codeam-cli 2.15.8 → 2.16.1

package/dist/index.js

@@ -6,6 +6,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -30,6 +33,38 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/services/pty/types.ts
+var types_exports = {};
+__export(types_exports, {
+  findInPath: () => findInPath
+});
+function findInPath(name) {
+  const isWin = process.platform === "win32";
+  const dirs = (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean);
+  const hasExt = path3.extname(name).length > 0;
+  const candidates = isWin && !hasExt ? [`${name}.exe`, `${name}.cmd`, `${name}.bat`, `${name}.ps1`, name] : [name];
+  const accessFlag = isWin ? fs3.constants.F_OK : fs3.constants.X_OK;
+  for (const dir of dirs) {
+    for (const candidate of candidates) {
+      const full = path3.join(dir, candidate);
+      try {
+        fs3.accessSync(full, accessFlag);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+var fs3, path3;
+var init_types = __esm({
+  "src/services/pty/types.ts"() {
+    "use strict";
+    fs3 = __toESM(require("fs"));
+    path3 = __toESM(require("path"));
+  }
+});
+
 // ../../node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
   "../../node_modules/sisteransi/src/index.js"(exports2, module2) {
@@ -389,7 +424,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.15.8",
+  version: "2.16.1",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -646,10 +681,86 @@ function pollStatus(pluginId, onPaired, onTimeout) {
 }
 var _transport = {
   postJson: _postJson,
-  getJson: _getJson
+  getJson: _getJson,
+  postJsonAuthed: _postJsonAuthed
 };
+async function postLinkCredential(input) {
+  const body = {
+    sessionId: input.sessionId,
+    pluginId: input.pluginId,
+    method: input.method,
+    credential: input.credential
+  };
+  if (input.modelPreference) {
+    body.modelPreference = input.modelPreference;
+  }
+  try {
+    await _transport.postJsonAuthed(
+      `${API_BASE}/api/plugin/agents/${input.agentId}/link`,
+      body,
+      input.pluginAuthToken
+    );
+    return { ok: true };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      status: typeof e.statusCode === "number" ? e.statusCode : 0,
+      message: e.message || "unknown"
+    };
+  }
+}
+async function _postJsonAuthed(url, body, pluginAuthToken) {
+  return new Promise((resolve3, reject) => {
+    const data = JSON.stringify(body);
+    const u2 = new URL(url);
+    const transport = u2.protocol === "https:" ? https : http;
+    const req = transport.request(
+      {
+        hostname: u2.hostname,
+        port: u2.port || (u2.protocol === "https:" ? 443 : 80),
+        path: u2.pathname + u2.search,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(data),
+          "X-Plugin-Auth-Token": pluginAuthToken,
+          ...vercelBypassHeader()
+        },
+        timeout: 15e3
+      },
+      (res) => {
+        res.on("error", reject);
+        let responseBody = "";
+        res.on("data", (chunk) => {
+          responseBody += chunk.toString();
+        });
+        res.on("end", () => {
+          if (res.statusCode && res.statusCode >= 400) {
+            const err = new Error(`HTTP ${res.statusCode}: ${responseBody.slice(0, 200)}`);
+            err.statusCode = res.statusCode;
+            reject(err);
+            return;
+          }
+          try {
+            resolve3(JSON.parse(responseBody));
+          } catch {
+            resolve3(null);
+          }
+        });
+      }
+    );
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("timeout"));
+    });
+    req.write(data);
+    req.end();
+  });
+}
 async function _postJson(url, body) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -678,9 +789,9 @@ async function _postJson(url, body) {
             return;
           }
           try {
-            resolve2(JSON.parse(body2));
+            resolve3(JSON.parse(body2));
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
@@ -695,7 +806,7 @@ async function _postJson(url, body) {
   });
 }
 async function _getJson(url) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
     const req = transport.request(
@@ -719,9 +830,9 @@ async function _getJson(url) {
             return;
           }
           try {
-            resolve2(JSON.parse(body));
+            resolve3(JSON.parse(body));
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
@@ -1029,30 +1140,7 @@ var import_child_process2 = require("child_process");
 var fs4 = __toESM(require("fs"));
 var os4 = __toESM(require("os"));
 var path4 = __toESM(require("path"));
-
-// src/services/pty/types.ts
-var fs3 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
-function findInPath(name) {
-  const isWin = process.platform === "win32";
-  const dirs = (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean);
-  const hasExt = path3.extname(name).length > 0;
-  const candidates = isWin && !hasExt ? [`${name}.exe`, `${name}.cmd`, `${name}.bat`, `${name}.ps1`, name] : [name];
-  const accessFlag = isWin ? fs3.constants.F_OK : fs3.constants.X_OK;
-  for (const dir of dirs) {
-    for (const candidate of candidates) {
-      const full = path3.join(dir, candidate);
-      try {
-        fs3.accessSync(full, accessFlag);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-
-// src/services/pty/unix.strategy.ts
+init_types();
 var PYTHON_PTY_HELPER = `import os,pty,sys,select,signal,struct,fcntl,termios,errno
 m,s=pty.openpty()
 try:
@@ -3365,6 +3453,7 @@ ${c2}
 } }).prompt();
 
 // src/services/claude-installer.ts
+init_types();
 function probeInstallDirs() {
   const home = os5.homedir();
   if (process.platform === "win32") {
@@ -3402,15 +3491,15 @@ function runInstaller() {
     "-Command",
     "irm https://claude.ai/install.ps1 | iex"
   ] : ["-c", "curl -fsSL https://claude.ai/install.sh | bash"];
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const proc = (0, import_child_process4.spawn)(cmd, args2, { stdio: "inherit" });
     proc.on("error", (err) => {
       console.error(`
   \u2717 Installer failed to launch: ${err.message}`);
-      resolve2(false);
+      resolve3(false);
     });
     proc.on("exit", (code) => {
-      resolve2(code === 0);
+      resolve3(code === 0);
     });
   });
 }
@@ -3444,6 +3533,7 @@ async function ensureClaudeInstalled() {
 
 // src/services/claude-resolver.ts
 var path7 = __toESM(require("path"));
+init_types();
 function buildClaudeLaunch(extraArgs = []) {
   const found = findInPath("claude") ?? findInPath("claude-code");
   if (!found) return null;
@@ -3703,6 +3793,7 @@ var fs5 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
 var path8 = __toESM(require("path"));
 var import_child_process5 = require("child_process");
+init_types();
 var HELPER_SCRIPT = `import os,pty,sys,select,signal,struct,fcntl,termios,errno
 m,s=pty.openpty()
 try:
@@ -3758,17 +3849,17 @@ function parseUsageOutput(raw) {
   return { percent, resetAt };
 }
 async function fetchClaudeQuota() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const claudeCmd = findInPath("claude") ? "claude" : "claude-code";
     if (!claudeCmd) {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     const helperPath = path8.join(os6.tmpdir(), "codeam-quota-helper.py");
     fs5.writeFileSync(helperPath, HELPER_SCRIPT, { mode: 420 });
     const python = findInPath("python3") ?? findInPath("python");
     if (!python) {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     const proc = (0, import_child_process5.spawn)(python, [helperPath, claudeCmd, "--tools", ""], {
@@ -3795,13 +3886,13 @@ async function fetchClaudeQuota() {
           fs5.unlinkSync(helperPath);
         } catch {
         }
-        resolve2(result);
+        resolve3(result);
       }, 5e3);
     }, 8e3);
     setTimeout(() => {
       if (!resolved) {
         resolved = true;
-        resolve2(null);
+        resolve3(null);
       }
       try {
         proc.kill();
@@ -4446,6 +4537,7 @@ var ClaudeDeployStrategy = class {
 
 // src/agents/codex/runtime.ts
 var import_node_child_process = require("child_process");
+init_types();
 
 // src/agents/codex/history.ts
 var import_node_fs2 = __toESM(require("fs"));
@@ -5040,13 +5132,13 @@ var CodexRuntimeStrategy = class {
   }
 };
 async function installCodexViaNpm() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const npm = process.platform === "win32" ? "npm.cmd" : "npm";
     const proc = (0, import_node_child_process.spawn)(npm, ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
-      if (code === 0) resolve2();
+      if (code === 0) resolve3();
       else reject(new Error(`npm install -g @openai/codex exited ${code}`));
     });
     proc.on("error", reject);
@@ -5245,14 +5337,14 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const attempt = (attemptsLeft) => {
         _transport2.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
           if (statusCode === 410 || statusCode === 404 && /SESSION_NOT_FOUND|SESSION_GONE/.test(resBody)) {
             process.stderr.write("[codeam] session was deleted/disconnected \u2014 stopping output stream.\n");
             log.info("chunkEmitter", `dead status=${statusCode} took=${tookMs}ms`);
-            resolve2({ dead: true });
+            resolve3({ dead: true });
             return;
           }
           if (statusCode >= 400) {
@@ -5262,7 +5354,7 @@ var ChunkEmitter = class {
           } else {
             log.info("chunkEmitter", `ok status=${statusCode} took=${tookMs}ms`);
           }
-          resolve2({ dead: false });
+          resolve3({ dead: false });
         }).catch((err) => {
           log.warn(
             "chunkEmitter",
@@ -5273,7 +5365,7 @@ var ChunkEmitter = class {
             const delay = 200 * (maxRetries - attemptsLeft + 1);
             setTimeout(() => attempt(attemptsLeft - 1), delay);
           } else {
-            resolve2({ dead: false });
+            resolve3({ dead: false });
           }
         });
       };
@@ -5285,7 +5377,7 @@ var _transport2 = {
   post: _post
 };
 function _post(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https3 : http3;
@@ -5309,7 +5401,7 @@ function _post(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body: resData });
+          resolve3({ statusCode: res.statusCode ?? 0, body: resData });
         });
       }
     );
@@ -5745,7 +5837,7 @@ function parseJsonl(filePath) {
   return messages;
 }
 function post(endpoint, body) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE4}${endpoint}`);
     const transport = u2.protocol === "https:" ? https4 : http4;
@@ -5766,17 +5858,17 @@ function post(endpoint, body) {
         res.resume();
         const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
         if (!ok) log.warn("history:post", `${endpoint} \u2192 HTTP ${res.statusCode}`);
-        resolve2(ok);
+        resolve3(ok);
       }
     );
     req.on("error", (err) => {
       log.warn("history:post", `${endpoint} network error`, err);
-      resolve2(false);
+      resolve3(false);
     });
     req.on("timeout", () => {
       log.warn("history:post", `${endpoint} timeout after 15s`);
       req.destroy();
-      resolve2(false);
+      resolve3(false);
     });
     req.write(payload);
     req.end();
@@ -6258,7 +6350,7 @@ var _transport3 = {
   post: _post2
 };
 function _post2(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https5 : http5;
@@ -6283,7 +6375,7 @@ function _post2(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -6327,9 +6419,9 @@ var FileWatcherService = class {
     if (this.stopped) {
       throw new Error("FileWatcherService has already been stopped \u2014 re-instantiate to restart.");
     }
-    let chokidar;
+    let chokidar2;
     try {
-      chokidar = require("chokidar");
+      chokidar2 = require("chokidar");
     } catch (err) {
       log.warn(
         "fileWatcher",
@@ -6338,7 +6430,7 @@ var FileWatcherService = class {
       );
       return;
     }
-    const watcher = chokidar.watch(this.opts.workingDir, {
+    const watcher = chokidar2.watch(this.opts.workingDir, {
       ignored: [
         /(^|[\\/])\../,
         // dot-files & dot-dirs (.git, .next, .expo, .DS_Store, …)
@@ -6591,12 +6683,12 @@ var _gitSeam = {
   run: _runGitImpl
 };
 async function _runGitImpl(cwd, args2, opts = {}) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let proc;
     try {
       proc = (0, import_child_process7.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     let stdout = "";
@@ -6607,13 +6699,13 @@ async function _runGitImpl(cwd, args2, opts = {}) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve2(null));
+    proc.on("error", () => resolve3(null));
     proc.on("close", (code) => {
       if (code === 0 || opts.allowNonZeroExit) {
-        resolve2(stdout);
+        resolve3(stdout);
       } else {
         log.trace("fileWatcher", `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`);
-        resolve2(null);
+        resolve3(null);
       }
     });
   });
@@ -6633,7 +6725,7 @@ var _transport4 = {
   get: _get
 };
 function _post3(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -6658,7 +6750,7 @@ function _post3(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -6675,7 +6767,7 @@ function _post3(url, headers, payload) {
   });
 }
 function _get(url, headers) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -6699,7 +6791,7 @@ function _get(url, headers) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -7068,7 +7160,7 @@ function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
-    await new Promise((resolve2) => {
+    await new Promise((resolve3) => {
       const proc = (0, import_child_process8.spawn)(
         "gh",
         [
@@ -7082,8 +7174,8 @@ function buildKeepAlive(ctx) {
         { stdio: "ignore", detached: true }
       );
       proc.unref();
-      proc.on("exit", () => resolve2());
-      proc.on("error", () => resolve2());
+      proc.on("exit", () => resolve3());
+      proc.on("error", () => resolve3());
     });
   }
   return {
@@ -8461,7 +8553,7 @@ async function pair(args2 = []) {
     waitSpin.message(waitMessage());
   }, 1e3);
   countdownInterval.unref?.();
-  await new Promise((resolve2) => {
+  await new Promise((resolve3) => {
     let stopPolling = null;
     function sigintHandler() {
       clearInterval(countdownInterval);
@@ -8488,7 +8580,7 @@ async function pair(args2 = []) {
         saveCliConfig({ ...loadCliConfig(), preferredAgent: agentId });
         showSuccess(`Paired with ${info.userName} (${info.plan})`);
         console.log("");
-        resolve2();
+        resolve3();
       },
       () => {
         clearInterval(countdownInterval);
@@ -8521,12 +8613,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path25 = fileFlag.slice("--token-file=".length);
+    const path28 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs15.readFileSync(path25, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path25} is empty`);
+      const content = fs15.readFileSync(path28, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path28} is empty`);
       try {
-        fs15.unlinkSync(path25);
+        fs15.unlinkSync(path28);
       } catch {
       }
       return content;
@@ -8744,12 +8836,12 @@ var GitHubCodespacesProvider = class {
     }
     if (!isAuthed) {
       resetStdinForChild();
-      await new Promise((resolve2, reject) => {
+      await new Promise((resolve3, reject) => {
         const proc = (0, import_child_process12.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
-          if (code === 0) resolve2();
+          if (code === 0) resolve3();
           else reject(new Error("gh auth login failed."));
         });
         proc.on("error", reject);
@@ -8778,13 +8870,13 @@ var GitHubCodespacesProvider = class {
       }
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
-      const refreshCode = await new Promise((resolve2, reject) => {
+      const refreshCode = await new Promise((resolve3, reject) => {
         const proc = (0, import_child_process12.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
         );
-        proc.on("exit", (code) => resolve2(code ?? 1));
+        proc.on("exit", (code) => resolve3(code ?? 1));
         proc.on("error", reject);
       });
       if (refreshCode !== 0) {
@@ -8928,10 +9020,10 @@ var GitHubCodespacesProvider = class {
     if (q(proceed) || !proceed) return;
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
-    const ok = await new Promise((resolve2) => {
+    const ok = await new Promise((resolve3) => {
       const proc = (0, import_child_process12.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
-      proc.on("exit", (code) => resolve2(code === 0));
-      proc.on("error", () => resolve2(false));
+      proc.on("exit", (code) => resolve3(code === 0));
+      proc.on("error", () => resolve3(false));
     });
     if (ok) O2.success("gh installed");
     else O2.error("gh install failed");
@@ -8955,14 +9047,14 @@ var GitHubCodespacesProvider = class {
       "Expanding GitHub scopes"
     );
     resetStdinForChild();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(
           "gh auth refresh failed. Re-run `gh auth refresh -h github.com -s repo,read:org` manually."
         ));
@@ -9133,13 +9225,13 @@ var GitHubCodespacesProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9160,7 +9252,7 @@ var GitHubCodespacesProvider = class {
       "--",
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process12.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -9180,7 +9272,7 @@ var GitHubCodespacesProvider = class {
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
         if (code === 0) {
-          resolve2();
+          resolve3();
         } else {
           const reason = (sshErr || tarErr || `exit ${code}`).trim().slice(0, 500);
           reject(new Error(`Remote tar failed: ${reason}`));
@@ -9198,7 +9290,7 @@ var GitHubCodespacesProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
@@ -9210,7 +9302,7 @@ var GitHubCodespacesProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9300,10 +9392,10 @@ var GitpodProvider = class {
       "Authenticating Gitpod"
     );
     resetStdinForChild2();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("gitpod login failed."));
       });
       proc.on("error", reject);
@@ -9452,13 +9544,13 @@ var GitpodProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9472,7 +9564,7 @@ var GitpodProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -9493,7 +9585,7 @@ var GitpodProvider = class {
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -9508,7 +9600,7 @@ var GitpodProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
@@ -9520,7 +9612,7 @@ var GitpodProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9577,14 +9669,14 @@ var GitLabWorkspacesProvider = class {
       "Authenticating GitLab"
     );
     resetStdinForChild3();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("glab auth login failed."));
       });
       proc.on("error", reject);
@@ -9749,13 +9841,13 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async streamCommand(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9770,7 +9862,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process14.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const ssh = (0, import_child_process14.spawn)(
         "ssh",
@@ -9788,7 +9880,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -9801,7 +9893,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
@@ -9813,7 +9905,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9904,10 +9996,10 @@ var RailwayProvider = class {
       "Authenticating Railway"
     );
     resetStdinForChild4();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("railway login failed."));
       });
       proc.on("error", reject);
@@ -10047,13 +10139,13 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     resetStdinForChild4();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -10071,7 +10163,7 @@ var RailwayProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const sh = (0, import_child_process15.spawn)(
         "railway",
@@ -10089,7 +10181,7 @@ var RailwayProvider = class {
       tar.on("error", reject);
       sh.on("error", reject);
       sh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -10105,7 +10197,7 @@ var RailwayProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
@@ -10117,7 +10209,7 @@ var RailwayProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -10630,74 +10722,427 @@ async function probeCodeamPair(provider, workspace) {
 }
 async function stopWorkspaceFromLocal(target) {
   if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile7 } = await import("child_process");
-    const { promisify: promisify7 } = await import("util");
-    const execFileP7 = promisify7(execFile7);
-    await execFileP7("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
+    const { execFile: execFile8 } = await import("child_process");
+    const { promisify: promisify8 } = await import("util");
+    const execFileP8 = promisify8(execFile8);
+    await execFileP8("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
     return;
   }
 }
 
-// src/commands/version.ts
+// src/commands/link.ts
+var import_node_child_process3 = require("child_process");
+var import_node_crypto = require("crypto");
+var fs18 = __toESM(require("fs"));
+var path26 = __toESM(require("path"));
+var import_chokidar = __toESM(require("chokidar"));
 var import_picocolors11 = __toESM(require("picocolors"));
+
+// src/agents/claude/local-token.ts
+var import_node_child_process2 = require("child_process");
+var fs16 = __toESM(require("fs"));
+var os15 = __toESM(require("os"));
+var path24 = __toESM(require("path"));
+var import_node_util3 = require("util");
+var execFileP7 = (0, import_node_util3.promisify)(import_node_child_process2.execFile);
+var KEYCHAIN_SERVICE_NAMES = [
+  "Claude Code-credentials",
+  "claude-code-credentials",
+  "Claude",
+  "Anthropic Claude"
+];
+function claudeCredentialsPaths() {
+  const home = os15.homedir();
+  return [
+    path24.join(home, ".claude", ".credentials.json"),
+    path24.join(home, ".config", "claude", ".credentials.json")
+  ];
+}
+async function extractLocalClaudeToken() {
+  for (const flat of claudeCredentialsPaths()) {
+    if (!fs16.existsSync(flat)) continue;
+    const credential = fs16.readFileSync(flat, "utf8").trim();
+    if (credential.length > 0) {
+      return { method: "oauth", credential, source: "flat-file" };
+    }
+  }
+  if (process.platform === "darwin") {
