@gleapai/kai-bridge 0.9.0 → 0.10.0

package/src/daemon.mjs

@@ -12,76 +12,51 @@ import { cloneRepository, locateRepository } from './repository-setup.mjs';
 //   bridge.repo.clone   { commandId, remote, name }
 //   bridge.profile.login{ commandId, profileId }
 //   bridge.rescan       {}
-//   bridge.verify.login.start  { commandId, requestId, sessionId, repoKey, previewNeeded }  — headed sign-in window (see preview-login.mjs)
-//   bridge.verify.login.done   { commandId, requestId }                                     — "Mark done": export now
-//   bridge.verify.login.cancel { commandId, requestId }
-//   bridge.verify.evidence.retry { commandId?, turnId }  — re-upload a kept evidence dir → PUT …/verification/artifacts
 //   bridge.session.close       { sessionId }              — stops the preview, aborts the session's running turns
+//   bridge.preview.publish     { sessionId, sessionUrl, title, repos, companionRemotes } — re-boot the preview with public
+//                              addresses (hostnames + tunnel credentials come from POST /devices/me/public-hosts)
+//   bridge.preview.unpublish   { sessionId }              — stop sharing: back to local addresses, the preview keeps running
 
 import { spawn } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { execFile } from "node:child_process";
-import { join, resolve as resolvePath } from "node:path";
-import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { platform } from "node:os";
 
 import { BridgeApi, createEventBatcher } from "./api.mjs";
 import { ensureClaudeAcpPatched } from "./acp-patch.mjs";
+import { ensurePlaywrightTimeoutPatched } from "./playwright-patch.mjs";
 import { KAI_HOME, defaultConfig, loadConfig, saveConfig } from "./config.mjs";
+import { WARMUP_HEADER } from "./gateway.mjs";
+
+/** Pre-warm navigation cap: a cold dev server of a big app needs minutes, not the probe's seconds. */
+const PREWARM_TIMEOUT_MS = 15 * 60_000;
 import { runTurn } from "./executor.mjs";
 import { createManagedProfile, describeProfiles, managedConfigDir, ambientConfigDir, openLoginTerminal, probeUsageLimits } from "./profiles.mjs";
 import { defaultRoots, groupByRepo, preferredCloneRoot, scanRoots, toDeviceRepoReport } from "./repos.mjs";
 import { describeBranchChanges, discardChanges, collectChanges, commitAndPush, copyPrimaryEnvFiles, currentBranch, currentHead, materializeBinding, sessionSlug, worktreePath, ensureCommitExcludes } from "./workspace.mjs";
-import { ServiceRunner, detectDevConfig, effectiveReload, ensurePreviewBrowser, isPortListening, previewMcpServer, readDevConfig } from "./preview.mjs";
-import { ARTIFACT_MAX_AGE_MS, buildVerificationPayload, createStageHeartbeat, deriveApiAuthHeader, redactJsonlFile, sweepArtifacts, sweepOldArtifacts, unionArtifacts, writeSecretsFile } from "./verify.mjs";
-import { PreviewError, envRedactionValues, previewErrorPayload, toPreviewErrorPayload } from "./preview-errors.mjs";
+import { ServiceRunner, detectDevConfig, ensurePreviewBrowser, launchOptionsFor, loadPlaywright, preferredStablePort, previewMcpServer, readDevConfig } from "./preview.mjs";
+import { PreviewError, previewErrorPayload, toPreviewErrorPayload } from "./preview-errors.mjs";
 import { buildCloneCommand, collectCompanions, prefersSsh, resolveCompanionRemote } from "./companions.mjs";
+import { TunnelManager } from "./tunnel.mjs";
+import { resolveCloudflared } from "./tunnel-binary.mjs";
 import { establishedConnections } from "./ports.mjs";
-import {
-  buildOriginMap,
-  captureLogin,
-  displayAvailable,
-  filterStorageState,
-  invertOriginMap,
-  launchOptionsFor,
-  loadPlaywright,
-  mergeFinalState,
-  normalizeOrigin,
-  parseStorageStateOutput,
-  preferredStablePort,
-  probeLogin,
-  redactDeep,
-  redactionSet,
-  rewriteStorageState,
-  storageStateIsEmpty,
-} from "./preview-login.mjs";
+import { GIT_AUTH_TTL_MS, gitAuthEnv, isGitAuthError } from "./git-auth.mjs";
 import { describeHarnesses, installHarness, probeHarnessAuth } from "./harnesses.mjs";
 import { probeHarnessModels } from "./models.mjs";
 import { decideRestart, decideUpdate, fetchLatestVersion, installVersion, installedVersion, installedVersionOrNull, isNewer } from "./selfupdate.mjs";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const PROBE_TIMEOUT_COLD_BOOT_MS = 60_000;
 const CLONE_TIMEOUT_MS = 3 * 60_000;
 const COMPANION_MAX_DEPTH = 3;
 const RUNNER_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "runner");
 
-/** A captured landing URL moved onto the current origin map (null when its origin is not running). */
-function rewriteUrl(url, originMap) {
-  const origin = normalizeOrigin(url);
-  const to = origin && originMap ? originMap.get(origin) : null;
-  if (!to) return null;
-  try {
-    const u = new URL(String(url));
-    return `${to}${u.pathname}${u.search}${u.hash}`;
-  } catch {
-    return null;
-  }
-}
-
 /** Lock paths held by daemons in THIS process (cross-process uses the file). */
 const HELD_LOCKS = new Set();
 const REALTIME_RETRY_MS = 15_000;
 const HEARTBEAT_MS = 30_000;
+/** Safety net under the realtime channel: ask the server for work it thinks we run (see pullPendingWork). */
+const PENDING_POLL_MS = 60_000;
 const USAGE_REFRESH_MS = 10 * 60_000;
 // Harness model catalogues change on releases, not by the minute.
 const MODELS_REFRESH_MS = 6 * 60 * 60_000;
@@ -158,6 +133,8 @@ export class BridgeDaemon {
     this.kaiHome = kaiHome;
     this.log = log;
     this.api = new BridgeApi({ apiBase: config.apiBase, token: config.device?.token });
+    /** repoKey → { authHeader, at }: Server-issued git credentials (see git-auth.mjs). */
+    this.gitAuth = new Map();
     this.realtimeFactory = realtimeFactory;
     this.running = new Map(); // turnId → { ctrl: AbortController, control?: (obj) => boolean }
     this.services = new Map(); // sessionId → ServiceRunner (lives across turns)
@@ -168,9 +145,6 @@ export class BridgeDaemon {
     this.updateAvailable = null; // newer registry version, when one exists
     this.updateError = null; // why the last self-update did not apply
     this.updating = false; // npm is replacing our files — refuse new turns
-    this.logins = new Map(); // requestId → { sessionId, repoKey, handle } — open sign-in windows (preview-login.mjs)
-    this.verifyLocks = new Map(); // `${userId}:${repoKey}` → promise chain (one probe/refresh of a sign-in at a time)
-    this.previewStatusListeners = new Map(); // sessionId → (message) => void — the booting heartbeat of a verify turn
     this.unknownDevKeysLogged = new Set(); // "<repo>:<key>" — unknown dev.yaml keys are logged once
     this.restartPending = false; // files on disk are a different version than the one we loaded; restart when idle
   }
@@ -184,7 +158,7 @@ export class BridgeDaemon {
   }
 
   async hello() {
-    const profiles = await describeProfiles(resolveProfiles(this.config, this.kaiHome), this.usageByProfile);
+    const profiles = carryAuthStates(await describeProfiles(resolveProfiles(this.config, this.kaiHome), this.usageByProfile), (this.lastAuthStates ??= new Map()));
     const repos = toDeviceRepoReport(this.repoGroups);
     return this.api.hello({
       name: this.config.device?.name,
@@ -198,10 +172,6 @@ export class BridgeDaemon {
       updateAvailable: this.updateAvailable || null,
       updateError: this.updateError || null,
       autoUpdate: this.config.autoUpdate !== false,
-      // Verify sign-in: can this machine open a headed Chrome window, and
-      // which sign-in requests are open right now (replayed after sleep).
-      capabilities: { display: this.displayAvailable() },
-      activeLogins: [...this.logins.keys()],
     });
   }
 
@@ -216,16 +186,29 @@ export class BridgeDaemon {
     // (postinstall applies the patch; a self-update or --ignore-scripts
     // install can leave it unpatched). Idempotent, best-effort.
     ensureClaudeAcpPatched({ log: (level, event, data) => this.log(level, event, data) });
+    // The browser MCP's 30 s default per tool call cannot survive a heavy
+    // dev build — raised in the bundled playwright-core (see playwright-patch.mjs).
+    ensurePlaywrightTimeoutPatched({ log: (level, event, data) => this.log(level, event, data) });
     // A previous run that was killed (reboot, crash, `kill -9`) never got
     // to report its turns. Tell the server before doing anything else,
     // so those sessions settle instead of spinning.
     await this.reportInterruptedTurns();
     // Dev servers a killed daemon left behind would hold the declared ports
-    // (→ port_busy on the next preview) — end them; then drop evidence dirs
-    // nobody retried for two days.
+    // (→ port_busy on the next preview) — end them.
+    // Previews from the previous daemon life (self-update, `launchctl kickstart`,
+    // a crash) are RE-ADOPTED when their dev servers are still up — a warm
+    // Vite is minutes of compile nobody wants to pay again. What cannot be
+    // resumed is ended like any orphan.
+    await this.resumePreviews();
+    // Public links of the resumed previews come back too; a cloudflared the
+    // previous daemon left behind is ended first.
+    await this.tunnel
+      .resume({
+        liveSessionIds: [...this.services.keys()],
+        resolveBinary: () => (this.resolveCloudflared ?? resolveCloudflared)({ kaiHome: this.kaiHome, device: this.config?.device?.name || "this device", log: (...a) => this.log(...a) }),
+      })
+      .catch((err) => this.log("warn", "tunnel.resume.failed", { error: err?.message }));
     this.killOrphanedServices();
-    const swept = sweepOldArtifacts(join(this.kaiHome, "artifacts"), { maxAgeMs: ARTIFACT_MAX_AGE_MS });
-    if (swept.length) this.log("info", "artifacts.swept", { count: swept.length });
     await this.scanRepos();
     // The first hello must not kill the daemon: the server may be
     // restarting (deploys, local nodemon) — retry with backoff instead
@@ -233,6 +216,7 @@ export class BridgeDaemon {
     for (let delay = 5_000; ; delay = Math.min(delay * 2, 60_000)) {
       try {
         await this.hello();
+        await this.reportResumedPreviews();
         break;
       } catch (err) {
         if (err?.status === 401 || err?.status === 403) {
@@ -260,10 +244,20 @@ export class BridgeDaemon {
     // behind, node exited 0, and launchd's SuccessfulExit:false meant the
     // machine stayed offline until the next login — silently.
     this.heartbeat = setInterval(() => {
+      // `previews`: the sessions with a live runner — the Server's reaper
+      // stops what it still believes runs here but is not in this list.
       this.api
-        .heartbeat({ running: [...this.running.keys()] })
+        .heartbeat({ running: [...this.running.keys()], previews: [...this.services.keys()] })
+        .then(() => this.flushPendingReports())
         .catch((err) => this.onApiError("heartbeat", err));
     }, HEARTBEAT_MS);
+    // The realtime channel can be silently dead (a subscription that
+    // failed its auth during a Server restart, a socket the client
+    // believes is fine): every minute, pull whatever the server still
+    // expects this machine to run. Idempotent — a turn already running
+    // or already started by the channel is skipped.
+    this.pendingPoll = setInterval(() => void this.pullPendingWork("poll"), this.pendingPollMs ?? PENDING_POLL_MS);
+    this.pendingPoll.unref?.();
     // Plan-usage windows for the composer popover. Fire-and-forget on a
     // slow cadence, unref'd (the heartbeat keeps the process alive), and
     // NEVER in hello's path — the probe spawns the CLI (~2s per profile).
@@ -296,7 +290,7 @@ export class BridgeDaemon {
     // into them as soon as no turn is running — BEFORE asking the registry,
     // which needs network this check must not depend on.
     const onDisk = installedVersionOrNull();
-    const restart = decideRestart({ loaded: VERSION, installed: onDisk, running: this.running.size + this.logins.size + this.services.size });
+    const restart = decideRestart({ loaded: VERSION, installed: onDisk, running: this.running.size + this.services.size });
     this.restartPending = restart.action === "defer";
     if (restart.action === "restart") {
       this.log("info", "update.restart.stale", { loaded: VERSION, installed: onDisk });
@@ -314,10 +308,9 @@ export class BridgeDaemon {
     const decision = decideUpdate({
       current: VERSION,
       latest,
-      // An open sign-in window is work in flight too: replacing our files
-      // under a headed Chrome the user is typing into loses the capture —
-      // and so is a live preview someone may be looking at right now.
-      running: this.running.size + this.logins.size + this.services.size,
+      // A live preview someone may be looking at right now is work in
+      // flight too.
+      running: this.running.size + this.services.size,
       autoUpdate: this.config.autoUpdate !== false,
       lastAttempt: this.config.selfUpdate?.lastAttempt ?? null,
     });
@@ -396,7 +389,11 @@ export class BridgeDaemon {
       const candidates = profiles
         .filter((p) => p.harness === harness && p.kind !== "gleap-key" && p.configDir)
         .sort((a, b) => Number(b.kind === "ambient") - Number(a.kind === "ambient"));
-      const profile = candidates.find((p) => probeHarnessAuth(harness, p.configDir, this.kaiHome)?.state === "signed_in");
+      const auths = candidates.map((p) => ({ profile: p, auth: probeHarnessAuth(harness, p.configDir, this.kaiHome) }));
+      const profile = auths.find(({ auth }) => auth?.state === "signed_in")?.profile;
+      // No definite answer (the CLI timed out) is not "signed out": keep
+      // the previous list rather than blanking the picker.
+      if (!profile && auths.some(({ auth }) => auth?.state === "unknown")) continue;
       let models = null;
       if (profile) {
         try {
@@ -450,27 +447,35 @@ export class BridgeDaemon {
   /**
    * Shut down: abort turns, stop every preview (telling the dashboard why —
    * `stopped` / `daemon_restarted`, so the card offers Start instead of
-   * showing dead links), close sign-in windows. Resolves once the preview
+   * showing dead links). Resolves once the preview
    * reports have been given a bounded chance to land (the self-update
    * restart awaits it; sync callers may ignore the promise).
    */
   stop() {
     this.stopped = true;
     clearInterval(this.heartbeat);
+    clearInterval(this.pendingPoll);
     clearInterval(this.usageTimer);
     clearInterval(this.modelsTimer);
     clearInterval(this.updateTimer);
     if (this.realtimeRetry) clearTimeout(this.realtimeRetry);
     for (const entry of this.running.values()) entry.ctrl.abort();
+    // Previews OUTLIVE the daemon: gateways close (the next daemon re-binds
+    // the ports), the dev servers keep running and are resumed from
+    // state/previews.json — a warm app stays warm across self-updates and
+    // restarts. Ones nobody resumes are reaped by the next daemon's idle
+    // timer or orphan sweep.
     const reports = [];
     for (const [sessionId, runner] of this.services) {
-      runner.stopAll();
+      // The handoff file must describe the runner as it is NOW (pids, ports,
+      // warmed) — previewStart wrote it before the warm-up finished.
+      const prev = this.readPreviewSnapshots()[sessionId];
+      if (prev) this.writePreviewSnapshot(sessionId, { ...prev, runner: runner.snapshot(), savedAt: new Date().toISOString() });
+      runner.detach();
       this.clearPreviewIdleTimer(sessionId);
-      reports.push(this.api.sessionPreview(sessionId, { status: "stopped", urls: [], previews: [], errorCode: "daemon_restarted", error: "kai-bridge restarted — start the preview again." }).catch(() => {}));
     }
     this.services.clear();
-    this.writePreviewPids([]);
-    void this.teardownLogins(() => true, "daemon stopping");
+    for (const w of this.prewarming?.values() ?? []) void w.close();
     this.realtime?.disconnect?.();
     this.releaseLock();
     return Promise.race([Promise.allSettled(reports), new Promise((r) => setTimeout(r, 3_000).unref?.())]).then(() => undefined);
@@ -528,7 +533,7 @@ export class BridgeDaemon {
     return join(this.kaiHome, "state", "inflight.json");
   }
 
