deepdebug-local-agent 1.0.20 → 1.0.22

package/src/server.js

@@ -867,7 +867,7 @@ app.post("/workspace/open", async (req, res) => {
 
             return res.json({
                 ok: true,
-                root: WORKSPACE_ROOT,
+                root: clonePath,
                 workspaceId: wsId,
                 mode: "cloud-clone",
                 meta,
@@ -988,13 +988,16 @@ app.post("/workspace/clone", async (req, res) => {
             const safeLog = authenticatedUrl.replace(/x-token-auth:[^@]+@/g, 'x-token-auth:***@').replace(/oauth2:[^@]+@/g, 'oauth2:***@').replace(/x-access-token:[^@]+@/g, 'x-access-token:***@');
             const cloneCmd = branch ? `git clone -b ${branch} "${authenticatedUrl}" "${absTarget}"` : `git clone "${authenticatedUrl}" "${absTarget}"`;
             console.log(`Running: git clone${branch ? ' -b ' + branch : ''} "${safeLog}" "${absTarget}"`);
-            await execAsync(cloneCmd, { timeout: 300000 });
+            const cloneEnvWorkspace = { ...process.env, GIT_TERMINAL_PROMPT: "0", HOME: process.env.HOME || "/tmp" };
+            await execAsync(cloneCmd, { timeout: 300000, env: cloneEnvWorkspace });
             console.log(`Clone complete: ${absTarget}`);
         }
 
         // Open the cloned workspace
-        WORKSPACE_ROOT = absTarget;
         const wsId = workspaceId || "default";
+        if (wsId === "default") {
+            WORKSPACE_ROOT = absTarget;
+        }
         try {
             await wsManager.open(wsId, absTarget);
         } catch (err) {
@@ -1096,6 +1099,398 @@ app.get("/workspace/file-content", async (req, res) => {
     }
 });
 
+/**
+ * POST /workspace/build-push
+ * Compress workspace, upload to GCS, submit Cloud Build.
+ * No Docker daemon needed — uses Cloud Build API + GCS.
+ * Body: { workspaceId, imageName, gcpProject, saKeyJson }
+ */
+app.post("/workspace/build-push", async (req, res) => {
+    const { workspaceId, imageName, gcpProject, saKeyJson } = req.body || {};
+    if (!workspaceId || !imageName || !gcpProject || !saKeyJson) {
+        return res.status(400).json({ error: "workspaceId, imageName, gcpProject and saKeyJson required" });
+    }
+
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+
+    const emit = (event, msg) => {
+        const data = typeof msg === "object" ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+        res.write(`event:${event}\ndata:${data}\n\n`);
+    };
+
+    try {
+        const nfsBase = process.env.WORKSPACES_MOUNT || "/mnt/workspaces";
+        const wsPath = path.join(nfsBase, workspaceId);
+
+        if (!fs.existsSync(wsPath)) {
+            emit("error", { error: "Workspace not found: " + wsPath });
+            return res.end();
+        }
+        if (!fs.existsSync(path.join(wsPath, "Dockerfile"))) {
+            emit("error", { error: "No Dockerfile in workspace. Run detect+generate first." });
+            return res.end();
+        }
+
+        // Step 1: Get GCP access token from SA key
+        emit("progress", "Authenticating with GCP...");
+        let accessToken;
+        try {
+            const { createSign } = await import("crypto");
+            const sa = JSON.parse(saKeyJson);
+            const now = Math.floor(Date.now() / 1000);
+            const h = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+            const c = Buffer.from(JSON.stringify({
+                iss: sa.client_email,
+                scope: "https://www.googleapis.com/auth/cloud-platform",
+                aud: "https://oauth2.googleapis.com/token",
+                iat: now, exp: now + 3600
+            })).toString("base64url");
+            const sign = createSign("SHA256");
+            sign.update(`${h}.${c}`);
+            const sig = sign.sign(sa.private_key, "base64url");
+            const jwt = `${h}.${c}.${sig}`;
+
+            const tokenResp = await fetch("https://oauth2.googleapis.com/token", {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=${jwt}`
+            });
+            const tokenData = await tokenResp.json();
+            accessToken = tokenData.access_token;
+            if (!accessToken) throw new Error("No access_token: " + JSON.stringify(tokenData));
+            emit("progress", "GCP authentication successful");
+        } catch (e) {
+            emit("error", { error: "GCP auth failed: " + e.message });
+            return res.end();
+        }
+
+        // Step 2: Compress workspace to tar.gz
+        emit("progress", "Compressing source code...");
+        const { execSync } = await import("child_process");
+        const tarPath = `/tmp/source-${workspaceId}-${Date.now()}.tar.gz`;
+        try {
+            execSync(
+                `tar -czf "${tarPath}" --exclude=".git" --exclude="node_modules" ` +
+                `--exclude="target" --exclude="*.class" --exclude=".gradle" ` +
+                `-C "${wsPath}" . 2>&1`,
+                { stdio: "pipe", timeout: 120000 }
+            );
+            const sizeKB = Math.round(fs.statSync(tarPath).size / 1024);
+            emit("progress", `Source compressed: ${sizeKB}KB`);
+        } catch (e) {
+            emit("error", { error: "Compression failed: " + (e.message || "").substring(0, 200) });
+            return res.end();
+        }
+
+        // Step 3: Upload to GCS
+        const bucketName = `${gcpProject}_cloudbuild`;
+        const objectName = `source/${workspaceId}-${Date.now()}.tar.gz`;
+        emit("progress", `Uploading source to GCS...`);
+        try {
+            // Create bucket (ignore if exists)
+            await fetch(`https://storage.googleapis.com/storage/v1/b?project=${gcpProject}`, {
+                method: "POST",
+                headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
+                body: JSON.stringify({ name: bucketName, location: "US" })
+            });
+
+            const fileBuffer = fs.readFileSync(tarPath);
+            const uploadResp = await fetch(
+                `https://storage.googleapis.com/upload/storage/v1/b/${encodeURIComponent(bucketName)}/o?uploadType=media&name=${encodeURIComponent(objectName)}`,
+                {
+                    method: "POST",
+                    headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/gzip" },
+                    body: fileBuffer
+                }
+            );
+            if (!uploadResp.ok) {
+                const errText = await uploadResp.text();
+                throw new Error(`GCS upload ${uploadResp.status}: ${errText.substring(0, 200)}`);
+            }
+            emit("progress", "Source uploaded to GCS");
+        } catch (e) {
+            emit("error", { error: "GCS upload failed: " + e.message });
+            return res.end();
+        } finally {
+            try { fs.unlinkSync(tarPath); } catch {}
+        }
+
+        // Step 4: Submit Cloud Build
+        emit("progress", "Submitting Cloud Build...");
+        let buildId = "unknown";
+        try {
+            const buildReq = {
+                source: { storageSource: { bucket: bucketName, object: objectName } },
+                steps: [
+                    { name: "gcr.io/cloud-builders/docker", args: ["build", "-t", imageName, "."], id: "build" },
+                    { name: "gcr.io/cloud-builders/docker", args: ["push", imageName], id: "push", waitFor: ["build"] }
+                ],
+                images: [imageName],
+                timeout: "1200s"
+            };
+
+            const buildResp = await fetch(
+                `https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds`,
+                {
+                    method: "POST",
+                    headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
+                    body: JSON.stringify(buildReq)
+                }
+            );
+            if (!buildResp.ok) {
+                const errText = await buildResp.text();
+                throw new Error(`Cloud Build ${buildResp.status}: ${errText.substring(0, 300)}`);
+            }
+            const buildData = await buildResp.json();
+            buildId = buildData.metadata?.build?.id || buildData.name?.split("/").pop() || "unknown";
+            emit("progress", `Cloud Build started: ${buildId}`);
+        } catch (e) {
+            emit("error", { error: "Cloud Build submit failed: " + e.message });
+            return res.end();
+        }
+
+        // Step 5: Poll build status
+        emit("progress", "Building Docker image (3-5 minutes)...");
+        let status = "WORKING";
+        let attempts = 0;
+        while (!["SUCCESS", "FAILURE", "CANCELLED", "TIMEOUT"].includes(status) && attempts < 40) {
+            await new Promise(r => setTimeout(r, 15000));
+            attempts++;
+            try {
+                const statusResp = await fetch(
+                    `https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds/${buildId}`,
+                    { headers: { "Authorization": `Bearer ${accessToken}` } }
+                );
+                const statusData = await statusResp.json();
+                status = statusData.status || "WORKING";
+                emit("progress", `Build status: ${status} (${attempts}/40)`);
+            } catch (e) {
+                emit("progress", `Status check error: ${e.message}`);
+            }
+        }
+
+        if (status === "SUCCESS") {
+            emit("progress", "Docker image built and pushed successfully!");
+            emit("complete", { success: true, imageName, buildId });
+        } else {
+            emit("error", { error: `Cloud Build ${status}. Check GCP Console.` });
+        }
+        res.end();
+
+    } catch (err) {
+        console.error("[build-push] Fatal:", err.message);
+        emit("error", { error: err.message });
+        res.end();
+    }
+});
+
+/**
+ * POST /workspace/setup
+ * AI Cloud Engineering Agent - autonomous setup:
+ * 1. Clone repo  2. Detect stack  3. Generate Dockerfile  4. Register workspace
+ * Returns SSE stream with real-time progress.
+ */
+app.post("/workspace/setup", async (req, res) => {
+    const { workspaceId, repoUrl, gitToken, provider = "deepdebug_cloud",
+            cloudProjectId, cloudToken } = req.body || {};
+    // gitProvider is passed by the gateway (OnboardingSetupController) and used below
+    // to pick the correct authenticated-clone username. Auto-detect from the URL if
+    // the gateway didn't send it, so older callers keep working.
