codeam-cli 2.16.0 → 2.16.2

package/dist/index.js

@@ -6,6 +6,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -30,6 +33,38 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/services/pty/types.ts
+var types_exports = {};
+__export(types_exports, {
+  findInPath: () => findInPath
+});
+function findInPath(name) {
+  const isWin = process.platform === "win32";
+  const dirs = (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean);
+  const hasExt = path3.extname(name).length > 0;
+  const candidates = isWin && !hasExt ? [`${name}.exe`, `${name}.cmd`, `${name}.bat`, `${name}.ps1`, name] : [name];
+  const accessFlag = isWin ? fs3.constants.F_OK : fs3.constants.X_OK;
+  for (const dir of dirs) {
+    for (const candidate of candidates) {
+      const full = path3.join(dir, candidate);
+      try {
+        fs3.accessSync(full, accessFlag);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+var fs3, path3;
+var init_types = __esm({
+  "src/services/pty/types.ts"() {
+    "use strict";
+    fs3 = __toESM(require("fs"));
+    path3 = __toESM(require("path"));
+  }
+});
+
 // ../../node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
   "../../node_modules/sisteransi/src/index.js"(exports2, module2) {
@@ -389,7 +424,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.16.0",
+  version: "2.16.2",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -676,7 +711,7 @@ async function postLinkCredential(input) {
   }
 }
 async function _postJsonAuthed(url, body, pluginAuthToken) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -708,9 +743,9 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
             return;
           }
           try {
-            resolve2(JSON.parse(responseBody));
+            resolve3(JSON.parse(responseBody));
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
@@ -725,7 +760,7 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
   });
 }
 async function _postJson(url, body) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -754,9 +789,9 @@ async function _postJson(url, body) {
             return;
           }
           try {
-            resolve2(JSON.parse(body2));
+            resolve3(JSON.parse(body2));
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
@@ -771,7 +806,7 @@ async function _postJson(url, body) {
   });
 }
 async function _getJson(url) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
     const req = transport.request(
@@ -795,9 +830,9 @@ async function _getJson(url) {
             return;
           }
           try {
-            resolve2(JSON.parse(body));
+            resolve3(JSON.parse(body));
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
@@ -1105,30 +1140,7 @@ var import_child_process2 = require("child_process");
 var fs4 = __toESM(require("fs"));
 var os4 = __toESM(require("os"));
 var path4 = __toESM(require("path"));
-
-// src/services/pty/types.ts
-var fs3 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
-function findInPath(name) {
-  const isWin = process.platform === "win32";
-  const dirs = (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean);
-  const hasExt = path3.extname(name).length > 0;
-  const candidates = isWin && !hasExt ? [`${name}.exe`, `${name}.cmd`, `${name}.bat`, `${name}.ps1`, name] : [name];
-  const accessFlag = isWin ? fs3.constants.F_OK : fs3.constants.X_OK;
-  for (const dir of dirs) {
-    for (const candidate of candidates) {
-      const full = path3.join(dir, candidate);
-      try {
-        fs3.accessSync(full, accessFlag);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-
-// src/services/pty/unix.strategy.ts
+init_types();
 var PYTHON_PTY_HELPER = `import os,pty,sys,select,signal,struct,fcntl,termios,errno
 m,s=pty.openpty()
 try:
@@ -3441,6 +3453,7 @@ ${c2}
 } }).prompt();
 
 // src/services/claude-installer.ts
+init_types();
 function probeInstallDirs() {
   const home = os5.homedir();
   if (process.platform === "win32") {
@@ -3478,15 +3491,15 @@ function runInstaller() {
     "-Command",
     "irm https://claude.ai/install.ps1 | iex"
   ] : ["-c", "curl -fsSL https://claude.ai/install.sh | bash"];
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const proc = (0, import_child_process4.spawn)(cmd, args2, { stdio: "inherit" });
     proc.on("error", (err) => {
       console.error(`
   \u2717 Installer failed to launch: ${err.message}`);
-      resolve2(false);
+      resolve3(false);
     });
     proc.on("exit", (code) => {
-      resolve2(code === 0);
+      resolve3(code === 0);
     });
   });
 }
@@ -3520,6 +3533,7 @@ async function ensureClaudeInstalled() {
 
 // src/services/claude-resolver.ts
 var path7 = __toESM(require("path"));
+init_types();
 function buildClaudeLaunch(extraArgs = []) {
   const found = findInPath("claude") ?? findInPath("claude-code");
   if (!found) return null;
@@ -3779,6 +3793,7 @@ var fs5 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
 var path8 = __toESM(require("path"));
 var import_child_process5 = require("child_process");
+init_types();
 var HELPER_SCRIPT = `import os,pty,sys,select,signal,struct,fcntl,termios,errno
 m,s=pty.openpty()
 try:
@@ -3834,17 +3849,17 @@ function parseUsageOutput(raw) {
   return { percent, resetAt };
 }
 async function fetchClaudeQuota() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const claudeCmd = findInPath("claude") ? "claude" : "claude-code";
     if (!claudeCmd) {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     const helperPath = path8.join(os6.tmpdir(), "codeam-quota-helper.py");
     fs5.writeFileSync(helperPath, HELPER_SCRIPT, { mode: 420 });
     const python = findInPath("python3") ?? findInPath("python");
     if (!python) {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     const proc = (0, import_child_process5.spawn)(python, [helperPath, claudeCmd, "--tools", ""], {
@@ -3871,13 +3886,13 @@ async function fetchClaudeQuota() {
           fs5.unlinkSync(helperPath);
         } catch {
         }
-        resolve2(result);
+        resolve3(result);
       }, 5e3);
     }, 8e3);
     setTimeout(() => {
       if (!resolved) {
         resolved = true;
-        resolve2(null);
+        resolve3(null);
       }
       try {
         proc.kill();
@@ -4522,6 +4537,7 @@ var ClaudeDeployStrategy = class {
 
 // src/agents/codex/runtime.ts
 var import_node_child_process = require("child_process");
+init_types();
 
 // src/agents/codex/history.ts
 var import_node_fs2 = __toESM(require("fs"));
@@ -5116,13 +5132,13 @@ var CodexRuntimeStrategy = class {
   }
 };
 async function installCodexViaNpm() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const npm = process.platform === "win32" ? "npm.cmd" : "npm";
     const proc = (0, import_node_child_process.spawn)(npm, ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
-      if (code === 0) resolve2();
+      if (code === 0) resolve3();
       else reject(new Error(`npm install -g @openai/codex exited ${code}`));
     });
     proc.on("error", reject);
@@ -5321,14 +5337,14 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const attempt = (attemptsLeft) => {
         _transport2.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
           if (statusCode === 410 || statusCode === 404 && /SESSION_NOT_FOUND|SESSION_GONE/.test(resBody)) {
             process.stderr.write("[codeam] session was deleted/disconnected \u2014 stopping output stream.\n");
             log.info("chunkEmitter", `dead status=${statusCode} took=${tookMs}ms`);
-            resolve2({ dead: true });
+            resolve3({ dead: true });
             return;
           }
           if (statusCode >= 400) {
@@ -5338,7 +5354,7 @@ var ChunkEmitter = class {
           } else {
             log.info("chunkEmitter", `ok status=${statusCode} took=${tookMs}ms`);
           }
-          resolve2({ dead: false });
+          resolve3({ dead: false });
         }).catch((err) => {
           log.warn(
             "chunkEmitter",
@@ -5349,7 +5365,7 @@ var ChunkEmitter = class {
             const delay = 200 * (maxRetries - attemptsLeft + 1);
             setTimeout(() => attempt(attemptsLeft - 1), delay);
           } else {
-            resolve2({ dead: false });
+            resolve3({ dead: false });
           }
         });
       };
@@ -5361,7 +5377,7 @@ var _transport2 = {
   post: _post
 };
 function _post(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https3 : http3;
@@ -5385,7 +5401,7 @@ function _post(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body: resData });
+          resolve3({ statusCode: res.statusCode ?? 0, body: resData });
         });
       }
     );
@@ -5821,7 +5837,7 @@ function parseJsonl(filePath) {
   return messages;
 }
 function post(endpoint, body) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE4}${endpoint}`);
     const transport = u2.protocol === "https:" ? https4 : http4;
@@ -5842,17 +5858,17 @@ function post(endpoint, body) {
         res.resume();
         const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
         if (!ok) log.warn("history:post", `${endpoint} \u2192 HTTP ${res.statusCode}`);
-        resolve2(ok);
+        resolve3(ok);
       }
     );
     req.on("error", (err) => {
       log.warn("history:post", `${endpoint} network error`, err);
-      resolve2(false);
+      resolve3(false);
     });
     req.on("timeout", () => {
       log.warn("history:post", `${endpoint} timeout after 15s`);
       req.destroy();
-      resolve2(false);
+      resolve3(false);
     });
     req.write(payload);
     req.end();
@@ -6246,6 +6262,7 @@ var HistoryService = class _HistoryService {
 
 // src/services/file-watcher.service.ts
 var import_child_process7 = require("child_process");
+var os13 = __toESM(require("os"));
 var path15 = __toESM(require("path"));
 
 // src/services/file-watcher/diff-parser.ts
@@ -6334,7 +6351,7 @@ var _transport3 = {
   post: _post2
 };
 function _post2(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https5 : http5;
@@ -6359,7 +6376,7 @@ function _post2(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -6381,6 +6398,44 @@ var API_BASE5 = process.env.CODEAM_API_URL ?? DEFAULT_API_BASE_URL;
 var DEBOUNCE_MS = 250;
 var MAX_RETRIES = 2;
 var RETRY_BACKOFF_MS = 300;
+var WINDOWS_LEGACY_JUNCTIONS = [
+  /[\\/]Application Data([\\/]|$)/i,
+  /[\\/]Cookies([\\/]|$)/i,
+  /[\\/]Local Settings([\\/]|$)/i,
+  /[\\/]My Documents([\\/]|$)/i,
+  /[\\/]NetHood([\\/]|$)/i,
+  /[\\/]PrintHood([\\/]|$)/i,
+  /[\\/]Recent([\\/]|$)/i,
+  /[\\/]SendTo([\\/]|$)/i,
+  /[\\/]Start Menu([\\/]|$)/i,
+  /[\\/]Templates([\\/]|$)/i
+];
+function isUnsafeWindowsWatchRoot(dir, homedir12) {
+  const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
+  const cwd = norm(dir);
+  const home = norm(homedir12);
+  if (cwd === home) return true;
+  if (/^[a-z]:$/.test(cwd)) return true;
+  const sysRoots = [
+    "c:\\windows",
+    "c:\\program files",
+    "c:\\program files (x86)",
+    "c:\\programdata"
+  ];
+  for (const root of sysRoots) {
+    if (cwd === root || cwd.startsWith(root + "\\")) return true;
+  }
+  return false;
+}
+var _chokidarSeam = {
+  load: () => {
+    try {
+      return require("chokidar");
+    } catch {
+      return null;
+    }
+  }
+};
 var FileWatcherService = class {
   constructor(opts) {
     this.opts = opts;
@@ -6403,18 +6458,23 @@ var FileWatcherService = class {
     if (this.stopped) {
       throw new Error("FileWatcherService has already been stopped \u2014 re-instantiate to restart.");
     }
-    let chokidar;
-    try {
-      chokidar = require("chokidar");
-    } catch (err) {
+    const isWin = process.platform === "win32";
+    if (isWin && isUnsafeWindowsWatchRoot(this.opts.workingDir, os13.homedir())) {
+      log.warn(
+        "fileWatcher",
+        `refusing to watch ${this.opts.workingDir} \u2014 looks like a Windows user-profile or system path. Run codeam from your project folder to enable file change emission.`
+      );
+      return;
+    }
+    const chokidar2 = _chokidarSeam.load();
+    if (!chokidar2) {
       log.warn(
         "fileWatcher",
-        `chokidar unavailable \u2014 file change emission disabled`,
-        err
+        `chokidar unavailable \u2014 file change emission disabled`
       );
       return;
     }
-    const watcher = chokidar.watch(this.opts.workingDir, {
+    const watcher = chokidar2.watch(this.opts.workingDir, {
       ignored: [
         /(^|[\\/])\../,
         // dot-files & dot-dirs (.git, .next, .expo, .DS_Store, …)
@@ -6428,11 +6488,22 @@ var FileWatcherService = class {
         /\.parcel-cache/,
         // Build outputs that aren't a typical "dist" target
         /target\//,
-        /__pycache__/
+        /__pycache__/,
+        // Windows-only: skip legacy user-profile junctions whose ACLs
+        // throw EPERM during chokidar's recursive traversal.
+        ...isWin ? WINDOWS_LEGACY_JUNCTIONS : []
       ],
       ignoreInitial: true,
       // we only care about post-start changes
       persistent: true,
+      // Windows-only safety net: don't follow reparse points, and let
+      // chokidar swallow EPERM/EACCES on unreadable paths instead of
+      // bubbling them up as fatal errors. Both are no-ops on macOS
+      // (fsevents traversal doesn't fail on permission errors).
+      ...isWin ? {
+        followSymlinks: false,
+        ignorePermissionErrors: true
+      } : {},
       awaitWriteFinish: {
         // Coalesces rapid sequential writes (npm install spam, build
         // tools emitting bursts). Lower than chokidar's default so
@@ -6445,6 +6516,13 @@ var FileWatcherService = class {
     watcher.on("add", (filePath) => this.schedule(filePath, "add"));
     watcher.on("change", (filePath) => this.schedule(filePath, "change"));
     watcher.on("unlink", (filePath) => this.schedule(filePath, "unlink"));
+    watcher.on("error", (err) => {
+      const code = err?.code ?? "unknown";
+      log.warn(
+        "fileWatcher",
+        `chokidar error (code=${code}) \u2014 watcher continues: ${err}`
+      );
+    });
     this.watcher = watcher;
     log.info(
       "fileWatcher",
@@ -6667,12 +6745,12 @@ var _gitSeam = {
   run: _runGitImpl
 };
 async function _runGitImpl(cwd, args2, opts = {}) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let proc;
     try {
       proc = (0, import_child_process7.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     let stdout = "";
@@ -6683,13 +6761,13 @@ async function _runGitImpl(cwd, args2, opts = {}) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve2(null));
+    proc.on("error", () => resolve3(null));
     proc.on("close", (code) => {
       if (code === 0 || opts.allowNonZeroExit) {
-        resolve2(stdout);
+        resolve3(stdout);
       } else {
         log.trace("fileWatcher", `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`);
-        resolve2(null);
+        resolve3(null);
       }
     });
   });
@@ -6709,7 +6787,7 @@ var _transport4 = {
   get: _get
 };
 function _post3(url, headers, payload) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -6734,7 +6812,7 @@ function _post3(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -6751,7 +6829,7 @@ function _post3(url, headers, payload) {
   });
 }
 function _get(url, headers) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -6775,7 +6853,7 @@ function _get(url, headers) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve2({ statusCode: res.statusCode ?? 0, body });
+          resolve3({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -7144,7 +7222,7 @@ function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
-    await new Promise((resolve2) => {
+    await new Promise((resolve3) => {
       const proc = (0, import_child_process8.spawn)(
         "gh",
         [
@@ -7158,8 +7236,8 @@ function buildKeepAlive(ctx) {
         { stdio: "ignore", detached: true }
       );
       proc.unref();
-      proc.on("exit", () => resolve2());
-      proc.on("error", () => resolve2());
+      proc.on("exit", () => resolve3());
+      proc.on("error", () => resolve3());
     });
   }
   return {
@@ -7183,7 +7261,7 @@ function buildKeepAlive(ctx) {
 
 // src/commands/start/handlers.ts
 var fs14 = __toESM(require("fs"));
-var os13 = __toESM(require("os"));
+var os14 = __toESM(require("os"));
 var path19 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
 var import_child_process11 = require("child_process");
@@ -7991,7 +8069,7 @@ function closeTerminal(sessionId) {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path19.join(os13.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
+    const tmpPath = path19.join(os14.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
     fs14.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     return tmpPath;
   });
@@ -8537,7 +8615,7 @@ async function pair(args2 = []) {
     waitSpin.message(waitMessage());
   }, 1e3);
   countdownInterval.unref?.();
-  await new Promise((resolve2) => {
+  await new Promise((resolve3) => {
     let stopPolling = null;
     function sigintHandler() {
       clearInterval(countdownInterval);
@@ -8564,7 +8642,7 @@ async function pair(args2 = []) {
         saveCliConfig({ ...loadCliConfig(), preferredAgent: agentId });
         showSuccess(`Paired with ${info.userName} (${info.plan})`);
         console.log("");
-        resolve2();
+        resolve3();
       },
       () => {
         clearInterval(countdownInterval);
@@ -8580,7 +8658,7 @@ async function pair(args2 = []) {
 
 // src/commands/pair-auto.ts
 var fs15 = __toESM(require("fs"));
-var os14 = __toESM(require("os"));
+var os15 = __toESM(require("os"));
 var import_crypto5 = require("crypto");
 var API_BASE7 = process.env.CODEAM_API_URL ?? DEFAULT_API_BASE_URL;
 function fail(msg) {
@@ -8597,12 +8675,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path27 = fileFlag.slice("--token-file=".length);
+    const path28 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs15.readFileSync(path27, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path27} is empty`);
+      const content = fs15.readFileSync(path28, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path28} is empty`);
       try {
-        fs15.unlinkSync(path27);
+        fs15.unlinkSync(path28);
       } catch {
       }
       return content;
@@ -8620,7 +8698,7 @@ async function claim(token, pluginId) {
     pluginId,
     ideName: "codeam-cli (codespace)",
     ideVersion: process.env.npm_package_version ?? "unknown",
-    hostname: os14.hostname(),
+    hostname: os15.hostname(),
     codespaceName: process.env.CODESPACE_NAME ?? "",
     // Current git branch of the codespace's working directory, so the
     // backend can populate `PairedSession.branch` for the codespace pair.
@@ -8820,12 +8898,12 @@ var GitHubCodespacesProvider = class {
     }
     if (!isAuthed) {
       resetStdinForChild();
-      await new Promise((resolve2, reject) => {
+      await new Promise((resolve3, reject) => {
         const proc = (0, import_child_process12.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
-          if (code === 0) resolve2();
+          if (code === 0) resolve3();
           else reject(new Error("gh auth login failed."));
         });
         proc.on("error", reject);
@@ -8854,13 +8932,13 @@ var GitHubCodespacesProvider = class {
       }
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
-      const refreshCode = await new Promise((resolve2, reject) => {
+      const refreshCode = await new Promise((resolve3, reject) => {
         const proc = (0, import_child_process12.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
         );
-        proc.on("exit", (code) => resolve2(code ?? 1));
+        proc.on("exit", (code) => resolve3(code ?? 1));
         proc.on("error", reject);
       });
       if (refreshCode !== 0) {
@@ -9004,10 +9082,10 @@ var GitHubCodespacesProvider = class {
     if (q(proceed) || !proceed) return;
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
-    const ok = await new Promise((resolve2) => {
+    const ok = await new Promise((resolve3) => {
       const proc = (0, import_child_process12.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
-      proc.on("exit", (code) => resolve2(code === 0));
-      proc.on("error", () => resolve2(false));
+      proc.on("exit", (code) => resolve3(code === 0));
+      proc.on("error", () => resolve3(false));
     });
     if (ok) O2.success("gh installed");
     else O2.error("gh install failed");
@@ -9031,14 +9109,14 @@ var GitHubCodespacesProvider = class {
       "Expanding GitHub scopes"
     );
     resetStdinForChild();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(
           "gh auth refresh failed. Re-run `gh auth refresh -h github.com -s repo,read:org` manually."
         ));
@@ -9209,13 +9287,13 @@ var GitHubCodespacesProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9236,7 +9314,7 @@ var GitHubCodespacesProvider = class {
       "--",
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process12.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -9256,7 +9334,7 @@ var GitHubCodespacesProvider = class {
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
         if (code === 0) {
-          resolve2();
+          resolve3();
         } else {
           const reason = (sshErr || tarErr || `exit ${code}`).trim().slice(0, 500);
           reject(new Error(`Remote tar failed: ${reason}`));
@@ -9274,7 +9352,7 @@ var GitHubCodespacesProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process12.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