-  /** `[{ turnId, sessionId?, agent?, artifactsDir? }]` — pre-0.5.0 files held bare ids. */
+  /** `[{ turnId, sessionId?, agent? }]` — pre-0.5.0 files held bare ids. */
   readInflight() {
     try {
       const raw = JSON.parse(readFileSync(this.inflightPath, "utf8"));
@@ -547,21 +552,18 @@ export class BridgeDaemon {
     }
   }
 
+  /** Merges: the runner pid and the verify artifacts dir arrive after the turn's session meta. */
   rememberInflight(turnId, meta = {}) {
-    const rest = this.readInflight().filter((e) => e.turnId !== turnId);
-    this.writeInflight([...rest, { turnId, ...meta }]);
+    const all = this.readInflight();
+    const existing = all.find((e) => e.turnId === turnId);
+    this.writeInflight([...all.filter((e) => e.turnId !== turnId), { ...existing, turnId, ...meta }]);
   }
 
   forgetInflight(turnId) {
     this.writeInflight(this.readInflight().filter((e) => e.turnId !== turnId));
   }
 
-  /**
-   * Turns this machine was running when it was killed — report them dead.
-   * A verify turn also gets a `blocked` report ("kai-bridge restarted
-   * mid-run") carrying whatever evidence the browser had written, so the
-   * card shows the partial recording instead of spinning.
-   */
+  /** Turns this machine was running when it was killed — report them dead. */
   async reportInterruptedTurns() {
     const entries = this.readInflight();
     if (!entries.length) return;
@@ -569,16 +571,6 @@ export class BridgeDaemon {
     for (const entry of entries) {
       const { turnId } = entry;
       this.log("warn", "turn.interrupted", { turnId, agent: entry.agent });
-      if (entry.agent === "kai-verifier") {
-        const uploads = entry.artifactsDir ? await this.uploadSweptEvidence(turnId, entry.artifactsDir) : { uploads: [], failed: 0 };
-        await this.api
-          .turnVerification(turnId, {
-            ...buildVerificationPayload(null, uploads.uploads, { fallbackReason: "kai-bridge restarted mid-run", evidence: { failed: uploads.failed, ...(uploads.failed && entry.artifactsDir ? { kept: entry.artifactsDir } : {}) } }),
-            blockedCode: "other",
-          })
-          .catch((err) => this.log("warn", "verify.interrupted.report.failed", { turnId, error: err?.message }));
-        if (entry.artifactsDir && uploads.failed === 0) rmSync(entry.artifactsDir, { recursive: true, force: true });
-      }
       await this.api
         .turnResult(turnId, {
           status: "failed",
@@ -611,11 +603,155 @@ export class BridgeDaemon {
     }
   }
 
-  /** ServiceRunner hook: every dev-server pid is persisted while it lives. */
-  trackServicePid(sessionId, name, pid, op) {
+  get previewSnapshotsPath() {
+    return join(this.kaiHome, "state", "previews.json");
+  }
+
+  readPreviewSnapshots() {
+    try {
+      const raw = JSON.parse(readFileSync(this.previewSnapshotsPath, "utf8"));
+      return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    } catch {
+      return {};
+    }
+  }
+
+  writePreviewSnapshot(sessionId, data) {
+    try {
+      mkdirSync(dirname(this.previewSnapshotsPath), { recursive: true });
+      const all = this.readPreviewSnapshots();
+      if (data) all[sessionId] = data;
+      else delete all[sessionId];
+      writeFileSync(this.previewSnapshotsPath, JSON.stringify(all), { mode: 0o600 });
+    } catch (err) {
+      this.log("warn", "preview.snapshot.failed", { sessionId, error: err?.message });
+    }
+  }
+
+  /**
+   * Re-adopt the previews of the previous daemon life whose dev servers
+   * are still alive and listening (see ServiceRunner.resume). Runs BEFORE
+   * the orphan reaper and before the first hello — the Server is told once
+   * hello succeeded (`reportResumedPreviews`).
+   */
+  async resumePreviews() {
+    const snapshots = this.readPreviewSnapshots();
+    this.resumedReports = [];
+    for (const [sessionId, snap] of Object.entries(snapshots)) {
+      const runner = this.runnerFor(sessionId);
+      let failed;
+      try {
+        failed = await runner.resume(snap.runner);
+      } catch (err) {
+        failed = [{ error: err?.message }];
+      }
+      const previewSvcs = (snap.runner?.services ?? []).filter((svc) => !svc.adopted);
+      if (failed.length || !previewSvcs.length) {
+        this.log("info", "preview.resume.skipped", { sessionId, failed });
+        runner.stopAll();
+        this.services.delete(sessionId);
+        this.writePreviewSnapshot(sessionId, null);
+        this.resumedReports.push({ sessionId, body: { status: "stopped", urls: [], previews: [], errorCode: "daemon_restarted", error: "kai-bridge restarted — start the preview again." } });
+        continue;
+      }
+      if (snap.manual) (this.manualPreviews ??= new Set()).add(sessionId);
+      this.armPreviewIdleTimer(sessionId);
+      this.log("info", "preview.resumed", { sessionId, services: previewSvcs.map((svc) => `${svc.name}:${svc.port}`), warmed: !!snap.runner?.warmed });
+      this.resumedReports.push({ sessionId, body: { status: "running", previews: snap.previews ?? [], urls: snap.urls ?? snap.previews ?? [], landingUrl: snap.landingUrl ?? null } });
+    }
+  }
+
+  async reportResumedPreviews() {
+    const reports = this.resumedReports ?? [];
+    this.resumedReports = [];
+    for (const { sessionId, body } of reports) await this.reportPreview(sessionId, body);
+    await this.flushPendingReports();
+  }
+
+  /**
+   * One preview report. A `stopped` / `error` that cannot be delivered (the
+   * laptop is offline — an idle stop on 2026-09-14 left the dashboard on
+   * "running" for a week) is kept in state/pending-reports.json and resent
+   * after the next successful heartbeat. Latest per session wins; a session
+   * that runs again drops its stale one.
+   */
+  async reportPreview(sessionId, body) {
+    try {
+      await this.api.sessionPreview(sessionId, body);
+      return true;
+    } catch (err) {
+      this.log("warn", "preview.report.failed", { sessionId, error: err?.message });
+      if (body?.status === "stopped" || body?.status === "error") this.writePendingReport(sessionId, body);
+      return false;
+    }
+  }
+
+  get pendingReportsPath() {
+    return join(this.kaiHome, "state", "pending-reports.json");
+  }
+
+  readPendingReports() {
+    try {
+      const raw = JSON.parse(readFileSync(this.pendingReportsPath, "utf8"));
+      return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    } catch {
+      return {};
+    }
+  }
+
+  writePendingReport(sessionId, body) {
+    try {
+      mkdirSync(dirname(this.pendingReportsPath), { recursive: true });
+      const all = this.readPendingReports();
+      if (body) all[sessionId] = body;
+      else delete all[sessionId];
+      writeFileSync(this.pendingReportsPath, JSON.stringify(all), { mode: 0o600 });
+    } catch (err) {
+      this.log("warn", "preview.pending.failed", { sessionId, error: err?.message });
+    }
+  }
+
+  async flushPendingReports() {
+    for (const [sessionId, body] of Object.entries(this.readPendingReports())) {
+      if (this.services.has(sessionId)) {
+        this.writePendingReport(sessionId, null); // running again: the old stop is history
+        continue;
+      }
+      if (await this.reportPreview(sessionId, body)) {
+        this.writePendingReport(sessionId, null);
+        this.log("info", "preview.report.resent", { sessionId, status: body?.status });
+      }
+    }
+  }
+
+  /**
+   * ServiceRunner hook: every dev-server pid is persisted while it lives —
+   * with its port and the session's title/link, so `kai-bridge ps` can
+   * show a preview-only session without a turn to borrow the meta from.
+   */
+  trackServicePid(sessionId, name, pid, op, { port = null } = {}) {
     if (!Number.isInteger(pid)) return;
     const rest = this.readPreviewPids().filter((e) => e.pid !== pid);
-    this.writePreviewPids(op === "add" ? [...rest, { pid, name, sessionId, startedAt: new Date().toISOString() }] : rest);
+    const session = this.sessionMeta?.get(sessionId) ?? {};
+    this.writePreviewPids(op === "add" ? [...rest, { pid, name, sessionId, port, ...session, startedAt: new Date().toISOString() }] : rest);
+  }
+
+  /**
+   * Title, dashboard link and repo keys of a session this machine works
+   * on — copied into the inflight / preview-pid entries (ps.mjs reads
+   * them back). Remembered from turn starts and preview starts alike.
+   */
+  rememberSession(sessionId, { title = null, sessionUrl = null, repos = [] } = {}) {
+    if (typeof sessionId !== "string") return {};
+    this.sessionMeta ??= new Map();
+    const prev = this.sessionMeta.get(sessionId) ?? {};
+    const meta = {
+      title: typeof title === "string" && title ? title : prev.title ?? null,
+      sessionUrl: typeof sessionUrl === "string" && sessionUrl ? sessionUrl : prev.sessionUrl ?? null,
+      repos: Array.isArray(repos) && repos.length ? repos.map((r) => (typeof r === "string" ? r : r?.key)).filter((k) => typeof k === "string") : prev.repos ?? [],
+    };
+    this.sessionMeta.set(sessionId, meta);
+    return meta;
   }
 
   /**
@@ -626,9 +762,12 @@ export class BridgeDaemon {
    */
   killOrphanedServices({ kill = process.kill, platform = process.platform } = {}) {
     const entries = this.readPreviewPids();
-    this.writePreviewPids([]);
+    const keep = new Set();
+    for (const runner of this.services.values()) for (const pid of runner.resumedPids?.values() ?? []) keep.add(pid);
+    this.writePreviewPids(entries.filter((e) => keep.has(e.pid)));
     let killed = 0;
     for (const e of entries) {
+      if (keep.has(e.pid)) continue;
       try {
         kill(e.pid, 0); // alive?
       } catch {
@@ -684,7 +823,7 @@ export class BridgeDaemon {
           /* already gone */
         }
         this.connectRealtime();
-      }, REALTIME_RETRY_MS);
+      }, this.realtimeRetryMs ?? REALTIME_RETRY_MS);
     }
   }
 
@@ -700,6 +839,20 @@ export class BridgeDaemon {
       this.log("warn", "reconnect.hello.failed", { error: err.message });
       return;
     }
+    await this.pullPendingWork("reconnect");
+  }
+
+  /**
+   * Ask the server what it still believes we're running and pick those
+   * turns up. Called after a reconnect and on
+   * a slow timer (`PENDING_POLL_MS`) — the timer is what saves a device
+   * whose channel subscription failed silently. Never runs twice at once,
+   * never while an update is replacing our files (the channel refuses
+   * turns then too).
+   */
+  async pullPendingWork(via = "poll") {
+    if (this.stopped || this.updating || this.pullingPending) return;
+    this.pullingPending = true;
     try {
       const pending = await this.api.pendingTurns();
       // Cancels the server settled while we were away (reaper / watchdog):
@@ -709,24 +862,21 @@ export class BridgeDaemon {
       for (const turnId of cancelled) {
         const run = this.running.get(turnId);
         if (!run) continue;
-        this.log("info", "turn.cancel.replayed", { turnId });
+        this.log("info", "turn.cancel.replayed", { turnId, via });
         run.ctrl.abort();
       }
       for (const turn of pending?.turns || []) {
         if (this.running.has(turn.turnId) || cancelled.has(String(turn.turnId))) continue;
-        this.log("info", "turn.recovered", { turnId: turn.turnId });
+        this.log("info", "turn.recovered", { turnId: turn.turnId, via });
         void this.startTurn(turn).catch((err) => this.log("error", "turn.recover.failed", { error: err.message }));
       }
-      // Sign-in requests published while we were away: open their windows now.
-      for (const req of pending?.loginRequests || []) {
-        if (!req?.requestId || this.logins.has(req.requestId)) continue;
-        this.log("info", "verify.login.recovered", { requestId: req.requestId });
-        void this.loginStart(req).catch((err) => this.log("error", "verify.login.recover.failed", { error: err.message }));
-      }
     } catch (err) {
-      // Older server without the endpoint: the server-side sweep still
-      // fails orphaned turns, so this is a nice-to-have, not a must.
-      this.log("debug", "pending.unavailable", { error: err.message });
+      // Older server without the endpoint, or the server is restarting: the
+      // server-side sweep still fails orphaned turns, so this is a
+      // nice-to-have, not a must.
+      this.log("debug", "pending.unavailable", { via, error: err.message });
+    } finally {
+      this.pullingPending = false;
     }
   }
 
