codeam-cli 2.21.0 → 2.21.2

package/dist/index.js

@@ -441,7 +441,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.21.0",
+  version: "2.21.2",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -735,7 +735,7 @@ async function postLinkCredential(input) {
   }
 }
 async function _postJsonAuthed(url, body, pluginAuthToken) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -767,9 +767,9 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
             return;
           }
           try {
-            resolve4(JSON.parse(responseBody));
+            resolve5(JSON.parse(responseBody));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -784,7 +784,7 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
   });
 }
 async function _postJson(url, body) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -813,9 +813,9 @@ async function _postJson(url, body) {
             return;
           }
           try {
-            resolve4(JSON.parse(body2));
+            resolve5(JSON.parse(body2));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -830,7 +830,7 @@ async function _postJson(url, body) {
   });
 }
 async function _getJson(url) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
     const req = transport.request(
@@ -854,9 +854,9 @@ async function _getJson(url) {
             return;
           }
           try {
-            resolve4(JSON.parse(body));
+            resolve5(JSON.parse(body));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -1026,8 +1026,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path39) {
-  return path39.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path40) {
+  return path40.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -3507,15 +3507,15 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path39, ranges, output) {
-  return new Promise((resolve4) => {
-    const stream = (0, import_node_fs.createReadStream)(path39);
+function getContextLinesFromFile(path40, ranges, output) {
+  return new Promise((resolve5) => {
+    const stream = (0, import_node_fs.createReadStream)(path40);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
     function destroyStreamAndResolve() {
       stream.destroy();
-      resolve4();
+      resolve5();
     }
     let lineNumber = 0;
     let currentRangeIndex = 0;
@@ -3524,7 +3524,7 @@ function getContextLinesFromFile(path39, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path39, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path40, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3585,8 +3585,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path39) {
-  return path39.startsWith("node:") || path39.endsWith(".min.js") || path39.endsWith(".min.cjs") || path39.endsWith(".min.mjs") || path39.startsWith("data:");
+function shouldSkipContextLinesForFile(path40) {
+  return path40.startsWith("node:") || path40.endsWith(".min.js") || path40.endsWith(".min.cjs") || path40.endsWith(".min.mjs") || path40.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -4802,9 +4802,9 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     if (!waitUntil) return;
     if (this.disabled || this.optedOut) return;
     if (!this._waitUntilCycle) {
-      let resolve4;
+      let resolve5;
       const promise = new Promise((r) => {
-        resolve4 = r;
+        resolve5 = r;
       });
       try {
         waitUntil(promise);
@@ -4812,7 +4812,7 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
         return;
       }
       this._waitUntilCycle = {
-        resolve: resolve4,
+        resolve: resolve5,
         startedAt: Date.now(),
         timer: void 0
       };
@@ -4836,12 +4836,12 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     return cycle?.resolve;
   }
   async resolveWaitUntilFlush() {
-    const resolve4 = this._consumeWaitUntilCycle();
+    const resolve5 = this._consumeWaitUntilCycle();
     try {
       await super.flush();
     } catch {
     } finally {
-      resolve4?.();
+      resolve5?.();
     }
   }
   getPersistedProperty(key) {
@@ -4933,15 +4933,15 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
   async waitForLocalEvaluationReady(timeoutMs = THIRTY_SECONDS) {
     if (this.isLocalEvaluationReady()) return true;
     if (void 0 === this.featureFlagsPoller) return false;
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const timeout = setTimeout(() => {
         cleanup();
-        resolve4(false);
+        resolve5(false);
       }, timeoutMs);
       const cleanup = this._events.on("localEvaluationFlagsLoaded", (count) => {
         clearTimeout(timeout);
         cleanup();
-        resolve4(count > 0);
+        resolve5(count > 0);
       });
     });
   }
@@ -5378,13 +5378,13 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     this.context?.enter(data, options);
   }
   async _shutdown(shutdownTimeoutMs) {
-    const resolve4 = this._consumeWaitUntilCycle();
+    const resolve5 = this._consumeWaitUntilCycle();
     await this.featureFlagsPoller?.stopPoller(shutdownTimeoutMs);
     this.errorTracking.shutdown();
     try {
       return await super._shutdown(shutdownTimeoutMs);
     } finally {
-      resolve4?.();
+      resolve5?.();
     }
   }
   async _requestRemoteConfigPayload(flagKey) {
@@ -5740,7 +5740,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.21.0" : "0.0.0-dev",
+    cliVersion: true ? "2.21.2" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8874,15 +8874,15 @@ function runInstaller() {
     "-Command",
     "irm https://claude.ai/install.ps1 | iex"
   ] : ["-c", "curl -fsSL https://claude.ai/install.sh | bash"];
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const proc = (0, import_child_process4.spawn)(cmd, args2, { stdio: "inherit" });
     proc.on("error", (err) => {
       console.error(`
   \u2717 Installer failed to launch: ${err.message}`);
-      resolve4(false);
+      resolve5(false);
     });
     proc.on("exit", (code) => {
-      resolve4(code === 0);
+      resolve5(code === 0);
     });
   });
 }
@@ -9045,17 +9045,17 @@ function parseUsageOutput(raw) {
   return { percent, resetAt };
 }
 async function fetchClaudeQuota() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const claudeCmd = findInPath("claude") ? "claude" : "claude-code";
     if (!claudeCmd) {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     const helperPath = path11.join(os10.tmpdir(), "codeam-quota-helper.py");
     fs8.writeFileSync(helperPath, HELPER_SCRIPT, { mode: 420 });
     const python = findInPath("python3") ?? findInPath("python");
     if (!python) {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     const proc = (0, import_child_process5.spawn)(python, [helperPath, claudeCmd, "--tools", ""], {
@@ -9082,13 +9082,13 @@ async function fetchClaudeQuota() {
           fs8.unlinkSync(helperPath);
         } catch {
         }
-        resolve4(result);
+        resolve5(result);
       }, 5e3);
     }, 8e3);
     setTimeout(() => {
       if (!resolved) {
         resolved = true;
-        resolve4(null);
+        resolve5(null);
       }
       try {
         proc.kill();
@@ -10428,12 +10428,12 @@ function resolveNpm(os26) {
   return os26.id === "win32" ? "npm.cmd" : "npm";
 }
 async function installCodexViaNpm(os26) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = (0, import_node_child_process4.spawn)(resolveNpm(os26), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
-      if (code === 0) resolve4();
+      if (code === 0) resolve5();
       else reject(new Error(`npm install -g @openai/codex exited ${code}`));
     });
     proc.on("error", (err) => {
@@ -10548,12 +10548,12 @@ async function ensureCoderabbitInstalled(os26) {
     return false;
   }
   console.log("\n  CodeRabbit CLI not found \u2014 installing via the official script\u2026\n");
-  const ok = await new Promise((resolve4) => {
+  const ok = await new Promise((resolve5) => {
     const proc = (0, import_node_child_process5.spawn)("sh", ["-c", `curl -fsSL ${INSTALL_URL} | sh`], {
       stdio: "inherit"
     });
-    proc.on("close", (code) => resolve4(code === 0));
-    proc.on("error", () => resolve4(false));
+    proc.on("close", (code) => resolve5(code === 0));
+    proc.on("error", () => resolve5(false));
   });
   if (!ok) return false;
   os26.augmentPath([`${os26.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
@@ -10610,11 +10610,11 @@ function parseReview(stdout) {
   for (const line of lines) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path39, lineNo, sevToken, message] = m;
-    if (!path39 || !lineNo || !message) continue;
+    const [, path40, lineNo, sevToken, message] = m;
+    if (!path40 || !lineNo || !message) continue;
     const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
-      path: path39.trim(),
+      path: path40.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: cleanedMessage
@@ -10672,7 +10672,7 @@ var CoderabbitRuntimeStrategy = class {
   }
   async runOneShot(input) {
     const launch = await this.prepareInvocation(input);
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const stdoutBuf = [];
       const stderrBuf = [];
       const proc = (0, import_node_child_process7.spawn)(launch.cmd, launch.args, {
@@ -10683,7 +10683,7 @@ var CoderabbitRuntimeStrategy = class {
       proc.stderr?.on("data", (b) => stderrBuf.push(b));
       proc.on("error", (err) => reject(err));
       proc.on("close", (code) => {
-        resolve4(
+        resolve5(
           this.parseOutput({
             exitCode: code ?? 0,
             stdout: Buffer.concat(stdoutBuf).toString("utf8"),
@@ -11216,14 +11216,14 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const attempt = (attemptsLeft) => {
         _transport2.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
           if (statusCode === 410 || statusCode === 404 && /SESSION_NOT_FOUND|SESSION_GONE/.test(resBody)) {
             process.stderr.write("[codeam] session was deleted/disconnected \u2014 stopping output stream.\n");
             log.info("chunkEmitter", `dead status=${statusCode} took=${tookMs}ms`);
-            resolve4({ dead: true });
+            resolve5({ dead: true });
             return;
           }
           if (statusCode >= 400) {
@@ -11233,7 +11233,7 @@ var ChunkEmitter = class {
           } else {
             log.info("chunkEmitter", `ok status=${statusCode} took=${tookMs}ms`);
           }
-          resolve4({ dead: false });
+          resolve5({ dead: false });
         }).catch((err) => {
           log.warn(
             "chunkEmitter",
@@ -11244,7 +11244,7 @@ var ChunkEmitter = class {
             const delay = 200 * (maxRetries - attemptsLeft + 1);
             setTimeout(() => attempt(attemptsLeft - 1), delay);
           } else {
-            resolve4({ dead: false });
+            resolve5({ dead: false });
           }
         });
       };
@@ -11256,7 +11256,7 @@ var _transport2 = {
   post: _post
 };
 function _post(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https3 : http3;
@@ -11280,7 +11280,7 @@ function _post(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body: resData });
+          resolve5({ statusCode: res.statusCode ?? 0, body: resData });
         });
       }
     );
@@ -11781,7 +11781,7 @@ function parseJsonl(filePath) {
   return messages;
 }
 function post(endpoint, body) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE4}${endpoint}`);
     const transport = u2.protocol === "https:" ? https4 : http4;
@@ -11802,17 +11802,17 @@ function post(endpoint, body) {
         res.resume();
         const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
         if (!ok) log.warn("history:post", `${endpoint} \u2192 HTTP ${res.statusCode}`);
-        resolve4(ok);
+        resolve5(ok);
       }
     );
     req.on("error", (err) => {
       log.warn("history:post", `${endpoint} network error`, err);
-      resolve4(false);
+      resolve5(false);
     });
     req.on("timeout", () => {
       log.warn("history:post", `${endpoint} timeout after 15s`);
       req.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     req.write(payload);
     req.end();
@@ -12296,7 +12296,7 @@ var _transport3 = {
   post: _post2
 };
 function _post2(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https5 : http5;
@@ -12321,7 +12321,7 @@ function _post2(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -12691,6 +12691,7 @@ var FileWatcherService = class {
       "X-Plugin-Auth-Token": this.opts.pluginAuthToken
     };
     for (let attempt = 0; attempt <= MAX_RETRIES; attempt += 1) {
+      if (this.stopped) return;
       try {
         const { statusCode, body: resBody } = await _transport3.post(url, headers, payload);