@@ -9286,7 +9364,7 @@ var GitHubCodespacesProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9376,10 +9454,10 @@ var GitpodProvider = class {
       "Authenticating Gitpod"
     );
     resetStdinForChild2();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("gitpod login failed."));
       });
       proc.on("error", reject);
@@ -9528,13 +9606,13 @@ var GitpodProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9548,7 +9626,7 @@ var GitpodProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -9569,7 +9647,7 @@ var GitpodProvider = class {
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -9584,7 +9662,7 @@ var GitpodProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process13.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
@@ -9596,7 +9674,7 @@ var GitpodProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9653,14 +9731,14 @@ var GitLabWorkspacesProvider = class {
       "Authenticating GitLab"
     );
     resetStdinForChild3();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("glab auth login failed."));
       });
       proc.on("error", reject);
@@ -9825,13 +9903,13 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async streamCommand(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -9846,7 +9924,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process14.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const ssh = (0, import_child_process14.spawn)(
         "ssh",
@@ -9864,7 +9942,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -9877,7 +9955,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process14.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
@@ -9889,7 +9967,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -9980,10 +10058,10 @@ var RailwayProvider = class {
       "Authenticating Railway"
     );
     resetStdinForChild4();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error("railway login failed."));
       });
       proc.on("error", reject);
@@ -10123,13 +10201,13 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     resetStdinForChild4();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve3({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -10147,7 +10225,7 @@ var RailwayProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const sh = (0, import_child_process15.spawn)(
         "railway",
@@ -10165,7 +10243,7 @@ var RailwayProvider = class {
       tar.on("error", reject);
       sh.on("error", reject);
       sh.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -10181,7 +10259,7 @@ var RailwayProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const proc = (0, import_child_process15.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
@@ -10193,7 +10271,7 @@ var RailwayProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve2();
+        if (code === 0) resolve3();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -10717,57 +10795,64 @@ async function stopWorkspaceFromLocal(target) {
 // src/commands/link.ts
 var import_node_child_process3 = require("child_process");
 var import_node_crypto = require("crypto");
+var fs18 = __toESM(require("fs"));
+var path26 = __toESM(require("path"));
+var import_chokidar = __toESM(require("chokidar"));
 var import_picocolors11 = __toESM(require("picocolors"));
 
 // src/agents/claude/local-token.ts
 var import_node_child_process2 = require("child_process");
 var fs16 = __toESM(require("fs"));
-var os15 = __toESM(require("os"));
+var os16 = __toESM(require("os"));
 var path24 = __toESM(require("path"));
 var import_node_util3 = require("util");
 var execFileP7 = (0, import_node_util3.promisify)(import_node_child_process2.execFile);
-function claudeCredentialsPath() {
-  return path24.join(os15.homedir(), ".claude", ".credentials.json");
+var KEYCHAIN_SERVICE_NAMES = [
+  "Claude Code-credentials",
+  "claude-code-credentials",
+  "Claude",
+  "Anthropic Claude"
+];
+function claudeCredentialsPaths() {
+  const home = os16.homedir();
+  return [
+    path24.join(home, ".claude", ".credentials.json"),
+    path24.join(home, ".config", "claude", ".credentials.json")
+  ];
 }
 async function extractLocalClaudeToken() {
-  const flat = claudeCredentialsPath();
-  if (fs16.existsSync(flat)) {
+  for (const flat of claudeCredentialsPaths()) {
+    if (!fs16.existsSync(flat)) continue;
     const credential = fs16.readFileSync(flat, "utf8").trim();
     if (credential.length > 0) {
       return { method: "oauth", credential, source: "flat-file" };
     }
   }
   if (process.platform === "darwin") {
-    try {
-      const { stdout } = await execFileP7(
-        "security",
-        ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
-        { maxBuffer: 1024 * 1024 }
-      );
-      const credential = stdout.trim();
-      if (credential.length > 0) {
-        return { method: "oauth", credential, source: "macos-keychain" };
+    for (const service of KEYCHAIN_SERVICE_NAMES) {
+      try {
+        const { stdout } = await execFileP7(
+          "security",
+          ["find-generic-password", "-s", service, "-w"],
+          { maxBuffer: 1024 * 1024 }
+        );
+        const credential = stdout.trim();
+        if (credential.length > 0) {
+          return { method: "oauth", credential, source: "macos-keychain" };
+        }
+      } catch {
       }
-    } catch {
     }
   }
   return null;
 }
-function claudeCredentialsMtime() {
-  const flat = claudeCredentialsPath();
-  try {
-    return fs16.statSync(flat).mtimeMs;
-  } catch {
-    return null;
-  }
-}
 
 // src/agents/codex/local-token.ts
 var fs17 = __toESM(require("fs"));
-var os16 = __toESM(require("os"));
+var os17 = __toESM(require("os"));
 var path25 = __toESM(require("path"));
 function codexCredentialsPath() {
-  return path25.join(os16.homedir(), ".codex", "auth.json");
+  return path25.join(os17.homedir(), ".codex", "auth.json");
 }
 async function extractLocalCodexToken() {
   const file = codexCredentialsPath();
@@ -10776,13 +10861,8 @@ async function extractLocalCodexToken() {
   if (credential.length === 0) return null;
   return { method: "oauth", credential, source: "flat-file" };
 }
-function codexCredentialsMtime() {
-  const file = codexCredentialsPath();
-  try {
-    return fs17.statSync(file).mtimeMs;
-  } catch {
-    return null;
-  }
+function codexCredentialsPaths() {
+  return [codexCredentialsPath()];
 }
 
 // src/commands/link.ts
@@ -10791,23 +10871,38 @@ var AGENT_META = {
     internalId: "claude",
     publicId: "claude_code",
     binary: "claude",
-    loginArgs: ["login"],
     displayName: "Claude Code",
     vendor: "Anthropic",
-    credentialsHint: "~/.claude/.credentials.json (or macOS Keychain)",
+    credentialsHint: "~/.claude/.credentials.json or the macOS Keychain",
+    watchPaths: claudeCredentialsPaths,
     extract: extractLocalClaudeToken,
-    mtime: claudeCredentialsMtime
+    ensureInstalled: ensureClaudeInstalled,
+    launchLogin: () => {
+      const child = (0, import_node_child_process3.spawn)("claude", [], { stdio: ["pipe", "inherit", "inherit"] });
+      child.stdin?.write("/login\n");
+      return child;
+    }
   },
   codex: {
     internalId: "codex",
     publicId: "codex",
     binary: "codex",
-    loginArgs: ["login"],
     displayName: "Codex",
     vendor: "OpenAI",
     credentialsHint: "~/.codex/auth.json",
+    watchPaths: codexCredentialsPaths,
     extract: extractLocalCodexToken,
-    mtime: codexCredentialsMtime
+    ensureInstalled: async () => {
+      const { findInPath: findInPath2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+      if (findInPath2("codex")) return true;
+      showError(
+        "codex binary not found on PATH. Install it first (https://github.com/openai/codex-cli) then re-run `codeam link codex`."
+      );
+      return false;
+    },
+    launchLogin: () => {
+      return (0, import_node_child_process3.spawn)("codex", ["login"], { stdio: "inherit" });
+    }
   }
 };
 function parseLinkArgs(args2) {
@@ -10825,11 +10920,15 @@ function parseLinkArgs(args2) {
     );
   }
   const reuseExisting = args2.includes("--reuse-existing");
-  return { agent: normalised, reuseExisting };
+  const apiKeyArg = args2.find((a) => a.startsWith("--api-key="));
+  const apiKey = apiKeyArg ? apiKeyArg.slice("--api-key=".length) : null;
+  const tokenFileArg = args2.find((a) => a.startsWith("--token-file="));
+  const tokenFile = tokenFileArg ? tokenFileArg.slice("--token-file=".length) : null;
+  return { agent: normalised, reuseExisting, apiKey, tokenFile };
 }
 async function link(args2 = []) {
-  const { agent, reuseExisting } = parseLinkArgs(args2);
-  const meta = AGENT_META[agent];
+  const parsed = parseLinkArgs(args2);
+  const meta = AGENT_META[parsed.agent];
   showIntro();
   console.log(
     import_picocolors11.default.bold(`  Link ${meta.displayName}`) + import_picocolors11.default.dim(`  \xB7  ${meta.vendor}`)
@@ -10853,7 +10952,7 @@ async function link(args2 = []) {
   waitSpin.start(waitMsg());
   const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
   countdown.unref?.();
-  const paired = await new Promise((resolve2, reject) => {
+  const paired = await new Promise((resolve3, reject) => {
     let stopPoll = null;
     const sigint = () => {
       clearInterval(countdown);
@@ -10866,7 +10965,7 @@ async function link(args2 = []) {
         process.removeListener("SIGINT", sigint);
         clearInterval(countdown);
         waitSpin.stop("Paired");
-        resolve2(info);
+        resolve3(info);
       },
       () => {
         clearInterval(countdown);
@@ -10893,36 +10992,135 @@ async function link(args2 = []) {
     agent: meta.internalId
   });
   saveCliConfig({ ...loadCliConfig(), preferredAgent: meta.internalId });
-  let token = await meta.extract();
-  if (token && reuseExisting) {
-    showInfo(`Reusing existing ${meta.displayName} token at ${import_picocolors11.default.bold(meta.credentialsHint)}.`);
-  } else {
-    const beforeMtime = meta.mtime();
-    showInfo(`Launching ${import_picocolors11.default.bold(`${meta.binary} ${meta.loginArgs.join(" ")}`)} \u2014 complete the sign-in in your browser, then return here.`);
-    console.log("");
-    const code = await runAgentLogin(meta);
-    console.log("");
-    if (code !== 0) {
-      showError(
-        `${meta.binary} ${meta.loginArgs.join(" ")} exited with code ${code}. Re-run when ready.`
-      );
-      process.exit(1);
-    }
-    const refreshed = await meta.extract();
-    const afterMtime = meta.mtime();
-    if (!refreshed) {
-      showError(
-        `${meta.displayName} login finished but no credential was found at ${meta.credentialsHint}. Re-run when ready.`
-      );
+  if (parsed.apiKey) {
+    await uploadAndSucceed(meta, paired, pluginId, {
+      method: "api_key",
+      credential: parsed.apiKey.trim(),
+      source: "manual"
+    });
+    return;
+  }
+  if (parsed.tokenFile) {
+    const credential = fs18.readFileSync(path26.resolve(parsed.tokenFile), "utf8").trim();
+    if (!credential) {
+      showError(`--token-file ${parsed.tokenFile} is empty.`);
       process.exit(1);
     }
-    if (token && refreshed.credential === token.credential && beforeMtime !== null && afterMtime !== null && afterMtime <= beforeMtime) {
-      showError(
-        `${meta.displayName} login didn't produce a fresh token. Re-run when ready, or pass --reuse-existing to keep the current one.`
-      );
-      process.exit(1);
+    await uploadAndSucceed(meta, paired, pluginId, {
+      method: "oauth",
+      credential,
+      source: "manual"
+    });
+    return;
+  }
+  const installSpin = dist_exports.spinner();
+  installSpin.start(`Checking that ${meta.binary} is installed...`);
+  const installed = await meta.ensureInstalled();
+  if (!installed) {
+    installSpin.stop("Failed");
+    showError(`Could not install ${meta.displayName}. Install it manually then re-run.`);
+    process.exit(1);
+  }
+  installSpin.stop(`${meta.displayName} is installed`);
+  const existing = await meta.extract();
+  if (existing) {
+    showInfo(`Found existing ${meta.displayName} credentials at ${import_picocolors11.default.bold(existing.source)}.`);
+    await uploadAndSucceed(meta, paired, pluginId, existing);
+    return;
+  }
+  if (parsed.reuseExisting) {
+    showError(
+      `--reuse-existing set, but no local ${meta.displayName} credentials were found at ${meta.credentialsHint}.`
+    );
+    process.exit(1);
+  }
+  showInfo(
+    `No local ${meta.displayName} credentials found. Launching the sign-in \u2014 complete it in your browser, the CLI will detect the new token and finish automatically.`
+  );
+  console.log("");
+  const captured = await captureFreshCredentials(meta);
+  console.log("");
+  await uploadAndSucceed(meta, paired, pluginId, captured);
+}
+async function captureFreshCredentials(meta) {
+  const isWin = process.platform === "win32";
+  const watcher = import_chokidar.default.watch(meta.watchPaths(), {
+    persistent: true,
+    ignoreInitial: false,
+    awaitWriteFinish: { stabilityThreshold: 500, pollInterval: 100 },
+    // Windows-only: when a credential file's ancestor is missing,
+    // chokidar walks up to the closest existing parent and starts
+    // traversing it. On a default Windows shell that ancestor is
+    // `C:\Users\<u>`, which contains legacy junctions whose ACL makes
+    // `fs.watch` throw EPERM (#43). These flags are no-ops on macOS,
+    // where the user has read access to their entire home.
+    ...isWin ? { followSymlinks: false, ignorePermissionErrors: true } : {}
+  });
+  watcher.on("error", () => {
+  });
+  let child = null;
+  let keychainPoll = null;
+  const cleanup = () => {
+    void watcher.close();
+    if (keychainPoll) clearInterval(keychainPoll);
+    if (child && !child.killed) {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
     }
-    token = refreshed;
+  };
+  try {
+    const token = await new Promise((resolve3, reject) => {
+      let settled = false;
+      const tryExtract = async () => {
+        if (settled) return;
+        const t2 = await meta.extract();
+        if (t2 && !settled) {
+          settled = true;
+          resolve3(t2);
+        }
+      };
+      watcher.on("add", () => void tryExtract());
+      watcher.on("change", () => void tryExtract());
+      keychainPoll = setInterval(() => void tryExtract(), 2e3);
+      keychainPoll.unref?.();
+      const sigint = () => {
+        if (settled) return;
+        settled = true;
+        reject(new Error("cancelled"));
+      };
+      process.once("SIGINT", sigint);
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        reject(new Error(`Timed out waiting for ${meta.displayName} sign-in (5 minutes).`));
+      }, 5 * 6e4);
+      child = meta.launchLogin();
+      child.on("exit", () => {
+        void tryExtract().then(() => {
+          if (!settled) {
+            settled = true;
+            reject(
+              new Error(
+                `${meta.binary} exited but no credentials were written at ${meta.credentialsHint}.`
+              )
+            );
+          }
+        });
+      });
+    });
+    cleanup();
+    return token;
+  } catch (err) {
+    cleanup();
+    throw err;
+  }
+}
+async function uploadAndSucceed(meta, paired, pluginId, token) {
+  if (!paired.pluginAuthToken) {
+    showError("Missing pluginAuthToken; re-run codeam link.");
+    process.exit(1);
   }
   const uploadSpin = dist_exports.spinner();
   uploadSpin.start("Sealing credential in your vault...");
@@ -10937,12 +11135,10 @@ async function link(args2 = []) {
   if (!result.ok) {
     uploadSpin.stop("Failed");
     if (result.status === 401) {
-      showError(
-        "Pair token rejected by the backend (401). Re-run `codeam link` to start fresh."
-      );
+      showError("Pair token rejected by the backend (401). Re-run `codeam link`.");
     } else if (result.status === 404) {
       showError(
-        `${meta.displayName} link endpoint not available on this backend (404). The api-v2 deployment may not yet include the /api/plugin/agents/:agentId/link route.`
+        `${meta.displayName} link endpoint not available on this backend (404). The api-v2 deployment may not yet include the route.`
       );
     } else {
       showError(`Upload failed: ${result.message}`);
@@ -10957,28 +11153,11 @@ async function link(args2 = []) {
   );
   console.log("");
 }
-function runAgentLogin(meta) {
-  return new Promise((resolve2) => {
-    const child = (0, import_node_child_process3.spawn)(meta.binary, meta.loginArgs, { stdio: "inherit" });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        showError(
-          `${meta.binary} binary not found on PATH. Install ${meta.displayName} first, then re-run \`codeam link ${meta.internalId}\`.`
-        );
-        resolve2(127);
-        return;
-      }
-      showError(`Failed to launch ${meta.binary}: ${err.message}`);
-      resolve2(1);
-    });
-    child.on("exit", (code) => resolve2(code ?? 1));
-  });
-}
 
