gemcode 0.4.19__tar.gz → 0.4.21__tar.gz

{gemcode-0.4.19/src/gemcode.egg-info → gemcode-0.4.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gemcode
-Version: 0.4.19
+Version: 0.4.21
 Summary: Local-first coding agent on Google Gemini + ADK
 Author: GemCode Contributors
 License:                                  Apache License
@@ -221,6 +221,7 @@ All state lives under `.gemcode/` in the project root. No external services requ
 | Agent Mesh | In-process multi-agent orchestration (automatic) |
 | GemCode Runtime | Optional always-on background scheduler (`gemcode runtime`; alias `gemcode kaira`) |
 | HTTP API (`gemcode serve`) | Built-in web/custom UI backend on `http://127.0.0.1:3001` — chat SSE, sessions, panel, HITL |
+| Hosted multi-tenant | One `gemcode serve` per user with `GEMCODE_HOSTED_TENANT_ROOT` — see [`../docs/hosted.md`](../docs/hosted.md) |
 | A2A server | Cross-machine agent communication via Google A2A protocol |
 | Live audio (experimental) | Microphone-driven Gemini Live sessions |
 

{gemcode-0.4.19 → gemcode-0.4.21}/README.md

@@ -28,6 +28,7 @@ All state lives under `.gemcode/` in the project root. No external services requ
 | Agent Mesh | In-process multi-agent orchestration (automatic) |
 | GemCode Runtime | Optional always-on background scheduler (`gemcode runtime`; alias `gemcode kaira`) |
 | HTTP API (`gemcode serve`) | Built-in web/custom UI backend on `http://127.0.0.1:3001` — chat SSE, sessions, panel, HITL |
+| Hosted multi-tenant | One `gemcode serve` per user with `GEMCODE_HOSTED_TENANT_ROOT` — see [`../docs/hosted.md`](../docs/hosted.md) |
 | A2A server | Cross-machine agent communication via Google A2A protocol |
 | Live audio (experimental) | Microphone-driven Gemini Live sessions |
 

{gemcode-0.4.19 → gemcode-0.4.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gemcode"
-version = "0.4.19"
+version = "0.4.21"
 description = "Local-first coding agent on Google Gemini + ADK"
 readme = "README.md"
 requires-python = ">=3.11"

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/repl_commands.py

@@ -251,6 +251,7 @@ SLASH_COMMANDS: list[tuple[str, str]] = [
     ("kaira",       "Background jobs — gemcode runtime (alias: gemcode kaira)"),
     ("runtime",     "Fleet socket status · gemcode runtime · attach/connect"),
     ("serve",       "HTTP API for web/custom UIs — gemcode serve on :3001"),
+    ("hosted",      "Hosted multi-tenant lock — GEMCODE_HOSTED_TENANT_ROOT status"),
     ("bus",         "Runtime bus — send/publish lightweight messages over IPC"),
     ("inbox",       "Bus inbox filters for this UI (to/topics)"),
     ("fleet",       "Fleet inbox — /fleet show | digest (habits / mesh reports)"),
@@ -413,6 +414,7 @@ def slash_help_lines() -> list[str]:
       "  /live-audio           How to run gemcode live-audio (mic → Gemini Live)",
       "  /doctor               Environment sanity check",
       "  /serve [start|status|stop|url]  Start HTTP API for web UI (gemcode serve on :3001)",
+      "  /hosted [status]                Hosted tenant lock (GEMCODE_HOSTED_TENANT_ROOT)",
       "  /version              Print GemCode version hint",
       "  /exit                 Exit the REPL",
       "",

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/repl_slash.py

@@ -2584,7 +2584,13 @@ async def process_repl_slash(
 
     if first in ("status", "ps"):
       running, info = is_serve_running(cfg.project_root, host=host, port=port)
-      if running and info:
+      if info and info.get("project_mismatch"):
+        out("[serve] port in use by another GemCode API (different project)")
+        out(f"  url: {info.get('url') or serve_base_url(host, port)}")
+        out(f"  this project: {info.get('expected_root') or cfg.project_root}")
+        out(f"  server root: {info.get('actual_root') or '?'}")
+        out("  Stop the other server or run `gemcode serve -C ...` for the matching folder.")
+      elif running and info:
         out("[serve] running")
         out(f"  url: {info.get('url') or serve_base_url(host, port)}")
         out(f"  project: {info.get('project_root') or cfg.project_root}")
@@ -2617,19 +2623,63 @@ async def process_repl_slash(
       session_id=session_id,
     )
     if not result.get("ok"):
-      out(f"[serve] failed: {result.get('error') or 'unknown error'}")
+      if result.get("project_mismatch"):
+        out("[serve] port 3001 is used by GemCode for a different project:")
+        out(f"  expected: {result.get('expected_root')}")
+        out(f"  actual:   {result.get('actual_root')}")
+        out("  Stop that server first, or start this project's API on another port.")
+      else:
+        out(f"[serve] failed: {result.get('error') or 'unknown error'}")
       if result.get("log"):
         out(f"  log: {result.get('log')}")
     elif result.get("already_running"):
       out(f"[serve] already running at {result.get('url')}")
     else:
-      out(f"[serve] started at {result.get('url')}")
+      if result.get("port_fallback"):
+        pref = result.get("preferred_port") or DEFAULT_SERVE_PORT
+        out(f"[serve] port {pref} was busy — started at {result.get('url')}")
+        out(f"  Set NEXT_PUBLIC_API_URL={result.get('url')} in gemcode-web-ui/.env.local")
+      else:
+        out(f"[serve] started at {result.get('url')}")
       if result.get("warming"):
         out("[serve] warming up — retry /serve status in a moment")
       if result.get("log"):
         out(f"  log: {result.get('log')}")
     out(f"[serve] session_id: {session_id}")
-    out("Open the web UI (npm run dev) — it proxies to port 3001 by default.")
+    out("Web UI: npm run dev in gemcode-web-ui → http://localhost:3002")
+    out()
+    return ReplSlashResult(skip_model_turn=True)
+
+  # ── /hosted (multi-tenant serve lock) ───────────────────────────────────
+  if name == "hosted":
+    from gemcode.web.project_root import hosted_tenant_root
+
+    args_h = (sc.args or "").strip().lower()
+    first_h = args_h.split()[0] if args_h else "status"
+
+    if first_h in ("help", "?"):
+      out("Hosted multi-tenant mode (one workspace per gemcode serve process):")
+      out("  /hosted             Show lock status")
+      out("  /hosted status      Same")
+      out("")
+      out("Set GEMCODE_HOSTED_TENANT_ROOT to the tenant workspace path.")
+      out("Web API then rejects client path/project_root outside that directory.")
+      out("HITL approvals use {workspace}/.gemcode/web_approvals.")
+      out("")
+      out("Deployment guide: docs/hosted.md and deploy/gcp/ in the repo.")
+      out()
+      return ReplSlashResult(skip_model_turn=True)
+
+    locked = hosted_tenant_root()
+    if locked is not None:
+      out("[hosted] active — tenant workspace locked")
+      out(f"  GEMCODE_HOSTED_TENANT_ROOT={locked}")
+      out(f"  project_root: {cfg.project_root}")
+      out("  Client path params must stay inside the tenant root (HTTP 403 otherwise).")
+    else:
+      out("[hosted] not active (local mode)")
+      out("  Client path / project_root query params are honored.")
+      out("  Set GEMCODE_HOSTED_TENANT_ROOT in containers for multi-tenant hosting.")
     out()
     return ReplSlashResult(skip_model_turn=True)
 

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/web/hitl_bridge.py

@@ -4,21 +4,35 @@ from __future__ import annotations
 
 import asyncio
 import json
+import os
 import time
 import uuid
 from pathlib import Path
 from typing import Any, Callable
 
-_APPROVAL_DIR = Path.home() / ".gemcode" / "web_approvals"
-_DEFAULT_TIMEOUT_S = 300.0
+def _approval_dir() -> Path:
+  tenant = os.environ.get("GEMCODE_HOSTED_TENANT_ROOT", "").strip()
+  if tenant:
+    return Path(tenant).expanduser().resolve() / ".gemcode" / "web_approvals"
+  return Path.home() / ".gemcode" / "web_approvals"
+_DEFAULT_TIMEOUT_S = float(os.environ.get("GEMCODE_WEB_HITL_TIMEOUT_S", "3600"))
 _POLL_INTERVAL_S = 0.25
 # approval_ids currently blocked in wait_for_web_approval (same process)
 _active_waiters: set[str] = set()
+# emitted to the UI but wait_for_web_approval not started yet (preflight)
+_pending_approval_ids: set[str] = set()
+
+
+def register_pending_approval(approval_id: str) -> None:
+  """Mark an approval as expected so early UI clicks are not reported as late."""
+  aid = (approval_id or "").strip()
+  if aid:
+    _pending_approval_ids.add(aid)
 
 
 def _approval_path(approval_id: str) -> Path:
   safe = "".join(c if c.isalnum() or c in "-_:" else "_" for c in approval_id)
-  return _APPROVAL_DIR / f"{safe}.json"
+  return _approval_dir() / f"{safe}.json"
 
 
 def _read_approval_file(path: Path) -> bool | None:
@@ -44,11 +58,11 @@ def resolve_web_approval(approval_id: str, *, confirmed: bool) -> dict[str, Any]
   """Record the user's approve/deny decision (called from HTTP handler)."""
   if not approval_id.strip():
     return {"ok": False, "error": "approval_id is required"}
-  _APPROVAL_DIR.mkdir(parents=True, exist_ok=True)
+  _approval_dir().mkdir(parents=True, exist_ok=True)
   path = _approval_path(approval_id)
   payload = {"confirmed": bool(confirmed), "resolved_ms": int(time.time() * 1000)}
   path.write_text(json.dumps(payload), encoding="utf-8")
-  late = approval_id not in _active_waiters
+  late = approval_id not in _active_waiters and approval_id not in _pending_approval_ids
   return {
     "ok": True,
     "approval_id": approval_id,
@@ -65,7 +79,7 @@ async def wait_for_web_approval(
   heartbeat_s: float = 15.0,
 ) -> bool:
   """Block until the user approves/denies or timeout (deny on timeout)."""
-  _APPROVAL_DIR.mkdir(parents=True, exist_ok=True)
+  _approval_dir().mkdir(parents=True, exist_ok=True)
   path = _approval_path(approval_id)
 
   # User may have approved before we started waiting (preflight UI is immediate).
@@ -73,6 +87,7 @@ async def wait_for_web_approval(
   if existing is not None:
     return existing
 
+  _pending_approval_ids.discard(approval_id)
   _active_waiters.add(approval_id)
   try:
     deadline = time.monotonic() + max(1.0, timeout_s)
@@ -93,6 +108,7 @@ async def wait_for_web_approval(
     return False
   finally:
     _active_waiters.discard(approval_id)
+    _pending_approval_ids.discard(approval_id)
 
 
 def new_approval_id(session_id: str, fc_id: str | None) -> str:

gemcode-0.4.21/src/gemcode/web/project_root.py

@@ -0,0 +1,60 @@
+"""Shared workspace path resolution for GemCode web HTTP handlers."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+class HostedTenantPathError(ValueError):
+  """Client requested a path outside the locked tenant workspace."""
+
+
+def hosted_tenant_root() -> Path | None:
+  """When set, web handlers are locked to this directory (multi-tenant hosting)."""
+  raw = os.environ.get("GEMCODE_HOSTED_TENANT_ROOT", "").strip()
+  if not raw:
+    return None
+  return Path(raw).expanduser().resolve()
+
+
+def _is_within_root(root: Path, candidate: Path) -> bool:
+  try:
+    candidate.resolve().relative_to(root.resolve())
+    return True
+  except ValueError:
+    return False
+
+
+def resolve_web_project_root(raw_path: str | None) -> Path:
+  """
+  Resolve the active project/workspace root for a web API request.
+
+  Prefers an explicit ``path`` query/body param, then ``GEMCODE_WEB_PROJECT_ROOT``,
+  then the API process working directory.
+
+  When ``GEMCODE_HOSTED_TENANT_ROOT`` is set (hosted multi-tenant mode), client
+  paths must stay inside that root; otherwise the locked root is always used.
+  """
+  locked = hosted_tenant_root()
+  if locked is not None:
+    if raw_path and str(raw_path).strip():
+      candidate = Path(str(raw_path).strip()).expanduser().resolve()
+      if not _is_within_root(locked, candidate):
+        raise HostedTenantPathError(
+          f"path is outside tenant workspace: {candidate} (root={locked})"
+        )
+      return candidate
+    return locked
+
+  if raw_path and str(raw_path).strip():
+    return Path(str(raw_path).strip()).expanduser().resolve()
+  env = os.environ.get("GEMCODE_WEB_PROJECT_ROOT", "").strip()
+  if env:
+    return Path(env).expanduser().resolve()
+  return Path.cwd().resolve()
+
+
+def resolve_sse_project_root(raw_path: str | None) -> Path:
+  """Same rules as :func:`resolve_web_project_root` for SSE chat subprocess."""
+  return resolve_web_project_root(raw_path)

gemcode-0.4.21/src/gemcode/web/serve_bind.py

@@ -0,0 +1,106 @@
+"""Bind helpers for ``gemcode serve`` (port scan + user-facing connection hints)."""
+
+from __future__ import annotations
+
+import errno
+import os
+import socket
+from http.server import ThreadingHTTPServer
+from typing import Callable, TypeVar
+
+from gemcode.web.serve_state import DEFAULT_SERVE_PORT, serve_base_url
+
+# Next.js dev server default — skip when auto-picking an API port.
+UI_RESERVED_PORTS: frozenset[int] = frozenset({3002})
+
+HandlerFactory = TypeVar("HandlerFactory", bound=Callable[..., type])
+
+
+def iter_candidate_ports(
+  preferred: int,
+  *,
+  max_attempts: int | None = None,
+  skip: frozenset[int] = UI_RESERVED_PORTS,
+) -> list[int]:
+  """Ports to try, starting at *preferred*, skipping reserved UI ports."""
+  attempts = max_attempts
+  if attempts is None:
+    attempts = int(os.environ.get("GEMCODE_WEB_PORT_SCAN", "30"))
+  ports: list[int] = []
+  port = preferred
+  while len(ports) < attempts:
+    while port in skip:
+      port += 1
+    ports.append(port)
+    port += 1
+  return ports
+
+
+def bind_http_server(
+  host: str,
+  handler_factory: HandlerFactory,
+  preferred_port: int,
+  *,
+  max_attempts: int | None = None,
+) -> tuple[ThreadingHTTPServer, int]:
+  """Bind ``ThreadingHTTPServer``, advancing to the next port if busy."""
+  last_err: OSError | None = None
+  for port in iter_candidate_ports(preferred_port, max_attempts=max_attempts):
+    try:
+      httpd = ThreadingHTTPServer((host, port), handler_factory)
+      return httpd, port
+    except OSError as exc:
+      if exc.errno != errno.EADDRINUSE:
+        raise
+      last_err = exc
+  raise OSError(
+    errno.EADDRINUSE,
+    f"No free port near {preferred_port} after {len(iter_candidate_ports(preferred_port, max_attempts=max_attempts))} attempts",
+  ) from last_err
+
+
+def port_is_free(host: str, port: int) -> bool:
+  try:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+      sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+      sock.bind((host, port))
+    return True
+  except OSError:
+    return False
+
+
+def find_available_port(
+  host: str,
+  preferred_port: int,
+  *,
+  max_attempts: int | None = None,
+) -> int:
+  """Return the first bindable port without starting a server."""
+  for port in iter_candidate_ports(preferred_port, max_attempts=max_attempts):
+    if port_is_free(host, port):
+      return port
+  raise OSError(
+    errno.EADDRINUSE,
+    f"No free port near {preferred_port}",
+  )
+
+
+def format_connection_lines(
+  host: str,
+  actual_port: int,
+  *,
+  preferred_port: int = DEFAULT_SERVE_PORT,
+) -> list[str]:
+  """Human-readable instructions for API + web UI wiring."""
+  url = serve_base_url(host, actual_port)
+  lines: list[str] = []
+  if actual_port != preferred_port:
+    lines.append(
+      f"Port {preferred_port} is busy — GemCode API is on {url} instead."
+    )
+  else:
+    lines.append(f"GemCode API listening on {url}")
+  lines.append("Web UI: run `npm run dev` in gemcode-web-ui → http://localhost:3002")
+  lines.append(f"Point the UI at this API (gemcode-web-ui/.env.local):")
+  lines.append(f"  NEXT_PUBLIC_API_URL={url}")
+  return lines

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/web/serve_state.py

@@ -90,6 +90,22 @@ def is_serve_running(
 
   health = probe_health(url)
   if health and health.get("status") == "ok":
+    expected = str(project_root.expanduser().resolve())
+    raw_root = health.get("project_root") or health.get("cwd")
+    if raw_root:
+      try:
+        actual = str(Path(str(raw_root)).expanduser().resolve())
+        if actual != expected:
+          return False, {
+            "url": url,
+            "health": health,
+            "external": True,
+            "project_mismatch": True,
+            "expected_root": expected,
+            "actual_root": actual,
+          }
+      except (OSError, ValueError):
+        pass
     return True, {"url": url, "health": health, "external": True}
   return False, state
 
@@ -103,9 +119,19 @@ def start_background_serve(
 ) -> dict[str, Any]:
   root = project_root.expanduser().resolve()
   running, info = is_serve_running(root, host=host, port=port)
+  if info and info.get("project_mismatch"):
+    return {"ok": False, "project_mismatch": True, **info}
   if running:
     return {"ok": True, "already_running": True, **(info or {})}
 
+  preferred_port = port
+  try:
+    from gemcode.web.serve_bind import find_available_port
+
+    port = find_available_port(host, preferred_port)
+  except OSError as exc:
+    return {"ok": False, "error": str(exc), "preferred_port": preferred_port}
+
   log_path = root / ".gemcode" / "web-serve.log"
   log_path.parent.mkdir(parents=True, exist_ok=True)
   log_fh = open(log_path, "a", encoding="utf-8")
@@ -147,7 +173,11 @@ def start_background_serve(
         "log": str(log_path),
       }
       write_serve_state(root, payload)
-      return {"ok": True, "started": True, **payload, "health": health}
+      result = {"ok": True, "started": True, **payload, "health": health}
+      if port != preferred_port:
+        result["preferred_port"] = preferred_port
+        result["port_fallback"] = True
+      return result
   if pid_alive(proc.pid):
     payload = {
       "pid": proc.pid,
@@ -160,7 +190,11 @@ def start_background_serve(
       "warming": True,
     }
     write_serve_state(root, payload)
-    return {"ok": True, "started": True, **payload}
+    result = {"ok": True, "started": True, **payload}
+    if port != preferred_port:
+      result["preferred_port"] = preferred_port
+      result["port_fallback"] = True
+    return result
   return {
     "ok": False,
     "error": f"Server failed to start — see {log_path}",

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/web/server.py

@@ -6,16 +6,20 @@ import argparse
 import json
 import os
 import platform
+import queue
 import re
 import signal
 import subprocess
 import sys
 import threading
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import time
+from http.server import BaseHTTPRequestHandler
 from pathlib import Path
 from typing import Any
 from urllib.parse import parse_qs, urlparse
 
+from gemcode.web.project_root import HostedTenantPathError
+from gemcode.web.serve_bind import bind_http_server, format_connection_lines
 from gemcode.web.serve_state import (
   clear_serve_state,
   serve_base_url,
@@ -25,6 +29,10 @@ from gemcode.web.serve_state import (
 PYTHON = sys.executable
 SERVER_VERSION = "GemCodeServe/1.0"
 
+# SSE / long-turn limits (0 = no server-side turn cap).
+_SSE_KEEPALIVE_S = float(os.environ.get("GEMCODE_WEB_SSE_KEEPALIVE_S", "20"))
+_TURN_TIMEOUT_S = float(os.environ.get("GEMCODE_WEB_TURN_TIMEOUT_S", "0"))
+
 
 def _mock_allowed() -> bool:
   return os.environ.get("GEMCODE_WEB_ALLOW_MOCK", "").lower() in (
@@ -175,8 +183,10 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
         except Exception:
           pass
         has_key = bool(os.environ.get("GOOGLE_API_KEY") or os.environ.get("GEMINI_API_KEY"))
-        body = json.dumps(
-          {
+        from gemcode.web.project_root import hosted_tenant_root
+
+        locked = hosted_tenant_root()
+        health: dict[str, Any] = {
             "status": "ok",
             "service": "gemcode-serve",
             "gemcode": True,
@@ -184,8 +194,13 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
             "mock_mode": _mock_mode_active(),
             "project_root": root,
             "cwd": root,
-          }
-        ).encode()
+            "port": self.server.server_address[1],
+            "url": serve_base_url(self.server.server_address[0], self.server.server_address[1]),
+        }
+        if locked is not None:
+          health["hosted_mode"] = True
+          health["hosted_tenant_root"] = str(locked)
+        body = json.dumps(health).encode()
         self.send_response(200)
         self.send_header("Content-Type", "application/json; charset=utf-8")
         self.send_header("Content-Length", str(len(body)))
@@ -362,6 +377,9 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
           else:
             raw_path = str(data.get("path") or root).strip()
             status, payload = handler(data, raw_path)
+        except HostedTenantPathError as exc:
+          payload = {"ok": False, "error": str(exc)}
+          status = 403
         except Exception as exc:
           payload = {"ok": False, "error": f"{type(exc).__name__}: {exc}"}
           status = 500
@@ -436,18 +454,67 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
 
       self.send_response(200)
       self.send_header("Content-Type", "text/event-stream; charset=utf-8")
-      self.send_header("Cache-Control", "no-cache")
+      self.send_header("Cache-Control", "no-cache, no-transform")
       self.send_header("Connection", "keep-alive")
+      self.send_header("X-Accel-Buffering", "no")
       self._cors()
       self.end_headers()
 
+      try:
+        self.connection.settimeout(None)
+      except Exception:
+        pass
+
+      out_q: queue.Queue[bytes | None] = queue.Queue()
+
+      def _stdout_reader() -> None:
+        try:
+          while proc.stdout is not None:
+            chunk = proc.stdout.read(4096)
+            if not chunk:
+              break
+            out_q.put(chunk)
+        except Exception:
+          pass
+        finally:
+          out_q.put(None)
+
+      threading.Thread(target=_stdout_reader, daemon=True).start()
+
       done_re = re.compile(rb'"type"\s*:\s*"done"')
       saw_done = False
       carry = b""
+      last_activity = time.monotonic()
+      turn_deadline = (
+        time.monotonic() + _TURN_TIMEOUT_S if _TURN_TIMEOUT_S > 0 else None
+      )
       try:
         while True:
-          chunk = proc.stdout.read(4096)
-          if not chunk:
+          if turn_deadline is not None and time.monotonic() > turn_deadline:
+            proc.kill()
+            if not saw_done:
+              payload = json.dumps(
+                {
+                  "type": "error",
+                  "error": (
+                    f"Turn exceeded server limit ({int(_TURN_TIMEOUT_S)}s). "
+                    "Set GEMCODE_WEB_TURN_TIMEOUT_S=0 for no cap."
+                  ),
+                }
+              )
+              self.wfile.write(f"data: {payload}\n\n".encode())
+              self.wfile.write(b'data: {"type": "done"}\n\n')
+              self.wfile.flush()
+            break
+          try:
+            chunk = out_q.get(timeout=5.0)
+          except queue.Empty:
+            if time.monotonic() - last_activity >= _SSE_KEEPALIVE_S:
+              self.wfile.write(b": keepalive\n\n")
+              self.wfile.flush()
+              last_activity = time.monotonic()
+            continue
+          if chunk is None:
             break
           window = carry + chunk
           if not saw_done and done_re.search(window):
@@ -455,11 +522,15 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
           carry = chunk[-64:]
           self.wfile.write(chunk)
           self.wfile.flush()
+          last_activity = time.monotonic()
       except (BrokenPipeError, ConnectionResetError):
         proc.kill()
       finally:
         try:
-          proc.wait(timeout=900)
+          if _TURN_TIMEOUT_S > 0:
+            proc.wait(timeout=max(30.0, _TURN_TIMEOUT_S))
+          else:
+            proc.wait()
         except subprocess.TimeoutExpired:
           proc.kill()
           proc.wait(timeout=5)
@@ -548,7 +619,8 @@ def run_server(
     print(f"[serve] Mesh scheduler bootstrap failed: {exc}", flush=True)
 
   handler = _build_handler(str(root))
-  httpd = ThreadingHTTPServer((host, bind_port), handler)
+  preferred_port = bind_port
+  httpd, bind_port = bind_http_server(host, handler, preferred_port)
   url = serve_base_url(host, bind_port)
 
   def _shutdown(*_args: Any) -> None:
@@ -578,7 +650,12 @@ def run_server(
   print(f"Project root: {root}", flush=True)
   if session_id:
     print(f"CLI session id: {session_id}", flush=True)
-  print("Connect the web UI to this URL (Settings → API URL or NEXT_PUBLIC_API_URL).", flush=True)
+  for line in format_connection_lines(host, bind_port, preferred_port=preferred_port):
+    print(line, flush=True)
+  if _TURN_TIMEOUT_S <= 0:
+    print("[serve] Long turns: no server-side turn timeout (GEMCODE_WEB_TURN_TIMEOUT_S=0)", flush=True)
+  else:
+    print(f"[serve] Long turns: server cap {int(_TURN_TIMEOUT_S)}s (set GEMCODE_WEB_TURN_TIMEOUT_S=0 to disable)", flush=True)
   if _mock_mode_active():
     print("[serve] WARNING: mock mode active (GEMCODE_WEB_ALLOW_MOCK=1)", flush=True)
   else:

{gemcode-0.4.19 → gemcode-0.4.21}/src/gemcode/web/sessions_api.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import uuid
 from pathlib import Path
 from typing import Any
 
@@ -25,22 +26,28 @@ def handle_sessions_post(project_root: str, data: dict[str, Any]) -> tuple[int,
     return 400, {"ok": False, "error": "Invalid project root"}
 
   action = str(data.get("action") or "").strip().lower()
-  session_id = str(data.get("session_id") or "").strip()
-  if not session_id:
-    return 400, {"ok": False, "error": "session_id is required"}
 
   try:
     from gemcode.session_store import name_session, touch_session
 
+    if action == "new":
+      session_id = str(data.get("session_id") or "").strip() or uuid.uuid4().hex
+      touch_session(root, session_id)
+      return 200, {"ok": True, "session_id": session_id, "action": "new"}
+
+    session_id = str(data.get("session_id") or "").strip()
+    if not session_id:
+      return 400, {"ok": False, "error": "session_id is required"}
+
     if action in ("name", "rename"):
       name = str(data.get("name") or "").strip()
       if not name:
         return 400, {"ok": False, "error": "name is required"}
       name_session(root, session_id, name)
       return 200, {"ok": True, "session_id": session_id, "name": name}
-    if action == "touch":
+    if action in ("touch", "resume"):
       touch_session(root, session_id)
-      return 200, {"ok": True, "session_id": session_id}
+      return 200, {"ok": True, "session_id": session_id, "action": action}
     return 400, {"ok": False, "error": f"Unknown action: {action}"}
   except Exception as exc:
     return 500, {"ok": False, "error": f"{type(exc).__name__}: {exc}"}