@gleapai/kai-bridge 0.6.0 → 0.9.0

package/src/preview.mjs

@@ -1,3 +1,4 @@
+import { previewPorts } from './preview-ports.mjs';
 // Preview tier A — run the app's real dev servers next to the session.
 //
 // Each repo may commit a `.gleap/dev.yaml`:
@@ -304,8 +305,11 @@ export function lanAddress() {
 }
 
 /** `${port:api}` → assigned port of service `api`. */
-export function substitutePorts(value, ports) {
-  return String(value).replace(/\$\{port:([\w-]+)\}/g, (_, name) => String(ports[name] ?? ""));
+export function substitutePorts(value, ports, urls = {}) {
+  return String(value).replace(/\$\{port:([\w-]+)\}/g, (_, name) => String(ports[name] ?? "")).replace(/\$\{url:([\w-]+)\}/g, (_, name) => {
+    if (!urls[name]) throw new Error(`Service URL is not available for ${name}.`);
+    return urls[name];
+  });
 }
 
 /** GET `url` accepting self-signed certificates (dev https); resolves `{ status, contentType }` or null. */
@@ -393,7 +397,8 @@ function spawnShell(cmd, { cwd, env, fd, detached = false }) {
   }
   // Windows has no process groups to kill and `detached` would open a
   // console window — taskkill /T does the tree.
-  return spawn(cmd, { cwd, env, shell: true, stdio: ["ignore", fd, fd], detached: process.platform !== "win32" && detached, windowsHide: true });
+  const child = spawn(cmd, { cwd, env, shell: true, stdio: ["ignore", fd, fd], detached: process.platform !== "win32" && detached, windowsHide: true });
+  return child;
 }
 
 /**
@@ -415,6 +420,7 @@ export class ServiceRunner {
     if (settleMs === DEFAULT_SETTLE_MS) settleMs = defaultSettleMs();
     this.kaiHome = kaiHome;
     this.sessionId = sessionId;
+    this.serviceUrls = {};
     this.log = log;
     this.onStatus = onStatus;
     this.preferredPort = typeof preferredPort === "function" ? preferredPort : null;
@@ -469,8 +475,10 @@ export class ServiceRunner {
       }
       if (this.ports[svc.name]) continue;
       const declared = svc.port;
+      const owner = `${this.sessionId}/${repoRoot}/${svc.name}`;
+      const pinned = !!declared && (mode === 'local' || new RegExp(`(^|[^0-9])${declared}([^0-9]|$)`).test(`${svc.run} ${Object.values(svc.env).join(' ')}`));
       if (declared && !(await isPortListening(declared))) {
-        this.ports[svc.name] = declared;
+        this.ports[svc.name] = await previewPorts.reserve(owner, declared, pinned, isPortListening);
         continue;
       }
       if (declared) {
@@ -498,7 +506,11 @@ export class ServiceRunner {
           });
         }
       }
-      this.ports[svc.name] = (declared ? await findFreePortNear(declared) : await this.stablePort(repoKey, svc.name)) ?? (await getFreePort());
+      const preferred = (declared ? await findFreePortNear(declared) : await this.stablePort(repoKey, svc.name)) ?? (await getFreePort());
+      this.ports[svc.name] = await previewPorts.reserve(owner, preferred, false, isPortListening);
+    }
+    for (const svc of services) {
+      this.serviceUrls[svc.name] = `${svc.protocol || 'http'}://localhost:${this.ports[svc.name]}`;
     }
     this.registered.set(repoRoot, services);
     this.previewNames ??= new Map();
@@ -576,7 +588,7 @@ export class ServiceRunner {
     const env = {
       ...process.env,
       PORT: String(port),
-      ...Object.fromEntries(Object.entries(svc.env).map(([k, v]) => [k, substitutePorts(v, this.ports)])),
+      ...Object.fromEntries(Object.entries(svc.env).map(([k, v]) => [k, substitutePorts(v, this.ports, this.serviceUrls)])),
       KAI_SESSION_ID: String(this.sessionId),
       BROWSER: "none",
     };
@@ -585,10 +597,12 @@ export class ServiceRunner {
     // straight into `command not found` was the #1 preview failure. The
     // install is authoritative: when it fails, the dev command never runs.
     await this.ensureDeps(cwd, { env, fd, logPath, service: name, repoKey });
-    const cmd = stripOpenFlag(substitutePorts(svc.run, this.ports));
+    const cmd = stripOpenFlag(substitutePorts(svc.run, this.ports, this.serviceUrls));
     const child = spawnShell(cmd, { cwd, env, fd, detached: true });
     m.ready = false;
     child.on("exit", (code) => {
+      // An old shell can exit after a replacement has been admitted.
+      if (this.processes.get(name) !== child) return;
       this.processes.delete(name);
       this.onProcess(name, child.pid, "remove");
       this.log("info", "service.exit", { name, code });
@@ -804,7 +818,11 @@ export class ServiceRunner {
     const child = this.processes.get(name);
     if (!child) return;
     this.stopping.add(name);
-    const gone = new Promise((r) => child.once("exit", r));
+    const port = this.ports[name];
+    let timer;
+    const gone = child.exitCode !== null || child.signalCode !== null
+      ? Promise.resolve()
+      : new Promise((r) => child.once("exit", r));
     if (process.platform === "win32") {
       spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }).on("error", () => {});
     } else {
@@ -819,17 +837,29 @@ export class ServiceRunner {
       }
     }
     this.log("info", "service.stop", { name });
-    await Promise.race([gone, new Promise((r) => setTimeout(r, timeoutMs))]);
-    if (this.processes.has(name)) {
+    await Promise.race([gone, new Promise((r) => { timer = setTimeout(r, timeoutMs); })]);
+    clearTimeout(timer);
+    // On Linux the shell may exit before its children close the listener.
+    // Starting the replacement now can mistake that old listener for readiness
+    // and then crash with EADDRINUSE. Wait for the owned service's port too.
+    const deadline = Date.now() + timeoutMs;
+    while (port && await isPortListening(port) && Date.now() < deadline) {
+      await new Promise(r => setTimeout(r, 50));
+    }
+    if (this.processes.get(name) === child || (port && await isPortListening(port))) {
       try {
         process.platform === "win32" ? child.kill() : process.kill(-child.pid, "SIGKILL");
       } catch {
         /* gone */
       }
     }
+    const forceDeadline = Date.now() + 1000;
+    while (port && await isPortListening(port) && Date.now() < forceDeadline) await new Promise(r => setTimeout(r, 50));
+    if (port && await isPortListening(port)) throw new PreviewError(`${name} did not release port ${port}; retry after checking the service.`, { code: 'port_busy', service: name });
   }
 
