deepdebug-local-agent 1.0.18 → 1.0.20

package/src/server.js

@@ -5,7 +5,7 @@ import path from "path";
 import os from "os";
 import fs from "fs";
 const fsPromises = fs.promises;
-import { exec } from "child_process";
+import { exec, spawn } from "child_process";
 import { promisify } from "util";
 import { EventEmitter } from "events";
 import { exists, listRecursive, readFile, writeFile } from "./fs-utils.js";
@@ -24,6 +24,7 @@ import { DTOAnalyzer } from "./analyzers/dto-analyzer.js";
 import { ConfigAnalyzer } from "./analyzers/config-analyzer.js";
 import { WorkspaceManager } from "./workspace-manager.js";
 import { startMCPHttpServer } from "./mcp-http-server.js";
+import { registerVercelRoutes } from "./vercel-proxy.js";
 
 const execAsync = promisify(exec);
 
@@ -545,24 +546,49 @@ const app = express();
 //  FIXED: Support Cloud Run PORT environment variable (GCP uses PORT)
 const PORT = process.env.PORT || process.env.LOCAL_AGENT_PORT || 5055;
 
-//  FIXED: Allow CORS from Cloud Run and local development
+// CORS - Allow from Cloud Run, local dev, and Lovable frontend domains
 app.use(cors({
-    origin: [
-        "http://localhost:3010",
-        "http://localhost:3000",
-        "http://localhost:8085",
-        "http://127.0.0.1:3010",
-        "http://127.0.0.1:3000",
-        "http://127.0.0.1:8085",
-        // Cloud Run URLs (regex patterns)
-        /https:\/\/.*\.run\.app$/,
-        /https:\/\/.*\.web\.app$/,
-        // Production frontend
-        "https://deepdebug.ai",
-        "https://www.deepdebug.ai"
-    ],
+    origin: function(origin, callback) {
+        // Allow requests with no origin (curl, mobile apps, server-to-server)
+        if (!origin) return callback(null, true);
+
+        const allowed = [
+            // Local development
+            "http://localhost:3010",
+            "http://localhost:3000",
+            "http://localhost:8085",
+            "http://127.0.0.1:3010",
+            "http://127.0.0.1:3000",
+            "http://127.0.0.1:8085",
+        ];
+
+        const allowedPatterns = [
+            /https:\/\/.*\.run\.app$/,          // Cloud Run
+            /https:\/\/.*\.web\.app$/,           // Firebase hosting
+            /https:\/\/.*\.lovable\.app$/,       // Lovable preview
+            /https:\/\/.*\.lovableproject\.com$/, // Lovable project domains
+            /https:\/\/.*\.netlify\.app$/,       // Netlify
+            /https:\/\/.*\.vercel\.app$/,        // Vercel
+            /https:\/\/deepdebug\.ai$/,           // Production
+            /https:\/\/.*\.deepdebug\.ai$/,      // Production subdomains
+        ];
+
+        if (allowed.includes(origin) || allowedPatterns.some(p => p.test(origin))) {
+            return callback(null, true);
+        }
+
+        // In development/QA, log and allow unknown origins instead of blocking
+        const env = process.env.NODE_ENV || 'development';
+        if (env !== 'production') {
+            console.warn(`CORS: allowing unknown origin in non-prod: ${origin}`);
+            return callback(null, true);
+        }
+
+        console.warn(`CORS: blocked origin: ${origin}`);
+        return callback(new Error(`CORS: origin ${origin} not allowed`));
+    },
     methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-    allowedHeaders: ["Content-Type", "Authorization", "X-Tenant-ID"],
+    allowedHeaders: ["Content-Type", "Authorization", "X-Tenant-ID", "X-User-ID"],
     credentials: true
 }));
 
@@ -573,7 +599,9 @@ app.use(bodyParser.json({ limit: "50mb" }));
 
 //  DEFAULT WORKSPACE - Define o workspace padro
 // Pode ser sobrescrito via varivel de ambiente ou POST /workspace/open
-const DEFAULT_WORKSPACE = process.env.DEFAULT_WORKSPACE || '/Users/macintosh/IdeaProjects/pure-core-ms';
+const DEFAULT_WORKSPACE = process.env.WORKSPACE_ROOT
+    || process.env.DEFAULT_WORKSPACE
+    || '/Users/macintosh/IdeaProjects/pure-core-ms';
 
 let WORKSPACE_ROOT = fs.existsSync(DEFAULT_WORKSPACE) ? DEFAULT_WORKSPACE : null;
 if (WORKSPACE_ROOT) {
@@ -622,7 +650,19 @@ aiEngine = new AIVibeCodingEngine(processManager, () => WORKSPACE_ROOT);
 // ============================================
 const BACKUPS = new Map();
 const MAX_BACKUPS = 50;
-const BACKUP_INDEX_PATH = path.join(os.tmpdir(), 'deepdebug-backups-index.json');
+// Store backup index on NFS Filestore so it survives container restarts
+// Falls back to /tmp if NFS is not mounted (local dev)
+const NFS_BACKUPS_DIR = process.env.WORKSPACE_MOUNT || '/mnt/workspaces';
+const NFS_BACKUP_INDEX = path.join(NFS_BACKUPS_DIR, '.deepdebug-backups-index.json');
+const BACKUP_INDEX_PATH = (() => {
+    try {
+        if (fs.existsSync(NFS_BACKUPS_DIR)) {
+            return NFS_BACKUP_INDEX;
+        }
+    } catch {}
+    return path.join(os.tmpdir(), 'deepdebug-backups-index.json');
+})();
+console.log(`[BACKUPS] Index path: ${BACKUP_INDEX_PATH}`);
 
 /**
  * Persist backup index to disk so diffs survive server restarts.
@@ -884,11 +924,15 @@ app.post("/workspace/clone", async (req, res) => {
     const tenantId    = body.tenantId;
     const workspaceId = body.workspaceId;
     const gitToken    = body.gitToken;
-    const branch      = body.branch;
+    // Accept gitBranch (onboarding frontend) OR branch (legacy)
+    const branch      = body.branch || body.gitBranch;
+    // Accept gitProvider (onboarding frontend) for auth URL construction
+    const gitProvider = body.gitProvider || (gitUrl && gitUrl.includes('bitbucket') ? 'bitbucket' : gitUrl && gitUrl.includes('gitlab') ? 'gitlab' : 'github');
 
     if (!gitUrl) return res.status(400).json({ ok: false, error: "gitUrl is required" });
 
-    const repoName = gitUrl.split('/').pop().replace('.git', '');
+    // Strip ALL trailing .git suffixes (handles accidental double .git.git from frontend)
+    const repoName = gitUrl.split('/').pop().replace(/\.git$/i, '').replace(/\.git$/i, '');
 
     const NFS_MOUNT = '/mnt/workspaces';
     let absTarget;
@@ -903,17 +947,22 @@ app.post("/workspace/clone", async (req, res) => {
         console.log(`[clone] Using fallback path: ${absTarget}`);
     }
 
-    let authenticatedUrl = gitUrl;
-    if (gitToken && gitUrl.startsWith('https://') && !gitUrl.includes('@')) {
-        if (gitUrl.includes('bitbucket.org')) {
-            authenticatedUrl = gitUrl.replace('https://', `https://x-token-auth:${gitToken}@`);
-        } else if (gitUrl.includes('gitlab.com')) {
-            authenticatedUrl = gitUrl.replace('https://', `https://oauth2:${gitToken}@`);
+    // Clean the gitUrl before using it (strip accidental double .git suffix)
+    const cleanGitUrl = gitUrl.replace(/\.git\.git$/i, '.git');
+
+    let authenticatedUrl = cleanGitUrl;
+    if (gitToken && cleanGitUrl.startsWith('https://') && !cleanGitUrl.includes('@')) {
+        const providerLower = (gitProvider || '').toLowerCase();
+        if (providerLower === 'bitbucket' || cleanGitUrl.includes('bitbucket.org')) {
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://x-token-auth:${gitToken}@`);
+        } else if (providerLower === 'gitlab' || cleanGitUrl.includes('gitlab.com')) {
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://oauth2:${gitToken}@`);
         } else {
-            authenticatedUrl = gitUrl.replace('https://', `https://x-access-token:${gitToken}@`);
+            // github or any other provider
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://x-access-token:${gitToken}@`);
         }
     }
-    console.log(`Clone request: ${gitUrl} -> ${absTarget}`);
+    console.log(`Clone request: ${cleanGitUrl} -> ${absTarget}`);
 
     try {
         // Ensure parent directory exists
@@ -1049,7 +1098,7 @@ app.get("/workspace/file-content", async (req, res) => {
 
 /** Escreve/salva conteudo de arquivo no workspace */
 app.post("/workspace/write-file", async (req, res) => {
-    const workspaceRoot = getEffectiveRoot(req);
+    const workspaceRoot = resolveWorkspaceRoot(req);
     if (!workspaceRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { path: relativePath, content: fileContent } = req.body || {};
@@ -1653,7 +1702,9 @@ app.post("/workspace/write", async (req, res) => {
     const { path: rel, content } = req.body || {};
     if (!rel) return res.status(400).json({ error: "path is required" });
     try {
-        await writeFile(path.join(wsRoot, rel), content ?? "", "utf8");
+        const fullPath = path.join(wsRoot, rel);
+        await fsPromises.mkdir(path.dirname(fullPath), { recursive: true });
+        await writeFile(fullPath, content ?? "", "utf8");
         res.json({ ok: true, path: rel, bytes: Buffer.byteLength(content ?? "", "utf8") });
     } catch (e) {
         res.status(400).json({ error: "write failed", details: String(e) });
@@ -1795,19 +1846,42 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             skipTests: true
         });
 
-        if (compileResult.code !== 0) {
+        // Support both formats:
+        // - new format: { success, code, steps[] } from updated exec-utils.js
+        // - legacy format: { code, stdout, stderr } from older exec-utils.js
+        const isSuccess = compileResult.success !== undefined
+            ? compileResult.success
+            : compileResult.code === 0;
+
+        const errorOutput = compileResult.steps
+            ? compileResult.steps.map(s => s.stderr || '').filter(Boolean).join('\n').trim()
+            : (compileResult.stderr || '');
+
+        const stdoutOutput = compileResult.steps
+            ? compileResult.steps.map(s => s.stdout || '').filter(Boolean).join('\n').trim()
+            : (compileResult.stdout || '');
+
+        const totalDuration = compileResult.steps
+            ? compileResult.steps.reduce((sum, s) => sum + (s.duration || 0), 0)
+            : (compileResult.duration || 0);
+
+        if (!isSuccess) {
             TEST_LOCAL_STATE.status = "error";
+            console.error("[TEST-LOCAL] Compilation failed. stderr:", errorOutput.substring(0, 500));
+            console.error("[TEST-LOCAL] Compilation failed. stdout:", stdoutOutput.substring(0, 500));
+
             TEST_LOCAL_STATE.compilationResult = {
                 success: false,
-                error: compileResult.stderr,
-                duration: compileResult.duration
+                error: errorOutput || 'Compilation failed',
+                duration: totalDuration
             };
 
             return res.json({
                 ok: false,
-                error: compileResult.stderr,
-                stdout: compileResult.stdout,
-                duration: compileResult.duration
+                error: errorOutput || 'Compilation failed',
+                stdout: stdoutOutput,
+                steps: compileResult.steps,
+                duration: totalDuration
             });
         }
 
@@ -1816,7 +1890,7 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             success: true,
             language: meta.language,
             buildTool: meta.buildTool,
-            duration: compileResult.duration
+            duration: totalDuration
         };
 
         console.log("[TEST-LOCAL] Compilation successful");
@@ -1825,8 +1899,8 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             ok: true,
             language: meta.language,
             buildTool: meta.buildTool,
-            duration: compileResult.duration,
-            stdout: compileResult.stdout
+            duration: totalDuration,
+            stdout: stdoutOutput
         });
     } catch (err) {
         console.error("[TEST-LOCAL] Compilation failed:", err.message);
@@ -2347,8 +2421,9 @@ app.post("/workspace/safe-patch", async (req, res) => {
             incidentId: incidentId || null
         });
 
-        // Save backup files to disk for persistence across restarts
-        const backupDir = path.join(os.tmpdir(), 'deepdebug-backups', backupId);
+        // Save backup files to NFS Filestore for persistence across container restarts
+        const backupsBase = fs.existsSync(NFS_BACKUPS_DIR) ? path.join(NFS_BACKUPS_DIR, '.deepdebug-backups') : path.join(os.tmpdir(), 'deepdebug-backups');
+        const backupDir = path.join(backupsBase, backupId);
         try {
             await fsPromises.mkdir(backupDir, { recursive: true });
             for (const file of backupFiles) {
@@ -5375,13 +5450,13 @@ app.post("/workspace/:workspaceId/run", async (req, res) => {
 // Connects Local Agent to Gateway  no public URL needed
 // ============================================
 async function startWebSocketTunnel(port, gatewayUrl, apiKey, tenantId) {
-    if (!gatewayUrl || !apiKey || !tenantId) {
-        console.log('WebSocket tunnel skipped: missing gatewayUrl, apiKey or tenantId in ~/.deepdebug/config.json');
+    if (!gatewayUrl || !tenantId) {
+        console.log('WebSocket tunnel skipped: missing gatewayUrl or tenantId');
         return;
     }
 
     const wsUrl = gatewayUrl.replace(/^https:\/\//, 'wss://').replace(/^http:\/\//, 'ws://');
-    const fullUrl = `${wsUrl}/api/v1/agent/ws?tenantId=${encodeURIComponent(tenantId)}&apiKey=${encodeURIComponent(apiKey)}`;
+    const fullUrl = `${wsUrl}/api/v1/agent/ws?tenantId=${encodeURIComponent(tenantId)}${apiKey ? '&apiKey=' + encodeURIComponent(apiKey) : ''}`;
 
     let reconnectDelay = 2000;
     let isShuttingDown = false;
@@ -5792,6 +5867,449 @@ app.get("/setup/auth-status", async (req, res) => {
     }
 });
 
+// ============================================
+// SPRINT 1  S1-T2: POST /workspace/test-local/run-single
+// Run a single test class (faster than full suite)
+// ============================================
+
+/**
+ * POST /workspace/test-local/run-single
+ *
+ * Runs a single test class by name  much faster than running the full suite.
+ * Used by the agentic loop (tool: run_single_test) to validate a specific fix
+ * without waiting for all tests to complete.
+ *
+ * Body:
+ *   { className: "BookingServiceTest" }
+ *   OR { testFile: "src/test/java/com/example/BookingServiceTest.java" }
+ *
+ * Response:
+ *   { ok, className, passed, failed, skipped, total, duration, output, failures[], exitCode }
+ */
+app.post("/workspace/test-local/run-single", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
+
+    const { className, testFile } = req.body || {};
+
+    // Resolve class name from either param
+    let resolvedClass = className;
+    if (!resolvedClass && testFile) {
+        resolvedClass = path.basename(testFile, '.java');
+    }
+
+    if (!resolvedClass || !resolvedClass.trim()) {
+        return res.status(400).json({
+            ok: false,
+            error: "className or testFile is required. Example: { className: 'BookingServiceTest' }"
+        });
+    }
+
+    resolvedClass = resolvedClass.trim();
+    console.log(`[RUN-SINGLE] Running test class: ${resolvedClass} in ${wsRoot}`);
+
+    const startTime = Date.now();
+
+    try {
+        const meta = await detectProject(wsRoot);
+
+        // Build JAVA_HOME env (same fix as compile endpoint)
+        const javaHome = process.env.JAVA_HOME || "/usr/local/java-home";
+        const mavenEnv = {
+            ...process.env,
+            JAVA_HOME: javaHome,
+            PATH: `${javaHome}/bin:${process.env.PATH}`
+        };
+
+        let result;
+
+        if (meta.buildTool === 'maven') {
+            // Prefer ./mvnw wrapper, pass JAVA_HOME env
+            const hasMvnw = fs.existsSync(path.join(wsRoot, 'mvnw'));
+            const mvnCmd = hasMvnw ? './mvnw' : 'mvn';
+            result = await run(mvnCmd, ['test', `-Dtest=${resolvedClass}`, '-DskipTests=false'], wsRoot, 3 * 60 * 1000, mavenEnv);
+        } else if (meta.buildTool === 'gradle') {
+            const gradleCmd = fs.existsSync(path.join(wsRoot, 'gradlew')) ? './gradlew' : 'gradle';
+            result = await run(gradleCmd, ['test', '--tests', `*.${resolvedClass}`], wsRoot, 3 * 60 * 1000, mavenEnv);
+        } else if (meta.language === 'node') {
+            result = await run('npx', ['jest', resolvedClass, '--no-coverage'], wsRoot);
+        } else {
+            return res.status(400).json({
+                ok: false,
+                error: `Single test not supported for buildTool: ${meta.buildTool}. Use /workspace/test-local/compile instead.`
+            });
+        }
+
+        const duration = Date.now() - startTime;
+        const output = (result.stdout || '') + (result.stderr || '');
+
+        // Parse Maven Surefire / JUnit output
+        const testsRunMatch = output.match(/Tests run: (\d+)/);
+        const failuresMatch = output.match(/Failures: (\d+)/);
+        const errorsMatch   = output.match(/Errors: (\d+)/);
+        const skippedMatch  = output.match(/Skipped: (\d+)/);
+
+        const total    = testsRunMatch ? parseInt(testsRunMatch[1]) : 0;
+        const failures = failuresMatch ? parseInt(failuresMatch[1]) : 0;
+        const errors   = errorsMatch   ? parseInt(errorsMatch[1])   : 0;
+        const skipped  = skippedMatch  ? parseInt(skippedMatch[1])  : 0;
+        const passed   = total - failures - errors - skipped;
+        const success  = result.code === 0 && failures === 0 && errors === 0;
+
+        // Extract failure names from output
+        const failureDetails = [];
+        const failureRegex = /FAILED\s+([^\n]+)/g;
+        let match;
+        while ((match = failureRegex.exec(output)) !== null) {
+            failureDetails.push(match[1].trim());
+        }
+
+        console.log(`[RUN-SINGLE] ${resolvedClass}: ${success ? 'PASSED' : 'FAILED'} ` +
+            `(${duration}ms, ${passed}/${total})`);
+
+        res.json({
+            ok: success,
+            className: resolvedClass,
+            passed,
+            failed: failures + errors,
+            skipped,
+            total,
+            duration,
+            output: output.length > 8000 ? output.substring(0, 8000) + '\n...[truncated]' : output,
+            failures: failureDetails,
+            exitCode: result.code
+        });
+
+    } catch (err) {
+        const duration = Date.now() - startTime;
+        console.error(`[RUN-SINGLE] Failed for ${resolvedClass}:`, err.message);
+        res.status(500).json({
+            ok: false,
+            className: resolvedClass,
+            error: err.message,
+            duration,
+            passed: 0,
+            failed: 1,
+            skipped: 0,
+            total: 0
+        });
+    }
+});
+
+// ============================================
+// SPRINT 1 - S1-T4: Session Isolation via Git Worktree
+// ============================================
+
+/**
+ * POST /workspace/session/create
+ *
+ * Creates an isolated git worktree for a session.
+ * Each session gets its own directory and branch - zero collision between parallel sessions.
+ *
+ * Body: { sessionId, branchName, tenantId }
+ * Response: { ok, sessionId, worktreePath, branchName }
+ */
+app.post("/workspace/session/create", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId, branchName, tenantId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId is required" });
+
+    const safeBranch = (branchName || `session-${sessionId}`).replace(/[^a-zA-Z0-9/_-]/g, "-").toLowerCase();
+    const tenantPart = tenantId || path.basename(path.dirname(wsRoot));
+
+    // Sessions dir: /mnt/workspaces/{tenantId}/sessions/{sessionId}
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+
+    console.log(`[SESSION] Creating worktree: ${worktreePath} (branch: ${safeBranch})`);
+
+    try {
+        await fsPromises.mkdir(sessionsBase, { recursive: true });
+
+        // Remove stale worktree if exists
+        if (fs.existsSync(worktreePath)) {
+            console.log(`[SESSION] Removing stale worktree: ${worktreePath}`);
+            await execAsync(`git worktree remove --force "${worktreePath}"`, { cwd: wsRoot }).catch(() => {});
+            await fsPromises.rm(worktreePath, { recursive: true, force: true }).catch(() => {});
+        }
+
+        // Create new worktree with new branch
+        await execAsync(`git worktree add "${worktreePath}" -b "${safeBranch}"`, { cwd: wsRoot });
+
+        console.log(`[SESSION] Worktree created: ${worktreePath}`);
+        return res.json({
+            ok: true,
+            sessionId,
+            worktreePath,
+            branchName: safeBranch
+        });
+    } catch (err) {
+        console.error(`[SESSION] Failed to create worktree: ${err.message}`);
+        // Fallback: return main workspace path (no isolation but no crash)
+        return res.status(500).json({
+            ok: false,
+            sessionId,
+            worktreePath: wsRoot,
+            branchName: safeBranch,
+            error: err.message,
+            fallback: true
+        });
+    }
+});
+
+/**
+ * DELETE /workspace/session/:sessionId
+ *
+ * Removes a session worktree and its branch.
+ * Called after PR is created or session times out.
+ *
+ * Query: ?tenantId=xxx
+ */
+app.delete("/workspace/session/:sessionId", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId } = req.params;
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+
+    console.log(`[SESSION] Removing worktree: ${worktreePath}`);
+
+    try {
+        if (fs.existsSync(worktreePath)) {
+            await execAsync(`git worktree remove --force "${worktreePath}"`, { cwd: wsRoot }).catch(() => {});
+            await fsPromises.rm(worktreePath, { recursive: true, force: true }).catch(() => {});
+        }
+
+        // Clean up branch
+        const branchName = `session-${sessionId}`;
+        await execAsync(`git branch -D "${branchName}"`, { cwd: wsRoot }).catch(() => {});
+
+        console.log(`[SESSION] Worktree removed: ${worktreePath}`);
+        return res.json({ ok: true, sessionId, removed: worktreePath });
+    } catch (err) {
+        console.error(`[SESSION] Failed to remove worktree: ${err.message}`);
+        return res.status(500).json({ ok: false, sessionId, error: err.message });
+    }
+});
+
+/**
+ * GET /workspace/session/:sessionId/status
+ *
+ * Returns status of a session worktree.
+ */
+app.get("/workspace/session/:sessionId/status", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId } = req.params;
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+    const exists = fs.existsSync(worktreePath);
+
+    return res.json({
+        ok: true,
+        sessionId,
+        worktreePath,
+        exists
+    });
+});
+
+
+// ============================================
+// FASE 5 - ENV MANAGER + PREVIEW TUNNEL
+// State: active vibe environments per sessionId
+// ============================================
+const vibeEnvs = new Map(); // sessionId -> { port, pid, serviceId, tunnelUrl, tunnelPid, worktreePath, status }
+
+function findFreePort(min = 9000, max = 9999) {
+    const used = new Set([...vibeEnvs.values()].map(e => e.port));
+    for (let p = min; p <= max; p++) {
+        if (!used.has(p)) return p;
+    }
+    throw new Error('No free ports available in range 9000-9999');
+}
+
+/**
+ * POST /workspace/vibe/env/start
+ *
+ * Compiles (if needed) and starts the service on a dynamic port.
+ * Body: { sessionId, worktreePath }
+ * Response: { ok, port, serviceId, readyUrl }
+ */
+app.post("/workspace/vibe/env/start", async (req, res) => {
+    const { sessionId, worktreePath } = req.body || {};
+    if (!sessionId || !worktreePath) {
+        return res.status(400).json({ ok: false, error: "sessionId and worktreePath required" });
+    }
+    if (vibeEnvs.has(sessionId)) {
+        const env = vibeEnvs.get(sessionId);
+        return res.json({ ok: true, port: env.port, serviceId: env.serviceId, readyUrl: `http://localhost:${env.port}`, alreadyRunning: true });
+    }
+    try {
+        const port = findFreePort();
+        const serviceId = `vibe-${sessionId}`;
+        const meta = await detectProject(worktreePath);
+        let startConfig;
+        if (meta.language === 'java') {
+            const targetDir = path.join(worktreePath, 'target');
+            let jarPath = null;
+            if (fs.existsSync(targetDir)) {
+                const jars = fs.readdirSync(targetDir).filter(f =>
+                    f.endsWith('.jar') && !f.endsWith('.original') &&
+                    !f.includes('-sources') && !f.includes('-javadoc'));
+                if (jars.length > 0) jarPath = path.join(targetDir, jars[0]);
+            }
+            if (!jarPath) {
+                return res.status(400).json({ ok: false, error: "No JAR found. Run compile_project first." });
+            }
+            const cleanEnv = { ...process.env };
+            Object.keys(cleanEnv).forEach(k => { if (k.startsWith('SPRING_')) delete cleanEnv[k]; });
+            cleanEnv.SERVER_PORT = String(port);
+            cleanEnv.PORT = String(port);
+            startConfig = { command: 'java', args: ['-jar', jarPath, `--server.port=${port}`], cwd: worktreePath, port, env: cleanEnv };
+        } else if (meta.language === 'node' || meta.language === 'javascript') {
+            startConfig = { command: 'node', args: ['index.js'], cwd: worktreePath, port, env: { ...process.env, PORT: String(port) } };
+        } else {
+            return res.status(400).json({ ok: false, error: `Unsupported language: ${meta.language}` });
+        }
+        vibeEnvs.set(sessionId, { port, serviceId, tunnelUrl: null, tunnelPid: null, worktreePath, status: 'starting' });
+        await processManager.start(serviceId, startConfig);
+        vibeEnvs.get(sessionId).status = 'running';
+        console.log(`[VIBE-ENV] Started ${serviceId} on port ${port}`);
+        return res.json({ ok: true, port, serviceId, readyUrl: `http://localhost:${port}` });
+    } catch (err) {
+        console.error(`[VIBE-ENV] Start failed: ${err.message}`);
+        vibeEnvs.delete(sessionId);
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * POST /workspace/vibe/env/stop
+ *
+ * Stops the service and tunnel for a session.
+ * Body: { sessionId }
+ */
+app.post("/workspace/vibe/env/stop", async (req, res) => {
+    const { sessionId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId required" });
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.json({ ok: true, message: "Not running" });
+    try {
+        await processManager.stop(env.serviceId);
+        if (env.tunnelPid) {
+            try { process.kill(env.tunnelPid, 'SIGTERM'); } catch (_) {}
+        }
+        vibeEnvs.delete(sessionId);
+        console.log(`[VIBE-ENV] Stopped ${env.serviceId}`);
+        return res.json({ ok: true });
+    } catch (err) {
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * GET /workspace/vibe/env/status/:sessionId
+ *
+ * Returns current status of a vibe environment.
+ */
+app.get("/workspace/vibe/env/status/:sessionId", async (req, res) => {
+    const { sessionId } = req.params;
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.json({ ok: true, status: 'stopped', sessionId });
+    return res.json({ ok: true, sessionId, status: env.status, port: env.port, serviceId: env.serviceId, tunnelUrl: env.tunnelUrl, readyUrl: `http://localhost:${env.port}` });
+});
+
+/**
+ * POST /workspace/vibe/tunnel/start
+ *
+ * Starts a cloudflared tunnel for a vibe environment.
+ * Body: { sessionId }
+ * Response: { ok, tunnelUrl }
+ *
+ * Downloads cloudflared binary automatically if not present.
+ */
+app.post("/workspace/vibe/tunnel/start", async (req, res) => {
+    const { sessionId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId required" });
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.status(404).json({ ok: false, error: "Environment not running. Call /vibe/env/start first." });
+    if (env.tunnelUrl) return res.json({ ok: true, tunnelUrl: env.tunnelUrl, alreadyRunning: true });
+    try {
+        // Resolve cloudflared binary path
+        const cfDir = path.join(process.env.HOME || '/tmp', '.deepdebug', 'bin');
+        const cfPath = path.join(cfDir, 'cloudflared');
+        // Download if missing
+        if (!fs.existsSync(cfPath)) {
+            fs.mkdirSync(cfDir, { recursive: true });
+            const arch = process.arch === 'arm64' ? 'arm64' : 'amd64';
+            const platform = process.platform === 'darwin' ? 'darwin' : 'linux';
+            const url = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${platform}-${arch}`;
+            console.log(`[VIBE-TUNNEL] Downloading cloudflared from ${url}...`);
+            await execAsync(`curl -fsSL "${url}" -o "${cfPath}" && chmod +x "${cfPath}"`);
+            console.log(`[VIBE-TUNNEL] cloudflared downloaded to ${cfPath}`);
+        }
+        // Start tunnel
+        const tunnelProcess = spawn(cfPath, ['tunnel', '--url', `http://localhost:${env.port}`], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: false
+        });
+        env.tunnelPid = tunnelProcess.pid;
+        env.status = 'tunneling';
+        // Capture tunnel URL from stdout/stderr
+        const tunnelUrl = await new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => reject(new Error('Tunnel URL not found within 30s')), 30000);
+            const handler = (data) => {
+                const text = data.toString();
+                const match = text.match(/https:\/\/[a-zA-Z0-9-]+\.trycloudflare\.com/);
+                if (match) {
+                    clearTimeout(timeout);
+                    tunnelProcess.stdout.off('data', handler);
+                    tunnelProcess.stderr.off('data', handler);
+                    resolve(match[0]);
+                }
+            };
+            tunnelProcess.stdout.on('data', handler);
+            tunnelProcess.stderr.on('data', handler);
+            tunnelProcess.on('error', (err) => { clearTimeout(timeout); reject(err); });
+        });
+        env.tunnelUrl = tunnelUrl;
+        console.log(`[VIBE-TUNNEL] Tunnel started: ${tunnelUrl}`);
+        return res.json({ ok: true, tunnelUrl });
+    } catch (err) {
+        console.error(`[VIBE-TUNNEL] Failed: ${err.message}`);
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * DELETE /workspace/vibe/tunnel/:sessionId
+ *
+ * Stops only the tunnel (keeps service running).
+ */
+app.delete("/workspace/vibe/tunnel/:sessionId", async (req, res) => {
+    const { sessionId } = req.params;
+    const env = vibeEnvs.get(sessionId);
+    if (!env || !env.tunnelPid) return res.json({ ok: true, message: "No tunnel running" });
+    try {
+        process.kill(env.tunnelPid, 'SIGTERM');
+        env.tunnelPid = null;
+        env.tunnelUrl = null;
+        env.status = 'running';
+        return res.json({ ok: true });
+    } catch (err) {
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+// ============================================
+// VERCEL PROXY ROUTES
+// ============================================
+registerVercelRoutes(app);
+
 // ============================================
 // START SERVER