codeam-cli 2.20.2 → 2.21.0

package/dist/index.js

@@ -441,7 +441,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.20.2",
+  version: "2.21.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -1026,8 +1026,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path37) {
-  return path37.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path39) {
+  return path39.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -3507,9 +3507,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path37, ranges, output) {
+function getContextLinesFromFile(path39, ranges, output) {
   return new Promise((resolve4) => {
-    const stream = (0, import_node_fs.createReadStream)(path37);
+    const stream = (0, import_node_fs.createReadStream)(path39);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -3524,7 +3524,7 @@ function getContextLinesFromFile(path37, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path37, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path39, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3585,8 +3585,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path37) {
-  return path37.startsWith("node:") || path37.endsWith(".min.js") || path37.endsWith(".min.cjs") || path37.endsWith(".min.mjs") || path37.startsWith("data:");
+function shouldSkipContextLinesForFile(path39) {
+  return path39.startsWith("node:") || path39.endsWith(".min.js") || path39.endsWith(".min.cjs") || path39.endsWith(".min.mjs") || path39.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -5740,7 +5740,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.20.2" : "0.0.0-dev",
+    cliVersion: true ? "2.21.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10610,11 +10610,11 @@ function parseReview(stdout) {
   for (const line of lines) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path37, lineNo, sevToken, message] = m;
-    if (!path37 || !lineNo || !message) continue;
+    const [, path39, lineNo, sevToken, message] = m;
+    if (!path39 || !lineNo || !message) continue;
     const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
-      path: path37.trim(),
+      path: path39.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: cleanedMessage
@@ -12576,6 +12576,7 @@ var FileWatcherService = class {
       );
       return;
     }
+    this.opts.onRepoDirty?.(gitRoot);
     const relPathInRepo = path25.relative(gitRoot, absPath);
     if (!relPathInRepo || relPathInRepo.startsWith("..")) return;
     const repoPath = path25.relative(this.opts.workingDir, gitRoot);
@@ -12769,9 +12770,493 @@ function _runGit(cwd, args2, opts = {}) {
   return _gitSeam.run(cwd, args2, opts);
 }
 
-// src/services/streaming-emitter.service.ts
+// src/services/turn-files/turn-file-aggregator.ts
 var import_crypto2 = require("crypto");
 
+// src/services/turn-files/git-changeset.ts
+var import_child_process8 = require("child_process");
+var path26 = __toESM(require("path"));
+async function collectRepoChangeset(opts) {
+  const status2 = await runGit2(opts.repoRoot, ["status", "--porcelain=v1", "-z"]);
+  if (status2 === null) return null;
+  const numstatRaw = await runGit2(opts.repoRoot, [
+    "diff",
+    "--numstat",
+    "-z",
+    "HEAD"
+  ]).catch(() => null);
+  const numstat = parseNumstat(numstatRaw ?? "");
+  const entries = [];
+  for (const row of parseStatus(status2)) {
+    const stats = numstat.get(row.filePath) ?? { added: 0, removed: 0 };
+    entries.push({
+      filePath: row.filePath,
+      fileStatus: row.fileStatus,
+      linesAdded: stats.added,
+      linesRemoved: stats.removed,
+      // hunkCount isn't surfaced by --numstat. For the rail / drawer
+      // it's only a count badge; defaulting to 1 when the file has
+      // any non-zero stat is good enough until we wire a follow-up
+      // per-file `git diff --shortstat` if we ever want exact hunks.
+      hunkCount: stats.added + stats.removed > 0 ? 1 : 0,
+      repoPath: opts.repoPath,
+      repoName: opts.repoName
+    });
+  }
+  return entries;
+}
+function parseStatus(raw) {
+  const tokens = raw.split("\0");
+  const rows = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token || token.length < 3) continue;
+    const code = token.slice(0, 2);
+    const filePath = token.slice(3);
+    if (!filePath) continue;
+    const indexCode = code[0];
+    const worktreeCode = code[1];
+    if (indexCode === "R" || worktreeCode === "R") {
+      rows.push({ filePath, fileStatus: "renamed" });
+      i += 1;
+      continue;
+    }
+    if (code === "??" || indexCode === "A" || worktreeCode === "A") {
+      rows.push({ filePath, fileStatus: "added" });
+      continue;
+    }
+    if (indexCode === "D" || worktreeCode === "D") {
+      rows.push({ filePath, fileStatus: "deleted" });
+      continue;
+    }
+    rows.push({ filePath, fileStatus: "modified" });
+  }
+  return rows;
+}
+function parseNumstat(raw) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (const record of raw.split("\0")) {
+    if (!record) continue;
+    const parts = record.split("	");
+    if (parts.length < 3) continue;
+    const added = parts[0] === "-" ? 0 : parseInt(parts[0], 10) || 0;
+    const removed = parts[1] === "-" ? 0 : parseInt(parts[1], 10) || 0;
+    const filePath = parts.slice(2).join("	");
+    if (!filePath) continue;
+    out2.set(filePath, { added, removed });
+  }
+  return out2;
+}
+var _runGitImpl2 = {
+  run: defaultRunGit
+};
+function runGit2(cwd, args2) {
+  return _runGitImpl2.run(cwd, args2);
+}
+function defaultRunGit(cwd, args2) {
+  return new Promise((resolve4) => {
+    let proc;
+    try {
+      proc = (0, import_child_process8.spawn)("git", args2, { cwd, env: process.env });
+    } catch {
+      resolve4(null);
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    proc.stdout?.on("data", (c2) => {
+      stdout += c2.toString();
+    });
+    proc.stderr?.on("data", (c2) => {
+      stderr += c2.toString();
+    });
+    proc.on("error", () => resolve4(null));
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve4(stdout);
+      } else {
+        log.trace(
+          "turnFiles",
+          `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`
+        );
+        resolve4(null);
+      }
+    });
+  });
+}
+async function discoverRepos(workingDir, maxDepth = 4) {
+  const fs30 = await import("fs/promises");
+  const out2 = [];
+  await walk(workingDir, 0);
+  return out2;
+  async function walk(dir, depth) {
+    if (depth > maxDepth) return;
+    let entries = [];
+    try {
+      const dirents = await fs30.readdir(dir, { withFileTypes: true });
+      entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
+    } catch {
+      return;
+    }
+    const hasGit = entries.some(
+      (e) => e.name === ".git" && (e.isDirectory || true)
+    );
+    if (hasGit) {
+      out2.push({
+        repoRoot: dir,
+        repoPath: path26.relative(workingDir, dir),
+        repoName: path26.basename(dir)
+      });
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory) continue;
+      if (entry.name === "node_modules") continue;
+      if (entry.name === "dist" || entry.name === "build") continue;
+      await walk(path26.join(dir, entry.name), depth + 1);
+    }
+  }
+}
+
+// src/services/turn-files/files-outbox.ts
+var fs22 = __toESM(require("fs/promises"));
+var path27 = __toESM(require("path"));
+var import_os6 = require("os");
+var HOME_OUTBOX_DIR = ".codeam/outbox";
+var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var BACKOFF_STEPS_MS = [
+  1e3,
+  // 1 s
+  2e3,
+  // 2 s
+  4e3,
+  // 4 s
+  8e3,
+  // 8 s
+  16e3,
+  // 16 s
+  32e3,
+  // 32 s
+  6e4,
+  // 1 min
+  12e4,
+  // 2 min
+  3e5
+  // 5 min — cap
+];
+var FilesOutbox = class {
+  filePath;
+  post;
+  autoSchedule;
+  flushTimer = null;
+  flushing = false;
+  backoffIndex = 0;
+  stopped = false;
+  constructor(opts) {
+    const base = opts.baseDir ?? path27.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path27.join(base, `${opts.sessionId}.jsonl`);
+    this.post = opts.post;
+    this.autoSchedule = opts.autoSchedule !== false;
+  }
+  /** Persist the entry to disk and trigger a flush. Returns once the
+   *  line is durable on disk (not once the POST succeeds). */
+  async enqueue(entry) {
+    await fs22.mkdir(path27.dirname(this.filePath), { recursive: true });
+    await fs22.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    this.backoffIndex = 0;
+    if (this.autoSchedule) this.scheduleFlush(0);
+  }
+  /** Stop the scheduler. Idempotent. The on-disk file is left alone
+   *  so the next process pickup can flush whatever's pending. */
+  stop() {
+    this.stopped = true;
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
+    }
+  }
+  /** Visible for tests. Forces a flush attempt right now. */
+  async _flushNow() {
+    return this.flush();
+  }
+  scheduleFlush(delayMs) {
+    if (this.stopped) return;
+    if (this.flushTimer) clearTimeout(this.flushTimer);
+    const jittered = delayMs === 0 ? 0 : applyJitter(delayMs);
+    this.flushTimer = setTimeout(() => {
+      this.flushTimer = null;
+      void this.flush();
+    }, jittered);
+  }
+  async flush() {
+    if (this.stopped) return;
+    if (this.flushing) {
+      return;
+    }
+    this.flushing = true;
+    try {
+      const entries = await this.readAll();
+      if (entries.length === 0) return;
+      const now = Date.now();
+      const fresh = entries.filter((e) => now - e.enqueuedAt <= MAX_AGE_MS);
+      if (fresh.length < entries.length) {
+        log.warn(
+          "turnFiles",
+          `dropping ${entries.length - fresh.length} outbox entries older than ${MAX_AGE_MS / 1e3}s`
+        );
+      }
+      const stillPending = [];
+      let anyFailed = false;
+      for (const entry of fresh) {
+        if (this.stopped) {
+          stillPending.push(entry);
+          continue;
+        }
+        try {
+          const res = await this.post(entry);
+          if (res.ok) continue;
+          if (res.statusCode === 404 || res.statusCode === 410) {
+            log.warn(
+              "turnFiles",
+              `session dead (status=${res.statusCode}); dropping turnId=${entry.turnId.slice(0, 8)}`
+            );
+            continue;
+          }
+          anyFailed = true;
+          stillPending.push(entry);
+        } catch (err) {
+          anyFailed = true;
+          stillPending.push(entry);
+          log.trace(
+            "turnFiles",
+            `outbox post threw for turnId=${entry.turnId.slice(0, 8)}: ${err.message}`
+          );
+        }
+      }
+      await this.rewrite(stillPending);
+      if (anyFailed) {
+        const delay = BACKOFF_STEPS_MS[Math.min(this.backoffIndex, BACKOFF_STEPS_MS.length - 1)];
+        this.backoffIndex = Math.min(
+          this.backoffIndex + 1,
+          BACKOFF_STEPS_MS.length - 1
+        );
+        this.scheduleFlush(delay);
+      } else {
+        this.backoffIndex = 0;
+      }
+    } finally {
+      this.flushing = false;
+    }
+  }
+  async readAll() {
+    let raw = "";
+    try {
+      raw = await fs22.readFile(this.filePath, "utf8");
+    } catch {
+      return [];
+    }
+    const out2 = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        out2.push(JSON.parse(trimmed));
+      } catch {
+      }
+    }
+    return out2;
+  }
+  /**
+   * Atomic compaction: write to `<file>.tmp`, fsync, rename over the
+   * original. A crash between any of these steps leaves either the
+   * original (no progress) or the new file (clean compaction) — never
+   * a torn write.
+   */
+  async rewrite(entries) {
+    const tmpPath = `${this.filePath}.${process.pid}.tmp`;
+    if (entries.length === 0) {
+      await fs22.unlink(this.filePath).catch(() => void 0);
+      return;
+    }
+    const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
+    await fs22.writeFile(tmpPath, payload, "utf8");
+    await fs22.rename(tmpPath, this.filePath);
+  }
+};
+function applyJitter(ms) {
+  const factor = 0.8 + Math.random() * 0.4;
+  return Math.round(ms * factor);
+}
+function homeDir() {
+  return process.env.HOME ?? process.env.USERPROFILE ?? (0, import_os6.tmpdir)();
+}
+
+// src/services/turn-files/turn-file-aggregator.ts
+var API_BASE6 = resolveApiBaseUrl();
+var ENDPOINT = "/api/files/batch";
+var MAX_BATCH_SIZE = 1e3;
+var TurnFileAggregator = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE6;
+    this.outbox = new FilesOutbox({
+      sessionId: opts.sessionId,
+      baseDir: opts.outboxDir,
+      post: (entry) => this.postEntry(entry),
+      autoSchedule: opts.outboxAutoSchedule
+    });
+    this.discovering = discoverRepos(opts.workingDir).then((repos) => {
+      this.repos = repos;
+      opts.dirtyTracker?.markAllDirty(repos);
+      log.info(
+        "turnFiles",
+        `discovered ${repos.length} repo(s) under ${opts.workingDir}: ${repos.map((r) => r.repoName || "<root>").join(", ")}`
+      );
+    });
+  }
+  opts;
+  apiBase;
+  outbox;
+  repos = [];
+  discovering = null;
+  stopped = false;
+  /** Stop the outbox scheduler. Idempotent. */
+  stop() {
+    this.stopped = true;
+    this.outbox.stop();
+  }
+  /**
+   * Run the discovery + git collection + POST pipeline for one
+   * turn. Errors are swallowed (logged) so an agent never blocks on a
+   * file-changeset failure; the outbox covers the network half.
+   */
+  async flushTurn() {
+    if (this.stopped) return;
+    try {
+      if (this.discovering) {
+        await this.discovering;
+        this.discovering = null;
+      }
+      if (this.repos.length === 0) {
+        log.trace("turnFiles", "no repos discovered \u2014 skipping flush");
+        return;
+      }
+      const reposToScan = this.opts.dirtyTracker ? this.filterByDirty(this.opts.dirtyTracker) : this.repos;
+      if (reposToScan.length === 0) {
+        log.trace("turnFiles", "dirty set empty \u2014 skipping flush");
+        return;
+      }
+      const files = [];
+      for (const repo of reposToScan) {
+        const entries = await collectRepoChangeset(repo);
+        if (entries) files.push(...entries);
+      }
+      if (files.length === 0) {
+        log.trace("turnFiles", "no changes detected this turn \u2014 skipping POST");
+        return;
+      }
+      const chunks = chunkArray(files, MAX_BATCH_SIZE);
+      for (const chunk of chunks) {
+        const entry = {
+          turnId: (0, import_crypto2.randomUUID)(),
+          sessionId: this.opts.sessionId,
+          pluginId: this.opts.pluginId,
+          enqueuedAt: Date.now(),
+          files: chunk
+        };
+        await this.outbox.enqueue(entry);
+      }
+    } catch (err) {
+      log.warn(
+        "turnFiles",
+        `flushTurn failed: ${err.message ?? String(err)}`
+      );
+    }
+  }
+  /**
+   * Consume the tracker's dirty set and intersect with the
+   * discovered repos so we never spawn git for a path the watcher
+   * marked outside our discovered set (e.g. a sibling repo that
+   * appeared after construction). Unknown roots get dropped on the
+   * floor — they'll re-mark themselves on the next event if they're
+   * inside `workingDir`.
+   */
+  filterByDirty(tracker) {
+    const dirty = tracker.consume();
+    if (dirty.size === 0) return [];
+    return this.repos.filter((repo) => dirty.has(repo.repoRoot));
+  }
+  async postEntry(entry) {
+    const url = `${this.apiBase}${ENDPOINT}`;
+    const headers = {
+      "Content-Type": "application/json",
+      "X-Codeam-Protocol-Version": PROTOCOL_VERSION,
+      "X-Plugin-Auth-Token": this.opts.pluginAuthToken
+    };
+    const body = JSON.stringify({
+      sessionId: entry.sessionId,
+      pluginId: entry.pluginId,
+      turnId: entry.turnId,
+      files: entry.files
+    });
+    try {
+      const res = await _transport3.post(url, headers, body);
+      return { ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode };
+    } catch (err) {
+      log.trace(
+        "turnFiles",
+        `batch POST threw turnId=${entry.turnId.slice(0, 8)}: ${err.message}`
+      );
+      return { ok: false, statusCode: 0 };
+    }
+  }
+};
+function chunkArray(arr, size) {
+  if (arr.length <= size) return [arr];
+  const out2 = [];
+  for (let i = 0; i < arr.length; i += size) {
+    out2.push(arr.slice(i, i + size));
+  }
+  return out2;
+}
+
+// src/services/turn-files/repo-dirty-tracker.ts
+var RepoDirtyTracker = class {
+  dirty = /* @__PURE__ */ new Set();
+  /** Add a repo root to the dirty set. Idempotent. */
+  markDirty(repoRoot) {
+    this.dirty.add(repoRoot);
+  }
+  /** Seed every known repo as dirty — used right after `discoverRepos`
+   *  returns so the first end-of-turn flush captures worktree state
+   *  that predates the pairing. */
+  markAllDirty(repoRoots) {
+    for (const r of repoRoots) this.dirty.add(r.repoRoot);
+  }
+  /** Snapshot the current dirty set without clearing — useful for
+   *  diagnostic logs / tests. */
+  peek() {
+    return new Set(this.dirty);
+  }
+  /** Atomically read AND clear the dirty set. The aggregator calls
+   *  this on each `done:true`; subsequent filesystem events
+   *  re-populate it for the next turn. */
+  consume() {
+    const snapshot = new Set(this.dirty);
+    this.dirty.clear();
+    return snapshot;
+  }
+  /** True when the set is non-empty. Cheap pre-flight gate so the
+   *  aggregator can early-return on chat-only turns without
+   *  touching the dirty set. */
+  hasDirty() {
+    return this.dirty.size > 0;
+  }
+};
+
+// src/services/streaming-emitter.service.ts
+var import_crypto3 = require("crypto");
+
 // src/services/streaming/transport.ts
 var http6 = __toESM(require("http"));
 var https6 = __toESM(require("https"));
@@ -12863,7 +13348,7 @@ function _get(url, headers) {
 }
 
 // src/services/streaming-emitter.service.ts
-var API_BASE6 = resolveApiBaseUrl();
+var API_BASE7 = resolveApiBaseUrl();
 var TICK_MS = 50;
 var ANSWER_POLL_MS = 1500;
 var SELECTOR_STABLE_MS = 800;
@@ -12874,7 +13359,7 @@ var TAIL_KEEP_BYTES2 = 1.5 * 1024 * 1024;
 var StreamingEmitterService = class {
   constructor(opts) {
     this.opts = opts;
-    this.apiBase = opts.apiBaseUrl ?? API_BASE6;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE7;
     this.headers = {
       "Content-Type": "application/json",
       "X-Codeam-Protocol-Version": "2.0.0",
@@ -12993,7 +13478,7 @@ var StreamingEmitterService = class {
       });
     }
     this.activeChunk = {
-      chunkId: (0, import_crypto2.randomUUID)(),
+      chunkId: (0, import_crypto3.randomUUID)(),
       kind: last.kind,
       emittedContent: "",
       currentContent: last.content,
@@ -13061,7 +13546,7 @@ var StreamingEmitterService = class {
     }
     if (this.pendingAnswer) return;
     if (now - this.selectorFirstSeenAt < SELECTOR_STABLE_MS) return;
-    const questionId = (0, import_crypto2.randomUUID)();
+    const questionId = (0, import_crypto3.randomUUID)();
     this.pendingAnswer = {
       questionId,
       options: selector.options.length > 0 ? selector.options : void 0,
@@ -13224,13 +13709,13 @@ function fetchQuotaUsage(runtime, historySvc) {
 }
 
 // src/commands/start/keep-alive.ts
-var import_child_process8 = require("child_process");
+var import_child_process9 = require("child_process");
 function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
     await new Promise((resolve4) => {
-      const proc = (0, import_child_process8.spawn)(
+      const proc = (0, import_child_process9.spawn)(
         "gh",
         [
           "api",
@@ -13267,11 +13752,11 @@ function buildKeepAlive(ctx) {
 }
 
 // src/commands/start/handlers.ts
-var fs24 = __toESM(require("fs"));
+var fs25 = __toESM(require("fs"));
 var os23 = __toESM(require("os"));
-var path29 = __toESM(require("path"));
-var import_crypto4 = require("crypto");
-var import_child_process11 = require("child_process");
+var path31 = __toESM(require("path"));
+var import_crypto5 = require("crypto");
+var import_child_process12 = require("child_process");
 
 // src/lib/payload.ts
 var import_zod2 = require("zod");
@@ -13327,8 +13812,8 @@ function parsePayload2(schema, raw) {
 }
 
 // src/services/file-ops.service.ts
-var fs22 = __toESM(require("fs/promises"));
-var path26 = __toESM(require("path"));
+var fs23 = __toESM(require("fs/promises"));
+var path28 = __toESM(require("path"));
 var MAX_FILE_BYTES = 5 * 1024 * 1024;
 var MAX_WALK_DEPTH = 6;
 var MAX_VISITED_DIRS = 5e3;
@@ -13363,12 +13848,12 @@ var SUBDIR_IGNORE = /* @__PURE__ */ new Set([
   "__pycache__"
 ]);
 function isUnder(parent, candidate) {
-  const rel = path26.relative(parent, candidate);
-  return rel === "" || !rel.startsWith("..") && !path26.isAbsolute(rel);
+  const rel = path28.relative(parent, candidate);
+  return rel === "" || !rel.startsWith("..") && !path28.isAbsolute(rel);
 }
 async function isExistingFile(absPath) {
   try {
-    const stat3 = await fs22.stat(absPath);
+    const stat3 = await fs23.stat(absPath);
     return stat3.isFile();
   } catch {
     return false;
@@ -13381,13 +13866,13 @@ async function walkForSuffix(dir, needleVariants, depth, ctx) {
   ctx.visited++;
   let entries = [];
   try {
-    entries = await fs22.readdir(dir, { withFileTypes: true });
+    entries = await fs23.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
     if (!e.isFile()) continue;
-    const full = path26.join(dir, e.name);
+    const full = path28.join(dir, e.name);
     if (needleVariants.some((needle) => full.endsWith(needle))) {
       ctx.matches.push(full);
       if (ctx.matches.length >= ctx.cap) return;
@@ -13397,21 +13882,21 @@ async function walkForSuffix(dir, needleVariants, depth, ctx) {
     if (!e.isDirectory()) continue;
     if (SUBDIR_IGNORE.has(e.name)) continue;
     if (e.name.startsWith(".") && SUBDIR_IGNORE.has(e.name)) continue;
-    await walkForSuffix(path26.join(dir, e.name), needleVariants, depth + 1, ctx);
+    await walkForSuffix(path28.join(dir, e.name), needleVariants, depth + 1, ctx);
     if (ctx.matches.length >= ctx.cap) return;
   }
 }
 async function findFile(rawPath) {
   const cwd = process.cwd();
-  if (path26.isAbsolute(rawPath)) {
-    const abs = path26.normalize(rawPath);
+  if (path28.isAbsolute(rawPath)) {
+    const abs = path28.normalize(rawPath);
     if (isUnder(cwd, abs) && await isExistingFile(abs)) return abs;
   }
-  const direct = path26.resolve(cwd, rawPath);
+  const direct = path28.resolve(cwd, rawPath);
   if (isUnder(cwd, direct) && await isExistingFile(direct)) return direct;
-  const normalized = path26.normalize(rawPath).replace(/^[./\\]+/, "");
+  const normalized = path28.normalize(rawPath).replace(/^[./\\]+/, "");
   const needles = [
-    `${path26.sep}${normalized}`,
+    `${path28.sep}${normalized}`,
     `/${normalized}`
   ].filter((v, i, a) => a.indexOf(v) === i);
   const ctx = { visited: 0, matches: [], cap: 16 };
@@ -13425,7 +13910,7 @@ async function findWriteTarget(rawPath) {
   const found = await findFile(rawPath);
   if (found) return found;
   const cwd = process.cwd();
-  const fallback = path26.isAbsolute(rawPath) ? path26.normalize(rawPath) : path26.resolve(cwd, rawPath);
+  const fallback = path28.isAbsolute(rawPath) ? path28.normalize(rawPath) : path28.resolve(cwd, rawPath);
   if (!isUnder(cwd, fallback)) return null;
   return fallback;
 }
@@ -13442,11 +13927,11 @@ async function readProjectFile(rawPath) {
     if (!abs) {
       return { error: `File not found in the project tree: ${rawPath}` };
     }
-    const stat3 = await fs22.stat(abs);
+    const stat3 = await fs23.stat(abs);
     if (stat3.size > MAX_FILE_BYTES) {
       return { error: `File too large (${(stat3.size / 1024 / 1024).toFixed(1)} MB > ${MAX_FILE_BYTES / 1024 / 1024} MB).` };
     }
-    const buf = await fs22.readFile(abs);
+    const buf = await fs23.readFile(abs);
     if (looksBinary(buf)) {
       return { error: "Binary file \u2014 refusing to open in a code editor." };
     }
@@ -13465,8 +13950,8 @@ async function writeProjectFile(rawPath, content) {
     if (Buffer.byteLength(content, "utf-8") > MAX_FILE_BYTES) {
       return { error: "Content too large." };
     }
-    await fs22.mkdir(path26.dirname(abs), { recursive: true });
-    await fs22.writeFile(abs, content, "utf-8");
+    await fs23.mkdir(path28.dirname(abs), { recursive: true });
+    await fs23.writeFile(abs, content, "utf-8");
     return { ok: true };
   } catch (e) {
     const msg = e instanceof Error ? e.message : "Write failed";
@@ -13475,11 +13960,11 @@ async function writeProjectFile(rawPath, content) {
 }
 
