@gleapai/kai-bridge 0.2.2 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.",
   "type": "module",
   "license": "MIT",
@@ -23,8 +23,8 @@
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {
-    "@agentclientprotocol/claude-agent-acp": "0.70.0",
-    "@agentclientprotocol/codex-acp": "1.6.2",
+    "@agentclientprotocol/claude-agent-acp": "0.73.0",
+    "@agentclientprotocol/codex-acp": "1.8.0",
     "@agentclientprotocol/sdk": "1.4.0",
     "@playwright/mcp": "^0.0.79",
     "@sockudo/client": "^2.0.0",
@@ -32,7 +32,7 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.245"
+    "@anthropic-ai/claude-agent-sdk": "0.3.258"
   },
   "exports": {
     ".": "./src/daemon.mjs",

package/runner/lib/acp/harnesses.mjs

@@ -56,6 +56,11 @@ export function pickSessionMode(preferred, available) {
 
 const OPENROUTER_BASE_URL = "https://openrouter.ai/api";
 
+// Backstop turn cap for gateway (non-native-Anthropic) claude-harness
+// runs when the host sends no explicit maxSteps — see the maxTurns spread
+// in the claude harness options below.
+const GATEWAY_FALLBACK_MAX_TURNS = 500;
+
 /**
  * Resolve the adapter binary: explicit override (`KAI_ACP_AGENT_CMD`,
  * JSON `{cmd, args}` — tests and the local bridge's per-profile
@@ -208,7 +213,17 @@ export const HARNESSES = {
           permissionMode: ctx.isPlanMode ? "plan" : ctx.isArtifactWriter ? "dontAsk" : "bypassPermissions",
           ...(ctx.allowedTools?.length ? { allowedTools: ctx.allowedTools } : {}),
           ...(ctx.disallowedTools?.length ? { disallowedTools: ctx.disallowedTools } : {}),
-          ...(ctx.maxSteps ? { maxTurns: ctx.maxSteps } : {}),
+          // Turn cap: explicit maxSteps wins; otherwise native Anthropic
+          // runs uncapped — maxBudgetUsd is the guard, and the CLI can
+          // price its own models. Gateway models get a generous backstop
+          // instead: the CLI prices unknown slugs at ~$0, so the budget
+          // never trips for them and turns are the only in-run guard
+          // that still bites.
+          ...(ctx.maxSteps
+            ? { maxTurns: ctx.maxSteps }
+            : isNativeAnthropic(ctx.model)
+              ? {}
+              : { maxTurns: GATEWAY_FALLBACK_MAX_TURNS }),
           ...(ctx.maxBudgetUsd ? { maxBudgetUsd: ctx.maxBudgetUsd } : {}),
           ...(ctx.additionalDirectories?.length ? { additionalDirectories: ctx.additionalDirectories } : {}),
           settings: {

package/runner/lib/contract.mjs

@@ -336,13 +336,6 @@ export function revertRepoMutations(workDir, baselines = null) {
 const SUPPORTED_FILE_PART_MIME_PREFIXES = ["image/"];
 const SUPPORTED_FILE_PART_MIMES = new Set(["application/pdf"]);
 
-// LEGACY: steps are no longer enforced as a turn limit — budget
-// (--max-budget-usd) is the sole cap (budget-only decision, 2026-06-18).
-// Retained only so `--max-steps` parsing stays backward-compatible
-// (Runner Contract v1); runners parse the value but ignore it for
-// enforcement. Safe to remove once no caller passes --max-steps.
-export const DEFAULT_STEP_CAP = 50;
-
 /**
  * Decode the full runner argv contract into one options object. All
  * flags are optional except `--task-b64`; callers fail fast on an
@@ -355,9 +348,11 @@ export const DEFAULT_STEP_CAP = 50;
  *   --effort <tier>                      low|medium|high|extra_high|max
  *   --session-id <id>                    resume an existing engine session/thread
  *   --max-budget-usd <number>            abort when accumulated cost exceeds
- *   --max-steps <number>                 LEGACY/no-op — steps no longer abort a
- *                                        turn; budget (--max-budget-usd) is the
- *                                        sole limit. Still parsed for compat.
+ *   --max-steps <number>                 explicit turn cap (SDK maxTurns) for
+ *                                        agents that want one; OMITTED = no
+ *                                        turn cap — budget (--max-budget-usd)
+ *                                        is the primary limit (budget-only
+ *                                        decision, 2026-06-18).
  *   --task-b64 <base64>                  REQUIRED — the user prompt
  *   --feedback-b64 <base64>              wrapped follow-up prompt for resumes
  *   --answers-b64 <base64-json>          string[][] question replies
@@ -378,11 +373,13 @@ export function parseRunnerArgs(rawArgs) {
 
   const agent = normalizeAgentName(argv.agent);
 
