@gleapai/kai-bridge 0.2.0

package/src/repos.mjs

@@ -0,0 +1,182 @@
+// Repo discovery + identity.
+//
+// The bridge never asks the user to map paths by hand for the common
+// case: it scans a few conventional roots (plus any the user adds), reads
+// each checkout's `origin`, and normalises it to `host/owner/name` so the
+// Server can match it to the org's connected repositories (or offer it as
+// a local-only repo — any git host works). When the same repo is checked
+// out more than once, a PRIMARY is chosen (default-branch checkout wins,
+// then most recently touched) and can be overridden in settings.
+//
+// Pure functions + one fs walker; tests feed synthetic inputs.
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, basename, dirname } from "node:path";
+
+export const DEFAULT_ROOT_NAMES = ["Documents", "code", "dev", "Projects", "projects", "src", "work", "repos", "git"];
+const SKIP_DIRS = new Set(["node_modules", ".git", "Library", "Applications", ".Trash", "vendor", "dist", "build", ".cache"]);
+export const MAX_SCAN_DEPTH = 3;
+
+export function defaultRoots(home = homedir()) {
+  return DEFAULT_ROOT_NAMES.map((n) => join(home, n)).filter((p) => existsSync(p));
+}
+
+/**
+ * `git@github.com:Gleap/Server.git`, `https://github.com/Gleap/Server`,
+ * `ssh://git@bitbucket.org/team/repo.git`, `https://user@dev.azure.com/org/proj/_git/repo`
+ * → `{ host, owner, name, key: "host/owner/name" }` (lower-cased, `.git` stripped).
+ */
+export function normalizeRemote(remote) {
+  const raw = String(remote || "").trim();
+  if (!raw) return null;
+  let host = "";
+  let path = "";
+  // Local / file remotes (bare repos on disk, tests): host "local".
+  if (raw.startsWith("/") || raw.startsWith("file://")) {
+    const p = raw.replace(/^file:\/\//, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+    const segs = p.split("/").filter(Boolean);
+    if (segs.length < 1) return null;
+    const name = segs.pop().toLowerCase();
+    const owner = (segs.pop() || "root").toLowerCase();
+    return { host: "local", owner, name, key: `local/${owner}/${name}` };
+  }
+  const scp = /^(?:[\w.-]+@)?([\w.-]+):(?!\/\/)(.+)$/.exec(raw);
+  if (scp && !raw.includes("://")) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    try {
+      const u = new URL(raw);
+      host = u.hostname;
+      path = u.pathname;
+    } catch {
+      return null;
+    }
+  }
+  path = path.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
+  // Azure DevOps: org/project/_git/repo → keep org/project as "owner".
+  path = path.replace(/\/_git\//, "/");
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const name = segments.pop();
+  const owner = segments.join("/");
+  const hostLc = host.toLowerCase();
+  return { host: hostLc, owner: owner.toLowerCase(), name: name.toLowerCase(), key: `${hostLc}/${owner.toLowerCase()}/${name.toLowerCase()}` };
+}
+
+function git(cwd, args) {
+  try {
+    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim();
+  } catch {
+    return "";
+  }
+}
+
+/** Inspect one checkout. Returns null when it isn't a git repo with an origin. */
+export function inspectCheckout(dir) {
+  if (!existsSync(join(dir, ".git"))) return null;
+  const remote = git(dir, ["remote", "get-url", "origin"]);
+  const id = normalizeRemote(remote);
+  if (!id) return null;
+  const branch = git(dir, ["rev-parse", "--abbrev-ref", "HEAD"]) || "HEAD";
+  const defaultRef = git(dir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]); // origin/main
+  const defaultBranch = defaultRef ? defaultRef.replace(/^origin\//, "") : "";
+  const dirtyCount = git(dir, ["status", "--porcelain"]).split("\n").filter(Boolean).length;
+  const lastTouched = (() => {
+    try {
+      return statSync(join(dir, ".git", "index")).mtimeMs;
+    } catch {
+      return 0;
+    }
+  })();
+  return { path: dir, remote, ...id, branch, defaultBranch, dirtyCount, lastTouched };
+}
+
+/** Walk roots for git checkouts (depth-limited, skips dependency dirs). */
+export function scanRoots(roots, { maxDepth = MAX_SCAN_DEPTH, inspect = inspectCheckout } = {}) {
+  const found = [];
+  const seen = new Set();
+  const walk = (dir, depth) => {
+    if (seen.has(dir)) return;
+    seen.add(dir);
+    const info = inspect(dir);
+    if (info) {
+      found.push(info);
+      return; // nested repos inside a repo are submodules/worktrees — skip
+    }
+    if (depth >= maxDepth) return;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (!e.isDirectory() || e.name.startsWith(".") || SKIP_DIRS.has(e.name)) continue;
+      walk(join(dir, e.name), depth + 1);
+    }
+  };
+  for (const root of roots) walk(root, 0);
+  return found;
+}
+
+/**
+ * Group checkouts by repo key and pick the primary: an explicit override,
+ * else the checkout sitting on the default branch, else the most recently
+ * touched. Returns `[{ key, host, owner, name, primary, checkouts[] }]`.
