@gleapai/kai-bridge 0.7.0 → 0.9.0

package/fly/start.mjs

@@ -1,7 +0,0 @@
-import { bootstrapHosted } from '../src/hosted.mjs';
-import { BridgeDaemon } from '../src/daemon.mjs';
-await bootstrapHosted();
-const daemon = new BridgeDaemon();
-process.on('SIGTERM', () => { void daemon.stop(); });
-process.on('SIGINT', () => { void daemon.stop(); });
-await daemon.start();

package/fly/supervisord.conf

@@ -1,45 +0,0 @@
-[unix_http_server]
-file=/run/supervisor.sock
-chmod=0700
-[supervisord]
-nodaemon=true
-logfile=/data/logs/supervisor.log
-pidfile=/run/supervisord.pid
-[rpcinterface:supervisor]
-supervisor.rpcinterface_factory=supervisor.rpcinterface:make_main_rpcinterface
-[supervisorctl]
-serverurl=unix:///run/supervisor.sock
-[program:kai-bridge]
-command=node /opt/kai-bridge/fly/runtime-launch.mjs bridge
-user=kai
-environment=HOME="/data/home/kai",KAI_HOME="/data/home/kai/.kai",DISPLAY=":99"
-autorestart=unexpected
-stopasgroup=true
-killasgroup=true
-stdout_logfile=/data/logs/bridge.log
-stderr_logfile=/data/logs/bridge-error.log
-[program:codex-auth]
-command=node /opt/kai-bridge/fly/runtime-launch.mjs codex-auth
-user=kai
-environment=HOME="/data/home/kai",CODEX_HOME="/data/home/kai/.codex"
-autorestart=true
-stopasgroup=true
-stdout_logfile=/data/logs/codex-auth.log
-stderr_logfile=/data/logs/codex-auth-error.log
-[program:display]
-command=/usr/bin/Xvfb :99 -screen 0 1440x900x24 -nolisten tcp
-user=kai
-autorestart=true
-[program:desktop]
-command=/usr/bin/fluxbox
-user=kai
-environment=DISPLAY=":99",HOME="/data/home/kai"
-autorestart=true
-[program:vnc]
-command=/usr/bin/x11vnc -display :99 -localhost -forever -shared -nopw -rfbport 5900
-user=kai
-autorestart=true
-[program:browser-login]
-command=/usr/bin/websockify --web=/usr/share/novnc 127.0.0.1:6080 127.0.0.1:5900
-user=kai
-autorestart=true

package/src/codex-broker-client.mjs

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import { connect } from 'node:net';
-import { spawn } from 'node:child_process';
-import { harnessBinary } from './harnesses.mjs';
-if (process.argv[2] !== 'app-server') {
-  // Version/login commands remain native. Refresh for coding sessions is owned
-  // exclusively by the supervised app-server.
-  const child = spawn(harnessBinary('codex'), process.argv.slice(2), { stdio: 'inherit' });
-  child.on('error', () => process.exit(1));
-  child.on('exit', code => process.exit(code || 0));
-} else {
-  const socket = connect('/data/home/kai/.kai/codex.sock');
-  process.stdin.pipe(socket); socket.pipe(process.stdout);
-  socket.on('error', () => { process.stderr.write('The Codex authentication service is unavailable. Restart it using maintenance SSH.\n'); process.exit(1); });
-  socket.on('close', () => process.exit(0));
-}

package/src/codex-broker.mjs

@@ -1,85 +0,0 @@
-// One native Codex app-server (and therefore one refresh-token owner) per VM.
-// ACP adapters retain independent session configuration and talk JSON-RPC
-// through private Unix sockets. No authentication files are copied per turn.
-import { createServer } from 'node:net';
-import { spawn } from 'node:child_process';
-import { createInterface } from 'node:readline';
-import { chmodSync, rmSync, mkdirSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { boundHostedProcess } from './hosted-resources.mjs';
-import { harnessBinary } from './harnesses.mjs';
-
-export function startCodexBroker({ socketPath = '/data/home/kai/.kai/codex.sock', command = harnessBinary('codex'), spawnImpl = spawn } = {}) {
-  if (!command) throw new Error('The bundled Codex executable is missing.');
-  mkdirSync(dirname(socketPath), { recursive: true }); rmSync(socketPath, { force: true });
-  const processHandle = spawnImpl(command, ['app-server'], { env: { ...process.env, CODEX_HOME: '/data/home/kai/.codex' }, detached: process.env.KAI_HOSTED === '1', stdio: ['pipe', 'pipe', 'inherit'] });
-  boundHostedProcess(processHandle, { limitMb: 1536 });
-  const clients = new Set(), pending = new Map(), threadOwners = new Map(), reverse = new Map(), activeTurns = new Map();
-  let sequence = 0, initialized, initializeRequest, initializeWaiters = [], notified = false;
-  const send = (socket, msg) => { if (!socket.destroyed) socket.write(JSON.stringify(msg) + '\n'); };
-  const upstream = msg => processHandle.stdin.write(JSON.stringify(msg) + '\n');
-  const server = createServer(socket => {
-    clients.add(socket);
-    const lines = createInterface({ input: socket });
-    lines.on('line', line => {
-      let msg; try { msg = JSON.parse(line); } catch { socket.destroy(); return; }
-      if (msg.method === 'initialize') {
-        if (initialized) { send(socket, { id: msg.id, result: initialized }); return; }
-        initializeWaiters.push({ socket, id: msg.id });
-        if (!initializeRequest) { initializeRequest = ++sequence; upstream({ ...msg, id: initializeRequest }); }
-        return;
-      }
-      if (msg.method === 'initialized') { if (!notified) { notified = true; upstream(msg); } return; }
-      if (!msg.method && reverse.has(String(msg.id))) {
-        const req = reverse.get(String(msg.id));
-        if (req.socket !== socket) return;
-        reverse.delete(String(msg.id)); upstream({ ...msg, id: req.id }); return;
-      }
-      const thread = msg.params?.threadId;
-      if (thread && threadOwners.has(thread) && threadOwners.get(thread) !== socket && !threadOwners.get(thread).destroyed) {
-        if (msg.id != null) send(socket, { id: msg.id, error: { code: -32000, message: 'This thread is active in another session.' } });
-        return;
-      }
-      if (thread) threadOwners.set(thread, socket);
-      if (msg.id != null) { const id = ++sequence; pending.set(id, { socket, id: msg.id }); upstream({ ...msg, id }); }
-      else upstream(msg);
-    });
-    socket.once('close', () => {
-      clients.delete(socket); lines.close();
-      initializeWaiters = initializeWaiters.filter(w => w.socket !== socket);
-      for (const [threadId, owner] of threadOwners) if (owner === socket && activeTurns.has(threadId))
-        upstream({ id: ++sequence, method: 'turn/interrupt', params: { threadId, turnId: activeTurns.get(threadId) } });
-      for (const [key, request] of reverse) if (request.socket === socket) { reverse.delete(key); upstream({ id: request.id, error: { code: -32000, message: 'Session owner disconnected.' } }); }
-    });
-    socket.on('error', () => socket.destroy());
-  });
-  createInterface({ input: processHandle.stdout }).on('line', line => {
-    let msg; try { msg = JSON.parse(line); } catch { return; }
-    if (msg.id === initializeRequest && !msg.method) {
-      initialized = msg.result;
-      for (const waiter of initializeWaiters) send(waiter.socket, { ...msg, id: waiter.id });
-      initializeWaiters = []; if (msg.error) initializeRequest = undefined; return;
-    }
-    if (msg.id != null && !msg.method) {
-      const req = pending.get(msg.id); if (!req) return;
-      pending.delete(msg.id);
-      const thread = msg.result?.thread?.id;
-      if (thread) threadOwners.set(thread, req.socket);
-      send(req.socket, { ...msg, id: req.id }); return;
-    }
-    const thread = msg.params?.threadId || msg.params?.thread_id || msg.params?.thread?.id;
-    if (thread && msg.method === 'turn/started' && msg.params?.turn?.id) activeTurns.set(thread, msg.params.turn.id);
-    if (thread && msg.method === 'turn/completed') activeTurns.delete(thread);
-    const socket = thread && threadOwners.get(thread);
-    if (socket && !socket.destroyed) {
-      if (msg.id != null) { const id = `up-${++sequence}`; reverse.set(id, { socket, id: msg.id }); send(socket, { ...msg, id }); }
-      else send(socket, msg);
-    } else if (!thread && msg.id == null && /^(account|model|serverStatus)/.test(msg.method || '')) {
-      for (const client of clients) send(client, msg);
-    } else if (msg.id != null) upstream({ id: msg.id, error: { code: -32000, message: 'Session owner disconnected.' } });
-  });
-  processHandle.once('exit', () => { for (const client of clients) client.destroy(); server.close(); });
-  processHandle.on('error', () => { for (const client of clients) client.destroy(); server.close(); });
-  server.listen(socketPath, () => chmodSync(socketPath, 0o600));
-  return { close() { for (const client of clients) client.destroy(); server.close(); processHandle.kill('SIGTERM'); rmSync(socketPath, { force: true }); } };
-}

package/src/hosted-auth.mjs

@@ -1,42 +0,0 @@
-import { createHash } from 'node:crypto';
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-// Only harness authentication failures invalidate a login. An application's
-// HTTP 401 during validation, a quota limit, or an outage must not sign it out.
-export function classifyHarnessFailure(message = '') {
-  if (/rate.?limit|429|usage limit|out of (extra )?usage/i.test(message)) return 'rate_limited';
-  if (/refresh_token_(reused|expired|invalidated)|not logged in|login (has )?expired|login required|authentication[_ ](?:error|required)|oauth.{0,30}(expired|invalid)|model provider rejected.{0,30}401/i.test(message)) return 'authentication_required';
-  if (/service unavailable|provider.{0,30}(unavailable|outage)|HTTP 50[234]|ECONNRESET|ETIMEDOUT/i.test(message)) return 'provider_unavailable';
-  return null;
-}
-
-const marker = (profile, kaiHome) => join(kaiHome, `auth-failure-${createHash('sha256').update(profile.id).digest('hex')}.json`);
-const fingerprint = profile => {
-  const hash = createHash('sha256');
-  for (const file of profile.harness === 'codex' ? ['auth.json'] : ['.credentials.json']) {
-    try { hash.update(readFileSync(join(profile.configDir, file))); } catch { hash.update('missing'); }
-  }
-  return hash.digest('hex');
-};
-
-export function markHostedLoginExpired(profile, kaiHome) {
-  mkdirSync(kaiHome, { recursive: true });
-  writeFileSync(marker(profile, kaiHome), JSON.stringify({ fingerprint: fingerprint(profile) }), { mode: 0o600 });
-}
-
-export function hostedLoginExpired(profile, kaiHome) {
-  try {
-    const previous = JSON.parse(readFileSync(marker(profile, kaiHome), 'utf8'));
-    if (previous.fingerprint === fingerprint(profile)) return true;
-    // Native login or a successful supervised refresh replaced the credential.
-    rmSync(marker(profile, kaiHome), { force: true });
-  } catch { /* No failed login recorded. */ }
-  return false;
-}
-
-export function hostedLoginRecovery(harness) {
-  return harness === 'codex'
-    ? 'Codex sign-in expired. Open maintenance SSH and run sudo /opt/kai-bridge/fly/login-codex.sh, then retry.'
-    : 'Claude Code sign-in expired. Open maintenance SSH and run sudo -iu kai claude auth login, then retry.';
-}

package/src/hosted-git-credential.mjs

@@ -1,24 +0,0 @@
-// Git's credential helper protocol. Credentials go directly to Git's pipe,
-// never into a remote URL, argv, stored config or a daemon log.
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { loadConfig, KAI_HOME } from './config.mjs';
-
-if (process.argv[2] === 'get') {
-  const input = await new Promise(resolve => { let text = ''; process.stdin.on('data', b => { text += b; }); process.stdin.on('end', () => resolve(text)); });
-  const fields = Object.fromEntries(String(input).split('\n').filter(Boolean).map(line => { const i = line.indexOf('='); return [line.slice(0, i), line.slice(i + 1)]; }));
-  const config = loadConfig();
-  const manifest = JSON.parse(readFileSync(join(KAI_HOME, 'hosted-repositories.json'), 'utf8'));
-  const remote = `${fields.protocol}://${fields.host}/${fields.path || ''}`;
-  const id = manifest[remote] || manifest[`${remote}.git`];
-  if (id && config.device?.token && fields.protocol === 'https') {
-    const response = await fetch(`${config.apiBase}/gleapcode/bridge/devices/me/hosted-repositories?repositoryId=${encodeURIComponent(id)}`, {
-      headers: { authorization: `Bearer ${config.device.token}` }, signal: AbortSignal.timeout(25_000) });
-    if (response.ok) {
-      const [repo] = await response.json();
-      if (repo?.remote === remote || repo?.remote === `${remote}.git`) {
-        if ([repo.username, repo.password].every(v => typeof v === 'string' && !/[\r\n]/.test(v))) process.stdout.write(`username=${repo.username}\npassword=${repo.password}\n\n`);
-      }
-    }
-  }
-}

package/src/hosted-git.mjs

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-// Fly-only Git launcher. Azure uses bearer authentication, which old Git
-// credential helpers cannot express. Add freshly authorized headers to this
-// process's config environment; never persist them in .git/config or argv.
-import { readFileSync, existsSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-import { join } from 'node:path';
-import { loadConfig, KAI_HOME } from './config.mjs';
-const args = process.argv.slice(2), env = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
-const manifestPath = join(KAI_HOME, 'hosted-repositories.json');
-try {
-  if (args.some(a => ['clone', 'fetch', 'push', 'pull', 'ls-remote', 'submodule'].includes(a)) && existsSync(manifestPath)) {
-    const config = loadConfig(), manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-    let count = Number(env.GIT_CONFIG_COUNT || 0);
-    for (const [remote, id] of Object.entries(manifest)) {
-      const response = await fetch(`${config.apiBase}/gleapcode/bridge/devices/me/hosted-repositories?repositoryId=${encodeURIComponent(id)}`, {
-        headers: { authorization: `Bearer ${config.device.token}` }, signal: AbortSignal.timeout(25_000) });
-      // A revoked companion cannot break an unrelated repository's fetch.
-      // The exact remote still fails closed if its own credentials are absent.
-      if (!response.ok) continue;
-      const [repo] = await response.json();
-      if (repo?.remote !== remote || !repo.authHeader || /[\r\n]/.test(repo.authHeader)) continue;
-      env[`GIT_CONFIG_KEY_${count}`] = `http.${remote}.extraheader`;
-      env[`GIT_CONFIG_VALUE_${count}`] = repo.authHeader; count++;
-    }
-    env.GIT_CONFIG_COUNT = String(count);
-  }
-  const sharedOperation = args.some(a => ['clone', 'fetch', 'push', 'pull', 'worktree', 'branch', 'update-ref', 'submodule'].includes(a));
-  const lock = sharedOperation && !process.env.KAI_GIT_LOCKED;
-  if (lock) env.KAI_GIT_LOCKED = '1';
-  const child = spawn(lock ? '/usr/bin/flock' : '/usr/bin/git', lock ? ['--timeout', '180', '/data/git-operations.lock', '/usr/bin/git', ...args] : args, { env, stdio: 'inherit' });
-  child.on('error', () => process.exit(1)); child.on('exit', code => process.exit(code || 0));
-} catch (error) { process.stderr.write(`${error.message}\n`); process.exit(1); }

package/src/hosted-resources.mjs

@@ -1,35 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const exec = promisify(execFile);
-
-export function processTreeMemory(rows, root) {
-  const parsed = rows.trim().split('\n').map(line => line.trim().split(/\s+/).map(Number)).filter(p => p.length === 3 && p.every(Number.isFinite));
-  const owned = new Set([Number(root)]);
-  for (let changed = true; changed;) { changed = false; for (const [pid, parent] of parsed) if (owned.has(parent) && !owned.has(pid)) { owned.add(pid); changed = true; } }
-  return parsed.filter(([pid]) => owned.has(pid)).reduce((sum, [, , rss]) => sum + rss, 0) / 1024;
-}
-
-/** Bound a workload including subprocesses, reserving room for Bridge,
- * Codex's shared auth process, a second session and preview services. Root SSH
- * can change the VM; the provider-side time/access limits remain authoritative. */
-export function boundHostedProcess(child, { limitMb = 2048, onExceeded = () => {} } = {}) {
-  if (process.env.KAI_HOSTED !== '1' || !child.pid) return () => {};
-  let stopped = false, reading = false, killTimer;
-  const timer = setInterval(async () => {
-    if (stopped || reading) return;
-    reading = true;
-    try {
-      const { stdout } = await exec('ps', ['-eo', 'pid=,ppid=,rss='], { timeout: 2000, maxBuffer: 2 * 1024 * 1024 });
-      if (!stopped && processTreeMemory(stdout, child.pid) > limitMb) {
-        onExceeded(`This workload exceeded its ${limitMb} MB memory budget. Reduce build concurrency or stop another preview, then retry.`);
-        try { process.kill(-child.pid, 'SIGTERM'); } catch { child.kill('SIGTERM'); }
-        killTimer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 5000);
-        stopped = true; clearInterval(timer);
-      }
-    } catch { /* Failed observation never claims that validation passed. */ }
-    finally { reading = false; }
-  }, 3000);
-  timer.unref?.();
-  const cleanup = () => { stopped = true; clearInterval(timer); };
-  child.once('close', cleanup); return cleanup;
-}

package/src/hosted-tunnel.mjs

@@ -1,76 +0,0 @@
-import WebSocket from 'ws';
-import http from 'node:http';
-import https from 'node:https';
-
-export class HostedTunnel {
-  constructor({ config, api, log = () => {} }) { this.config = config; this.api = api; this.log = log; this.services = new Map(); this.pending = new Map(); this.closed = false; }
-  connect() {
-    if (!process.env.KAI_TUNNEL_URL || this.closed) return;
-    this.socket = new WebSocket(process.env.KAI_TUNNEL_URL, { headers: { authorization: `Bearer ${this.config.device.token}` }, maxPayload: 12 * 1024 * 1024 });
-    this.socket.on('message', raw => { try { this.handle(JSON.parse(String(raw))); } catch { this.socket.close(1008); } });
-    this.socket.on('error', () => {});
-    this.socket.on('close', () => {
-      for (const request of this.pending.values()) { request.destroy?.(); request.close?.(); }
-      this.pending.clear(); if (!this.closed) this.timer = setTimeout(() => this.connect(), 3000);
-    });
-  }
-  send(message) {
-    if (this.socket?.bufferedAmount > 16 * 1024 * 1024) { this.socket.close(1013, 'Preview transport backpressure'); return; }
-    if (this.socket?.readyState === WebSocket.OPEN) this.socket.send(JSON.stringify(message));
-  }
-  async register(sessionId, name, port, protocol = 'http') {
-    const service = await this.api.request('POST', '/gleapcode/bridge/devices/me/preview-services', { sessionId, name, port, protocol });
-    this.services.set(service.key, { sessionId, name, port, protocol });
-    return service.url;
-  }
-  unregisterSession(sessionId) {
-    for (const [key, service] of this.services) if (service.sessionId === sessionId) {
-      this.services.delete(key);
-      for (const [id, pending] of this.pending) if (pending.serviceKey === key) { pending.destroy?.(); pending.close?.(); this.pending.delete(id); this.send({ type: 'end', id }); }
-    }
-  }
-  handle(message) {
-    const { id } = message;
-    if (message.type === 'cancel') { const pending = this.pending.get(id); pending?.destroy?.(); pending?.close?.(); this.pending.delete(id); return; }
-    if (message.type === 'ws-data') {
-      const socket = this.pending.get(id), data = Buffer.from(message.data || '', 'base64');
-      if (!socket) return;
-      if (socket.readyState === WebSocket.OPEN && socket.bufferedAmount < 4 * 1024 * 1024) socket.send(data, { binary: !!message.binary });
-      else if (socket.readyState === WebSocket.CONNECTING && (socket.earlyBytes || 0) + data.length < 1024 * 1024) { socket.earlyBytes = (socket.earlyBytes || 0) + data.length; socket.early.push({ data, binary: !!message.binary }); }
-      else { socket.close(1013); this.send({ type: 'error', id }); }
-      return;
-    }
-    const service = this.services.get(message.key);
-    // The relay may reach only services registered by THIS daemon. It cannot
-    // turn into an arbitrary loopback / private-network proxy.
-    if (!service || service.port !== message.port || service.protocol !== message.protocol || !String(message.path).startsWith('/')) { this.send({ type: 'error', id }); return; }
-    if (this.pending.size >= 64) { this.send({ type: 'error', id }); return; }
-    const headers = { ...message.headers };
-    if (message.type === 'http') {
-      const client = service.protocol === 'https' ? https : http;
-      const request = client.request({ hostname: '127.0.0.1', port: service.port, method: message.method,
-        path: message.path, headers, rejectUnauthorized: false, timeout: 60_000 }, response => {
-        this.send({ type: 'headers', id, status: response.statusCode, headers: response.headers });
-        response.on('data', data => this.send({ type: 'data', id, data: data.toString('base64') }));
-        response.on('end', () => { this.send({ type: 'end', id }); this.pending.delete(id); });
-      });
-      this.pending.set(id, request);
-      request.serviceKey = message.key;
-      request.on('timeout', () => request.destroy());
-      request.on('error', () => { this.send({ type: 'error', id }); this.pending.delete(id); });
-      request.end(Buffer.from(message.body || '', 'base64'));
-    } else if (message.type === 'ws') {
-      // The local client generates its own handshake headers.
-      const protocols = headers['sec-websocket-protocol']?.split(',').map(p => p.trim()).filter(Boolean);
-      for (const key of Object.keys(headers)) if (key.toLowerCase().startsWith('sec-websocket-')) delete headers[key];
-      const socket = new WebSocket(`${service.protocol === 'https' ? 'wss' : 'ws'}://127.0.0.1:${service.port}${message.path}`, protocols || [], { headers, rejectUnauthorized: false, maxPayload: 12 * 1024 * 1024 });
-      this.pending.set(id, socket);
-      socket.serviceKey = message.key; socket.early = []; socket.earlyBytes = 0;
-      socket.on('open', () => { for (const frame of socket.early) socket.send(frame.data, { binary: frame.binary }); socket.early = []; socket.earlyBytes = 0; });
-      socket.on('message', (data, binary) => this.send({ type: 'data', id, data: Buffer.from(data).toString('base64'), binary }));
-      socket.on('close', () => { this.pending.delete(id); this.send({ type: 'end', id }); });
-      socket.on('error', () => { this.pending.delete(id); this.send({ type: 'error', id }); });
-    }
-  }
-  close() { this.closed = true; clearTimeout(this.timer); this.socket?.close(); for (const p of this.pending.values()) { p.destroy?.(); p.close?.(); } }
-}

package/src/hosted.mjs

@@ -1,86 +0,0 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { freemem } from 'node:os';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { defaultConfig, loadConfig, saveConfig, KAI_HOME, DEFAULT_API_BASE } from './config.mjs';
-
-export async function bootstrapHosted() {
-  if (process.env.KAI_HOSTED !== '1') return;
-  const config = loadConfig();
-  if (config.device?.token) return;
-  const response = await fetch(`${DEFAULT_API_BASE}/gleapcode/hosted-bootstrap`, { method: 'POST',
-    headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(30_000),
-    body: JSON.stringify({ token: process.env.KAI_BOOTSTRAP_TOKEN, machineId: process.env.KAI_MACHINE_ID,
-      generation: Number(process.env.KAI_MACHINE_GENERATION) }) });
-  if (!response.ok) throw new Error(`Machine bootstrap failed (${response.status}). Use maintenance SSH to repair.`);
-  const data = await response.json();
-  saveConfig({ ...defaultConfig(), ...data, autoUpdate: false });
-  delete process.env.KAI_BOOTSTRAP_TOKEN;
-}
-
-export function hostedResources(daemon) {
-  return { availableMemoryMb: Math.floor(freemem() / 1024 / 1024),
-    activeWork: daemon.running.size + (daemon.hostedCloning ? 1 : 0) + daemon.logins.size + (daemon.hostedPreviewWork?.size || 0),
-    queuedWork: daemon.hostedQueued?.size || 0, repositories: daemon.hostedRepositorySetup };
-}
-
-function git(args, cwd) {
-  return new Promise((resolve, reject) => {
-    const child = spawn('git', args, { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, stdio: ['ignore', 'pipe', 'pipe'] });
-    let error = '';
-    child.stderr.on('data', b => { error = (error + b).slice(-2000); });
-    const timer = setTimeout(() => child.kill('SIGTERM'), 180_000);
-    child.once('error', e => { clearTimeout(timer); reject(e); });
-    child.once('exit', code => { clearTimeout(timer); code === 0 ? resolve() : reject(new Error(`Repository preparation failed (${code}): ${error}`)); });
-  });
-}
-
-export async function syncHostedRepositories(daemon) {
-  if (!daemon.config.hosted || daemon.hostedCloning || daemon.stopped) return;
-  daemon.hostedCloning = true;
-  const readyIds = [];
-  daemon.hostedRepositorySetup = { status: 'cloning', readyIds };
-  try {
-    const repos = await daemon.api.request('GET', '/gleapcode/bridge/devices/me/hosted-repositories');
-    const root = '/data/repos'; mkdirSync(root, { recursive: true });
-    const helperPath = join(dirname(fileURLToPath(import.meta.url)), 'hosted-git-credential.mjs');
-    const manifest = Object.fromEntries(repos.map(repo => [repo.remote, repo.id]));
-    writeFileSync(join(daemon.kaiHome, 'hosted-repositories.json'), JSON.stringify(manifest), { mode: 0o600 });
-    for (const repo of repos) {
-      const name = createHash('sha256').update(repo.key || repo.remote).digest('hex');
-      const target = join(root, name), staging = `${target}.cloning`;
-      if (existsSync(join(target, '.git'))) { readyIds.push(repo.id); continue; }
-      // Never erase a failed clone's directory or a user-created checkout.
-      if (existsSync(staging) || existsSync(target)) throw new Error(`Repository ${repo.fullName} needs attention at ${staging}. Existing files were preserved.`);
-      const helper = `!${JSON.stringify(process.execPath)} ${JSON.stringify(helperPath)}`;
-      await git(['-c', 'credential.helper=', '-c', `credential.helper=${helper}`, '-c', 'credential.useHttpPath=true', 'clone', '--', repo.remote, staging], root);
-      await git(['config', '--local', 'credential.helper', helper], staging);
-      await git(['config', '--local', 'credential.useHttpPath', 'true'], staging);
-      renameSync(staging, target);
-      readyIds.push(repo.id);
-    }
-    await daemon.scanRepos(); await daemon.hello();
-    daemon.hostedRepositorySetup = { status: 'ready', readyIds };
-  } catch (error) {
-    daemon.hostedRepositorySetup = { status: 'error', error: error.message, readyIds };
-    throw error;
-  } finally { daemon.hostedCloning = false; }
-}
-
-/** FIFO contents persist on the server; duplicate push/replay cannot run twice. */
-export async function awaitHostedAdmission(daemon, turn) {
-  if (!daemon.config.hosted) return true;
-  daemon.hostedQueued ??= new Set();
-  if (daemon.hostedQueued.has(turn.turnId) || daemon.running.has(turn.turnId)) return false;
-  daemon.hostedQueued.add(turn.turnId);
-  try {
-    while (!daemon.stopped && !daemon.hostedCancelled?.has(turn.turnId)) {
-      const admission = await daemon.api.request('POST', `/gleapcode/bridge/turns/${turn.turnId}/admit`, {});
-      if (admission.admitted) return true;
-      await new Promise(r => setTimeout(r, 2000));
-    }
-    return false;
-  } finally { daemon.hostedQueued.delete(turn.turnId); }
-}