+  // No default: an absent --max-steps means NO turn cap (the harness then
+  // omits the SDK's maxTurns entirely). Budget/deadline are the real guards.
   const maxSteps = (() => {
     const raw = argv["max-steps"];
-    if (raw == null || raw === true) return DEFAULT_STEP_CAP;
+    if (raw == null || raw === true) return undefined;
     const n = Number(raw);
-    return Number.isFinite(n) && n > 0 ? n : DEFAULT_STEP_CAP;
+    return Number.isFinite(n) && n > 0 ? n : undefined;
   })();
 
   const maxBudgetUsd =

package/src/daemon.mjs

@@ -22,7 +22,8 @@ import { createManagedProfile, describeProfiles, managedConfigDir, ambientConfig
 import { defaultRoots, groupByRepo, preferredCloneRoot, scanRoots, toDeviceRepoReport } from "./repos.mjs";
 import { collectChanges, commitAndPush, copyPrimaryEnvFiles, materializeBinding, sessionSlug, worktreePath, ensureCommitExcludes } from "./workspace.mjs";
 import { ServiceRunner, detectDevConfig, previewMcpServer, readDevConfig } from "./preview.mjs";
-import { describeHarnesses, installHarness } from "./harnesses.mjs";
+import { describeHarnesses, installHarness, probeHarnessAuth } from "./harnesses.mjs";
+import { probeHarnessModels } from "./models.mjs";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -33,6 +34,10 @@ const HELD_LOCKS = new Set();
 const REALTIME_RETRY_MS = 15_000;
 const HEARTBEAT_MS = 30_000;
 const USAGE_REFRESH_MS = 10 * 60_000;
+// Harness model catalogues change on releases, not by the minute.
+const MODELS_REFRESH_MS = 6 * 60 * 60_000;
+/** Harnesses that can tell us which models they offer (Cursor has no such surface). */
+const MODEL_PROBE_HARNESSES = ["claude", "codex"];
 const VERSION = "0.1.0";
 
 export function createLogger(kaiHome = KAI_HOME) {
@@ -102,6 +107,7 @@ export class BridgeDaemon {
     this.services = new Map(); // sessionId → ServiceRunner (lives across turns)
     this.repoGroups = [];
     this.usageByProfile = new Map(); // profileId → plan-usage snapshot (claude only)
+    this.modelsByHarness = new Map(); // harnessId → models the signed-in login offers (see refreshHarnessModels)
     this.stopped = false;
   }
 
@@ -120,7 +126,7 @@ export class BridgeDaemon {
       name: this.config.device?.name,
       platform: platform(),
       version: VERSION,
-      harnesses: describeHarnesses(this.kaiHome).map(({ binary, ...h }) => h),
+      harnesses: this.describeHarnessesWithModels(),
       profiles,
       repos,
       roots: [...defaultRoots(), ...(this.config.roots || [])],
@@ -179,9 +185,63 @@ export class BridgeDaemon {
     void this.refreshUsageLimits();
     this.usageTimer = setInterval(() => void this.refreshUsageLimits(), USAGE_REFRESH_MS);
     this.usageTimer.unref?.();
+    // Which models the local Claude Code / Codex offer — same rules as
+    // the usage probe (spawns the CLI, so off hello's path, never mid-turn).
+    void this.refreshHarnessModels();
+    this.modelsTimer = setInterval(() => void this.refreshHarnessModels(), MODELS_REFRESH_MS);
+    this.modelsTimer.unref?.();
     this.log("info", "started", { device: this.config.device.id });
   }
 