 // src/commands/version.ts
 var import_picocolors12 = __toESM(require("picocolors"));
 function version() {
-  const v = true ? "2.16.0" : "unknown";
+  const v = true ? "2.16.2" : "unknown";
   console.log(`${import_picocolors12.default.bold("codeam-cli")} ${import_picocolors12.default.cyan(v)}`);
 }
 
@@ -11020,9 +11199,9 @@ function help() {
 }
 
 // src/lib/updateNotifier.ts
-var fs18 = __toESM(require("fs"));
-var os17 = __toESM(require("os"));
-var path26 = __toESM(require("path"));
+var fs19 = __toESM(require("fs"));
+var os18 = __toESM(require("os"));
+var path27 = __toESM(require("path"));
 var https7 = __toESM(require("https"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
@@ -11030,12 +11209,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path26.join(os17.homedir(), ".codeam");
-  return path26.join(dir, "update-check.json");
+  const dir = path27.join(os18.homedir(), ".codeam");
+  return path27.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs18.readFileSync(cachePath(), "utf8");
+    const raw = fs19.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -11046,8 +11225,8 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs18.mkdirSync(path26.dirname(file), { recursive: true });
-    fs18.writeFileSync(file, JSON.stringify(cache));
+    fs19.mkdirSync(path27.dirname(file), { recursive: true });
+    fs19.writeFileSync(file, JSON.stringify(cache));
   } catch {
   }
 }
@@ -11065,14 +11244,14 @@ function compareSemver(a, b) {
   return 0;
 }
 function fetchLatest() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const req = https7.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve2(null);
+          resolve3(null);
           return;
         }
         let buf = "";
@@ -11084,21 +11263,21 @@ function fetchLatest() {
           try {
             const json = JSON.parse(buf);
             if (typeof json.version === "string") {
-              resolve2(json.version);
+              resolve3(json.version);
             } else {
-              resolve2(null);
+              resolve3(null);
             }
           } catch {
-            resolve2(null);
+            resolve3(null);
           }
         });
       }
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve2(null);
+      resolve3(null);
     });
-    req.on("error", () => resolve2(null));
+    req.on("error", () => resolve3(null));
   });
 }
 function notifyIfStale(currentVersion, latest) {
@@ -11118,7 +11297,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.16.0" : null;
+  const current = true ? "2.16.2" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;