@gleapai/kai-bridge 0.11.0 → 0.12.1

package/src/deps.mjs

@@ -11,7 +11,7 @@
 // yet) we leave the directory absent and the install path takes over with
 // the lockfile-driven, cache-first command instead of a bare `npm install`.
 
-import { execFileSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, rmSync, statSync } from "node:fs";
 import { platform } from "node:os";
@@ -84,24 +84,45 @@ export function canSeedNodeModules({ primaryPath, cwd }) {
   return { ok: true, reason: "lockfile_match", pm: b.pm };
 }
 
+/**
+ * `cmd args` as a promise, output discarded (stderr's head kept for the
+ * reason). Asynchronous on purpose: cloning a big `node_modules` takes 30 s
+ * to 2.5 min (bridge.log: 144 s for the Gleap dashboard, 105 s for the
+ * Server), and a synchronous copy froze the daemon for all of it.
+ */
+function runQuiet(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => {
+      if (stderr.length < 2000) stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      if (code === 0) resolve();
+      else reject(new Error(`${cmd} exited with ${code ?? signal}${stderr.trim() ? `: ${stderr.trim().slice(0, 500)}` : ""}`));
+    });
+  });
+}
+
 /**
  * Copy the primary checkout's `node_modules` into a fresh worktree when
- * the lockfiles match. Returns `{ seeded, reason, ms }`; never throws — a
+ * the lockfiles match. Resolves `{ seeded, reason, ms }`; never rejects — a
  * failed or partial copy is removed so the install path still runs.
  *
  * macOS `cp -c` clones via clonefile(2) and falls back to a plain copy on
  * filesystems without it; `-R` without `-L` keeps symlinks as symlinks
  * (`.bin` shims, pnpm's store links — all relative, so they stay valid).
  */
-export function seedNodeModules({ primaryPath, cwd, os = platform(), exec = execFileSync }) {
+export async function seedNodeModules({ primaryPath, cwd, os = platform(), exec = runQuiet }) {
   const started = Date.now();
   const check = canSeedNodeModules({ primaryPath, cwd });
   if (!check.ok) return { seeded: false, reason: check.reason, ms: 0 };
   const src = join(primaryPath, "node_modules");
   const dst = join(cwd, "node_modules");
   try {
-    if (os === "darwin") exec("cp", ["-c", "-R", src, dst], { stdio: "ignore" });
-    else if (os === "linux") exec("cp", ["-R", "--reflink=auto", src, dst], { stdio: "ignore" });
+    if (os === "darwin") await exec("cp", ["-c", "-R", src, dst]);
+    else if (os === "linux") await exec("cp", ["-R", "--reflink=auto", src, dst]);
     else return { seeded: false, reason: "unsupported_platform", ms: 0 };
     return { seeded: true, reason: check.reason, ms: Date.now() - started };
   } catch (err) {

package/src/executor.mjs

@@ -7,36 +7,72 @@
 // `onEvent` as they stream, plus the final `result`.
 
 import { spawn } from "node:child_process";
-import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { createInterface } from "node:readline";
 import { delimiter, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { getHarness, resolveHarnessId } from "../runner/lib/acp/harnesses.mjs";
+import { isPlanModeAgent, normalizeAgentName } from "../runner/lib/contract.mjs";
 import { ambientConfigDir, managedConfigDir } from "./profiles.mjs";
 import { harnessAcpCommand, harnessBinary } from "./harnesses.mjs";
 import { KAI_HOME } from "./config.mjs";
 import { classifyHarnessFailure } from './harness-errors.mjs';
+import { isContinuationTurn, rehydrateTurnTask } from "./rehydration.mjs";
 
 const RUNNER = join(dirname(fileURLToPath(import.meta.url)), "..", "runner", "acp-runner.mjs");
 const b64 = (v) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v), "utf8").toString("base64");
 
-/** turn.start payload → runner argv (no shell — we spawn node directly). */
-export function buildRunnerArgs(turn, workDir, profile) {
-  const args = ["--task-b64", b64(turn.task || ""), "--work-dir", workDir];
-  // The Server's coder payload signals plan mode as `planMode`, not as an
-  // agent name (the analyzer host does this same mapping before spawning
-  // its runner). Without it, a device Plan turn silently ran as build:
-  // full write permissions, no plan artifact, no "Implement this plan?".
-  const agent = turn.agent ?? (turn.planMode ? "kai-planner" : undefined);
+// The Server's coder payload signals plan mode as `planMode`, not as an
+// agent name (the analyzer host does this same mapping before spawning
+// its runner). Without it, a device Plan turn silently ran as build:
+// full write permissions, no plan artifact, no "Implement this plan?".
+const runnerAgent = (turn) => turn.agent ?? (turn.planMode ? "kai-planner" : undefined);
+
+/**
+ * A follow-up's task for a FRESH harness session (src/rehydration.mjs):
+ * the runner prompts with `feedback` (or the answers) INSTEAD of the task,
+ * so a follow-up that could not resume reached a blank agent holding only
+ * the latest message — after a merge the Server drops the resume id, and
+ * the agent got nothing but "can you help me generate an answer to her?"
+ * (#148327). Plan mode is the mode the runner will actually run in.
+ */
+export function rehydratedTaskFor(turn, { hasPriorBranch = false, restartedRepos = [], workspaceNote = "" } = {}) {
+  const isPlanMode = isPlanModeAgent(normalizeAgentName(runnerAgent(turn)));
+  return `${rehydrateTurnTask(turn, { isPlanMode, hasPriorBranch, restartedRepos })}${workspaceNote}`;
+}
+
+/**
+ * turn.start payload → runner argv (no shell — we spawn node directly).
+ *
+ * `workspaceNote` = the daemon's repo brief + live-preview note, appended
+ * to the task. `rehydratedTaskFile` = where runTurn wrote the follow-up's
+ * rehydrated task (rehydratedTaskFor): the runner prompts with it whenever
+ * the session starts fresh — also when a resume fails in the harness. With
+ * it and `resumable` false (runTurn checks the transcript on disk, see
+ * canResumeSession), the turn starts a clean session prompted with that
+ * task alone: no feedback, answers or resume id.
+ */
+export function buildRunnerArgs(turn, workDir, profile, { resumable = !!turn.acpSessionId, workspaceNote = "", rehydratedTaskFile = null } = {}) {
+  const agent = runnerAgent(turn);
+  const rehydrate = !!rehydratedTaskFile && !resumable;
+  const args = ["--task-b64", b64(`${turn.task || ""}${workspaceNote}`), "--work-dir", workDir];
   if (agent) args.push("--agent", agent);
   if (turn.model) args.push("--model", turn.model);
   if (turn.engineModelSlug) args.push("--engine-model", turn.engineModelSlug);
   if (turn.subagentModel) args.push("--subagent-model", turn.subagentModel);
   if (turn.effort) args.push("--effort", turn.effort);
-  // ACP resume id when the server split it out (acpSessionId); the
-  // canonical session id otherwise (turn 1 — the runner treats it as a
-  // hint and mints its own ACP id).
-  if (turn.acpSessionId || turn.sessionId) args.push("--session-id", turn.acpSessionId || turn.sessionId);
+  // The ACP resume id only (`acpSessionId`, set by the Server once a turn
+  // reported one). `turn.sessionId` is always the canonical Kai Code
+  // session (the worktree key), never a harness chat, but the runner reads
+  // `--session-id` as "resume this chat": handed the canonical id, a
+  // session's first turn asked the harness to resume a chat that does not
+  // exist (Cursor has no transcript to check first, and an adapter that
+  // accepted the id ran the turn without the persona prefix). None for a
+  // rehydrated turn either: it starts a clean session and never resumes
+  // the one its prompt retells.
+  if (!rehydrate && turn.acpSessionId) args.push("--session-id", turn.acpSessionId);
   if (turn.harness) args.push("--harness", turn.harness);
   // BYO turns run uncapped: no --max-steps and no --max-budget-usd, even
   // when the Server sends them — the work bills the operator's own harness
@@ -50,8 +86,11 @@ export function buildRunnerArgs(turn, workDir, profile) {
   if (profile?.kind === "gleap-key" && turn.maxBudgetUsd > 0) {
     args.push("--max-budget-usd", String(turn.maxBudgetUsd));
   }
-  if (turn.feedback) args.push("--feedback-b64", b64(turn.feedback));
-  if (turn.questionAnswers?.length) args.push("--answers-b64", b64(turn.questionAnswers));
+  if (turn.feedback && !rehydrate) args.push("--feedback-b64", b64(turn.feedback));
+  if (turn.questionAnswers?.length && !rehydrate) args.push("--answers-b64", b64(turn.questionAnswers));
+  // A file, not argv: history + plan + summary outgrow argv limits (32 KB
+  // for a whole Windows command line, 128 KB per Linux argument).
+  if (rehydratedTaskFile) args.push("--rehydrated-task-file", rehydratedTaskFile);
   if (turn.attachments?.length) args.push("--attachments-b64", b64(turn.attachments));
   if (turn.mcpServers?.length) args.push("--mcp-config-b64", b64(turn.mcpServers));
   if (turn.customInstructions?.trim()) args.push("--system-prompt-b64", b64(turn.customInstructions));
@@ -135,16 +174,61 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
   return env;
 }
 
+/**
+ * Can the harness resume the turn's ACP session? The runner's own check
+ * (HARNESS.hasResumableSession: the prior transcript is on disk), run
+ * against the config dir the runner will use (`env` from buildRunnerEnv).
+ * A session this machine does not have — the transcript was cleaned up,
+ * the session ran under another login or on another machine — would
+ * otherwise start fresh on the feedback alone. A harness without an
+ * on-disk check (Cursor) is trusted: the runner tries to continue the
+ * session (Cursor: `session/load`, it offers no `session/resume`).
+ */
+export function canResumeSession(turn, workDir, env) {
+  if (!turn.acpSessionId) return false;
+  const harnessId = resolveHarnessId(turn.harness, turn.model);
+  const harness = getHarness(harnessId);
+  if (!harness.hasResumableSession) return true;
+  // Resolved like the runner's main(): the profile's dir, else a
+  // per-harness dir under the state root.
+  const configDir = env.KAI_ACP_CONFIG_DIR || join(env.KAI_ACP_STATE_DIR || join(tmpdir(), "kai-acp-state"), harnessId);
+  try {
+    return !!harness.hasResumableSession({ configDir, workDir, resumeSessionId: turn.acpSessionId });
+  } catch {
+    return false;
+  }
+}
+
+/** A follow-up's rehydrated task in a private temp dir, removed when the turn ends. */
+function writeRehydratedTask(turn, opts) {
+  const dir = mkdtempSync(join(tmpdir(), "kai-turn-"));
+  const file = join(dir, "rehydrated-task.md");
+  writeFileSync(file, rehydratedTaskFor(turn, opts), { mode: 0o600 });
+  return { dir, file };
+}
+
 /**
  * Execute a turn. Resolves `{ code, result, rateLimited }`; events stream
  * through `onEvent(event)`. `signal` cancels (SIGTERM to the runner).
  * `onSpawn(handle)` hands out `handle.control(obj)` for the runner's stdin
- * control channel (mid-turn steering).
+ * control channel (mid-turn steering). `workspaceNote`: see
+ * buildRunnerArgs; `hasPriorBranch` / `restartedRepos`: see
+ * buildRehydrationTask (src/rehydration.mjs).
+ * `onRehydrate({ reason })` fires when a follow-up runs on its rehydrated
+ * task instead of a resumed session: `no_resume_id` / `session_not_found`
+ * before the spawn, `resume_failed` when the harness could not resume or
+ * load it, or loaded a chat with no conversation left in it.
  */
-export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onSpawn, signal, kaiHome = KAI_HOME, extraEnv = null }) {
+export function runTurn({ turn, profile, workDir, workspaceNote = "", hasPriorBranch = false, restartedRepos = [], onEvent, onLog = () => {}, onRehydrate, onSpawn, signal, kaiHome = KAI_HOME, extraEnv = null }) {
   return new Promise((resolve) => {
-    const args = buildRunnerArgs(turn, workDir, profile);
     const env = buildRunnerEnv(turn, profile, kaiHome, extraEnv);
+    const resumable = canResumeSession(turn, workDir, env);
+    // Every follow-up hands the runner its rehydrated task: the prompt when
+    // the session cannot be resumed, the fallback when a resume fails in
+    // the harness (a transcript it cannot load, a Cursor chat that is gone).
+    const rehydration = isContinuationTurn(turn) ? writeRehydratedTask(turn, { hasPriorBranch, restartedRepos, workspaceNote }) : null;
+    if (rehydration && !resumable) onRehydrate?.({ reason: turn.acpSessionId ? "session_not_found" : "no_resume_id" });
+    const args = buildRunnerArgs(turn, workDir, profile, { resumable, workspaceNote, rehydratedTaskFile: rehydration?.file });
     // stdin is the runner's control channel (JSONL: steer / cancel) — see
     // startControlChannel in runner/acp-runner.mjs. Never closed from
     // here; the runner exits on its own when the turn ends.
@@ -186,7 +270,13 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
       }
       onEvent(ev);
     });
-    child.stderr.on("data", (d) => onLog(String(d)));
+    child.stderr.on("data", (d) => {
+      const text = String(d);
+      // The runner's trace when the harness could not resume after all and
+      // the rehydrated task became the prompt (buildPrompt in acp-runner.mjs).
+      if (rehydration && text.includes(" resume.rehydrated")) onRehydrate?.({ reason: "resume_failed" });
+      onLog(text);
+    });
     const onAbort = () => {
       try {
         child.kill("SIGTERM");
@@ -195,9 +285,22 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
       }
     };
     signal?.addEventListener("abort", onAbort, { once: true });
-    child.on("close", (code) => {
+    let settled = false;
+    const finish = (code) => {
+      if (settled) return;
+      settled = true;
       signal?.removeEventListener("abort", onAbort);
+      if (rehydration) rmSync(rehydration.dir, { recursive: true, force: true });
       resolve({ code, result, rateLimited, lastError, errorCode: classifyHarnessFailure(lastError || '') });
+    };
+    // A runner that never started (e.g. a command line the OS refuses)
+    // fails the turn — unhandled, 'error' would take the daemon down. A
+    // failed kill also lands here; its 'close' still follows.
+    child.on("error", (err) => {
+      if (child.pid !== undefined) return;
+      lastError ||= `The runner could not start: ${err.message}`;
+      finish(null);
     });
+    child.on("close", (code) => finish(code));
   });
 }

package/src/rehydration.mjs

@@ -0,0 +1,129 @@
+// Rehydrating a follow-up turn that cannot resume its harness session.
+//
+// Ported from the analyzer (gleap_code_analyzer src/coder/rehydration.ts,
+// GleapSDK/gleap_code_analyzer#73). The runner sends `feedback` INSTEAD of
+// the task whenever it has one (runner/acp-runner.mjs `buildPrompt`), so a
+// follow-up that starts a fresh harness session reached a blank agent
+// holding only the latest message: no original task, no continuation
+// summary, no recent turns. That is every follow-up after the session's
+// PRs merged (the Server clears `analyzerSessionId` in the merge handler)
+// and every one whose transcript this machine no longer has. Such a turn
+// gets one self-contained task instead, built from what the Server already
+// sends with every resume (task, plan, sessionSummary, recentTurns,
+// feedback), and no separate feedback. Keep the sections and tails in sync
+// with the analyzer.
+
+/**
+ * Whether this turn continues an earlier one. On the bridge `sessionId` is
+ * always the canonical Kai Code session id (bridgeService.dispatchTurn
+ * pins it), so it proves nothing; the harness resume id travels as
+ * `acpSessionId`. Everything else matches the analyzer's signal list.
+ */
+export const isContinuationTurn = (turn = {}) =>
+  !!(turn.acpSessionId || turn.feedback || turn.sessionSummary || turn.recentTurns || turn.plan || turn.questionAnswers?.length);
+
+/**
+ * Structured question answers, worded the way the runner puts them in
+ * front of a resumed agent (renderAnswersBlock in runner/acp-runner.mjs).
+ * The runner would send them INSTEAD of the task too, so a rehydrated turn
+ * carries them inside the latest user message.
+ */
+export const renderQuestionAnswers = (answers) => {
+  if (!Array.isArray(answers) || answers.length === 0) return "";
+  const lines = answers.map((a, i) => `${i + 1}. ${Array.isArray(a) ? a.join(", ") : String(a)}`);
+  return `Answers to your questions:\n${lines.join("\n")}`;
+};
+
+/**
+ * Synthesize the first-turn prompt the rehydrated agent receives.
+ * Sections are stitched in order:
+ *   # Original task
+ *   # Approved/Prior plan          (when `plan` is set)
+ *   # Continuation summary         (when `sessionSummary` is set)
+ *   # Recent conversation          (when `recentTurns` is set)
+ *   # Latest user message          (when `feedback` is set)
+ *   <mode-specific tail>
+ *
+ * `hasPriorBranch`: the checkout already carries an earlier turn's work
+ * (on the bridge: a resumed session worktree with commits beyond its base
+ * or uncommitted changes — see hasPriorWork in workspace.mjs).
+ * `restartedRepos`: repositories whose pull request merged, restarted from
+ * the latest base on a new branch (materializeBinding in workspace.mjs).
+ * They are not prior work: their changes ship in a new pull request.
+ */
+export const buildRehydrationTask = (input) => {
+  const sections = [];
+
+  if (input.task) sections.push(`# Original task\n${input.task}`);
+
+  if (input.plan) {
+    const planHeading = input.isPlanMode ? "Prior plan" : "Approved plan";
+    sections.push(`# ${planHeading}\n${input.plan}`);
+  }
+
+  if (input.sessionSummary) {
+    sections.push(`# Continuation summary\n${input.sessionSummary}`);
+  }
+
+  if (input.recentTurns) {
+    sections.push(`# Recent conversation\n${input.recentTurns}`);
+  }
+
+  if (input.feedback) {
+    sections.push(`# Latest user message\n${input.feedback}`);
+  }
+
