // Drop non-URL / empty uris so an optional bad uri doesn't fail the whole report.
             if ("uri" in evidence && (typeof evidence.uri !== "string" || !z.string().url().max(4_000).safeParse(evidence.uri).success))
                 delete evidence.uri;

package/dist/execution.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets } from "./config.js";
-import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
+import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
 import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
@@ -629,9 +629,9 @@ async function prepareDelivery(client, attemptId, taskId, report) {
         // Publication receipts require a digest on every acceptance artifact. Textual agent
         // evidence has no file to hash, so default to a canonical content digest of the
         // evidence itself — deterministic and verifiable against the stored metadata.
-        const digest = item.digest ?? `sha256:${createHash("sha256")
+        const digest = normalizeEvidenceDigest(item.digest ?? `sha256:${createHash("sha256")
             .update(JSON.stringify({ kind: item.kind, name: item.name, details: item.details, acceptance_criteria: item.acceptance_criteria }))
-            .digest("hex")}`;
+            .digest("hex")}`);
         const response = await client.attemptRequest(taskId, "artifacts", {
             kind: item.kind, name: item.name, uri, digest,
             metadata: { details: item.details, acceptance_criteria: item.acceptance_criteria },
@@ -666,7 +666,10 @@ export function validateDeliveryReport(report, spec, grants = []) {
         const published = report.evidence.some((item) => {
             if (!["preview", "research", "documentation"].includes(item.kind))
                 return false;
-            if (!item.uri || !item.digest || !/^sha256:[0-9a-f]{64}$/i.test(item.digest))
+            if (!item.uri || !item.digest)
+                return false;
+            const digest = normalizeEvidenceDigest(item.digest);
+            if (!/^sha256:[0-9a-f]{64}$/i.test(digest))
                 return false;
             try {
                 const protocol = new URL(item.uri).protocol;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {