@gleapai/kai-bridge 0.7.0 → 0.9.0

package/README.md

@@ -1,8 +1,7 @@
-# kai-bridge
+# Kai Code Bridge
 
-Run [Gleap Kai Code](https://gleap.io) sessions on your own machine — with your own
-Claude Code / Codex login — and preview your real dev servers from the dashboard or the
-Gleap app on your phone.
+Run [Gleap Kai Code](https://gleap.io) on your computer or server with your own
+Claude Code / Codex login, local dev-server previews, and photo or video verification.
 
 ```bash
 npm i -g @gleapai/kai-bridge   # one install, so the background service has a stable path
@@ -43,3 +42,28 @@ kai-bridge run --task "Explain the auth flow in this repo" --cwd ~/code/my-app
 
 `npm run sync-runner` copies the ACP runner from a sibling `gleap_code_analyzer` checkout;
 `npm test` runs the unit suite (uses real `git`).
+
+
+### Computers and your own servers
+
+Kai Code offers **Kai Code Cloud** (Gleap's managed execution, using AI credits) or **Kai Code Bridge** (your coding agents on your computer or a server you manage, using your own AI subscriptions).
+
+Run `npm i -g @gleapai/kai-bridge && kai-bridge` in a local terminal or over SSH. The guided setup pairs the device, installs its background service and helps sign in to coding agents. Node.js 20+ and Git are required. On a Linux server, keep the user service running after logout using your system's service configuration; `kai-bridge doctor` reports service status.
+
+Codex and Claude Code ship with Kai Code Bridge. Missing agents can be installed or repaired, and existing agents can be updated independently:
+
+```sh
+kai-bridge harness install codex
+kai-bridge harness update codex
+kai-bridge harness login codex --device-auth
+
+kai-bridge harness install claude
+kai-bridge harness update claude
+kai-bridge harness login claude
+```
+
+Updates install into `~/.kai/harnesses`, verify the new executable, then select it for subsequent sessions. A failed download or startup leaves the previous version selected. Existing versions are retained for running sessions; your global CLI installations and agent logins are not overwritten. `--version <version>` selects a specific package version (for Claude, the Claude Agent SDK package version).
+
+Codex automatically uses device-code sign-in over SSH or on headless Linux. Enable device-code sign-in in the account settings if Codex asks. Claude uses its native `auth login` flow: follow the URL and prompts in the SSH terminal. Dashboard **Sign in** opens a terminal on desktop devices; for headless servers it shows the exact command to run over SSH. The login is picked up automatically.
+
+**Previews are local to the Kai Code Bridge device.** Open them on that computer, on the same network when supported, or use your own SSH port forwarding. Kai Code Bridge does not expose previews through a public tunnel. Screenshot and video verification runs on the Kai Code Bridge device and uploads its evidence to the Kai Code session, so those checks still work on a remote server.

package/bin/kai-bridge.mjs

@@ -7,7 +7,7 @@
 //   kai-bridge install | uninstall   run at login (launchd / systemd / Task Scheduler)
 //   kai-bridge start                 run in the foreground (what the service runs)
 //   kai-bridge status                device, service, profiles, repos
-//   kai-bridge harness list|install <id>|login <id>      Claude Code + Codex are bundled; Cursor is downloaded
+//   kai-bridge harness list|install <id>|update <id>|login <id> [--device-auth]      Claude Code + Codex are bundled; Cursor is downloaded
 //   kai-bridge profile list|add <id> --harness claude|codex|cursor [--label …]|login <id>|remove <id>
 //   kai-bridge repo scan|roots [add <dir>|remove <dir>]|primary <repoKey> <path>
 //   kai-bridge run --task "…" [--model …] [--profile …] [--cwd …]   (local turn, no server)
@@ -89,7 +89,8 @@ async function profile() {
   if (sub === "login") {
     const p = resolveProfiles(config).find((x) => x.id === positional[1]);
     if (!p) fail("unknown profile");
-    const c = loginCommand(p.harness, p.configDir);
+    await installHarness(p.harness, { kaiHome: KAI_HOME, onLog: out });
+    const c = loginCommand(p.harness, p.configDir, KAI_HOME, flags["device-auth"] ? { deviceAuth: true } : undefined);
     if (!c) fail(`${p.harness} is not installed`);
     const child = spawn(c.cmd, c.args, { env: c.env, stdio: "inherit" });
     child.on("close", (code) => process.exit(code ?? 0));
@@ -111,9 +112,9 @@ async function harness() {
     return;
   }
   const id = positional[1];
-  if (!HARNESS_INFO[id]) fail("usage: harness list|install <claude|codex|cursor>|login <id>");
+  if (!HARNESS_INFO[id]) fail("usage: harness list|install <id>|update <id>|login <id> (claude|codex|cursor)");
   if (sub === "install" || sub === "update") {
-    const res = await installHarness(id, { kaiHome: KAI_HOME, onLog: out });
+    const res = await installHarness(id, { kaiHome: KAI_HOME, onLog: out, update: sub === "update", version: typeof flags.version === "string" ? flags.version : undefined });
     if (!res.ok) fail(`${id} is not usable`);
     out(`${HARNESS_INFO[id].label} ${res.version} → ${res.binary}`);
     return;
@@ -123,7 +124,7 @@ async function harness() {
     positional[0] = "login";
     return profile();
   }
-  fail("usage: harness list|install <id>|login <id>");
+  fail("usage: harness list|install <id>|update <id>|login <id> [--device-auth]");
 }
 
 async function repo() {
@@ -280,7 +281,7 @@ try {
 
   setup                            guided onboarding (pair · service · sign-ins)
   login | logout | install | uninstall | start | status | doctor | update
-  harness list|install <id>|login <id>
+  harness list|install <id>|update <id>|login <id> [--device-auth]
   profile list|add <id> --harness claude|codex|cursor|login <id>|remove <id>
   repo scan|roots [add|remove <dir>]|primary <repoKey> <path>
   run --task "…" [--model …] [--profile …] [--cwd …]`);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gleapai/kai-bridge",
-      "version": "0.7.0",
+      "version": "0.9.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.7.0",
-  "description": "Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.",
+  "version": "0.9.0",
+  "description": "Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions, local previews, and photo or video verification.",
   "type": "module",
   "license": "MIT",
   "bin": {
@@ -13,7 +13,6 @@
     "runner",
     "scripts/postinstall.mjs",
     "README.md",
-    "fly",
     "scripts/runtime-smoke.mjs",
     "npm-shrinkwrap.json"
   ],
@@ -52,8 +51,5 @@
     "type": "git",
     "url": "git+https://github.com/GleapSDK/kai-bridge.git"
   },
-  "homepage": "https://gleap.io",
-  "kaiHostedRuntime": {
-    "protocol": 1
-  }
+  "homepage": "https://gleap.io"
 }

package/scripts/runtime-smoke.mjs

@@ -55,6 +55,6 @@ try {
     await initialize(adapter.cmd, adapter.args, { protocolVersion: 1, clientCapabilities: {}, clientInfo: { name: 'kai-runtime-check', version: '1.0.0' } });
   }
   // Imports catch packaging omissions and syntax/dependency failures before boot.
-  await import('../src/daemon.mjs'); await import('../src/codex-broker.mjs');
+  await import('../src/daemon.mjs'); await import('../src/harness-install.mjs');
   console.log('Native CLIs, Codex app-server and both ACP adapters passed isolated startup checks.');
 } finally { rmSync(home, { recursive: true, force: true }); }

package/src/daemon.mjs

@@ -28,9 +28,6 @@ import { BridgeApi, createEventBatcher } from "./api.mjs";
 import { ensureClaudeAcpPatched } from "./acp-patch.mjs";
 import { KAI_HOME, defaultConfig, loadConfig, saveConfig } from "./config.mjs";
 import { runTurn } from "./executor.mjs";
-import { awaitHostedAdmission, hostedResources, syncHostedRepositories } from './hosted.mjs';
-import { HostedTunnel } from './hosted-tunnel.mjs';
-import { hostedLoginExpired, markHostedLoginExpired, hostedLoginRecovery } from './hosted-auth.mjs';
 import { createManagedProfile, describeProfiles, managedConfigDir, ambientConfigDir, openLoginTerminal, probeUsageLimits } from "./profiles.mjs";
 import { defaultRoots, groupByRepo, preferredCloneRoot, scanRoots, toDeviceRepoReport } from "./repos.mjs";
 import { describeBranchChanges, discardChanges, collectChanges, commitAndPush, copyPrimaryEnvFiles, currentBranch, currentHead, materializeBinding, sessionSlug, worktreePath, ensureCommitExcludes } from "./workspace.mjs";
@@ -188,14 +185,6 @@ export class BridgeDaemon {
 
   async hello() {
     const profiles = await describeProfiles(resolveProfiles(this.config, this.kaiHome), this.usageByProfile);
-    if (this.config.hosted) {
-      for (const profile of resolveProfiles(this.config, this.kaiHome)) {
-        if (hostedLoginExpired(profile, this.kaiHome)) {
-          const report = profiles.find(p => p.id === profile.id);
-          if (report) report.authState = 'signed_out';
-        }
-      }
-    }
     const repos = toDeviceRepoReport(this.repoGroups);
     return this.api.hello({
       name: this.config.device?.name,
@@ -272,16 +261,9 @@ export class BridgeDaemon {
     // machine stayed offline until the next login — silently.
     this.heartbeat = setInterval(() => {
       this.api
-        .heartbeat({ running: [...this.running.keys()], ...(this.config.hosted ? { resources: hostedResources(this) } : {}) })
+        .heartbeat({ running: [...this.running.keys()] })
         .catch((err) => this.onApiError("heartbeat", err));
     }, HEARTBEAT_MS);
-    if (this.config.hosted) {
-      this.hostedTunnel = new HostedTunnel({ config: this.config, api: this.api, log: this.log });
-      this.hostedTunnel.connect();
-      void this.hostedTunnel.register('maintenance', 'machine-browser', 6080).catch(err => this.log('warn', 'hosted.browser', { error: err.message }));
-      const sync = () => void syncHostedRepositories(this).catch(err => this.log('warn', 'hosted.repositories', { error: err.message }));
-      sync(); this.hostedRepoTimer = setInterval(sync, 30_000);
-    }
     // Plan-usage windows for the composer popover. Fire-and-forget on a
     // slow cadence, unref'd (the heartbeat keeps the process alive), and
     // NEVER in hello's path — the probe spawns the CLI (~2s per profile).
@@ -409,8 +391,6 @@ export class BridgeDaemon {
     let changed = false;
     const profiles = resolveProfiles(this.config, this.kaiHome);
     for (const harness of MODEL_PROBE_HARNESSES) {
-      // Model probing must not start a second Codex authentication owner.
-      if (this.config.hosted && harness === 'codex') continue;
       // The user's own ~/.claude / ~/.codex first, then any signed-in
       // managed profile — the catalogue is per account, not per profile.
       const candidates = profiles
@@ -480,8 +460,6 @@ export class BridgeDaemon {
     clearInterval(this.usageTimer);
     clearInterval(this.modelsTimer);
     clearInterval(this.updateTimer);
-    clearInterval(this.hostedRepoTimer);
-    this.hostedTunnel?.close();
     if (this.realtimeRetry) clearTimeout(this.realtimeRetry);
     for (const entry of this.running.values()) entry.ctrl.abort();
     const reports = [];
@@ -805,8 +783,6 @@ export class BridgeDaemon {
         }
         return this.startTurn(data);
       case "bridge.turn.cancel":
-        this.hostedCancelled ??= new Set();
-        this.hostedCancelled.add(data.turnId);
         this.running.get(data.turnId)?.ctrl.abort();
         return;
       case "bridge.turn.steer":
@@ -881,7 +857,6 @@ export class BridgeDaemon {
    * how non-github companions get cloned; `note` survives onto error writes.