+  sections.push(buildRehydrationTail(input));
+  return sections.join("\n\n");
+};
+
+/**
+ * The repositories a multi-repo follow-up restarted because their pull
+ * request merged, said after the prior-work tail: that tail alone sends
+ * every repository's changes to "the same PR". Empty without any.
+ */
+export const restartedReposNote = (repos) => {
+  if (!Array.isArray(repos) || repos.length === 0) return "";
+  return repos.length === 1
+    ? ` The pull request for ${repos[0]} merged, so that repository starts from the latest base branch on a new branch; changes there ship in a new pull request.`
+    : ` The pull requests for ${repos.join(", ")} merged, so those repositories start from the latest base branch on new branches; changes there ship in new pull requests.`;
+};
+
+/**
+ * The instruction tail. Picked separately so tests can pin the wording
+ * for each branch independently.
+ */
+export const buildRehydrationTail = (input) => {
+  if (input.isPlanMode && !input.plan) {
+    return "Write the plan for the request above. Respond with the full plan as your final assistant message — that becomes the plan we surface to the user.";
+  }
+  if (input.isPlanMode) {
+    return "Refine the plan above based on the latest user message. Respond with the updated full plan as your final assistant message — that becomes the plan we surface to the user.";
+  }
+  if (input.hasPriorBranch) {
+    return `The repository is checked out on the prior work branch from an earlier turn — prior commits are already there. Run \`git log --oneline -20\` and \`git diff\` against the base branch first to see what's been done, then pick up from where it left off and apply the latest user message if present. The build pipeline will commit and push your new changes to the same PR.${restartedReposNote(input.restartedRepos)}`;
+  }
+  if (input.plan) {
+    return "The user has reviewed and approved the plan above; you are now in build mode. Implement the plan — this is a fresh branch with no prior commits, so make all the changes the plan specifies. Do not re-plan or ask for clarification: implement what was approved. The build pipeline will commit your changes and open a PR afterward.";
+  }
+  return "Continue the task on a fresh branch and apply the latest user message. If it needs code changes, make them; the build pipeline will commit your changes and open a PR afterward. If it only asks for an answer (a question, a reply draft), answer it without changing files.";
+};
+
+/**
+ * The rehydrated task for a bridge turn. `feedback` + `questionAnswers`
+ * are what the user sent this turn, so both land under "Latest user
+ * message" — the same text a resumed session would have been prompted with.
+ * `isPlanMode` = the mode the runner will actually run in (executor.mjs
+ * resolves it from the agent it passes).
+ */
+export const rehydrateTurnTask = (turn, { isPlanMode = !!turn.planMode, hasPriorBranch = false, restartedRepos = [] } = {}) =>
+  buildRehydrationTask({
+    task: turn.task || "",
+    plan: turn.plan,
+    sessionSummary: turn.sessionSummary,
+    recentTurns: turn.recentTurns,
+    feedback: [turn.feedback, renderQuestionAnswers(turn.questionAnswers)].filter(Boolean).join("\n\n"),
+    isPlanMode,
+    hasPriorBranch,
+    restartedRepos,
+  });

package/src/repos.mjs

@@ -23,10 +23,52 @@ export function defaultRoots(home = homedir()) {
   return DEFAULT_ROOT_NAMES.map((n) => join(home, n)).filter((p) => existsSync(p));
 }
 
