@gleapai/kai-bridge 0.7.0 → 0.9.0

package/src/harnesses.mjs

@@ -1,18 +1,4 @@
-// Harness registry: which coding agents this device can run, how to find
-// their binaries, install/update them, probe their login, and open a
-// login.
-//
-//   claude — Claude Code. BUNDLED: the ACP adapter ships the Agent SDK,
-//            which ships the CLI. Nothing to install; only a login.
-//   codex  — Codex CLI. BUNDLED by codex-acp. Only a login.
-//   cursor — Cursor Agent CLI. NOT bundled (no npm package); installed by
-//            the bridge from Cursor's release tarball into
-//            ~/.kai/harnesses/cursor/<version>/ and called by path — never
-//            via the vendor's ~/.local/bin/agent symlink (other vendors
-//            use that name too: Grok's CLI on at least one dev machine).
-//
-// "Installed" therefore means: claude/codex always; cursor when the
-// tarball is present. "Signed in" is per profile (see profiles.mjs).
+// Coding agents: bundled defaults, optional managed updates, and per-profile sign-in.
 
 import { execFileSync, spawn } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
@@ -20,6 +6,7 @@ import { arch, homedir, platform } from "node:os";
 import { dirname, join, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from 'node:module';
+import { managedHarnessRoot, installManagedHarness } from './harness-install.mjs';
 
 const PKG = join(dirname(fileURLToPath(import.meta.url)), "..");
 const PKG_BIN = join(PKG, "node_modules", ".bin");
@@ -76,12 +63,12 @@ export function cursorDownloadUrl(version = CURSOR_AGENT_VERSION) {
 }
 
 /** Bundled / installed binary for a harness, or null. */
-export function harnessBinary(harness, kaiHome = join(homedir(), ".kai")) {
+function packageBinary(harness, packageRequire) {
   if (harness === "claude") {
     try {
       // Resolve from the SDK exactly as the ACP adapter does, including nested
       // npm installs and the correct libc. Directory order is not a platform check.
-      const sdkRequire = createRequire(require.resolve('@anthropic-ai/claude-agent-sdk'));
+      const sdkRequire = createRequire(packageRequire.resolve('@anthropic-ai/claude-agent-sdk'));
       const libc = platform() === 'linux' && !process.report.getReport().header.glibcVersionRuntime ? '-musl' : '';
       return sdkRequire.resolve(`@anthropic-ai/claude-agent-sdk-${platform()}-${arch()}${libc}/claude${platform() === 'win32' ? '.exe' : ''}`);
     } catch {
@@ -94,15 +81,25 @@ export function harnessBinary(harness, kaiHome = join(homedir(), ".kai")) {
       if (platform() === 'win32') {
         // execFile/ACP cannot execute a JS entrypoint or .cmd shim directly on
         // Windows. Resolve the same pinned package's native executable there.
-        const codexRequire = createRequire(require.resolve('@openai/codex/package.json'));
+        const codexRequire = createRequire(packageRequire.resolve('@openai/codex/package.json'));
         const root = dirname(codexRequire.resolve(`@openai/codex-win32-${arch()}/package.json`));
         const triple = `${arch() === 'arm64' ? 'aarch64' : 'x86_64'}-pc-windows-msvc`;
         const binary = join(root, 'vendor', triple, 'bin', 'codex.exe');
         return existsSync(binary) ? binary : null;
       }
-      return require.resolve('@openai/codex/bin/codex.js');
+      return packageRequire.resolve('@openai/codex/bin/codex.js');
     } catch { return null; }
   }
+  return null;
+}
+
+export function harnessBinary(harness, kaiHome = process.env.KAI_HOME || join(homedir(), ".kai")) {
+  const managed = managedHarnessRoot(kaiHome, harness);
+  if (managed) {
+    const binary = packageBinary(harness, createRequire(join(managed, "package.json")));
+    if (binary && existsSync(binary)) return binary;
+  }
+  if (harness === "claude" || harness === "codex") return packageBinary(harness, require);
   if (harness === "cursor") {
     const bin = join(CURSOR_CURRENT(kaiHome), "dist-package", platform() === "win32" ? "cursor-agent.exe" : "cursor-agent");
     return existsSync(bin) ? bin : null;
@@ -146,18 +143,22 @@ export function describeHarnesses(kaiHome) {
 }
 
 /**
- * Install (or update) a harness. Bundled ones are no-ops. Cursor:
+ * Install (or update) a coding agent. Cursor:
  * download the release tarball for this platform into
  * ~/.kai/harnesses/cursor/<version>/ and point `current` at it.
  * `onLog(line)` receives progress; resolves `{ ok, version, binary }`.
  */
-export async function installHarness(harness, { kaiHome, onLog = () => {}, version = CURSOR_AGENT_VERSION } = {}) {
+export async function installHarness(harness, { kaiHome = process.env.KAI_HOME || join(homedir(), ".kai"), onLog = () => {}, version, update = false } = {}) {
   if (!HARNESS_IDS.includes(harness)) throw new Error(`unknown harness ${harness}`);
   if (HARNESS_INFO[harness].bundled) {
     const bin = harnessBinary(harness, kaiHome);
-    onLog(`${HARNESS_INFO[harness].label} is bundled with the bridge (${bin ? versionOf(bin) : "missing — run npm install"})`);
-    return { ok: !!bin, version: bin ? versionOf(bin) : null, binary: bin };
+    const currentVersion = bin ? versionOf(bin) : null;
+    if (!update && !version && currentVersion) return { ok: true, version: currentVersion, binary: bin };
+    return installManagedHarness({ harness, kaiHome, version: version || 'latest', onLog,
+      resolveBinary: root => packageBinary(harness, createRequire(join(root, 'package.json'))), probeVersion: versionOf });
   }
+  version ||= CURSOR_AGENT_VERSION;
+  if (!/^[0-9][a-zA-Z0-9.-]*$/.test(version)) throw new Error("Invalid Cursor version.");
   const root = CURSOR_ROOT(kaiHome);
   const target = join(root, version);
   const tmp = join(root, `.tmp-${version}-${process.pid}`);
@@ -197,7 +198,11 @@ export async function installHarness(harness, { kaiHome, onLog = () => {}, versi
 }
 
 /** Interactive login command for a harness under a profile's config dir. */
-export function harnessLoginCommand(harness, configDir, kaiHome) {
+export function isHeadless(env = process.env, os = platform()) {
+  return !!(env.SSH_CONNECTION || env.SSH_TTY || (os === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY));
+}
+
+export function harnessLoginCommand(harness, configDir, kaiHome, { deviceAuth = isHeadless() } = {}) {
   const bin = harnessBinary(harness, kaiHome);
   if (!bin) return null;
   if (harness === "claude") {
@@ -207,7 +212,7 @@ export function harnessLoginCommand(harness, configDir, kaiHome) {
     const env = resolvePath(configDir) !== resolvePath(claudeDefault) ? { CLAUDE_CONFIG_DIR: configDir } : {};
     return { cmd: bin, args: ["auth", "login"], env };
   }
-  if (harness === "codex") return { cmd: bin, args: ["login"], env: { CODEX_HOME: configDir } };
+  if (harness === "codex") return { cmd: bin, args: ["login", ...(deviceAuth ? ["--device-auth"] : [])], env: { CODEX_HOME: configDir } };
   return { cmd: bin, args: ["login"], env: {} };
 }
 

package/src/{hosted-ports.mjs → preview-ports.mjs}

@@ -1,5 +1,5 @@
 // Reserve before boot: two sessions can otherwise choose the same free port.
-export class HostedPortPool {
+export class PreviewPortPool {
   constructor() { this.owners = new Map(); this.tail = Promise.resolve(); }
   reserve(owner, preferred, pinned, listening) {
     const operation = this.tail.then(async () => {
@@ -17,4 +17,4 @@ export class HostedPortPool {
   }
   releaseSession(sessionId) { for (const [port, owner] of this.owners) if (owner.startsWith(`${sessionId}/`)) this.owners.delete(port); }
 }
-export const hostedPorts = new HostedPortPool();
+export const previewPorts = new PreviewPortPool();

package/src/preview.mjs

@@ -1,5 +1,4 @@
-import { hostedPorts } from './hosted-ports.mjs';
-import { boundHostedProcess } from './hosted-resources.mjs';
+import { previewPorts } from './preview-ports.mjs';
 // Preview tier A — run the app's real dev servers next to the session.
 //
 // Each repo may commit a `.gleap/dev.yaml`:
@@ -389,7 +388,6 @@ function lockfileHash(cwd) {
 
 /** Runs `cmd` through the user's login shell (darwin) or the platform shell, capturing output into `fd`. */
 function spawnShell(cmd, { cwd, env, fd, detached = false }) {
-  if (process.env.KAI_HOSTED === '1') { env = { ...env, NODE_OPTIONS: '--max-old-space-size=1024' }; detached = true; }
   if (process.platform !== "win32") cmd = withDaemonNode(cmd);
   if (process.platform === "darwin") {
     // Under launchd the daemon's PATH is frozen at install time
@@ -400,7 +398,6 @@ function spawnShell(cmd, { cwd, env, fd, detached = false }) {
   // Windows has no process groups to kill and `detached` would open a
   // console window — taskkill /T does the tree.
   const child = spawn(cmd, { cwd, env, shell: true, stdio: ["ignore", fd, fd], detached: process.platform !== "win32" && detached, windowsHide: true });
-  boundHostedProcess(child, { limitMb: 1536 });
   return child;
 }
 
@@ -419,12 +416,11 @@ export class ServiceRunner {
    * fires when a service that had become ready dies on its own;
    * `onProcess(name, pid, "add" | "remove")` lets the daemon persist pids.
    */
-  constructor({ kaiHome, sessionId, log = () => {}, onStatus = () => {}, preferredPort = null, describeListener = null, settleMs = DEFAULT_SETTLE_MS, onServiceExit = () => {}, onProcess = () => {}, home = homedir(), registerPublicService = null } = {}) {
+  constructor({ kaiHome, sessionId, log = () => {}, onStatus = () => {}, preferredPort = null, describeListener = null, settleMs = DEFAULT_SETTLE_MS, onServiceExit = () => {}, onProcess = () => {}, home = homedir() } = {}) {
     if (settleMs === DEFAULT_SETTLE_MS) settleMs = defaultSettleMs();
     this.kaiHome = kaiHome;
     this.sessionId = sessionId;
-    this.registerPublicService = registerPublicService;
-    this.publicUrls = {};
+    this.serviceUrls = {};
     this.log = log;
     this.onStatus = onStatus;
     this.preferredPort = typeof preferredPort === "function" ? preferredPort : null;
@@ -479,13 +475,10 @@ export class ServiceRunner {
       }
       if (this.ports[svc.name]) continue;
       const declared = svc.port;
-      if (process.env.KAI_HOSTED === '1') {
-        const pinned = !!declared && (mode === 'local' || new RegExp(`(^|[^0-9])${declared}([^0-9]|$)`).test(`${svc.run} ${Object.values(svc.env).join(' ')}`));
-        this.ports[svc.name] = await hostedPorts.reserve(`${this.sessionId}/${repoRoot}/${svc.name}`, declared || await this.preferredPort?.({ repoKey, service: svc.name }), pinned, isPortListening);
-        continue;
-      }
+      const owner = `${this.sessionId}/${repoRoot}/${svc.name}`;
+      const pinned = !!declared && (mode === 'local' || new RegExp(`(^|[^0-9])${declared}([^0-9]|$)`).test(`${svc.run} ${Object.values(svc.env).join(' ')}`));
       if (declared && !(await isPortListening(declared))) {
-        this.ports[svc.name] = declared;
+        this.ports[svc.name] = await previewPorts.reserve(owner, declared, pinned, isPortListening);
         continue;
       }
       if (declared) {
@@ -513,10 +506,11 @@ export class ServiceRunner {
           });
         }
       }
-      this.ports[svc.name] = (declared ? await findFreePortNear(declared) : await this.stablePort(repoKey, svc.name)) ?? (await getFreePort());
+      const preferred = (declared ? await findFreePortNear(declared) : await this.stablePort(repoKey, svc.name)) ?? (await getFreePort());
+      this.ports[svc.name] = await previewPorts.reserve(owner, preferred, false, isPortListening);
     }
     for (const svc of services) {
-      this.publicUrls[svc.name] = this.registerPublicService ? await this.registerPublicService(svc.name, this.ports[svc.name], svc.protocol) : `${svc.protocol || 'http'}://localhost:${this.ports[svc.name]}`;
+      this.serviceUrls[svc.name] = `${svc.protocol || 'http'}://localhost:${this.ports[svc.name]}`;
     }
     this.registered.set(repoRoot, services);
     this.previewNames ??= new Map();
@@ -594,7 +588,7 @@ export class ServiceRunner {
     const env = {
       ...process.env,
       PORT: String(port),
-      ...Object.fromEntries(Object.entries(svc.env).map(([k, v]) => [k, substitutePorts(v, this.ports, this.publicUrls)])),
+      ...Object.fromEntries(Object.entries(svc.env).map(([k, v]) => [k, substitutePorts(v, this.ports, this.serviceUrls)])),
       KAI_SESSION_ID: String(this.sessionId),
       BROWSER: "none",
     };
@@ -603,7 +597,7 @@ export class ServiceRunner {
     // straight into `command not found` was the #1 preview failure. The
     // install is authoritative: when it fails, the dev command never runs.
     await this.ensureDeps(cwd, { env, fd, logPath, service: name, repoKey });
-    const cmd = stripOpenFlag(substitutePorts(svc.run, this.ports, this.publicUrls));
+    const cmd = stripOpenFlag(substitutePorts(svc.run, this.ports, this.serviceUrls));
     const child = spawnShell(cmd, { cwd, env, fd, detached: true });
     m.ready = false;
     child.on("exit", (code) => {
@@ -865,7 +859,7 @@ export class ServiceRunner {
   }
 
   stopAll() {
-    if (process.env.KAI_HOSTED === '1') hostedPorts.releaseSession(this.sessionId);
+    previewPorts.releaseSession(this.sessionId);
     for (const [name, child] of this.processes) {
       this.stopping.add(name);
       if (process.platform === "win32") {

package/src/profiles.mjs

@@ -13,7 +13,7 @@
 
 import { execFileSync, spawn } from "node:child_process";
 import { cpSync, existsSync, mkdirSync } from "node:fs";
-import { HARNESS_IDS as REGISTRY_IDS, harnessBinary, harnessLoginCommand, probeHarnessAuth } from "./harnesses.mjs";
+import { HARNESS_IDS as REGISTRY_IDS, harnessBinary, harnessLoginCommand, isHeadless, probeHarnessAuth } from "./harnesses.mjs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -112,8 +112,8 @@ export function createManagedProfile(harness, profileId, kaiHome) {
 }
 
 /** Interactive login for a profile (opens the harness's own flow). */
-export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME || join(HOME, ".kai")) {
-  const c = harnessLoginCommand(harness, configDir, kaiHome);
+export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME || join(HOME, ".kai"), options) {
+  const c = harnessLoginCommand(harness, configDir, kaiHome, options);
   if (!c) return null;
   return { cmd: c.cmd, args: c.args, env: { ...process.env, ...c.env } };
 }
@@ -124,8 +124,9 @@ export function loginCommand(harness, configDir, kaiHome = process.env.KAI_HOME
  * DEVICE running the login under the profile's config dir. Returns the
  * spawned process or null when no terminal could be opened.
  */
-export function openLoginTerminal(harness, configDir) {
-  const c = loginCommand(harness, configDir);
+export function openLoginTerminal(harness, configDir, kaiHome) {
+  if (isHeadless()) return null;
+  const c = loginCommand(harness, configDir, kaiHome);
   if (!c) return null;
   // Ambient claude must log in with the env untouched so credentials land
   // in the keychain, where the (equally untouched) probe and turns look.

package/src/service.mjs

@@ -70,7 +70,7 @@ export function displayEnv(env = process.env) {
 export function renderSystemdUnit({ program, args, env = {} }) {
   const q = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
   return `[Unit]
-Description=Gleap Kai Bridge
+Description=Kai Code Bridge
 Wants=network-online.target
 After=network-online.target
 

package/src/setup.mjs

@@ -165,7 +165,7 @@ const rowLine = (h) => {
 export async function runSetup({ binPath, prompter = makePrompter() } = {}) {
   const config = loadConfig();
   out("");
-  out("── Kai Bridge ────────────────────────────────────────────────");
+  out("── Kai Code Bridge ────────────────────────────────────────────────");
   out("Run Kai Code sessions on this machine — with your own Claude /");
   out("Codex / Cursor login, against your local checkouts.");
   out("");

package/src/workspace.mjs

@@ -15,7 +15,6 @@
 import { execFileSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { createHash } from 'node:crypto';
 
 import { seedNodeModules } from "./deps.mjs";
 
@@ -24,18 +23,13 @@ function git(cwd, args, opts = {}) {
 }
 
 export function sessionSlug(sessionId, title) {
-  if (process.env.KAI_HOSTED === '1') {
-    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(String(sessionId))) throw new Error('Invalid session identity.');
-    return `session-${sessionId}`;
-  }
   const t = String(title || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 32);
   const id = String(sessionId || "").slice(-8);
   return t ? `${t}-${id}` : `session-${id}`;
 }
 
 export function worktreePath(kaiHome, repoName, slug) {
-  const repo = process.env.KAI_HOSTED === '1' ? createHash('sha256').update(String(repoName)).digest('hex') : repoName;
-  return join(kaiHome, "worktrees", repo, slug);
+  return join(kaiHome, "worktrees", repoName, slug);
 }
 
 /**
@@ -176,22 +170,9 @@ export function discardChanges(cwd) {
 export function removeWorktree({ kaiHome, repo, sessionId, title }) {
   const dir = worktreePath(kaiHome, repo.name, sessionSlug(sessionId, title));
   if (!existsSync(dir)) return false;
-  if (process.env.KAI_HOSTED === '1') {
-    // Never destroy dirty or unpushed work during session cleanup.
-    if (collectChanges(dir).files.length || git(dir, ['log', '--branches', '--not', '--remotes', '--oneline'])) return false;
-    git(repo.primaryPath, ['worktree', 'remove', dir]);
-    return true;
-  }
-  try {
-    git(repo.primaryPath, ["worktree", "remove", "--force", dir]);
-  } catch {
-    rmSync(dir, { recursive: true, force: true });
-    try {
-      git(repo.primaryPath, ["worktree", "prune"]);
-    } catch {
-      /* best-effort */
-    }
-  }
+  // Never destroy dirty or unpushed work during session cleanup.
+  if (collectChanges(dir).files.length || git(dir, ['log', 'HEAD', '--not', '--remotes', '--oneline'])) return false;
+  git(repo.primaryPath, ['worktree', 'remove', dir]);
   return true;
 }
 

package/fly/Dockerfile

@@ -1,11 +0,0 @@
-FROM node:24-bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl sudo openssh-client lsof procps supervisor xvfb fluxbox x11vnc novnc websockify python3 make g++ && rm -rf /var/lib/apt/lists/*
-RUN useradd --home-dir /data/home/kai --shell /bin/bash kai && printf 'kai ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/kai && chmod 440 /etc/sudoers.d/kai
-WORKDIR /opt/kai-bridge
-COPY package.json package-lock.json ./
-RUN npm ci --ignore-scripts
-COPY . .
-ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
-RUN node scripts/postinstall.mjs && node scripts/runtime-smoke.mjs && chmod +x src/codex-broker-client.mjs src/hosted-git.mjs fly/runtime-cli.sh fly/entrypoint.sh fly/login-codex.sh && for cli in codex claude git; do ln -s /opt/kai-bridge/fly/runtime-cli.sh /usr/local/bin/$cli; done && npx playwright install --with-deps chromium
-ENV KAI_HOSTED=1 KAI_HOME=/data/home/kai/.kai HOME=/data/home/kai KAI_BRIDGE_NO_SELF_UPDATE=1 DISABLE_AUTOUPDATER=1
-ENTRYPOINT ["/opt/kai-bridge/fly/entrypoint.sh"]

package/fly/UPDATES.md

@@ -1,76 +0,0 @@
-# Hosted coding runtime releases
-
-One Bridge release owns the complete coding runtime: Codex CLI, Claude Agent SDK
-(including its native Claude Code binary), both ACP adapters, Bridge and its
-runner. Versions are pinned in package.json and package-lock.json. The image no
-longer installs separate global CLIs. `codex`, `claude`, login, version probes,
-coding turns and the supervised Codex process all resolve this bundle.
-
-## Routine updates
-
-Dependabot checks npm dependencies daily and groups the coding runtime changes.
-The `Coding runtime compatibility` workflow runs the full Bridge tests, native
-CLI versions, Codex app-server and both ACP initialization checks, package checks
-and the Linux image build. Vendor CLI updates are disabled for the managed
-executables so they cannot mutate a tested bundle underneath active sessions.
-
-After review and internal qualification, publish a new Bridge version and promote
-that exact version to the npm `hosted-stable` dist-tag. Promotion is a release
-operation, never something a customer VM decides from upstream `latest` versions.
-The channel is intentionally separate from `latest`, which connected devices use.
-No tag is published or promoted merely by adding this workflow.
-
-`npm pack`/`npm publish` generate a published npm-shrinkwrap.json from the committed
-lockfile. Consumers therefore receive the dependency tree that was tested. The
-temporary shrinkwrap is removed after packing. Always bump the Bridge version and
-refresh its lockfile for a new release; npm versions are immutable.
-
-Each hosted machine checks `hosted-stable` on a normal start, at most once per day.
-It does not wake a stopped machine to check. Updates only happen **before
-supervisord starts**, under a file lock; running coding, validation, previews,
-maintenance and login processes are never hot-replaced. A machine that remains
-running applies updates on its next normal stop/start.
-
-The updater downloads an exact release, checks protocol compatibility, installs
-the shrinkwrapped dependencies with lifecycle scripts disabled, and runs native
-startup checks with an empty temporary home. It selects the new bundle atomically
-only after those checks pass. Registry failures, invalid releases, failed checks
-and interrupted installs preserve the previous selection. Failed versions are
-quarantined; the next distinct approved version can still update.
-
-Runtime files are stored under `/opt/kai-runtime`. User repositories, worktrees,
-home directories and authentication remain on `/data` and are never copied or
-overwritten by updates. The current and one previous installed bundle are kept.
-This does not rebuild the VM, reset its usage allowance, or require a new login.
-Setup/update running time still counts against the slot allowance.
-
-## Rollback and support
-
-Inspect `/opt/kai-runtime/state.json` for the active version, previous version,
-last check, failed version and update error. Bridge's normal version/harness
-reports show the selected executable versions in Gleap. Updates can be disabled
-with the machine environment `KAI_HOSTED_RUNTIME_UPDATES=0`.
-
-If a runtime passes startup checks but later proves incompatible, schedule a
-rollback through maintenance SSH:
-
-```sh
-sudo node /opt/kai-bridge/fly/runtime-update.mjs --rollback-next-start
-```
-
-Then stop and start the machine through Gleap. This selects the retained previous
-bundle (or the image's original bundle), preserves credentials/files and
-quarantines the rejected release. The command does not interrupt current work.
-Do not run `npm update` inside active release directories.
-
-The startup checks exercise real binaries and protocol initialization without
-account credentials or billable prompts. They do not replace authenticated
-two-session coding/refresh/verification tests on the internal cohort before
-promoting `hosted-stable`. A startup pass cannot guarantee compatibility with
-every provider-side behavior. Keep the previous runtime available for rollback.
-
-Changing the bootstrap protocol, OS packages, browser revision or persistent data formats requires
-an explicit image/migration release; the boot updater rejects unsupported
-protocol versions and Playwright revisions that differ from the image's installed
-browser. System modifications survive normal starts as configured by
-Fly root-filesystem persistence.

package/fly/codex-auth.mjs

@@ -1,5 +0,0 @@
-import { startCodexBroker } from '../src/codex-broker.mjs';
-import { mkdirSync } from 'node:fs';
-mkdirSync('/data/home/kai/.codex', { recursive: true });
-const broker = startCodexBroker();
-process.on('SIGTERM', () => { broker.close(); process.exit(0); });

package/fly/entrypoint.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-set -eu
-mkdir -p /data/home/kai/.codex /data/home/kai/.claude /data/repos /data/logs
-chown kai:kai /data/home/kai /data/home/kai/.codex /data/home/kai/.claude /data/repos /data/logs
-touch /run/kai-runtime-update.lock
-chown root:kai /run/kai-runtime-update.lock
-chmod 660 /run/kai-runtime-update.lock
-# The lock and boot boundary keep installations away from coding/login/preview
-# processes. Failed or interrupted updates keep the previous validated bundle.
-KAI_RUNTIME_ROOT="$(flock /run/kai-runtime-update.lock node /opt/kai-bridge/fly/runtime-update.mjs)"
-export KAI_RUNTIME_ROOT
-exec /usr/bin/supervisord -n -c /opt/kai-bridge/fly/supervisord.conf

package/fly/login-codex.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-set -eu
-# Pause the single refresh owner while native device authentication updates it.
-exec 9>/data/codex-login.lock
-flock -n 9 || { echo 'Another Codex sign-in is already in progress.'; exit 1; }
-control='/opt/kai-bridge/fly/supervisord.conf'
-supervisorctl -c "$control" stop codex-auth
-trap 'supervisorctl -c "$control" start codex-auth' EXIT
-sudo -iu kai codex login --device-auth

package/fly/runtime-cli.mjs

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import { basename, join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { spawn } from 'node:child_process';
-import { runtimeRoot } from './runtime-update.mjs';
-
-const root = process.env.KAI_RUNTIME_ROOT || runtimeRoot();
-const name = process.env.KAI_RUNTIME_CLI_NAME || basename(process.argv[1]).replace(/\.mjs$/, '');
-const { harnessBinary } = await import(pathToFileURL(join(root, 'src/harnesses.mjs')));
-const command = name === 'git' ? process.execPath : harnessBinary(name);
-if (!command) { process.stderr.write('The selected Kai runtime is missing this executable.\n'); process.exit(1); }
-const args = name === 'git' ? [join(root, 'src/hosted-git.mjs'), ...process.argv.slice(2)] : process.argv.slice(2);
-const child = spawn(command, args, { stdio: 'inherit', env: { ...process.env, KAI_RUNTIME_ROOT: root, DISABLE_AUTOUPDATER: '1' } });
-child.on('error', () => process.exit(1));
-child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 1); });

package/fly/runtime-cli.sh

@@ -1,10 +0,0 @@
-#!/bin/sh
-set -eu
-KAI_RUNTIME_CLI_NAME="${0##*/}"
-export KAI_RUNTIME_CLI_NAME
-# Startup validation has an isolated HOME and already holds the exclusive lock.
-if [ "${KAI_RUNTIME_UPDATE_CHECK:-0}" = '1' ]; then
-  exec node /opt/kai-bridge/fly/runtime-cli.mjs "$@"
-fi
-# A native CLI opened through maintenance SSH waits for an in-progress update.
-exec flock --shared /run/kai-runtime-update.lock node /opt/kai-bridge/fly/runtime-cli.mjs "$@"

package/fly/runtime-launch.mjs

@@ -1,8 +0,0 @@
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { runtimeRoot } from './runtime-update.mjs';
-const entry = { bridge: 'start.mjs', 'codex-auth': 'codex-auth.mjs' }[process.argv[2]];
-if (!entry) throw new Error('Unknown hosted runtime service.');
-const root = process.env.KAI_RUNTIME_ROOT || runtimeRoot();
-process.env.KAI_RUNTIME_ROOT = root;
-await import(pathToFileURL(join(root, 'fly', entry)));

package/fly/runtime-update.mjs

@@ -1,137 +0,0 @@
-import { execFile } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { isNewer } from '../src/selfupdate.mjs';
-
-const exec = promisify(execFile);
-export const BASE_RUNTIME = '/opt/kai-bridge';
-export const RUNTIME_STORE = '/opt/kai-runtime';
-const CHANNEL = 'https://registry.npmjs.org/@gleapai/kai-bridge/hosted-stable';
-const DAY = 86400_000;
-const version = value => typeof value === 'string' && /^\d+\.\d+\.\d+$/.test(value);
-const read = path => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return {}; } };
-const packageAt = root => read(join(root, 'package.json'));
-export function browserVersion(root) {
-  const lock = read(join(root, existsSync(join(root, 'npm-shrinkwrap.json')) ? 'npm-shrinkwrap.json' : 'package-lock.json'));
-  return lock.packages?.['node_modules/playwright-core']?.version;
-}
-
-export function assertImageCompatibility(candidate, base) {
-  // Chromium is installed by the image, outside the replaceable runtime. Never
-  // activate a new Playwright revision against the old browser executable.
-  if (!browserVersion(candidate) || browserVersion(candidate) !== browserVersion(base)) {
-    throw Object.assign(new Error('This release needs a browser image update.'), { code: 'image_required' });
-  }
-}
-
-export function runtimeRoot(store = RUNTIME_STORE, base = BASE_RUNTIME) {
-  const state = read(join(store, 'state.json'));
-  const candidate = version(state.active) ? join(store, 'releases', state.active) : base;
-  return existsSync(join(candidate, 'package.json')) ? candidate : base;
-}
-
-function save(store, state) {
-  mkdirSync(store, { recursive: true });
-  const temporary = join(store, `state.${process.pid}.tmp`);
-  writeFileSync(temporary, JSON.stringify(state, null, 2) + '\n', { mode: 0o644 });
-  renameSync(temporary, join(store, 'state.json'));
-}
-
-export function supervisorRunning() {
-  const pid = Number(readFileText('/run/supervisord.pid'));
-  if (!Number.isSafeInteger(pid) || pid <= 1) return false;
-  try { process.kill(pid, 0); return true; } catch { return false; }
-}
-const readFileText = path => { try { return readFileSync(path, 'utf8').trim(); } catch { return ''; } };
-
-export function requestRuntimeRollback(store = RUNTIME_STORE) {
-  const state = read(join(store, 'state.json'));
-  if (!state.active || !state.previousVersion) throw new Error('No previous runtime is available.');
-  writeFileSync(join(store, 'rollback-next-start'), '1\n', { mode: 0o600 });
-}
-
-export async function fetchHostedRelease() {
-  const response = await fetch(CHANNEL, { signal: AbortSignal.timeout(8000), headers: { accept: 'application/json' } });
-  if (response.status === 404) return null; // Channel has not been promoted yet.
-  if (!response.ok) throw new Error(`Release registry unavailable (${response.status}).`);
-  return response.json();
-}
-
-export async function installHostedRelease(release, destination, store, base = BASE_RUNTIME) {
-  mkdirSync(destination, { recursive: true });
-  const home = join(destination, '.install-home'); mkdirSync(home);
-  // No customer HOME, OAuth profiles, bootstrap token or npm login is inherited.
-  const env = { PATH: process.env.PATH, HOME: home, CI: '1', KAI_RUNTIME_UPDATE_CHECK: '1', npm_config_registry: 'https://registry.npmjs.org', npm_config_cache: join(store, 'cache') };
-  try {
-    const packed = await exec('npm', ['pack', `@gleapai/kai-bridge@${release.version}`, '--ignore-scripts', '--json', '--pack-destination', destination], { env, timeout: 30_000, maxBuffer: 1024 * 1024 });
-    const archive = JSON.parse(packed.stdout)?.[0]?.filename;
-    if (archive !== `gleapai-kai-bridge-${release.version}.tgz`) throw new Error('Unexpected runtime archive.');
-    await exec('tar', ['-xzf', join(destination, archive), '--strip-components=1', '-C', destination], { timeout: 10_000 });
-    const pkg = packageAt(destination), lock = read(join(destination, 'npm-shrinkwrap.json'));
-    if (pkg.name !== '@gleapai/kai-bridge' || pkg.version !== release.version || pkg.kaiHostedRuntime?.protocol !== 1 || lock.version !== pkg.version) throw new Error('Release lacks a matching locked runtime.');
-    assertImageCompatibility(destination, base);
-    await exec('npm', ['ci', '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund'], { cwd: destination, env, timeout: 60_000, maxBuffer: 1024 * 1024 });
-    await exec(process.execPath, [join(destination, 'scripts/runtime-smoke.mjs')], { cwd: destination, env, timeout: 45_000, maxBuffer: 1024 * 1024 });
-    rmSync(join(destination, archive), { force: true });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-}
-
-/** Called under flock BEFORE supervisord starts. Running VMs never hot-swap
- * runtimes. Install/check failures and interrupted installs retain the old root. */
-export async function updateHostedRuntime({ store = RUNTIME_STORE, base = BASE_RUNTIME, now = Date.now(), busy = supervisorRunning(), enabled = true,
-  fetchRelease = fetchHostedRelease, install = installHostedRelease, log = message => process.stderr.write(`${message}\n`) } = {}) {
-  const current = runtimeRoot(store, base);
-  if (busy) return current;
-  const state = read(join(store, 'state.json'));
-  if (existsSync(join(store, 'rollback-next-start')) && state.active && state.previousVersion) {
-    save(store, { checkedAt: now, active: state.previous || null, failed: state.active, rolledBackAt: now });
-    rmSync(join(store, 'rollback-next-start'), { force: true });
-    log('Previous hosted runtime selected; the rejected release is quarantined.');
-    return runtimeRoot(store, base);
-  }
-  if (!enabled) return current;
-  if (state.checkedAt && now - state.checkedAt < DAY) return current;
-  state.checkedAt = now; save(store, state);
-  let release, staging;
-  try {
-    release = await fetchRelease();
-    if (!release || release.name !== '@gleapai/kai-bridge' || release.kaiHostedRuntime?.protocol !== 1 || !version(release.version)) return current;
-    if (!isNewer(release.version, packageAt(current).version) || state.failed === release.version) return current;
-    staging = join(store, 'releases', `.staging-${release.version}`);
-    rmSync(staging, { recursive: true, force: true });
-    await install(release, staging, store, base);
-    // Recheck admission boundary before activation, including manual invocation.
-    if (supervisorRunning()) throw new Error('Machine became busy during the update.');
-    const destination = join(store, 'releases', release.version);
-    rmSync(destination, { recursive: true, force: true });
-    renameSync(staging, destination);
-    save(store, { checkedAt: now, active: release.version, previous: state.active || null, previousVersion: packageAt(current).version, activatedAt: now });
-    // Keep one rollback bundle. User repositories and auth are outside this store.
-    try {
-      for (const entry of readdirSync(join(store, 'releases'))) {
-        if (version(entry) && entry !== release.version && entry !== state.active) rmSync(join(store, 'releases', entry), { recursive: true, force: true });
-      }
-      rmSync(join(store, 'cache'), { recursive: true, force: true });
-    } catch { /* Cleanup cannot invalidate an already-validated activation. */ }
-    log(`Hosted runtime ${release.version} validated and selected for this start.`);
-    return destination;
-  } catch (error) {
-    if (staging) rmSync(staging, { recursive: true, force: true });
-    save(store, { ...state, ...(release?.version && version(release.version) ? { failed: release.version } : {}), error: error.code === 'image_required' ? 'This release needs a browser image update; previous runtime retained.' : 'Runtime update failed; previous release retained.' });
-    log('Hosted runtime update failed; starting the previous release.');
-    return current;
-  }
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  if (process.argv.includes('--rollback-next-start')) {
-    requestRuntimeRollback(); process.stdout.write('Rollback scheduled. Stop and start the machine from Gleap to apply it.\n');
-  } else {
-  // stdout is consumed by the entrypoint: emit only the selected absolute path.
-  updateHostedRuntime({ enabled: process.env.KAI_HOSTED_RUNTIME_UPDATES !== '0' })
-    .then(root => process.stdout.write(`${root}\n`))
-    .catch(() => process.stdout.write(`${runtimeRoot()}\n`));
-  }
-}