kbridge

Per-machine sidecar that bridges a stock kimi web (kap-server) running on loopback to the ex-vu-code gateway over a single outbound WebSocket — no tunnels, no inbound ports, no fork of kap-server.

Quickstart

On any machine with Node.js ≥ 18 and kimi web running:

npm i -g kbridge
kbridge join        # enroll this machine — waits for owner approval
kbridge             # run the sidecar

That's it. No environment variables, no config files to write.

Commands

| Command | What it does | | ------------------------ | --------------------------------------------------------------- | | kbridge / kbridge start [machine] | Run the sidecar (reconnects forever). Default command. | | kbridge join [machine] | Generate a machine credential and enroll; blocks until the owner approves. | | kbridge status | Print the resolved config (secrets redacted) and the local kap-server. | | kbridge logout [machine] | Delete the local credential file. | | kbridge --help | Usage. |

The machine name defaults to the OS hostname. The gateway defaults to wss://kimi.vustudio.network and the kimi home to ~/.kimi-code.

How enrollment works

1. kbridge join generates a random 256-bit secret on your machine and sends only its sha256 hash to the gateway, then polls until the owner approves. Re-running join reuses the same pending credential, so approval can happen across any number of attempts.
2. The owner approves the machine in the gateway's admin UI (/admin/machines). Nothing works before this approval.
3. Once approved, the raw secret is written to ~/.kimi-code/<machine>.json (mode 0600) and kbridge uses it automatically on every start.

Security notes

• Credentials are per-machine. Each machine enrolls with its own secret; there is no shared fleet token to distribute or leak.
• The raw secret never leaves the machine. Only its sha256 hash crosses the wire during enrollment; the gateway stores only the hash.
• Owner approval gates everything. A machine cannot dial in until the owner explicitly approves its enrollment; owners can revoke a machine at any time, which also drops its live connection.
• The credential file is written with mode 0600 inside ~/.kimi-code.
• kbridge status always prints credentials redacted.

Env overrides (optional)

Baked-in defaults work out of the box; these are for development:

| Var | Default | Purpose | | ----------------- | ------------------------------ | --------------------------- | | VU_CODE_URL | wss://kimi.vustudio.network | Gateway WebSocket URL | | VU_CODE_MACHINE | OS hostname | Machine name | | VU_CODE_TOKEN | credential file from join | Explicit machine credential | | KIMI_CODE_HOME | ~/.kimi-code | kimi home / credential dir |

License

MIT