+ */
+export function groupByRepo(checkouts, overrides = {}) {
+  const groups = new Map();
+  for (const c of checkouts) {
+    const g = groups.get(c.key) ?? { key: c.key, host: c.host, owner: c.owner, name: c.name, checkouts: [] };
+    g.checkouts.push(c);
+    groups.set(c.key, g);
+  }
+  for (const g of groups.values()) {
+    const override = overrides[g.key];
+    const byOverride = override ? g.checkouts.find((c) => c.path === override) : null;
+    const onDefault = g.checkouts.filter((c) => c.defaultBranch && c.branch === c.defaultBranch);
+    const newest = (list) => [...list].sort((a, b) => b.lastTouched - a.lastTouched)[0];
+    g.primary = byOverride ?? (onDefault.length > 0 ? newest(onDefault) : newest(g.checkouts));
+  }
+  return [...groups.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+/** What the Server sees in `hello` / `repos.changed`. Paths stay on the device — only the primary path is sent, for display in the owner's own settings. */
+export function toDeviceRepoReport(groups) {
+  return groups.map((g) => ({
+    key: g.key,
+    host: g.host,
+    owner: g.owner,
+    name: g.name,
+    primaryPath: g.primary.path,
+    branch: g.primary.branch,
+    defaultBranch: g.primary.defaultBranch || null,
+    dirtyCount: g.primary.dirtyCount,
+    checkouts: g.checkouts.length,
+    label: basename(g.primary.path),
+  }));
+}
+
+/**
+ * Where a "Clone here" should land: the directory most of the machine's
+ * repos already live in — cloning next to the user's other checkouts is
+ * what "here" means to them. A bare scan root is only the fallback for a
+ * machine with no repos yet ("~/Documents" is technically the root that
+ * discovered "~/Documents/Gleap/*", but nobody wants a clone in
+ * ~/Documents when 30 repos sit in ~/Documents/Gleap).
+ */
+export function preferredCloneRoot(groups, fallback) {
+  const counts = new Map();
+  for (const g of groups || []) {
+    const parent = g?.primary?.path ? dirname(g.primary.path) : null;
+    if (parent) counts.set(parent, (counts.get(parent) ?? 0) + 1);
+  }
+  let best = null;
+  for (const [dir, n] of counts) {
+    if (!best || n > best.n) best = { dir, n };
+  }
+  return best?.dir ?? fallback ?? null;
+}

package/src/service.mjs

@@ -0,0 +1,162 @@
+// Login-item service: launchd (macOS) / systemd --user (Linux) /
+// Task Scheduler (Windows). Runs `kai-bridge start` at login, restarts
+// on crash, logs under ~/.kai/logs. `kai-bridge install` / `uninstall`.
