codeam-cli 2.12.17 → 2.14.0

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.13.0] — 2026-05-16
+
+### Added
+
+- **cli:** Forward CODEAM_VERCEL_BYPASS as x-vercel-protection-bypass
+
+### CI
+
+- **deps:** Cap @types/node major in CLI dependabot config
+
+### Chore
+
+- **deps:** Bump gradle-wrapper in /apps/jetbrains-plugin (#32)
+- **deps:** Bump org.jetbrains.intellij.platform (#29)
+
+## [2.12.17] — 2026-05-16
+
+### Fixed
+
+- **cli:** Submit multi-line composer prompts; document new commands + env vars
+- **vsc-plugin:** Replace placeholder activity bar icon with branded </> mark
+
 ## [2.12.16] — 2026-05-15
 
 ### Documentation

package/dist/index.js

@@ -1018,7 +1018,7 @@ var require_unixTerminal = __commonJS({
     var terminal_1 = require_terminal();
     var utils_1 = require_utils();
     var native = utils_1.loadNativeModule("pty");
-    var pty = native.module;
+    var pty2 = native.module;
     var helperPath = native.dir + "/spawn-helper";
     helperPath = path23.resolve(__dirname, helperPath);
     helperPath = helperPath.replace("app.asar", "app.asar.unpacked");
@@ -1076,7 +1076,7 @@ var require_unixTerminal = __commonJS({
             }
             _this.emit("exit", code, signal);
           };
-          var term = pty.fork(file, args2, parsedEnv, cwd, _this._cols, _this._rows, uid, gid, encoding === "utf8", helperPath, onexit);
+          var term = pty2.fork(file, args2, parsedEnv, cwd, _this._cols, _this._rows, uid, gid, encoding === "utf8", helperPath, onexit);
           _this._socket = new tty.ReadStream(term.fd);
           if (encoding !== null) {
             _this._socket.setEncoding(encoding);
@@ -1164,7 +1164,7 @@ var require_unixTerminal = __commonJS({
           var cols = opt.cols || terminal_1.DEFAULT_COLS;
           var rows = opt.rows || terminal_1.DEFAULT_ROWS;
           var encoding = opt.encoding === void 0 ? "utf8" : opt.encoding;
-          var term = pty.open(cols, rows);
+          var term = pty2.open(cols, rows);
           self._master = new tty.ReadStream(term.master);
           if (encoding !== null) {
             self._master.setEncoding(encoding);
@@ -1215,10 +1215,10 @@ var require_unixTerminal = __commonJS({
            */
           get: function() {
             if (process.platform === "darwin") {
-              var title = pty.process(this._fd);
+              var title = pty2.process(this._fd);
               return title !== "kernel_task" ? title : this._file;
             }
-            return pty.process(this._fd, this._pty) || this._file;
+            return pty2.process(this._fd, this._pty) || this._file;
           },
           enumerable: false,
           configurable: true
@@ -1227,7 +1227,7 @@ var require_unixTerminal = __commonJS({
           if (cols <= 0 || rows <= 0 || isNaN(cols) || isNaN(rows) || cols === Infinity || rows === Infinity) {
             throw new Error("resizing must be done using positive cols and rows");
           }
-          pty.resize(this._fd, cols, rows);
+          pty2.resize(this._fd, cols, rows);
           this._cols = cols;
           this._rows = rows;
         };
@@ -1313,10 +1313,10 @@ var require_lib = __commonJS({
     } else {
       terminalCtor = require_unixTerminal().UnixTerminal;
     }
-    function spawn11(file, args2, opt) {
+    function spawn12(file, args2, opt) {
       return new terminalCtor(file, args2, opt);
     }
-    exports2.spawn = spawn11;
+    exports2.spawn = spawn12;
     function fork(file, args2, opt) {
       return new terminalCtor(file, args2, opt);
     }
@@ -1689,7 +1689,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.12.17",
+  version: "2.14.0",
   description: "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands \u2014 from anywhere.",
   type: "commonjs",
   main: "dist/index.js",
@@ -1817,6 +1817,12 @@ var https = __toESM(require("https"));
 var http = __toESM(require("http"));
 var os2 = __toESM(require("os"));
 
+// src/lib/backend-headers.ts
+function vercelBypassHeader() {
+  const token = process.env.CODEAM_VERCEL_BYPASS;
+  return token ? { "x-vercel-protection-bypass": token } : {};
+}
+
 // src/lib/poll-delay.ts
 var MAX_DELAY_MS = 3e4;
 function computePollDelay({ baseMs, failures }) {
@@ -1915,7 +1921,8 @@ async function _postJson(url, body) {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(data)
+          "Content-Length": Buffer.byteLength(data),
+          ...vercelBypassHeader()
         },
         timeout: 1e4
       },
@@ -1957,6 +1964,7 @@ async function _getJson(url) {
         port: u2.port || (u2.protocol === "https:" ? 443 : 80),
         path: u2.pathname + u2.search,
         method: "GET",
+        headers: { ...vercelBypassHeader() },
         timeout: 1e4
       },
       (res) => {
@@ -2111,7 +2119,7 @@ var CommandRelayService = class {
         port: url.port || (url.protocol === "https:" ? 443 : 80),
         path: `${url.pathname}${url.search}`,
         method: "GET",
-        headers: { Accept: "text/event-stream", "Cache-Control": "no-cache" },
+        headers: { Accept: "text/event-stream", "Cache-Control": "no-cache", ...vercelBypassHeader() },
         timeout: 35e3
       },
       (res) => {
@@ -6468,7 +6476,8 @@ var ChunkEmitter = class {
       // it can route legacy translations / 426 us when we're
       // too far behind. Bumped to 2.0.0 with the discriminated-
       // chunk + delta-chrome refactor in this release.
-      "X-Codeam-Protocol-Version": "2.0.0"
+      "X-Codeam-Protocol-Version": "2.0.0",
+      ...vercelBypassHeader()
     };
     if (opts.pluginAuthToken) {
       this.headers["X-Plugin-Auth-Token"] = opts.pluginAuthToken;
@@ -6780,6 +6789,31 @@ var OutputService = class _OutputService {
       this.dispose();
     }
   }
+  /**
+   * Push a terminal-data chunk for the IDE-integrated terminal
+   * panel. Distinct from chat output: `type: 'terminal_data'`
+   * lets the host filter the SSE stream by terminal session id.
+   * `done: false` because terminal sessions are long-lived — the
+   * `terminal_close` command emits the final chunk separately.
+   */
+  async sendTerminalChunk(terminalSessionId, data) {
+    await this.emitter.send({
+      type: "terminal_data",
+      terminalSessionId,
+      data,
+      done: false
+    });
+  }
+  /** Final chunk for a terminal session — fires when the PTY
+   * exits, so the host can update UI (badge "exit 0", etc). */
+  async sendTerminalExit(terminalSessionId, exitCode) {
+    await this.emitter.send({
+      type: "terminal_exit",
+      terminalSessionId,
+      exitCode,
+      done: true
+    });
+  }
   stopPoll() {
     if (this.pollTimer) {
       clearInterval(this.pollTimer);
@@ -6983,7 +7017,8 @@ function post(endpoint, body) {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(payload)
+          "Content-Length": Buffer.byteLength(payload),
+          ...vercelBypassHeader()
         },
         timeout: 15e3
       },
@@ -7277,7 +7312,7 @@ var HistoryService = class _HistoryService {
     } catch {
       return;
     }
-    const sessions2 = [];
+    const sessions3 = [];
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
       const id = path14.basename(entry.name, ".jsonl");
@@ -7307,11 +7342,11 @@ var HistoryService = class _HistoryService {
         }
       } catch {
       }
-      if (summary) sessions2.push({ id, summary, timestamp: mtime });
+      if (summary) sessions3.push({ id, summary, timestamp: mtime });
     }
-    if (sessions2.length === 0) return;
-    sessions2.sort((a, b) => b.timestamp - a.timestamp);
-    await post("/api/sessions/claude-sessions", { pluginId: this.pluginId, sessions: sessions2 });
+    if (sessions3.length === 0) return;
+    sessions3.sort((a, b) => b.timestamp - a.timestamp);
+    await post("/api/sessions/claude-sessions", { pluginId: this.pluginId, sessions: sessions3 });
   }
   /**
    * Read a specific session's full conversation and POST it to the API in batches.
@@ -7454,7 +7489,7 @@ function buildKeepAlive(ctx) {
 var fs14 = __toESM(require("fs"));
 var os13 = __toESM(require("os"));
 var path17 = __toESM(require("path"));
-var import_crypto = require("crypto");
+var import_crypto2 = require("crypto");
 var import_child_process8 = require("child_process");
 
 // src/lib/payload.ts
@@ -7484,7 +7519,26 @@ var startCommandSchema = import_zod2.z.object({
   message: import_zod2.z.string().max(8e3).optional(),
   paths: import_zod2.z.array(import_zod2.z.string().max(4096)).optional(),
   side: import_zod2.z.enum(["ours", "theirs"]).optional(),
-  limit: import_zod2.z.number().int().min(1).max(500).optional()
+  limit: import_zod2.z.number().int().min(1).max(500).optional(),
+  // search_files options. `query` is the haystack/needle string,
+  // declared above for list_files. The rest mirror VS Code's
+  // search panel toggles + the @codeam/ide-core SearchOptions
+  // contract.
+  caseSensitive: import_zod2.z.boolean().optional(),
+  wholeWord: import_zod2.z.boolean().optional(),
+  regex: import_zod2.z.boolean().optional(),
+  include: import_zod2.z.array(import_zod2.z.string().max(512)).max(64).optional(),
+  exclude: import_zod2.z.array(import_zod2.z.string().max(512)).max(64).optional(),
+  maxResults: import_zod2.z.number().int().min(1).max(500).optional(),
+  // terminal_open / _write / _resize / _close. `sessionId` is the
+  // opaque uuid returned by `terminal_open` and required by every
+  // subsequent op. `data` carries keystrokes (any UTF-8 string).
+  // `cwd` lets the host pin the spawn directory.
+  sessionId: import_zod2.z.string().min(1).max(128).optional(),
+  data: import_zod2.z.string().max(64 * 1024).optional(),
+  cwd: import_zod2.z.string().max(4096).optional(),
+  cols: import_zod2.z.number().int().min(1).max(500).optional(),
+  rows: import_zod2.z.number().int().min(1).max(200).optional()
 });
 function parsePayload(schema, raw) {
   const result = schema.safeParse(raw);
@@ -7842,13 +7896,19 @@ async function gitDiffStaged(file, cwd) {
   return { diff: r.stdout.slice(0, MAX_DIFF_BYTES), truncated };
 }
 async function gitLog(limit = 30, cwd) {
-  const sep2 = "
";
-  const fmt = ["%H", "%h", "%an", "%aI", "%s"].join(sep2);
+  const SEP = "";
+  const fmt = `%H${SEP}%s${SEP}%an${SEP}%ct${SEP}%D`;
   const r = await git(["log", `-n${Math.min(limit, 200)}`, `--pretty=format:${fmt}`], cwd);
   if (r.code !== 0) return { commits: [], error: r.stderr.trim() };
   const commits = r.stdout.split("\n").filter(Boolean).map((line) => {
-    const [hash, shortHash, author, date, subject] = line.split(sep2);
-    return { hash, shortHash, author, date, subject };
+    const [sha, subject, author, ts, refs] = line.split(SEP);
+    return {
+      sha: sha ?? "",
+      subject: subject ?? "",
+      author: author ?? "",
+      timestamp: parseInt(ts ?? "0", 10) * 1e3,
+      refs: (refs ?? "").split(",").map((s) => s.trim().replace(/^HEAD -> /, "")).filter((s) => s.length > 0)
+    };
   });
   return { commits };
 }
@@ -7887,12 +7947,189 @@ async function gitResolve(file, side, cwd) {
   if (add.code !== 0) return { error: add.stderr.trim() || "git add (resolve) failed" };
   return { ok: true };
 }
+var MAX_SEARCH_HITS = 500;
+var MAX_SEARCH_BYTES = 256 * 1024;
+async function searchFiles(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const cap = Math.min(opts.maxResults ?? MAX_SEARCH_HITS, MAX_SEARCH_HITS);
+  if (!opts.query.trim()) return { hits: [], total: 0, truncated: false };
+  const args2 = ["grep", "-n", "--column", "-I"];
+  if (!opts.caseSensitive) args2.push("-i");
+  if (opts.wholeWord) args2.push("-w");
+  if (opts.regex) args2.push("-E");
+  else args2.push("-F");
+  args2.push(opts.query);
+  if (opts.include && opts.include.length > 0) {
+    args2.push("--");
+    for (const p2 of opts.include) args2.push(p2);
+  } else if (opts.exclude && opts.exclude.length > 0) {
+    args2.push("--");
+    args2.push(".");
+  }
+  for (const p2 of opts.exclude ?? []) args2.push(`:!${p2}`);
+  const r = await git(args2, cwd);
+  if (r.code !== 0 && r.code !== 1) {
+    return jsSearchFiles(opts, cwd, cap);
+  }
+  const hits = [];
+  const lines = r.stdout.split("\n");
+  let truncated = false;
+  let byteBudget = MAX_SEARCH_BYTES;
+  for (const line of lines) {
+    if (!line) continue;
+    if (hits.length >= cap) {
+      truncated = true;
+      break;
+    }
+    if (byteBudget <= 0) {
+      truncated = true;
+      break;
+    }
+    byteBudget -= line.length;
+    const m = line.match(/^([^]+?):(\d+):(\d+):(.*)$/);
+    if (!m) continue;
+    const filePath = m[1] ?? "";
+    const lineNo = parseInt(m[2] ?? "0", 10);
+    const col = parseInt(m[3] ?? "1", 10);
+    const text = (m[4] ?? "").slice(0, 400);
+    if (!filePath) continue;
+    hits.push({
+      path: filePath,
+      line: lineNo,
+      column: col,
+      text,
+      matchLength: opts.query.length
+    });
+  }
+  return { hits, total: hits.length, truncated };
+}
+async function jsSearchFiles(opts, cwd, cap) {
+  const files = await listProjectFiles({ cwd, cap: 2e3 });
+  const hits = [];
+  const needle = opts.caseSensitive ? opts.query : opts.query.toLowerCase();
+  let truncated = files.truncated;
+  for (const f of files.files) {
+    if (hits.length >= cap) {
+      truncated = true;
+      break;
+    }
+    let content = "";
+    try {
+      content = await fs13.readFile(path16.join(cwd, f.path), "utf8");
+    } catch {
+      continue;
+    }
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length && hits.length < cap; i++) {
+      const line = lines[i] ?? "";
+      const hay = opts.caseSensitive ? line : line.toLowerCase();
+      const idx = hay.indexOf(needle);
+      if (idx === -1) continue;
+      hits.push({
+        path: f.path,
+        line: i + 1,
+        column: idx + 1,
+        text: line.slice(0, 400),
+        matchLength: opts.query.length
+      });
+    }
+  }
+  return { hits, total: hits.length, truncated };
+}
+
+// src/services/terminal-ops.service.ts
+var import_crypto = require("crypto");
+var pty = __toESM(require_lib());
+var MAX_CONCURRENT_SESSIONS = 4;
+var sessions = /* @__PURE__ */ new Map();
+var onDataHandler = null;
+var onExitHandler = null;
+function registerTerminalHandlers(opts) {
+  onDataHandler = opts.onData;
+  onExitHandler = opts.onExit;
+}
+function defaultShell() {
+  if (process.platform === "win32") {
+    return process.env.COMSPEC ?? "powershell.exe";
+  }
+  return process.env.SHELL ?? "/bin/bash";
+}
+function openTerminal(opts) {
+  if (sessions.size >= MAX_CONCURRENT_SESSIONS) {
+    return { error: `Too many open terminals (max ${MAX_CONCURRENT_SESSIONS})` };
+  }
+  const shell = opts.shell ?? defaultShell();
+  const cwd = opts.cwd ?? process.cwd();
+  const env = {
+    ...process.env,
+    TERM: "xterm-256color",
+    COLORTERM: "truecolor"
+  };
+  env.FORCE_COLOR = "1";
+  try {
+    const term = pty.spawn(shell, [], {
+      name: "xterm-256color",
+      cols: Math.max(1, Math.min(opts.cols ?? 80, 500)),
+      rows: Math.max(1, Math.min(opts.rows ?? 24, 200)),
+      cwd,
+      env,
+      // Windows-specific: ConPTY is the default on Win 10 1809+
+      // and is what we want. node-pty falls back to winpty
+      // automatically on older builds.
+      useConpty: process.platform === "win32" ? true : void 0
+    });
+    const id = (0, import_crypto.randomUUID)();
+    const dataListener = term.onData((data) => {
+      onDataHandler?.({ sessionId: id, data });
+    });
+    const exitListener = term.onExit(({ exitCode }) => {
+      onExitHandler?.({ sessionId: id, exitCode });
+      sessions.delete(id);
+    });
+    sessions.set(id, { id, pty: term, dataListener, exitListener });
+    return { sessionId: id };
+  } catch (e) {
+    return { error: e instanceof Error ? e.message : "spawn failed" };
+  }
+}
+function writeTerminal(sessionId, data) {
+  const s = sessions.get(sessionId);
+  if (!s) return { ok: false, error: "No such session" };
+  try {
+    s.pty.write(data);
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : "write failed" };
+  }
+}
+function resizeTerminal(sessionId, cols, rows) {
+  const s = sessions.get(sessionId);
+  if (!s) return { ok: false, error: "No such session" };
+  try {
+    s.pty.resize(Math.max(1, Math.min(cols, 500)), Math.max(1, Math.min(rows, 200)));
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : "resize failed" };
+  }
+}
+function closeTerminal(sessionId) {
+  const s = sessions.get(sessionId);
+  if (!s) return { ok: true };
+  try {
+    s.dataListener.dispose();
+    s.exitListener.dispose();
+    s.pty.kill();
+  } catch {
+  }
+  sessions.delete(sessionId);
+  return { ok: true };
+}
 
 // src/commands/start/handlers.ts
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path17.join(os13.tmpdir(), `codeam-${(0, import_crypto.randomUUID)()}-${safeName}`);
+    const tmpPath = path17.join(os13.tmpdir(), `codeam-${(0, import_crypto2.randomUUID)()}-${safeName}`);
     fs14.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     return tmpPath;
   });
@@ -8067,7 +8304,7 @@ var shutdownSession = async (ctx, cmd) => {
   ctx.relay.stop();
   process.exit(0);
 };
-var readFile2 = async (ctx, cmd, parsed) => {
+var readFile3 = async (ctx, cmd, parsed) => {
   if (!parsed.path) {
     await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path" });
     return;
@@ -8087,6 +8324,58 @@ var listFiles = async (ctx, cmd, parsed) => {
   const result = await listProjectFiles({ query: parsed.query });
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
+var terminalOpenH = async (ctx, cmd, parsed) => {
+  const r = openTerminal({
+    cols: typeof parsed.cols === "number" ? parsed.cols : void 0,
+    rows: typeof parsed.rows === "number" ? parsed.rows : void 0,
+    cwd: typeof parsed.cwd === "string" ? parsed.cwd : void 0
+  });
+  if ("error" in r) {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: r.error });
+    return;
+  }
+  await ctx.relay.sendResult(cmd.id, "completed", r);
+};
+var terminalWriteH = async (ctx, cmd, parsed) => {
+  if (typeof parsed.sessionId !== "string" || typeof parsed.data !== "string") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId or data" });
+    return;
+  }
+  const r = writeTerminal(parsed.sessionId, parsed.data);
+  await ctx.relay.sendResult(cmd.id, r.ok ? "completed" : "failed", r);
+};
+var terminalResizeH = async (ctx, cmd, parsed) => {
+  if (typeof parsed.sessionId !== "string" || typeof parsed.cols !== "number" || typeof parsed.rows !== "number") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId / cols / rows" });
+    return;
+  }
+  const r = resizeTerminal(parsed.sessionId, parsed.cols, parsed.rows);
+  await ctx.relay.sendResult(cmd.id, r.ok ? "completed" : "failed", r);
+};
+var terminalCloseH = async (ctx, cmd, parsed) => {
+  if (typeof parsed.sessionId !== "string") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId" });
+    return;
+  }
+  const r = closeTerminal(parsed.sessionId);
+  await ctx.relay.sendResult(cmd.id, "completed", r);
+};
+var searchFilesH = async (ctx, cmd, parsed) => {
+  if (!parsed.query || typeof parsed.query !== "string") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing query" });
+    return;
+  }
+  const result = await searchFiles({
+    query: parsed.query,
+    caseSensitive: parsed.caseSensitive,
+    wholeWord: parsed.wholeWord,
+    regex: parsed.regex,
+    include: Array.isArray(parsed.include) ? parsed.include : void 0,
+    exclude: Array.isArray(parsed.exclude) ? parsed.exclude : void 0,
+    maxResults: typeof parsed.maxResults === "number" ? parsed.maxResults : void 0
+  });
+  await ctx.relay.sendResult(cmd.id, "completed", result);
+};
 var gitStatusH = async (ctx, cmd) => {
   const result = await gitStatus();
   await ctx.relay.sendResult(cmd.id, "completed", result);
@@ -8142,9 +8431,14 @@ var handlers = {
   set_keep_alive: setKeepAlive,
   session_terminated: sessionTerminated,
   shutdown_session: shutdownSession,
-  read_file: readFile2,
+  read_file: readFile3,
   write_file: writeFile2,
   list_files: listFiles,
+  search_files: searchFilesH,
+  terminal_open: terminalOpenH,
+  terminal_write: terminalWriteH,
+  terminal_resize: terminalResizeH,
+  terminal_close: terminalCloseH,
   git_status: gitStatusH,
   git_diff: gitDiffH,
   git_diff_staged: gitDiffStagedH,
@@ -8246,6 +8540,14 @@ async function start(requestedAgent) {
     await dispatchCommand(ctx, cmd);
   }, runtime.meta);
   ctx.relay = relay;
+  registerTerminalHandlers({
+    onData: ({ sessionId, data }) => {
+      void outputSvc.sendTerminalChunk(sessionId, data);
+    },
+    onExit: ({ sessionId, exitCode }) => {
+      void outputSvc.sendTerminalExit(sessionId, exitCode);
+    }
+  });
   function sigintHandler() {
     claude.kill();
     outputSvc.dispose();
@@ -8264,7 +8566,7 @@ async function start(requestedAgent) {
 }
 
 // src/commands/pair.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 var import_picocolors3 = __toESM(require("picocolors"));
 
 // src/ui/prompts.ts
@@ -8273,10 +8575,10 @@ async function confirmAction(message) {
   if (q(result)) return false;
   return result;
 }
-async function selectSession(sessions2, activeId) {
+async function selectSession(sessions3, activeId) {
   const result = await _t({
     message: "Select active session:",
-    options: sessions2.map((s) => ({
+    options: sessions3.map((s) => ({
       value: s.id,
       label: `${s.userName}  ${s.plan}`,
       hint: s.id === activeId ? "active" : `paired ${new Date(s.pairedAt).toLocaleDateString()}`
@@ -8327,7 +8629,7 @@ async function pair(args2 = []) {
   const flagAgent = parseAgentFlag(args2);
   const agentId = flagAgent ?? await promptForAgent(config.preferredAgent ?? "claude");
   showIntro();
-  const pluginId = (0, import_crypto2.randomUUID)();
+  const pluginId = (0, import_crypto3.randomUUID)();
   const spin = dist_exports.spinner();
   spin.start("Requesting pairing code...");
   const result = await requestCode(pluginId);
@@ -8383,7 +8685,7 @@ async function pair(args2 = []) {
 // src/commands/pair-auto.ts
 var fs15 = __toESM(require("fs"));
 var os14 = __toESM(require("os"));
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 var API_BASE5 = process.env.CODEAM_API_URL ?? "https://codeagent-mobile-api.vercel.app";
 function fail(msg) {
   console.error(`
@@ -8427,7 +8729,7 @@ async function claim(token, pluginId) {
   };
   const res = await fetch(url, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...vercelBypassHeader() },
     body: JSON.stringify(body)
   });
   const json = await res.json();
@@ -8445,7 +8747,7 @@ async function claim(token, pluginId) {
 }
 async function pairAuto(args2) {
   const token = readTokenFromArgs(args2);
-  const pluginId = (0, import_crypto3.randomUUID)();
+  const pluginId = (0, import_crypto4.randomUUID)();
   console.log("  Claiming pairing token\u2026");
   const claimed = await claim(token, pluginId);
   if (!isKnownAgentId(claimed.agent)) {
@@ -8470,7 +8772,7 @@ async function pairAuto(args2) {
 
 // src/commands/sessions.ts
 var import_picocolors4 = __toESM(require("picocolors"));
-async function sessions(args2) {
+async function sessions2(args2) {
   const [sub, id] = args2;
   if (sub === "switch") return switchSession();
   if (sub === "delete") {
@@ -10515,7 +10817,7 @@ async function stopWorkspaceFromLocal(target) {
 // src/commands/version.ts
 var import_picocolors11 = __toESM(require("picocolors"));
 function version() {
-  const v = true ? "2.12.17" : "unknown";
+  const v = true ? "2.14.0" : "unknown";
   console.log(`${import_picocolors11.default.bold("codeam-cli")} ${import_picocolors11.default.cyan(v)}`);
 }
 
@@ -10654,7 +10956,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.12.17" : null;
+  const current = true ? "2.14.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -10687,7 +10989,7 @@ async function main() {
     case "pair-auto":
       return pairAuto(args);
     case "sessions":
-      return sessions(args);
+      return sessions2(args);
     case "status":
       return status();
     case "logout":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.12.17",
+  "version": "2.14.0",
   "description": "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands — from anywhere.",
   "type": "commonjs",
   "main": "dist/index.js",