   stopAll() {
+    previewPorts.releaseSession(this.sessionId);
     for (const [name, child] of this.processes) {
       this.stopping.add(name);
       if (process.platform === "win32") {

package/src/profiles.mjs

@@ -13,7 +13,7 @@
 
 import { execFileSync, spawn } from "node:child_process";
 import { cpSync, existsSync, mkdirSync } from "node:fs";
-import { HARNESS_IDS as REGISTRY_IDS, harnessBinary, harnessLoginCommand, probeHarnessAuth } from "./harnesses.mjs";
+import { HARNESS_IDS as REGISTRY_IDS, harnessBinary, harnessLoginCommand, isHeadless, probeHarnessAuth } from "./harnesses.mjs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -112,8 +112,8 @@ export function createManagedProfile(harness, profileId, kaiHome) {
 }
 
 /** Interactive login for a profile (opens the harness's own flow). */
-export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME || join(HOME, ".kai")) {
-  const c = harnessLoginCommand(harness, configDir, kaiHome);
+export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME || join(HOME, ".kai"), options) {
+  const c = harnessLoginCommand(harness, configDir, kaiHome, options);
   if (!c) return null;
   return { cmd: c.cmd, args: c.args, env: { ...process.env, ...c.env } };
 }
@@ -124,8 +124,9 @@ export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME
  * DEVICE running the login under the profile's config dir. Returns the
  * spawned process or null when no terminal could be opened.
  */
-export function openLoginTerminal(harness, configDir) {
-  const c = loginCommand(harness, configDir);
+export function openLoginTerminal(harness, configDir, kaiHome) {
+  if (isHeadless()) return null;
+  const c = loginCommand(harness, configDir, kaiHome);
   if (!c) return null;
   // Ambient claude must log in with the env untouched so credentials land
   // in the keychain, where the (equally untouched) probe and turns look.
@@ -138,12 +139,15 @@ export function openLoginTerminal(harness, configDir) {
       : harness === "codex"
         ? `CODEX_HOME=${shellQuote(configDir)} `
         : "NO_OPEN_BROWSER=0 ";
-  const line = `${envPrefix}${shellQuote(c.cmd)} login`;
+  const line = `${harness === 'claude' && process.platform !== 'win32' ? 'DISABLE_AUTOUPDATER=1 ' : ''}${envPrefix}${[c.cmd, ...c.args].map(shellQuote).join(' ')}`;
   if (process.platform === "darwin") {
     return spawn("osascript", ["-e", `tell application "Terminal" to activate`, "-e", `tell application "Terminal" to do script ${JSON.stringify(line)}`], { stdio: "ignore", detached: true });
   }
   if (process.platform === "win32") {
-    return spawn("cmd", ["/c", "start", "cmd", "/k", line.replace(/^([A-Z_]+)=('[^']*') /, "set $1=$2 && ")], { stdio: "ignore", detached: true, shell: true });
+    // cmd uses double quotes, and profile variables belong in the child env;
+    // POSIX KEY='value' prefixes are not valid Windows commands.
+    const windowsLine = [c.cmd, ...c.args].map(value => `"${String(value).replace(/"/g, '""')}"`).join(' ');
+    return spawn("cmd", ["/c", "start", '""', "cmd", "/k", windowsLine], { env: { ...c.env, ...(harness === 'claude' ? { DISABLE_AUTOUPDATER: '1' } : {}) }, stdio: "ignore", detached: true, shell: true });
   }
   for (const term of ["x-terminal-emulator", "gnome-terminal", "konsole", "xterm"]) {
     if (findBinary(term)) {

package/src/repository-setup.mjs

@@ -0,0 +1,96 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, rmSync } from 'node:fs';
+import { join, resolve, dirname, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { inspectCheckout, normalizeRemote } from './repos.mjs';
+
+const locks = new Map();
+export function withRepositoryLock(target, action) {
+  const key = resolve(target);
+  const prior = locks.get(key) || Promise.resolve();
+  const work = prior.catch(() => {}).then(action);
+  const tail = work.catch(() => {});
+  locks.set(key, tail);
+  void tail.then(() => { if (locks.get(key) === tail) locks.delete(key); });
+  return work;
+}
+
+export function locateRepository(rawPath, repoKey) {
+  const expanded = String(rawPath || '').trim().replace(/^~(?=$|\/)/, homedir());
+  if (!isAbsolute(expanded)) throw new Error('Enter an absolute folder path on this device.');
+  const target = resolve(expanded);
+  if (!existsSync(target)) throw new Error(`${target} does not exist on this machine.`);
+  // Validate BEFORE recording an override or adding a scan root.
+  if (repoKey && inspectCheckout(target)?.key !== repoKey) {
+    throw new Error(`${target} is not a checkout of ${repoKey}. Choose the folder for that repository.`);
+  }
+  return target;
+}
+
+export function cloneRepository({ remote, name, root, repoKey, timeoutMs = 180_000 }, spawnGit = spawn) {
+  if (typeof remote !== 'string' || !(/^(https?|ssh):\/\/\S+$/i.test(remote) || /^[\w.-]+@[\w.-]+:\S+$/.test(remote))) {
+    return Promise.reject(new Error('This repository has an unsupported clone URL.'));
+  }
+  if (!root || !existsSync(root)) return Promise.reject(new Error('No workspace folder is available. Add a scan folder in device settings.'));
+  if (typeof name !== 'string' || !name || name === '.' || name === '..' || name.startsWith('-') || /[/\\\x00-\x1f]/.test(name)) {
+    return Promise.reject(new Error('Invalid repository folder name.'));
+  }
+  const target = resolve(root, name);
+  if (dirname(target) !== resolve(root)) return Promise.reject(new Error('Invalid repository folder name.'));
+  const expectedKey = repoKey || normalizeRemote(remote)?.key;
+  if (!expectedKey || normalizeRemote(remote)?.key !== expectedKey) return Promise.reject(new Error('The clone URL belongs to a different repository.'));
+  return withRepositoryLock(target, async () => {
+    if (existsSync(target)) {
+      // Another session may have just cloned the same repo. Reuse only an
+      // exact identity match; never touch or remove an existing folder.
+      if (inspectCheckout(target)?.key === expectedKey) return target;
+      throw Object.assign(new Error(`${target} already exists. Use Locate existing to choose the correct checkout.`), { target });
+    }
+    mkdirSync(target); // exclusive reservation; cleanup only what we created
+    try {
+      await new Promise((accept, reject) => {
+        const child = spawnGit('git', ['clone', '--', remote, target], {
+          stdio: ['ignore', 'ignore', 'pipe'],
+          detached: process.platform !== 'win32',
+          env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', SSH_ASKPASS: 'echo',
+            GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || 'ssh -o BatchMode=yes' },
+        });
+        let stderr = '';
+        let timedOut = false;
+        let killTimer;
+        const signalGit = (signal) => {
+          try {
+            // SSH/helpers must exit too before the directory can be cleaned.
+            if (child.pid && process.platform !== 'win32') process.kill(-child.pid, signal);
+            else child.kill(signal);
+          } catch { /* already exited */ }
+        };
+        child.stderr.on('data', (chunk) => { stderr = `${stderr}${chunk}`.slice(-4000); });
+        const timer = setTimeout(() => {
+          timedOut = true;
+          signalGit('SIGTERM');
+          killTimer = setTimeout(() => signalGit('SIGKILL'), 2000);
+        }, timeoutMs);
+        const finish = (err) => {
+          clearTimeout(timer);
+          clearTimeout(killTimer);
+          if (err) reject(err); else accept();
+        };
+        child.on('error', finish);
+        // Wait for exit before deleting the partial clone/releasing the lock.
+        child.on('close', (code) => {
+          const detail = stderr.trim().split('\n').filter(Boolean).slice(-2).join(' · ')
+            .replace(/(https?:\/\/)[^\s/@]+(?::[^\s/@]*)?@/gi, '$1');
+          finish(timedOut ? new Error('Cloning timed out. Check the network and try again.') : code === 0 ? null
+            : new Error(`Could not clone the repository${detail ? `: ${detail}` : '.'}`));
+        });
+      });
+      if (inspectCheckout(target)?.key !== expectedKey) throw new Error('The cloned repository does not match the requested repository.');
+      return target;
+    } catch (err) {
+      rmSync(target, { recursive: true, force: true });
+      err.target = target;
+      throw err;
+    }
+  });
+}

package/src/service.mjs

@@ -70,7 +70,7 @@ export function displayEnv(env = process.env) {
 export function renderSystemdUnit({ program, args, env = {} }) {
   const q = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
   return `[Unit]
-Description=Gleap Kai Bridge
+Description=Kai Code Bridge
 Wants=network-online.target
 After=network-online.target
 

package/src/setup.mjs

@@ -165,7 +165,7 @@ const rowLine = (h) => {
 export async function runSetup({ binPath, prompter = makePrompter() } = {}) {
   const config = loadConfig();
   out("");
-  out("── Kai Bridge ────────────────────────────────────────────────");
+  out("── Kai Code Bridge ────────────────────────────────────────────────");
   out("Run Kai Code sessions on this machine — with your own Claude /");
   out("Codex / Cursor login, against your local checkouts.");
   out("");

package/src/workspace.mjs

@@ -81,7 +81,7 @@ export function materializeBinding({ kaiHome, repo, binding, sessionId, title, b
     // Resume: the worktree from the previous turn is the session state.
     return { cwd: dir, mode, branch, base, resumed: true };
   }
-  mkdirSync(join(kaiHome, "worktrees", repo.name), { recursive: true });
+  mkdirSync(dirname(dir), { recursive: true });
   git(repo.primaryPath, ["fetch", "origin", base, "--quiet"]);
   git(repo.primaryPath, ["worktree", "add", "-b", branch, dir, `origin/${base}`]);
   // A fresh worktree has no node_modules; clone the primary checkout's
@@ -170,16 +170,9 @@ export function discardChanges(cwd) {
 export function removeWorktree({ kaiHome, repo, sessionId, title }) {
   const dir = worktreePath(kaiHome, repo.name, sessionSlug(sessionId, title));
   if (!existsSync(dir)) return false;
-  try {
-    git(repo.primaryPath, ["worktree", "remove", "--force", dir]);
-  } catch {
-    rmSync(dir, { recursive: true, force: true });
-    try {
-      git(repo.primaryPath, ["worktree", "prune"]);
-    } catch {
-      /* best-effort */
-    }
-  }
+  // Never destroy dirty or unpushed work during session cleanup.
+  if (collectChanges(dir).files.length || git(dir, ['log', 'HEAD', '--not', '--remotes', '--oneline'])) return false;
+  git(repo.primaryPath, ['worktree', 'remove', dir]);
   return true;
 }