+  /** Install/version state per harness, plus the models it reported (when probed). */
+  describeHarnessesWithModels() {
+    return describeHarnesses(this.kaiHome).map(({ binary, ...h }) => {
+      const models = this.modelsByHarness.get(h.id);
+      return models ? { ...h, models } : h;
+    });
+  }
+
+  /**
+   * Ask each installed harness which models its signed-in login offers
+   * (Claude Code: the SDK's `supportedModels`; Codex: `models_cache.json`)
+   * and, when a list changed, re-announce via hello so the dashboard's
+   * picker lists what THIS machine can actually run — including models
+   * newer than the Server's catalogue. Never while a turn is running:
+   * the Claude probe spawns the CLI under the same login. A failed probe
+   * keeps the previous list (a timeout must not blank the picker); a
+   * signed-out harness clears it.
+   */
+  async refreshHarnessModels() {
+    if (this.stopped || this.running.size > 0) return;
+    let changed = false;
+    const profiles = resolveProfiles(this.config, this.kaiHome);
+    for (const harness of MODEL_PROBE_HARNESSES) {
+      // The user's own ~/.claude / ~/.codex first, then any signed-in
+      // managed profile — the catalogue is per account, not per profile.
+      const candidates = profiles
+        .filter((p) => p.harness === harness && p.kind !== "gleap-key" && p.configDir)
+        .sort((a, b) => Number(b.kind === "ambient") - Number(a.kind === "ambient"));
+      const profile = candidates.find((p) => probeHarnessAuth(harness, p.configDir, this.kaiHome)?.state === "signed_in");
+      let models = null;
+      if (profile) {
+        try {
+          models = await probeHarnessModels(harness, profile.configDir, this.kaiHome);
+        } catch (err) {
+          this.log("warn", "models.probe.failed", { harness, profile: profile.id, error: err?.message });
+          continue;
+        }
+      }
+      const prev = this.modelsByHarness.get(harness) ?? null;
+      if (JSON.stringify(models) !== JSON.stringify(prev)) changed = true;
+      if (models) this.modelsByHarness.set(harness, models);
+      else this.modelsByHarness.delete(harness);
+    }
+    if (changed && !this.stopped) {
+      await this.hello().catch((err) => this.log("warn", "models.hello.failed", { error: err?.message }));
+      this.log("info", "models.refreshed", Object.fromEntries([...this.modelsByHarness].map(([k, v]) => [k, v.length])));
+    }
+  }
+
   /**
    * Probe each claude profile's plan-usage windows and, when anything
    * changed, push the fresh profile list via hello (idempotent $set on
@@ -216,6 +276,7 @@ export class BridgeDaemon {
     this.stopped = true;
     clearInterval(this.heartbeat);
     clearInterval(this.usageTimer);
+    clearInterval(this.modelsTimer);
     if (this.realtimeRetry) clearTimeout(this.realtimeRetry);
     for (const ctrl of this.running.values()) ctrl.abort();
     for (const runner of this.services.values()) runner.stopAll();
@@ -426,6 +487,9 @@ export class BridgeDaemon {
         return;
       case "bridge.rescan":
         await this.scanRepos();
+        // A rescan is the user's "look again" — refresh the model lists too
+        // (hello runs again by itself when they changed).
+        void this.refreshHarnessModels();
         return this.hello();
       case "bridge.repo.clone":
         return this.cloneRepo(data);
@@ -894,7 +958,12 @@ export class BridgeDaemon {
     if (!child) throw new Error(`Could not open a terminal for ${profile.harness} login on this device.`);
     child.unref?.();
     if (commandId) await this.api.commandAck(commandId, { ok: true, opened: "terminal" });
-    const poll = setInterval(() => this.hello().catch(() => {}), 15_000);
+    const poll = setInterval(() => {
+      this.hello().catch(() => {});
+      // First sign-in for this harness: learn its models as soon as the
+      // login lands (later refreshes ride the slow timer).
+      if (!this.modelsByHarness.has(profile.harness)) void this.refreshHarnessModels();
+    }, 15_000);
     poll.unref?.();
     setTimeout(() => clearInterval(poll), 10 * 60_000).unref?.();
   }

package/src/executor.mjs

@@ -20,7 +20,7 @@ const RUNNER = join(dirname(fileURLToPath(import.meta.url)), "..", "runner", "ac
 const b64 = (v) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v), "utf8").toString("base64");
 
 /** turn.start payload → runner argv (no shell — we spawn node directly). */
-export function buildRunnerArgs(turn, workDir) {
+export function buildRunnerArgs(turn, workDir, profile) {
   const args = ["--task-b64", b64(turn.task || ""), "--work-dir", workDir];
   // The Server's coder payload signals plan mode as `planMode`, not as an
   // agent name (the analyzer host does this same mapping before spawning
@@ -37,8 +37,18 @@ export function buildRunnerArgs(turn, workDir) {
   // hint and mints its own ACP id).
   if (turn.acpSessionId || turn.sessionId) args.push("--session-id", turn.acpSessionId || turn.sessionId);
   if (turn.harness) args.push("--harness", turn.harness);
-  if (turn.maxSteps > 0) args.push("--max-steps", String(Math.floor(turn.maxSteps)));
-  if (turn.maxBudgetUsd > 0) args.push("--max-budget-usd", String(turn.maxBudgetUsd));
+  // BYO turns run uncapped: no --max-steps and no --max-budget-usd, even
+  // when the Server sends them — the work bills the operator's own harness
+  // subscription, so cost guards are the cloud's concern only. An absent
+  // --max-steps means no SDK maxTurns — a deep run must never die with
+  // "Reached maximum number of turns".
+  //
+  // The one exception is the `gleap-key` profile: there the Server hands
+  // the device GLEAP's API key (turn.credentials) and bills the org's AI
+  // credits, so the Server-computed wallet headroom must keep enforcing.
+  if (profile?.kind === "gleap-key" && turn.maxBudgetUsd > 0) {
+    args.push("--max-budget-usd", String(turn.maxBudgetUsd));
+  }
   if (turn.feedback) args.push("--feedback-b64", b64(turn.feedback));
   if (turn.questionAnswers?.length) args.push("--answers-b64", b64(turn.questionAnswers));
   if (turn.attachments?.length) args.push("--attachments-b64", b64(turn.attachments));
@@ -114,7 +124,7 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME) {
  */
 export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, signal, kaiHome = KAI_HOME }) {
   return new Promise((resolve) => {
-    const args = buildRunnerArgs(turn, workDir);
+    const args = buildRunnerArgs(turn, workDir, profile);
     const env = buildRunnerEnv(turn, profile, kaiHome);
     const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, stdio: ["ignore", "pipe", "pipe"] });
     let result = null;