+const reencodeSegment = (segment) => {
+  try {
+    return encodeURIComponent(decodeURIComponent(segment));
+  } catch {
+    return segment;
+  }
+};
+
+/**
+ * Azure DevOps spells one repository several ways, and the Server keys a
+ * connected repo by its `https://dev.azure.com/{org}/{project}/_git/{repo}`
+ * clone URL (segments URI-encoded). Every spelling maps to that
+ * `{org}/{project}/{repo}` path on dev.azure.com:
+ *   git@ssh.dev.azure.com:v3/{org}/{project}/{repo}           SSH
+ *   {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}   legacy SSH
+ *   https://{org}.visualstudio.com/[DefaultCollection/]{project}/_git/{repo}
+ *   https://dev.azure.com/{org}/_git/{repo}                    repo named like its project
+ * Null for other hosts and shapes (they keep the generic rules).
+ */
+function azureDevOpsPath(host, path) {
+  const segs = path.split("/").filter(Boolean);
+  const canonical = (org, project, repo) => [org, project, repo].map(reencodeSegment).join("/");
+  if (host === "ssh.dev.azure.com" || host === "vs-ssh.visualstudio.com") {
+    return segs.length === 4 && segs[0].toLowerCase() === "v3" ? canonical(segs[1], segs[2], segs[3]) : null;
+  }
+  let org;
+  let rest; // after the org: [project, "_git", repo] or ["_git", repo]
+  const legacy = /^([^.]+)\.visualstudio\.com$/.exec(host);
+  if (host === "dev.azure.com") {
+    [org, ...rest] = segs;
+  } else if (legacy) {
+    org = legacy[1];
+    rest = segs[0]?.toLowerCase() === "defaultcollection" ? segs.slice(1) : segs;
+  } else {
+    return null;
+  }
+  if (org && rest.length === 3 && rest[1].toLowerCase() === "_git") return canonical(org, rest[0], rest[2]);
+  if (org && rest.length === 2 && rest[0].toLowerCase() === "_git") return canonical(org, rest[1], rest[1]);
+  return null;
+}
+
 /**
  * `git@github.com:Gleap/Server.git`, `https://github.com/Gleap/Server`,
  * `ssh://git@bitbucket.org/team/repo.git`, `https://user@dev.azure.com/org/proj/_git/repo`
  * → `{ host, owner, name, key: "host/owner/name" }` (lower-cased, `.git` stripped).
+ * Mirrored by `repoKeyFromUrl` in the Server (src/services/coderepo/repoKey.ts).
  */
 export function normalizeRemote(remote) {
   const raw = String(remote || "").trim();
@@ -56,6 +98,11 @@ export function normalizeRemote(remote) {
     }
   }
   path = path.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
+  const azurePath = azureDevOpsPath(host.toLowerCase(), path);
+  if (azurePath) {
+    host = "dev.azure.com";
+    path = azurePath;
+  }
   // Azure DevOps: org/project/_git/repo → keep org/project as "owner".
   path = path.replace(/\/_git\//, "/");
   const segments = path.split("/").filter(Boolean);
@@ -66,6 +113,22 @@ export function normalizeRemote(remote) {
   return { host: hostLc, owner: owner.toLowerCase(), name: name.toLowerCase(), key: `${hostLc}/${owner.toLowerCase()}/${name.toLowerCase()}` };
 }
 
+/**
+ * A remote as it may leave this machine: userinfo, query and fragment
+ * dropped (`https://x-access-token:<token>@github.com/o/r.git` →
+ * `https://github.com/o/r.git`). `git remote get-url` returns any token in
+ * the URL, and expands `url.<base>.insteadOf` rewrites that add one.
+ * scp-style remotes (`git@github.com:o/r.git`) and local paths are
+ * returned as given. Mirrored by `stripRemoteCredentials` in the Server
+ * (src/api/gleapcode/services/bridge.changes.ts).
+ */
+export function stripRemoteCredentials(remote) {
+  const url = /^([a-z][a-z\d+.-]*:\/\/)([^/?#]*)([^?#]*)/i.exec(remote.trim());
+  if (!url) return remote;
+  const [, scheme, authority, path] = url;
+  return `${scheme}${authority.slice(authority.lastIndexOf("@") + 1)}${path}`;
+}
+
 function git(cwd, args) {
   try {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim();