@gleapai/kai-bridge 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.",
   "type": "module",
   "license": "MIT",

package/runner/lib/acp/harnesses.mjs

@@ -56,6 +56,11 @@ export function pickSessionMode(preferred, available) {
 
 const OPENROUTER_BASE_URL = "https://openrouter.ai/api";
 
+// Backstop turn cap for gateway (non-native-Anthropic) claude-harness
+// runs when the host sends no explicit maxSteps — see the maxTurns spread
+// in the claude harness options below.
+const GATEWAY_FALLBACK_MAX_TURNS = 500;
+
 /**
  * Resolve the adapter binary: explicit override (`KAI_ACP_AGENT_CMD`,
  * JSON `{cmd, args}` — tests and the local bridge's per-profile
@@ -208,7 +213,17 @@ export const HARNESSES = {
           permissionMode: ctx.isPlanMode ? "plan" : ctx.isArtifactWriter ? "dontAsk" : "bypassPermissions",
           ...(ctx.allowedTools?.length ? { allowedTools: ctx.allowedTools } : {}),
           ...(ctx.disallowedTools?.length ? { disallowedTools: ctx.disallowedTools } : {}),
-          ...(ctx.maxSteps ? { maxTurns: ctx.maxSteps } : {}),
+          // Turn cap: explicit maxSteps wins; otherwise native Anthropic
+          // runs uncapped — maxBudgetUsd is the guard, and the CLI can
+          // price its own models. Gateway models get a generous backstop
+          // instead: the CLI prices unknown slugs at ~$0, so the budget
+          // never trips for them and turns are the only in-run guard
+          // that still bites.
+          ...(ctx.maxSteps
+            ? { maxTurns: ctx.maxSteps }
+            : isNativeAnthropic(ctx.model)
+              ? {}
+              : { maxTurns: GATEWAY_FALLBACK_MAX_TURNS }),
           ...(ctx.maxBudgetUsd ? { maxBudgetUsd: ctx.maxBudgetUsd } : {}),
           ...(ctx.additionalDirectories?.length ? { additionalDirectories: ctx.additionalDirectories } : {}),
           settings: {

package/runner/lib/contract.mjs

@@ -336,13 +336,6 @@ export function revertRepoMutations(workDir, baselines = null) {
 const SUPPORTED_FILE_PART_MIME_PREFIXES = ["image/"];
 const SUPPORTED_FILE_PART_MIMES = new Set(["application/pdf"]);
 
-// LEGACY: steps are no longer enforced as a turn limit — budget
-// (--max-budget-usd) is the sole cap (budget-only decision, 2026-06-18).
-// Retained only so `--max-steps` parsing stays backward-compatible
-// (Runner Contract v1); runners parse the value but ignore it for
-// enforcement. Safe to remove once no caller passes --max-steps.
-export const DEFAULT_STEP_CAP = 50;
-
 /**
  * Decode the full runner argv contract into one options object. All
  * flags are optional except `--task-b64`; callers fail fast on an
@@ -355,9 +348,11 @@ export const DEFAULT_STEP_CAP = 50;
  *   --effort <tier>                      low|medium|high|extra_high|max
  *   --session-id <id>                    resume an existing engine session/thread
  *   --max-budget-usd <number>            abort when accumulated cost exceeds
- *   --max-steps <number>                 LEGACY/no-op — steps no longer abort a
- *                                        turn; budget (--max-budget-usd) is the
- *                                        sole limit. Still parsed for compat.
+ *   --max-steps <number>                 explicit turn cap (SDK maxTurns) for
+ *                                        agents that want one; OMITTED = no
+ *                                        turn cap — budget (--max-budget-usd)
+ *                                        is the primary limit (budget-only
+ *                                        decision, 2026-06-18).
  *   --task-b64 <base64>                  REQUIRED — the user prompt
  *   --feedback-b64 <base64>              wrapped follow-up prompt for resumes
  *   --answers-b64 <base64-json>          string[][] question replies
@@ -378,11 +373,13 @@ export function parseRunnerArgs(rawArgs) {
 
   const agent = normalizeAgentName(argv.agent);
 
+  // No default: an absent --max-steps means NO turn cap (the harness then
+  // omits the SDK's maxTurns entirely). Budget/deadline are the real guards.
   const maxSteps = (() => {
     const raw = argv["max-steps"];
-    if (raw == null || raw === true) return DEFAULT_STEP_CAP;
+    if (raw == null || raw === true) return undefined;
     const n = Number(raw);
-    return Number.isFinite(n) && n > 0 ? n : DEFAULT_STEP_CAP;
+    return Number.isFinite(n) && n > 0 ? n : undefined;
   })();
 
   const maxBudgetUsd =

package/src/executor.mjs

@@ -20,7 +20,7 @@ const RUNNER = join(dirname(fileURLToPath(import.meta.url)), "..", "runner", "ac
 const b64 = (v) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v), "utf8").toString("base64");
 
 /** turn.start payload → runner argv (no shell — we spawn node directly). */
-export function buildRunnerArgs(turn, workDir) {
+export function buildRunnerArgs(turn, workDir, profile) {
   const args = ["--task-b64", b64(turn.task || ""), "--work-dir", workDir];
   // The Server's coder payload signals plan mode as `planMode`, not as an
   // agent name (the analyzer host does this same mapping before spawning
@@ -37,8 +37,18 @@ export function buildRunnerArgs(turn, workDir) {
   // hint and mints its own ACP id).
   if (turn.acpSessionId || turn.sessionId) args.push("--session-id", turn.acpSessionId || turn.sessionId);
   if (turn.harness) args.push("--harness", turn.harness);
-  if (turn.maxSteps > 0) args.push("--max-steps", String(Math.floor(turn.maxSteps)));
-  if (turn.maxBudgetUsd > 0) args.push("--max-budget-usd", String(turn.maxBudgetUsd));
+  // BYO turns run uncapped: no --max-steps and no --max-budget-usd, even
+  // when the Server sends them — the work bills the operator's own harness
+  // subscription, so cost guards are the cloud's concern only. An absent
+  // --max-steps means no SDK maxTurns — a deep run must never die with
+  // "Reached maximum number of turns".
+  //
+  // The one exception is the `gleap-key` profile: there the Server hands
+  // the device GLEAP's API key (turn.credentials) and bills the org's AI
+  // credits, so the Server-computed wallet headroom must keep enforcing.
+  if (profile?.kind === "gleap-key" && turn.maxBudgetUsd > 0) {
+    args.push("--max-budget-usd", String(turn.maxBudgetUsd));
+  }
   if (turn.feedback) args.push("--feedback-b64", b64(turn.feedback));
   if (turn.questionAnswers?.length) args.push("--answers-b64", b64(turn.questionAnswers));
   if (turn.attachments?.length) args.push("--attachments-b64", b64(turn.attachments));
@@ -114,7 +124,7 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME) {
  */
 export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, signal, kaiHome = KAI_HOME }) {
   return new Promise((resolve) => {
-    const args = buildRunnerArgs(turn, workDir);
+    const args = buildRunnerArgs(turn, workDir, profile);
     const env = buildRunnerEnv(turn, profile, kaiHome);
     const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, stdio: ["ignore", "pipe", "pipe"] });
     let result = null;