+    const gitProvider = (req.body && req.body.gitProvider
+            ? String(req.body.gitProvider)
+            : (repoUrl && repoUrl.includes("bitbucket.org") ? "bitbucket"
+             : repoUrl && repoUrl.includes("gitlab.com") ? "gitlab"
+             : "github")).toLowerCase();
+
+    if (!workspaceId || !repoUrl) {
+        return res.status(400).json({ error: "workspaceId and repoUrl required" });
+    }
+
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+
+    const emit = (event, msg) => {
+        const data = typeof msg === "object" ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+        res.write(`event:${event}\ndata:${data}\n\n`);
+    };
+
+    try {
+        // Use /mnt/workspaces as base (not WORKSPACE_ROOT which is a specific workspace)
+        const nfsBase = process.env.WORKSPACES_MOUNT || "/mnt/workspaces";
+        const wsPath = path.join(nfsBase, workspaceId);
+
+        emit("progress", `Starting setup for workspace: ${workspaceId}`);
+        emit("progress", `Workspace path: ${wsPath}`);
+
+        // STEP 1 - Clone
+        emit("progress", "Cloning repository...");
+        let authUrl = repoUrl;
+        if (gitToken && gitToken.length > 5) {
+            // Provider-specific auth username:
+            //   bitbucket -> "x-token-auth" (required by Bitbucket Cloud)
+            //   gitlab    -> "oauth2"
+            //   github/*  -> "x-access-token" (GitHub's recommended)
+            const authUser = gitProvider === "bitbucket" ? "x-token-auth"
+                           : gitProvider === "gitlab"    ? "oauth2"
+                           : "x-access-token";
+            try {
+                const urlObj = new URL(repoUrl);
+                urlObj.username = authUser;
+                urlObj.password = gitToken;
+                authUrl = urlObj.toString();
+                emit("progress", `Using authenticated clone for ${urlObj.hostname} (auth=${authUser})`);
+            } catch {
+                authUrl = repoUrl.replace("https://", `https://${authUser}:${gitToken}@`);
+                emit("progress", `Using authenticated clone (fallback, auth=${authUser})`);
+            }
+        }
+
+        const { execSync } = await import("child_process");
+        const cloneEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0", HOME: process.env.HOME || "/tmp" };
+        const execOpts = { stdio: "pipe", timeout: 300000, encoding: "utf8", env: cloneEnv };
+        let cloneBranch = "main";
+
+        // Configure safe directory
+        try { execSync(`git config --global --add safe.directory "${wsPath}"`, execOpts); } catch {}
+
+        if (fs.existsSync(path.join(wsPath, ".git"))) {
+            emit("progress", "Workspace exists, updating...");
+            try {
+                if (gitToken && gitToken.length > 5) {
+                    execSync(`git remote set-url origin "${authUrl}"`, { ...execOpts, cwd: wsPath });
+                }
+                execSync("git fetch origin", { ...execOpts, cwd: wsPath });
+                cloneBranch = execSync("git branch --show-current", { ...execOpts, cwd: wsPath }).trim() || "main";
+                execSync(`git reset --hard origin/${cloneBranch}`, { ...execOpts, cwd: wsPath });
+            } catch (e) {
+                const safeMsg = gitToken ? e.message.replace(gitToken, "***") : e.message;
+                emit("progress", `Update failed (${safeMsg.substring(0, 100)}), re-cloning...`);
+                fs.rmSync(wsPath, { recursive: true, force: true });
+            }
+        }
+
+        if (!fs.existsSync(path.join(wsPath, ".git"))) {
+            // Remove existing empty dir before clone (git clone needs non-existent or empty target)
+            if (fs.existsSync(wsPath)) {
+                const contents = fs.readdirSync(wsPath);
+                if (contents.length === 0) fs.rmSync(wsPath, { recursive: true });
+            }
+
+            for (const b of ["main", "master", "develop"]) {
+                try {
+                    emit("progress", `Trying branch: ${b}...`);
+                    execSync(`git clone --depth=1 --branch ${b} "${authUrl}" "${wsPath}"`, execOpts);
+                    cloneBranch = b;
+                    emit("progress", `Cloned on branch: ${b}`);
+                    break;
+                } catch (e) {
+                    const stderr = (e.stderr || e.stdout || e.message || "").toString();
+                    const safeMsg = gitToken ? stderr.replace(new RegExp(gitToken, 'g'), "***") : stderr;
+                    console.warn(`[Clone] Branch ${b} failed: ${safeMsg.substring(0, 500)}`);
+                    emit("progress", `Branch ${b} failed: ${safeMsg.substring(0, 200)}`);
+                    // Clean up partial clone
+                    if (fs.existsSync(wsPath)) fs.rmSync(wsPath, { recursive: true, force: true });
+                }
+            }
+
+            // Fallback: clone without specifying branch
+            if (!fs.existsSync(path.join(wsPath, ".git"))) {
+                try {
+                    emit("progress", "Trying default branch...");
+                    execSync(`git clone --depth=1 "${authUrl}" "${wsPath}" 2>&1`, execOpts);
+                    cloneBranch = execSync("git branch --show-current", { ...execOpts, cwd: wsPath }).trim() || "main";
+                    emit("progress", `Cloned on default branch: ${cloneBranch}`);
+                } catch (e) {
+                    const stderr = (e.stderr || e.stdout || e.message || "").toString();
+                    const safeMsg = gitToken ? stderr.replace(new RegExp(gitToken, 'g'), "***") : stderr;
+                    console.error(`[Clone] Default branch failed: ${safeMsg.substring(0, 500)}`);
+                    emit("progress", `Default branch failed: ${safeMsg.substring(0, 200)}`);
+                    if (fs.existsSync(wsPath)) fs.rmSync(wsPath, { recursive: true, force: true });
+                }
+            }
+        }
+
+        if (!fs.existsSync(path.join(wsPath, ".git"))) {
+            emit("error", { error: "Clone failed for all branches. Check repo URL and permissions." });
+            return res.end();
+        }
+        emit("progress", `Repository cloned on branch: ${cloneBranch}`);
+
+        // STEP 2 - Detect stack
+        emit("progress", "AI analysing project structure...");
+        const meta = await detectProject(wsPath);
+        emit("progress", `Stack: ${meta.language} / ${meta.buildTool} / ${meta.framework || "unknown"}`);
+
+        // STEP 3 - Generate Dockerfile if missing
+        const dockerfilePath = path.join(wsPath, "Dockerfile");
+        if (!fs.existsSync(dockerfilePath)) {
+            emit("progress", `Generating Dockerfile for ${meta.language}...`);
+            const content = generateDockerfileContent(meta.language, meta.buildTool);
+            fs.writeFileSync(dockerfilePath, content, "utf8");
+            emit("progress", "Dockerfile generated");
+        } else {
+            emit("progress", "Dockerfile already exists");
+        }
+
+        // STEP 4 - Register
+        emit("progress", `Provider: ${provider}. Workspace ready.`);
+
+        emit("progress", "AI Cloud Engineering setup complete!");
+        emit("complete", {
+            success: true, workspaceId, wsPath, provider, branch: cloneBranch,
+            stack: { language: meta.language, buildTool: meta.buildTool, framework: meta.framework },
+            message: "Setup complete. Monitoring is now active."
+        });
+        res.end();
+
+    } catch (err) {
+        console.error("[Setup] Error:", err.message);
+        emit("error", { error: err.message });
+        res.end();
+    }
+});
+
+function generateDockerfileContent(language, buildTool) {
+    if (language === "java" && (buildTool === "maven" || buildTool === "mvn"))
+        return `FROM maven:3.9-eclipse-temurin-17 AS build\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/target/*.jar app.jar\nEXPOSE 8080\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+    if (language === "java")
+        return `FROM gradle:8-jdk17 AS build\nWORKDIR /app\nCOPY . .\nRUN gradle build -x test\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/build/libs/*.jar app.jar\nEXPOSE 8080\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+    if (language === "node" || language === "javascript" || language === "typescript")
+        return `FROM node:20-alpine\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\nCOPY . .\nEXPOSE 8080\nENV PORT=8080\nCMD ["node", "src/index.js"]\n`;
+    if (language === "python")
+        return `FROM python:3.11-slim\nWORKDIR /app\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\nCOPY . .\nEXPOSE 8080\nCMD ["python", "app.py"]\n`;
+    if (language === "go")
+        return `FROM golang:1.21-alpine AS build\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 go build -o main .\nFROM alpine:3.18\nCOPY --from=build /app/main /app/main\nEXPOSE 8080\nCMD ["/app/main"]\n`;
+    return `FROM ubuntu:22.04\nWORKDIR /app\nCOPY . .\nEXPOSE 8080\nCMD ["./start.sh"]\n`;
+}
+
+/** Detect project stack from files (pom.xml, package.json, etc.) */
+app.post("/workspace/detect", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ ok: false, error: "workspace not set" });
+    try {
+        const meta = await detectProject(wsRoot);
+        const fs = await import("fs");
+        const path = await import("path");
+        res.json({
+            ok: true,
+            language: meta.language || "unknown",
+            buildTool: meta.buildTool || "unknown",
+            framework: meta.framework || "unknown",
+            hasDockerfile: fs.existsSync(path.join(wsRoot, "Dockerfile")),
+            path: wsRoot
+        });
+    } catch (e) {
+        res.json({ ok: false, language: "unknown", buildTool: "unknown",
+            framework: "unknown", error: e.message });
+    }
+});
+
 /** Escreve/salva conteudo de arquivo no workspace */
 app.post("/workspace/write-file", async (req, res) => {
     const workspaceRoot = resolveWorkspaceRoot(req);
@@ -1826,6 +2221,156 @@ app.get("/workspace/test-local/state", async (req, res) => {
     });
 });
 
+/**
+ * POST /workspace/git/prepare
+ * Prepares a clean workspace for a new fix:
+ * 1. Detects main branch (main, master, develop)
+ * 2. git fetch origin
+ * 3. git checkout main branch
+ * 4. git reset --hard origin/main branch
+ */
+app.post("/workspace/git/prepare", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
+        return res.status(400).json({ ok: false, error: "workspace not set" });
+    }
+
+    const { gitToken, repoUrl, gitProvider, branch: reqBranch, workspaceId } = req.body || {};
+    console.log(`[git-prepare] Starting workspace preparation: wsRoot=${wsRoot} repoUrl=${repoUrl || 'none'}`);
+
+    try {
+        const { execSync } = await import("child_process");
+        const execOpts = { encoding: "utf8", timeout: 120000, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } };
+        const execGit = (cmd) => {
+            try {
+                return { ok: true, output: execSync(cmd, {
+                    cwd: wsRoot, ...execOpts
+                }).trim() };
+            } catch (err) {
+                return { ok: false, output: (err.stderr || err.stdout || err.message || "unknown").toString().trim() };
+            }
+        };
+
+        execGit(`git config --global --add safe.directory "${wsRoot}"`);
+
+        // If workspace is empty (no .git), clone first before attempting fetch/reset
+        const gitDir = path.join(wsRoot, ".git");
+        if (!fs.existsSync(gitDir)) {
+            if (!repoUrl) {
+                return res.json({ ok: false, error: "Workspace is empty and no repoUrl provided for clone" });
+            }
+            console.log(`[git-prepare] No .git found at ${wsRoot}, cloning from ${repoUrl}`);
+            fs.mkdirSync(wsRoot, { recursive: true });
+
+            // Build authenticated URL
+            let authUrl = repoUrl;
+            if (gitToken) {
+                const prov = (gitProvider || "").toLowerCase();
+                if (repoUrl.includes("bitbucket.org") || prov === "bitbucket") {
+                    authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://x-token-auth:${gitToken}@`);
+                } else if (repoUrl.includes("gitlab.com") || prov === "gitlab") {
+                    authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://oauth2:${gitToken}@`);
+                } else {
+                    authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://x-access-token:${gitToken}@`);
+                }
+            }
+            if (!authUrl.endsWith(".git")) authUrl += ".git";
+
+            const branchesToTry = [reqBranch || "main", "main", "master"].filter((b, i, a) => a.indexOf(b) === i);
+            let cloned = false;
+            let clonedBranch = "main";
+            for (const b of branchesToTry) {
+                try {
+                    fs.rmSync(wsRoot, { recursive: true, force: true });
+                    fs.mkdirSync(wsRoot, { recursive: true });
+                    execSync(`git clone --depth 50 --branch "${b}" "${authUrl}" "${wsRoot}"`, execOpts);
+                    clonedBranch = b;
+                    cloned = true;
+                    console.log(`[git-prepare] Cloned branch ${b} successfully`);
+                    break;
+                } catch (cloneErr) {
+                    console.warn(`[git-prepare] Clone branch ${b} failed: ${(cloneErr.message || "").slice(0, 100)}`);
+                }
+            }
+            if (!cloned) {
+                try {
+                    fs.rmSync(wsRoot, { recursive: true, force: true });
+                    fs.mkdirSync(wsRoot, { recursive: true });
+                    execSync(`git clone --depth 50 "${authUrl}" "${wsRoot}"`, execOpts);
+                    cloned = true;
+                    clonedBranch = "default";
+                } catch (e) {
+                    return res.json({ ok: false, error: "Clone failed: " + (e.message || "").slice(0, 200) });
+                }
+            }
+
+            // Update WORKSPACE_ROOT so subsequent tool calls find the files
+            WORKSPACE_ROOT = wsRoot;
+            try { await wsManager.open(workspaceId || path.basename(wsRoot), wsRoot); } catch (_) {}
+
+            const commit = execGit("git rev-parse --short HEAD");
+            let fileCount = 0;
+            try { function walk(d) { for (const e of fs.readdirSync(d, {withFileTypes:true})) { if (e.name==='.git') continue; if (e.isDirectory()) walk(path.join(d,e.name)); else fileCount++; } } walk(wsRoot); } catch (_) {}
+            return res.json({ ok: true, cloned: true, mainBranch: clonedBranch,
+                currentCommit: commit.ok ? commit.output : "unknown", fileCount,
+                message: `Repository cloned: ${clonedBranch} (${fileCount} files)` });
+        }
+
+        if (gitToken && repoUrl) {
+            let authUrl = repoUrl;
+            const prov = (gitProvider || "").toLowerCase();
+            if (repoUrl.includes("bitbucket.org") || prov === "bitbucket") {
+                authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://x-token-auth:${gitToken}@`);
+            } else if (repoUrl.includes("gitlab.com") || prov === "gitlab") {
+                authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://oauth2:${gitToken}@`);
+            } else {
+                authUrl = repoUrl.replace(/https:\/\/([^@]*@)?/, `https://x-access-token:${gitToken}@`);
+            }
+            execGit(`git remote set-url origin "${authUrl}"`);
+        }
+
+        console.log("[git-prepare] Fetching origin...");
+        execGit("git fetch origin --prune");
+
+        let mainBranch = null;
+        for (const branch of ["main", "master", "develop", "dev"]) {
+            if (execGit(`git rev-parse --verify origin/${branch}`).ok) {
+                mainBranch = branch;
+                break;
+            }
+        }
+        if (!mainBranch) {
+            const cur = execGit("git rev-parse --abbrev-ref HEAD");
+            mainBranch = cur.ok ? cur.output : "main";
+        }
+
+        const prevBranch = (execGit("git rev-parse --abbrev-ref HEAD").output || "unknown");
+        const prevCommit = (execGit("git rev-parse --short HEAD").output || "unknown");
+
+        console.log(`[git-prepare] ${prevBranch}@${prevCommit} -> ${mainBranch}`);
+
+        let checkout = execGit(`git checkout ${mainBranch}`);
+        if (!checkout.ok) checkout = execGit(`git checkout -f ${mainBranch}`);
+        if (!checkout.ok) {
+            return res.json({ ok: false, error: `Could not checkout ${mainBranch}: ${checkout.output}`,
+                mainBranch, previousBranch: prevBranch, previousCommit: prevCommit });
+        }
+
+        execGit(`git reset --hard origin/${mainBranch}`);
+        execGit('git clean -fd --exclude="*.env" --exclude=".env*"');
+
+        const newCommit = (execGit("git rev-parse --short HEAD").output || "unknown");
+        console.log(`[git-prepare] Ready: ${mainBranch}@${newCommit}`);
+
+        res.json({ ok: true, mainBranch, currentCommit: newCommit,
+            previousBranch: prevBranch, previousCommit: prevCommit,
+            message: `Workspace prepared: on ${mainBranch} at ${newCommit}` });
+    } catch (err) {
+        console.error("[git-prepare] Error:", err.message);
+        res.status(500).json({ ok: false, error: err.message });
+    }
+});
+
 /**
  * POST /workspace/test-local/compile
  * Compiles the project without starting server
@@ -6310,6 +6855,186 @@ app.delete("/workspace/vibe/tunnel/:sessionId", async (req, res) => {
 // ============================================
 registerVercelRoutes(app);
 
+// ============================================
+// LIVE PREVIEW — iOS / Android / Web
+// ============================================
+
+app.get('/workspace/preview', async (req, res) => {
+    const wsRoot = req.headers['x-workspace-root'] || WORKSPACE_ROOT;
+    if (!wsRoot) {
+        return res.json({ type: 'none', message: 'Workspace not set' });
+    }
+
+    try {
+        const meta = await detectProject(wsRoot);
+        const lang = (meta.language || '').toLowerCase();
+        const fw   = (meta.framework || '').toLowerCase();
+
+        if (lang === 'ios' || lang === 'swift' || fw.includes('swiftui') || fw.includes('uikit')) {
+            const html = renderSwiftUIPreview(wsRoot);
+            return res.json({ type: 'ios', html, framework: fw, message: 'SwiftUI static render' });
+        }
+
+        if (lang === 'android' || lang === 'kotlin' || fw.includes('compose') || fw.includes('android')) {
+            const html = renderAndroidPreview(wsRoot);
+            return res.json({ type: 'android', html, framework: fw, message: 'Android static render' });
+        }
+
+        const webFw = ['react','next','vue','nuxt','angular','svelte','vite'];
+        if (webFw.some(f => fw.includes(f))) {
+            let cmd = 'npm run dev';
+            if (fw.includes('angular')) cmd = 'npx ng serve --port 4200 --host 0.0.0.0';
+            return res.json({ type: 'web', framework: fw, startCommand: cmd, message: 'Start dev server for live preview' });
+        }
+
+        return res.json({ type: 'none', language: lang, framework: fw, message: 'No preview for ' + lang + '/' + fw });
+    } catch (err) {
+        console.error('[preview]', err.message);
+        res.json({ type: 'none', message: err.message });
+    }
+});
+
+function renderSwiftUIPreview(wsRoot) {
+    const swiftFiles = [];
+    function walk(dir) {
+        try {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const full = path.join(dir, entry.name);
+                if (entry.isDirectory() && !['node_modules','.git','build','DerivedData','.build'].includes(entry.name)) {
+                    walk(full);
+                } else if (entry.name.endsWith('.swift')) {
+                    swiftFiles.push(full);
+                }
+            }
+        } catch (_) {}
+    }
+    walk(wsRoot);
+    if (swiftFiles.length === 0) return buildPhoneFrame('<p style="color:#999;padding:20px">No Swift files found</p>', 'iOS');
+
+    const priority = ['ContentView.swift','TaskListView.swift','HomeView.swift','MainView.swift'];
+    swiftFiles.sort((a, b) => {
+        const ai = priority.findIndex(p => a.endsWith(p));
+        const bi = priority.findIndex(p => b.endsWith(p));
+        return (ai === -1 ? 99 : ai) - (bi === -1 ? 99 : bi);
+    });
+
+    const bodyParts = [];
+    for (const f of swiftFiles.slice(0, 5)) {
+        try { bodyParts.push(parseSwiftUI(path.basename(f), fs.readFileSync(f, 'utf8'))); } catch (_) {}
+    }
+    return buildPhoneFrame(bodyParts.join('\n'), 'iOS');
+}
+
+function parseSwiftUI(name, src) {
+    let h = '<div class="vb"><div class="vn">' + name + '</div>';
+    if (src.includes('TabView')) {
+        const tabs = [...src.matchAll(/\.tabItem\s*\{[^}]*Label\s*\(\s*"([^"]+)"/g)].map(m => m[1]);
+        if (tabs.length) h += '<div class="tb">' + tabs.map(t => '<div class="ti">' + t + '</div>').join('') + '</div>';
+    }
+    if (src.includes('NavigationStack') || src.includes('NavigationView')) {
+        const m = src.match(/\.navigationTitle\s*\(\s*"([^"]+)"/);
+        h += '<div class="nb"><span>' + (m ? m[1] : 'Navigation') + '</span></div>';
+    }
+    if (src.includes('List') || src.includes('ForEach')) {
+        h += '<div class="lc">';
+        const rows = [...src.matchAll(/Text\s*\(\s*"([^"]+)"\s*\)/g)].slice(0, 6);
+        (rows.length ? rows : [{1:'Task item'},{1:'Task item'},{1:'Task item'}]).forEach(r => {
+            h += '<div class="lr">' + (r[1] || 'Item') + '</div>';
+        });
+        h += '</div>';
+    }
+    const btns = [...src.matchAll(/Button\s*\(?\s*"([^"]+)"/g)].slice(0, 3);
+    if (btns.length) { h += '<div class="bg">'; btns.forEach(b => { h += '<button class="ib">' + b[1] + '</button>'; }); h += '</div>'; }
+    if (src.includes('import Charts') || src.includes('Chart {')) {
+        h += '<div class="cp"><div class="cb">' + [60,85,45,90,70].map(v => '<div class="bar" style="height:' + v + '%"></div>').join('') + '</div><div class="cl">Charts</div></div>';
+    }
+    const texts = [...src.matchAll(/Text\s*\(\s*"([^"]+)"\s*\)/g)].map(m => m[1]).filter(t => t.length > 2 && t.length < 60).slice(0, 4);
+    if (texts.length && !src.includes('List')) { h += '<div class="tg">'; texts.forEach(t => { h += '<p class="it">' + t + '</p>'; }); h += '</div>'; }
+    return h + '</div>';
+}
+
+function renderAndroidPreview(wsRoot) {
+    const ktFiles = [];
+    function walk(dir) {
+        try {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const full = path.join(dir, entry.name);
+                if (entry.isDirectory() && !['node_modules','.git','build','.gradle'].includes(entry.name)) {
+                    walk(full);
+                } else if (entry.name.endsWith('.kt')) {
+                    ktFiles.push(full);
+                }
+            }
+        } catch (_) {}
+    }
+    walk(wsRoot);
+    if (ktFiles.length === 0) return buildPhoneFrame('<p style="color:#999;padding:20px">No Kotlin files found</p>', 'Android');
+
+    const priority = ['MainActivity.kt','MainScreen.kt','HomeScreen.kt'];
+    ktFiles.sort((a, b) => {
+        const ai = priority.findIndex(p => a.endsWith(p));
+        const bi = priority.findIndex(p => b.endsWith(p));
+        return (ai === -1 ? 99 : ai) - (bi === -1 ? 99 : bi);
+    });
+
+    const bodyParts = [];
+    for (const f of ktFiles.slice(0, 5)) {
+        try { bodyParts.push(parseKotlin(path.basename(f), fs.readFileSync(f, 'utf8'))); } catch (_) {}
+    }
+    return buildPhoneFrame(bodyParts.join('\n'), 'Android');
+}
+
+function parseKotlin(name, src) {
+    let h = '<div class="vb"><div class="vn">' + name + '</div>';
+    const tm = src.match(/title\s*=\s*\{\s*Text\s*\(\s*"([^"]+)"/);
+    if (tm) h += '<div class="nb mat"><span>' + tm[1] + '</span></div>';
