@gleapai/kai-bridge 0.7.0 → 0.9.1

package/src/daemon.mjs

@@ -28,9 +28,6 @@ import { BridgeApi, createEventBatcher } from "./api.mjs";
 import { ensureClaudeAcpPatched } from "./acp-patch.mjs";
 import { KAI_HOME, defaultConfig, loadConfig, saveConfig } from "./config.mjs";
 import { runTurn } from "./executor.mjs";
-import { awaitHostedAdmission, hostedResources, syncHostedRepositories } from './hosted.mjs';
-import { HostedTunnel } from './hosted-tunnel.mjs';
-import { hostedLoginExpired, markHostedLoginExpired, hostedLoginRecovery } from './hosted-auth.mjs';
 import { createManagedProfile, describeProfiles, managedConfigDir, ambientConfigDir, openLoginTerminal, probeUsageLimits } from "./profiles.mjs";
 import { defaultRoots, groupByRepo, preferredCloneRoot, scanRoots, toDeviceRepoReport } from "./repos.mjs";
 import { describeBranchChanges, discardChanges, collectChanges, commitAndPush, copyPrimaryEnvFiles, currentBranch, currentHead, materializeBinding, sessionSlug, worktreePath, ensureCommitExcludes } from "./workspace.mjs";
@@ -57,6 +54,7 @@ import {
   rewriteStorageState,
   storageStateIsEmpty,
 } from "./preview-login.mjs";
+import { GIT_AUTH_TTL_MS, gitAuthEnv, isGitAuthError } from "./git-auth.mjs";
 import { describeHarnesses, installHarness, probeHarnessAuth } from "./harnesses.mjs";
 import { probeHarnessModels } from "./models.mjs";
 import { decideRestart, decideUpdate, fetchLatestVersion, installVersion, installedVersion, installedVersionOrNull, isNewer } from "./selfupdate.mjs";
@@ -161,6 +159,8 @@ export class BridgeDaemon {
     this.kaiHome = kaiHome;
     this.log = log;
     this.api = new BridgeApi({ apiBase: config.apiBase, token: config.device?.token });
+    /** repoKey → { authHeader, at }: Server-issued git credentials (see git-auth.mjs). */
+    this.gitAuth = new Map();
     this.realtimeFactory = realtimeFactory;
     this.running = new Map(); // turnId → { ctrl: AbortController, control?: (obj) => boolean }
     this.services = new Map(); // sessionId → ServiceRunner (lives across turns)
@@ -188,14 +188,6 @@ export class BridgeDaemon {
 
   async hello() {
     const profiles = await describeProfiles(resolveProfiles(this.config, this.kaiHome), this.usageByProfile);
-    if (this.config.hosted) {
-      for (const profile of resolveProfiles(this.config, this.kaiHome)) {
-        if (hostedLoginExpired(profile, this.kaiHome)) {
-          const report = profiles.find(p => p.id === profile.id);
-          if (report) report.authState = 'signed_out';
-        }
-      }
-    }
     const repos = toDeviceRepoReport(this.repoGroups);
     return this.api.hello({
       name: this.config.device?.name,
@@ -272,16 +264,9 @@ export class BridgeDaemon {
     // machine stayed offline until the next login — silently.
     this.heartbeat = setInterval(() => {
       this.api
-        .heartbeat({ running: [...this.running.keys()], ...(this.config.hosted ? { resources: hostedResources(this) } : {}) })
+        .heartbeat({ running: [...this.running.keys()] })
         .catch((err) => this.onApiError("heartbeat", err));
     }, HEARTBEAT_MS);
-    if (this.config.hosted) {
-      this.hostedTunnel = new HostedTunnel({ config: this.config, api: this.api, log: this.log });
-      this.hostedTunnel.connect();
-      void this.hostedTunnel.register('maintenance', 'machine-browser', 6080).catch(err => this.log('warn', 'hosted.browser', { error: err.message }));
-      const sync = () => void syncHostedRepositories(this).catch(err => this.log('warn', 'hosted.repositories', { error: err.message }));
-      sync(); this.hostedRepoTimer = setInterval(sync, 30_000);
-    }
     // Plan-usage windows for the composer popover. Fire-and-forget on a
     // slow cadence, unref'd (the heartbeat keeps the process alive), and
     // NEVER in hello's path — the probe spawns the CLI (~2s per profile).
@@ -409,8 +394,6 @@ export class BridgeDaemon {
     let changed = false;
     const profiles = resolveProfiles(this.config, this.kaiHome);
     for (const harness of MODEL_PROBE_HARNESSES) {
-      // Model probing must not start a second Codex authentication owner.
-      if (this.config.hosted && harness === 'codex') continue;
       // The user's own ~/.claude / ~/.codex first, then any signed-in
       // managed profile — the catalogue is per account, not per profile.
       const candidates = profiles
@@ -480,8 +463,6 @@ export class BridgeDaemon {
     clearInterval(this.usageTimer);
     clearInterval(this.modelsTimer);
     clearInterval(this.updateTimer);
-    clearInterval(this.hostedRepoTimer);
-    this.hostedTunnel?.close();
     if (this.realtimeRetry) clearTimeout(this.realtimeRetry);
     for (const entry of this.running.values()) entry.ctrl.abort();
     const reports = [];
@@ -569,9 +550,11 @@ export class BridgeDaemon {
     }
   }
 
+  /** Merges: the runner pid and the verify artifacts dir arrive after the turn's session meta. */
   rememberInflight(turnId, meta = {}) {
-    const rest = this.readInflight().filter((e) => e.turnId !== turnId);
-    this.writeInflight([...rest, { turnId, ...meta }]);
+    const all = this.readInflight();
+    const existing = all.find((e) => e.turnId === turnId);
+    this.writeInflight([...all.filter((e) => e.turnId !== turnId), { ...existing, turnId, ...meta }]);
   }
 
   forgetInflight(turnId) {
@@ -633,11 +616,34 @@ export class BridgeDaemon {
     }
   }
 
-  /** ServiceRunner hook: every dev-server pid is persisted while it lives. */
-  trackServicePid(sessionId, name, pid, op) {
+  /**
+   * ServiceRunner hook: every dev-server pid is persisted while it lives —
+   * with its port and the session's title/link, so `kai-bridge ps` can
+   * show a preview-only session without a turn to borrow the meta from.
+   */
+  trackServicePid(sessionId, name, pid, op, { port = null } = {}) {
     if (!Number.isInteger(pid)) return;
     const rest = this.readPreviewPids().filter((e) => e.pid !== pid);
-    this.writePreviewPids(op === "add" ? [...rest, { pid, name, sessionId, startedAt: new Date().toISOString() }] : rest);
+    const session = this.sessionMeta?.get(sessionId) ?? {};
+    this.writePreviewPids(op === "add" ? [...rest, { pid, name, sessionId, port, ...session, startedAt: new Date().toISOString() }] : rest);
+  }
+
+  /**
+   * Title, dashboard link and repo keys of a session this machine works
+   * on — copied into the inflight / preview-pid entries (ps.mjs reads
+   * them back). Remembered from turn starts and preview starts alike.
+   */
+  rememberSession(sessionId, { title = null, sessionUrl = null, repos = [] } = {}) {
+    if (typeof sessionId !== "string") return {};
+    this.sessionMeta ??= new Map();
+    const prev = this.sessionMeta.get(sessionId) ?? {};
+    const meta = {
+      title: typeof title === "string" && title ? title : prev.title ?? null,
+      sessionUrl: typeof sessionUrl === "string" && sessionUrl ? sessionUrl : prev.sessionUrl ?? null,
+      repos: Array.isArray(repos) && repos.length ? repos.map((r) => (typeof r === "string" ? r : r?.key)).filter((k) => typeof k === "string") : prev.repos ?? [],
+    };
+    this.sessionMeta.set(sessionId, meta);
+    return meta;
   }
 
   /**
@@ -805,8 +811,6 @@ export class BridgeDaemon {
         }
         return this.startTurn(data);
       case "bridge.turn.cancel":
-        this.hostedCancelled ??= new Set();
-        this.hostedCancelled.add(data.turnId);
         this.running.get(data.turnId)?.ctrl.abort();
         return;
       case "bridge.turn.steer":
@@ -880,8 +884,8 @@ export class BridgeDaemon {
    * truncation. `companionRemotes` (Server-resolved `{ key: remote }`) is
    * how non-github companions get cloned; `note` survives onto error writes.
    */
-  async previewStart({ sessionId, title, repos, companionRemotes = null }) {
-    if (this.config.hosted) { this.hostedPreviewWork ??= new Set(); this.hostedPreviewWork.add(sessionId); }
+  async previewStart({ sessionId, title, repos, sessionUrl = null, companionRemotes = null }) {
+    this.rememberSession(sessionId, { title, sessionUrl, repos });
     let lastNote = null;
     const skipped = [];
     // Every report is also RETURNED: the verify turn boots the preview
@@ -889,11 +893,7 @@ export class BridgeDaemon {
     const report = async (payload) => {
       if (payload.note) lastNote = payload.note;
       const body = payload.status === "error" ? { ...payload, urls: payload.urls ?? [], previews: payload.previews ?? [], ...(lastNote && !payload.note ? { note: lastNote } : {}), ...(skipped.length && !payload.skipped ? { skipped } : {}) } : payload;
-      if (['running', 'error'].includes(body.status)) this.hostedPreviewWork?.delete(sessionId);
-      const runner = this.services.get(sessionId);
-      const publicPreview = p => this.config.hosted && runner?.publicUrls?.[p.name] ? { ...p, url: runner.publicUrls[p.name], lanUrl: null } : p;
-      const reportBody = this.config.hosted ? { ...body, previews: body.previews?.map(publicPreview), urls: body.urls?.map(publicPreview), landingUrl: body.previews?.[0] ? publicPreview(body.previews[0]).url : body.landingUrl } : body;
-      await this.api.sessionPreview(sessionId, reportBody).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
+      await this.api.sessionPreview(sessionId, body).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
       return body;
     };
     const fail = (err, ctx = {}) => report(toPreviewErrorPayload(err, { ...ctx, skipped }));
@@ -908,7 +908,7 @@ export class BridgeDaemon {
           return fail(new PreviewError(`Repository ${r.key} is not checked out on this device.`, { code: "companion_missing", repo: r.key }), { repo: r.key });
         }
         const mode = r.mode || this.config.repoModes?.[r.key] || "worktree";
-        const cwd = mode === "local" ? group.primary.path : this.findSessionWorktree(this.config.hosted ? group.key : group.name, sessionId, title);
+        const cwd = mode === "local" ? group.primary.path : this.findSessionWorktree(group.name, sessionId, title);
         if (!cwd || !existsSync(cwd)) {
           return fail(new PreviewError(`The workspace for this session is gone on this device — send Kai a message to recreate it, then start the preview again.`, { code: "other", repo: r.key }), { repo: r.key });
         }
@@ -1073,7 +1073,6 @@ export class BridgeDaemon {
   findSessionWorktree(repoName, sessionId, title) {
     const exact = worktreePath(this.kaiHome, repoName, sessionSlug(sessionId, title));
     if (existsSync(exact)) return exact;
-    if (this.config.hosted) return exact;
     const suffix = `-${String(sessionId || "").slice(-8)}`;
     if (suffix.length < 2) return exact;
     try {
@@ -1162,7 +1161,7 @@ export class BridgeDaemon {
       this.previewIdleTimers.delete(sessionId);
       const runner = this.services.get(sessionId);
       if (!runner) return;
-      if (!this.config.hosted && await this.previewHasConnections(runner)) {
+      if (await this.previewHasConnections(runner)) {
         this.log("info", "preview.idle.connected", { sessionId });
         if (this.services.get(sessionId) === runner) this.armPreviewIdleTimer(sessionId);
         return;
@@ -1195,7 +1194,6 @@ export class BridgeDaemon {
   }
 
   async previewStop({ sessionId }) {
-    this.hostedTunnel?.unregisterSession(sessionId);
     this.manualPreviews?.delete(sessionId);
     this.verifyOwnedPreviews?.delete(sessionId);
     // A sign-in window for this session has nothing left to sign in to.
@@ -1213,7 +1211,6 @@ export class BridgeDaemon {
    * dashboard why — with the classified log line.
    */
   onServiceDied(sessionId, info) {
-    this.hostedTunnel?.unregisterSession(sessionId);
     const runner = this.services.get(sessionId);
     if (!runner) return Promise.resolve();
     this.log("warn", "preview.service.died", { sessionId, name: info.name, code: info.code, errorCode: info.errorCode });
@@ -1243,7 +1240,6 @@ export class BridgeDaemon {
       runner = new ServiceRunner({
         kaiHome: this.kaiHome,
         sessionId,
-        ...(this.hostedTunnel ? { registerPublicService: (name, port, protocol) => this.hostedTunnel.register(sessionId, name, port, protocol) } : {}),
         log: this.log,
         onStatus: (message) => {
           this.log("info", "preview.status", { sessionId, message });
@@ -1253,7 +1249,7 @@ export class BridgeDaemon {
         ...(this.describeListener ? { describeListener: this.describeListener } : {}),
         ...(this.previewSettleMs != null ? { settleMs: this.previewSettleMs } : {}),
         onServiceExit: (info) => this.onServiceDied(sessionId, info),
-        onProcess: (name, pid, op) => this.trackServicePid(sessionId, name, pid, op),
+        onProcess: (name, pid, op, info) => this.trackServicePid(sessionId, name, pid, op, info),
       });
       this.services.set(sessionId, runner);
     }
@@ -1261,21 +1257,23 @@ export class BridgeDaemon {
   }
 
   /** Map the Server's repo bindings onto local checkouts; throw a readable error when one is missing. */
-  bindRepos(turn) {
+  async bindRepos(turn) {
     const bound = [];
     for (const r of turn.repos || []) {
       const group = this.repoGroups.find((g) => g.key === r.key);
       if (!group) throw new Error(`Repository ${r.key} is not checked out on this device.`);
       const mode = r.mode || this.config.repoModes?.[r.key] || "worktree";
-      const ws = materializeBinding({
+      const ws = await this.withGitAuth(r.key, (gitEnv) => materializeBinding({
         kaiHome: this.kaiHome,
-        repo: { name: this.config.hosted ? group.key : group.name, primaryPath: group.primary.path, defaultBranch: group.primary.defaultBranch },
+        repo: { name: group.name, primaryPath: group.primary.path, defaultBranch: group.primary.defaultBranch },
         binding: { mode, base: r.base, carryUncommitted: r.carryUncommitted },
         sessionId: turn.sessionId,
         title: turn.title,
-      });
+        gitEnv,
+      }));
       bound.push({ key: r.key, ...ws });
       if (ws.deps) this.log("info", "deps.seed", { repo: r.key, ...ws.deps });
+      if (ws.fetch && (ws.fetch.stale || ws.fetch.attempts > 1)) this.log("warn", "workspace.fetch.contended", { repo: r.key, ...ws.fetch });
       // Remember the choice per repo (the UI asks once, then sticks).
       this.config.repoModes = { ...(this.config.repoModes || {}), [r.key]: mode };
     }
@@ -1303,7 +1301,7 @@ export class BridgeDaemon {
       );
       for (const g of others.slice(0, 40)) {
         const base = g.primary.defaultBranch || "main";
-        lines.push(`- ${g.key}: git -C ${g.primary.path} fetch origin ${base} --quiet && git -C ${g.primary.path} worktree add -b kai/${slug} ${worktreePath(this.kaiHome, this.config.hosted ? g.key : g.name, slug)} origin/${base}`);
+        lines.push(`- ${g.key}: git -C ${g.primary.path} fetch origin ${base} --quiet && git -C ${g.primary.path} worktree add -b kai/${slug} ${worktreePath(this.kaiHome, g.name, slug)} origin/${base}`);
       }
       if (others.length > 40) lines.push(`- (${others.length - 40} more repositories on this device — same recipe, path ~/.kai/worktrees/<repo>/${slug})`);
     }
@@ -1320,7 +1318,7 @@ export class BridgeDaemon {
     const adopted = [];
     for (const g of this.repoGroups) {
       if (bound.some((b) => b.key === g.key)) continue;
-      const cwd = worktreePath(this.kaiHome, this.config.hosted ? g.key : g.name, slug);
+      const cwd = worktreePath(this.kaiHome, g.name, slug);
       if (!existsSync(cwd)) continue;
       const branch = currentBranch(cwd);
       if (!branch || branch === "HEAD") continue;
@@ -1333,8 +1331,6 @@ export class BridgeDaemon {
   async startTurn(turn) {
     const { turnId } = turn;
     if (this.running.has(turnId)) return;
-    if (this.config.hosted && !(await awaitHostedAdmission(this, turn))) return;
-    if (this.running.has(turnId)) return;
     const ctrl = new AbortController();
     const entry = { ctrl, control: null, sessionId: turn.sessionId };
     this.running.set(turnId, entry);
@@ -1345,13 +1341,13 @@ export class BridgeDaemon {
     // turn — see prepareVerifyTurn / finishVerification.
     const isVerify = turn.agent === "kai-verifier";
     let verify = null;
-    this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent ?? null });
+    // Everything `kai-bridge ps` shows for this turn; the runner pid follows at spawn.
+    const session = this.rememberSession(turn.sessionId, { title: turn.title, sessionUrl: turn.sessionUrl, repos: turn.repos });
+    this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent ?? null, harness: turn.harness ?? null, profileId: turn.profileId ?? null, startedAt: new Date().toISOString(), ...session });
     const batcher = createEventBatcher({ api: this.api, turnId, onError: (err) => this.log("warn", "events.post.failed", { error: err.message }) });
     try {
       const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === turn.profileId) ?? { id: "gleap-key", kind: "gleap-key", harness: turn.harness };
-      if (this.config.hosted && (profile.kind === 'gleap-key' || !['codex', 'claude'].includes(profile.harness))) throw new Error('Choose your signed-in Claude Code or Codex profile for this machine.');
-      if (this.config.hosted && hostedLoginExpired(profile, this.kaiHome)) throw new Error(hostedLoginRecovery(profile.harness));
-      const bound = this.bindRepos(turn);
+      const bound = await this.bindRepos(turn);
       // Multi-repo: the runner's cwd is the first repo; the others are
       // reachable as siblings under the same worktree root or by their
       // local paths — the prompt lists them.
@@ -1379,7 +1375,7 @@ export class BridgeDaemon {
         }
         previewNote = verify.note;
         // The evidence dir is where a restart mid-run finds partial footage.
-        this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent, artifactsDir: verify.artifactsDir });
+        this.rememberInflight(turnId, { artifactsDir: verify.artifactsDir });
         mcpServers = [
           ...(turn.mcpServers || []),
           previewMcpServer(RUNNER_DIR, {
@@ -1414,6 +1410,7 @@ export class BridgeDaemon {
         signal: ctrl.signal,
         onSpawn: (handle) => {
           entry.control = handle.control;
+          if (Number.isInteger(handle.pid)) this.rememberInflight(turnId, { pid: handle.pid });
         },
         onEvent: (ev) => {
           if (verify) {
@@ -1434,16 +1431,11 @@ export class BridgeDaemon {
         onLog: (l) => this.log("debug", "runner", { line: l.slice(0, 500) }),
       });
       await batcher.flush();
-      if (this.config.hosted && res.errorCode === 'authentication_required') {
-        markHostedLoginExpired(profile, this.kaiHome);
-        res.lastError = hostedLoginRecovery(profile.harness);
-        await this.hello().catch(() => {});
-      }
       const completed = !ctrl.signal.aborted && res.code === 0 && !res.rateLimited;
       // Plan and verify turns are read-only: worktrees are restored, local
       // checkouts only reported, nothing is ever committed or pushed.
       const readOnlyTurn = !!turn.planMode || isVerify;
-      const changes = [...bound, ...this.adoptSessionWorktrees(turn, bound)].map((b) => {
+      const changes = await Promise.all([...bound, ...this.adoptSessionWorktrees(turn, bound)].map(async (b) => {
         ensureCommitExcludes(b.cwd, { allowDevConfig: !!turn.allowDevConfig });
         // A read-only turn must leave the worktree as it found it — see
         // discardChanges. Local checkouts are the user's; only report.
@@ -1465,12 +1457,20 @@ export class BridgeDaemon {
         // Build turns in worktree mode publish the session branch so the
         // Server can open the PR; read-only turns and local mode never push.
         const shouldPush = completed && b.mode === "worktree" && !readOnlyTurn && diff.files.length > 0;
+        const pushOnce = (gitEnv) => {
+          const out = commitAndPush(b.cwd, {
+            branch: b.branch,
+            allowDevConfig: !!turn.allowDevConfig,
+            message: `${turn.title || "Kai Code changes"}\n\nSession ${turn.sessionId} · run on ${this.config.device?.name || "a paired device"}`,
+            gitEnv,
+          });
+          // commitAndPush reports instead of throwing; surface an auth
+          // rejection so withGitAuth can retry the push (the commit exists).
+          if (!out.pushed && !gitEnv && isGitAuthError(out.error)) throw Object.assign(new Error(out.error), { push: out });
+          return out;
+        };
         const push = shouldPush
-          ? commitAndPush(b.cwd, {
-              branch: b.branch,
-              allowDevConfig: !!turn.allowDevConfig,
-              message: `${turn.title || "Kai Code changes"}\n\nSession ${turn.sessionId} · run on ${this.config.device?.name || "a paired device"}`,
-            })
+          ? await this.withGitAuth(b.key, pushOnce).catch((err) => err.push ?? { committed: false, pushed: false, branch: b.branch, error: err.message })
           : isVerify
             ? false
             : null;
@@ -1480,7 +1480,7 @@ export class BridgeDaemon {
         // Server can write a real pull request description.
         const described = push?.pushed ? describeBranchChanges(b.cwd, b.base) : null;
         return { key: b.key, mode: b.mode, branch: b.branch, base: b.base, cwd: b.cwd, adopted: b.adopted || undefined, ...diff, push, ...(described ? described : {}) };
-      });
+      }));
       // The read-only notices above were queued AFTER the post-turn
       // flush; land them before the result closes the turn (the Server
       // answers 410 for events on an ended turn).
@@ -1504,9 +1504,11 @@ export class BridgeDaemon {
         profileId: profile.id,
       };
     } catch (err) {
-      this.log("error", "turn.failed", { turnId, error: err.message });
+      this.log("error", "turn.failed", { turnId, error: err.message, ...(err.code ? { code: err.code, repo: err.repo } : {}) });
       await batcher.flush().catch(() => {});
-      outcome = outcome ?? { status: "failed", error: err.message };
+      // A WorkspaceError names why the checkout could not be prepared;
+      // the Server turns `failure.code` into a one-click retry.
+      outcome = outcome ?? { status: "failed", error: err.message, ...(err.code ? { failure: { code: err.code, repo: err.repo ?? null } } : {}) };
     } finally {
       // One report, retried until it lands — a dropped result is what
       // leaves a session spinning forever in the dashboard.
@@ -1712,7 +1714,7 @@ export class BridgeDaemon {
     this.previewStatusListeners.set(sessionId, heartbeat.note);
     let preview;
     try {
-      preview = await this.previewStart({ sessionId, title: turn.title, repos: turn.repos, companionRemotes: turn.companionRemotes ?? null });
+      preview = await this.previewStart({ sessionId, title: turn.title, repos: turn.repos, sessionUrl: turn.sessionUrl ?? null, companionRemotes: turn.companionRemotes ?? null });
     } finally {
       this.previewStatusListeners?.delete(sessionId);
       heartbeat.stop();
@@ -2432,6 +2434,43 @@ export class BridgeDaemon {
     return { note: notes.join(""), hasLivePreview: previews.length > 0 };
   }
 
+  /**
+   * Run a git network op with this machine's own credentials; when those are
+   * rejected, retry ONCE with the Server-issued credentials for `repoKey`
+   * (connected repos only — anything else rethrows the original error).
+   */
+  async withGitAuth(repoKey, run) {
+    try {
+      return await run(null);
+    } catch (err) {
+      if (!repoKey || !isGitAuthError(err)) throw err;
+      let authHeader;
+      try {
+        authHeader = await this.gitAuthHeader(repoKey);
+      } catch (credErr) {
+        this.log("warn", "git.auth.unavailable", { repo: repoKey, error: credErr.message });
+        throw err;
+      }
+      this.log("info", "git.auth.fallback", { repo: repoKey });
+      try {
+        return await run(gitAuthEnv(authHeader));
+      } catch (retryErr) {
+        // Stale or revoked: never reuse it for the next attempt.
+        if (isGitAuthError(retryErr)) this.gitAuth.delete(repoKey);
+        throw retryErr;
+      }
+    }
+  }
+
+  async gitAuthHeader(repoKey) {
+    const cached = this.gitAuth.get(repoKey);
+    if (cached && Date.now() - cached.at < GIT_AUTH_TTL_MS) return cached.authHeader;
+    const { authHeader } = await this.api.gitCredentials(repoKey);
+    if (!authHeader) throw new Error("The Server returned no git credentials.");
+    this.gitAuth.set(repoKey, { authHeader, at: Date.now() });
+    return authHeader;
+  }
+
   /**
    * Clone `remote` into the preferred root as `name`. Hardened for
    * unattended runs: no credential prompts (`GIT_TERMINAL_PROMPT=0`,
@@ -2443,7 +2482,7 @@ export class BridgeDaemon {
   async cloneRepo({ commandId, remote, name, repoKey, timeoutMs = CLONE_TIMEOUT_MS }) {
     const root = preferredCloneRoot(this.repoGroups, (this.config.roots || [])[0] ?? defaultRoots()[0]);
     try {
-      const target = await cloneRepository({ remote, name, root, repoKey, timeoutMs });
+      const target = await this.withGitAuth(repoKey, (gitEnv) => cloneRepository({ remote, name, root, repoKey, timeoutMs, gitEnv }));
       await this.scanRepos();
       // Ack only after the Server has the new inventory: recovery checks
       // readiness before automatically retrying the blocked session.
@@ -2501,10 +2540,10 @@ export class BridgeDaemon {
     }
   }
 
-  async harnessInstall({ commandId, harness }) {
+  async harnessInstall({ commandId, harness, update = false }) {
     const lines = [];
     try {
-      const res = await installHarness(harness, { kaiHome: this.kaiHome, onLog: (l) => { lines.push(l); this.log("info", "harness.install", { harness, line: l }); } });
+      const res = await installHarness(harness, { kaiHome: this.kaiHome, update, onLog: (l) => { lines.push(l); this.log("info", "harness.install", { harness, line: l }); } });
       await this.hello();
       if (commandId) await this.api.commandAck(commandId, { ok: res.ok, version: res.version, log: lines });
     } catch (err) {
@@ -2514,24 +2553,34 @@ export class BridgeDaemon {
   }
 
   async profileLogin({ commandId, profileId }) {
-    const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === profileId);
-    if (!profile) throw new Error(`Unknown profile ${profileId}`);
-    if (profile.kind === "managed") createManagedProfile(profile.harness, profile.id, this.kaiHome);
-    // Logins are interactive: open a terminal on this machine running the
-    // harness's own login under the profile's config dir, and re-announce
-    // the profile state once it exits.
-    const child = openLoginTerminal(profile.harness, profile.configDir);
-    if (!child) throw new Error(`Could not open a terminal for ${profile.harness} login on this device.`);
-    child.unref?.();
-    if (commandId) await this.api.commandAck(commandId, { ok: true, opened: "terminal" });
-    const poll = setInterval(() => {
-      this.hello().catch(() => {});
-      // First sign-in for this harness: learn its models as soon as the
-      // login lands (later refreshes ride the slow timer).
-      if (!this.modelsByHarness.has(profile.harness)) void this.refreshHarnessModels();
-    }, 15_000);
-    poll.unref?.();
-    setTimeout(() => clearInterval(poll), 10 * 60_000).unref?.();
+    try {
+      const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === profileId);
+      if (!profile) throw new Error(`Unknown profile ${profileId}`);
+      if (profile.kind === "managed") createManagedProfile(profile.harness, profile.id, this.kaiHome);
+      // Logins are interactive: open a terminal on this machine running the
+      // harness's own login under the profile's config dir, and re-announce
+      // the profile state once it exits.
+      await installHarness(profile.harness, { kaiHome: this.kaiHome });
+      const child = openLoginTerminal(profile.harness, profile.configDir, this.kaiHome);
+      if (child) await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', reject);
+      });
+      child?.unref?.();
+      const command = `kai-bridge profile login '${String(profile.id).replace(/'/g, "'\\''")}'${profile.harness === 'codex' ? ' --device-auth' : ''}`;
+      if (commandId) await this.api.commandAck(commandId, { ok: true, opened: child ? "terminal" : "ssh", ...(!child ? { command } : {}) });
+      const poll = setInterval(() => {
+        this.hello().catch(() => {});
+        // First sign-in for this harness: learn its models as soon as the
+        // login lands (later refreshes ride the slow timer).
+        if (!this.modelsByHarness.has(profile.harness)) void this.refreshHarnessModels();
+      }, 15_000);
+      poll.unref?.();
+      setTimeout(() => clearInterval(poll), 10 * 60_000).unref?.();
+    } catch (err) {
+      if (commandId) await this.api.commandAck(commandId, { ok: false, error: err.message }).catch(() => {});
+      else throw err;
+    }
   }
 }
 

package/src/executor.mjs

@@ -15,8 +15,7 @@ import { fileURLToPath } from "node:url";
 import { ambientConfigDir, managedConfigDir } from "./profiles.mjs";
 import { harnessAcpCommand, harnessBinary } from "./harnesses.mjs";
 import { KAI_HOME } from "./config.mjs";
-import { boundHostedProcess } from './hosted-resources.mjs';
-import { classifyHarnessFailure } from './hosted-auth.mjs';
+import { classifyHarnessFailure } from './harness-errors.mjs';
 
 const RUNNER = join(dirname(fileURLToPath(import.meta.url)), "..", "runner", "acp-runner.mjs");
 const b64 = (v) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v), "utf8").toString("base64");
@@ -79,13 +78,10 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
   for (const [k, v] of Object.entries(extraEnv || {})) if (v != null && v !== "") env[k] = String(v);
   // Never leak the Gleap device token into the harness.
   delete env.KAI_DEVICE_TOKEN;
-  delete env.KAI_BOOTSTRAP_TOKEN;
   // Login, version probes and coding must resolve the same release's binaries.
-  // Hosted Codex replaces this path below with its single-owner RPC transport.
   const native = harnessBinary(profile.harness, kaiHome);
   if (native && profile.harness === 'claude') { env.CLAUDE_CODE_EXECUTABLE = native; env.DISABLE_AUTOUPDATER = '1'; }
   if (native && profile.harness === 'codex') env.CODEX_PATH = native;
-  if (process.env.KAI_HOSTED === '1') env.NODE_OPTIONS = '--max-old-space-size=1536';
   // The daemon's own node first on PATH for the runner, the harness and
   // every shell the agent opens. Under launchd PATH is frozen at install
   // time and a stale /usr/local/bin/node (v20 here) beat the nvm node the
@@ -107,12 +103,6 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
       env.KAI_ACP_CONFIG_DIR = join(kaiHome, "state", profile.id, "cursor");
       mkdirSync(env.KAI_ACP_CONFIG_DIR, { recursive: true });
     } else if (profile.harness === "codex") {
-      if (process.env.KAI_HOSTED === '1') {
-        // A single supervised app-server owns login refresh for every hosted
-        // turn. Per-session config travels over RPC, never through config.toml.
-        env.KAI_ACP_CONFIG_DIR = profileDir;
-        env.CODEX_PATH = join(dirname(fileURLToPath(import.meta.url)), 'codex-broker-client.mjs');
-      } else {
       // The runner writes config.toml (MCP servers, kill-switches) into
       // CODEX_HOME — that must never be the user's real ~/.codex. Use a
       // per-profile session dir seeded with a COPY of auth.json (read-only
@@ -122,7 +112,6 @@ export function buildRunnerEnv(turn, profile, kaiHome = KAI_HOME, extraEnv = nul
       const src = join(profileDir, "auth.json");
       if (existsSync(src)) copyFileSync(src, join(sessionDir, "auth.json"));
       env.KAI_ACP_CONFIG_DIR = sessionDir;
-      }
     } else {
       // Claude: CLAUDE_CONFIG_DIR IS the login dir; the runner reads the
       // transcript from it and passes settings via the SDK, never by file.
@@ -159,10 +148,11 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
     // stdin is the runner's control channel (JSONL: steer / cancel) — see
     // startControlChannel in runner/acp-runner.mjs. Never closed from
     // here; the runner exits on its own when the turn ends.
-    const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, detached: process.env.KAI_HOSTED === '1', stdio: ["pipe", "pipe", "pipe"] });
-    boundHostedProcess(child, { onExceeded: message => { lastError = message; onEvent({ type: 'error', message, code: 'memory_pressure' }); } });
+    const child = spawn(process.execPath, [RUNNER, ...args], { cwd: workDir, env, stdio: ["pipe", "pipe", "pipe"] });
     child.stdin.on("error", () => {});
     onSpawn?.({
+      /** The runner's pid — the daemon records it for `kai-bridge ps`. */
+      pid: child.pid,
       /** Write one control line; false when the runner is already gone. */
       control(obj) {
         if (child.exitCode !== null || child.killed || !child.stdin.writable) return false;
@@ -199,8 +189,7 @@ export function runTurn({ turn, profile, workDir, onEvent, onLog = () => {}, onS
     child.stderr.on("data", (d) => onLog(String(d)));
     const onAbort = () => {
       try {
-        if (process.env.KAI_HOSTED === '1') process.kill(-child.pid, 'SIGTERM');
-        else child.kill("SIGTERM");
+        child.kill("SIGTERM");
       } catch {
         /* gone */
       }