package/src/models.mjs

@@ -0,0 +1,186 @@
+// Harness model discovery: which models THIS device's harness logins can
+// run, reported to the Server on `hello` (per harness, next to
+// install/version state) so the dashboard's model picker lists what the
+// local Claude Code / Codex actually offers — not only Gleap's static
+// catalogue. A model the catalogue doesn't know yet (a release newer
+// than the Server's registry) becomes selectable on the device the day
+// the harness ships it.
+//
+//   claude — the Agent SDK's `supportedModels()` control request: the
+//            same list the CLI's own /model picker shows for this login
+//            (subscription tier, `availableModels` allowlist, gateway
+//            settings all applied by the CLI itself). Spawns the CLI
+//            (~2s), so never on hello's path — see the daemon's refresh.
+//   codex  — `<CODEX_HOME>/models_cache.json`, the model catalogue the
+//            Codex CLI fetches for the signed-in ChatGPT account. No
+//            spawn, plain file read.
+//   cursor — no catalogue surface; the dashboard keeps its static list.
+//
+// Ids are namespaced exactly like the Server's registry (`anthropic/…`,
+// `openai/…`) so the harness derivation, the BYO gate and the runner's
+// engine-slug derivation all keep working unchanged.
+
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { harnessBinary } from "./harnesses.mjs";
+import { ambientConfigDir } from "./profiles.mjs";
+
+const HOME = homedir();
+
+/** Harness effort vocabulary → Gleap's effort ids (`extra_high` = CLI `xhigh`). */
+const EFFORT_MAP = { low: "low", medium: "medium", high: "high", xhigh: "extra_high", max: "max" };
+
+export function mapEfforts(levels) {
+  if (!Array.isArray(levels)) return undefined;
+  const out = [];
+  for (const l of levels) {
+    const mapped = EFFORT_MAP[String(l?.effort ?? l)];
+    if (mapped && !out.includes(mapped)) out.push(mapped);
+  }
+  return out;
+}
+
+const cleanLabel = (s, fallback) => {
+  const v = String(s || "").trim();
+  return v || fallback;
+};
+
+/**
+ * Claude Code: the SDK's `ModelInfo[]` → picker rows. Aliases (`sonnet`,
+ * `opus`, `default`) collapse onto the wire id they resolve to
+ * (`resolvedModel`), so the list carries each model once under its
+ * canonical `claude-*` id. Rows the CLI can't name a `claude-*` id for
+ * (custom gateway models) are skipped — the Server's catalogue is the
+ * authority for those.
+ */
+export function claudeModelsFromSdk(infos) {
+  const out = [];
+  const seen = new Set();
+  for (const m of Array.isArray(infos) ? infos : []) {
+    const value = String(m?.value || "").trim();
+    if (!value || value === "default") continue;
+    const canonical = String(m?.resolvedModel || value).trim();
+    if (!canonical.startsWith("claude-")) continue;
+    if (seen.has(canonical)) continue;
+    seen.add(canonical);
+    const row = {
+      id: `anthropic/${canonical}`,
+      label: cleanLabel(m.displayName, canonical),
+      vendor: "Anthropic",
+    };
+    if (canonical.includes("[1m]")) row.tag = "1M";
+    if (m.supportsEffort === false) row.supportedEfforts = [];
+    else if (Array.isArray(m.supportedEffortLevels)) row.supportedEfforts = mapEfforts(m.supportedEffortLevels);
+    out.push(row);
+  }
+  return out;
+}
+
+/**
+ * Codex: `models_cache.json` → picker rows. Only rows Codex itself lists
+ * (`visibility: "list"`; hidden internal SKUs like `codex-auto-review`
+ * stay out), ordered by Codex's own `priority`.
+ */
+export function codexModelsFromCache(cache) {
+  const models = Array.isArray(cache?.models) ? cache.models : [];
+  return models
+    .filter((m) => m && typeof m.slug === "string" && m.slug && (m.visibility ?? "list") === "list")
+    .map((m, i) => ({ m, i }))
+    .sort((a, b) => (a.m.priority ?? 1e9) - (b.m.priority ?? 1e9) || a.i - b.i)
+    .map(({ m }) => {
+      const row = {
+        id: `openai/${m.slug}`,
+        label: cleanLabel(m.display_name, m.slug),
+        vendor: "OpenAI",
+      };
+      if (Number.isFinite(m.context_window) && m.context_window > 0) row.contextWindow = m.context_window;
+      const efforts = mapEfforts(m.supported_reasoning_levels);
+      if (efforts) row.supportedEfforts = efforts;
+      const def = EFFORT_MAP[String(m.default_reasoning_level || "")];
+      if (def && (!efforts || efforts.includes(def))) row.defaultEffort = def;
+      return row;
+    });
+}
+
+export function readCodexModelsCache(configDir) {
+  const file = join(configDir, "models_cache.json");
+  if (!existsSync(file)) return null;
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function withTimeout(promise, ms, what) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+/**
+ * Ask the bundled Claude Code (under the profile's login) which models it
+ * offers. The query never sends a prompt: a gated async iterator keeps
+ * the CLI alive just long enough for the `supportedModels` control
+ * request, then the process is closed. Same env rules as every other
+ * probe: ambient login = leave CLAUDE_CONFIG_DIR unset (macOS keychain),
+ * managed = export the profile dir; never Gleap's API key.
+ */
+export async function probeClaudeModels(configDir, kaiHome = process.env.KAI_HOME || join(HOME, ".kai"), { timeoutMs = 45_000, sdk } = {}) {
+  const bin = harnessBinary("claude", kaiHome);
+  if (!bin) return null;
+  const { query } = sdk ?? (await import("@anthropic-ai/claude-agent-sdk"));
+  const env = { ...process.env };
+  delete env.ANTHROPIC_API_KEY;
+  if (resolve(configDir) === resolve(ambientConfigDir("claude"))) delete env.CLAUDE_CONFIG_DIR;
+  else env.CLAUDE_CONFIG_DIR = configDir;
+  let release;
+  const gate = new Promise((r) => (release = r));
+  async function* idle() {
+    await gate;
+  }
+  const q = query({
+    prompt: idle(),
+    options: {
+      pathToClaudeCodeExecutable: bin,
+      env,
+      cwd: kaiHome,
+      // No project settings, no MCP servers: this is a catalogue read,
+      // not a turn — nothing here may spawn or bill.
+      settingSources: ["user"],
+      strictMcpConfig: true,
+      mcpServers: {},
+    },
+  });
+  try {
+    const infos = await withTimeout(q.supportedModels(), timeoutMs, "claude supportedModels");
+    return claudeModelsFromSdk(infos);
+  } finally {
+    release();
+    try {
+      q.close?.();
+    } catch {
+      /* already gone */
+    }
+  }
+}
+
+export function probeCodexModels(configDir) {
+  const cache = readCodexModelsCache(configDir);
+  return cache ? codexModelsFromCache(cache) : null;
+}
+
+/**
+ * Models a harness offers under the given login dir. `null` = nothing
+ * learned (harness missing, not signed in, probe failed) — the Server
+ * then keeps its catalogue for that harness; an empty array means the
+ * harness answered with no models.
+ */
+export async function probeHarnessModels(harness, configDir, kaiHome, opts) {
+  if (harness === "claude") return probeClaudeModels(configDir, kaiHome, opts);
+  if (harness === "codex") return probeCodexModels(configDir);
+  return null;
+}