    */
   async previewStart({ sessionId, title, repos, companionRemotes = null }) {
-    if (this.config.hosted) { this.hostedPreviewWork ??= new Set(); this.hostedPreviewWork.add(sessionId); }
     let lastNote = null;
     const skipped = [];
     // Every report is also RETURNED: the verify turn boots the preview
@@ -889,11 +864,7 @@ export class BridgeDaemon {
     const report = async (payload) => {
       if (payload.note) lastNote = payload.note;
       const body = payload.status === "error" ? { ...payload, urls: payload.urls ?? [], previews: payload.previews ?? [], ...(lastNote && !payload.note ? { note: lastNote } : {}), ...(skipped.length && !payload.skipped ? { skipped } : {}) } : payload;
-      if (['running', 'error'].includes(body.status)) this.hostedPreviewWork?.delete(sessionId);
-      const runner = this.services.get(sessionId);
-      const publicPreview = p => this.config.hosted && runner?.publicUrls?.[p.name] ? { ...p, url: runner.publicUrls[p.name], lanUrl: null } : p;
-      const reportBody = this.config.hosted ? { ...body, previews: body.previews?.map(publicPreview), urls: body.urls?.map(publicPreview), landingUrl: body.previews?.[0] ? publicPreview(body.previews[0]).url : body.landingUrl } : body;
-      await this.api.sessionPreview(sessionId, reportBody).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
+      await this.api.sessionPreview(sessionId, body).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
       return body;
     };
     const fail = (err, ctx = {}) => report(toPreviewErrorPayload(err, { ...ctx, skipped }));
@@ -908,7 +879,7 @@ export class BridgeDaemon {
           return fail(new PreviewError(`Repository ${r.key} is not checked out on this device.`, { code: "companion_missing", repo: r.key }), { repo: r.key });
         }
         const mode = r.mode || this.config.repoModes?.[r.key] || "worktree";
-        const cwd = mode === "local" ? group.primary.path : this.findSessionWorktree(this.config.hosted ? group.key : group.name, sessionId, title);
+        const cwd = mode === "local" ? group.primary.path : this.findSessionWorktree(group.name, sessionId, title);
         if (!cwd || !existsSync(cwd)) {
           return fail(new PreviewError(`The workspace for this session is gone on this device — send Kai a message to recreate it, then start the preview again.`, { code: "other", repo: r.key }), { repo: r.key });
         }
@@ -1073,7 +1044,6 @@ export class BridgeDaemon {
   findSessionWorktree(repoName, sessionId, title) {
     const exact = worktreePath(this.kaiHome, repoName, sessionSlug(sessionId, title));
     if (existsSync(exact)) return exact;
-    if (this.config.hosted) return exact;
     const suffix = `-${String(sessionId || "").slice(-8)}`;
     if (suffix.length < 2) return exact;
     try {
@@ -1162,7 +1132,7 @@ export class BridgeDaemon {
       this.previewIdleTimers.delete(sessionId);
       const runner = this.services.get(sessionId);
       if (!runner) return;
-      if (!this.config.hosted && await this.previewHasConnections(runner)) {
+      if (await this.previewHasConnections(runner)) {
         this.log("info", "preview.idle.connected", { sessionId });
         if (this.services.get(sessionId) === runner) this.armPreviewIdleTimer(sessionId);
         return;
@@ -1195,7 +1165,6 @@ export class BridgeDaemon {
   }
 
   async previewStop({ sessionId }) {
-    this.hostedTunnel?.unregisterSession(sessionId);
     this.manualPreviews?.delete(sessionId);
     this.verifyOwnedPreviews?.delete(sessionId);
     // A sign-in window for this session has nothing left to sign in to.
@@ -1213,7 +1182,6 @@ export class BridgeDaemon {
    * dashboard why — with the classified log line.
    */
   onServiceDied(sessionId, info) {
-    this.hostedTunnel?.unregisterSession(sessionId);
     const runner = this.services.get(sessionId);
     if (!runner) return Promise.resolve();
     this.log("warn", "preview.service.died", { sessionId, name: info.name, code: info.code, errorCode: info.errorCode });
@@ -1243,7 +1211,6 @@ export class BridgeDaemon {
       runner = new ServiceRunner({
         kaiHome: this.kaiHome,
         sessionId,
-        ...(this.hostedTunnel ? { registerPublicService: (name, port, protocol) => this.hostedTunnel.register(sessionId, name, port, protocol) } : {}),
         log: this.log,
         onStatus: (message) => {
           this.log("info", "preview.status", { sessionId, message });
@@ -1269,7 +1236,7 @@ export class BridgeDaemon {
       const mode = r.mode || this.config.repoModes?.[r.key] || "worktree";
       const ws = materializeBinding({
         kaiHome: this.kaiHome,
-        repo: { name: this.config.hosted ? group.key : group.name, primaryPath: group.primary.path, defaultBranch: group.primary.defaultBranch },
+        repo: { name: group.name, primaryPath: group.primary.path, defaultBranch: group.primary.defaultBranch },
         binding: { mode, base: r.base, carryUncommitted: r.carryUncommitted },
         sessionId: turn.sessionId,
         title: turn.title,
@@ -1303,7 +1270,7 @@ export class BridgeDaemon {
       );
       for (const g of others.slice(0, 40)) {
         const base = g.primary.defaultBranch || "main";
-        lines.push(`- ${g.key}: git -C ${g.primary.path} fetch origin ${base} --quiet && git -C ${g.primary.path} worktree add -b kai/${slug} ${worktreePath(this.kaiHome, this.config.hosted ? g.key : g.name, slug)} origin/${base}`);
+        lines.push(`- ${g.key}: git -C ${g.primary.path} fetch origin ${base} --quiet && git -C ${g.primary.path} worktree add -b kai/${slug} ${worktreePath(this.kaiHome, g.name, slug)} origin/${base}`);
       }
       if (others.length > 40) lines.push(`- (${others.length - 40} more repositories on this device — same recipe, path ~/.kai/worktrees/<repo>/${slug})`);
     }
@@ -1320,7 +1287,7 @@ export class BridgeDaemon {
     const adopted = [];
     for (const g of this.repoGroups) {
       if (bound.some((b) => b.key === g.key)) continue;
-      const cwd = worktreePath(this.kaiHome, this.config.hosted ? g.key : g.name, slug);
+      const cwd = worktreePath(this.kaiHome, g.name, slug);
       if (!existsSync(cwd)) continue;
       const branch = currentBranch(cwd);
       if (!branch || branch === "HEAD") continue;
@@ -1333,8 +1300,6 @@ export class BridgeDaemon {
   async startTurn(turn) {
     const { turnId } = turn;
     if (this.running.has(turnId)) return;
-    if (this.config.hosted && !(await awaitHostedAdmission(this, turn))) return;
-    if (this.running.has(turnId)) return;
     const ctrl = new AbortController();
     const entry = { ctrl, control: null, sessionId: turn.sessionId };
     this.running.set(turnId, entry);
@@ -1349,8 +1314,6 @@ export class BridgeDaemon {
     const batcher = createEventBatcher({ api: this.api, turnId, onError: (err) => this.log("warn", "events.post.failed", { error: err.message }) });
     try {
       const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === turn.profileId) ?? { id: "gleap-key", kind: "gleap-key", harness: turn.harness };
-      if (this.config.hosted && (profile.kind === 'gleap-key' || !['codex', 'claude'].includes(profile.harness))) throw new Error('Choose your signed-in Claude Code or Codex profile for this machine.');
-      if (this.config.hosted && hostedLoginExpired(profile, this.kaiHome)) throw new Error(hostedLoginRecovery(profile.harness));
       const bound = this.bindRepos(turn);
       // Multi-repo: the runner's cwd is the first repo; the others are
       // reachable as siblings under the same worktree root or by their
@@ -1434,11 +1397,6 @@ export class BridgeDaemon {
         onLog: (l) => this.log("debug", "runner", { line: l.slice(0, 500) }),
       });
       await batcher.flush();
-      if (this.config.hosted && res.errorCode === 'authentication_required') {
-        markHostedLoginExpired(profile, this.kaiHome);
-        res.lastError = hostedLoginRecovery(profile.harness);
-        await this.hello().catch(() => {});
-      }
       const completed = !ctrl.signal.aborted && res.code === 0 && !res.rateLimited;
       // Plan and verify turns are read-only: worktrees are restored, local
       // checkouts only reported, nothing is ever committed or pushed.
@@ -2501,10 +2459,10 @@ export class BridgeDaemon {
     }
   }
 
-  async harnessInstall({ commandId, harness }) {
+  async harnessInstall({ commandId, harness, update = false }) {
     const lines = [];
     try {
-      const res = await installHarness(harness, { kaiHome: this.kaiHome, onLog: (l) => { lines.push(l); this.log("info", "harness.install", { harness, line: l }); } });
+      const res = await installHarness(harness, { kaiHome: this.kaiHome, update, onLog: (l) => { lines.push(l); this.log("info", "harness.install", { harness, line: l }); } });
       await this.hello();
       if (commandId) await this.api.commandAck(commandId, { ok: res.ok, version: res.version, log: lines });
     } catch (err) {
@@ -2514,24 +2472,34 @@ export class BridgeDaemon {
   }
 
   async profileLogin({ commandId, profileId }) {
-    const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === profileId);
-    if (!profile) throw new Error(`Unknown profile ${profileId}`);
-    if (profile.kind === "managed") createManagedProfile(profile.harness, profile.id, this.kaiHome);
-    // Logins are interactive: open a terminal on this machine running the
-    // harness's own login under the profile's config dir, and re-announce
-    // the profile state once it exits.
-    const child = openLoginTerminal(profile.harness, profile.configDir);
-    if (!child) throw new Error(`Could not open a terminal for ${profile.harness} login on this device.`);
-    child.unref?.();
-    if (commandId) await this.api.commandAck(commandId, { ok: true, opened: "terminal" });
-    const poll = setInterval(() => {
-      this.hello().catch(() => {});
-      // First sign-in for this harness: learn its models as soon as the
-      // login lands (later refreshes ride the slow timer).
-      if (!this.modelsByHarness.has(profile.harness)) void this.refreshHarnessModels();
-    }, 15_000);
-    poll.unref?.();
-    setTimeout(() => clearInterval(poll), 10 * 60_000).unref?.();
+    try {
+      const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === profileId);
+      if (!profile) throw new Error(`Unknown profile ${profileId}`);
+      if (profile.kind === "managed") createManagedProfile(profile.harness, profile.id, this.kaiHome);
+      // Logins are interactive: open a terminal on this machine running the
+      // harness's own login under the profile's config dir, and re-announce
+      // the profile state once it exits.
+      await installHarness(profile.harness, { kaiHome: this.kaiHome });
+      const child = openLoginTerminal(profile.harness, profile.configDir, this.kaiHome);
+      if (child) await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', reject);
+      });
+      child?.unref?.();
+      const command = `kai-bridge profile login '${String(profile.id).replace(/'/g, "'\\''")}'${profile.harness === 'codex' ? ' --device-auth' : ''}`;
+      if (commandId) await this.api.commandAck(commandId, { ok: true, opened: child ? "terminal" : "ssh", ...(!child ? { command } : {}) });
+      const poll = setInterval(() => {
+        this.hello().catch(() => {});
+        // First sign-in for this harness: learn its models as soon as the
+        // login lands (later refreshes ride the slow timer).
+        if (!this.modelsByHarness.has(profile.harness)) void this.refreshHarnessModels();
+      }, 15_000);
+      poll.unref?.();
+      setTimeout(() => clearInterval(poll), 10 * 60_000).unref?.();
+    } catch (err) {
+      if (commandId) await this.api.commandAck(commandId, { ok: false, error: err.message }).catch(() => {});
+      else throw err;
+    }
   }
 }
 

package/src/executor.mjs

@@ -15,8 +15,7 @@ import { fileURLToPath } from "node:url";
 import { ambientConfigDir, managedConfigDir } from "./profiles.mjs";
 import { harnessAcpCommand, harnessBinary } from "./harnesses.mjs";
 import { KAI_HOME } from "./config.mjs";
-import { boundHostedProcess } from './hosted-resources.mjs';
-import { classifyHarnessFailure } from './hosted-auth.mjs';
+import { classifyHarnessFailure } from './harness-errors.mjs';
 
 const RUNNER = join(dirname(fileURLToPath(import.meta.url)), "..", "runner", "acp-runner.mjs");
 const b64 = (v) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v), "utf8").toString("base64");
@@ -79,13 +78,10 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
   for (const [k, v] of Object.entries(extraEnv || {})) if (v != null && v !== "") env[k] = String(v);
   // Never leak the Gleap device token into the harness.
   delete env.KAI_DEVICE_TOKEN;
-  delete env.KAI_BOOTSTRAP_TOKEN;
   // Login, version probes and coding must resolve the same release's binaries.
