@miraland-labs/conduit-bridge

Local Bridge CLI for Conduit. Connects a computer to one organization, claims work, and drives a local agent.

Current npm: 0.8.0 — multi-driver lanes on one Connect computer (drivers online|offline), shared concurrent slots 1–4 (sum across online IDEs, not per IDE), per-attempt worktrees, optional --ensure-checkout, safe resume.

Prerequisites

• Node.js 20+
• One or more supported agent CLIs on PATH (common: install several on one Mac):
  • Claude Code — claude (Conduit pump or Anthropic login)
  • Codex — codex (Conduit pump or ChatGPT/OpenAI login). Since the July 2026 ChatGPT desktop merge, Bridge also finds the CLI bundled inside ChatGPT.app when codex is not on PATH (macOS)
  • OpenCode — opencode (Conduit pump or local provider login)
  • Cursor Agent — agent (local fuel; set with drivers fuel cursor local or machine fuel local)
  • Kiro CLI — kiro-cli (local fuel)
  • Antigravity — agy (local fuel)
• macOS or Linux for install-service (Windows: keep a terminal runner open)

Install / run

npx @miraland-labs/conduit-bridge join --url <https://your-conduit> --organization <slug>

After approval, seed detects installed CLIs as offline lanes. Bring one or more online (subscription failover / concurrent lanes):

npx @miraland-labs/conduit-bridge drivers              # list lanes
npx @miraland-labs/conduit-bridge drivers online claude-code
npx @miraland-labs/conduit-bridge drivers online claude-code codex   # both can run at once
npx @miraland-labs/conduit-bridge drivers offline claude-code         # finish in-flight; no new claims
npx @miraland-labs/conduit-bridge runner --workspace /path/to/repo

Legacy single-driver process override (does not change saved online set):

npx @miraland-labs/conduit-bridge runner --agent claude-code --workspace /path/to/repo

Persist (macOS/Linux) — one LaunchAgent; honors the drivers online set:

npx @miraland-labs/conduit-bridge install-service --workspace /path/to/repo
# optional: bring a lane online at install time
npx @miraland-labs/conduit-bridge install-service --agent claude-code --workspace /path/to/repo

Reinstall after upgrading from Bridge versions before 0.8 if the old unit baked a single --agent.

For a Start-created GitHub repo that is not checked out yet, point --workspace at the intended path and add --ensure-checkout <https://github.com/…> so Bridge clones with the machine’s Git credentials before the first heartbeat (never the control-plane PAT).

Capacity: Connect-approved lease_capacity (1–4) is a shared pool for all online lanes on that computer. Claude alone may use all 4 slots; Claude + Codex share those 4 — never 4×N.

Grant enforcement

Every driver enforces the assignment's granted actions with its CLI's native mechanism — never just the prompt:

| Driver | Fuel | Mechanism | | --- | --- | --- | | claude-code | pump or local | --allowedTools / --disallowedTools per grant; bounded verification commands | | codex | pump or local | sandbox read-only / workspace-write; network enabled only with pr_create; resumes by thread id | | opencode | pump or local | plan/build agents; per-run opencode.json bash deny list (shared deniedCommands); --session resume; --format json | | cursor | local only | per-run .cursor/cli.json permissions allow/deny (no --force); read-only runs in --mode plan | | kiro | local only | --trust-tools=fs_read,fs_write,execute_bash allowlist; --no-interactive; --resume-id. Tool-level only — no per-command scoping, so a bash grant trusts execute_bash wholesale (Antigravity-tier) | | antigravity | local only | -p --mode plan (read-only) / --mode accept-edits --sandbox (write). Mode-level, coarser than per-tool; plain-text output; resume not surfaced |

Every driver refuses to start when grants map to nothing, fails closed on missing logins, and shares one denied-command list (merge, force-push, deploy, kubectl, terraform).

Verification status:

• claude-code, codex, cursor, opencode, antigravity — verified end-to-end against their real CLIs (agy 1.1.3: -p --mode args, Google login, plain-text output confirmed through the driver).
• kiro — flag surface and login preflight verified against kiro-cli 2.13.0 (chat --no-interactive --trust-tools --resume-id; tool names; whoami-based login check that avoids the browser-login hang). A full run is pending a KIRO_API_KEY — kiro-cli requires auth to execute and cannot be exercised offline.