         if (statusCode >= 200 && statusCode < 300) {
@@ -12739,12 +12740,12 @@ var _gitSeam = {
   run: _runGitImpl
 };
 async function _runGitImpl(cwd, args2, opts = {}) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let proc;
     try {
       proc = (0, import_child_process7.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     let stdout = "";
@@ -12755,13 +12756,13 @@ async function _runGitImpl(cwd, args2, opts = {}) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve4(null));
+    proc.on("error", () => resolve5(null));
     proc.on("close", (code) => {
       if (code === 0 || opts.allowNonZeroExit) {
-        resolve4(stdout);
+        resolve5(stdout);
       } else {
         log.trace("fileWatcher", `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`);
-        resolve4(null);
+        resolve5(null);
       }
     });
   });
@@ -12854,12 +12855,12 @@ function runGit2(cwd, args2) {
   return _runGitImpl2.run(cwd, args2);
 }
 function defaultRunGit(cwd, args2) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let proc;
     try {
       proc = (0, import_child_process8.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     let stdout = "";
@@ -12870,22 +12871,22 @@ function defaultRunGit(cwd, args2) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve4(null));
+    proc.on("error", () => resolve5(null));
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout);
+        resolve5(stdout);
       } else {
         log.trace(
           "turnFiles",
           `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`
         );
-        resolve4(null);
+        resolve5(null);
       }
     });
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs30 = await import("fs/promises");
+  const fs31 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -12893,7 +12894,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs30.readdir(dir, { withFileTypes: true });
+      const dirents = await fs31.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -13265,7 +13266,7 @@ var _transport4 = {
   get: _get
 };
 function _post3(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -13290,7 +13291,7 @@ function _post3(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -13307,7 +13308,7 @@ function _post3(url, headers, payload) {
   });
 }
 function _get(url, headers) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -13331,7 +13332,7 @@ function _get(url, headers) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -13714,7 +13715,7 @@ function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const proc = (0, import_child_process9.spawn)(
         "gh",
         [
@@ -13728,8 +13729,8 @@ function buildKeepAlive(ctx) {
         { stdio: "ignore", detached: true }
       );
       proc.unref();
-      proc.on("exit", () => resolve4());
-      proc.on("error", () => resolve4());
+      proc.on("exit", () => resolve5());
+      proc.on("error", () => resolve5());
     });
   }
   return {
@@ -13752,11 +13753,11 @@ function buildKeepAlive(ctx) {
 }
 
 // src/commands/start/handlers.ts
-var fs25 = __toESM(require("fs"));
+var fs26 = __toESM(require("fs"));
 var os23 = __toESM(require("os"));
-var path31 = __toESM(require("path"));
+var path32 = __toESM(require("path"));
 var import_crypto5 = require("crypto");
-var import_child_process12 = require("child_process");
+var import_child_process13 = require("child_process");
 
 // src/lib/payload.ts
 var import_zod2 = require("zod");
@@ -13804,7 +13805,15 @@ var startCommandSchema = import_zod2.z.object({
   data: import_zod2.z.string().max(64 * 1024).optional(),
   cwd: import_zod2.z.string().max(4096).optional(),
   cols: import_zod2.z.number().int().min(1).max(500).optional(),
-  rows: import_zod2.z.number().int().min(1).max(200).optional()
+  rows: import_zod2.z.number().int().min(1).max(200).optional(),
+  // `apply_file_review` (Epic B follow-up — backend pushes this when
+  // the user clicks APPROVE_CHANGES / REJECT_CHANGES in the diff
+  // drawer). `filePath` is relative to the enclosing git repo; the
+  // handler walks up from it to find `.git/` and runs `git add` or
+  // `git restore` from there. `action='approved'` stages the edit,
+  // `action='rejected'` discards every worktree change on the file.