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+
+export const SERVICE_LABEL = "io.gleap.kai-bridge";
+
+export function servicePaths(home = homedir()) {
+  return {
+    launchdPlist: join(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`),
+    systemdUnit: join(home, ".config", "systemd", "user", "kai-bridge.service"),
+  };
+}
+
+/** The command the service runs — the CLI entry of THIS install. */
+/**
+ * True when the CLI is running out of npm's throwaway `npx` cache. A
+ * service installed from there points at a path npm garbage-collects,
+ * and the device goes Away for good with nothing to show why — so the
+ * installer refuses and asks for a global install instead.
+ */
+export function isEphemeralBinPath(binPath) {
+  return /[\\/]_npx[\\/]|[\\/]\.npm[\\/]_cacache[\\/]/.test(String(binPath || ""));
+}
+
+export function serviceCommand(binPath, nodePath = process.execPath) {
+  return { program: nodePath, args: [binPath, "start"] };
+}
+
+export function renderLaunchdPlist({ program, args, logDir, env = {} }) {
+  const xml = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;");
+  const envXml = Object.entries(env)
+    .map(([k, v]) => `      <key>${xml(k)}</key><string>${xml(v)}</string>`)
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${[program, ...args].map((a) => `    <string>${xml(a)}</string>`).join("\n")}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
+  <key>ThrottleInterval</key><integer>10</integer>
+  <key>ProcessType</key><string>Adaptive</string>
+  <key>StandardOutPath</key><string>${xml(join(logDir, "service.out.log"))}</string>
+  <key>StandardErrorPath</key><string>${xml(join(logDir, "service.err.log"))}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+</dict>
+</plist>
+`;
+}
+
+export function renderSystemdUnit({ program, args, env = {} }) {
+  const q = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
+  return `[Unit]
+Description=Gleap Kai Bridge
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=${[program, ...args].map(q).join(" ")}
+Restart=on-failure
+RestartSec=10
+${Object.entries(env)
+  .map(([k, v]) => `Environment=${k}=${v}`)
+  .join("\n")}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+export function install({ binPath, logDir, env = {} }) {
+  const { program, args } = serviceCommand(binPath);
+  const paths = servicePaths();
+  mkdirSync(logDir, { recursive: true });
+  const os = platform();
+  // PATH: launchd/systemd start with a minimal PATH; the harness binaries
+  // (claude, codex) usually live in the user's shell PATH.
+  // SSH_AUTH_SOCK matters: pushing a branch uses the user's own git auth,
+  // and a LaunchAgent that never saw the agent socket fails every push
+  // with "Permission denied (publickey)" — while the same turn works
+  // perfectly when started from a terminal.
+  const fullEnv = {
+    PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin",
+    HOME: homedir(),
+    ...(process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}),
+    ...env,
+  };
+  if (os === "darwin") {
+    mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
+    writeFileSync(paths.launchdPlist, renderLaunchdPlist({ program, args, logDir, env: fullEnv }));
+    try {
+      execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" });
+    } catch {
+      /* not loaded */
+    }
+    execFileSync("launchctl", ["load", "-w", paths.launchdPlist], { stdio: "ignore" });
+    return { kind: "launchd", path: paths.launchdPlist };
+  }
+  if (os === "linux") {
+    mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });
+    writeFileSync(paths.systemdUnit, renderSystemdUnit({ program, args, env: fullEnv }));
+    execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+    execFileSync("systemctl", ["--user", "enable", "--now", "kai-bridge.service"], { stdio: "ignore" });
+    return { kind: "systemd", path: paths.systemdUnit };
+  }
+  if (os === "win32") {
+    const cmd = `"${program}" ${args.map((a) => `"${a}"`).join(" ")}`;
+    execFileSync("schtasks", ["/Create", "/F", "/SC", "ONLOGON", "/TN", "GleapKaiBridge", "/TR", cmd], { stdio: "ignore" });
+    execFileSync("schtasks", ["/Run", "/TN", "GleapKaiBridge"], { stdio: "ignore" });
+    return { kind: "schtasks", path: "GleapKaiBridge" };