+    if (src.includes('LazyColumn') || src.includes('items(')) {
+        h += '<div class="lc mat">';
+        const rows = [...src.matchAll(/Text\s*\(\s*(?:text\s*=\s*)?"([^"]+)"/g)].slice(0, 5);
+        (rows.length ? rows : [{1:'List item'},{1:'List item'},{1:'List item'}]).forEach(r => {
+            h += '<div class="lr mat">' + (r[1] || 'Item') + '</div>';
+        });
+        h += '</div>';
+    }
+    const btns = [...src.matchAll(/Button\s*\([^)]*onClick[^)]*\)\s*\{[^}]*Text\s*\(\s*"([^"]+)"/g)].slice(0, 3);
+    if (btns.length) { h += '<div class="bg">'; btns.forEach(b => { h += '<button class="mb">' + b[1] + '</button>'; }); h += '</div>'; }
+    return h + '</div>';
+}
+
+function buildPhoneFrame(body, platform) {
+    const iOS = platform === 'iOS';
+    const bg = iOS ? '#f2f2f7' : '#fafafa';
+    const accent = iOS ? '#007AFF' : '#6200EA';
+    const font = iOS ? "-apple-system,BlinkMacSystemFont,'SF Pro Display',sans-serif" : "'Roboto','Google Sans',sans-serif";
+    const sb = iOS
+        ? '<div class="sb ios"><span>9:41</span><span style="margin-left:auto">WiFi 100%</span></div>'
+        : '<div class="sb and"><span>12:00</span><span style="margin-left:auto">WiFi</span></div>';
+    return '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>'
+        + '*{box-sizing:border-box;margin:0;padding:0}'
+        + 'body{background:#1a1a2e;display:flex;align-items:center;justify-content:center;min-height:100vh;font-family:' + font + '}'
+        + '.pf{width:375px;min-height:812px;background:' + bg + ';border-radius:44px;border:8px solid #2d2d2d;overflow:hidden;box-shadow:0 30px 80px rgba(0,0,0,.8);position:relative;display:flex;flex-direction:column}'
+        + '.pf::before{content:"";position:absolute;top:14px;left:50%;transform:translateX(-50%);width:' + (iOS?'120':'100') + 'px;height:' + (iOS?'28':'24') + 'px;background:#2d2d2d;border-radius:14px;z-index:10}'
+        + '.pc{flex:1;overflow-y:auto;padding-top:' + (iOS?'56':'48') + 'px;padding-bottom:34px}'
+        + '.sb{position:absolute;top:0;left:0;right:0;height:' + (iOS?'54':'44') + 'px;display:flex;align-items:flex-end;padding:0 24px 8px;font-size:12px;font-weight:600;z-index:9;background:' + bg + '}'
+        + '.nb{background:' + bg + ';border-bottom:.5px solid rgba(0,0,0,.12);padding:12px 16px;font-size:17px;font-weight:600;text-align:' + (iOS?'center':'left') + '}'
+        + '.nb.mat{background:' + accent + ';color:#fff;font-size:20px;font-weight:500;padding:16px;text-align:left}'
+        + '.tb{position:absolute;bottom:0;left:0;right:0;height:83px;background:' + bg + ';border-top:.5px solid rgba(0,0,0,.12);display:flex;align-items:flex-start;padding-top:10px}'
+        + '.ti{flex:1;text-align:center;font-size:10px;color:' + accent + ';padding-top:24px}'
+        + '.lc{background:#fff;margin:16px 0;border-top:.5px solid rgba(0,0,0,.12);border-bottom:.5px solid rgba(0,0,0,.12)}.lc.mat{margin:0}'
+        + '.lr{padding:14px 16px;border-bottom:.5px solid rgba(0,0,0,.08);font-size:16px;color:#1c1c1e}.lr::after{content:">";margin-left:auto;color:#c7c7cc;float:right}.lr.mat{background:#fff}'
+        + '.bg{padding:16px;display:flex;flex-direction:column;gap:10px}'
+        + '.ib{background:' + accent + ';color:#fff;border:none;border-radius:12px;padding:14px;font-size:16px;font-weight:600;width:100%;cursor:pointer}'
+        + '.mb{background:' + accent + ';color:#fff;border:none;border-radius:4px;padding:12px 24px;font-size:14px;font-weight:500;text-transform:uppercase;letter-spacing:.5px;cursor:pointer;box-shadow:0 2px 4px rgba(0,0,0,.2)}'
+        + '.tg{padding:16px}.it{font-size:15px;color:#1c1c1e;margin:6px 0;line-height:1.4}'
+        + '.vb{margin-bottom:4px}.vn{font-size:10px;color:#8e8e93;padding:4px 16px;background:rgba(0,0,0,.03);font-family:monospace}'
+        + '.cp{margin:16px;background:#fff;border-radius:12px;padding:16px;box-shadow:0 1px 3px rgba(0,0,0,.1)}'
+        + '.cb{display:flex;align-items:flex-end;gap:8px;height:100px;padding:8px 0}'
+        + '.bar{flex:1;background:' + accent + ';border-radius:4px 4px 0 0;opacity:.8}'
+        + '.cl{text-align:center;font-size:11px;color:#8e8e93;margin-top:8px}'
+        + '.badge{position:absolute;top:-6px;right:20px;background:' + accent + ';color:#fff;font-size:10px;font-weight:700;padding:2px 8px;border-radius:4px;letter-spacing:1px}'
+        + '</style></head><body><div style="position:relative"><div class="badge">' + platform.toUpperCase() + '</div><div class="pf">' + sb + '<div class="pc">' + body + '</div></div></div></body></html>';
+}
+
 // ============================================
 // START SERVER
 
@@ -6358,4 +7083,4 @@ try {
 // Auto-register default workspace in WorkspaceManager
 if (WORKSPACE_ROOT) {
     wsManager.open("default", WORKSPACE_ROOT).catch(() => {});
-}
+}