-  // Hosted Codex replaces this path below with its single-owner RPC transport.
   const native = harnessBinary(profile.harness, kaiHome);
   if (native && profile.harness === 'claude') { env.CLAUDE_CODE_EXECUTABLE = native; env.DISABLE_AUTOUPDATER = '1'; }
   if (native && profile.harness === 'codex') env.CODEX_PATH = native;
-  if (process.env.KAI_HOSTED === '1') env.NODE_OPTIONS = '--max-old-space-size=1536';
   // The daemon's own node first on PATH for the runner, the harness and
   // every shell the agent opens. Under launchd PATH is frozen at install
   // time and a stale /usr/local/bin/node (v20 here) beat the nvm node the
@@ -107,12 +103,6 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
       env.KAI_ACP_CONFIG_DIR = join(kaiHome, "state", profile.id, "cursor");
       mkdirSync(env.KAI_ACP_CONFIG_DIR, { recursive: true });
     } else if (profile.harness === "codex") {
-      if (process.env.KAI_HOSTED === '1') {
-        // A single supervised app-server owns login refresh for every hosted
-        // turn. Per-session config travels over RPC, never through config.toml.
-        env.KAI_ACP_CONFIG_DIR = profileDir;
-        env.CODEX_PATH = join(dirname(fileURLToPath(import.meta.url)), 'codex-broker-client.mjs');
-      } else {
       // The runner writes config.toml (MCP servers, kill-switches) into
       // CODEX_HOME — that must never be the user's real ~/.codex. Use a
       // per-profile session dir seeded with a COPY of auth.json (read-only
@@ -122,7 +112,6 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
       const src = join(profileDir, "auth.json");
       if (existsSync(src)) copyFileSync(src, join(sessionDir, "auth.json"));
       env.KAI_ACP_CONFIG_DIR = sessionDir;
-      }
     } else {
       // Claude: CLAUDE_CONFIG_DIR IS the login dir; the runner reads the
       // transcript from it and passes settings via the SDK, never by file.
@@ -159,8 +148,7 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
     // stdin is the runner's control channel (JSONL: steer / cancel) — see
     // startControlChannel in runner/acp-runner.mjs. Never closed from
     // here; the runner exits on its own when the turn ends.
-    const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, detached: process.env.KAI_HOSTED === '1', stdio: ["pipe", "pipe", "pipe"] });
-    boundHostedProcess(child, { onExceeded: message => { lastError = message; onEvent({ type: 'error', message, code: 'memory_pressure' }); } });
+    const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, stdio: ["pipe", "pipe", "pipe"] });
     child.stdin.on("error", () => {});
     onSpawn?.({
       /** Write one control line; false when the runner is already gone. */
@@ -199,8 +187,7 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
     child.stderr.on("data", (d) => onLog(String(d)));
     const onAbort = () => {
       try {
-        if (process.env.KAI_HOSTED === '1') process.kill(-child.pid, 'SIGTERM');
-        else child.kill("SIGTERM");
+        child.kill("SIGTERM");
       } catch {
         /* gone */
       }

package/src/harness-errors.mjs

@@ -0,0 +1,8 @@
+// Only harness authentication failures invalidate a login. An application's
+// HTTP 401 during validation, a quota limit, or an outage must not sign it out.
