@miraland-labs/conduit-bridge 0.9.9 → 0.9.11

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.9.9` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
+**Package version:** `0.9.11` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` and pass `--force` (required for headless fetch); research-only networked runs also deny `Shell(*)` / `Write(**)`. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
 
 ## Prerequisites
 

package/dist/driver.js

@@ -142,6 +142,7 @@ export function buildAssignmentPrompt(context) {
         ...(context.grants.includes("branch_create") ? branchCreateCommands : []),
         ...(context.grants.includes("pr_create") ? prCreateCommands : []),
     ];
+    const hasExternalNetwork = (spec.required_capabilities ?? []).includes("external_network");
     const languageRule = deliveryLanguageRule(packageContext?.working_language ?? spec.working_language);
     lines.push("", "RULES", "- Stay within the change scope and boundaries.", ...(languageRule ? [languageRule] : []), 
     // Name the executable commands. The shell allow-list is exact, so an agent that guesses at
@@ -152,7 +153,12 @@ export function buildAssignmentPrompt(context) {
         ? [
             `- These are the ONLY shell commands you may run: ${runnableCommands.join("; ")}. Anything else is rejected — do not try variations, wrappers, or \`echo\`. Run the relevant ones and report their real output.`,
         ]
-        : ["- You have no shell authority for this assignment. Do not attempt shell commands; verify by reading files and report what you could not verify as unknown."]), ...(mustCommit
+        : ["- You have no shell authority for this assignment. Do not attempt shell commands; verify by reading files and report what you could not verify as unknown."]), 
+    // Mirror .cursor/cli.json WebFetch(*) — without naming it, agents fall back to WebSearch (not
+    // allow-listable) or invent status/title after "User Rejected" on unlisted fetches.
+    ...(hasExternalNetwork
+        ? ["- This assignment includes external_network: WebFetch is allow-listed. Use WebFetch for live HTTP status and page content; do not invent origin responses. Prefer WebFetch over WebSearch."]
+        : []), ...(mustCommit
         ? [
             "- Your working branch is already checked out. Commit your repository changes on the current branch (git add + git commit) — do not create a new branch — and report the resulting sha as head_commit. A delivery that changed files without a commit is rejected.",
             ...(mustOpenPr
@@ -430,11 +436,18 @@ export const codexDriver = {
     },
 };
 /**
- * Grants → Cursor CLI permissions (project .cursor/cli.json).
+ * Grants + capabilities → Cursor CLI permissions (project .cursor/cli.json).
  * Current Cursor Agent schema accepts only `permissions.{allow,deny}` (no
  * `version` / `approvalMode`). Outside the allow list is denied without --force.
+ *
+ * `external_network` maps to WebFetch(*) plus `--force` on the run (see
+ * cursorRunArgs). Field evidence: allow-listing WebFetch alone still yields
+ * "User Rejected" under headless `-p`; `--force` is required for fetch to
+ * succeed. Because `--force` auto-allows unlisted tools, research-only
+ * networked assignments also deny Shell(*) and Write(**). Codex's parallel is
+ * sandbox_workspace_write.network_access=true.
  */
-export function cursorPermissionsForGrants(grants, verificationCommands = []) {
+export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = []) {
     const allow = [];
     if (grants.includes("test_run")) {
         allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Shell(${command})`));
@@ -443,7 +456,19 @@ export function cursorPermissionsForGrants(grants, verificationCommands = []) {
         allow.push(...branchCreateCommands.map((command) => `Shell(${command})`));
     if (grants.includes("pr_create"))
         allow.push(...prCreateCommands.map((command) => `Shell(${command})`));
-    return { allow, deny: deniedCommands.map((command) => `Shell(${command})`) };
+    // Cursor docs: WebFetch(domainOrPattern); WebFetch(*) auto-approves any domain.
+    if (capabilities.includes("external_network"))
+        allow.push("WebFetch(*)");
+    const deny = deniedCommands.map((command) => `Shell(${command})`);
+    // --force opens anything not denied; lock shell/write when the assignment has no mutate/shell grants.
+    if (capabilities.includes("external_network")
+        && !grants.includes("repo_write")
+        && !grants.includes("test_run")
+        && !grants.includes("branch_create")
+        && !grants.includes("pr_create")) {
+        deny.push("Shell(*)", "Write(**)");
+    }
+    return { allow, deny };
 }
 /**
  * Cursor CLI arguments. Deliberately no `--mode plan` for read-only assignments: plan mode is not an
@@ -461,6 +486,9 @@ export function cursorRunArgs(input) {
     const args = ["-p", "--output-format", "json", "--workspace", input.workspace];
     if (input.trustWorkspace)
         args.push("--trust");
+    // Headless WebFetch requires --force even when WebFetch(*) is allow-listed (Cursor CLI 2026.07+).
+    if (input.capabilities?.includes("external_network"))
+        args.push("--force");
     if (input.model)
         args.push("--model", input.model);
     if (input.resumeSessionId)
@@ -538,7 +566,7 @@ export const cursorDriver = {
         // local contract instead of making either version fail every attempt worktree.
         const help = await execute(executable, ["--help"], input.workspace, 15_000, undefined, "local");
         const trustWorkspace = help.code === 0 && cursorSupportsWorkspaceTrust(`${help.stdout}\n${help.stderr}`);
-        const configured = await withCursorPermissions(input.workspace, cursorPermissionsForGrants(input.grants, input.verificationCommands), () => execute(executable, cursorRunArgs({ ...input, trustWorkspace }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
+        const configured = await withCursorPermissions(input.workspace, cursorPermissionsForGrants(input.grants, input.verificationCommands, input.capabilities ?? []), () => execute(executable, cursorRunArgs({ ...input, trustWorkspace }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
         const { code, stdout, stderr } = configured;
         const parsed = parseCursorOutput(stdout);
         if (code !== 0 || parsed.isError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {