deepdebug-local-agent 1.0.19 → 1.0.21

package/src/server.js

@@ -5,7 +5,7 @@ import path from "path";
 import os from "os";
 import fs from "fs";
 const fsPromises = fs.promises;
-import { exec } from "child_process";
+import { exec, spawn } from "child_process";
 import { promisify } from "util";
 import { EventEmitter } from "events";
 import { exists, listRecursive, readFile, writeFile } from "./fs-utils.js";
@@ -24,6 +24,7 @@ import { DTOAnalyzer } from "./analyzers/dto-analyzer.js";
 import { ConfigAnalyzer } from "./analyzers/config-analyzer.js";
 import { WorkspaceManager } from "./workspace-manager.js";
 import { startMCPHttpServer } from "./mcp-http-server.js";
+import { registerVercelRoutes } from "./vercel-proxy.js";
 
 const execAsync = promisify(exec);
 
@@ -545,24 +546,49 @@ const app = express();
 //  FIXED: Support Cloud Run PORT environment variable (GCP uses PORT)
 const PORT = process.env.PORT || process.env.LOCAL_AGENT_PORT || 5055;
 
-//  FIXED: Allow CORS from Cloud Run and local development
+// CORS - Allow from Cloud Run, local dev, and Lovable frontend domains
 app.use(cors({
-    origin: [
-        "http://localhost:3010",
-        "http://localhost:3000",
-        "http://localhost:8085",
-        "http://127.0.0.1:3010",
-        "http://127.0.0.1:3000",
-        "http://127.0.0.1:8085",
-        // Cloud Run URLs (regex patterns)
-        /https:\/\/.*\.run\.app$/,
-        /https:\/\/.*\.web\.app$/,
-        // Production frontend
-        "https://deepdebug.ai",
-        "https://www.deepdebug.ai"
-    ],
+    origin: function(origin, callback) {
+        // Allow requests with no origin (curl, mobile apps, server-to-server)
+        if (!origin) return callback(null, true);
+
+        const allowed = [
+            // Local development
+            "http://localhost:3010",
+            "http://localhost:3000",
+            "http://localhost:8085",
+            "http://127.0.0.1:3010",
+            "http://127.0.0.1:3000",
+            "http://127.0.0.1:8085",
+        ];
+
+        const allowedPatterns = [
+            /https:\/\/.*\.run\.app$/,          // Cloud Run
+            /https:\/\/.*\.web\.app$/,           // Firebase hosting
+            /https:\/\/.*\.lovable\.app$/,       // Lovable preview
+            /https:\/\/.*\.lovableproject\.com$/, // Lovable project domains
+            /https:\/\/.*\.netlify\.app$/,       // Netlify
+            /https:\/\/.*\.vercel\.app$/,        // Vercel
+            /https:\/\/deepdebug\.ai$/,           // Production
+            /https:\/\/.*\.deepdebug\.ai$/,      // Production subdomains
+        ];
+
+        if (allowed.includes(origin) || allowedPatterns.some(p => p.test(origin))) {
+            return callback(null, true);
+        }
+
+        // In development/QA, log and allow unknown origins instead of blocking
+        const env = process.env.NODE_ENV || 'development';
+        if (env !== 'production') {
+            console.warn(`CORS: allowing unknown origin in non-prod: ${origin}`);
+            return callback(null, true);
+        }
+
+        console.warn(`CORS: blocked origin: ${origin}`);
+        return callback(new Error(`CORS: origin ${origin} not allowed`));
+    },
     methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-    allowedHeaders: ["Content-Type", "Authorization", "X-Tenant-ID"],
+    allowedHeaders: ["Content-Type", "Authorization", "X-Tenant-ID", "X-User-ID"],
     credentials: true
 }));
 
@@ -573,7 +599,9 @@ app.use(bodyParser.json({ limit: "50mb" }));
 
 //  DEFAULT WORKSPACE - Define o workspace padro
 // Pode ser sobrescrito via varivel de ambiente ou POST /workspace/open
-const DEFAULT_WORKSPACE = process.env.DEFAULT_WORKSPACE || '/Users/macintosh/IdeaProjects/pure-core-ms';
+const DEFAULT_WORKSPACE = process.env.WORKSPACE_ROOT
+    || process.env.DEFAULT_WORKSPACE
+    || '/Users/macintosh/IdeaProjects/pure-core-ms';
 
 let WORKSPACE_ROOT = fs.existsSync(DEFAULT_WORKSPACE) ? DEFAULT_WORKSPACE : null;
 if (WORKSPACE_ROOT) {
@@ -622,7 +650,19 @@ aiEngine = new AIVibeCodingEngine(processManager, () => WORKSPACE_ROOT);
 // ============================================
 const BACKUPS = new Map();
 const MAX_BACKUPS = 50;
-const BACKUP_INDEX_PATH = path.join(os.tmpdir(), 'deepdebug-backups-index.json');
+// Store backup index on NFS Filestore so it survives container restarts
+// Falls back to /tmp if NFS is not mounted (local dev)
+const NFS_BACKUPS_DIR = process.env.WORKSPACE_MOUNT || '/mnt/workspaces';
+const NFS_BACKUP_INDEX = path.join(NFS_BACKUPS_DIR, '.deepdebug-backups-index.json');
+const BACKUP_INDEX_PATH = (() => {
+    try {
+        if (fs.existsSync(NFS_BACKUPS_DIR)) {
+            return NFS_BACKUP_INDEX;
+        }
+    } catch {}
+    return path.join(os.tmpdir(), 'deepdebug-backups-index.json');
+})();
+console.log(`[BACKUPS] Index path: ${BACKUP_INDEX_PATH}`);
 
 /**
  * Persist backup index to disk so diffs survive server restarts.
@@ -884,11 +924,15 @@ app.post("/workspace/clone", async (req, res) => {
     const tenantId    = body.tenantId;
     const workspaceId = body.workspaceId;
     const gitToken    = body.gitToken;
-    const branch      = body.branch;
+    // Accept gitBranch (onboarding frontend) OR branch (legacy)
+    const branch      = body.branch || body.gitBranch;
+    // Accept gitProvider (onboarding frontend) for auth URL construction
+    const gitProvider = body.gitProvider || (gitUrl && gitUrl.includes('bitbucket') ? 'bitbucket' : gitUrl && gitUrl.includes('gitlab') ? 'gitlab' : 'github');
 
     if (!gitUrl) return res.status(400).json({ ok: false, error: "gitUrl is required" });
 
-    const repoName = gitUrl.split('/').pop().replace('.git', '');
+    // Strip ALL trailing .git suffixes (handles accidental double .git.git from frontend)
+    const repoName = gitUrl.split('/').pop().replace(/\.git$/i, '').replace(/\.git$/i, '');
 
     const NFS_MOUNT = '/mnt/workspaces';
     let absTarget;
@@ -903,17 +947,22 @@ app.post("/workspace/clone", async (req, res) => {
         console.log(`[clone] Using fallback path: ${absTarget}`);
     }
 
-    let authenticatedUrl = gitUrl;
-    if (gitToken && gitUrl.startsWith('https://') && !gitUrl.includes('@')) {
-        if (gitUrl.includes('bitbucket.org')) {
-            authenticatedUrl = gitUrl.replace('https://', `https://x-token-auth:${gitToken}@`);
-        } else if (gitUrl.includes('gitlab.com')) {
-            authenticatedUrl = gitUrl.replace('https://', `https://oauth2:${gitToken}@`);
+    // Clean the gitUrl before using it (strip accidental double .git suffix)
+    const cleanGitUrl = gitUrl.replace(/\.git\.git$/i, '.git');
+
+    let authenticatedUrl = cleanGitUrl;
+    if (gitToken && cleanGitUrl.startsWith('https://') && !cleanGitUrl.includes('@')) {
+        const providerLower = (gitProvider || '').toLowerCase();
+        if (providerLower === 'bitbucket' || cleanGitUrl.includes('bitbucket.org')) {
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://x-token-auth:${gitToken}@`);
+        } else if (providerLower === 'gitlab' || cleanGitUrl.includes('gitlab.com')) {
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://oauth2:${gitToken}@`);
         } else {
-            authenticatedUrl = gitUrl.replace('https://', `https://x-access-token:${gitToken}@`);
+            // github or any other provider
+            authenticatedUrl = cleanGitUrl.replace('https://', `https://x-access-token:${gitToken}@`);
         }
     }
-    console.log(`Clone request: ${gitUrl} -> ${absTarget}`);
+    console.log(`Clone request: ${cleanGitUrl} -> ${absTarget}`);
 
     try {
         // Ensure parent directory exists
@@ -1047,9 +1096,386 @@ app.get("/workspace/file-content", async (req, res) => {
     }
 });
 