+export function classifyHarnessFailure(message = '') {
+  if (/rate.?limit|429|usage limit|out of (extra )?usage/i.test(message)) return 'rate_limited';
+  if (/refresh_token_(reused|expired|invalidated)|not logged in|login (has )?expired|login required|authentication[_ ](?:error|required)|oauth.{0,30}(expired|invalid)|model provider rejected.{0,30}401/i.test(message)) return 'authentication_required';
+  if (/service unavailable|provider.{0,30}(unavailable|outage)|HTTP 50[234]|ECONNRESET|ETIMEDOUT/i.test(message)) return 'provider_unavailable';
+  return null;
+}

package/src/harness-install.mjs

@@ -0,0 +1,73 @@
+import { execFile } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { promisify } from 'node:util';
+
+const exec = promisify(execFile);
+export const HARNESS_PACKAGES = { codex: '@openai/codex', claude: '@anthropic-ai/claude-agent-sdk' };
+const rootFor = (home, harness) => join(home, 'harnesses', harness);
+
+export function managedHarnessRoot(home, harness) {
+  try {
+    const { active } = JSON.parse(readFileSync(join(rootFor(home, harness), 'active.json'), 'utf8'));
+    if (!/^[a-f0-9-]{36}$/.test(active)) return null;
+    const root = join(rootFor(home, harness), 'releases', active);
+    return existsSync(join(root, 'package.json')) ? root : null;
+  } catch { return null; }
+}
+
+async function installPackage(destination, spec) {
+  const npmCli = [process.env.npm_execpath, join(dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js'), join(dirname(process.execPath), '../lib/node_modules/npm/bin/npm-cli.js')]
+    .find(p => p?.endsWith('npm-cli.js') && existsSync(p));
+  if (!npmCli && process.platform === 'win32') throw new Error('npm is missing. Install Node.js with npm, then retry.');
+  const args = ['install', '--prefix', destination, '--ignore-scripts', '--save-exact', '--no-audit', '--no-fund', spec];
+  await exec(npmCli ? process.execPath : 'npm', npmCli ? [npmCli, ...args] : args, {
+    timeout: 5 * 60_000, maxBuffer: 2 * 1024 * 1024,
+  });
+}
+
+/** Download into an isolated release, verify it runs, then atomically select it.
+ * Existing sessions retain their old binaries; profiles and global CLIs are untouched. */
+export async function installManagedHarness({ harness, kaiHome, version = 'latest', resolveBinary, probeVersion, onLog = () => {}, install = installPackage }) {
+  const packageName = HARNESS_PACKAGES[harness];
+  if (!packageName || !/^(latest|\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?)$/.test(version)) throw new Error('Choose a valid coding agent version.');
+  const root = rootFor(kaiHome, harness);
+  mkdirSync(root, { recursive: true });
+  const lock = join(root, '.install-lock');
+  try { mkdirSync(lock); } catch {
+    let abandoned = false;
+    try {
+      const { pid } = JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8'));
+      if (Number.isSafeInteger(pid) && pid > 0) {
+        try { process.kill(pid, 0); } catch (error) { abandoned = error.code === 'ESRCH'; }
+      }
+    } catch { abandoned = Date.now() - statSync(lock).mtimeMs > 10 * 60_000; }
+    if (!abandoned) throw new Error('An installation is already running for this agent. Try again when it finishes.');
+    rmSync(lock, { recursive: true, force: true });
+    try { mkdirSync(lock); } catch { throw new Error('Another agent installation started. Try again when it finishes.'); }
+  }
+  writeFileSync(join(lock, 'owner.json'), JSON.stringify({ pid: process.pid }));
+  const release = randomUUID();
+  const destination = join(root, 'releases', release);
+  const temporary = join(root, `active-${release}.tmp`);
+  let activated = false;
+  try {
+    mkdirSync(destination, { recursive: true });
+    writeFileSync(join(destination, 'package.json'), JSON.stringify({ private: true }));
+    onLog(`Installing ${harness} ${version}…`);
+    await install(destination, `${packageName}@${version}`);
+    const binary = resolveBinary(destination);
+    const detected = binary && await probeVersion(binary);
+    if (!detected) throw new Error('The new coding agent did not start. Your previous version is still selected.');
+    writeFileSync(temporary, JSON.stringify({ active: release, version: detected }), { mode: 0o600 });
+    renameSync(temporary, join(root, 'active.json'));
+    activated = true;
+    onLog(`Ready: ${detected}`);
+    return { ok: true, version: detected, binary };
+  } finally {
+    rmSync(temporary, { force: true });
+    if (!activated) rmSync(destination, { recursive: true, force: true });
+    rmSync(lock, { recursive: true, force: true });
+  }
+}