 // src/services/project-ops.service.ts
-var import_child_process9 = require("child_process");
+var import_child_process10 = require("child_process");
 var import_util2 = require("util");
-var fs23 = __toESM(require("fs/promises"));
-var path27 = __toESM(require("path"));
-var execFileP3 = (0, import_util2.promisify)(import_child_process9.execFile);
+var fs24 = __toESM(require("fs/promises"));
+var path29 = __toESM(require("path"));
+var execFileP3 = (0, import_util2.promisify)(import_child_process10.execFile);
 var PROJECT_IGNORE = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -13526,7 +14011,7 @@ async function listProjectFiles(opts = {}) {
     }
     let entries = [];
     try {
-      entries = await fs23.readdir(dir, { withFileTypes: true });
+      entries = await fs24.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -13536,18 +14021,18 @@ async function listProjectFiles(opts = {}) {
         return;
       }
       if (PROJECT_IGNORE.has(e.name)) continue;
-      const full = path27.join(dir, e.name);
+      const full = path29.join(dir, e.name);
       if (e.isDirectory()) {
         if (depth >= 12) continue;
         await walk(full, depth + 1);
       } else if (e.isFile()) {
-        const rel = path27.relative(root, full);
+        const rel = path29.relative(root, full);
         if (q2 && !rel.toLowerCase().includes(q2) && !e.name.toLowerCase().includes(q2)) {
           continue;
         }
         let size = 0;
         try {
-          const st3 = await fs23.stat(full);
+          const st3 = await fs24.stat(full);
           size = st3.size;
         } catch {
         }
@@ -13649,8 +14134,8 @@ async function gitStatus(cwd) {
   let hasMergeInProgress = false;
   try {
     const gitDir = (await git(["rev-parse", "--git-dir"], root)).stdout.trim();
-    const mergeHead = path27.isAbsolute(gitDir) ? path27.join(gitDir, "MERGE_HEAD") : path27.join(root, gitDir, "MERGE_HEAD");
-    await fs23.access(mergeHead);
+    const mergeHead = path29.isAbsolute(gitDir) ? path29.join(gitDir, "MERGE_HEAD") : path29.join(root, gitDir, "MERGE_HEAD");
+    await fs24.access(mergeHead);
     hasMergeInProgress = true;
   } catch {
   }
@@ -13796,7 +14281,7 @@ async function jsSearchFiles(opts, cwd, cap) {
     }
     let content = "";
     try {
-      content = await fs23.readFile(path27.join(cwd, f.path), "utf8");
+      content = await fs24.readFile(path29.join(cwd, f.path), "utf8");
     } catch {
       continue;
     }
@@ -13819,8 +14304,8 @@ async function jsSearchFiles(opts, cwd, cap) {
 }
 