@@ -810,30 +960,33 @@ export class BridgeDaemon {
             entry.ctrl.abort();
           }
         }
-        this.services.get(data.sessionId)?.stopAll();
-        this.services.delete(data.sessionId);
-        this.clearPreviewIdleTimer(data.sessionId);
-        // A sign-in window opened for this session has nothing to sign in to any more.
-        await this.teardownLogins((l) => l.sessionId === data.sessionId, "session closed");
+        // The dashboard's Stop (`reason: "stopped"`) keeps a live preview: the
+        // user may come back to it, and a warm dev server is minutes of
+        // compile. The idle reaper ends it when nobody comes back.
+        // Merged / deleted sessions (and pre-reason Servers) stop it now.
+        if (data.reason === "stopped" && this.services.has(data.sessionId)) {
+          this.log("info", "preview.kept.session_stopped", { sessionId: data.sessionId });
+          this.armPreviewIdleTimer(data.sessionId);
+        } else {
+          this.services.get(data.sessionId)?.stopAll();
+          this.services.delete(data.sessionId);
+          this.clearPreviewIdleTimer(data.sessionId);
+          this.writePreviewSnapshot(data.sessionId, null);
+          void this.tunnelManager?.removeSession(data.sessionId);
+        }
         // Pre-0.4.0 daemons kept a browser profile per session; drop leftovers.
         rmSync(join(this.kaiHome, "browser", String(data.sessionId).replace(/[^\w.-]/g, "_")), { recursive: true, force: true });
         return;
-      case "bridge.verify.login.start":
-        return this.loginStart(data);
-      case "bridge.verify.login.done":
-        return this.loginDone(data);
-      case "bridge.verify.login.cancel":
-        return this.loginCancel(data);
-      case "bridge.verify.evidence.retry":
-        return this.retryEvidence(data);
       case "bridge.preview.start":
-        // A preview the USER started stays up until they stop it (or it
-        // idles out); one that Verify booted is released after the run.
+        // A preview the USER started stays up until they stop it (or it idles out).
         (this.manualPreviews ??= new Set()).add(data.sessionId);
-        this.verifyOwnedPreviews?.delete(data.sessionId);
         return this.previewStart(data);
       case "bridge.preview.stop":
         return this.previewStop(data);
+      case "bridge.preview.publish":
+        return this.previewPublish(data);
+      case "bridge.preview.unpublish":
+        return this.previewUnpublish(data);
       case "bridge.preview.keepalive":
         // Dashboard heartbeat while someone is actually LOOKING at the
         // preview — makes the idle auto-stop mean real idleness instead
@@ -856,19 +1009,23 @@ export class BridgeDaemon {
    * truncation. `companionRemotes` (Server-resolved `{ key: remote }`) is
    * how non-github companions get cloned; `note` survives onto error writes.
    */
-  async previewStart({ sessionId, title, repos, companionRemotes = null }) {
+  async previewStart({ sessionId, title, repos, sessionUrl = null, companionRemotes = null, publicMode = false }) {
+    this.rememberSession(sessionId, { title, sessionUrl, repos });
     let lastNote = null;
     const skipped = [];
-    // Every report is also RETURNED: the verify turn boots the preview
-    // through this same path and needs the final status + preview URLs.
+    // Every report is also RETURNED (callers and tests read the final status + preview URLs).
     const report = async (payload) => {
       if (payload.note) lastNote = payload.note;
-      const body = payload.status === "error" ? { ...payload, urls: payload.urls ?? [], previews: payload.previews ?? [], ...(lastNote && !payload.note ? { note: lastNote } : {}), ...(skipped.length && !payload.skipped ? { skipped } : {}) } : payload;
-      await this.api.sessionPreview(sessionId, body).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
+      const body =
+        payload.status === "error"
+          ? { ...payload, urls: payload.urls ?? [], previews: payload.previews ?? [], ...(lastNote && !payload.note ? { note: lastNote } : {}), ...(skipped.length && !payload.skipped ? { skipped } : {}) }
+          : // A note-only `running` tick must not wipe the skipped rows the boot reported.
+            { ...payload, ...(skipped.length && !payload.skipped ? { skipped } : {}) };
+      await this.reportPreview(sessionId, body);
       return body;
     };
     const fail = (err, ctx = {}) => report(toPreviewErrorPayload(err, { ...ctx, skipped }));
-    await report({ status: "starting" });
+    await report({ status: "starting", ...(publicMode ? { note: "Restarting with the public address…" } : {}) });
     let runner = null;
     try {
       // Pass 1 — resolve every session repo (checkout, env, config).
@@ -921,6 +1078,7 @@ export class BridgeDaemon {
       const remotes = companionRemotes && typeof companionRemotes === "object" ? companionRemotes : {};
       const { companions } = await collectCompanions({
         roots: resolved.map((r) => ({ key: r.key, config: r.config })),
+        extra: this.reverseCompanions(resolved),
         maxDepth: COMPANION_MAX_DEPTH,
         loadConfig: async (key) => {
           try {
@@ -949,11 +1107,38 @@ export class BridgeDaemon {
       }
       const bootable = companions.filter((c) => c.config);
 
+      // Public mode: one hostname per service (own repos + companions) from
+      // the Server, which also decides which other public session loses its
+      // link on this device — stopped here, before this one boots.
+      let publicHosts = null;
+      if (publicMode) {
+        await report({ status: "starting", note: "Getting the public address…" });
+        const services = [
+          ...bootable.flatMap((c) => Object.values(c.config.services).map((s) => ({ repoKey: c.key, service: s.name, sessionRepo: false }))),
+          ...resolved.flatMap((r) => Object.values(r.config.services).map((s) => ({ repoKey: r.key, service: s.name, sessionRepo: true }))),
+        ];
+        const answer = await this.api.publicHosts({ sessionId, services });
+        for (const id of answer?.displaced || []) if (id !== sessionId) await this.previewStop({ sessionId: id });
+        publicHosts = {};
+        for (const h of answer?.hosts || []) (publicHosts[String(h.repoKey).toLowerCase()] ??= {})[h.service] = h.hostname;
+        this.tunnel.ensureRunning(answer.tunnel);
+      }
+      const hostsFor = (key) => publicHosts?.[String(key).toLowerCase()] ?? null;
+
       runner = this.runnerFor(sessionId);
       // Pass 3 — ports for EVERY config (companions + session repos) before
       // any boot, so `${port:x}` cross-references resolve whatever the order.
-      for (const c of bootable) await runner.assignPorts(c.group.primary.path, c.config, { mode: "local", repoKey: c.key });
-      for (const r of resolved) await runner.assignPorts(r.cwd, r.config, { mode: r.mode, repoKey: r.key, envSource: r.envSource });
+      for (const c of bootable) await runner.assignPorts(c.group.primary.path, c.config, { mode: "local", repoKey: c.key, publicHosts: hostsFor(c.key) });
+      for (const r of resolved) await runner.assignPorts(r.cwd, r.config, { mode: r.mode, repoKey: r.key, envSource: r.envSource, publicHosts: hostsFor(r.key) });
+      // The public addresses answer as soon as the dev servers do: routes go
+      // in BEFORE the boot (cloudflared → the service's gateway port).
+      if (publicMode) {
+        const routes = Object.entries(runner.publicHosts || {})
+          .filter(([name]) => runner.ports[name])
+          .map(([name, hostname]) => ({ hostname, port: runner.ports[name], protocol: runner.meta.get(name)?.protocol || "http" }));
+        await this.tunnel.setRoutes(sessionId, routes);
+        await report({ status: "starting", note: "Public address ready. Starting the services…" });
+      }
 
       // Pass 4 — boot companions (deepest first, local mode: an already
       // running dev server of that repo is adopted), then the session repos
@@ -984,19 +1169,189 @@ export class BridgeDaemon {
         }
       }
       const urls = [...previews, ...companionPreviews];
-      // The landing page is a session repo's preview (never a companion's).
-      const landing = previews[0] ?? companionPreviews[0] ?? null;
-      this.armPreviewIdleTimer(sessionId);
-      return report({ status: "running", previews: urls, urls, landingUrl: landing?.url ?? null, ...(skipped.length ? { skipped } : {}) });
+      // The landing page: the session repo's web preview, else the first web
+      // preview at all (a Server ticket lands on its Frontend companion),
+      // else whatever the session repo serves.
+      const landing = previews.find((p) => p.kind !== "api") ?? urls.find((p) => p.kind !== "api") ?? previews[0] ?? companionPreviews[0] ?? null;
+      const running = { status: "running", previews: urls, urls, landingUrl: landing?.url ?? null, ...(skipped.length ? { skipped } : {}) };
+      // `running` goes out as soon as the dev servers answer — BEFORE the
+      // warm-up: the Server's booting deadline (3 min) and the dashboard
+      // must not wait out a cold compile (10 min on a big Vite app). The
+      // gateway keeps holding document requests on the "starting" page
+      // until the app is warm, so nobody actually lands on a cold server.
+      await report(running);
+      this.writePreviewSnapshot(sessionId, { previews: urls, urls, landingUrl: landing?.url ?? null, manual: !!this.manualPreviews?.has(sessionId), runner: runner.snapshot(), savedAt: new Date().toISOString() });
+      // Warm the app ONCE before anyone is let in: a cold dev server compiles
+      // its whole module graph on the first page load. Done here,
+      // sequentially, the agent and the user's tabs all arrive at a warm
+      // server instead of stampeding a cold one. Progress rides along as a
+      // `running` note; the same body again once warm clears the note.
+      const gen = this.bumpPreviewGeneration(sessionId);
+      return this.warmPreview(sessionId, landing, runner, report).then((warmed) => {
+        // Stopped or replaced while warming: nothing to re-announce, no idle
+        // timer for a runner that is gone — and the awaiting caller must
+        // never take the pre-stop body as a live preview.
+        if (this.services.get(sessionId) !== runner) {
+          return { status: "stopped", urls: [], previews: [], error: "The preview was stopped while it was starting." };
+        }
+        this.armPreviewIdleTimer(sessionId);
+        // Made public (or local) while warming: that path announced the current
+        // addresses; re-announcing THIS body would roll them back.
+        return warmed && this.previewGeneration.get(sessionId) === gen ? report(running) : running;
+      });
     } catch (err) {
       this.log("error", "preview.start.failed", { sessionId, error: err.message, code: err?.code });
       runner?.stopAll();
       this.services.delete(sessionId);
       this.clearPreviewIdleTimer(sessionId);
+      if (publicMode) await this.tunnel.removeSession(sessionId);
       return fail(err);
     }
   }
 
+  /**
+   * Which announcement of a session's addresses is current. A warm-up that
+   * finishes after "Make public" swapped the addresses must not re-announce
+   * the pre-publish body (seen 2026-09-21: the public URLs vanished 3 s after
+   * they appeared).
+   */
+  bumpPreviewGeneration(sessionId) {
+    this.previewGeneration ??= new Map();
+    const gen = (this.previewGeneration.get(sessionId) ?? 0) + 1;
+    this.previewGeneration.set(sessionId, gen);
+    return gen;
+  }
+
+  /** Lazily built: embedded hosts and tests build a daemon without the constructor. */
+  get tunnel() {
+    return (this.tunnelManager ??= new TunnelManager({ kaiHome: this.kaiHome, log: (...a) => this.log(...a) }));
+  }
+
+  /**
+   * "Make public": the preview re-boots with the public addresses (the web
+   * bundle bakes the API origin in at boot). Needs `cloudflared` — on PATH,
+   * downloaded before, or downloaded now; else the dashboard gets a
+   * `dependency_missing` card with the install hint and a Retry.
+   */
+  async previewPublish(data) {
+    const { sessionId } = data;
+    (this.manualPreviews ??= new Set()).add(sessionId);
+    try {
+      // `this.resolveCloudflared` is injectable for tests (the default may download).
+      this.tunnel.binary = await (this.resolveCloudflared ?? resolveCloudflared)({ kaiHome: this.kaiHome, device: this.config?.device?.name || "this device", log: (...a) => this.log(...a) });
+    } catch (err) {
+      await this.reportPreview(sessionId, toPreviewErrorPayload(err));
+      return;
+    }
+    this.rememberSession(sessionId, data);
+    // A running preview goes public IN PLACE; nothing running → a normal boot in public mode.
+    if (this.services.has(sessionId) && this.readPreviewSnapshots()[sessionId]) return this.previewRepublish({ sessionId, makePublic: true });
+    return this.previewStart({ ...data, publicMode: true });
+  }
+
+  /** "Stop sharing": back to local addresses, the preview keeps running. Nothing running → a plain stop. */
+  async previewUnpublish({ sessionId }) {
+    if (this.services.has(sessionId) && this.readPreviewSnapshots()[sessionId]) return this.previewRepublish({ sessionId, makePublic: false });
+    return this.previewStop({ sessionId });
+  }
+
+  /**
+   * Switch a LIVE preview between local and public addresses. Routes go in
+   * first, so the link answers at once (the gateway's "starting" page while
+   * the web app restarts); then only the services that bake a `${url:…}`
+   * restart (`ServiceRunner.setPublicHosts`) — an API or an adopted dev
+   * server is not touched. Measured 2026-09-21: a full re-boot of web + a
+   * worktree Server took ~85 s, the web restart alone ~30 s.
+   */
+  async previewRepublish({ sessionId, makePublic }) {
+    // Two flips of one session must never overlap: on 2026-09-21 a doubled
+    // "Make public" (19 ms apart) had the second flip stop the web app the
+    // first had just restarted, and the preview died as "did not come
+    // back". The same direction joins the running flip; the opposite waits.
+    const flips = (this.republishing ??= new Map());
+    const current = flips.get(sessionId);
+    if (current?.makePublic === makePublic) return current.promise;
+    if (current) {
+      await current.promise.catch(() => {});
+      if (!this.services.has(sessionId)) return;
+    }
+    const promise = this.runPreviewRepublish({ sessionId, makePublic }).finally(() => {
+      if (flips.get(sessionId)?.promise === promise) flips.delete(sessionId);
+    });
+    flips.set(sessionId, { makePublic, promise });
+    return promise;
+  }
+
+  async runPreviewRepublish({ sessionId, makePublic }) {
+    const runner = this.services.get(sessionId);
+    const snap = this.readPreviewSnapshots()[sessionId];
+    const report = (body) => this.reportPreview(sessionId, body).then(() => body);
+    this.clearPreviewIdleTimer(sessionId);
+    // A warm-up still running from the start (a cold Vite compile) ticks
+    // `running` with the LOCAL urls every 20 s — mid-flip that painted a
+    // "Public link" card with no link (2026-09-21). Retire it: a new
+    // generation mutes its ticks, and closing its browser ends it.
+    this.bumpPreviewGeneration(sessionId);
+    this.prewarming?.get(sessionId)?.close?.();
+    await report({ status: "starting", previews: snap.urls ?? snap.previews ?? [], note: makePublic ? "Getting the public address…" : "Switching back to local addresses…" });
+    try {
+      let hosts = null;
+      if (makePublic) {
+        const sessionKeys = new Set((this.sessionMeta?.get(sessionId)?.repos || []).map((k) => String(k).toLowerCase()));
+        const services = [...runner.meta].filter(([, m]) => m.repoKey).map(([name, m]) => ({ repoKey: m.repoKey, service: name, sessionRepo: sessionKeys.has(String(m.repoKey).toLowerCase()) }));
+        const answer = await this.api.publicHosts({ sessionId, services });
+        for (const id of answer?.displaced || []) if (id !== sessionId) await this.previewStop({ sessionId: id });
+        hosts = Object.fromEntries((answer?.hosts || []).map((h) => [h.service, h.hostname]));
+        this.tunnel.ensureRunning(answer.tunnel);
+        const routes = Object.entries(hosts).filter(([name]) => runner.ports[name]).map(([name, hostname]) => ({ hostname, port: runner.ports[name], protocol: runner.meta.get(name)?.protocol || "http" }));
+        await this.tunnel.setRoutes(sessionId, routes);
+        await report({ status: "starting", note: "Public address ready. Restarting the web app with it…" });
+      } else {
+        await this.tunnelManager?.removeSession(sessionId);
+      }
+      await runner.setPublicHosts(hosts);
+      const urls = (snap.urls ?? snap.previews ?? []).map(({ publicUrl: _old, ...p }) => (hosts?.[p.name] ? { ...p, publicUrl: `https://${hosts[p.name]}` } : p));
+      const landing = urls.find((p) => p.kind !== "api") ?? urls[0] ?? null;
+      const running = { status: "running", previews: urls, urls, landingUrl: landing?.url ?? null };
+      await report(running);
+      this.writePreviewSnapshot(sessionId, { ...snap, previews: urls, urls, runner: runner.snapshot(), savedAt: new Date().toISOString() });
+      const gen = this.bumpPreviewGeneration(sessionId);
+      return this.warmPreview(sessionId, landing, runner, report).then((warmed) => {
+        if (this.services.get(sessionId) !== runner) return { status: "stopped", urls: [], previews: [] };
+        this.armPreviewIdleTimer(sessionId);
+        return warmed && this.previewGeneration.get(sessionId) === gen ? report(running) : running;
+      });
+    } catch (err) {
+      this.log("error", "preview.republish.failed", { sessionId, makePublic, error: err.message, code: err?.code });
+      runner.stopAll();
+      this.services.delete(sessionId);
+      this.writePreviewSnapshot(sessionId, null);
+      await this.tunnelManager?.removeSession(sessionId);
+      return report(toPreviewErrorPayload(err));
+    }
+  }
+
+  /**
+   * Repos on this device whose dev config names a session repo as a
+   * companion and that have a web preview: booted alongside as optional
+   * companions (a Server ticket gets its Frontend, pointed at the ticket's
+   * Server), unless they opt out with `reverseCompanions: false`. Only
+   * checkouts already here — never cloned for this.
+   */
+  reverseCompanions(resolved) {
+    const sessionKeys = new Set(resolved.map((r) => String(r.key).toLowerCase()));
+    const out = [];
+    for (const group of this.repoGroups || []) {
+      const key = String(group.key).toLowerCase();
+      if (sessionKeys.has(key) || !group.primary?.path) continue;
+      const config = readDevConfig(group.primary.path);
+      if (!config || config.error || config.reverseCompanions === false || !config.preview) continue;
+      if (config.services[config.preview]?.kind === "api") continue;
+      if (config.companions.some((c) => sessionKeys.has(c.repo))) out.push({ repo: key, optional: true });
+    }
+    return out;
+  }
+
   /**
    * Config resolution order: this worktree's own config, then the PRIMARY
    * checkout's (a repo verified by the setup agent has its dev.yaml on an
@@ -1037,7 +1392,7 @@ export class BridgeDaemon {
 
   /**
    * The session's worktree for a repo: the exact slug when the title is
-   * known; otherwise (sign-in commands carry only the session id) the one
+   * known; otherwise (a command that carries only the session id) the one
    * directory under `~/.kai/worktrees/<repo>/` that ends in the session's
    * id suffix — slugs are `<title>-<last 8 of the id>`, unique per session.
    */
@@ -1060,8 +1415,8 @@ export class BridgeDaemon {
    * `PreviewError` carrying the classified log line + code when a service
    * never becomes ready — a "running" preview must not 404.
    */
-  async bootRepoWithConfig(runner, cwd, config, mode, repoKey = null, opts = {}) {
-    const started = await runner.start(cwd, config, { mode, repoKey, ...opts });
+  async bootRepoWithConfig(runner, cwd, config, mode, repoKey = null) {
+    const started = await runner.start(cwd, config, { mode, repoKey });
     const dead = started.services.find((s) => !s.adopted && !s.ready);
     if (dead) {
       throw new PreviewError(`${dead.name} did not start${dead.error ? ` — ${dead.error}` : ""}`, {
@@ -1139,15 +1494,100 @@ export class BridgeDaemon {
       }
       runner.stopAll();
       this.services.delete(sessionId);
+      this.writePreviewSnapshot(sessionId, null);
+      void this.tunnelManager?.removeSession(sessionId);
       this.log("info", "preview.idle.stopped", { sessionId });
-      this.api
-        .sessionPreview(sessionId, { status: "stopped", urls: [], previews: [], errorCode: "idle_stopped", error: "Stopped automatically after 30 minutes." })
-        .catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
+      void this.reportPreview(sessionId, { status: "stopped", urls: [], previews: [], errorCode: "idle_stopped", error: "Stopped automatically after 30 minutes." });
     }, this.previewIdleMs ?? 30 * 60 * 1000);
     t.unref?.();
     this.previewIdleTimers.set(sessionId, t);
   }
 
+  /**
+   * The warm-up gate. Loads the landing page once, headless, BEFORE the
+   * preview is reported running. While it runs, the service's gateway holds
+   * browser tabs on a reloading "Kai is starting the preview" page (they
+   * would otherwise pile onto the cold compile), and the dashboard shows
+   * the elapsed time. Bounded by PREWARM_TIMEOUT_MS; a timeout is logged
+   * and the preview still opens. Skipped for a runner already warmed, on
+   * a device without a browser, and for previews with no web landing page.
+   */
+  async warmPreview(sessionId, landing, runner, report = async () => {}) {
+    // Single-flight per session: two callers arriving while the app compiles share one run.
+    this.prewarming ??= new Map();
+    const inFlight = this.prewarming.get(sessionId);
+    if (inFlight?.promise) return inFlight.promise;
+    const entry = { close: () => {}, promise: null };
+    this.prewarming.set(sessionId, entry);
+    entry.promise = this.warmPreviewOnce(sessionId, landing, runner, report, entry).finally(() => {
+      if (this.prewarming?.get(sessionId) === entry) this.prewarming.delete(sessionId);
+    });
+    return entry.promise;
+  }
+
+  async warmPreviewOnce(sessionId, landing, runner, report, entry) {
+    const url = landing?.url ?? null;
+    if (!url || !runner || runner.warmed || this.stopped) return false;
+    // A flip (make public / stop sharing) bumps the generation: this warm-up
+    // then belongs to a web app that is being replaced — no more reports.
+    const gen = this.previewGeneration?.get(sessionId) ?? 0;
+    const current = () => !this.stopped && this.services.get(sessionId) === runner && (this.previewGeneration?.get(sessionId) ?? 0) === gen;
+    const pw = this.loadPlaywright();
+    if (typeof pw?.chromium?.launch !== "function") return false;
+    const browser = await this.ensurePreviewBrowser().catch(() => null);
+    if (!browser?.ok) return false;
+    const gateway = landing?.name ? runner.gatewayFor?.(landing.name) : null;
+    const startedAt = Date.now();
+    const elapsed = () => {
+      const sec = Math.round((Date.now() - startedAt) / 1000);
+      return sec >= 60 ? `${Math.floor(sec / 60)}m ${String(sec % 60).padStart(2, "0")}s` : `${sec}s`;
+    };
+    const noteFor = () => `Compiling the app for the first time (${elapsed()})… a cold dev server can take a few minutes; later starts are fast.`;
+    // The preview is already reported `running` (urls up) — the note rides
+    // on that status so it never regresses to `starting`.
+    const tick = async () => {
+      if (!current()) return; // never overtake a `stopped` report, nor a flip in progress
+      const note = noteFor();
+      gateway?.hold(note);
+      await report({ status: "running", note });
+    };
+    await tick();
+    const ticker = setInterval(() => void tick(), 20_000);
+    ticker.unref?.();
+    let instance = null;
+    entry.close = () => instance?.close().catch(() => {});
+    try {
+      instance = await pw.chromium.launch(launchOptionsFor({ headless: true, browser: browser.browser === "chrome" ? "chrome" : null }));
+      const context = await instance.newContext({ extraHTTPHeaders: { [WARMUP_HEADER]: "1" } });
+      const page = await context.newPage();
+      // `domcontentloaded` is the point where every statically imported
+      // module has been transformed and run — that is the compile the warm-up
+      // exists to pay for. `load` additionally waits for fonts, images and
+      // late chunks, which on a big dev build pushed a cold warm-up past its
+      // whole budget (measured 2026-09-15: 10 min → "Timeout exceeded").
+      await page.goto(url, { waitUntil: "domcontentloaded", timeout: PREWARM_TIMEOUT_MS });
+      // Let lazy chunks and the app's first API calls land too.
+      await new Promise((r) => setTimeout(r, 5_000));
+      // Stopped, replaced or torn down while we waited: stop() has already
+      // written the handoff snapshot from the live runner — a rewrite from a
+      // detached one would record no services and the next daemon would
+      // reap the warm servers as orphans.
+      if (!current()) return false;
+      runner.warmed = true;
+      this.log("info", "preview.warmed", { sessionId, ms: Date.now() - startedAt });
+      // A daemon restart re-adopts this preview as warm (no second gate).
+      const prev = this.readPreviewSnapshots()[sessionId];
+      if (prev) this.writePreviewSnapshot(sessionId, { ...prev, runner: runner.snapshot(), savedAt: new Date().toISOString() });
+    } catch (err) {
+      this.log("warn", "preview.warm.failed", { sessionId, ms: Date.now() - startedAt, error: String(err?.message || err).split("\n")[0] });
+    } finally {
+      clearInterval(ticker);
+      gateway?.release();
+      await instance?.close().catch(() => {});
+    }
+    return true;
+  }
+
   /** Any ESTABLISHED connection on one of the runner's (non-adopted) ports? Injectable for tests. */
   async previewHasConnections(runner) {
     const count = this.countConnections ?? ((port) => establishedConnections(port));
@@ -1166,13 +1606,12 @@ export class BridgeDaemon {
 
   async previewStop({ sessionId }) {
     this.manualPreviews?.delete(sessionId);
-    this.verifyOwnedPreviews?.delete(sessionId);
-    // A sign-in window for this session has nothing left to sign in to.
-    await this.teardownLogins((l) => l.sessionId === sessionId, "preview stopped");
     this.services.get(sessionId)?.stopAll();
     this.services.delete(sessionId);
     this.clearPreviewIdleTimer(sessionId);
-    await this.api.sessionPreview(sessionId, { status: "stopped", urls: [], previews: [] }).catch((err) => this.log("warn", "preview.report.failed", { error: err.message }));
+    this.writePreviewSnapshot(sessionId, null);
+    await this.tunnelManager?.removeSession(sessionId);
+    await this.reportPreview(sessionId, { status: "stopped", urls: [], previews: [] });
   }
 
   /**
@@ -1187,6 +1626,7 @@ export class BridgeDaemon {
     this.log("warn", "preview.service.died", { sessionId, name: info.name, code: info.code, errorCode: info.errorCode });
     runner.stopAll();
     this.services.delete(sessionId);
+    this.writePreviewSnapshot(sessionId, null);
     this.clearPreviewIdleTimer(sessionId);
     return this.api
       .sessionPreview(
@@ -1207,20 +1647,17 @@ export class BridgeDaemon {
     let runner = this.services.get(sessionId);
     if (!runner) {
       // Stable ports (hash of repo + service in 43000-43999, when free) keep
-      // a saved sign-in's origins matching from one session to the next.
+      // a service's URL the same from one session to the next.
       runner = new ServiceRunner({
         kaiHome: this.kaiHome,
         sessionId,
         log: this.log,
-        onStatus: (message) => {
-          this.log("info", "preview.status", { sessionId, message });
-          this.previewStatusListeners?.get(sessionId)?.(message);
-        },
+        onStatus: (message) => this.log("info", "preview.status", { sessionId, message }),
         preferredPort: ({ repoKey, service }) => preferredStablePort(repoKey, service),
         ...(this.describeListener ? { describeListener: this.describeListener } : {}),
         ...(this.previewSettleMs != null ? { settleMs: this.previewSettleMs } : {}),
         onServiceExit: (info) => this.onServiceDied(sessionId, info),
-        onProcess: (name, pid, op) => this.trackServicePid(sessionId, name, pid, op),
+        onProcess: (name, pid, op, info) => this.trackServicePid(sessionId, name, pid, op, info),
       });
       this.services.set(sessionId, runner);
     }
@@ -1228,21 +1665,23 @@ export class BridgeDaemon {
   }
 