+/**
+ * POST /workspace/build-push
+ * Compress workspace, upload to GCS, submit Cloud Build.
+ * No Docker daemon needed — uses Cloud Build API + GCS.
+ * Body: { workspaceId, imageName, gcpProject, saKeyJson }
+ */
+app.post("/workspace/build-push", async (req, res) => {
+    const { workspaceId, imageName, gcpProject, saKeyJson } = req.body || {};
+    if (!workspaceId || !imageName || !gcpProject || !saKeyJson) {
+        return res.status(400).json({ error: "workspaceId, imageName, gcpProject and saKeyJson required" });
+    }
+
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+
+    const emit = (event, msg) => {
+        const data = typeof msg === "object" ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+        res.write(`event:${event}\ndata:${data}\n\n`);
+    };
+
+    try {
+        const nfsBase = process.env.WORKSPACES_MOUNT || "/mnt/workspaces";
+        const wsPath = path.join(nfsBase, workspaceId);
+
+        if (!fs.existsSync(wsPath)) {
+            emit("error", { error: "Workspace not found: " + wsPath });
+            return res.end();
+        }
+        if (!fs.existsSync(path.join(wsPath, "Dockerfile"))) {
+            emit("error", { error: "No Dockerfile in workspace. Run detect+generate first." });
+            return res.end();
+        }
+
+        // Step 1: Get GCP access token from SA key
+        emit("progress", "Authenticating with GCP...");
+        let accessToken;
+        try {
+            const { createSign } = await import("crypto");
+            const sa = JSON.parse(saKeyJson);
+            const now = Math.floor(Date.now() / 1000);
+            const h = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+            const c = Buffer.from(JSON.stringify({
+                iss: sa.client_email,
+                scope: "https://www.googleapis.com/auth/cloud-platform",
+                aud: "https://oauth2.googleapis.com/token",
+                iat: now, exp: now + 3600
+            })).toString("base64url");
+            const sign = createSign("SHA256");
+            sign.update(`${h}.${c}`);
+            const sig = sign.sign(sa.private_key, "base64url");
+            const jwt = `${h}.${c}.${sig}`;
+
+            const tokenResp = await fetch("https://oauth2.googleapis.com/token", {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=${jwt}`
+            });
+            const tokenData = await tokenResp.json();
+            accessToken = tokenData.access_token;
+            if (!accessToken) throw new Error("No access_token: " + JSON.stringify(tokenData));
+            emit("progress", "GCP authentication successful");
+        } catch (e) {
+            emit("error", { error: "GCP auth failed: " + e.message });
+            return res.end();
+        }
+
+        // Step 2: Compress workspace to tar.gz
+        emit("progress", "Compressing source code...");
+        const { execSync } = await import("child_process");
+        const tarPath = `/tmp/source-${workspaceId}-${Date.now()}.tar.gz`;
+        try {
+            execSync(
+                `tar -czf "${tarPath}" --exclude=".git" --exclude="node_modules" ` +
+                `--exclude="target" --exclude="*.class" --exclude=".gradle" ` +
+                `-C "${wsPath}" . 2>&1`,
+                { stdio: "pipe", timeout: 120000 }
+            );
+            const sizeKB = Math.round(fs.statSync(tarPath).size / 1024);
+            emit("progress", `Source compressed: ${sizeKB}KB`);
+        } catch (e) {
+            emit("error", { error: "Compression failed: " + (e.message || "").substring(0, 200) });
+            return res.end();
+        }
+
+        // Step 3: Upload to GCS
+        const bucketName = `${gcpProject}_cloudbuild`;
+        const objectName = `source/${workspaceId}-${Date.now()}.tar.gz`;
+        emit("progress", `Uploading source to GCS...`);
+        try {
+            // Create bucket (ignore if exists)
+            await fetch(`https://storage.googleapis.com/storage/v1/b?project=${gcpProject}`, {
+                method: "POST",
+                headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
+                body: JSON.stringify({ name: bucketName, location: "US" })
+            });
+
+            const fileBuffer = fs.readFileSync(tarPath);
+            const uploadResp = await fetch(
+                `https://storage.googleapis.com/upload/storage/v1/b/${encodeURIComponent(bucketName)}/o?uploadType=media&name=${encodeURIComponent(objectName)}`,
+                {
+                    method: "POST",
+                    headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/gzip" },
+                    body: fileBuffer
+                }
+            );
+            if (!uploadResp.ok) {
+                const errText = await uploadResp.text();
+                throw new Error(`GCS upload ${uploadResp.status}: ${errText.substring(0, 200)}`);
+            }
+            emit("progress", "Source uploaded to GCS");
+        } catch (e) {
+            emit("error", { error: "GCS upload failed: " + e.message });
+            return res.end();
+        } finally {
+            try { fs.unlinkSync(tarPath); } catch {}
+        }
+
+        // Step 4: Submit Cloud Build
+        emit("progress", "Submitting Cloud Build...");
+        let buildId = "unknown";
+        try {
+            const buildReq = {
+                source: { storageSource: { bucket: bucketName, object: objectName } },
+                steps: [
+                    { name: "gcr.io/cloud-builders/docker", args: ["build", "-t", imageName, "."], id: "build" },
+                    { name: "gcr.io/cloud-builders/docker", args: ["push", imageName], id: "push", waitFor: ["build"] }
+                ],
+                images: [imageName],
+                timeout: "1200s"
+            };
+
+            const buildResp = await fetch(
+                `https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds`,
+                {
+                    method: "POST",
+                    headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
+                    body: JSON.stringify(buildReq)
+                }
+            );
+            if (!buildResp.ok) {
+                const errText = await buildResp.text();
+                throw new Error(`Cloud Build ${buildResp.status}: ${errText.substring(0, 300)}`);
+            }
+            const buildData = await buildResp.json();
+            buildId = buildData.metadata?.build?.id || buildData.name?.split("/").pop() || "unknown";
+            emit("progress", `Cloud Build started: ${buildId}`);
+        } catch (e) {
+            emit("error", { error: "Cloud Build submit failed: " + e.message });
+            return res.end();
+        }
+
+        // Step 5: Poll build status
+        emit("progress", "Building Docker image (3-5 minutes)...");
+        let status = "WORKING";
+        let attempts = 0;
+        while (!["SUCCESS", "FAILURE", "CANCELLED", "TIMEOUT"].includes(status) && attempts < 40) {
+            await new Promise(r => setTimeout(r, 15000));
+            attempts++;
+            try {
+                const statusResp = await fetch(
+                    `https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds/${buildId}`,
+                    { headers: { "Authorization": `Bearer ${accessToken}` } }
+                );
+                const statusData = await statusResp.json();
+                status = statusData.status || "WORKING";
+                emit("progress", `Build status: ${status} (${attempts}/40)`);
+            } catch (e) {
+                emit("progress", `Status check error: ${e.message}`);
+            }
+        }
+
+        if (status === "SUCCESS") {
+            emit("progress", "Docker image built and pushed successfully!");
+            emit("complete", { success: true, imageName, buildId });
+        } else {
+            emit("error", { error: `Cloud Build ${status}. Check GCP Console.` });
+        }
+        res.end();
+
+    } catch (err) {
+        console.error("[build-push] Fatal:", err.message);
+        emit("error", { error: err.message });
+        res.end();
+    }
+});
+
+/**
+ * POST /workspace/setup
+ * AI Cloud Engineering Agent - autonomous setup:
+ * 1. Clone repo  2. Detect stack  3. Generate Dockerfile  4. Register workspace
+ * Returns SSE stream with real-time progress.
+ */
+app.post("/workspace/setup", async (req, res) => {
+    const { workspaceId, repoUrl, gitToken, provider = "deepdebug_cloud",
+            cloudProjectId, cloudToken } = req.body || {};
+
+    if (!workspaceId || !repoUrl) {
+        return res.status(400).json({ error: "workspaceId and repoUrl required" });
+    }
+
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+
+    const emit = (event, msg) => {
+        const data = typeof msg === "object" ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+        res.write(`event:${event}\ndata:${data}\n\n`);
+    };
+
+    try {
+        // Use /mnt/workspaces as base (not WORKSPACE_ROOT which is a specific workspace)
+        const nfsBase = process.env.WORKSPACES_MOUNT || "/mnt/workspaces";
+        const wsPath = path.join(nfsBase, workspaceId);
+
+        emit("progress", `Starting setup for workspace: ${workspaceId}`);
+        emit("progress", `Workspace path: ${wsPath}`);
+
+        // STEP 1 - Clone
+        emit("progress", "Cloning repository...");
+        let authUrl = repoUrl;
+        if (gitToken && gitToken.length > 5) {
+            // Build authenticated URL
+            try {
+                const urlObj = new URL(repoUrl);
+                urlObj.username = "x-access-token";
+                urlObj.password = gitToken;
+                authUrl = urlObj.toString();
+                emit("progress", `Using authenticated clone for ${urlObj.hostname}`);
+            } catch {
+                authUrl = repoUrl.replace("https://", `https://x-access-token:${gitToken}@`);
+            }
+        }
+
+        const { execSync } = await import("child_process");
+        const cloneEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0", HOME: process.env.HOME || "/tmp" };
+        const execOpts = { stdio: "pipe", timeout: 300000, encoding: "utf8", env: cloneEnv };
+        let cloneBranch = "main";
+
+        // Configure safe directory
+        try { execSync(`git config --global --add safe.directory "${wsPath}"`, execOpts); } catch {}
+
+        if (fs.existsSync(path.join(wsPath, ".git"))) {
+            emit("progress", "Workspace exists, updating...");
+            try {
+                if (gitToken && gitToken.length > 5) {
+                    execSync(`git remote set-url origin "${authUrl}"`, { ...execOpts, cwd: wsPath });
+                }
+                execSync("git fetch origin", { ...execOpts, cwd: wsPath });
+                cloneBranch = execSync("git branch --show-current", { ...execOpts, cwd: wsPath }).trim() || "main";
+                execSync(`git reset --hard origin/${cloneBranch}`, { ...execOpts, cwd: wsPath });
+            } catch (e) {
+                const safeMsg = gitToken ? e.message.replace(gitToken, "***") : e.message;
+                emit("progress", `Update failed (${safeMsg.substring(0, 100)}), re-cloning...`);
+                fs.rmSync(wsPath, { recursive: true, force: true });
+            }
+        }
+
+        if (!fs.existsSync(path.join(wsPath, ".git"))) {
+            // Remove existing empty dir before clone (git clone needs non-existent or empty target)
+            if (fs.existsSync(wsPath)) {
+                const contents = fs.readdirSync(wsPath);
+                if (contents.length === 0) fs.rmSync(wsPath, { recursive: true });
+            }
+
+            for (const b of ["main", "master", "develop"]) {
+                try {
+                    emit("progress", `Trying branch: ${b}...`);
+                    execSync(`git clone --depth=1 --branch ${b} "${authUrl}" "${wsPath}"`, execOpts);
+                    cloneBranch = b;
+                    emit("progress", `Cloned on branch: ${b}`);
+                    break;
+                } catch (e) {
+                    const stderr = (e.stderr || e.stdout || e.message || "").toString();
+                    const safeMsg = gitToken ? stderr.replace(new RegExp(gitToken, 'g'), "***") : stderr;
+                    console.warn(`[Clone] Branch ${b} failed: ${safeMsg.substring(0, 500)}`);
+                    emit("progress", `Branch ${b} failed: ${safeMsg.substring(0, 200)}`);
+                    // Clean up partial clone
+                    if (fs.existsSync(wsPath)) fs.rmSync(wsPath, { recursive: true, force: true });
+                }
+            }
+
+            // Fallback: clone without specifying branch
+            if (!fs.existsSync(path.join(wsPath, ".git"))) {
+                try {
+                    emit("progress", "Trying default branch...");
+                    execSync(`git clone --depth=1 "${authUrl}" "${wsPath}" 2>&1`, execOpts);
+                    cloneBranch = execSync("git branch --show-current", { ...execOpts, cwd: wsPath }).trim() || "main";
+                    emit("progress", `Cloned on default branch: ${cloneBranch}`);
+                } catch (e) {
+                    const stderr = (e.stderr || e.stdout || e.message || "").toString();
+                    const safeMsg = gitToken ? stderr.replace(new RegExp(gitToken, 'g'), "***") : stderr;
+                    console.error(`[Clone] Default branch failed: ${safeMsg.substring(0, 500)}`);
+                    emit("progress", `Default branch failed: ${safeMsg.substring(0, 200)}`);
+                    if (fs.existsSync(wsPath)) fs.rmSync(wsPath, { recursive: true, force: true });
+                }
+            }
+        }
+
+        if (!fs.existsSync(path.join(wsPath, ".git"))) {
+            emit("error", { error: "Clone failed for all branches. Check repo URL and permissions." });
+            return res.end();
+        }
+        emit("progress", `Repository cloned on branch: ${cloneBranch}`);
+
+        // STEP 2 - Detect stack
+        emit("progress", "AI analysing project structure...");
+        const meta = await detectProject(wsPath);
+        emit("progress", `Stack: ${meta.language} / ${meta.buildTool} / ${meta.framework || "unknown"}`);
+
+        // STEP 3 - Generate Dockerfile if missing
+        const dockerfilePath = path.join(wsPath, "Dockerfile");
+        if (!fs.existsSync(dockerfilePath)) {
+            emit("progress", `Generating Dockerfile for ${meta.language}...`);
+            const content = generateDockerfileContent(meta.language, meta.buildTool);
+            fs.writeFileSync(dockerfilePath, content, "utf8");
+            emit("progress", "Dockerfile generated");
+        } else {
+            emit("progress", "Dockerfile already exists");
+        }
+
+        // STEP 4 - Register
+        emit("progress", `Provider: ${provider}. Workspace ready.`);
+
+        emit("progress", "AI Cloud Engineering setup complete!");
+        emit("complete", {
+            success: true, workspaceId, wsPath, provider, branch: cloneBranch,
+            stack: { language: meta.language, buildTool: meta.buildTool, framework: meta.framework },
+            message: "Setup complete. Monitoring is now active."
+        });
+        res.end();
+
+    } catch (err) {
+        console.error("[Setup] Error:", err.message);
+        emit("error", { error: err.message });
+        res.end();
+    }
+});
+
+function generateDockerfileContent(language, buildTool) {
+    if (language === "java" && (buildTool === "maven" || buildTool === "mvn"))
+        return `FROM maven:3.9-eclipse-temurin-17 AS build\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/target/*.jar app.jar\nEXPOSE 8080\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+    if (language === "java")
+        return `FROM gradle:8-jdk17 AS build\nWORKDIR /app\nCOPY . .\nRUN gradle build -x test\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/build/libs/*.jar app.jar\nEXPOSE 8080\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+    if (language === "node" || language === "javascript" || language === "typescript")
+        return `FROM node:20-alpine\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\nCOPY . .\nEXPOSE 8080\nENV PORT=8080\nCMD ["node", "src/index.js"]\n`;
+    if (language === "python")
+        return `FROM python:3.11-slim\nWORKDIR /app\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\nCOPY . .\nEXPOSE 8080\nCMD ["python", "app.py"]\n`;
+    if (language === "go")
+        return `FROM golang:1.21-alpine AS build\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 go build -o main .\nFROM alpine:3.18\nCOPY --from=build /app/main /app/main\nEXPOSE 8080\nCMD ["/app/main"]\n`;
+    return `FROM ubuntu:22.04\nWORKDIR /app\nCOPY . .\nEXPOSE 8080\nCMD ["./start.sh"]\n`;
+}
+
+/** Detect project stack from files (pom.xml, package.json, etc.) */
+app.post("/workspace/detect", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+    try {
+        const meta = await detectProject(wsRoot);
+        const fs = await import("fs");
+        const path = await import("path");
+        res.json({
+            ok: true,
+            language: meta.language || "unknown",
+            buildTool: meta.buildTool || "unknown",
+            framework: meta.framework || "unknown",
+            hasDockerfile: fs.existsSync(path.join(wsRoot, "Dockerfile")),
+            path: wsRoot
+        });
+    } catch (e) {
+        res.json({ ok: false, language: "unknown", buildTool: "unknown",
+            framework: "unknown", error: e.message });
+    }
+});
+
 /** Escreve/salva conteudo de arquivo no workspace */
 app.post("/workspace/write-file", async (req, res) => {
-    const workspaceRoot = getEffectiveRoot(req);
+    const workspaceRoot = resolveWorkspaceRoot(req);
     if (!workspaceRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { path: relativePath, content: fileContent } = req.body || {};
@@ -1653,7 +2079,9 @@ app.post("/workspace/write", async (req, res) => {
     const { path: rel, content } = req.body || {};
     if (!rel) return res.status(400).json({ error: "path is required" });
     try {
-        await writeFile(path.join(wsRoot, rel), content ?? "", "utf8");
+        const fullPath = path.join(wsRoot, rel);
+        await fsPromises.mkdir(path.dirname(fullPath), { recursive: true });
+        await writeFile(fullPath, content ?? "", "utf8");
         res.json({ ok: true, path: rel, bytes: Buffer.byteLength(content ?? "", "utf8") });
     } catch (e) {
         res.status(400).json({ error: "write failed", details: String(e) });
@@ -1775,6 +2203,85 @@ app.get("/workspace/test-local/state", async (req, res) => {
     });
 });
 
+/**
+ * POST /workspace/git/prepare
+ * Prepares a clean workspace for a new fix:
+ * 1. Detects main branch (main, master, develop)
+ * 2. git fetch origin
+ * 3. git checkout main branch
+ * 4. git reset --hard origin/main branch
+ */
+app.post("/workspace/git/prepare", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
+        return res.status(400).json({ ok: false, error: "workspace not set" });
+    }
+
+    const { gitToken, repoUrl } = req.body || {};
+    console.log("[git-prepare] Starting workspace preparation...");
+
+    try {
+        const { execSync } = await import("child_process");
+        const execGit = (cmd) => {
+            try {
+                return { ok: true, output: execSync(cmd, {
+                    cwd: wsRoot, encoding: "utf8", timeout: 60000,
+                    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+                }).trim() };
+            } catch (err) {
+                return { ok: false, output: (err.stderr || err.stdout || err.message || "unknown").toString().trim() };
+            }
+        };
+
+        execGit(`git config --global --add safe.directory "${wsRoot}"`);
+
+        if (gitToken && repoUrl) {
+            const urlWithToken = repoUrl.replace("https://", `https://x-access-token:${gitToken}@`);
+            execGit(`git remote set-url origin "${urlWithToken}"`);
+        }
+
+        console.log("[git-prepare] Fetching origin...");
+        execGit("git fetch origin --prune");
+
+        let mainBranch = null;
+        for (const branch of ["main", "master", "develop", "dev"]) {
+            if (execGit(`git rev-parse --verify origin/${branch}`).ok) {
+                mainBranch = branch;
+                break;
+            }
+        }
+        if (!mainBranch) {
+            const cur = execGit("git rev-parse --abbrev-ref HEAD");
+            mainBranch = cur.ok ? cur.output : "main";
+        }
+
+        const prevBranch = (execGit("git rev-parse --abbrev-ref HEAD").output || "unknown");
+        const prevCommit = (execGit("git rev-parse --short HEAD").output || "unknown");
+
+        console.log(`[git-prepare] ${prevBranch}@${prevCommit} -> ${mainBranch}`);
+
+        let checkout = execGit(`git checkout ${mainBranch}`);
+        if (!checkout.ok) checkout = execGit(`git checkout -f ${mainBranch}`);
+        if (!checkout.ok) {
+            return res.json({ ok: false, error: `Could not checkout ${mainBranch}: ${checkout.output}`,
+                mainBranch, previousBranch: prevBranch, previousCommit: prevCommit });
+        }
+
+        execGit(`git reset --hard origin/${mainBranch}`);
+        execGit('git clean -fd --exclude="*.env" --exclude=".env*"');
+
+        const newCommit = (execGit("git rev-parse --short HEAD").output || "unknown");
+        console.log(`[git-prepare] Ready: ${mainBranch}@${newCommit}`);
+
+        res.json({ ok: true, mainBranch, currentCommit: newCommit,
+            previousBranch: prevBranch, previousCommit: prevCommit,
+            message: `Workspace prepared: on ${mainBranch} at ${newCommit}` });
+    } catch (err) {
+        console.error("[git-prepare] Error:", err.message);
+        res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
 /**
  * POST /workspace/test-local/compile
  * Compiles the project without starting server
@@ -1795,23 +2302,29 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             skipTests: true
         });
 
-        if (!compileResult.success) {
-            TEST_LOCAL_STATE.status = "error";
+        // Support both formats:
+        // - new format: { success, code, steps[] } from updated exec-utils.js
+        // - legacy format: { code, stdout, stderr } from older exec-utils.js
+        const isSuccess = compileResult.success !== undefined
+            ? compileResult.success
+            : compileResult.code === 0;
 
-            const errorOutput = (compileResult.steps || [])
-                .map(s => s.stderr || '')
-                .filter(Boolean)
-                .join('\n')
-                .trim();
+        const errorOutput = compileResult.steps
+            ? compileResult.steps.map(s => s.stderr || '').filter(Boolean).join('\n').trim()
+            : (compileResult.stderr || '');
 
-            const stdoutOutput = (compileResult.steps || [])
-                .map(s => s.stdout || '')
-                .filter(Boolean)
-                .join('\n')
-                .trim();
+        const stdoutOutput = compileResult.steps
+            ? compileResult.steps.map(s => s.stdout || '').filter(Boolean).join('\n').trim()
+            : (compileResult.stdout || '');
 
-            const totalDuration = (compileResult.steps || [])
-                .reduce((sum, s) => sum + (s.duration || 0), 0);
+        const totalDuration = compileResult.steps
+            ? compileResult.steps.reduce((sum, s) => sum + (s.duration || 0), 0)
+            : (compileResult.duration || 0);
+
+        if (!isSuccess) {
+            TEST_LOCAL_STATE.status = "error";
+            console.error("[TEST-LOCAL] Compilation failed. stderr:", errorOutput.substring(0, 500));
+            console.error("[TEST-LOCAL] Compilation failed. stdout:", stdoutOutput.substring(0, 500));
 
             TEST_LOCAL_STATE.compilationResult = {
                 success: false,
@@ -1828,9 +2341,6 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             });
         }
 
-        const totalDuration = (compileResult.steps || [])
-            .reduce((sum, s) => sum + (s.duration || 0), 0);
-
         TEST_LOCAL_STATE.status = "compiled";
         TEST_LOCAL_STATE.compilationResult = {
             success: true,
@@ -1846,7 +2356,7 @@ app.post("/workspace/test-local/compile", async (req, res) => {
             language: meta.language,
             buildTool: meta.buildTool,
             duration: totalDuration,
-            stdout: (compileResult.steps || []).map(s => s.stdout || '').filter(Boolean).join('\n').trim()
+            stdout: stdoutOutput
         });
     } catch (err) {
         console.error("[TEST-LOCAL] Compilation failed:", err.message);
@@ -2367,8 +2877,9 @@ app.post("/workspace/safe-patch", async (req, res) => {
             incidentId: incidentId || null
         });
 
-        // Save backup files to disk for persistence across restarts
-        const backupDir = path.join(os.tmpdir(), 'deepdebug-backups', backupId);
+        // Save backup files to NFS Filestore for persistence across container restarts
+        const backupsBase = fs.existsSync(NFS_BACKUPS_DIR) ? path.join(NFS_BACKUPS_DIR, '.deepdebug-backups') : path.join(os.tmpdir(), 'deepdebug-backups');
+        const backupDir = path.join(backupsBase, backupId);
         try {
             await fsPromises.mkdir(backupDir, { recursive: true });
             for (const file of backupFiles) {
@@ -5858,14 +6369,24 @@ app.post("/workspace/test-local/run-single", async (req, res) => {
     try {
         const meta = await detectProject(wsRoot);
 
+        // Build JAVA_HOME env (same fix as compile endpoint)
+        const javaHome = process.env.JAVA_HOME || "/usr/local/java-home";
+        const mavenEnv = {
+            ...process.env,
+            JAVA_HOME: javaHome,
+            PATH: `${javaHome}/bin:${process.env.PATH}`
+        };
+
         let result;
 
         if (meta.buildTool === 'maven') {
-            // mvn test -Dtest=ClassName -q (sem clean para ser mais rapido)
-            result = await run('mvn', ['test', `-Dtest=${resolvedClass}`, '-q'], wsRoot);
+            // Prefer ./mvnw wrapper, pass JAVA_HOME env
+            const hasMvnw = fs.existsSync(path.join(wsRoot, 'mvnw'));
+            const mvnCmd = hasMvnw ? './mvnw' : 'mvn';
+            result = await run(mvnCmd, ['test', `-Dtest=${resolvedClass}`, '-DskipTests=false'], wsRoot, 3 * 60 * 1000, mavenEnv);
         } else if (meta.buildTool === 'gradle') {
             const gradleCmd = fs.existsSync(path.join(wsRoot, 'gradlew')) ? './gradlew' : 'gradle';
-            result = await run(gradleCmd, ['test', '--tests', `*.${resolvedClass}`], wsRoot);
+            result = await run(gradleCmd, ['test', '--tests', `*.${resolvedClass}`], wsRoot, 3 * 60 * 1000, mavenEnv);
         } else if (meta.language === 'node') {
             result = await run('npx', ['jest', resolvedClass, '--no-coverage'], wsRoot);
         } else {
@@ -5931,6 +6452,320 @@ app.post("/workspace/test-local/run-single", async (req, res) => {
     }
 });
 
+// ============================================
+// SPRINT 1 - S1-T4: Session Isolation via Git Worktree
+// ============================================
+
+/**
+ * POST /workspace/session/create
+ *
+ * Creates an isolated git worktree for a session.
+ * Each session gets its own directory and branch - zero collision between parallel sessions.
+ *
+ * Body: { sessionId, branchName, tenantId }
+ * Response: { ok, sessionId, worktreePath, branchName }
+ */
+app.post("/workspace/session/create", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId, branchName, tenantId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId is required" });
+
+    const safeBranch = (branchName || `session-${sessionId}`).replace(/[^a-zA-Z0-9/_-]/g, "-").toLowerCase();
+    const tenantPart = tenantId || path.basename(path.dirname(wsRoot));
+
+    // Sessions dir: /mnt/workspaces/{tenantId}/sessions/{sessionId}
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+
+    console.log(`[SESSION] Creating worktree: ${worktreePath} (branch: ${safeBranch})`);
+
+    try {
+        await fsPromises.mkdir(sessionsBase, { recursive: true });
+
+        // Remove stale worktree if exists
+        if (fs.existsSync(worktreePath)) {
+            console.log(`[SESSION] Removing stale worktree: ${worktreePath}`);
+            await execAsync(`git worktree remove --force "${worktreePath}"`, { cwd: wsRoot }).catch(() => {});
+            await fsPromises.rm(worktreePath, { recursive: true, force: true }).catch(() => {});
+        }
+
+        // Create new worktree with new branch
+        await execAsync(`git worktree add "${worktreePath}" -b "${safeBranch}"`, { cwd: wsRoot });
+
+        console.log(`[SESSION] Worktree created: ${worktreePath}`);
+        return res.json({
+            ok: true,
+            sessionId,
+            worktreePath,
+            branchName: safeBranch
+        });
+    } catch (err) {
+        console.error(`[SESSION] Failed to create worktree: ${err.message}`);
+        // Fallback: return main workspace path (no isolation but no crash)
+        return res.status(500).json({
+            ok: false,
+            sessionId,
+            worktreePath: wsRoot,
+            branchName: safeBranch,
+            error: err.message,
+            fallback: true
+        });
+    }
+});
+
+/**
+ * DELETE /workspace/session/:sessionId
+ *
+ * Removes a session worktree and its branch.
+ * Called after PR is created or session times out.
+ *
+ * Query: ?tenantId=xxx
+ */
+app.delete("/workspace/session/:sessionId", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId } = req.params;
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+
+    console.log(`[SESSION] Removing worktree: ${worktreePath}`);
+
+    try {
+        if (fs.existsSync(worktreePath)) {
+            await execAsync(`git worktree remove --force "${worktreePath}"`, { cwd: wsRoot }).catch(() => {});
+            await fsPromises.rm(worktreePath, { recursive: true, force: true }).catch(() => {});
+        }
+
+        // Clean up branch
+        const branchName = `session-${sessionId}`;
+        await execAsync(`git branch -D "${branchName}"`, { cwd: wsRoot }).catch(() => {});
+
+        console.log(`[SESSION] Worktree removed: ${worktreePath}`);
+        return res.json({ ok: true, sessionId, removed: worktreePath });
+    } catch (err) {
+        console.error(`[SESSION] Failed to remove worktree: ${err.message}`);
+        return res.status(500).json({ ok: false, sessionId, error: err.message });
+    }
+});
+
+/**
+ * GET /workspace/session/:sessionId/status
+ *
+ * Returns status of a session worktree.
+ */
+app.get("/workspace/session/:sessionId/status", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+
+    const { sessionId } = req.params;
+    const sessionsBase = path.join(path.dirname(wsRoot), "sessions");
+    const worktreePath = path.join(sessionsBase, sessionId);
+    const exists = fs.existsSync(worktreePath);
+
+    return res.json({
+        ok: true,
+        sessionId,
+        worktreePath,
+        exists
+    });
+});
+
+
+// ============================================
+// FASE 5 - ENV MANAGER + PREVIEW TUNNEL
+// State: active vibe environments per sessionId
+// ============================================
+const vibeEnvs = new Map(); // sessionId -> { port, pid, serviceId, tunnelUrl, tunnelPid, worktreePath, status }
+
+function findFreePort(min = 9000, max = 9999) {
+    const used = new Set([...vibeEnvs.values()].map(e => e.port));
+    for (let p = min; p <= max; p++) {
+        if (!used.has(p)) return p;
+    }
+    throw new Error('No free ports available in range 9000-9999');
+}
+
+/**
+ * POST /workspace/vibe/env/start
+ *
+ * Compiles (if needed) and starts the service on a dynamic port.
+ * Body: { sessionId, worktreePath }
+ * Response: { ok, port, serviceId, readyUrl }
+ */
+app.post("/workspace/vibe/env/start", async (req, res) => {
+    const { sessionId, worktreePath } = req.body || {};
+    if (!sessionId || !worktreePath) {
+        return res.status(400).json({ ok: false, error: "sessionId and worktreePath required" });
+    }
+    if (vibeEnvs.has(sessionId)) {
+        const env = vibeEnvs.get(sessionId);
+        return res.json({ ok: true, port: env.port, serviceId: env.serviceId, readyUrl: `http://localhost:${env.port}`, alreadyRunning: true });
+    }
+    try {
+        const port = findFreePort();
+        const serviceId = `vibe-${sessionId}`;
+        const meta = await detectProject(worktreePath);
+        let startConfig;
+        if (meta.language === 'java') {
+            const targetDir = path.join(worktreePath, 'target');
+            let jarPath = null;
+            if (fs.existsSync(targetDir)) {
+                const jars = fs.readdirSync(targetDir).filter(f =>
+                    f.endsWith('.jar') && !f.endsWith('.original') &&
+                    !f.includes('-sources') && !f.includes('-javadoc'));
+                if (jars.length > 0) jarPath = path.join(targetDir, jars[0]);
+            }
+            if (!jarPath) {
+                return res.status(400).json({ ok: false, error: "No JAR found. Run compile_project first." });
+            }
+            const cleanEnv = { ...process.env };
+            Object.keys(cleanEnv).forEach(k => { if (k.startsWith('SPRING_')) delete cleanEnv[k]; });
+            cleanEnv.SERVER_PORT = String(port);
+            cleanEnv.PORT = String(port);
+            startConfig = { command: 'java', args: ['-jar', jarPath, `--server.port=${port}`], cwd: worktreePath, port, env: cleanEnv };
+        } else if (meta.language === 'node' || meta.language === 'javascript') {
+            startConfig = { command: 'node', args: ['index.js'], cwd: worktreePath, port, env: { ...process.env, PORT: String(port) } };
+        } else {
+            return res.status(400).json({ ok: false, error: `Unsupported language: ${meta.language}` });
+        }
+        vibeEnvs.set(sessionId, { port, serviceId, tunnelUrl: null, tunnelPid: null, worktreePath, status: 'starting' });
+        await processManager.start(serviceId, startConfig);
+        vibeEnvs.get(sessionId).status = 'running';
+        console.log(`[VIBE-ENV] Started ${serviceId} on port ${port}`);
+        return res.json({ ok: true, port, serviceId, readyUrl: `http://localhost:${port}` });
+    } catch (err) {
+        console.error(`[VIBE-ENV] Start failed: ${err.message}`);
+        vibeEnvs.delete(sessionId);
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * POST /workspace/vibe/env/stop
+ *
+ * Stops the service and tunnel for a session.
+ * Body: { sessionId }
+ */
+app.post("/workspace/vibe/env/stop", async (req, res) => {
+    const { sessionId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId required" });
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.json({ ok: true, message: "Not running" });
+    try {
+        await processManager.stop(env.serviceId);
+        if (env.tunnelPid) {
+            try { process.kill(env.tunnelPid, 'SIGTERM'); } catch (_) {}
+        }
+        vibeEnvs.delete(sessionId);
+        console.log(`[VIBE-ENV] Stopped ${env.serviceId}`);
+        return res.json({ ok: true });
+    } catch (err) {
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * GET /workspace/vibe/env/status/:sessionId
+ *
+ * Returns current status of a vibe environment.
+ */
+app.get("/workspace/vibe/env/status/:sessionId", async (req, res) => {
+    const { sessionId } = req.params;
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.json({ ok: true, status: 'stopped', sessionId });
+    return res.json({ ok: true, sessionId, status: env.status, port: env.port, serviceId: env.serviceId, tunnelUrl: env.tunnelUrl, readyUrl: `http://localhost:${env.port}` });
+});
+
+/**
+ * POST /workspace/vibe/tunnel/start
+ *
+ * Starts a cloudflared tunnel for a vibe environment.
+ * Body: { sessionId }
+ * Response: { ok, tunnelUrl }
+ *
+ * Downloads cloudflared binary automatically if not present.
+ */
+app.post("/workspace/vibe/tunnel/start", async (req, res) => {
+    const { sessionId } = req.body || {};
+    if (!sessionId) return res.status(400).json({ ok: false, error: "sessionId required" });
+    const env = vibeEnvs.get(sessionId);
+    if (!env) return res.status(404).json({ ok: false, error: "Environment not running. Call /vibe/env/start first." });
+    if (env.tunnelUrl) return res.json({ ok: true, tunnelUrl: env.tunnelUrl, alreadyRunning: true });
+    try {
+        // Resolve cloudflared binary path
+        const cfDir = path.join(process.env.HOME || '/tmp', '.deepdebug', 'bin');
+        const cfPath = path.join(cfDir, 'cloudflared');
+        // Download if missing
+        if (!fs.existsSync(cfPath)) {
+            fs.mkdirSync(cfDir, { recursive: true });
+            const arch = process.arch === 'arm64' ? 'arm64' : 'amd64';
+            const platform = process.platform === 'darwin' ? 'darwin' : 'linux';
+            const url = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${platform}-${arch}`;
+            console.log(`[VIBE-TUNNEL] Downloading cloudflared from ${url}...`);
+            await execAsync(`curl -fsSL "${url}" -o "${cfPath}" && chmod +x "${cfPath}"`);
+            console.log(`[VIBE-TUNNEL] cloudflared downloaded to ${cfPath}`);
+        }
+        // Start tunnel
+        const tunnelProcess = spawn(cfPath, ['tunnel', '--url', `http://localhost:${env.port}`], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: false
+        });
+        env.tunnelPid = tunnelProcess.pid;
+        env.status = 'tunneling';
+        // Capture tunnel URL from stdout/stderr
+        const tunnelUrl = await new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => reject(new Error('Tunnel URL not found within 30s')), 30000);
+            const handler = (data) => {
+                const text = data.toString();
+                const match = text.match(/https:\/\/[a-zA-Z0-9-]+\.trycloudflare\.com/);
+                if (match) {
+                    clearTimeout(timeout);
+                    tunnelProcess.stdout.off('data', handler);
+                    tunnelProcess.stderr.off('data', handler);
+                    resolve(match[0]);
+                }
+            };
+            tunnelProcess.stdout.on('data', handler);
+            tunnelProcess.stderr.on('data', handler);
+            tunnelProcess.on('error', (err) => { clearTimeout(timeout); reject(err); });
+        });
+        env.tunnelUrl = tunnelUrl;
+        console.log(`[VIBE-TUNNEL] Tunnel started: ${tunnelUrl}`);
+        return res.json({ ok: true, tunnelUrl });
+    } catch (err) {
+        console.error(`[VIBE-TUNNEL] Failed: ${err.message}`);
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+/**
+ * DELETE /workspace/vibe/tunnel/:sessionId
+ *
+ * Stops only the tunnel (keeps service running).
+ */
+app.delete("/workspace/vibe/tunnel/:sessionId", async (req, res) => {
+    const { sessionId } = req.params;
+    const env = vibeEnvs.get(sessionId);
+    if (!env || !env.tunnelPid) return res.json({ ok: true, message: "No tunnel running" });
+    try {
+        process.kill(env.tunnelPid, 'SIGTERM');
+        env.tunnelPid = null;
+        env.tunnelUrl = null;
+        env.status = 'running';
+        return res.json({ ok: true });
+    } catch (err) {
+        return res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
+// ============================================
+// VERCEL PROXY ROUTES
+// ============================================
+registerVercelRoutes(app);
+
 // ============================================
 // START SERVER