+  }
+  throw new Error(`Unsupported platform ${os}`);
+}
+
+export function uninstall() {
+  const paths = servicePaths();
+  const os = platform();
+  if (os === "darwin" && existsSync(paths.launchdPlist)) {
+    try {
+      execFileSync("launchctl", ["unload", "-w", paths.launchdPlist], { stdio: "ignore" });
+    } catch {
+      /* not loaded */
+    }
+    rmSync(paths.launchdPlist, { force: true });
+    return true;
+  }
+  if (os === "linux" && existsSync(paths.systemdUnit)) {
+    try {
+      execFileSync("systemctl", ["--user", "disable", "--now", "kai-bridge.service"], { stdio: "ignore" });
+    } catch {
+      /* not enabled */
+    }
+    rmSync(paths.systemdUnit, { force: true });
+    return true;
+  }
+  if (os === "win32") {
+    try {
+      execFileSync("schtasks", ["/Delete", "/F", "/TN", "GleapKaiBridge"], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+
+export function isInstalled() {
+  const paths = servicePaths();
+  return platform() === "darwin" ? existsSync(paths.launchdPlist) : platform() === "linux" ? existsSync(paths.systemdUnit) : false;
+}

package/src/setup.mjs

@@ -0,0 +1,261 @@
+// Interactive onboarding — the whole first run in one guided flow:
+//
+//   1. pair this machine with the user's Gleap account
+//   2. offer the background service (start at login, restart on crash)
+//   3. offer harness sign-ins (Claude Code / Codex / Cursor), inline
+//   4. say it's done, nicely
+//
+// Runs from `kai-bridge setup`, from a bare `kai-bridge` on an unpaired
+// machine, and (when npm shows script output — `--foreground-scripts`)
+// straight from `npm i -g @gleapai/kai-bridge`'s postinstall. Re-running is
+// safe: every step detects its current state and offers the next thing,
+// so it doubles as "reconnect", "add a harness", and "log out".
+
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+
+import { BridgeApi } from "./api.mjs";
+import { KAI_HOME, deviceDefaults, loadConfig, saveConfig } from "./config.mjs";
+import { describeHarnesses, installHarness, HARNESS_INFO } from "./harnesses.mjs";
+import { ambientConfigDir, describeProfiles, loginCommand } from "./profiles.mjs";
+import { install, isInstalled, isEphemeralBinPath, uninstall } from "./service.mjs";
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * The background service is MACHINE-global (one launchd/systemd unit, and
+ * it always loads the default ~/.kai), while KAI_HOME can point a CLI run
+ * at any sandbox config. Service install/uninstall must therefore only
+ * happen when this run actually operates on the home the service uses —
+ * a `KAI_HOME=/tmp/test kai-bridge logout` must never take down the real
+ * machine's service.
+ */
+const isServiceHome = () => resolve(KAI_HOME) === resolve(join(homedir(), ".kai"));
+
+// ── Tiny prompt helpers (node:readline — no dependency) ──────────────
+//
+// Lines are buffered and EOF resolves pending questions with "" (the
+// default answer), so a piped stdin — `printf 'y\n' | kai-bridge setup`,
+// CI, or a closed terminal — walks through cleanly instead of throwing
+// "readline was closed" between two slow probe steps.
+function makePrompter({ input = process.stdin, output = process.stdout } = {}) {
+  const rl = createInterface({ input, output });
+  const queue = [];
+  const waiting = [];
+  let closed = false;
+  rl.on("line", (line) => {
+    const next = waiting.shift();
+    if (next) next(line.trim());
+    else queue.push(line.trim());
+  });
+  rl.on("close", () => {
+    closed = true;
+    while (waiting.length > 0) waiting.shift()("");
+  });
+  const ask = (q) => {
+    if (queue.length > 0) {
+      output.write(q + "\n");
+      return Promise.resolve(queue.shift());
+    }
+    if (closed) return Promise.resolve("");
+    output.write(q);
+    return new Promise((res) => waiting.push(res));
+  };
+  return {
+    ask,
+    /** Enter/`y` → true, `n` → false. */
+    async yesNo(q, def = true) {
+      const a = (await ask(`${q} ${def ? "[Y/n]" : "[y/N]"} `)).toLowerCase();
+      if (!a) return def;
+      return a.startsWith("y");
+    },
+    close: () => rl.close(),
+  };
+}
+
+const out = (s = "") => process.stdout.write(s + "\n");
+
+/**
+ * Device-code pairing, shared by `kai-bridge login` and the wizard.
