@gleapai/kai-bridge 0.9.1 → 0.10.1

package/README.md

@@ -1,7 +1,7 @@
 # Kai Code Bridge
 
 Run [Gleap Kai Code](https://gleap.io) on your computer or server with your own
-Claude Code / Codex login, local dev-server previews, and photo or video verification.
+Claude Code / Codex login, and local dev-server previews.
 
 ```bash
 npm i -g @gleapai/kai-bridge   # one install, so the background service has a stable path
@@ -67,4 +67,4 @@ Updates install into `~/.kai/harnesses`, verify the new executable, then select
 
 Codex automatically uses device-code sign-in over SSH or on headless Linux. Enable device-code sign-in in the account settings if Codex asks. Claude uses its native `auth login` flow: follow the URL and prompts in the SSH terminal. Dashboard **Sign in** opens a terminal on desktop devices; for headless servers it shows the exact command to run over SSH. The login is picked up automatically.
 
-**Previews are local to the Kai Code Bridge device.** Open them on that computer, on the same network when supported, or use your own SSH port forwarding. Kai Code Bridge does not expose previews through a public tunnel. Screenshot and video verification runs on the Kai Code Bridge device and uploads its evidence to the Kai Code session, so those checks still work on a remote server.
+**Previews boot local to the Kai Code Bridge device.** Open them on that computer, or click **Make public** in the dashboard's Preview popover to get a stable HTTPS link (`https://web-<repo>-<id>.gleap-preview.dev`) that works from a phone or a teammate's laptop. Public links run through a Cloudflare Tunnel: the daemon starts `cloudflared` on the device (it uses one from your PATH, else downloads a pinned release into `~/.kai/bin`; `brew install cloudflared`, `apt install cloudflared` or `winget install Cloudflare.cloudflared` also work). The address is the same for every ticket of a repo on this device, so a saved login survives from one ticket to the next, and only one ticket per repo can be public on a device at a time: making another one public points the same link at it and stops the previous preview (its owner sees a notice). Nothing leaves the device until someone clicks Make public. `kai-bridge ps` shows what is running.

package/npm-shrinkwrap.json

@@ -1,20 +1,20 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.9.1",
+  "version": "0.10.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gleapai/kai-bridge",
-      "version": "0.9.1",
+      "version": "0.10.1",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@agentclientprotocol/claude-agent-acp": "0.75.1",
-        "@agentclientprotocol/codex-acp": "1.10.0",
-        "@agentclientprotocol/sdk": "1.4.0",
-        "@anthropic-ai/claude-agent-sdk": "0.3.266",
-        "@openai/codex": "0.153.4",
+        "@agentclientprotocol/claude-agent-acp": "0.81.1",
+        "@agentclientprotocol/codex-acp": "1.13.1",
+        "@agentclientprotocol/sdk": "1.5.0",
+        "@anthropic-ai/claude-agent-sdk": "0.3.280",
+        "@openai/codex": "0.156.1",
         "@playwright/mcp": "^0.0.79",
         "@sockudo/client": "^2.0.0",
         "chokidar": "^4.0.1",
@@ -35,14 +35,14 @@
       "license": "Apache-2.0"
     },
     "node_modules/@agentclientprotocol/claude-agent-acp": {
-      "version": "0.75.1",
-      "resolved": "https://registry.npmjs.org/@agentclientprotocol/claude-agent-acp/-/claude-agent-acp-0.75.1.tgz",
-      "integrity": "sha512-Un6I4BRkhpCFS3I7kr5C/lkAm8Nc3VuGZU2YQ3xIpJAIxV94iWO0Q2CH2QABxMERpONRu4Le6XC9V+5PImQZ2A==",
+      "version": "0.81.1",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/claude-agent-acp/-/claude-agent-acp-0.81.1.tgz",
+      "integrity": "sha512-I+7tUPsrYnI0nBmdUonoRmdCi7ohyzZ0SeCpeIUFuVZ7a8ZxDyUNO6zBJpaeAIwuPXCk8aw+7t+QiwXS6FwskQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@agentclientprotocol/sdk": "1.4.0",
-        "@anthropic-ai/claude-agent-sdk": "0.3.257",
-        "zod": "^4.0.0"
+        "@agentclientprotocol/sdk": "1.5.0",
+        "@anthropic-ai/claude-agent-sdk": "0.3.280",
+        "zod": "4.6.5"
       },
       "bin": {
         "claude-agent-acp": "dist/index.js"
@@ -52,13 +52,13 @@
       }
     },
     "node_modules/@agentclientprotocol/codex-acp": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@agentclientprotocol/codex-acp/-/codex-acp-1.10.0.tgz",
-      "integrity": "sha512-b4dDCPkH/GgHRb3JelXz4QdNirdoTjO3yYM1ImUJMxVXxgZLZMguEXNhZOH2G755UKzf6ZypiiC7UHe3fKgp2Q==",
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/codex-acp/-/codex-acp-1.13.1.tgz",
+      "integrity": "sha512-NAbXTb6GRReox7B+8RN9VRB+sKUqFJh5Vg7Ex7RskYCO8EsYPJKN1WJvN7mOqjCKKK9lVDrNxtP7Bp/OUKPyAg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@agentclientprotocol/sdk": "^1.4.0",
-        "@openai/codex": "^0.153.3",
+        "@agentclientprotocol/sdk": "^1.5.0",
+        "@openai/codex": "^0.156.1",
         "diff": "^9.0.0",
         "open": "^11.0.1",
         "vscode-jsonrpc": "^9.0.1",
@@ -69,31 +69,31 @@
       }
     },
     "node_modules/@agentclientprotocol/sdk": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.4.0.tgz",
-      "integrity": "sha512-/eufudw+aFY1LKLolT6yFE6UMmYRl7fMJ/DEONSIyR6wI3slHWITBsANRGqXEY8FRzqUxwh7QEaGiZHcJPVThg==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.5.0.tgz",
+      "integrity": "sha512-524jwbB2iYWA+kWWyv9fhKbhU89dH/lu9u5EXwVNmfYzopV8BujCDxByBDZhxRUkB7RWIJzISCnwivdDk+bdVg==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "zod": "^3.25.0 || ^4.0.0"
       }
     },
     "node_modules/@anthropic-ai/claude-agent-sdk": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk/-/claude-agent-sdk-0.3.266.tgz",
-      "integrity": "sha512-GVTLf3QwmtqUcFbrH/gzCWleGQ0RBSCMfVbdciTGdu7eiYeRu0seYNE3T8awmRl3nL63z7CkKbnWnpy4te5y4g==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk/-/claude-agent-sdk-0.3.280.tgz",
+      "integrity": "sha512-aIQSTKcCJcOgi125GAGQaNZUYgxbEBQwV2Ac+Utp0+gGUjIEWjTqz4B8kXr9XjkcCTYiRUMTDsXPAUfIcBDjnw==",
       "license": "SEE LICENSE IN README.md",
       "engines": {
         "node": ">=18.0.0"
       },
       "optionalDependencies": {
-        "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.266",
-        "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.266"
+        "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.280",
+        "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.280"
       },
       "peerDependencies": {
         "@anthropic-ai/sdk": ">=0.93.0",
@@ -102,9 +102,9 @@
       }
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-darwin-arm64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-arm64/-/claude-agent-sdk-darwin-arm64-0.3.266.tgz",
-      "integrity": "sha512-PfzEE3W2KyxM1yiZjMc9OrhvH9TM1c+wKdiQ2eRiFfnUDKL72FOkpcttB7QFf1pB0lrBhtMUjQIou+tWudkiCQ==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-arm64/-/claude-agent-sdk-darwin-arm64-0.3.280.tgz",
+      "integrity": "sha512-Yws14X5g5hgDtF565Tld/+dILAhH9QZpundjKMyO3dFasq9miXZlhU0NwXqwTO2xP0jDjJ54zduIiJwkcfcvGw==",
       "cpu": [
         "arm64"
       ],
@@ -115,9 +115,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-darwin-x64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-x64/-/claude-agent-sdk-darwin-x64-0.3.266.tgz",
-      "integrity": "sha512-+VRBd/GrrYHPATopS+rUjb8FmmMGbcAaW1zY3BhGlthG6eQjGUUuGvJm04YVIDeJznuRxADdX2JCZkmFP7rl/A==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-x64/-/claude-agent-sdk-darwin-x64-0.3.280.tgz",
+      "integrity": "sha512-B1eLx/oZ5RL1c3a13nQ4cRUksWyhGcVNS5vbCHnOVu4Pz+dH0moZ+iY8VaE6FvikVAQwFEW6VDU00b6m3tYdsQ==",
       "cpu": [
         "x64"
       ],
@@ -128,9 +128,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-linux-arm64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64/-/claude-agent-sdk-linux-arm64-0.3.266.tgz",
-      "integrity": "sha512-PetNmwoI4nC/R/ZsQ5ImrpAH38rSuMZxbb0uHRtxPGstQ6rGH9SPYDEC1vpNU2LC44TBqTjHKIwo7qmjB7fK1Q==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64/-/claude-agent-sdk-linux-arm64-0.3.280.tgz",
+      "integrity": "sha512-6s96OIvBHT2817hCFLIZ421JBpQnvrmZucpjlWsyCODKmwGsSxiEhlWqK2h5Q7lwS6F7bzeAhqjGvC7FzDl9Rw==",
       "cpu": [
         "arm64"
       ],
@@ -144,9 +144,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-linux-arm64-musl": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64-musl/-/claude-agent-sdk-linux-arm64-musl-0.3.266.tgz",
-      "integrity": "sha512-YhIceLAjcN9dGgyOF9hmR6FxaMXRehHtI1FHIB6WfJY+VeJhr/aMDEbAdcbkX8pW3WQJUmXgVEF6/+b8NbllFg==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64-musl/-/claude-agent-sdk-linux-arm64-musl-0.3.280.tgz",
+      "integrity": "sha512-uDh+Ggjb36l+jcVgaYxSziGHmBSSR3clqvGlQ0Bgc1v5dLF4igwqZ6ZPW/hS9dArG27fislIOetH1waEgIr+GA==",
       "cpu": [
         "arm64"
       ],
@@ -160,9 +160,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-linux-x64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64/-/claude-agent-sdk-linux-x64-0.3.266.tgz",
-      "integrity": "sha512-vsZC/4sA5r9CFxchOSQcSL1b01+Z6RWYlUSda6HcdiCg47u4RFilwBxFU5/u82pAYvyKbDKMOF0I8L6z16IYew==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64/-/claude-agent-sdk-linux-x64-0.3.280.tgz",
+      "integrity": "sha512-vpPyxYLy+zNc7LwQDWsZf0GZtTYa0PJLxzuv2vK9iV2dG+hrbRNTl35NSKKRR9rMj6RpKz0i2NLyVQ+D4mREgw==",
       "cpu": [
         "x64"
       ],
@@ -176,9 +176,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-linux-x64-musl": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64-musl/-/claude-agent-sdk-linux-x64-musl-0.3.266.tgz",
-      "integrity": "sha512-jygNEBfVuX09Nqfrcpax6y/O3erTUSoh8/T1Ou1/27DHJSPIWoWebTZx2gpctyjQCUub4yGwXgwUDePEk8YZkQ==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64-musl/-/claude-agent-sdk-linux-x64-musl-0.3.280.tgz",
+      "integrity": "sha512-IVbIgvi5C0sdLg/p9hpiVvAQ/ikvTKwOOEy5C1aT7w8XLqBgfpJbzzVuk06df1Q0HlILUmf63EKPmq48lbxtqA==",
       "cpu": [
         "x64"
       ],
@@ -192,9 +192,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-win32-arm64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-arm64/-/claude-agent-sdk-win32-arm64-0.3.266.tgz",
-      "integrity": "sha512-1osOefn+dBsC22FMnyOgF7ZBY35HXkeN0zSyszSSx4X/BVA7HcluqRJElKppWLxQGGLukkd/sqkLzgvX5sh1eg==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-arm64/-/claude-agent-sdk-win32-arm64-0.3.280.tgz",
+      "integrity": "sha512-heTflHwciJF+Hrf7v0J53QBzD+9mxN9gt2VVmEJAN0+ejbPcOcqnGGZHvyc9aZUuGh5INN0ECaiL4Fn1X2vXQQ==",
       "cpu": [
         "arm64"
       ],
@@ -205,9 +205,9 @@
       ]
     },
     "node_modules/@anthropic-ai/claude-agent-sdk-win32-x64": {
-      "version": "0.3.266",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-x64/-/claude-agent-sdk-win32-x64-0.3.266.tgz",
-      "integrity": "sha512-/l2l1nDYhkz7GdWHCu2ENg0+CAY/Ds6R/Y1cYxJsRfB6mP1dgaU83cSaExMInswdIh3uiwEv96OMLQZGVjSFaA==",
+      "version": "0.3.280",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-x64/-/claude-agent-sdk-win32-x64-0.3.280.tgz",
+      "integrity": "sha512-N+Y1zJb19nx0oPTvzkl/E3ng9AtWGW+K4hySmSHCgYSsgIwfs1YzDj/F5eHDMrxgklTuzFp76TvL3S75z5ge+g==",
       "cpu": [
         "x64"
       ],
@@ -218,9 +218,9 @@
       ]
     },
     "node_modules/@anthropic-ai/sdk": {
-      "version": "0.124.0",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.124.0.tgz",
-      "integrity": "sha512-cN5O8i9UVxHeOQAzj/XjshWXG8KiibJDw9OGpH2Z/eR3n/RBxdoLxDJOcfqAJWvjaMDFfHTBADU04hWRJVkDyA==",
+      "version": "0.128.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.128.0.tgz",
+      "integrity": "sha512-tl5cBFZC1jVFrTuQyvQObA4WmuNgcYVeXfriqOumgtLAHUm4gPUj18YnszBW60v0PrjDB8nBDOC6wd9CmHQFlA==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -313,9 +313,9 @@
       }
     },
     "node_modules/@openai/codex": {
-      "version": "0.153.4",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4.tgz",
-      "integrity": "sha512-wbHDmit7S/YvBGVX1DQmk13xtWblZ2cApeJ/pB7xDZ10Cna+DZc5ij7f0F4OxdsXN4FW1oLT48OpogUI1+8Y2w==",
+      "version": "0.156.1",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1.tgz",
+      "integrity": "sha512-nI1iVl/n2SO2lSvlwEsJx63zdSI4C4Me2gR7AG0OWMJiGSakz2tY2hx43E39Zq5aEoeB5bZjJXzp5Sqhog6vyA==",
       "license": "Apache-2.0",
       "bin": {
         "codex": "bin/codex.js"
@@ -324,19 +324,19 @@
         "node": ">=16"
       },
       "optionalDependencies": {
-        "@openai/codex-darwin-arm64": "npm:@openai/codex@0.153.4-darwin-arm64",
-        "@openai/codex-darwin-x64": "npm:@openai/codex@0.153.4-darwin-x64",
-        "@openai/codex-linux-arm64": "npm:@openai/codex@0.153.4-linux-arm64",
-        "@openai/codex-linux-x64": "npm:@openai/codex@0.153.4-linux-x64",
-        "@openai/codex-win32-arm64": "npm:@openai/codex@0.153.4-win32-arm64",
-        "@openai/codex-win32-x64": "npm:@openai/codex@0.153.4-win32-x64"
+        "@openai/codex-darwin-arm64": "npm:@openai/codex@0.156.1-darwin-arm64",
+        "@openai/codex-darwin-x64": "npm:@openai/codex@0.156.1-darwin-x64",
+        "@openai/codex-linux-arm64": "npm:@openai/codex@0.156.1-linux-arm64",
+        "@openai/codex-linux-x64": "npm:@openai/codex@0.156.1-linux-x64",
+        "@openai/codex-win32-arm64": "npm:@openai/codex@0.156.1-win32-arm64",
+        "@openai/codex-win32-x64": "npm:@openai/codex@0.156.1-win32-x64"
       }
     },
     "node_modules/@openai/codex-darwin-arm64": {
       "name": "@openai/codex",
-      "version": "0.153.4-darwin-arm64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz",
-      "integrity": "sha512-B1qhN3fa1ay0R0wGziXqgwSkB5icpYChNKHhtBHff/0UtSTC7z+l8aTtvMlGjH3E8HEvY3+njIJelM9CAAoVWg==",
+      "version": "0.156.1-darwin-arm64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-darwin-arm64.tgz",
+      "integrity": "sha512-Jg6wbdV+wmMZczhwE74GSxOYEZlViKXn6KyCw/yfrz3PAKFD14xljuPopmdhWC1+8IKU2WdN5fdmXNPt2q4HPA==",
       "cpu": [
         "arm64"
       ],
@@ -351,9 +351,9 @@
     },
     "node_modules/@openai/codex-darwin-x64": {
       "name": "@openai/codex",
-      "version": "0.153.4-darwin-x64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz",
-      "integrity": "sha512-vnSbbPzfoDZmmyzsxswsDDXQ06IVFBzkQU7/hroB3ji93Ok2utcsq8Psfk2tjF5r9mEx8RWFJhzuTGHG26/NDA==",
+      "version": "0.156.1-darwin-x64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-darwin-x64.tgz",
+      "integrity": "sha512-BVjqNOoltWrnNUrgMRepvDIIBmd4XY+ikAE4pYVHlrwiizNlEWQuCQOTrFMJKp54LFRG8jDTjLZyYQ1QrliuOg==",
       "cpu": [
         "x64"
       ],
@@ -368,9 +368,9 @@
     },
     "node_modules/@openai/codex-linux-arm64": {
       "name": "@openai/codex",
-      "version": "0.153.4-linux-arm64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz",
-      "integrity": "sha512-QKdjYLYV4hXIuUQDP3P6F4NXuWFoKo9WUoV4nAREIx55kiUyi8UsYdsVobkeXir5n/maEQgYMCKLHVma4rNPiw==",
+      "version": "0.156.1-linux-arm64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-arm64.tgz",
+      "integrity": "sha512-sTEHk31C12dqzJdjZ2u9KLFCXKL04KyCM+QheSjdQI8uzmVJS7aEF2/qAqFxXwk/jwMzC9u7IihfoIlAGR6YsA==",
       "cpu": [
         "arm64"
       ],
@@ -385,9 +385,9 @@
     },
     "node_modules/@openai/codex-linux-x64": {
       "name": "@openai/codex",
-      "version": "0.153.4-linux-x64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz",
-      "integrity": "sha512-x1EcwBlY3AObM1VTUHNM2AzAJQsyreGdagpF+qFiYi/Oa30VBktvvG0C6tLtCzqW6hjZNWkGZQWmeVk7MuJKWg==",
+      "version": "0.156.1-linux-x64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-x64.tgz",
+      "integrity": "sha512-2ePo0wgOcnONKsuzp8vBjOmNY+IdsKaouaDDIdiKq9HOWNuV/GI22OeXft2A/1GaoL71ictO0/pLAsCEnQ6wew==",
       "cpu": [
         "x64"
       ],
@@ -402,9 +402,9 @@
     },
     "node_modules/@openai/codex-win32-arm64": {
       "name": "@openai/codex",
-      "version": "0.153.4-win32-arm64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz",
-      "integrity": "sha512-/FBh42976ltF1kxDoPQBg1Q6+hwChRU5/sm5dfeC8kFVQMvOCGoGeY5d8rRZGVJE8XojlXo74VQb0sHowcfgBw==",
+      "version": "0.156.1-win32-arm64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-win32-arm64.tgz",
+      "integrity": "sha512-e5DsyOHlKWulTBz/neIczpcYLQDqtaLtBj2lgncOgeQw5mlAQVZHlGvKsoKVcEPUKLb8opIMJBxXi6cz3JJ4hg==",
       "cpu": [
         "arm64"
       ],
@@ -419,9 +419,9 @@
     },
     "node_modules/@openai/codex-win32-x64": {
       "name": "@openai/codex",
-      "version": "0.153.4-win32-x64",
-      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz",
-      "integrity": "sha512-lMkB43kJZH0VFr+hoXc11qqR7QtQIbkr07ALgj4urKL1osNyUyuy1iXd3Vzz2iCYvBUCSw7I0l/W1cEPGx9euQ==",
+      "version": "0.156.1-win32-x64",
+      "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-win32-x64.tgz",
+      "integrity": "sha512-MJyLxbBs2zzp5kbaR/99Zwe7SmbrwUkveTcT+ayYlO48V0nYh0eU+h2lalBwvC7VJ/ya/bXnUtISJfJKhGCD/g==",
       "cpu": [
         "x64"
       ],
@@ -1068,9 +1068,9 @@
       "peer": true
     },
     "node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -1235,9 +1235,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
-      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
+      "version": "4.13.8",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.8.tgz",
+      "integrity": "sha512-/Gng7NfoykZl2pjukW5Z6+8Yxm3BPRf86GTbQnt0SbySkvax4fyL4H3HhY1cCpBGmiW9XDRFzRV+CXK2W8QudQ==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -1290,9 +1290,9 @@
       "peer": true
     },
     "node_modules/ip-address": {
-      "version": "10.7.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz",
-      "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -1702,9 +1702,9 @@
       }
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -1713,6 +1713,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/qs": {
@@ -2174,9 +2178,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.6.5",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
+      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gleapai/kai-bridge",
-  "version": "0.9.1",
-  "description": "Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions, local previews, and photo or video verification.",
+  "version": "0.10.1",
+  "description": "Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions and local previews.",
   "type": "module",
   "license": "MIT",
   "bin": {
@@ -28,16 +28,16 @@
     "postpack": "node scripts/prepare-release.mjs --clean"
   },
   "dependencies": {
-    "@agentclientprotocol/claude-agent-acp": "0.75.1",
-    "@agentclientprotocol/codex-acp": "1.10.0",
-    "@agentclientprotocol/sdk": "1.4.0",
+    "@agentclientprotocol/claude-agent-acp": "0.81.1",
+    "@agentclientprotocol/codex-acp": "1.13.1",
+    "@agentclientprotocol/sdk": "1.5.0",
     "@playwright/mcp": "^0.0.79",
     "@sockudo/client": "^2.0.0",
     "chokidar": "^4.0.1",
     "ws": "^8.21.3",
     "yaml": "^2.9.0",
-    "@openai/codex": "0.153.4",
-    "@anthropic-ai/claude-agent-sdk": "0.3.266"
+    "@openai/codex": "0.156.1",
+    "@anthropic-ai/claude-agent-sdk": "0.3.280"
   },
   "overrides": {
     "@anthropic-ai/claude-agent-sdk": "$@anthropic-ai/claude-agent-sdk"

package/runner/acp-runner.mjs

@@ -28,14 +28,12 @@ import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 
 import {
   KAI_RESOLUTION_ANALYST_AGENT_NAME,
-  KAI_VERIFIER_AGENT_NAME,
   captureRepoBaselines,
   createUsageTracker,
   debugLog,
   emit,
   emitSync,
   isArtifactWriterAgent,
-  isReadOnlyAgent,
   parseRunnerArgs,
   revertRepoMutations,
   setTracePrefix,
@@ -77,10 +75,6 @@ const ENGINE_MODEL = ARGS.engineModel;
 const HARNESS_ID = resolveHarnessId(ARGS.argv.harness, MODEL);
 const HARNESS = getHarness(HARNESS_ID);
 const IS_ARTIFACT_WRITER = isArtifactWriterAgent(AGENT);
-// Read-only agents (the verifier): build-mode tool access minus the file
-// write tools, repos reverted after the turn — see contract.mjs.
-const IS_READ_ONLY = isReadOnlyAgent(AGENT);
-const IS_VERIFIER = AGENT === KAI_VERIFIER_AGENT_NAME;
 
 if (!TASK) {
   emitSync({ type: "error", message: "runner: missing --task-b64 argument" });
@@ -89,7 +83,7 @@ if (!TASK) {
 
 const RUNNER_DIR = dirname(fileURLToPath(import.meta.url));
 const PERSONA_DIR = process.env.KAI_PERSONA_DIR || "/opt/gleap-runners/personas";
-const PERSONA_AGENTS = new Set(["kai-documentarian", "kai-asker", "kai-researcher", KAI_RESOLUTION_ANALYST_AGENT_NAME, KAI_VERIFIER_AGENT_NAME]);
+const PERSONA_AGENTS = new Set(["kai-documentarian", "kai-asker", "kai-researcher", KAI_RESOLUTION_ANALYST_AGENT_NAME]);
 const SCRATCH_DIR = join(tmpdir(), `kai-acp-${process.pid}`);
 mkdirSync(SCRATCH_DIR, { recursive: true });
 // Harness config dir lives OUTSIDE the repo tree and survives across
@@ -132,32 +126,6 @@ const PROMPT_SUGGESTION_WAIT_MS = Math.max(0, Number(process.env.KAI_PROMPT_SUGG
 const PROMPT_SUGGESTIONS_ENABLED = process.env.KAI_PROMPT_SUGGESTIONS !== "0" && PROMPT_SUGGESTION_WAIT_MS > 0;
 const TODO_SERVER_KEY = "kai_todos";
 const TODO_MCP_PATH = process.env.KAI_TODO_MCP_PATH || join(RUNNER_DIR, "tools", "todo-mcp.mjs");
-// Verification report bridge (tools/verify-mcp.mjs) — the verifier's
-// verdict channel. Attached ONLY to kai-verifier turns; the mapper turns
-// its `report_verification` calls into `verify_report` contract events.
-const VERIFY_SERVER_KEY = "kai_verify";
-const VERIFY_MCP_PATH = process.env.KAI_VERIFY_MCP_PATH || join(RUNNER_DIR, "tools", "verify-mcp.mjs");
-/**
- * `KAI_VERIFY_*` — the host's request policy for the verify MCP's
- * `http_request` (read-only flag, allowed origins, the app's auth header,
- * the evidence dir for `requests.jsonl`). Passed EXPLICITLY on the server
- * entry: Codex spawns MCP servers with a scrubbed env, and the values must
- * never ride in the prompt (the auth header is a live credential).
- */
-function verifyMcpEnv() {
-  const out = {};
-  for (const k of Object.keys(process.env).sort()) {
-    if (k.startsWith("KAI_VERIFY_") && k !== "KAI_VERIFY_MCP_PATH" && process.env[k]) out[k] = String(process.env[k]);
-  }
-  return out;
-}
-// The verifier must not write files. Claude's bypassPermissions mode still
-// honours disallowedTools, so the write tools are removed outright (Bash
-// redirections are caught by the post-turn revert).
-const READ_ONLY_DISALLOWED = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-// The verifier tests the app, it never needs the app's secrets: env files
-// and private keys stay unreadable (gitignore-style Read rules).
-const VERIFIER_DISALLOWED = ["Read(**/.env*)", "Read(**/*.pem)"];
 const TODO_NOTE =
   "Track multi-step work as a live todo list with the `todo_write` tool " +
   `from the \`${TODO_SERVER_KEY}\` MCP server: pass the FULL updated list ` +
@@ -311,9 +279,7 @@ function buildAppendSystemPrompt() {
   if (IS_PLAN_MODE) sections.push(NEEDS_ASK_USER_MCP ? GATEWAY_PLAN_GUARD : PLAN_QUESTION_GUARD);
   if (IS_PLAN_MODE) sections.push(PLAN_SCOPE_NOTE);
   if (IS_PLAN_MODE && HARNESS_ID !== "claude") sections.push(READ_ONLY_PLAN_NOTE);
-  // Read-only agents carry their own "never commit" rule in the persona;
-  // the hand-off note ("the host commits your changes") would contradict it.
-  if (!IS_PLAN_MODE && !IS_READ_ONLY) sections.push(GIT_HANDOFF_PROMPT);
+  if (!IS_PLAN_MODE) sections.push(GIT_HANDOFF_PROMPT);
   // After the safety guards (their leading position is load-bearing for
   // cursor's prompt-prefix mode) but before project instructions.
   if (!IS_ARTIFACT_WRITER) sections.push(TODO_NOTE);
@@ -331,9 +297,6 @@ function buildAcpMcpServers() {
   if (!IS_ARTIFACT_WRITER && existsSync(TODO_MCP_PATH)) {
     out.push({ name: TODO_SERVER_KEY, command: process.execPath, args: [TODO_MCP_PATH], env: [] });
   }
-  if (IS_VERIFIER && existsSync(VERIFY_MCP_PATH)) {
-    out.push({ name: VERIFY_SERVER_KEY, command: process.execPath, args: [VERIFY_MCP_PATH], env: Object.entries(verifyMcpEnv()).map(([name, value]) => ({ name, value })) });
-  }
   for (const server of MCP_SERVERS || []) {
     if (!server || typeof server !== "object") continue;
     const name = String(server.name || server.id || "").replace(/[^a-zA-Z0-9_-]/g, "_");
@@ -384,8 +347,6 @@ function buildAgents() {
 
 function buildDisallowedTools() {
   const list = IS_PLAN_MODE || IS_ARTIFACT_WRITER ? [] : [...GIT_HANDOFF_DISALLOWED];
-  if (IS_READ_ONLY) list.push(...READ_ONLY_DISALLOWED);
-  if (IS_VERIFIER) list.push(...VERIFIER_DISALLOWED);
   for (const server of MCP_SERVERS || []) {
     const key = String(server?.name || server?.id || "").replace(/[^a-zA-Z0-9_-]/g, "_");
     for (const tool of [...(server?.disabledTools ?? []), ...(server?.gatedTools ?? [])]) {
@@ -503,14 +464,12 @@ async function main() {
     maxSteps: MAX_STEPS,
     isPlanMode: IS_PLAN_MODE,
     isArtifactWriter: IS_ARTIFACT_WRITER,
-    isReadOnly: IS_READ_ONLY,
     appendSystemPrompt,
     instructionsPath,
     disallowedTools: buildDisallowedTools(),
     allowedTools: buildAllowedTools([
       // The injected todo bridge must survive plan mode's allow-list.
       `mcp__${TODO_SERVER_KEY}`,
-      ...(IS_VERIFIER ? [`mcp__${VERIFY_SERVER_KEY}`] : []),
       ...(MCP_SERVERS || []).map((srv) => `mcp__${String(srv?.name || srv?.id || "").replace(/[^a-zA-Z0-9_-]/g, "_")}`).filter((k) => k !== "mcp__"),
     ]),
     agents: buildAgents(),
@@ -527,9 +486,6 @@ async function main() {
             ...(!IS_ARTIFACT_WRITER && existsSync(TODO_MCP_PATH)
               ? [{ name: TODO_SERVER_KEY, command: process.execPath, args: [TODO_MCP_PATH] }]
               : []),
-            ...(IS_VERIFIER && existsSync(VERIFY_MCP_PATH)
-              ? [{ name: VERIFY_SERVER_KEY, command: process.execPath, args: [VERIFY_MCP_PATH], env: verifyMcpEnv() }]
-              : []),
             ...(MCP_SERVERS || []),
           ]
         : MCP_SERVERS || [],
@@ -618,7 +574,7 @@ async function main() {
     isPlanMode: IS_PLAN_MODE,
     mcpServerIds,
     readPlanFile: readNewestPlan,
-    allowTool: permissionPolicy({ isPlanMode: IS_PLAN_MODE, isArtifactWriter: IS_ARTIFACT_WRITER, isReadOnly: IS_READ_ONLY, workDir: WORK_DIR }),
+    allowTool: permissionPolicy({ isPlanMode: IS_PLAN_MODE, isArtifactWriter: IS_ARTIFACT_WRITER, workDir: WORK_DIR }),
     onTurnShouldEnd: (reason) => {
       cancelRequested = reason;
       if (conn && acpSessionId) conn.cancel({ sessionId: acpSessionId }).catch(() => {});
@@ -686,6 +642,10 @@ async function main() {
     !!SESSION_ID &&
     !!init.agentCapabilities?.sessionCapabilities?.resume &&
     (HARNESS.hasResumableSession ? HARNESS.hasResumableSession(ctx) : true);
+  // What the session's earlier turns already cost (Claude: the total the
+  // transcript saved — a resumed query's cost figure continues from it).
+  // Read before the resume appends this turn's record.
+  const priorTurnsCostUsd = canResume ? Number(HARNESS.priorTurnsCostUsd?.(ctx)) || 0 : 0;
   let sessionResponse;
   let resumed = false;
   if (canResume) {
@@ -749,10 +709,10 @@ async function main() {
     }
   }
 
-  // Artifact writers and read-only agents must leave the repo untouched:
-  // snapshot before, revert anything outside `.kai/` after (belt-and-braces
-  // under the permission rules — shell redirections can still write).
-  const REVERTS_REPO = IS_ARTIFACT_WRITER || IS_READ_ONLY;
+  // Artifact writers must leave the repo untouched: snapshot before, revert
+  // anything outside `.kai/` after (belt-and-braces under the permission
+  // rules — shell redirections can still write).
+  const REVERTS_REPO = IS_ARTIFACT_WRITER;
   const baselines = REVERTS_REPO ? captureRepoBaselines(WORK_DIR) : null;
   // Harnesses without a system-prompt channel (Cursor) get the persona as
   // a prefix of the first prompt.
@@ -821,9 +781,11 @@ async function main() {
     );
   }
   // The adapter's USD is the CLI's own figure — authoritative on the
-  // native Anthropic wire only; gateway turns are priced from tokens.
+  // native Anthropic wire only; gateway turns are priced from tokens. On a
+  // resumed session it is the conversation's running total (Agent SDK
+  // 0.3.280), so only the part above the saved prior total is this turn's.
   if (typeof finished.usage?.costUsd === "number" && HARNESS_ID === "claude" && isNativeAnthropic(MODEL)) {
-    tracker.setProviderCostUsd(finished.usage.costUsd);
+    tracker.setProviderCostUsd(Math.max(0, finished.usage.costUsd - (resumed ? priorTurnsCostUsd : 0)));
   }
 
   const suggestionWaitStarted = Date.now();