+  filePath: import_zod2.z.string().min(1).max(4096).optional(),
+  action: import_zod2.z.enum(["approved", "rejected"]).optional()
 });
 function parsePayload2(schema, raw) {
   const result = schema.safeParse(raw);
@@ -14560,12 +14569,96 @@ function closeAllTerminals() {
   for (const id of Array.from(sessions.keys())) closeTerminal(id);
 }
 
+// src/services/apply-file-review.service.ts
+var import_child_process12 = require("child_process");
+var fs25 = __toESM(require("fs"));
+var path31 = __toESM(require("path"));
+async function applyFileReview(workingDir, filePath, action) {
+  if (filePath.includes("..") || path31.isAbsolute(filePath)) {
+    return { ok: false, action, filePath, error: "invalid file path" };
+  }
+  const absFile = path31.resolve(workingDir, filePath);
+  const repoRoot = findGitRoot2(path31.dirname(absFile));
+  if (!repoRoot) {
+    return {
+      ok: false,
+      action,
+      filePath,
+      error: `no enclosing git repo for ${filePath}`
+    };
+  }
+  const relInRepo = path31.relative(repoRoot, absFile);
+  if (!relInRepo || relInRepo.startsWith("..")) {
+    return { ok: false, action, filePath, error: "path escapes repo root" };
+  }
+  const args2 = action === "approved" ? ["add", "--", relInRepo] : ["restore", "--", relInRepo];
+  const result = await runGit3(repoRoot, args2);
+  if (!result.ok) {
+    return {
+      ok: false,
+      action,
+      filePath,
+      repoRoot,
+      error: result.stderr.slice(0, 500) || `git ${args2[0]} exited ${result.code}`
+    };
+  }
+  log.info(
+    "reviewApply",
+    `git ${args2[0]} ${relInRepo} in ${repoRoot} \u2014 ok`
+  );
+  return { ok: true, action, filePath, repoRoot };
+}
+function runGit3(cwd, args2) {
+  return new Promise((resolve5) => {
+    let proc;
+    try {
+      proc = (0, import_child_process12.spawn)("git", args2, { cwd, env: process.env });
+    } catch (err) {
+      resolve5({ ok: false, code: -1, stdout: "", stderr: err.message });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    proc.stdout?.on("data", (c2) => {
+      stdout += c2.toString();
+    });
+    proc.stderr?.on("data", (c2) => {
+      stderr += c2.toString();
+    });
+    proc.on(
+      "error",
+      (err) => resolve5({ ok: false, code: -1, stdout, stderr: stderr + err.message })
+    );
+    proc.on(
+      "close",
+      (code) => resolve5({ ok: code === 0, code: code ?? -1, stdout, stderr })
+    );
+  });
+}
+function findGitRoot2(startDir) {
+  let dir = path31.resolve(startDir);
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < 256; i++) {
+    if (seen.has(dir)) return null;
+    seen.add(dir);
+    try {
+      const stat3 = fs25.statSync(path31.join(dir, ".git"), { throwIfNoEntry: false });
+      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
+    } catch {
+    }
+    const parent = path31.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
 // src/commands/start/handlers.ts
 var pendingAttachmentFiles = /* @__PURE__ */ new Set();
 function cleanupAttachmentTempFiles() {
   for (const p2 of pendingAttachmentFiles) {
     try {
-      fs25.unlinkSync(p2);
+      fs26.unlinkSync(p2);
     } catch {
     }
   }
@@ -14574,8 +14667,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path31.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
-    fs25.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path32.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
+    fs26.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -14595,7 +14688,7 @@ var startTask = (ctx, _cmd, parsed) => {
     setTimeout(() => {
       for (const p2 of paths) {
         try {
-          fs25.unlinkSync(p2);
+          fs26.unlinkSync(p2);
         } catch {
         }
         pendingAttachmentFiles.delete(p2);
@@ -14708,7 +14801,7 @@ var sessionTerminated = (ctx) => {
   } catch {
   }
   try {
-    const proc = (0, import_child_process12.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14730,7 +14823,7 @@ var shutdownSession = async (ctx, cmd) => {
   }
   if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
     try {
-      const stopProc = (0, import_child_process12.spawn)(
+      const stopProc = (0, import_child_process13.spawn)(
         "bash",
         ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
         { detached: true, stdio: "ignore" }
@@ -14740,7 +14833,7 @@ var shutdownSession = async (ctx, cmd) => {
     }
   }
   try {
-    const proc = (0, import_child_process12.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14863,6 +14956,24 @@ var gitResolveH = async (ctx, cmd, parsed) => {
   const result = await gitResolve(parsed.path, parsed.side);
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
+var applyFileReviewH = async (ctx, cmd, parsed) => {
+  if (!parsed.filePath || !parsed.action) {
+    await ctx.relay.sendResult(cmd.id, "failed", {
+      error: "Missing filePath or action"