+    for (const service of KEYCHAIN_SERVICE_NAMES) {
+      try {
+        const { stdout } = await execFileP7(
+          "security",
+          ["find-generic-password", "-s", service, "-w"],
+          { maxBuffer: 1024 * 1024 }
+        );
+        const credential = stdout.trim();
+        if (credential.length > 0) {
+          return { method: "oauth", credential, source: "macos-keychain" };
+        }
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+
+// src/agents/codex/local-token.ts
+var fs17 = __toESM(require("fs"));
+var os16 = __toESM(require("os"));
+var path25 = __toESM(require("path"));
+function codexCredentialsPath() {
+  return path25.join(os16.homedir(), ".codex", "auth.json");
+}
+async function extractLocalCodexToken() {
+  const file = codexCredentialsPath();
+  if (!fs17.existsSync(file)) return null;
+  const credential = fs17.readFileSync(file, "utf8").trim();
+  if (credential.length === 0) return null;
+  return { method: "oauth", credential, source: "flat-file" };
+}
+function codexCredentialsPaths() {
+  return [codexCredentialsPath()];
+}
+
+// src/commands/link.ts
+var AGENT_META = {
+  claude: {
+    internalId: "claude",
+    publicId: "claude_code",
+    binary: "claude",
+    displayName: "Claude Code",
+    vendor: "Anthropic",
+    credentialsHint: "~/.claude/.credentials.json or the macOS Keychain",
+    watchPaths: claudeCredentialsPaths,
+    extract: extractLocalClaudeToken,
+    ensureInstalled: ensureClaudeInstalled,
+    launchLogin: () => {
+      const child = (0, import_node_child_process3.spawn)("claude", [], { stdio: ["pipe", "inherit", "inherit"] });
+      child.stdin?.write("/login\n");
+      return child;
+    }
+  },
+  codex: {
+    internalId: "codex",
+    publicId: "codex",
+    binary: "codex",
+    displayName: "Codex",
+    vendor: "OpenAI",
+    credentialsHint: "~/.codex/auth.json",
+    watchPaths: codexCredentialsPaths,
+    extract: extractLocalCodexToken,
+    ensureInstalled: async () => {
+      const { findInPath: findInPath2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+      if (findInPath2("codex")) return true;
+      showError(
+        "codex binary not found on PATH. Install it first (https://github.com/openai/codex-cli) then re-run `codeam link codex`."
+      );
+      return false;
+    },
+    launchLogin: () => {
+      return (0, import_node_child_process3.spawn)("codex", ["login"], { stdio: "inherit" });
+    }
+  }
+};
+function parseLinkArgs(args2) {
+  const positional = args2.find((a) => !a.startsWith("--"));
+  if (!positional) {
+    throw new Error(
+      `Usage: codeam link <agent>
+         agent: ${Object.keys(AGENT_META).join(" | ")}`
+    );
+  }
+  const normalised = positional === "claude_code" ? "claude" : positional;
+  if (normalised !== "claude" && normalised !== "codex") {
+    throw new Error(
+      `Unknown agent "${positional}". Valid: ${Object.keys(AGENT_META).join(", ")}`
+    );
+  }
+  const reuseExisting = args2.includes("--reuse-existing");
+  const apiKeyArg = args2.find((a) => a.startsWith("--api-key="));
+  const apiKey = apiKeyArg ? apiKeyArg.slice("--api-key=".length) : null;
+  const tokenFileArg = args2.find((a) => a.startsWith("--token-file="));
+  const tokenFile = tokenFileArg ? tokenFileArg.slice("--token-file=".length) : null;
+  return { agent: normalised, reuseExisting, apiKey, tokenFile };
+}
+async function link(args2 = []) {
+  const parsed = parseLinkArgs(args2);
+  const meta = AGENT_META[parsed.agent];
+  showIntro();
+  console.log(
+    import_picocolors11.default.bold(`  Link ${meta.displayName}`) + import_picocolors11.default.dim(`  \xB7  ${meta.vendor}`)
+  );
+  console.log("");
+  const pluginId = (0, import_node_crypto.randomUUID)();
+  const spin = dist_exports.spinner();
+  spin.start("Requesting pairing code...");
+  const pairing = await requestCode(pluginId);
+  if (!pairing) {
+    spin.stop("Failed");
+    showError("Could not reach the server. Check your connection and try again.");
+    process.exit(1);
+  }
+  spin.stop("Got pairing code");
+  showPairingCode(pairing.code);
+  console.log(import_picocolors11.default.dim("  Scan the QR or enter the code in CodeAgent Mobile."));
+  console.log("");
+  const waitSpin = dist_exports.spinner();
+  const waitMsg = () => `Waiting for mobile pair... \xB7 expires in ${formatRemaining(pairing.expiresAt)}`;
+  waitSpin.start(waitMsg());
+  const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
+  countdown.unref?.();
+  const paired = await new Promise((resolve3, reject) => {
+    let stopPoll = null;
+    const sigint = () => {
+      clearInterval(countdown);
+      stopPoll?.();
+      reject(new Error("cancelled"));
+    };
+    stopPoll = pollStatus(
+      pluginId,
+      (info) => {
+        process.removeListener("SIGINT", sigint);
+        clearInterval(countdown);
+        waitSpin.stop("Paired");
+        resolve3(info);
+      },
+      () => {
+        clearInterval(countdown);
+        waitSpin.stop("Timed out");
+        reject(new Error("Pairing timed out after 5 minutes. Run codeam link again."));
+      }
+    );
+    process.once("SIGINT", sigint);
+  });
+  if (!paired.pluginAuthToken) {
+    showError(
+      "Backend did not return a pluginAuthToken \u2014 upgrade api-v2 (deploy includes the link endpoint)."
+    );
+    process.exit(1);
+  }
+  addSession({
+    id: paired.sessionId,
+    pluginId,
+    userName: paired.userName,
+    userEmail: paired.userEmail,
+    plan: paired.plan,
+    pairedAt: Date.now(),
+    pluginAuthToken: paired.pluginAuthToken,
+    agent: meta.internalId
+  });
+  saveCliConfig({ ...loadCliConfig(), preferredAgent: meta.internalId });
+  if (parsed.apiKey) {
+    await uploadAndSucceed(meta, paired, pluginId, {
+      method: "api_key",
+      credential: parsed.apiKey.trim(),
+      source: "manual"
+    });
+    return;
+  }
+  if (parsed.tokenFile) {
+    const credential = fs18.readFileSync(path26.resolve(parsed.tokenFile), "utf8").trim();
+    if (!credential) {
+      showError(`--token-file ${parsed.tokenFile} is empty.`);
+      process.exit(1);
+    }
+    await uploadAndSucceed(meta, paired, pluginId, {
+      method: "oauth",
+      credential,
+      source: "manual"
+    });
+    return;
+  }
+  const installSpin = dist_exports.spinner();
+  installSpin.start(`Checking that ${meta.binary} is installed...`);
+  const installed = await meta.ensureInstalled();
+  if (!installed) {
+    installSpin.stop("Failed");
+    showError(`Could not install ${meta.displayName}. Install it manually then re-run.`);
+    process.exit(1);
+  }
+  installSpin.stop(`${meta.displayName} is installed`);
+  const existing = await meta.extract();
+  if (existing) {
+    showInfo(`Found existing ${meta.displayName} credentials at ${import_picocolors11.default.bold(existing.source)}.`);
+    await uploadAndSucceed(meta, paired, pluginId, existing);
+    return;
+  }
+  if (parsed.reuseExisting) {
+    showError(
+      `--reuse-existing set, but no local ${meta.displayName} credentials were found at ${meta.credentialsHint}.`
+    );
+    process.exit(1);
+  }
+  showInfo(
+    `No local ${meta.displayName} credentials found. Launching the sign-in \u2014 complete it in your browser, the CLI will detect the new token and finish automatically.`
+  );
+  console.log("");
+  const captured = await captureFreshCredentials(meta);
+  console.log("");
+  await uploadAndSucceed(meta, paired, pluginId, captured);
+}
+async function captureFreshCredentials(meta) {
+  const watcher = import_chokidar.default.watch(meta.watchPaths(), {
+    persistent: true,
+    ignoreInitial: false,
+    awaitWriteFinish: { stabilityThreshold: 500, pollInterval: 100 }
+  });
+  let child = null;
+  let keychainPoll = null;
+  const cleanup = () => {
+    void watcher.close();
+    if (keychainPoll) clearInterval(keychainPoll);
+    if (child && !child.killed) {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }
+  };
+  try {
+    const token = await new Promise((resolve3, reject) => {
+      let settled = false;
+      const tryExtract = async () => {
+        if (settled) return;
+        const t2 = await meta.extract();
+        if (t2 && !settled) {
+          settled = true;
+          resolve3(t2);
+        }
+      };
+      watcher.on("add", () => void tryExtract());
+      watcher.on("change", () => void tryExtract());
+      keychainPoll = setInterval(() => void tryExtract(), 2e3);
+      keychainPoll.unref?.();
+      const sigint = () => {
+        if (settled) return;
+        settled = true;
+        reject(new Error("cancelled"));
+      };
+      process.once("SIGINT", sigint);
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        reject(new Error(`Timed out waiting for ${meta.displayName} sign-in (5 minutes).`));
+      }, 5 * 6e4);
+      child = meta.launchLogin();
+      child.on("exit", () => {
+        void tryExtract().then(() => {
+          if (!settled) {
+            settled = true;
+            reject(
+              new Error(
+                `${meta.binary} exited but no credentials were written at ${meta.credentialsHint}.`
+              )
+            );
+          }
+        });
+      });
+    });
+    cleanup();
+    return token;
+  } catch (err) {
+    cleanup();
+    throw err;
+  }
+}
+async function uploadAndSucceed(meta, paired, pluginId, token) {
+  if (!paired.pluginAuthToken) {
+    showError("Missing pluginAuthToken; re-run codeam link.");
+    process.exit(1);
+  }
+  const uploadSpin = dist_exports.spinner();
+  uploadSpin.start("Sealing credential in your vault...");
+  const result = await postLinkCredential({
+    agentId: meta.publicId,
+    sessionId: paired.sessionId,
+    pluginId,
+    pluginAuthToken: paired.pluginAuthToken,
+    method: token.method,
+    credential: token.credential
+  });
+  if (!result.ok) {
+    uploadSpin.stop("Failed");
+    if (result.status === 401) {
+      showError("Pair token rejected by the backend (401). Re-run `codeam link`.");
+    } else if (result.status === 404) {
+      showError(
+        `${meta.displayName} link endpoint not available on this backend (404). The api-v2 deployment may not yet include the route.`
+      );
+    } else {
+      showError(`Upload failed: ${result.message}`);
+    }
+    process.exit(1);
+  }
+  uploadSpin.stop("Linked");
+  console.log("");
+  showSuccess(`${meta.displayName} is now linked to ${paired.userEmail || paired.userName}.`);
+  showInfo(
+    `Your codespaces and @codeagent mentions can now use ${meta.displayName} without you signing in again.`
+  );
+  console.log("");
+}
+
+// src/commands/version.ts
+var import_picocolors12 = __toESM(require("picocolors"));
 function version() {
-  const v = true ? "2.15.8" : "unknown";
-  console.log(`${import_picocolors11.default.bold("codeam-cli")} ${import_picocolors11.default.cyan(v)}`);
+  const v = true ? "2.16.1" : "unknown";
+  console.log(`${import_picocolors12.default.bold("codeam-cli")} ${import_picocolors12.default.cyan(v)}`);
 }
 
 // src/commands/help.ts
-var import_picocolors12 = __toESM(require("picocolors"));
+var import_picocolors13 = __toESM(require("picocolors"));
 function help() {
   const lines = [
     "",
-    `  ${import_picocolors12.default.bold(import_picocolors12.default.magenta("codeam-cli"))}  ${import_picocolors12.default.dim("\u2014 remote-control AI coding agents from your phone")}`,
+    `  ${import_picocolors13.default.bold(import_picocolors13.default.magenta("codeam-cli"))}  ${import_picocolors13.default.dim("\u2014 remote-control AI coding agents from your phone")}`,
     "",
-    `  ${import_picocolors12.default.bold("Usage")}`,
-    `     ${import_picocolors12.default.cyan("codeam")} ${import_picocolors12.default.dim("[command]")}`,
+    `  ${import_picocolors13.default.bold("Usage")}`,
+    `     ${import_picocolors13.default.cyan("codeam")} ${import_picocolors13.default.dim("[command]")}`,
     "",
-    `  ${import_picocolors12.default.bold("Commands")}`,
-    `     ${import_picocolors12.default.white("codeam")}                       ${import_picocolors12.default.dim("start the active agent with mobile control")}`,
-    `     ${import_picocolors12.default.white("codeam <agent>")}               ${import_picocolors12.default.dim("start a specific agent \u2014 e.g. claude, codex")}`,
-    `     ${import_picocolors12.default.white("codeam pair")}                  ${import_picocolors12.default.dim("pair a new mobile device (interactive)")}`,
-    `     ${import_picocolors12.default.white("codeam pair --agent <id>")}     ${import_picocolors12.default.dim("pair non-interactively for a specific agent")}`,
-    `     ${import_picocolors12.default.white("codeam sessions")}              ${import_picocolors12.default.dim("list paired devices")}`,
-    `     ${import_picocolors12.default.white("codeam sessions switch")}       ${import_picocolors12.default.dim("switch the active paired session")}`,
-    `     ${import_picocolors12.default.white("codeam sessions delete <id>")}  ${import_picocolors12.default.dim("remove a specific paired session")}`,
-    `     ${import_picocolors12.default.white("codeam status")}                ${import_picocolors12.default.dim("show connection info")}`,
-    `     ${import_picocolors12.default.white("codeam logout")}                ${import_picocolors12.default.dim("remove all paired sessions")}`,
-    `     ${import_picocolors12.default.white("codeam deploy")}                ${import_picocolors12.default.dim("provision a cloud workspace (Codespaces) and pair it")}`,
-    `     ${import_picocolors12.default.white("codeam deploy ls | list")}      ${import_picocolors12.default.dim("list deployed cloud workspaces")}`,
-    `     ${import_picocolors12.default.white("codeam deploy stop | remove")}  ${import_picocolors12.default.dim("stop a deployed workspace session")}`,
+    `  ${import_picocolors13.default.bold("Commands")}`,
+    `     ${import_picocolors13.default.white("codeam")}                       ${import_picocolors13.default.dim("start the active agent with mobile control")}`,
+    `     ${import_picocolors13.default.white("codeam <agent>")}               ${import_picocolors13.default.dim("start a specific agent \u2014 e.g. claude, codex")}`,
+    `     ${import_picocolors13.default.white("codeam pair")}                  ${import_picocolors13.default.dim("pair a new mobile device (interactive)")}`,
+    `     ${import_picocolors13.default.white("codeam pair --agent <id>")}     ${import_picocolors13.default.dim("pair non-interactively for a specific agent")}`,
+    `     ${import_picocolors13.default.white("codeam sessions")}              ${import_picocolors13.default.dim("list paired devices")}`,
+    `     ${import_picocolors13.default.white("codeam sessions switch")}       ${import_picocolors13.default.dim("switch the active paired session")}`,
+    `     ${import_picocolors13.default.white("codeam sessions delete <id>")}  ${import_picocolors13.default.dim("remove a specific paired session")}`,
+    `     ${import_picocolors13.default.white("codeam status")}                ${import_picocolors13.default.dim("show connection info")}`,
+    `     ${import_picocolors13.default.white("codeam logout")}                ${import_picocolors13.default.dim("remove all paired sessions")}`,
+    `     ${import_picocolors13.default.white("codeam link <agent>")}          ${import_picocolors13.default.dim("link an agent (claude, codex) to your CodeAgent account")}`,
+    `     ${import_picocolors13.default.white("codeam deploy")}                ${import_picocolors13.default.dim("provision a cloud workspace (Codespaces) and pair it")}`,
+    `     ${import_picocolors13.default.white("codeam deploy ls | list")}      ${import_picocolors13.default.dim("list deployed cloud workspaces")}`,
+    `     ${import_picocolors13.default.white("codeam deploy stop | remove")}  ${import_picocolors13.default.dim("stop a deployed workspace session")}`,
     "",
-    `  ${import_picocolors12.default.bold("Flags")}`,
-    `     ${import_picocolors12.default.white("-v, --version")}                ${import_picocolors12.default.dim("print the CLI version")}`,
-    `     ${import_picocolors12.default.white("-h, --help")}                   ${import_picocolors12.default.dim("show this help")}`,
+    `  ${import_picocolors13.default.bold("Flags")}`,
+    `     ${import_picocolors13.default.white("-v, --version")}                ${import_picocolors13.default.dim("print the CLI version")}`,
+    `     ${import_picocolors13.default.white("-h, --help")}                   ${import_picocolors13.default.dim("show this help")}`,
     "",
-    `  ${import_picocolors12.default.bold("Links")}`,
-    `     ${import_picocolors12.default.dim("Docs:")}     ${import_picocolors12.default.green("https://www.codeagent-mobile.com")}`,
-    `     ${import_picocolors12.default.dim("Issues:")}   ${import_picocolors12.default.green("https://github.com/edgar-durand/codeagent-mobile-clients/issues")}`,
+    `  ${import_picocolors13.default.bold("Links")}`,
+    `     ${import_picocolors13.default.dim("Docs:")}     ${import_picocolors13.default.green("https://www.codeagent-mobile.com")}`,
+    `     ${import_picocolors13.default.dim("Issues:")}   ${import_picocolors13.default.green("https://github.com/edgar-durand/codeagent-mobile-clients/issues")}`,
     ""
   ];
   process.stdout.write(lines.join("\n") + "\n");
 }
 
 // src/lib/updateNotifier.ts
-var fs16 = __toESM(require("fs"));
-var os15 = __toESM(require("os"));
-var path24 = __toESM(require("path"));
+var fs19 = __toESM(require("fs"));
+var os17 = __toESM(require("os"));
+var path27 = __toESM(require("path"));
 var https7 = __toESM(require("https"));
-var import_picocolors13 = __toESM(require("picocolors"));
+var import_picocolors14 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
 var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path24.join(os15.homedir(), ".codeam");
-  return path24.join(dir, "update-check.json");
+  const dir = path27.join(os17.homedir(), ".codeam");
+  return path27.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs16.readFileSync(cachePath(), "utf8");
+    const raw = fs19.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -10708,8 +11153,8 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs16.mkdirSync(path24.dirname(file), { recursive: true });
-    fs16.writeFileSync(file, JSON.stringify(cache));
+    fs19.mkdirSync(path27.dirname(file), { recursive: true });
+    fs19.writeFileSync(file, JSON.stringify(cache));
   } catch {
   }
 }
@@ -10727,14 +11172,14 @@ function compareSemver(a, b) {
   return 0;
 }
 function fetchLatest() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const req = https7.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve2(null);
+          resolve3(null);
           return;
         }
         let buf = "";
@@ -10746,30 +11191,30 @@ function fetchLatest() {
           try {
             const json = JSON.parse(buf);
             if (typeof json.version === "string") {
-              resolve2(json.version);
+              resolve3(json.version);
             } else {
-              resolve2(null);
+              resolve3(null);
             }
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve2(null);
+      resolve3(null);
     });
-    req.on("error", () => resolve2(null));
+    req.on("error", () => resolve3(null));
   });
 }
 function notifyIfStale(currentVersion, latest) {
   if (compareSemver(latest, currentVersion) <= 0) return;
-  const arrow = import_picocolors13.default.dim("\u2192");
-  const cmd = import_picocolors13.default.cyan("npm install -g codeam-cli");
+  const arrow = import_picocolors14.default.dim("\u2192");
+  const cmd = import_picocolors14.default.cyan("npm install -g codeam-cli");
   const lines = [
     "",
-    `  ${import_picocolors13.default.yellow("\u25CF")} ${import_picocolors13.default.bold("Update available")} ${import_picocolors13.default.dim(currentVersion)} ${arrow} ${import_picocolors13.default.green(latest)}`,
+    `  ${import_picocolors14.default.yellow("\u25CF")} ${import_picocolors14.default.bold("Update available")} ${import_picocolors14.default.dim(currentVersion)} ${arrow} ${import_picocolors14.default.green(latest)}`,
     `    Run ${cmd} to upgrade.`,
     ""
   ];
@@ -10780,7 +11225,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.15.8" : null;
+  const current = true ? "2.16.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -10818,6 +11263,8 @@ async function main() {
       return status();
     case "logout":
       return logout();
+    case "link":
+      return link(args);
     case "deploy":
       if (args[0] === "ls" || args[0] === "list") return deployList();
       if (args[0] === "stop" || args[0] === "remove") return deployStop();