@gleapai/kai-bridge 0.9.1 → 0.10.0

package/README.md

@@ -1,7 +1,7 @@
 # Kai Code Bridge
 
 Run [Gleap Kai Code](https://gleap.io) on your computer or server with your own
-Claude Code / Codex login, local dev-server previews, and photo or video verification.
+Claude Code / Codex login, and local dev-server previews.
 
 ```bash
 npm i -g @gleapai/kai-bridge   # one install, so the background service has a stable path
@@ -67,4 +67,4 @@ Updates install into `~/.kai/harnesses`, verify the new executable, then select
 
 Codex automatically uses device-code sign-in over SSH or on headless Linux. Enable device-code sign-in in the account settings if Codex asks. Claude uses its native `auth login` flow: follow the URL and prompts in the SSH terminal. Dashboard **Sign in** opens a terminal on desktop devices; for headless servers it shows the exact command to run over SSH. The login is picked up automatically.
 
-**Previews are local to the Kai Code Bridge device.** Open them on that computer, on the same network when supported, or use your own SSH port forwarding. Kai Code Bridge does not expose previews through a public tunnel. Screenshot and video verification runs on the Kai Code Bridge device and uploads its evidence to the Kai Code session, so those checks still work on a remote server.
+**Previews boot local to the Kai Code Bridge device.** Open them on that computer, or click **Make public** in the dashboard's Preview popover to get a stable HTTPS link (`https://web-<repo>-<id>.gleap-preview.dev`) that works from a phone or a teammate's laptop. Public links run through a Cloudflare Tunnel: the daemon starts `cloudflared` on the device (it uses one from your PATH, else downloads a pinned release into `~/.kai/bin`; `brew install cloudflared`, `apt install cloudflared` or `winget install Cloudflare.cloudflared` also work). The address is the same for every ticket of a repo on this device, so a saved login survives from one ticket to the next, and only one ticket per repo can be public on a device at a time: making another one public points the same link at it and stops the previous preview (its owner sees a notice). Nothing leaves the device until someone clicks Make public. `kai-bridge ps` shows what is running.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gleapai/kai-bridge",
-      "version": "0.9.1",
+      "version": "0.10.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.9.1",
-  "description": "Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions, local previews, and photo or video verification.",
+  "version": "0.10.0",
+  "description": "Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions and local previews.",
   "type": "module",
   "license": "MIT",
   "bin": {

package/runner/acp-runner.mjs

@@ -28,14 +28,12 @@ import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 
 import {
   KAI_RESOLUTION_ANALYST_AGENT_NAME,
-  KAI_VERIFIER_AGENT_NAME,
   captureRepoBaselines,
   createUsageTracker,
   debugLog,
   emit,
   emitSync,
   isArtifactWriterAgent,
-  isReadOnlyAgent,
   parseRunnerArgs,
   revertRepoMutations,
   setTracePrefix,
@@ -77,10 +75,6 @@ const ENGINE_MODEL = ARGS.engineModel;
 const HARNESS_ID = resolveHarnessId(ARGS.argv.harness, MODEL);
 const HARNESS = getHarness(HARNESS_ID);
 const IS_ARTIFACT_WRITER = isArtifactWriterAgent(AGENT);
-// Read-only agents (the verifier): build-mode tool access minus the file
-// write tools, repos reverted after the turn — see contract.mjs.
-const IS_READ_ONLY = isReadOnlyAgent(AGENT);
-const IS_VERIFIER = AGENT === KAI_VERIFIER_AGENT_NAME;
 
 if (!TASK) {
   emitSync({ type: "error", message: "runner: missing --task-b64 argument" });
@@ -89,7 +83,7 @@ if (!TASK) {
 
 const RUNNER_DIR = dirname(fileURLToPath(import.meta.url));
 const PERSONA_DIR = process.env.KAI_PERSONA_DIR || "/opt/gleap-runners/personas";
-const PERSONA_AGENTS = new Set(["kai-documentarian", "kai-asker", "kai-researcher", KAI_RESOLUTION_ANALYST_AGENT_NAME, KAI_VERIFIER_AGENT_NAME]);
+const PERSONA_AGENTS = new Set(["kai-documentarian", "kai-asker", "kai-researcher", KAI_RESOLUTION_ANALYST_AGENT_NAME]);
 const SCRATCH_DIR = join(tmpdir(), `kai-acp-${process.pid}`);
 mkdirSync(SCRATCH_DIR, { recursive: true });
 // Harness config dir lives OUTSIDE the repo tree and survives across
@@ -132,32 +126,6 @@ const PROMPT_SUGGESTION_WAIT_MS = Math.max(0, Number(process.env.KAI_PROMPT_SUGG
 const PROMPT_SUGGESTIONS_ENABLED = process.env.KAI_PROMPT_SUGGESTIONS !== "0" && PROMPT_SUGGESTION_WAIT_MS > 0;
 const TODO_SERVER_KEY = "kai_todos";
 const TODO_MCP_PATH = process.env.KAI_TODO_MCP_PATH || join(RUNNER_DIR, "tools", "todo-mcp.mjs");
-// Verification report bridge (tools/verify-mcp.mjs) — the verifier's
-// verdict channel. Attached ONLY to kai-verifier turns; the mapper turns
-// its `report_verification` calls into `verify_report` contract events.
-const VERIFY_SERVER_KEY = "kai_verify";
-const VERIFY_MCP_PATH = process.env.KAI_VERIFY_MCP_PATH || join(RUNNER_DIR, "tools", "verify-mcp.mjs");
-/**
- * `KAI_VERIFY_*` — the host's request policy for the verify MCP's
- * `http_request` (read-only flag, allowed origins, the app's auth header,
- * the evidence dir for `requests.jsonl`). Passed EXPLICITLY on the server
- * entry: Codex spawns MCP servers with a scrubbed env, and the values must
- * never ride in the prompt (the auth header is a live credential).
- */
-function verifyMcpEnv() {
-  const out = {};
-  for (const k of Object.keys(process.env).sort()) {
-    if (k.startsWith("KAI_VERIFY_") && k !== "KAI_VERIFY_MCP_PATH" && process.env[k]) out[k] = String(process.env[k]);
-  }
-  return out;
-}
-// The verifier must not write files. Claude's bypassPermissions mode still
-// honours disallowedTools, so the write tools are removed outright (Bash
-// redirections are caught by the post-turn revert).
-const READ_ONLY_DISALLOWED = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-// The verifier tests the app, it never needs the app's secrets: env files
-// and private keys stay unreadable (gitignore-style Read rules).
-const VERIFIER_DISALLOWED = ["Read(**/.env*)", "Read(**/*.pem)"];
 const TODO_NOTE =
   "Track multi-step work as a live todo list with the `todo_write` tool " +
   `from the \`${TODO_SERVER_KEY}\` MCP server: pass the FULL updated list ` +
@@ -311,9 +279,7 @@ function buildAppendSystemPrompt() {
   if (IS_PLAN_MODE) sections.push(NEEDS_ASK_USER_MCP ? GATEWAY_PLAN_GUARD : PLAN_QUESTION_GUARD);
   if (IS_PLAN_MODE) sections.push(PLAN_SCOPE_NOTE);
   if (IS_PLAN_MODE && HARNESS_ID !== "claude") sections.push(READ_ONLY_PLAN_NOTE);
-  // Read-only agents carry their own "never commit" rule in the persona;
-  // the hand-off note ("the host commits your changes") would contradict it.
-  if (!IS_PLAN_MODE && !IS_READ_ONLY) sections.push(GIT_HANDOFF_PROMPT);
+  if (!IS_PLAN_MODE) sections.push(GIT_HANDOFF_PROMPT);
   // After the safety guards (their leading position is load-bearing for
   // cursor's prompt-prefix mode) but before project instructions.
   if (!IS_ARTIFACT_WRITER) sections.push(TODO_NOTE);
@@ -331,9 +297,6 @@ function buildAcpMcpServers() {
   if (!IS_ARTIFACT_WRITER && existsSync(TODO_MCP_PATH)) {
     out.push({ name: TODO_SERVER_KEY, command: process.execPath, args: [TODO_MCP_PATH], env: [] });
   }
-  if (IS_VERIFIER && existsSync(VERIFY_MCP_PATH)) {
-    out.push({ name: VERIFY_SERVER_KEY, command: process.execPath, args: [VERIFY_MCP_PATH], env: Object.entries(verifyMcpEnv()).map(([name, value]) => ({ name, value })) });
-  }
   for (const server of MCP_SERVERS || []) {
     if (!server || typeof server !== "object") continue;
     const name = String(server.name || server.id || "").replace(/[^a-zA-Z0-9_-]/g, "_");
@@ -384,8 +347,6 @@ function buildAgents() {
 
 function buildDisallowedTools() {
   const list = IS_PLAN_MODE || IS_ARTIFACT_WRITER ? [] : [...GIT_HANDOFF_DISALLOWED];
-  if (IS_READ_ONLY) list.push(...READ_ONLY_DISALLOWED);
-  if (IS_VERIFIER) list.push(...VERIFIER_DISALLOWED);
   for (const server of MCP_SERVERS || []) {
     const key = String(server?.name || server?.id || "").replace(/[^a-zA-Z0-9_-]/g, "_");
     for (const tool of [...(server?.disabledTools ?? []), ...(server?.gatedTools ?? [])]) {
@@ -503,14 +464,12 @@ async function main() {
     maxSteps: MAX_STEPS,
     isPlanMode: IS_PLAN_MODE,
     isArtifactWriter: IS_ARTIFACT_WRITER,
-    isReadOnly: IS_READ_ONLY,
     appendSystemPrompt,
     instructionsPath,
     disallowedTools: buildDisallowedTools(),
     allowedTools: buildAllowedTools([
       // The injected todo bridge must survive plan mode's allow-list.
       `mcp__${TODO_SERVER_KEY}`,
-      ...(IS_VERIFIER ? [`mcp__${VERIFY_SERVER_KEY}`] : []),
       ...(MCP_SERVERS || []).map((srv) => `mcp__${String(srv?.name || srv?.id || "").replace(/[^a-zA-Z0-9_-]/g, "_")}`).filter((k) => k !== "mcp__"),
     ]),
     agents: buildAgents(),
@@ -527,9 +486,6 @@ async function main() {
             ...(!IS_ARTIFACT_WRITER && existsSync(TODO_MCP_PATH)
               ? [{ name: TODO_SERVER_KEY, command: process.execPath, args: [TODO_MCP_PATH] }]
               : []),
-            ...(IS_VERIFIER && existsSync(VERIFY_MCP_PATH)
-              ? [{ name: VERIFY_SERVER_KEY, command: process.execPath, args: [VERIFY_MCP_PATH], env: verifyMcpEnv() }]
-              : []),
             ...(MCP_SERVERS || []),
           ]
         : MCP_SERVERS || [],
@@ -618,7 +574,7 @@ async function main() {
     isPlanMode: IS_PLAN_MODE,
     mcpServerIds,
     readPlanFile: readNewestPlan,
-    allowTool: permissionPolicy({ isPlanMode: IS_PLAN_MODE, isArtifactWriter: IS_ARTIFACT_WRITER, isReadOnly: IS_READ_ONLY, workDir: WORK_DIR }),
+    allowTool: permissionPolicy({ isPlanMode: IS_PLAN_MODE, isArtifactWriter: IS_ARTIFACT_WRITER, workDir: WORK_DIR }),
     onTurnShouldEnd: (reason) => {
       cancelRequested = reason;
       if (conn && acpSessionId) conn.cancel({ sessionId: acpSessionId }).catch(() => {});
@@ -749,10 +705,10 @@ async function main() {
     }
   }
 
-  // Artifact writers and read-only agents must leave the repo untouched:
-  // snapshot before, revert anything outside `.kai/` after (belt-and-braces
-  // under the permission rules — shell redirections can still write).
-  const REVERTS_REPO = IS_ARTIFACT_WRITER || IS_READ_ONLY;
+  // Artifact writers must leave the repo untouched: snapshot before, revert
+  // anything outside `.kai/` after (belt-and-braces under the permission
+  // rules — shell redirections can still write).
+  const REVERTS_REPO = IS_ARTIFACT_WRITER;
   const baselines = REVERTS_REPO ? captureRepoBaselines(WORK_DIR) : null;
   // Harnesses without a system-prompt channel (Cursor) get the persona as
   // a prefix of the first prompt.

package/runner/lib/acp/mapper.mjs

@@ -24,19 +24,6 @@ import {
 const QUESTION_TOOL = "Question";
 const EXIT_PLAN_TOOL = "ExitPlanMode";
 
-/**
- * The `kai_verify` bridge's `report_verification` (tools/verify-mcp.mjs)
- * in every harness spelling: Claude `mcp__kai_verify__report_verification`,
- * Codex's server-scoped form (rebuilt from `rawInput.server/tool` by
- * toolNameFromUpdate), a bare title. Its call becomes the `verify_report`
- * contract event — never a tool row, and NOT turn-ending (the persona
- * wraps up after reporting).
- */
-export function isVerifyReportTool(name) {
-  return /(^|__|\.)report_verification$/.test(String(name || ""));
-}
-const VERIFY_REPORT_TOOL_NAME = "mcp__kai_verify__report_verification";
-
 /** Generic ACP `kind` → a readable tool label when no meta name exists. */
 const KIND_LABEL = {
   read: "Read",
@@ -75,8 +62,6 @@ export function toolNameFromUpdate(update) {
   // the announce leaks a bare "Tool (running)" row that the suppressed
   // completion never clears.
   if (typeof update?.title === "string" && /todo_write/.test(update.title)) return "TodoWrite";
-  // Same for the verifier's report bridge.
-  if (typeof update?.title === "string" && /report_verification/.test(update.title)) return VERIFY_REPORT_TOOL_NAME;
   if (update?.kind && KIND_LABEL[update.kind]) return KIND_LABEL[update.kind];
   return "Tool";
 }
@@ -248,16 +233,11 @@ function contentToValue(content) {
  * the agent: a mode the adapter fails to apply must not become a free
  * pass for edits.
  */
-export function permissionPolicy({ isPlanMode = false, isArtifactWriter = false, isReadOnly = false, workDir = "" } = {}) {
+export function permissionPolicy({ isPlanMode = false, isArtifactWriter = false, workDir = "" } = {}) {
   const WRITE_TOOLS = /^(Write|Edit|MultiEdit|NotebookEdit)$/;
   const READONLY_BASH = /^\s*(cat|head|tail|wc|stat|ls|find|grep|rg|git (log|diff|show|status|ls-files|grep|rev-parse|branch)|sed -n|awk|jq|sort|uniq|cut|tr|diff|nl|basename|dirname|realpath|file|echo|pwd|which)\b/;
   const kaiDir = workDir ? `${workDir.replace(/\/+$/, "")}/.kai/` : "/.kai/";
   return (name, input) => {
-    // Read-only agents (kai-verifier) keep build-mode tool access — the
-    // browser MCP, shell probes and questions must run unprompted — but a
-    // file-write tool is never theirs. Shell leaks are caught by the
-    // post-turn revert.
-    if (isReadOnly && !isPlanMode && !isArtifactWriter) return !WRITE_TOOLS.test(canonicalToolName(name));
     if (!isPlanMode && !isArtifactWriter) return true;
     const canonical = canonicalToolName(name);
     if (WRITE_TOOLS.test(canonical)) {
@@ -342,16 +322,6 @@ export function createAcpMapper({ emit, isPlanMode = false, onTurnShouldEnd, onC
       }
       return;
     }
-    if (isVerifyReportTool(meta.name)) {
-      // One `verify_report` per call, on completion only — the announce
-      // (input still streaming) and the completed update would otherwise
-      // hand the host two reports for one filing. Local artifact paths
-      // ride in `report`; the host uploads them and rewrites to URLs.
-      if (status !== "running" && meta.input && typeof meta.input === "object" && !Array.isArray(meta.input)) {
-        emit({ type: "verify_report", message: "Verification report filed", report: sanitizeToolValue(meta.input, 4000) });
-      }
-      return;
-    }
     // Adapter-provided titles ("List files in 'src'") stand in when the
     // input carries nothing summarizeTool understands.
     const summary = summarizeTool(name, meta.input || {}) || meta.title || "";

package/runner/lib/contract.mjs

@@ -64,9 +64,6 @@ export function decodeB64Json(value, fallback) {
 export const KAI_PLANNER_AGENT_NAME = "kai-planner";
 export const KAI_BUILDER_AGENT_NAME = "kai";
 export const KAI_RESOLUTION_ANALYST_AGENT_NAME = "kai-resolution-analyst";
-// Kai Code "Verify": drives the running preview with the browser tools,
-// records evidence, files a `report_verification`. Read-only by contract.
-export const KAI_VERIFIER_AGENT_NAME = "kai-verifier";
 
 export function normalizeAgentName(raw) {
   const value = typeof raw === "string" ? raw : "";
@@ -121,18 +118,6 @@ export function isArtifactWriterAgent(agentName) {
   return ARTIFACT_WRITER_AGENT_NAMES.includes(agentName);
 }
 
-// Read-only agents produce NO files at all — not even `.kai/` artifacts.
-// The verifier's output is the `report_verification` tool call plus the
-// browser recordings the Playwright MCP writes OUTSIDE the workspace
-// (the host's artifacts dir). They run with build-mode tool access (the
-// browser MCP + questions must work unprompted), so `revertRepoMutations`
-// is what guarantees the repos come out exactly as they went in.
-export const READ_ONLY_AGENT_NAMES = [KAI_VERIFIER_AGENT_NAME];
-
-export function isReadOnlyAgent(agentName) {
-  return READ_ONLY_AGENT_NAMES.includes(agentName);
-}
-
 function findWorkspaceRepos(workDir) {
   const repos = [];
   if (existsSync(join(workDir, ".git"))) {
@@ -356,7 +341,7 @@ const SUPPORTED_FILE_PART_MIMES = new Set(["application/pdf"]);
  * flags are optional except `--task-b64`; callers fail fast on an
  * empty `task` themselves (the error message differs per runner).
  *
- *   --agent <name>                       kai | kai-planner | kai-verifier | kai-documentarian | …
+ *   --agent <name>                       kai | kai-planner | kai-documentarian | …
  *   --model <provider/modelID>           canonical registry id
  *   --engine-model <slug>                engine-native model slug (claude/codex wire form)
  *   --subagent-model <provider/modelID>  cheaper sibling for explorer subagents

package/scripts/postinstall.mjs

@@ -16,6 +16,13 @@ try {
 } catch {
   // The daemon retries on start; a missing patch only means no suggestions.
 }
+// Raise the browser MCP's 30 s per-call default (see src/playwright-patch.mjs).
+try {
+  const { ensurePlaywrightTimeoutPatched } = await import("../src/playwright-patch.mjs");
+  ensurePlaywrightTimeoutPatched();
+} catch {
+  // The daemon retries on start.
+}
 try {
   const interactive = process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
   const isGlobal = process.env.npm_config_global === "true";

package/src/api.mjs

@@ -6,18 +6,18 @@
 //   POST   /gleapcode/bridge/devices/me/heartbeat  { running: [turnIds] }
 //   POST   /gleapcode/bridge/turns/:id/events      { events: [contract lines] }
 //   POST   /gleapcode/bridge/turns/:id/result      { result, changes, status }
-//   POST   /gleapcode/bridge/turns/:id/artifacts   multipart `file`            → { url }   (verify evidence)
-//   POST   /gleapcode/bridge/turns/:id/verification{ status, scope, reason, checks, untested, artifacts, evidence?, revisions? }
-//   PUT    /gleapcode/bridge/turns/:id/verification/artifacts { artifacts, evidence }   (evidence retry — union by URL, clears evidenceMissing)
-//   POST   /gleapcode/bridge/turns/:id/verification/stage { stage, note? }   (setup|booting|login|verifying|fixing|saving)
-//   GET    /gleapcode/bridge/turns/:id/preview-login → the saved sign-in record for this verify turn (one GET per turn)
-//   POST   /gleapcode/bridge/preview-logins/:requestId          { storageState, origins, services, landingUrl, loginPaths }  (capture upload)
-//   POST   /gleapcode/bridge/preview-logins/:requestId/status   { status: opened|waiting_signin|detected|failed|cancelled, error? }
-//   PUT    /gleapcode/bridge/preview-logins/:id                 { storageState, basedOnVersion } → 409 on a stale version
+//   POST   /gleapcode/bridge/devices/me/public-hosts { sessionId, services } → { domain, hosts, tunnel, displaced }
 //   POST   /users/me/pusher                        { socket_id, channel_name }   (channel auth)
 
-import { readFile } from "node:fs/promises";
-import { basename } from "node:path";
+/**
+ * The human-readable part of a Server error body. `statusOr500` answers
+ * `{ ok: false, message }`; the global handler answers `{ error: { message,
+ * details } }` — reading `error` itself printed "[object Object]".
+ */
+export function errorMessage(data, text = "") {
+  const pick = (v) => (typeof v === "string" && v ? v : null);
+  return pick(data?.message) ?? pick(data?.error?.message) ?? pick(data?.error) ?? pick(text.slice(0, 200)) ?? "no error body";
+}
 
 export class BridgeApi {
   constructor({ apiBase, token, fetchImpl = fetch }) {
@@ -51,7 +51,7 @@ export class BridgeApi {
       data = { raw: text };
     }
     if (!res.ok) {
-      const err = new Error(`${method} ${path} → ${res.status}: ${data?.message ?? data?.error ?? text.slice(0, 200)}`);
+      const err = new Error(`${method} ${path} → ${res.status}: ${errorMessage(data, text)}`);
       err.status = res.status;
       err.data = data;
       throw err;
@@ -116,97 +116,7 @@ export class BridgeApi {
     );
   }
 
-  /**
-   * Upload one verify artifact (recording / screenshot / trace) as
-   * multipart `file`; resolves the Server's `{ url }`. Separate from the
-   * JSON-only `request()`: the body is a FormData (fetch sets the boundary
-   * header itself — never set content-type here), a video can take a
-   * while (5-min cap), and it retries transient failures 3× — a dropped
-   * screenshot is missing evidence, not a broken turn.
-   */
-  async uploadArtifact(turnId, filePath, contentType, { tries = 3, timeoutMs = 5 * 60_000, onRetry } = {}) {
-    const bytes = await readFile(filePath);
-    const path = `/gleapcode/bridge/turns/${encodeURIComponent(turnId)}/artifacts`;
-    let delay = 1_000;
-    for (let attempt = 1; ; attempt += 1) {
-      try {
-        const form = new FormData();
-        form.append("file", new Blob([bytes], { type: contentType }), basename(filePath));
-        const res = await this.fetch(`${this.apiBase}${path}`, {
-          method: "POST",
-          headers: { ...(this.token ? { authorization: `Bearer ${this.token}` } : {}) },
-          body: form,
-          signal: AbortSignal.timeout(timeoutMs),
-        });
-        const text = await res.text();
-        let data = null;
-        try {
-          data = text ? JSON.parse(text) : null;
-        } catch {
-          data = { raw: text };
-        }
-        if (!res.ok) {
-          const err = new Error(`POST ${path} → ${res.status}: ${data?.message ?? data?.error ?? text.slice(0, 200)}`);
-          err.status = res.status;
-          err.data = data;
-          throw err;
-        }
-        if (typeof data?.url !== "string" || !data.url) throw new Error(`POST ${path} → no url in response`);
-        return data;
-      } catch (err) {
-        const permanent = err.status >= 400 && err.status < 500 && err.status !== 429;
-        if (permanent || attempt >= tries) throw err;
-        onRetry?.(err, attempt, delay);
-        await new Promise((r) => setTimeout(r, delay));
-        delay = Math.min(delay * 2, 30_000);
-      }
-    }
-  }
-
-  /** The verification report for a verify turn (artifacts already uploaded → URLs). */
-  turnVerification(turnId, payload, opts) {
-    return this.requestWithRetry("POST", `/gleapcode/bridge/turns/${encodeURIComponent(turnId)}/verification`, payload, opts);
-  }
-
-  /** Late evidence (`bridge.verify.evidence.retry`): the Server unions by URL and clears `evidenceMissing`. */
-  putVerificationArtifacts(turnId, payload, opts) {
-    return this.requestWithRetry("PUT", `/gleapcode/bridge/turns/${encodeURIComponent(turnId)}/verification/artifacts`, payload, opts);
-  }
-
-  /** Stage transition of a running verify turn (best-effort UI state — callers swallow errors). */
-  turnVerificationStage(turnId, payload) {
-    return this.request("POST", `/gleapcode/bridge/turns/${encodeURIComponent(turnId)}/verification/stage`, payload);
-  }
-  /**
-   * The saved sign-in for this verify turn: `{ id, version, storageState,
-   * origins, services, landingUrl, loginPaths, optional }` (or `null` —
-   * a 404 is "no record", not an error). The Server allows ONE successful
-   * GET per turn and never caches it.
-   */
-  async turnPreviewLogin(turnId) {
-    try {
-      const data = await this.request("GET", `/gleapcode/bridge/turns/${encodeURIComponent(turnId)}/preview-login`);
-      const record = data && typeof data === "object" && "record" in data ? data.record : data;
-      return record && typeof record === "object" && record.storageState ? record : null;
-    } catch (err) {
-      if (err?.status === 404) return null;
-      throw err;
-    }
-  }
-  /** Capture upload against a pending login request (the ONLY thing a device may upload a sign-in against). */
-  uploadPreviewLogin(requestId, payload, opts) {
-    return this.requestWithRetry("POST", `/gleapcode/bridge/preview-logins/${encodeURIComponent(requestId)}`, payload, opts);
-  }
-  /** Capture progress for the dashboard's sign-in card. */
-  previewLoginStatus(requestId, payload) {
-    return this.request("POST", `/gleapcode/bridge/preview-logins/${encodeURIComponent(requestId)}/status`, payload);
-  }
-  /** Refresh a record after a verify run (CAS on `basedOnVersion`; 409 = someone else refreshed first → discard). */
-  refreshPreviewLogin(recordId, payload) {
-    return this.request("PUT", `/gleapcode/bridge/preview-logins/${encodeURIComponent(recordId)}`, payload);
-  }
-
-  /** Turns (and pending sign-in requests) the server still believes this device is running. */
+  /** Turns the server still believes this device is running. */
   pendingTurns() {
     return this.request("GET", "/gleapcode/bridge/devices/me/pending");
   }
@@ -217,6 +127,10 @@ export class BridgeApi {
   gitCredentials(repoKey) {
     return this.request("POST", "/gleapcode/bridge/devices/me/git-credentials", { repoKey });
   }
+  /** Public hostnames + tunnel credentials for a session being published (the Server decides displacement). */
+  publicHosts(payload) {
+    return this.request("POST", "/gleapcode/bridge/devices/me/public-hosts", payload);
+  }
 
   commandAck(commandId, payload) {
     return this.request("POST", `/gleapcode/bridge/commands/${encodeURIComponent(commandId)}/ack`, payload);

package/src/companions.mjs

@@ -69,7 +69,7 @@ export function orderCompanions(entries) {
  * repo required by any config is required overall; depth is capped at
  * `maxDepth`; a visited set keeps cycles harmless.
  */
-export async function collectCompanions({ roots, loadConfig, maxDepth = 3 } = {}) {
+export async function collectCompanions({ roots, loadConfig, maxDepth = 3, extra = [] } = {}) {
   const sessionKeys = new Set((roots || []).map((r) => String(r.key).toLowerCase()));
   const seen = new Map(); // key → entry
   let queue = (roots || []).map((r) => ({ key: String(r.key).toLowerCase(), config: r.config, depth: 0 }));
@@ -77,7 +77,8 @@ export async function collectCompanions({ roots, loadConfig, maxDepth = 3 } = {}
   for (let depth = 1; depth <= maxDepth && queue.length > 0; depth += 1) {
     const next = [];
     for (const node of queue) {
-      for (const c of node.config?.companions || []) {
+      // `extra`: companions the daemon inferred (reverse companions) count as declared by the session repos.
+      for (const c of [...(node.config?.companions || []), ...(node.depth === 0 ? extra : [])]) {
         const key = String(c.repo).toLowerCase();
         if (sessionKeys.has(key)) continue; // already part of the session
         const prev = seen.get(key);