 // src/services/terminal-ops.service.ts
-var import_child_process10 = require("child_process");
-var import_crypto3 = require("crypto");
+var import_child_process11 = require("child_process");
+var import_crypto4 = require("crypto");
 var import_path3 = __toESM(require("path"));
 var MAX_CONCURRENT_SESSIONS = 4;
 var nodePtyModule;
@@ -13941,7 +14426,7 @@ function createPythonSession(id, shell, cwd, env, cols, rows) {
   }
   let child;
   try {
-    child = (0, import_child_process10.spawn)(python, ["-c", PYTHON_TERMINAL_HELPER, shell], {
+    child = (0, import_child_process11.spawn)(python, ["-c", PYTHON_TERMINAL_HELPER, shell], {
       cwd,
       env: { ...env, COLUMNS: String(cols), LINES: String(rows) },
       stdio: ["pipe", "pipe", "pipe"]
@@ -13996,7 +14481,7 @@ function openTerminal(opts) {
   };
   const cols = Math.max(1, Math.min(opts.cols ?? 80, 500));
   const rows = Math.max(1, Math.min(opts.rows ?? 24, 200));
-  const id = (0, import_crypto3.randomUUID)();
+  const id = (0, import_crypto4.randomUUID)();
   const ptyMod = loadNodePty2();
   if (ptyMod) {
     try {
@@ -14080,7 +14565,7 @@ var pendingAttachmentFiles = /* @__PURE__ */ new Set();
 function cleanupAttachmentTempFiles() {
   for (const p2 of pendingAttachmentFiles) {
     try {
-      fs24.unlinkSync(p2);
+      fs25.unlinkSync(p2);
     } catch {
     }
   }
@@ -14089,8 +14574,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path29.join(os23.tmpdir(), `codeam-${(0, import_crypto4.randomUUID)()}-${safeName}`);
-    fs24.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path31.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
+    fs25.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -14110,7 +14595,7 @@ var startTask = (ctx, _cmd, parsed) => {
     setTimeout(() => {
       for (const p2 of paths) {
         try {
-          fs24.unlinkSync(p2);
+          fs25.unlinkSync(p2);
         } catch {
         }
         pendingAttachmentFiles.delete(p2);
@@ -14223,7 +14708,7 @@ var sessionTerminated = (ctx) => {
   } catch {
   }
   try {
-    const proc = (0, import_child_process11.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process12.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14245,7 +14730,7 @@ var shutdownSession = async (ctx, cmd) => {
   }
   if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
     try {
-      const stopProc = (0, import_child_process11.spawn)(
+      const stopProc = (0, import_child_process12.spawn)(
         "bash",
         ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
         { detached: true, stdio: "ignore" }
@@ -14255,7 +14740,7 @@ var shutdownSession = async (ctx, cmd) => {
     }
   }
   try {
-    const proc = (0, import_child_process11.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process12.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14266,7 +14751,7 @@ var shutdownSession = async (ctx, cmd) => {
   ctx.relay.stop();
   process.exit(0);
 };
-var readFile3 = async (ctx, cmd, parsed) => {
+var readFile4 = async (ctx, cmd, parsed) => {
   if (!parsed.path) {
     await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path" });
     return;
@@ -14274,7 +14759,7 @@ var readFile3 = async (ctx, cmd, parsed) => {
   const result = await readProjectFile(parsed.path);
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
-var writeFile2 = async (ctx, cmd, parsed) => {
+var writeFile3 = async (ctx, cmd, parsed) => {
   if (!parsed.path || typeof parsed.content !== "string") {
     await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path or content" });
     return;
@@ -14393,8 +14878,8 @@ var handlers = {
   set_keep_alive: setKeepAlive,
   session_terminated: sessionTerminated,
   shutdown_session: shutdownSession,
-  read_file: readFile3,
-  write_file: writeFile2,
+  read_file: readFile4,
+  write_file: writeFile3,
   list_files: listFiles,
   search_files: searchFilesH,
   terminal_open: terminalOpenH,
@@ -14480,6 +14965,8 @@ async function start(requestedAgent) {
         historySvc.uploadDelta().catch(() => {
         });
       }, 400);
+      turnFiles?.flushTurn().catch(() => {
+      });
     },
     () => {
       const prevCount = historySvc.getCurrentMessageCount();
@@ -14488,11 +14975,20 @@ async function start(requestedAgent) {
     session.pluginAuthToken,
     runtime
   );
+  const dirtyTracker = session.pluginAuthToken ? new RepoDirtyTracker() : null;
   const fileWatcher = session.pluginAuthToken ? new FileWatcherService({
     workingDir: cwd,
     sessionId: session.id,
     pluginId,
-    pluginAuthToken: session.pluginAuthToken
+    pluginAuthToken: session.pluginAuthToken,
+    onRepoDirty: dirtyTracker ? (repoRoot) => dirtyTracker.markDirty(repoRoot) : void 0
+  }) : null;
+  const turnFiles = session.pluginAuthToken ? new TurnFileAggregator({
+    workingDir: cwd,
+    sessionId: session.id,
+    pluginId,
+    pluginAuthToken: session.pluginAuthToken,
+    dirtyTracker: dirtyTracker ?? void 0
   }) : null;
   let streamingEmitter = null;
   const agent = new AgentService(
@@ -14510,6 +15006,7 @@ async function start(requestedAgent) {
         outputSvc.dispose();
         relay.stop();
         void fileWatcher?.stop();
+        turnFiles?.stop();
         void streamingEmitter?.stop();
         closeAllTerminals();
         cleanupAttachmentTempFiles();
@@ -14577,7 +15074,7 @@ async function start(requestedAgent) {
 }
 
 // src/commands/pair.ts
-var import_crypto5 = require("crypto");
+var import_crypto6 = require("crypto");
 var import_picocolors3 = __toESM(require("picocolors"));
 
 // src/ui/prompts.ts
@@ -14641,7 +15138,7 @@ async function pair(args2 = []) {
   const flagAgent = parseAgentFlag(args2);
   const agentId = dryRun ? flagAgent ?? config.preferredAgent ?? "claude" : flagAgent ?? await promptForAgent(config.preferredAgent ?? "claude");
   showIntro();
-  const pluginId = (0, import_crypto5.randomUUID)();
+  const pluginId = (0, import_crypto6.randomUUID)();
   capture("pair_started", { agentId, pluginId, dryRun });
   const spin = dist_exports.spinner();
   spin.start("Requesting pairing code...");
@@ -14732,10 +15229,10 @@ async function pair(args2 = []) {
 }
 