+    });
+    return;
+  }
+  const result = await applyFileReview(
+    process.cwd(),
+    parsed.filePath,
+    parsed.action
+  );
+  await ctx.relay.sendResult(
+    cmd.id,
+    result.ok ? "completed" : "failed",
+    result
+  );
+};
 var handlers = {
   start_task: startTask,
   provide_input: provideInput,
@@ -14893,7 +15004,8 @@ var handlers = {
   git_commit: gitCommitH,
   git_push: gitPushH,
   git_pull: gitPullH,
-  git_resolve: gitResolveH
+  git_resolve: gitResolveH,
+  apply_file_review: applyFileReviewH
 };
 async function dispatchCommand(ctx, cmd) {
   const parsed = parsePayload2(startCommandSchema, cmd.payload);
@@ -15173,7 +15285,7 @@ async function pair(args2 = []) {
     waitSpin.message(waitMessage());
   }, 1e3);
   countdownInterval.unref?.();
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     let stopPolling = null;
     function sigintHandler() {
       clearInterval(countdownInterval);
@@ -15213,7 +15325,7 @@ async function pair(args2 = []) {
         });
         showSuccess(`Paired with ${info.userName} (${info.plan})`);
         console.log("");
-        resolve4();
+        resolve5();
       },
       () => {
         clearInterval(countdownInterval);
@@ -15229,7 +15341,7 @@ async function pair(args2 = []) {
 }
 
 // src/commands/pair-auto.ts
-var fs26 = __toESM(require("fs"));
+var fs27 = __toESM(require("fs"));
 var os24 = __toESM(require("os"));
 var import_crypto7 = require("crypto");
 var API_BASE8 = resolveApiBaseUrl();
@@ -15247,12 +15359,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path39 = fileFlag.slice("--token-file=".length);
+    const path40 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs26.readFileSync(path39, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path39} is empty`);
+      const content = fs27.readFileSync(path40, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path40} is empty`);
       try {
-        fs26.unlinkSync(path39);
+        fs27.unlinkSync(path40);
       } catch {
       }
       return content;
@@ -15502,11 +15614,11 @@ async function logout() {
 var import_picocolors9 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
-var import_child_process13 = require("child_process");
+var import_child_process14 = require("child_process");
 var import_util3 = require("util");
 var import_picocolors7 = __toESM(require("picocolors"));
-var path32 = __toESM(require("path"));
-var execFileP4 = (0, import_util3.promisify)(import_child_process13.execFile);
+var path33 = __toESM(require("path"));
+var execFileP4 = (0, import_util3.promisify)(import_child_process14.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -15549,12 +15661,12 @@ var GitHubCodespacesProvider = class {
     }
     if (!isAuthed) {
       resetStdinForChild();
-      await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process13.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
+      await new Promise((resolve5, reject) => {
+        const proc = (0, import_child_process14.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
-          if (code === 0) resolve4();
+          if (code === 0) resolve5();
           else reject(new Error("gh auth login failed."));
         });
         proc.on("error", reject);
@@ -15583,13 +15695,13 @@ var GitHubCodespacesProvider = class {
       }
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
-      const refreshCode = await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process13.spawn)(
+      const refreshCode = await new Promise((resolve5, reject) => {
+        const proc = (0, import_child_process14.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
         );
-        proc.on("exit", (code) => resolve4(code ?? 1));
+        proc.on("exit", (code) => resolve5(code ?? 1));
         proc.on("error", reject);
       });
       if (refreshCode !== 0) {
@@ -15733,10 +15845,10 @@ var GitHubCodespacesProvider = class {
     if (q(proceed) || !proceed) return;
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
-    const ok = await new Promise((resolve4) => {
-      const proc = (0, import_child_process13.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
-      proc.on("exit", (code) => resolve4(code === 0));
-      proc.on("error", () => resolve4(false));
+    const ok = await new Promise((resolve5) => {
+      const proc = (0, import_child_process14.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
+      proc.on("exit", (code) => resolve5(code === 0));
+      proc.on("error", () => resolve5(false));
     });
     if (ok) O2.success("gh installed");
     else O2.error("gh install failed");
@@ -15760,14 +15872,14 @@ var GitHubCodespacesProvider = class {
       "Expanding GitHub scopes"
     );
     resetStdinForChild();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(
           "gh auth refresh failed. Re-run `gh auth refresh -h github.com -s repo,read:org` manually."