+ * Mutates + saves config on success; throws on denial/timeout.
+ */
+export async function pairDevice({ config, name, print = out }) {
+  const api = new BridgeApi({ apiBase: config.apiBase });
+  const dev = { ...deviceDefaults(), name: name || deviceDefaults().name, version: "0.1.0" };
+  const start = await api.pairStart(dev);
+  const url = start.url || `${config.appBase}/connect-device?code=${start.code}`;
+  print(`\nOpen this link to connect "${dev.name}" to your Gleap account:\n\n  ${url}\n\nCode: ${start.code}\n`);
+  try {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    spawn(opener, process.platform === "win32" ? ["/c", "start", url] : [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* user opens it by hand */
+  }
+  const deadline = Date.now() + 10 * 60_000;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    const poll = await api.pairPoll(start.pollToken);
+    if (poll.status === "approved") {
+      config.device = { id: poll.device.id, name: poll.device.name, token: poll.token, organisationId: poll.device.organisationId, userId: poll.device.userId };
+      saveConfig(config);
+      print(`\nConnected as ${poll.device.name} (${poll.device.organisationName ?? poll.device.organisationId}).`);
+      return poll.device;
+    }
+    if (poll.status === "denied" || poll.status === "expired") throw new Error(`pairing ${poll.status}`);
+    process.stdout.write(".");
+  }
+  throw new Error("pairing timed out");
+}
+
+/**
+ * Disconnect this machine: tell the server (best-effort — works offline
+ * too), stop + remove the background service, forget the pairing locally.
+ * Harness logins are the user's own and stay untouched.
+ */
+export async function logout({ config = loadConfig(), print = out } = {}) {
+  if (!config.device?.token) {
+    print("This machine isn't connected — nothing to log out.");
+    return false;
+  }
+  const name = config.device.name;
+  try {
+    await new BridgeApi({ apiBase: config.apiBase, token: config.device.token }).logout();
+  } catch {
+    print("(Couldn't reach Gleap to revoke the pairing — it was removed locally; you can also remove it under Kai Code → Settings → Devices.)");
+  }
+  if (isServiceHome() && isInstalled()) {
+    uninstall();
+    print("Background service removed.");
+  } else if (isInstalled()) {
+    print("(Background service left untouched — this KAI_HOME isn't the one the service runs on.)");
+  }
+  delete config.device;
+  saveConfig(config);
+  print(`${name} is disconnected from Gleap. Your Claude/Codex logins on this machine are untouched.`);
+  return true;
+}
+
+/** One line per harness with its live state, for the sign-in step. */
+async function harnessRows(config) {
+  const { resolveProfiles } = await import("./daemon.mjs");
+  const resolved = resolveProfiles(config);
+  const described = await describeProfiles(resolved);
+  return describeHarnesses(KAI_HOME).map((h) => {
+    const pick = (list) => list.find((p) => p.harness === h.id && p.kind === "ambient") ?? list.find((p) => p.harness === h.id);
+    return { ...h, profile: pick(described), resolvedProfile: pick(resolved) };
+  });
+}
+
+const rowLine = (h) => {
+  const status = !h.installed
+    ? "not installed"
+    : h.profile?.authState === "signed_in"
+      ? `✓ signed in${h.profile.account ? ` as ${h.profile.account}` : ""}`
+      : "installed · signed out";
+  return `${h.label.padEnd(12)} ${status}`;
+};
+
+/**
+ * The wizard. `binPath` is the CLI entry (for the service plist);
+ * re-runnable at any time.