 // src/commands/pair-auto.ts
-var fs25 = __toESM(require("fs"));
+var fs26 = __toESM(require("fs"));
 var os24 = __toESM(require("os"));
-var import_crypto6 = require("crypto");
-var API_BASE7 = resolveApiBaseUrl();
+var import_crypto7 = require("crypto");
+var API_BASE8 = resolveApiBaseUrl();
 function fail(msg) {
   console.error(`
   ${msg}
@@ -14750,12 +15247,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path37 = fileFlag.slice("--token-file=".length);
+    const path39 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs25.readFileSync(path37, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path37} is empty`);
+      const content = fs26.readFileSync(path39, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path39} is empty`);
       try {
-        fs25.unlinkSync(path37);
+        fs26.unlinkSync(path39);
       } catch {
       }
       return content;
@@ -14775,7 +15272,7 @@ function networkError(msg, cause) {
   return err;
 }
 async function claimOnce(token, pluginId) {
-  const url = `${API_BASE7}/api/pairing/claim-auto-token`;
+  const url = `${API_BASE8}/api/pairing/claim-auto-token`;
   const body = {
     token,
     pluginId,
@@ -14839,7 +15336,7 @@ async function claim(token, pluginId) {
 }
 async function pairAuto(args2) {
   const token = readTokenFromArgs(args2);
-  const pluginId = (0, import_crypto6.randomUUID)();
+  const pluginId = (0, import_crypto7.randomUUID)();
   capture("pair_auto_started", { pluginId });
   console.log("  Claiming pairing token\u2026");
   const claimed = await claim(token, pluginId);
@@ -14965,7 +15462,7 @@ function status() {
 
 // src/commands/logout.ts
 var import_picocolors6 = __toESM(require("picocolors"));
-var API_BASE8 = resolveApiBaseUrl();
+var API_BASE9 = resolveApiBaseUrl();
 async function notifyBackendOffline() {
   const cfg = loadCliConfig();
   const pluginIds = /* @__PURE__ */ new Set([
@@ -14977,7 +15474,7 @@ async function notifyBackendOffline() {
   try {
     await Promise.all(
       Array.from(pluginIds).map(
-        (pluginId) => _postJson(`${API_BASE8}/api/plugin/heartbeat`, {
+        (pluginId) => _postJson(`${API_BASE9}/api/plugin/heartbeat`, {
           pluginId,
           online: false
         }).catch((err) => {
@@ -15005,11 +15502,11 @@ async function logout() {
 var import_picocolors9 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
-var import_child_process12 = require("child_process");
+var import_child_process13 = require("child_process");
 var import_util3 = require("util");
 var import_picocolors7 = __toESM(require("picocolors"));
-var path30 = __toESM(require("path"));
-var execFileP4 = (0, import_util3.promisify)(import_child_process12.execFile);
+var path32 = __toESM(require("path"));
+var execFileP4 = (0, import_util3.promisify)(import_child_process13.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -15053,7 +15550,7 @@ var GitHubCodespacesProvider = class {
     if (!isAuthed) {
       resetStdinForChild();
       await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process12.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
+        const proc = (0, import_child_process13.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
@@ -15087,7 +15584,7 @@ var GitHubCodespacesProvider = class {
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
       const refreshCode = await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process12.spawn)(
+        const proc = (0, import_child_process13.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
@@ -15237,7 +15734,7 @@ var GitHubCodespacesProvider = class {
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
     const ok = await new Promise((resolve4) => {
-      const proc = (0, import_child_process12.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
+      const proc = (0, import_child_process13.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
       proc.on("exit", (code) => resolve4(code === 0));
       proc.on("error", () => resolve4(false));
     });
@@ -15264,7 +15761,7 @@ var GitHubCodespacesProvider = class {
     );
     resetStdinForChild();
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+      const proc = (0, import_child_process13.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
@@ -15442,7 +15939,7 @@ var GitHubCodespacesProvider = class {
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
     return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+      const proc = (0, import_child_process13.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
@@ -15469,11 +15966,11 @@ var GitHubCodespacesProvider = class {
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
     await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process12.spawn)("tar", tarArgs, {
+      const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process12.spawn)("gh", sshArgs, {
+      const ssh = (0, import_child_process13.spawn)("gh", sshArgs, {
         stdio: [tar.stdout, "pipe", "pipe"]
       });
       let tarErr = "";
@@ -15497,7 +15994,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path30.posix.dirname(remotePath);
+    const remoteDir = path32.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -15507,7 +16004,7 @@ var GitHubCodespacesProvider = class {
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+      const proc = (0, import_child_process13.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -15565,11 +16062,11 @@ function shellQuote(s) {
 }
 
 // src/services/providers/gitpod.ts
-var import_child_process13 = require("child_process");
+var import_child_process14 = require("child_process");
 var import_util4 = require("util");
-var path31 = __toESM(require("path"));
+var path33 = __toESM(require("path"));
 var import_picocolors8 = __toESM(require("picocolors"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process13.execFile);
+var execFileP5 = (0, import_util4.promisify)(import_child_process14.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -15609,7 +16106,7 @@ var GitpodProvider = class {
     );
     resetStdinForChild2();
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)("gitpod", ["login"], { stdio: "inherit" });
+      const proc = (0, import_child_process14.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
         if (code === 0) resolve4();
         else reject(new Error("gitpod login failed."));
@@ -15761,7 +16258,7 @@ var GitpodProvider = class {
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
     return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+      const proc = (0, import_child_process14.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
@@ -15781,11 +16278,11 @@ var GitpodProvider = class {
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
     await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
+      const tar = (0, import_child_process14.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process13.spawn)(
+      const ssh = (0, import_child_process14.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -15807,7 +16304,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path31.posix.dirname(remotePath);
+    const remoteDir = path33.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -15817,7 +16314,7 @@ var GitpodProvider = class {
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+      const proc = (0, import_child_process14.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -15841,10 +16338,10 @@ function shellQuote2(s) {
 }
 