package/src/git-auth.mjs

@@ -0,0 +1,38 @@
+// Git credentials of last resort.
+//
+// Every git network op runs with the machine's own credentials first: that
+// keeps the user's identity, their SSH keys and their org SSO exactly as
+// they are. A device that was never signed in to GitHub (a fresh Mac, a
+// shared box, a CI-ish machine) has none, and a clone, the prep fetch or
+// the end-of-turn push then dies with "Authentication failed".
+//
+// For those — and ONLY those — the Server hands out the same short-lived
+// provider credentials Kai Code Cloud clones with, for one repository, on
+// demand. The header is passed through the environment for that single git
+// command: it never reaches `.git/config`, the remote URL, or `ps` output.
+
+const AUTH_FAILURE = /authentication failed|invalid username or (?:token|password)|could not read (?:username|password)|terminal prompts disabled|permission denied \(publickey\)|remote: (?:invalid|write access|permission)|403 forbidden|repository not found|please ask the owner|support for password authentication was removed/i;
+
+export const isGitAuthError = (err) =>
+  // `cause`: workspace.mjs wraps a failed fetch in a WorkspaceError.
+  AUTH_FAILURE.test([err?.stderr, err?.message, err?.cause?.stderr, err?.cause?.message, typeof err === "string" ? err : ""]
+    .map((part) => String(part ?? "")).join(" "));
+
+/**
+ * `git -c http.extraheader=…` without the command line: GIT_CONFIG_COUNT
+ * config pairs are read by git itself, so the token stays out of argv.
+ */
+export function gitAuthEnv(authHeader) {
+  if (!authHeader) return null;
+  return {
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "http.extraheader",
+    GIT_CONFIG_VALUE_0: String(authHeader),
+    // The header authenticates; never let a helper prompt on top of it.
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "echo",
+  };
+}
+
+/** Keep a repo's credentials only while they are certainly still valid. */
+export const GIT_AUTH_TTL_MS = 30 * 60_000;

package/src/harness-errors.mjs

@@ -0,0 +1,8 @@
+// Only harness authentication failures invalidate a login. An application's
+// HTTP 401 during validation, a quota limit, or an outage must not sign it out.
+export function classifyHarnessFailure(message = '') {
+  if (/rate.?limit|429|usage limit|out of (extra )?usage/i.test(message)) return 'rate_limited';
+  if (/refresh_token_(reused|expired|invalidated)|not logged in|login (has )?expired|login required|authentication[_ ](?:error|required)|oauth.{0,30}(expired|invalid)|model provider rejected.{0,30}401/i.test(message)) return 'authentication_required';
+  if (/service unavailable|provider.{0,30}(unavailable|outage)|HTTP 50[234]|ECONNRESET|ETIMEDOUT/i.test(message)) return 'provider_unavailable';
+  return null;
+}