   /** Map the Server's repo bindings onto local checkouts; throw a readable error when one is missing. */
-  bindRepos(turn) {
+  async bindRepos(turn) {
     const bound = [];
     for (const r of turn.repos || []) {
       const group = this.repoGroups.find((g) => g.key === r.key);
       if (!group) throw new Error(`Repository ${r.key} is not checked out on this device.`);
       const mode = r.mode || this.config.repoModes?.[r.key] || "worktree";
-      const ws = materializeBinding({
+      const ws = await this.withGitAuth(r.key, (gitEnv) => materializeBinding({
         kaiHome: this.kaiHome,
         repo: { name: group.name, primaryPath: group.primary.path, defaultBranch: group.primary.defaultBranch },
         binding: { mode, base: r.base, carryUncommitted: r.carryUncommitted },
         sessionId: turn.sessionId,
         title: turn.title,
-      });
+        gitEnv,
+      }));
       bound.push({ key: r.key, ...ws });
       if (ws.deps) this.log("info", "deps.seed", { repo: r.key, ...ws.deps });
+      if (ws.fetch && (ws.fetch.stale || ws.fetch.attempts > 1)) this.log("warn", "workspace.fetch.contended", { repo: r.key, ...ws.fetch });
       // Remember the choice per repo (the UI asks once, then sticks).
       this.config.repoModes = { ...(this.config.repoModes || {}), [r.key]: mode };
     }
@@ -1305,117 +1744,58 @@ export class BridgeDaemon {
     this.running.set(turnId, entry);
     const releaseAwake = keepAwake();
     let outcome = null;
-    // Verify turns (`agent: kai-verifier`): preview booted up front, browser
-    // evidence collected into an artifacts dir, report uploaded after the
-    // turn — see prepareVerifyTurn / finishVerification.
-    const isVerify = turn.agent === "kai-verifier";
-    let verify = null;
-    this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent ?? null });
+    // Everything `kai-bridge ps` shows for this turn; the runner pid follows at spawn.
+    const session = this.rememberSession(turn.sessionId, { title: turn.title, sessionUrl: turn.sessionUrl, repos: turn.repos });
+    this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent ?? null, harness: turn.harness ?? null, profileId: turn.profileId ?? null, startedAt: new Date().toISOString(), ...session });
     const batcher = createEventBatcher({ api: this.api, turnId, onError: (err) => this.log("warn", "events.post.failed", { error: err.message }) });
     try {
       const profile = resolveProfiles(this.config, this.kaiHome).find((p) => p.id === turn.profileId) ?? { id: "gleap-key", kind: "gleap-key", harness: turn.harness };
-      const bound = this.bindRepos(turn);
+      const bound = await this.bindRepos(turn);
       // Multi-repo: the runner's cwd is the first repo; the others are
       // reachable as siblings under the same worktree root or by their
       // local paths — the prompt lists them.
       const workDir = bound[0]?.cwd;
       if (!workDir) throw new Error("Turn has no repositories.");
-      const repoNote = isVerify ? this.verifyRepoBrief(bound) : this.repoBrief(turn, bound);
-      let previewNote = "";
-      let mcpServers = turn.mcpServers;
-      if (isVerify) {
-        verify = await this.prepareVerifyTurn(turn, bound);
-        if (!verify.ok) {
-          // Nothing to test against (preview dead) or a sign-in wall the
-          // user must clear first: file a blocked report and close the turn
-          // cleanly without spending an agent run.
-          await this.api
-            .turnVerification(turnId, { ...buildVerificationPayload(null, [], { fallbackReason: verify.error }), ...(verify.blocked || {}) })
-            .catch((err) => this.log("warn", "verify.report.failed", { turnId, error: err.message }));
-          outcome = {
-            status: "completed",
-            result: null,
-            changes: bound.map((b) => ({ key: b.key, mode: b.mode, branch: b.branch, base: b.base, cwd: b.cwd, files: [], push: false })),
-            profileId: profile.id,
-          };
-          return;
-        }
-        previewNote = verify.note;
-        // The evidence dir is where a restart mid-run finds partial footage.
-        this.rememberInflight(turnId, { sessionId: turn.sessionId, agent: turn.agent, artifactsDir: verify.artifactsDir });
-        mcpServers = [
-          ...(turn.mcpServers || []),
-          previewMcpServer(RUNNER_DIR, {
-            outputDir: verify.artifactsDir,
-            // `storage` = browser_storage_state for the final sign-in refresh;
-            // restoring an arbitrary state file is never the agent's call.
-            caps: ["devtools", "testing", "storage"],
-            secretsFile: verify.secretsFile,
-            storageStateFile: verify.storageStateFile,
-            allowedOrigins: verify.storageStateFile ? verify.allowedOrigins : null,
-            disabledTools: ["browser_set_storage_state"],
-            ignoreHttpsErrors: !!verify.ignoreHttpsErrors,
-          }),
-        ];
-        await this.postVerifyStage(turnId, "verifying");
-      } else {
-        // Previews are manual-only (dashboard "Start preview") — a turn
-        // never boots dev servers on its own. When the user already has a
-        // preview running for this session, describe it to the agent and
-        // hand it the Playwright MCP so it can verify in a real browser.
-        const live = await this.describeLivePreview(turn, bound, batcher);
-        previewNote = live.note;
-        if (live.hasLivePreview) mcpServers = [...(turn.mcpServers || []), previewMcpServer(RUNNER_DIR)];
-      }
+      const repoNote = this.repoBrief(turn, bound);
+      // Previews are manual-only (dashboard "Start preview") — a turn
+      // never boots dev servers on its own. When the user already has a
+      // preview running for this session, describe it to the agent and
+      // hand it the Playwright MCP so it can check its work in a real browser.
+      const live = await this.describeLivePreview(turn, bound, batcher);
+      const previewNote = live.note;
+      const mcpServers = live.hasLivePreview ? [...(turn.mcpServers || []), previewMcpServer(RUNNER_DIR)] : turn.mcpServers;
       const res = await runTurn({
         turn: { ...turn, task: `${turn.task}${repoNote}${previewNote}`, mcpServers },
         profile,
         workDir,
         kaiHome: this.kaiHome,
-        // The verify MCP's request policy (KAI_VERIFY_*) — host-only, never in the prompt.
-        extraEnv: verify?.env ?? null,
         signal: ctrl.signal,
         onSpawn: (handle) => {
           entry.control = handle.control;
+          if (Number.isInteger(handle.pid)) this.rememberInflight(turnId, { pid: handle.pid });
         },
-        onEvent: (ev) => {
-          if (verify) {
-            // The tester is using the preview — it must not idle-stop
-            // under it. And the report carries LOCAL paths: keep it here,
-            // the uploaded version goes out after the turn.
-            this.armPreviewIdleTimer(turn.sessionId);
-            if (ev?.type === "verify_report") {
-              verify.report = ev.report && typeof ev.report === "object" ? ev.report : null;
-              return;
-            }
-            // Injected sign-in values (cookies, tokens) must never reach
-            // the Server in a tool row or snapshot.
-            if (verify.redact?.size) ev = redactDeep(ev, verify.redact);
-          }
-          batcher.push(ev);
-        },
+        onEvent: (ev) => batcher.push(ev),
         onLog: (l) => this.log("debug", "runner", { line: l.slice(0, 500) }),
       });
       await batcher.flush();
       const completed = !ctrl.signal.aborted && res.code === 0 && !res.rateLimited;
-      // Plan and verify turns are read-only: worktrees are restored, local
-      // checkouts only reported, nothing is ever committed or pushed.
-      const readOnlyTurn = !!turn.planMode || isVerify;
-      const changes = [...bound, ...this.adoptSessionWorktrees(turn, bound)].map((b) => {
+      // Plan turns are read-only: worktrees are restored, local checkouts
+      // only reported, nothing is ever committed or pushed.
+      const readOnlyTurn = !!turn.planMode;
+      const changes = await Promise.all([...bound, ...this.adoptSessionWorktrees(turn, bound)].map(async (b) => {
         ensureCommitExcludes(b.cwd, { allowDevConfig: !!turn.allowDevConfig });
         // A read-only turn must leave the worktree as it found it — see
         // discardChanges. Local checkouts are the user's; only report.
         if (readOnlyTurn) {
           const leaked = b.mode === "worktree" ? discardChanges(b.cwd).discarded : collectChanges(b.cwd).files;
           if (leaked.length > 0) {
-            const mode = turn.planMode ? "Plan mode" : "Verification";
-            this.log("warn", `${turn.planMode ? "plan" : "verify"}.changes`, { turnId, repo: b.key, mode: b.mode, files: leaked.length, discarded: b.mode === "worktree" });
+            this.log("warn", "plan.changes", { turnId, repo: b.key, mode: b.mode, files: leaked.length, discarded: b.mode === "worktree" });
             batcher.push({
               type: "text",
               message:
                 b.mode === "worktree"
-                  ? `${mode} is read-only — ${leaked.length} file change${leaked.length === 1 ? "" : "s"} made during ${turn.planMode ? "planning" : "verification"} ${leaked.length === 1 ? "was" : "were"} discarded${turn.planMode ? "; the build starts from the plan" : ""}.`
-                  : `${mode} is read-only, but ${leaked.length} file change${leaked.length === 1 ? "" : "s"} landed in your local checkout of ${b.key} — review them${turn.planMode ? " before building" : ""}.`,
+                  ? `Plan mode is read-only — ${leaked.length} file change${leaked.length === 1 ? "" : "s"} made during planning ${leaked.length === 1 ? "was" : "were"} discarded; the build starts from the plan.`
+                  : `Plan mode is read-only, but ${leaked.length} file change${leaked.length === 1 ? "" : "s"} landed in your local checkout of ${b.key} — review them before building.`,
             });
           }
         }
@@ -1423,30 +1803,32 @@ export class BridgeDaemon {
         // Build turns in worktree mode publish the session branch so the
         // Server can open the PR; read-only turns and local mode never push.
         const shouldPush = completed && b.mode === "worktree" && !readOnlyTurn && diff.files.length > 0;
+        const pushOnce = (gitEnv) => {
+          const out = commitAndPush(b.cwd, {
+            branch: b.branch,
+            allowDevConfig: !!turn.allowDevConfig,
+            message: `${turn.title || "Kai Code changes"}\n\nSession ${turn.sessionId} · run on ${this.config.device?.name || "a paired device"}`,
+            gitEnv,
+          });
+          // commitAndPush reports instead of throwing; surface an auth
+          // rejection so withGitAuth can retry the push (the commit exists).
+          if (!out.pushed && !gitEnv && isGitAuthError(out.error)) throw Object.assign(new Error(out.error), { push: out });
+          return out;
+        };
         const push = shouldPush
-          ? commitAndPush(b.cwd, {
-              branch: b.branch,
-              allowDevConfig: !!turn.allowDevConfig,
-              message: `${turn.title || "Kai Code changes"}\n\nSession ${turn.sessionId} · run on ${this.config.device?.name || "a paired device"}`,
-            })
-          : isVerify
-            ? false
-            : null;
+          ? await this.withGitAuth(b.key, pushOnce).catch((err) => err.push ?? { committed: false, pushed: false, branch: b.branch, error: err.message })
+          : null;
         // `cwd` travels with the change so the dashboard can point at
         // work that stayed on this machine (files but no push).
         // Pushed → the commit list + diff stat travel with the change so the
         // Server can write a real pull request description.
         const described = push?.pushed ? describeBranchChanges(b.cwd, b.base) : null;
         return { key: b.key, mode: b.mode, branch: b.branch, base: b.base, cwd: b.cwd, adopted: b.adopted || undefined, ...diff, push, ...(described ? described : {}) };
-      });
+      }));
       // The read-only notices above were queued AFTER the post-turn
       // flush; land them before the result closes the turn (the Server
       // answers 410 for events on an ended turn).
       await batcher.flush();
-      if (verify) {
-        const finished = await this.finishVerification(turn, { ...verify, workDir, bound }, res, ctrl.signal.aborted);
-        await this.settleVerifyPreview(turn, finished?.status).catch((err) => this.log("warn", "verify.preview.release.failed", { turnId, error: err.message }));
-      }
       // Built OUTSIDE the report call: if posting the result throws, the
       // catch below must not turn a finished turn into a failed one. The
       // work is already committed and pushed at this point.
@@ -1454,17 +1836,19 @@ export class BridgeDaemon {
         status: ctrl.signal.aborted ? "cancelled" : res.rateLimited ? "rate_limited" : res.code === 0 ? "completed" : "failed",
         exitCode: res.code,
         ...(res.errorCode ? { errorCode: res.errorCode } : {}),
-        result: verify?.redact?.size ? redactDeep(res.result, verify.redact) : res.result,
+        result: res.result,
         // The runner's own failure text (e.g. the engine's usage-limit
         // message) — the Server prefers this over its generic fallback.
-        ...(res.lastError && res.code !== 0 ? { error: redactDeep(res.lastError.replace(/^acp-runner: /, "").slice(0, 500), verify?.redact) } : {}),
+        ...(res.lastError && res.code !== 0 ? { error: res.lastError.replace(/^acp-runner: /, "").slice(0, 500) } : {}),
         changes,
         profileId: profile.id,
       };
     } catch (err) {
-      this.log("error", "turn.failed", { turnId, error: err.message });
+      this.log("error", "turn.failed", { turnId, error: err.message, ...(err.code ? { code: err.code, repo: err.repo } : {}) });
       await batcher.flush().catch(() => {});
-      outcome = outcome ?? { status: "failed", error: err.message };
+      // A WorkspaceError names why the checkout could not be prepared;
+      // the Server turns `failure.code` into a one-click retry.
+      outcome = outcome ?? { status: "failed", error: err.message, ...(err.code ? { failure: { code: err.code, repo: err.repo ?? null } } : {}) };
     } finally {
       // One report, retried until it lands — a dropped result is what
       // leaves a session spinning forever in the dashboard.
@@ -1476,845 +1860,23 @@ export class BridgeDaemon {
           })
           .catch((err) => this.log("error", "result.lost", { turnId, error: err.message }));
       }
-      // Test credentials and the injected / final sign-in state live on
-      // disk only for the duration of the turn.
-      for (const f of [verify?.secretsFile, verify?.storageStateFile, verify?.finalStateFile]) if (f) rmSync(f, { force: true });
-      verify?.release?.();
       this.forgetInflight(turnId);
       releaseAwake();
       this.running.delete(turnId);
-      if ((this.updatePending || this.restartPending) && this.running.size === 0 && this.logins.size === 0) void this.checkForUpdate();
+      if ((this.updatePending || this.restartPending) && this.running.size === 0) void this.checkForUpdate();
     }
   }
 
-  // ── verify turns ───────────────────────────────────────────────────
-  /** Overridable seam (tests, embedded hosts): a browser the Playwright MCP can launch. */
+  // ── preview browser ────────────────────────────────────────────────
+  /** Overridable seam (tests, embedded hosts): a browser the warm-up and the Playwright MCP can launch. */
   ensurePreviewBrowser() {
     return ensurePreviewBrowser({ runnerDir: RUNNER_DIR, log: this.log });
   }
 
-  /** Seams for the sign-in flows (tests inject a fake Playwright / probe / capture). */
+  /** Seam for the warm-up (tests inject a fake Playwright). */
   loadPlaywright() {
     return loadPlaywright(RUNNER_DIR);
   }
-  displayAvailable() {
-    return displayAvailable();
-  }
-  probeLogin(opts) {
-    return probeLogin(opts);
-  }
-  captureLogin(opts) {
-    return captureLogin(opts);
-  }
-
-  /** Where a verify turn's injected sign-in state lives (0600, deleted with the turn). */
-  loginStateDir() {
-    return join(this.kaiHome, "state", "preview-login");
-  }
-
-  /** The agent's final browser-state export — inside the turn's evidence dir (the MCP's only writable root besides the repo). */
-  finalStateFileFor(artifactsDir) {
-    return join(artifactsDir, "state", "final-storage-state.json");
-  }
-
-  /** Best-effort stage transition for the dashboard's Verify card (booting → verifying → saving). */
-  async postVerifyStage(turnId, stage, note) {
-    // The note often relays the agent's last line — markdown emphasis
-    // ("**Confirming…**") must not reach the card as literal asterisks.
-    const plain = typeof note === "string" ? note.replace(/[#*`>_]/g, "").replace(/\s+/g, " ").trim().slice(0, 200) : "";
-    try {
-      await this.api.turnVerificationStage(turnId, { stage, ...(plain ? { note: plain } : {}) });
-    } catch (err) {
-      this.log("debug", "verify.stage.failed", { turnId, stage, error: err?.message });
-    }
-  }
-
-  /**
-   * One probe / refresh of a sign-in at a time per user + repo: two verify
-   * turns racing the same record would both refresh it (one 409s) and
-   * could probe a preview the other is still booting.
-   */
-  withVerifyLock(key, fn) {
-    return this.acquireVerifyLock(key).then(async (release) => {
-      try {
-        return await fn();
-      } finally {
-        release();
-      }
-    });
-  }
-
-  /**
-   * Acquire the per user+repo verify lock; resolves with `release()`. A
-   * turn that injected a saved sign-in keeps it until its final refresh
-   * has landed: two agent runs presenting the same refresh token in
-   * parallel is exactly what rotation-based IdPs revoke on.
-   */
-  acquireVerifyLock(key) {
-    this.verifyLockHolders ??= new Set(); // keys currently HELD (the map also lists waiters)
-    this.verifyLocks ??= new Map();
-    const prev = this.verifyLocks.get(key) ?? Promise.resolve();
-    let release;
-    const held = new Promise((resolve) => {
-      let done = false;
-      release = () => {
-        if (done) return;
-        done = true;
-        this.verifyLockHolders.delete(key);
-        resolve();
-      };
-    });
-    const next = prev.catch(() => {}).then(() => held);
-    this.verifyLocks.set(key, next);
-    next.finally(() => {
-      if (this.verifyLocks.get(key) === next) this.verifyLocks.delete(key);
-    });
-    return prev
-      .catch(() => {})
-      .then(() => {
-        this.verifyLockHolders.add(key);
-        return release;
-      });
-  }
-
-  /** The verifier's repo brief: where the checkouts are, and that they are read-only. */
-  verifyRepoBrief(bound) {
-    const lines = ["", "", "Repositories in this session (read-only for this verification turn — you cannot commit or push, and every file change is discarded when the turn ends):"];
-    for (const b of bound) lines.push(`- ${b.key}: ${b.cwd}${b.branch ? ` (branch ${b.branch}${b.base ? `, base ${b.base}` : ""})` : ""}`);
-    return lines.join("\n");
-  }
-
-  /**
-   * dev.yaml `auth.storageState: <command>` — run in the repo checkout,
-   * stdout is Playwright storageState JSON (or the path of a JSON file).
-   * Replaces the user's saved sign-in for this repo. Null on any failure.
-   */
-  async storageStateFromCommand(command, cwd) {
-    return new Promise((resolveP) => {
-      const cb = (err, stdout) => {
-        if (err) {
-          this.log("warn", "verify.login.command.failed", { error: err.message });
-          return resolveP(null);
-        }
-        resolveP(parseStorageStateOutput(stdout, { read: (p) => readFileSync(p, "utf8") }));
-      };
-      const opts = { cwd, timeout: 60_000, maxBuffer: 16 * 1024 * 1024, env: { ...process.env, BROWSER: "none" } };
-      if (process.platform === "darwin") execFile("/bin/zsh", ["-lc", command], opts, cb);
-      else execFile(command, [], { ...opts, shell: true }, cb);
-    });
-  }
-
-  /**
-   * Boot (or re-describe) the session's preview, make sure a browser can
-   * launch, decide the sign-in (dev.yaml command → saved record → none),
-   * PROBE it headless, and lay out the turn's evidence dir + state files +
-   * optional secrets file. Resolves `{ ok: false, error, blocked? }`
-   * (`blocked` = `{ blockedCode, loginPath?, firstTime? }` for the report)
-   * or `{ ok: true, artifactsDir, secretsFile, storageStateFile,
-   * finalStateFile, allowedOrigins, injected, redact, note, report: null }`.
-   */
-  async prepareVerifyTurn(turn, bound = []) {
-    const repoKeys = (turn.repos || []).map((r) => r.key).filter(Boolean).sort();
-    const lockKey = `${turn.userId ?? turn.ownerUserId ?? "device"}:${repoKeys.join(",")}`;
-    if (this.verifyLockHolders?.has(lockKey)) {
-      // Another verify run of this repo holds its sign-in — say so instead
-      // of sitting on "Starting the app…" until it finishes.
-      this.log("info", "verify.lock.wait", { turnId: turn.turnId, lockKey });
-      await this.postVerifyStage(turn.turnId, "booting", "Waiting for another verification of this repo on this machine to finish…");
-    }
-    const release = await this.acquireVerifyLock(lockKey);
-    let result;
-    try {
-      result = await this.prepareVerifyTurnLocked(turn, bound);
-    } catch (err) {
-      release();
-      throw err;
-    }
-    if (result?.ok && result.injected) {
-      // Hold the repo's sign-in for the whole run — released by startTurn's
-      // finally (after finishVerification refreshed the record).
-      return { ...result, release };
-    }
-    release();
-    return result;
-  }
-
-  async prepareVerifyTurnLocked(turn, bound) {
-    const { turnId, sessionId } = turn;
-    // Lazy browser check — setup usually did this; a machine that skipped
-    // it downloads Chromium now (best-effort: without a browser the agent
-    // reports `blocked` itself).
-    const browser = await this.ensurePreviewBrowser().catch((err) => ({ ok: false, error: err?.message }));
-    if (!browser?.ok) {
-      // No browser, no test — say so with the exact command (Linux/Windows
-      // machines without Chrome and a failed Chromium download) instead of
-      // letting the agent discover it on its first navigate.
-      this.log("warn", "verify.browser.unavailable", { turnId, error: browser?.error });
-      return {
-        ok: false,
-        error: `No browser is available on this machine for the verification: ${browser?.error || "Chromium is not installed."}${browser?.command ? ` Run \`${browser.command}\` on this machine, then retry.` : ""}`,
-        blocked: { blockedCode: "no_browser" },
-      };
-    }
-    const channel = browser?.browser === "chrome" ? "chrome" : null;
-    // previewStart is idempotent on a live runner (booted services are
-    // only re-described) and reports starting/running to the dashboard
-    // exactly like the manual button. A cold boot is its own stage, and
-    // every runner status line during it (installing, still starting,
-    // ready) reaches the Verify card as a `booting` note — the heartbeat.
-    const coldBoot = !this.services.has(sessionId);
-    if (coldBoot && !this.manualPreviews?.has(sessionId)) (this.verifyOwnedPreviews ??= new Set()).add(sessionId);
-    if (coldBoot) await this.postVerifyStage(turnId, "booting");
-    const heartbeat = createStageHeartbeat((note) => this.postVerifyStage(turnId, "booting", note), { minIntervalMs: this.stageHeartbeatMs ?? 5_000 });
-    this.previewStatusListeners ??= new Map();
-    this.previewStatusListeners.set(sessionId, heartbeat.note);
-    let preview;
-    try {
-      preview = await this.previewStart({ sessionId, title: turn.title, repos: turn.repos, companionRemotes: turn.companionRemotes ?? null });
-    } finally {
-      this.previewStatusListeners?.delete(sessionId);
-      heartbeat.stop();
-    }
-    if (preview?.status !== "running") {
-      // The preview's structured error IS the diagnosis: its code becomes the
-      // verification's blockedCode (companion_missing, port_busy, deps_failed,
-      // …) so the card offers the right verb; `preview_unreachable` only
-      // when nothing more specific is known.
-      const code = preview?.errorCode && preview.errorCode !== "other" ? preview.errorCode : "preview_unreachable";
-      return {
-        ok: false,
-        error: preview?.error ? `The preview could not be started: ${preview.error}` : "The preview could not be started.",
-        blocked: { blockedCode: code },
-      };
-    }
-    // After a fix turn, services that do not hot-reload (`reload: restart`,
-    // the default for APIs) must run the fixed code before the probe.
-    const restartNotes = await this.restartChangedServices(turn, sessionId);
-    const artifactsDir = join(this.kaiHome, "artifacts", String(turnId).replace(/[^\w.-]/g, "_"));
-    mkdirSync(artifactsDir, { recursive: true });
-    let secretsFile = null;
-    let secretNames = [];
-    if (turn.verifySecrets && typeof turn.verifySecrets === "object") {
-      const dir = join(this.kaiHome, "state", "verify-secrets");
-      mkdirSync(dir, { recursive: true });
-      const path = join(dir, `${String(turnId).replace(/[^\w.-]/g, "_")}.env`);
-      secretNames = writeSecretsFile(path, turn.verifySecrets);
-      if (secretNames.length > 0) secretsFile = path;
-    }
-    const previews = preview.previews || [];
-    const runner = this.services.get(sessionId);
-    const services = runner?.describeServices?.() ?? previews.map((p) => ({ name: p.name, url: p.url }));
-    const previewOrigins = [...new Set([...services.map((s) => normalizeOrigin(s.url)), ...previews.map((p) => normalizeOrigin(p.url))].filter(Boolean))];
-    const primaryKey = (turn.repos || [])[0]?.key;
-    // The landing page is a session repo's web preview (an API has no UI to land on).
-    const webPreviews = previews.filter((p) => p.kind !== "api");
-    const landingUrl = webPreviews.find((p) => p.repo === primaryKey)?.url ?? webPreviews[0]?.url ?? previews.find((p) => p.repo === primaryKey)?.url ?? previews[0]?.url ?? services[0]?.url ?? null;
-
-    // ── sign-in: dev.yaml command → saved record → none ──────────────
-    const primary = bound?.[0] ?? null;
-    const devConfig = primary?.cwd ? readDevConfig(primary.cwd) : null;
-    const auth = devConfig?.auth ?? null;
-    // Every dev.yaml in the session (external origins, verify policy) — the
-    // primary's wins on conflicts.
-    const configs = (bound || []).map((b) => (b?.cwd ? readDevConfig(b.cwd) : null)).filter(Boolean);
-    const external = [...new Set(configs.flatMap((c) => c.external || []))];
-    // The state filter accepts the declared `external` origins too: the
-    // browser is allowed to talk to them, so a token the app keeps there is
-    // part of "signed in". Cookies stay localhost-only (filterStorageState).
-    const stateOrigins = [...new Set([...previewOrigins, ...external])];
-    let injected = null; // { source: "command" | "record", state, record?, originMap? }
-    if (auth?.storageState && primary?.cwd) {
-      const state = await this.storageStateFromCommand(auth.storageState, primary.cwd);
-      if (state) injected = { source: "command", state: filterStorageState(state, stateOrigins).state, record: null, originMap: null };
-      else this.log("warn", "verify.login.command.empty", { turnId });
-    } else if (turn.loginRecordAvailable) {
-      const record = await this.api.turnPreviewLogin(turnId).catch((err) => {
-        this.log("warn", "verify.login.record.failed", { turnId, error: err?.message });
-        return null;
-      });
-      if (record?.storageState) {
-        const originMap = buildOriginMap(record.services, services);
-        const state = rewriteStorageState(record.storageState, originMap);
-        this.log("info", "verify.login.record", { turnId, version: record.version, mapped: originMap.size, cookies: state.cookies.length, origins: state.origins.length });
-        injected = { source: "record", state, record, originMap };
-      }
-    }
-
-    // ── probe: does the preview consider us signed in? ───────────────
-    // An API-only preview (no web service) has nothing to render a login
-    // wall on — the agent's http_request answers 401/403 → needs_login.
-    let probe = { result: "unknown", storageState: null, loginPath: null };
-    const hasWebService = services.some((svc) => svc.kind !== "api") || webPreviews.length > 0;
-    if (landingUrl && hasWebService) {
-      const pw = this.loadPlaywright();
-      probe = await this.probeLogin({
-        pw,
-        launchOptions: launchOptionsFor({ headless: true, browser: channel }),
-        storageState: injected?.state ?? null,
-        url: injected?.record?.landingUrl ? rewriteUrl(injected.record.landingUrl, injected.originMap) ?? landingUrl : landingUrl,
-        previewOrigins,
-        loginPaths: injected?.record?.loginPaths ?? [],
-        loginCheck: auth?.loginCheck ?? null,
-        // A dev server that just booted still compiles its first page (vite's
-        // cold transform of a large app takes 30-60 s) — give it room, or the
-        // probe answers `unknown` and a login wall goes unnoticed.
-        timeoutMs: coldBoot ? PROBE_TIMEOUT_COLD_BOOT_MS : undefined,
-        log: this.log,
-      });
-    }
-    // "Continue without signing in" (`previewLoginOptional`) means: run
-    // unauthenticated rather than block — whether there is no record at all
-    // or the saved one no longer works.
-    if (probe.result === "needs_login" && turn.previewLoginOptional === true) {
-      this.log("info", "verify.login.optional", { turnId, hadRecord: injected !== null });
-      injected = null;
-      probe = { result: "unknown", storageState: null, loginPath: probe.loginPath };
-    }
-    if (probe.result === "needs_login") {
-      rmSync(artifactsDir, { recursive: true, force: true });
-      if (secretsFile) rmSync(secretsFile, { force: true });
-      const firstTime = injected === null;
-      return {
-        ok: false,
-        error: firstTime
-          ? "The preview asks for a sign-in. Sign in once on this device so Kai can test the app."
-          : "The saved sign-in for this preview no longer works — sign in again on this device.",
-        blocked: { blockedCode: "needs_login", ...(probe.loginPath ? { loginPath: probe.loginPath } : {}), firstTime },
-      };
-    }
-
-    // ── state files for the MCP ──────────────────────────────────────
-    let storageStateFile = null;
-    let finalStateFile = null;
-    let redact = new Set();
-    let probeExport = null;
-    if (injected && !storageStateIsEmpty(injected.state)) {
-      const dir = this.loginStateDir();
-      mkdirSync(dir, { recursive: true, mode: 0o700 });
-      const safe = String(turnId).replace(/[^\w.-]/g, "_");
-      storageStateFile = join(dir, `${safe}.json`);
-      // The persona's final `browser_storage_state` export must land INSIDE
-      // the MCP's `--output-dir`: the Playwright MCP refuses any `filename`
-      // outside its output dir / the client cwd (`File access denied …
-      // outside allowed roots`), so a path under ~/.kai/state would make the
-      // agent's last action fail on every signed-in run and the record would
-      // never refresh. A `.json` is not an artifact extension — the sweep
-      // never uploads it — and it is read before the evidence dir is deleted.
-      finalStateFile = this.finalStateFileFor(artifactsDir);
-      mkdirSync(dirname(finalStateFile), { recursive: true, mode: 0o700 });
-      // The probe context's own export (with IndexedDB) when the probe ran;
-      // the rewritten record otherwise (probe unknown → proceed anyway).
-      probeExport = probe.result === "ok" && probe.storageState ? filterStorageState(probe.storageState, stateOrigins).state : injected.state;
-      writeFileSync(storageStateFile, JSON.stringify(probeExport), { mode: 0o600 });
-      redact = new Set([...redactionSet(injected.state), ...redactionSet(probeExport)]);
-    }
-    // `.env*` values of the repos + service dirs are secrets too: a tool row
-    // that echoes one (a config dump, an error message) must not carry it
-    // to the Server.
-    for (const value of this.envRedactionValues(bound, services)) redact.add(value);
-    const allowedOrigins = [...previewOrigins, ...external, "http://localhost:*", "http://127.0.0.1:*", "https://localhost:*", "https://127.0.0.1:*"];
-    // ── API evidence: the verify MCP's request policy ───────────────
-    const apiServices = services.filter((svc) => svc.kind === "api");
-    const verifyPolicy = configs.find((c) => c.verify)?.verify ?? devConfig?.verify ?? { readOnly: null, endpoints: [], loginVia: null };
-    const readOnly = verifyPolicy.readOnly ?? apiServices.length > 0;
-    const env = {
-      KAI_VERIFY_READ_ONLY: readOnly ? "1" : "0",
-      KAI_VERIFY_ORIGINS: [...new Set([...previewOrigins, ...external])].join(";"),
-      KAI_VERIFY_EVIDENCE_DIR: artifactsDir,
-    };
-    // The app's own API credential (dev.yaml `auth.apiToken`) read from the
-    // injected sign-in → `Authorization: Bearer …` for http_request. The
-    // value goes to the MCP by env only and joins the redaction set.
-    const apiAuth = deriveApiAuthHeader(auth?.apiToken, probeExport ?? injected?.state ?? null, services);
-    if (apiAuth) {
-      env.KAI_VERIFY_AUTH_HEADER = apiAuth.value;
-      if (apiAuth.token.length >= 8) redact.add(apiAuth.token);
-    }
-    return {
-      ok: true,
-      artifactsDir,
-      secretsFile,
-      storageStateFile,
-      finalStateFile,
-      allowedOrigins,
-      previewOrigins,
-      stateOrigins,
-      external,
-      // Companions run the code they have checked out — their HEADs travel
-      // with the report so "verified" can never be claimed for a stale API.
-      companionRevisions: previews
-        .filter((p) => p.role === "companion" && p.repo && p.commit)
-        .map((p) => ({ repo: p.repo, commit: p.commit, role: "companion", ...(p.branch ? { branch: p.branch } : {}), ...(p.dirty > 0 ? { dirty: p.dirty } : {}) })),
-      ignoreHttpsErrors: !!runner?.usesHttps?.(),
-      env,
-      readOnly,
-      injected: injected ? { ...injected, probeExport } : null,
-      redact,
-      note: this.verifyPreviewNote(sessionId, previews, secretNames, artifactsDir, {
-        signedIn: !!storageStateFile,
-        finalStateFile,
-        services,
-        readOnly,
-        endpoints: verifyPolicy.endpoints || [],
-        external,
-        restartNotes,
-        apiAuth: !!apiAuth,
-      }),
-      report: null,
-    };
-  }
-
-  /**
-   * After a fix turn (`turn.changedRepos` = repo keys the fix touched):
-   * restart the changed repos' services whose reload mode is `restart`
-   * (declared, or the default for `kind: api`) on their same ports. Adopted
-   * services are the user's own dev server — never restarted, the task
-   * note says so. Returns the note lines for the agent.
-   */
-  async restartChangedServices(turn, sessionId) {
-    const changed = Array.isArray(turn.changedRepos) ? turn.changedRepos.map((k) => String(k).toLowerCase()) : [];
-    const runner = this.services.get(sessionId);
-    if (!changed.length || !runner) return [];
-    const notes = [];
-    const byRoot = new Map(); // repoRoot → { key, names }
-    for (const svc of runner.describeServices()) {
-      if (!svc.repoKey || !changed.includes(String(svc.repoKey).toLowerCase()) || !svc.repoRoot) continue;
-      const meta = runner.meta?.get(svc.name);
-      if (effectiveReload(meta?.svc, svc.kind) !== "restart") continue;
-      if (svc.adopted) {
-        notes.push(`${svc.name} is your already-running dev server and was not restarted — make sure it serves the fixed code.`);
-        continue;
-      }
-      const entry = byRoot.get(svc.repoRoot) ?? { key: svc.repoKey, names: [] };
-      entry.names.push(svc.name);
-      byRoot.set(svc.repoRoot, entry);
-    }
-    for (const [repoRoot, { key, names }] of byRoot) {
-      await this.postVerifyStage(turn.turnId, "booting", `Restarting ${names.join(", ")} with the fix…`);
-      this.log("info", "verify.restart", { turnId: turn.turnId, repo: key, services: names });
-      try {
-        const restarted = await runner.restart(repoRoot, { only: names });
-        const dead = restarted.find((r) => r.restarted && !r.ready);
-        if (dead) notes.push(`${dead.name} did not come back after the restart${dead.error ? ` — ${dead.error}` : ""} (see ${dead.logPath}).`);
-        else notes.push(`${names.join(", ")} ${names.length === 1 ? "was" : "were"} restarted with the fix.`);
-      } catch (err) {
-        this.log("warn", "verify.restart.failed", { turnId: turn.turnId, repo: key, error: err?.message });
-        notes.push(`${names.join(", ")} could not be restarted with the fix: ${err?.message}`);
-      }
-    }
-    return notes;
-  }
-
-  /** Secrets from `.env*` files at the repo roots + service cwds (values ≥ 12 chars, placeholders excluded). */
-  envRedactionValues(bound, services) {
-    const dirs = new Set([...(bound || []).map((b) => b?.cwd).filter(Boolean), ...(services || []).map((svc) => svc?.cwd).filter(Boolean)]);
-    const texts = [];
-    for (const dir of dirs) {
-      let names = [];
-      try {
-        names = readdirSync(dir).filter((n) => n === ".env" || (n.startsWith(".env.") && !/\.(example|sample|template)$/.test(n)));
-      } catch {
-        continue;
-      }
-      for (const name of names) {
-        try {
-          texts.push(readFileSync(join(dir, name), "utf8"));
-        } catch {
-          /* unreadable */
-        }
-      }
-    }
-    return envRedactionValues(texts);
-  }
-
-  /** Task suffix for the verifier: the preview URLs (web + API services), where evidence goes, the secrets by name, the sign-in state, the request policy. */
-  verifyPreviewNote(sessionId, previews, secretNames = [], artifactsDir = null, { signedIn = false, finalStateFile = null, services = null, readOnly = false, endpoints = [], external = [], restartNotes = [], apiAuth = false } = {}) {
-    const runner = this.services.get(sessionId);
-    const apiNames = new Set((services || []).filter((svc) => svc.kind === "api").map((svc) => svc.name));
-    const webPreviews = previews.filter((p) => !apiNames.has(p.name));
-    const lines = webPreviews.map((p) => {
-      const logPath = runner && !p.adopted ? join(runner.logDir, `${p.name}.log`) : null;
-      return `- ${p.repo}${p.name && p.name !== p.repo ? ` (${p.name})` : ""}: ${p.url}${p.adopted ? " (your already-running dev server)" : ""}${logPath ? ` · logs: ${logPath}` : ""}`;
-    });
-    const parts = ["", "", "This is a verification turn: do not modify files, do not commit."];
-    if (lines.length > 0) {
-      parts.push(`Dev services running for this session:\n${lines.join("\n")}`);
-      parts.push(
-        "Use the `gleap_preview` browser tools (browser_navigate, browser_snapshot, browser_start_video, browser_video_chapter, browser_take_screenshot, browser_stop_video, …) against these URLs. " +
-          "Tail the service logs with the Read/Bash tools if a page fails to load.",
-      );
-    }
-    const apiServices = (services || []).filter((svc) => svc.kind === "api");
-    if (apiServices.length > 0) {
-      const apiLines = apiServices.map((svc) => {
-        const logPath = runner && !svc.adopted ? join(runner.logDir, `${svc.name}.log`) : null;
-        return `- ${svc.repoKey ? `${svc.repoKey} (${svc.name})` : svc.name}: ${svc.url}${svc.openapi ? ` · OpenAPI: ${svc.openapi}` : ""}${svc.adopted ? " (your already-running dev server)" : ""}${logPath ? ` · logs: ${logPath}` : ""}`;
-      });
-      parts.push(
-        `API services (no UI):\n${apiLines.join("\n")}\n` +
-          `Exercise them with the \`http_request\` tool from the \`kai_verify\` MCP server (one call per check, \`check\` set to what it proves) — the HTTP transcript it records is uploaded with your report as evidence; curl is not available. ` +
-          `Resolve real paths from the OpenAPI spec (or the router files) before calling. ` +
-          (readOnly
-            ? "This run is READ-ONLY (shared database): only GET/HEAD/OPTIONS go through — anything else is refused and recorded as skipped; list such endpoints under `untested`. "
-            : "Writes are allowed in this run — prefer creating throwaway records and say what you created in the report. ") +
-          (apiAuth ? "The app's own authentication is added to your requests automatically; never paste tokens. " : "A 401/403 means the API needs a sign-in you do not have: report `blocked` / `needs_login` with the endpoint's path, never a failed check. ") +
-          (endpoints.length ? `Endpoints the repo asks you to cover: ${endpoints.join(", ")}. ` : "") +
-          (lines.length === 0 ? "There is no web UI in this run — no recording is needed; the transcript and the report are the evidence." : ""),
-      );
-    }
-    if (lines.length === 0 && apiServices.length === 0) {
-      parts.push(`Dev services running for this session:\n${previews.map((p) => `- ${p.repo}: ${p.url}`).join("\n") || "- (none)"}`);
-    }
-    if (external.length > 0) parts.push(`External origins the app talks to (allowed for the browser and http_request): ${external.join(", ")}.`);
-    if (restartNotes.length > 0) parts.push(restartNotes.join(" "));
-    if (artifactsDir) {
-      // The MCP resolves a relative `filename` against the CLIENT
-      // workspace (the repo worktree), where it would be discarded with
-      // the turn — only absolute paths under the output dir (or no
-      // filename at all) reach the evidence dir.
-      parts.push(
-        `Evidence directory: ${artifactsDir} — every screenshot and video in it is uploaded with your report. Pass every screenshot/video \`filename\` as an ABSOLUTE path inside it (e.g. \`${join(artifactsDir, "01-home.png")}\`, \`${join(artifactsDir, "verification.webm")}\`), never a bare relative name, and list the paths the tools print back in your report.`,
-      );
-    }
-    if (secretNames.length > 0) {
-      parts.push(
-        `Test credentials are available as secrets: ${secretNames.join(", ")}. Type the secret NAME into the form field (e.g. \`${secretNames[0]}\`) — the browser substitutes the real value and masks it in every response. Do not ask the user for these.`,
-      );
-    }
-    if (signedIn && finalStateFile) {
-      parts.push(
-        `The browser is already signed in to the preview (the user's saved sign-in is loaded). Final browser state path: ${finalStateFile} — as your LAST browser action, after \`browser_stop_video\` and before \`report_verification\`, call \`browser_storage_state\` with exactly this absolute path as \`filename\` so the sign-in stays fresh. ` +
-          `Never read, list or copy anything under ${this.loginStateDir()} — it is the daemon's private state. Never paste cookies, tokens or storage values into the report, todos or summary.`,
-      );
-    } else {
-      parts.push(
-        "If a page asks you to sign in (password field, one-time code, a Sign in / Log in button, a redirect to an identity provider) and no secrets are listed, do not ask the user and do not type into the form: stop the video, screenshot the wall, and file `report_verification` with `status: blocked`, `blockedCode: needs_login` and `loginPath` set to the wall's URL path.",
-      );
-    }
-    parts.push("If the change has nothing a tester can exercise from the running app, file `report_verification` with `status: blocked` and `blockedCode: not_verifiable` — never invent a check. A `passed` report needs at least one real check.");
-    return parts.join("\n\n").replace(/^\n\n\n\n/, "\n\n");
-  }
-
-  /**
-   * After a verify turn: sweep the evidence dir (the agent may have
-   * forgotten the recording), upload every file, then post the report
-   * with URLs in place of paths (redacted: nothing from the injected
-   * sign-in may leak). No report from the agent → `blocked` with the swept
-   * evidence; a report with zero checks → `blocked` / `no_report` (the
-   * payload builder). A turn CANCELLED before any report skips the uploads
-   * altogether (nobody asked for that footage). `evidence: { failed, kept }`
-   * tells the Server how many uploads failed and where the files still are
-   * (`bridge.verify.evidence.retry` re-uploads them). Then, when a saved
-   * sign-in was injected and the agent left its final `browser_storage_state`
-   * export, refresh the record (CAS on the version we read). The dir is
-   * deleted only when everything landed; otherwise it stays for the retry /
-   * `kai-bridge doctor`.
-   */
-  async finishVerification(turn, verify, res, cancelled) {
-    const { turnId } = turn;
-    await this.postVerifyStage(turnId, "saving");
-    const redact = verify.redact?.size ? (v) => redactDeep(v, verify.redact) : (v) => v;
-    const report = verify.report ? redact(verify.report) : null;
-    // Verify turns never push, so the Server cannot derive the tested heads
-    // from `changes[]` — stamp them here (repo key → HEAD of the checkout).
-    // Companions booted alongside carry `role: "companion"` (their HEAD is
-    // the code the API under test actually served).
-    const revisions = [
-      ...(verify.bound || [])
-        .map((b) => ({ repo: b.key, commit: currentHead(b.cwd) }))
-        .filter((r) => r.repo && r.commit),
-      ...(verify.companionRevisions || []),
-    ];
-    const fallbackReason = cancelled
-      ? "The verification was cancelled before Kai filed a report."
-      : res.code !== 0
-        ? `The verification turn failed${res.lastError ? `: ${res.lastError.replace(/^acp-runner: /, "").slice(0, 300)}` : ""}.`
-        : "Kai finished without filing a verification report";
-    let uploads = [];
-    let uploadFailures = 0;
-    if (cancelled && !report) {
-      this.log("info", "verify.cancelled.no_uploads", { turnId });
-    } else {
-      const swept = await this.uploadSweptEvidence(turnId, verify.artifactsDir, { report, redact: verify.redact, workDir: verify.workDir, signedIn: !!verify.storageStateFile });
-      uploads = swept.uploads;
-      uploadFailures = swept.failed;
-    }
-    const evidence = { failed: uploadFailures, ...(uploadFailures > 0 ? { kept: verify.artifactsDir } : {}) };
-    const payload = redact({ ...buildVerificationPayload(report, uploads, { fallbackReason, cancelled, evidence, readOnly: typeof verify.readOnly === "boolean" ? verify.readOnly : null }), revisions });
-    let reported = false;
-    try {
-      await this.api.turnVerification(turnId, payload, {
-        onRetry: (err, attempt, delay) => this.log("warn", "verify.report.retry", { turnId, attempt, nextInMs: delay, error: err.message }),
-      });
-      reported = true;
-    } catch (err) {
-      this.log("error", "verify.report.failed", { turnId, error: err.message });
-    }
-    this.log("info", "verify.reported", { turnId, status: payload.status, blockedCode: payload.blockedCode, checks: payload.checks.length, artifacts: uploads.length, uploadFailures, reported });
-    // The final-state export lives in the evidence dir: refresh the record
-    // from it BEFORE the dir is deleted.
-    await this.refreshPreviewLogin(turn, verify);
-    if ((reported && uploadFailures === 0) || (cancelled && !report)) rmSync(verify.artifactsDir, { recursive: true, force: true });
-    else this.log("warn", "verify.artifacts.kept", { turnId, dir: verify.artifactsDir });
-    return { status: payload.status };
-  }
-
-  /**
-   * A preview that Verify booted for itself is released once the run has
-   * settled — a manual preview keeps running until the user stops it. A
-   * `failed` run with fix attempts left keeps the app up: the fix turn's
-   * auto re-verify is seconds away and the Server restarts changed services.
-   */
-  async settleVerifyPreview(turn, status) {
-    const sessionId = turn?.sessionId;
-    if (!sessionId || !this.verifyOwnedPreviews?.has(sessionId)) return false;
-    if (this.manualPreviews?.has(sessionId)) return false;
-    const loop = turn.loop && typeof turn.loop === "object" ? turn.loop : null;
-    const retryPending = status === "failed" && loop && Number(loop.attempt ?? 0) < Number(loop.max ?? 0);
-    if (retryPending) return false;
-    this.log("info", "verify.preview.released", { sessionId, status });
-    await this.previewStop({ sessionId });
-    return true;
-  }
-
-  /**
-   * Sweep an evidence dir, union it with the report's declared artifacts,
-   * redact the HTTP transcript in place, upload everything. Resolves
-   * `{ uploads: [{ artifact, url }], failed }`. Trace archives are dropped
-   * from signed-in runs (they contain every request with its cookies).
-   */
-  async uploadSweptEvidence(turnId, artifactsDir, { report = null, redact = null, workDir = null, signedIn = false } = {}) {
-    const swept = sweepArtifacts(artifactsDir).filter((p) => !(signedIn && /\.zip$/i.test(p)));
-    const artifacts = unionArtifacts(report, swept, { outputDir: artifactsDir, workDir }).filter((a) => !(signedIn && a.kind === "trace"));
-    const uploads = [];
-    let failed = 0;
-    for (const artifact of artifacts) {
-      if (artifact.kind === "requests") redactJsonlFile(artifact.path, redact);
-      try {
-        const { url } = await this.api.uploadArtifact(turnId, artifact.path, artifact.contentType, {
-          onRetry: (err, attempt, delay) => this.log("warn", "verify.upload.retry", { turnId, file: artifact.path, attempt, nextInMs: delay, error: err.message }),
-        });
-        uploads.push({ artifact, url });
-      } catch (err) {
-        failed += 1;
-        this.log("warn", "verify.upload.failed", { turnId, file: artifact.path, error: err.message });
-      }
-    }
-    return { uploads, failed, swept: swept.length };
-  }
-
-  /**
-   * `bridge.verify.evidence.retry { turnId }`: the evidence dir kept after
-   * failed uploads is swept and uploaded again; the Server unions the
-   * artifacts by URL (`PUT …/verification/artifacts`) and clears
-   * `evidenceMissing`. The dir goes once everything landed.
-   */
-  async retryEvidence({ commandId, turnId }) {
-    const ack = (payload) => (commandId ? this.api.commandAck(commandId, payload).catch((err) => this.log("warn", "verify.evidence.ack.failed", { turnId, error: err?.message })) : Promise.resolve());
-    if (!turnId) return ack({ ok: false, error: "evidence retry without a turnId" });
-    const dir = join(this.kaiHome, "artifacts", String(turnId).replace(/[^\w.-]/g, "_"));
-    if (!existsSync(dir)) {
-      this.log("warn", "verify.evidence.retry.missing", { turnId, dir });
-      return ack({ ok: false, error: "The evidence for this run is no longer on this machine." });
-    }
-    const { uploads, failed, swept } = await this.uploadSweptEvidence(turnId, dir);
-    const artifacts = uploads.map((u) => ({ label: u.artifact.label, url: u.url, contentType: u.artifact.contentType, kind: u.artifact.kind, ...(u.artifact.count > 0 ? { count: u.artifact.count } : {}) }));
-    const evidence = { failed, ...(failed > 0 ? { kept: dir } : {}) };
-    try {
-      await this.api.putVerificationArtifacts(turnId, { artifacts, evidence });
-    } catch (err) {
-      this.log("error", "verify.evidence.retry.failed", { turnId, error: err?.message });
-      return ack({ ok: false, error: err?.message || String(err), uploaded: artifacts.length, failed });
-    }
-    this.log("info", "verify.evidence.retried", { turnId, swept, uploaded: artifacts.length, failed });
-    if (failed === 0) rmSync(dir, { recursive: true, force: true });
-    return ack({ ok: true, uploaded: artifacts.length, failed });
-  }
-
-  /**
-   * The agent's final `browser_storage_state` export (cookies + localStorage
-   * — what the app may have rotated during the run) merged over the probe
-   * export's IndexedDB, filtered to the preview origins, mapped BACK onto
-   * the record's captured origins, and PUT with the version we read. 409 =
-   * another run refreshed first → ours is discarded. Only for injected
-   * records (a dev.yaml command owns its own state).
-   */
-  async refreshPreviewLogin(turn, verify) {
-    const { turnId } = turn;
-    const record = verify.injected?.record;
-    if (!record?.id || verify.injected.source !== "record" || !verify.finalStateFile) return;
-    let final;
-    try {
-      if (!existsSync(verify.finalStateFile)) {
-        this.log("info", "verify.login.refresh.skipped", { turnId, reason: "no final state" });
-        return;
-      }
-      final = JSON.parse(readFileSync(verify.finalStateFile, "utf8"));
-    } catch (err) {
-      this.log("warn", "verify.login.refresh.unreadable", { turnId, error: err?.message });
-      return;
-    }
-    const merged = mergeFinalState(verify.injected.probeExport, final);
-    const { state: filtered, counts } = filterStorageState(merged, verify.stateOrigins ?? verify.previewOrigins);
-    const back = rewriteStorageState(filtered, invertOriginMap(verify.injected.originMap));
-    if (storageStateIsEmpty(back)) {
-      this.log("info", "verify.login.refresh.skipped", { turnId, reason: "empty state" });
-      return;
-    }
-    try {
-      await this.api.refreshPreviewLogin(record.id, { storageState: back, basedOnVersion: record.version });
-      this.log("info", "verify.login.refreshed", { turnId, recordId: record.id, basedOnVersion: record.version, ...counts });
-    } catch (err) {
-      this.log(err?.status === 409 ? "info" : "warn", err?.status === 409 ? "verify.login.refresh.stale" : "verify.login.refresh.failed", { turnId, recordId: record.id, error: err?.message });
-    }
-  }
-
-  // ── sign-in windows (bridge.verify.login.*) ────────────────────────
-  /**
-   * Open a headed Chrome at the preview for the user to sign in; the
-   * capture uploads the filtered storage state against `requestId`. Acks
-   * `{ ok: true, opened: true }` once the window is up, `{ ok: false,
-   * error }` when this machine cannot (updating, no display, preview dead).
-   * Idempotent per requestId (the Server replays after sleep).
-   */
-  async loginStart({ commandId, requestId, sessionId, repoKey, previewNeeded, title, repos }) {
-    const ack = (payload) => (commandId ? this.api.commandAck(commandId, payload).catch((err) => this.log("warn", "verify.login.ack.failed", { requestId, error: err?.message })) : Promise.resolve());
-    const status = (payload) => this.api.previewLoginStatus(requestId, payload).catch((err) => this.log("warn", "verify.login.status.failed", { requestId, error: err?.message }));
-    if (!requestId) {
-      await ack({ ok: false, error: "Sign-in request without a requestId." });
-      return;
-    }
-    if (this.logins.has(requestId)) {
-      await ack({ ok: true, opened: true, replayed: true });
-      return;
-    }
-    const entry = { requestId, sessionId, repoKey, handle: null, startedAt: Date.now() };
-    this.logins.set(requestId, entry);
-    try {
-      if (this.updating) throw new Error("This machine is updating kai-bridge — try again in a minute.");
-      if (!this.displayAvailable()) throw new Error("This machine has no display to open a sign-in window on.");
-      const pw = this.loadPlaywright();
-      if (!pw?.chromium) throw new Error("Playwright is not installed next to kai-bridge — reinstall @gleapai/kai-bridge.");
-      const browser = await this.ensurePreviewBrowser().catch((err) => ({ ok: false, error: err?.message }));
-      if (!browser?.ok) throw new Error(browser?.error || "No browser is available on this machine.");
-      // Liveness first: booting a cold preview can take minutes, and the
-      // Server fails a request nobody acknowledged as "device unreachable".
-      // `accepted` moves the request off pending without claiming a window.
-      await ack({ ok: true, accepted: true });
-      // The preview must be up for the user to sign in to — boot it (or,
-      // when it already runs, only re-describe it: previewStart is
-      // idempotent on a live runner and we need its URLs either way).
-      // `repos`/`title` may be absent on the command; then the request's
-      // repo is the whole session and the worktree is looked up by id.
-      const sessionRepos = Array.isArray(repos) && repos.length ? repos : [{ key: repoKey }];
-      this.log("info", "verify.login.preview", { requestId, sessionId, previewNeeded: !!previewNeeded, live: this.services.has(sessionId) });
-      const preview = await this.previewStart({ sessionId, title, repos: sessionRepos });
-      if (preview?.status !== "running") throw new Error(preview?.error ? `The preview could not be started: ${preview.error}` : "The preview could not be started.");
-      entry.previews = preview.previews || [];
-      const runner = this.services.get(sessionId);
-      const services = runner?.describeServices?.() ?? (entry.previews || []).map((p) => ({ name: p.name, url: p.url }));
-      const previewOrigins = [...new Set([...services.map((s) => normalizeOrigin(s.url)), ...(entry.previews || []).map((p) => normalizeOrigin(p.url))].filter(Boolean))];
-      // dev.yaml `external` origins may hold part of the app's own sign-in
-      // state — keepable, but never "back on the app" for the detection.
-      const external = [...new Set([...new Set((services || []).map((s) => s.repoRoot).filter(Boolean))].flatMap((root) => readDevConfig(root)?.external || []))];
-      const url = (entry.previews || []).find((p) => p.repo === repoKey)?.url ?? (entry.previews || [])[0]?.url ?? services[0]?.url;
-      if (!url) throw new Error("The preview has no URL to open.");
-      // Keep the preview alive while the window is open (the idle timer
-      // would otherwise stop the app under the user's nose).
-      this.armPreviewIdleTimer(sessionId);
-      const handle = await this.captureLogin({
-        pw,
-        launchOptions: launchOptionsFor({ headless: false, browser: browser.browser === "chrome" ? "chrome" : null }),
-        url,
-        previewOrigins,
-        stateOrigins: [...previewOrigins, ...external],
-        services: services.map((s) => ({ name: s.name, origin: normalizeOrigin(s.url) })),
-        onStatus: (st, extra) => {
-          this.log("info", "verify.login.status", { requestId, status: st, ...(extra?.error ? { error: extra.error } : {}) });
-          return status({ status: st, ...(extra?.error ? { error: String(extra.error) } : {}) });
-        },
-        onSaved: async (payload, counts) => {
-          await this.api.uploadPreviewLogin(requestId, payload, {
-            tries: 3,
-            onRetry: (err, attempt, delay) => this.log("warn", "verify.login.upload.retry", { requestId, attempt, nextInMs: delay, error: err.message }),
-          });
-          this.log("info", "verify.login.saved", { requestId, repoKey, ...counts, loginPaths: payload.loginPaths.length });
-        },
-        log: this.log,
-      });
-      void handle.finished.then((outcome) => {
-        this.logins.delete(requestId);
-        this.log("info", "verify.login.finished", { requestId, status: outcome?.status, error: outcome?.error });
-        this.hello().catch(() => {});
-        if ((this.updatePending || this.restartPending) && this.running.size === 0 && this.logins.size === 0) void this.checkForUpdate();
-      });
-      if (entry.cancelled) {
-        // Cancelled while Chrome was still launching (the Server has already
-        // settled the request): close the window it just opened, no ack of
-        // `opened`, no status (the cancel already answered).
-        this.log("info", "verify.login.cancelled.launching", { requestId });
-        await handle.cancel();
-        await ack({ ok: false, error: "The sign-in was cancelled before the window opened." });
-        return;
-      }
-      entry.handle = handle;
-      await ack({ ok: true, opened: true });
-      await status({ status: "opened" });
-      // Re-announce right away: `activeLogins` is how the dashboard knows a window is open.
-      await this.hello().catch((err) => this.log("warn", "verify.login.hello.failed", { requestId, error: err?.message }));
-    } catch (err) {
-      this.logins.delete(requestId);
-      this.log("error", "verify.login.start.failed", { requestId, error: err?.message });
-      await ack({ ok: false, error: err?.message || String(err) });
-      await status({ status: "failed", error: err?.message || String(err) });
-    }
-  }
-
-  /** "Mark done": export whatever the window holds now (the heuristic may have missed the sign-in). */
-  async loginDone({ commandId, requestId }) {
-    try {
-      const entry = this.logins.get(requestId);
-      if (!entry?.handle) throw new Error("No sign-in window is open for this request on this machine.");
-      await entry.handle.done();
-      if (commandId) await this.api.commandAck(commandId, { ok: true });
-    } catch (err) {
-      this.log("warn", "verify.login.done.failed", { requestId, error: err?.message });
-      if (commandId) await this.api.commandAck(commandId, { ok: false, error: err?.message || String(err) }).catch(() => {});
-    }
-  }
-
-  async loginCancel({ commandId, requestId }) {
-    try {
-      const entry = this.logins.get(requestId);
-      if (!entry) throw new Error("No sign-in window is open for this request on this machine.");
-      if (entry.handle) await entry.handle.cancel();
-      // Still launching: loginStart closes the window as soon as it is up.
-      else entry.cancelled = true;
-      if (commandId) await this.api.commandAck(commandId, { ok: true });
-    } catch (err) {
-      this.log("warn", "verify.login.cancel.failed", { requestId, error: err?.message });
-      if (commandId) await this.api.commandAck(commandId, { ok: false, error: err?.message || String(err) }).catch(() => {});
-    }
-  }
-
-  /** Close every sign-in window matching `filter` (session close, shutdown). */
-  async teardownLogins(filter, reason) {
-    if (!this.logins?.size) return;
-    const victims = [...this.logins.values()].filter((l) => {
-      try {
-        return filter(l);
-      } catch {
-        return false;
-      }
-    });
-    for (const l of victims) {
-      this.log("info", "verify.login.teardown", { requestId: l.requestId, reason });
-      this.logins.delete(l.requestId);
-      l.cancelled = true; // still launching → loginStart closes it on arrival
-      await l.handle?.cancel?.().catch(() => {});
-    }
-  }
-
   /**
    * Mid-turn steering: forward the message to the running runner's stdin
    * control channel. The runner answers with a `steer` turn event
@@ -2390,6 +1952,43 @@ export class BridgeDaemon {
     return { note: notes.join(""), hasLivePreview: previews.length > 0 };
   }
 
+  /**
+   * Run a git network op with this machine's own credentials; when those are
+   * rejected, retry ONCE with the Server-issued credentials for `repoKey`
+   * (connected repos only — anything else rethrows the original error).
+   */
+  async withGitAuth(repoKey, run) {
+    try {
+      return await run(null);
+    } catch (err) {
+      if (!repoKey || !isGitAuthError(err)) throw err;
+      let authHeader;
+      try {
+        authHeader = await this.gitAuthHeader(repoKey);
+      } catch (credErr) {
+        this.log("warn", "git.auth.unavailable", { repo: repoKey, error: credErr.message });
+        throw err;
+      }
+      this.log("info", "git.auth.fallback", { repo: repoKey });
+      try {
+        return await run(gitAuthEnv(authHeader));
+      } catch (retryErr) {
+        // Stale or revoked: never reuse it for the next attempt.
+        if (isGitAuthError(retryErr)) this.gitAuth.delete(repoKey);
+        throw retryErr;
+      }
+    }
+  }
+
+  async gitAuthHeader(repoKey) {
+    const cached = this.gitAuth.get(repoKey);
+    if (cached && Date.now() - cached.at < GIT_AUTH_TTL_MS) return cached.authHeader;
+    const { authHeader } = await this.api.gitCredentials(repoKey);
+    if (!authHeader) throw new Error("The Server returned no git credentials.");
+    this.gitAuth.set(repoKey, { authHeader, at: Date.now() });
+    return authHeader;
+  }
+
   /**
    * Clone `remote` into the preferred root as `name`. Hardened for
    * unattended runs: no credential prompts (`GIT_TERMINAL_PROMPT=0`,
@@ -2401,7 +2000,7 @@ export class BridgeDaemon {
   async cloneRepo({ commandId, remote, name, repoKey, timeoutMs = CLONE_TIMEOUT_MS }) {
     const root = preferredCloneRoot(this.repoGroups, (this.config.roots || [])[0] ?? defaultRoots()[0]);
     try {
-      const target = await cloneRepository({ remote, name, root, repoKey, timeoutMs });
+      const target = await this.withGitAuth(repoKey, (gitEnv) => cloneRepository({ remote, name, root, repoKey, timeoutMs, gitEnv }));
       await this.scanRepos();
       // Ack only after the Server has the new inventory: recovery checks
       // readiness before automatically retrying the blocked session.
@@ -2523,9 +2122,44 @@ export function defaultRealtimeFactory({ config, channel, onEvent, onState }) {
     });
     client.connection?.bind?.("state_change", (s) => onState(s.current));
     const ch = client.subscribe(channel);
-    ch.bind_global?.((name, data) => {
-      if (typeof name === "string" && name.startsWith("bridge.")) onEvent(name, data);
-    });
+    ch.bind_global?.((name, data) => routeRealtimeEvent(name, data, { onEvent, onState }));
   })().catch((err) => onState(`error:${err.message}`));
   return { disconnect: () => client?.disconnect?.() };
 }
+
+/**
+ * One channel event → command or state. `pusher:subscription_error` is the
+ * case that used to slip through: the socket is up, so the connection
+ * reports `connected`, but the private-channel auth failed (the API was
+ * restarting) and nothing is subscribed — the daemon sat "online" and deaf
+ * until the next socket drop. Routed as a state, handleRealtimeState
+ * reconnects from scratch like any other terminal state.
+ */
+export function routeRealtimeEvent(name, data, { onEvent, onState }) {
+  if (typeof name !== "string") return;
+  if (name === "pusher:subscription_error") {
+    const detail = [data?.status, data?.error].filter((v) => v !== undefined && v !== null && v !== "").join(" ");
+    onState(`subscription_error${detail ? `:${detail}` : ""}`);
+    return;
+  }
+  if (name.startsWith("bridge.")) onEvent(name, data);
+}
+
+/**
+ * A probe that could not run (the CLI timed out, could not be spawned)
+ * answers `unknown`; announcing that would flip the dashboard to
+ * "signed out" until the next good probe. Carry the last definite state
+ * for that profile instead, and remember every definite answer.
+ */
+export function carryAuthStates(profiles, lastAuthStates) {
+  for (const p of profiles) {
+    if (!p?.id) continue;
+    if (p.authState === "unknown") {
+      const last = lastAuthStates.get(p.id);
+      if (last) Object.assign(p, last);
+    } else if (p.authState) {
+      lastAuthStates.set(p.id, { authState: p.authState, account: p.account ?? null });
+    }
+  }
+  return profiles;
+}