 // src/services/providers/gitlab-workspaces.ts
-var import_child_process14 = require("child_process");
+var import_child_process15 = require("child_process");
 var import_util5 = require("util");
-var path32 = __toESM(require("path"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process14.execFile);
+var path34 = __toESM(require("path"));
+var execFileP6 = (0, import_util5.promisify)(import_child_process15.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -15886,7 +16383,7 @@ var GitLabWorkspacesProvider = class {
     );
     resetStdinForChild3();
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+      const proc = (0, import_child_process15.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
@@ -16058,7 +16555,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
     return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+      const proc = (0, import_child_process15.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
@@ -16079,8 +16576,8 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
     await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process14.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const ssh = (0, import_child_process14.spawn)(
+      const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const ssh = (0, import_child_process15.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16103,14 +16600,14 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path32.posix.dirname(remotePath);
+    const remoteDir = path34.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+      const proc = (0, import_child_process15.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16169,10 +16666,10 @@ function shellQuote3(s) {
 }
 
 // src/services/providers/railway.ts
-var import_child_process15 = require("child_process");
+var import_child_process16 = require("child_process");
 var import_util6 = require("util");
-var path33 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process15.execFile);
+var path35 = __toESM(require("path"));
+var execFileP7 = (0, import_util6.promisify)(import_child_process16.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -16213,7 +16710,7 @@ var RailwayProvider = class {
     );
     resetStdinForChild4();
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)("railway", ["login"], { stdio: "inherit" });
+      const proc = (0, import_child_process16.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
         if (code === 0) resolve4();
         else reject(new Error("railway login failed."));
@@ -16356,7 +16853,7 @@ var RailwayProvider = class {
     }
     resetStdinForChild4();
     return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+      const proc = (0, import_child_process16.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
@@ -16380,8 +16877,8 @@ var RailwayProvider = class {
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
     await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const sh = (0, import_child_process15.spawn)(
+      const tar = (0, import_child_process16.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const sh = (0, import_child_process16.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16407,14 +16904,14 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path33.posix.dirname(remotePath);
+    const remoteDir = path35.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+      const proc = (0, import_child_process16.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16948,8 +17445,8 @@ async function stopWorkspaceFromLocal(target) {
 
 // src/commands/link.ts
 var import_node_crypto4 = require("crypto");
-var fs26 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var fs27 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 var import_chokidar = __toESM(require("chokidar"));
 var import_picocolors11 = __toESM(require("picocolors"));
 function buildLinkContext(agentId) {
@@ -16987,7 +17484,7 @@ function parseLinkArgs(args2) {
   if (apiKeyFileArg) {
     const filePath = apiKeyFileArg.slice("--api-key-file=".length);
     try {
-      apiKey = fs26.readFileSync(path34.resolve(filePath), "utf8").trim();
+      apiKey = fs27.readFileSync(path36.resolve(filePath), "utf8").trim();
     } catch (err) {
       throw new Error(`Could not read --api-key-file ${filePath}: ${err.message}`);
     }
@@ -17081,7 +17578,7 @@ async function link(args2 = []) {
     return;
   }
   if (parsed.tokenFile) {
-    const credential = fs26.readFileSync(path34.resolve(parsed.tokenFile), "utf8").trim();
+    const credential = fs27.readFileSync(path36.resolve(parsed.tokenFile), "utf8").trim();
     if (!credential) {
       showError(`--token-file ${parsed.tokenFile} is empty.`);
       process.exit(1);
@@ -17270,8 +17767,8 @@ async function linkDryRunPreflight(ctx) {
 var import_node_dns = require("dns");
 var import_node_util4 = require("util");
 var import_node_crypto5 = require("crypto");
-var fs27 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 var import_picocolors12 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util4.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase) {
@@ -17327,13 +17824,13 @@ async function checkHealth(apiBase) {
   }
 }
 function checkConfigDir() {
-  const dir = path35.join(require("os").homedir(), ".codeam");
+  const dir = path37.join(require("os").homedir(), ".codeam");
   try {
-    fs27.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path35.join(dir, ".doctor-probe");
-    fs27.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs27.readFileSync(probe, "utf8");
-    fs27.unlinkSync(probe);
+    fs28.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path37.join(dir, ".doctor-probe");
+    fs28.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs28.readFileSync(probe, "utf8");
+    fs28.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -17397,7 +17894,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path35.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path37.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -17439,7 +17936,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.20.2" : "0.0.0-dev";
+  const cliVersion = true ? "2.21.0" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto5.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -17638,7 +18135,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.20.2" : "unknown";
+  const v = true ? "2.21.0" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -17766,9 +18263,9 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/lib/updateNotifier.ts
-var fs28 = __toESM(require("fs"));
+var fs29 = __toESM(require("fs"));
 var os25 = __toESM(require("os"));
-var path36 = __toESM(require("path"));
+var path38 = __toESM(require("path"));
 var https7 = __toESM(require("https"));
 var import_picocolors16 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
@@ -17776,12 +18273,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path36.join(os25.homedir(), ".codeam");
-  return path36.join(dir, "update-check.json");
+  const dir = path38.join(os25.homedir(), ".codeam");
+  return path38.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs28.readFileSync(cachePath(), "utf8");
+    const raw = fs29.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -17792,10 +18289,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs28.mkdirSync(path36.dirname(file), { recursive: true });
+    fs29.mkdirSync(path38.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs28.writeFileSync(tmp, JSON.stringify(cache));
-    fs28.renameSync(tmp, file);
+    fs29.writeFileSync(tmp, JSON.stringify(cache));
+    fs29.renameSync(tmp, file);
   } catch {
   }
 }
@@ -17866,7 +18363,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.20.2" : null;
+  const current = true ? "2.21.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;