         ));
@@ -15938,13 +16050,13 @@ var GitHubCodespacesProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -15965,12 +16077,12 @@ var GitHubCodespacesProvider = class {
       "--",
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process14.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process13.spawn)("gh", sshArgs, {
+      const ssh = (0, import_child_process14.spawn)("gh", sshArgs, {
         stdio: [tar.stdout, "pipe", "pipe"]
       });
       let tarErr = "";
@@ -15985,7 +16097,7 @@ var GitHubCodespacesProvider = class {
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
         if (code === 0) {
-          resolve4();
+          resolve5();
         } else {
           const reason = (sshErr || tarErr || `exit ${code}`).trim().slice(0, 500);
           reject(new Error(`Remote tar failed: ${reason}`));
@@ -15994,7 +16106,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path32.posix.dirname(remotePath);
+    const remoteDir = path33.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -16003,8 +16115,8 @@ var GitHubCodespacesProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16015,7 +16127,7 @@ var GitHubCodespacesProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -16062,11 +16174,11 @@ function shellQuote(s) {
 }
 
 // src/services/providers/gitpod.ts
-var import_child_process14 = require("child_process");
+var import_child_process15 = require("child_process");
 var import_util4 = require("util");
-var path33 = __toESM(require("path"));
+var path34 = __toESM(require("path"));
 var import_picocolors8 = __toESM(require("picocolors"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process14.execFile);
+var execFileP5 = (0, import_util4.promisify)(import_child_process15.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -16105,10 +16217,10 @@ var GitpodProvider = class {
       "Authenticating Gitpod"
     );
     resetStdinForChild2();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)("gitpod", ["login"], { stdio: "inherit" });
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("gitpod login failed."));
       });
       proc.on("error", reject);
@@ -16257,13 +16369,13 @@ var GitpodProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -16277,12 +16389,12 @@ var GitpodProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process14.spawn)("tar", tarArgs, {
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process15.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process14.spawn)(
+      const ssh = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16298,13 +16410,13 @@ var GitpodProvider = class {
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path33.posix.dirname(remotePath);
+    const remoteDir = path34.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -16313,8 +16425,8 @@ var GitpodProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16325,7 +16437,7 @@ var GitpodProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -16338,10 +16450,10 @@ function shellQuote2(s) {
 }
 
 // src/services/providers/gitlab-workspaces.ts
-var import_child_process15 = require("child_process");
+var import_child_process16 = require("child_process");
 var import_util5 = require("util");
-var path34 = __toESM(require("path"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process15.execFile);
+var path35 = __toESM(require("path"));
+var execFileP6 = (0, import_util5.promisify)(import_child_process16.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -16382,14 +16494,14 @@ var GitLabWorkspacesProvider = class {
       "Authenticating GitLab"
     );
     resetStdinForChild3();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("glab auth login failed."));
       });
       proc.on("error", reject);
@@ -16554,13 +16666,13 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async streamCommand(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -16575,9 +16687,9 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const ssh = (0, import_child_process15.spawn)(
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process16.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const ssh = (0, import_child_process16.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16593,21 +16705,21 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path34.posix.dirname(remotePath);