+ */
+export async function runSetup({ binPath, prompter = makePrompter() } = {}) {
+  const config = loadConfig();
+  out("");
+  out("── Kai Bridge ────────────────────────────────────────────────");
+  out("Run Kai Code sessions on this machine — with your own Claude /");
+  out("Codex / Cursor login, against your local checkouts.");
+  out("");
+
+  try {
+    // 1 ── Pairing ---------------------------------------------------
+    if (config.device?.token) {
+      out(`This machine is already connected as ${config.device.name}.`);
+      const choice = (
+        await prompter.ask("Press Enter to keep it, `r` to reconnect, or `o` to log out and quit: ")
+      ).toLowerCase();
+      if (choice === "o") {
+        await logout({ config });
+        return;
+      }
+      if (choice === "r") {
+        await logout({ config });
+        await pairDevice({ config });
+      }
+    } else {
+      out("Step 1 — connect this machine to your Gleap account.");
+      await pairDevice({ config });
+    }
+    out("");
+
+    // 2 ── Background service ---------------------------------------
+    if (!isServiceHome()) {
+      out("(Custom KAI_HOME — skipping the background service; it always runs on the machine's default ~/.kai.)");
+    } else if (binPath && isEphemeralBinPath(binPath)) {
+      out("(Running via npx — install it with `npm i -g @gleapai/kai-bridge` to add the background service.)");
+    } else if (isInstalled()) {
+      out("Background service: already installed — Kai stays reachable here.");
+    } else if (
+      await prompter.yesNo("Step 2 — keep Kai reachable in the background? Starts at login, restarts after crashes.", true)
+    ) {
+      const res = install({ binPath, logDir: join(KAI_HOME, "logs") });
+      out(`Installed (${res.kind}) — running now, and again after every restart.`);
+    } else {
+      out("Skipped — run `kai-bridge start` whenever you want this machine available.");
+    }
+    out("");
+
+    // 3 ── Harness sign-ins ------------------------------------------
+    out("Step 3 — coding agents on this machine:");
+    let rows = await harnessRows(config);
+    for (const [i, h] of rows.entries()) out(`  ${i + 1}. ${rowLine(h)}`);
+    const pick = await prompter.ask("Sign in / install now? Numbers like `1,3`, or Enter to skip: ");
+    const picked = pick
+      .split(/[\s,]+/)
+      .map((n) => rows[Number(n) - 1])
+      .filter(Boolean);
+    for (const h of picked) {
+      if (!h.installed) {
+        out(`Installing ${h.label}…`);
+        const res = await installHarness(h.id, { kaiHome: KAI_HOME, onLog: out });
+        if (!res.ok) {
+          out(`Couldn't install ${h.label} — skipping (guide: ${HARNESS_INFO[h.id]?.label} docs).`);
+          continue;
+        }
+      }
+      if (h.profile?.authState === "signed_in") {
+        out(`${h.label} is already signed in — nothing to do.`);
+        continue;
+      }
+      const configDir = h.resolvedProfile?.configDir ?? ambientConfigDir(h.id);
+      const c = loginCommand(h.id, configDir);
+      if (!c) {
+        out(`${h.label} has no login command — skipping.`);
+        continue;
+      }
+      out(`\nSigning in to ${h.label} — follow its own prompts:`);
+      await new Promise((res) => spawn(c.cmd, c.args, { env: c.env, stdio: "inherit" }).on("close", res));
+    }
+    if (picked.length > 0) {
+      rows = await harnessRows(config);
+      out("");
+      for (const h of rows) out(`  ${rowLine(h)}`);
+    }
+    out("");
+
+    // 4 ── Done -------------------------------------------------------
+    const name = config.device?.name ?? "This machine";
+    out("──────────────────────────────────────────────────────────────");
+    out(`🎉 All set. ${name} now shows up in Kai Code.`);
+    out("");
+    out("Open Gleap → Kai Code, pick this machine in the Run-on menu,");
+    out("and sessions run right here — on your own subscription, with");
+    out("your local checkouts and dev servers. Happy shipping!");
+    out("");
+    out("Handy later:  kai-bridge status · kai-bridge setup · kai-bridge logout");
+  } finally {
+    prompter.close();
+  }
+}