+    const remoteDir = path35.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16618,7 +16730,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -16666,10 +16778,10 @@ function shellQuote3(s) {
 }
 
 // src/services/providers/railway.ts
-var import_child_process16 = require("child_process");
+var import_child_process17 = require("child_process");
 var import_util6 = require("util");
-var path35 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process16.execFile);
+var path36 = __toESM(require("path"));
+var execFileP7 = (0, import_util6.promisify)(import_child_process17.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -16709,10 +16821,10 @@ var RailwayProvider = class {
       "Authenticating Railway"
     );
     resetStdinForChild4();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process16.spawn)("railway", ["login"], { stdio: "inherit" });
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("railway login failed."));
       });
       proc.on("error", reject);
@@ -16852,13 +16964,13 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     resetStdinForChild4();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process16.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -16876,9 +16988,9 @@ var RailwayProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process16.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const sh = (0, import_child_process16.spawn)(
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process17.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const sh = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16894,7 +17006,7 @@ var RailwayProvider = class {
       tar.on("error", reject);
       sh.on("error", reject);
       sh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -16904,14 +17016,14 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path35.posix.dirname(remotePath);
+    const remoteDir = path36.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process16.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16922,7 +17034,7 @@ var RailwayProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -17445,8 +17557,8 @@ async function stopWorkspaceFromLocal(target) {
 
 // src/commands/link.ts
 var import_node_crypto4 = require("crypto");
-var fs27 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 var import_chokidar = __toESM(require("chokidar"));
 var import_picocolors11 = __toESM(require("picocolors"));
 function buildLinkContext(agentId) {
@@ -17484,7 +17596,7 @@ function parseLinkArgs(args2) {
   if (apiKeyFileArg) {
     const filePath = apiKeyFileArg.slice("--api-key-file=".length);
     try {
-      apiKey = fs27.readFileSync(path36.resolve(filePath), "utf8").trim();
+      apiKey = fs28.readFileSync(path37.resolve(filePath), "utf8").trim();
     } catch (err) {
       throw new Error(`Could not read --api-key-file ${filePath}: ${err.message}`);
     }
@@ -17529,7 +17641,7 @@ async function link(args2 = []) {
   waitSpin.start(waitMsg());
   const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
   countdown.unref?.();
-  const paired = await new Promise((resolve4, reject) => {
+  const paired = await new Promise((resolve5, reject) => {
     let stopPoll = null;
     const sigint = () => {
       clearInterval(countdown);
@@ -17542,7 +17654,7 @@ async function link(args2 = []) {
         process.removeListener("SIGINT", sigint);
         clearInterval(countdown);
         waitSpin.stop("Paired");
-        resolve4(info);
+        resolve5(info);
       },
       () => {
         clearInterval(countdown);
@@ -17578,7 +17690,7 @@ async function link(args2 = []) {
     return;
   }
   if (parsed.tokenFile) {
-    const credential = fs27.readFileSync(path36.resolve(parsed.tokenFile), "utf8").trim();
+    const credential = fs28.readFileSync(path37.resolve(parsed.tokenFile), "utf8").trim();
     if (!credential) {
       showError(`--token-file ${parsed.tokenFile} is empty.`);
       process.exit(1);
@@ -17648,14 +17760,14 @@ async function captureFreshCredentials(ctx) {
     }
   };
   try {
-    const token = await new Promise((resolve4, reject) => {
+    const token = await new Promise((resolve5, reject) => {
       let settled = false;
       const tryExtract = async () => {
         if (settled) return;
         const t2 = await ctx.locator.extract();
         if (t2 && !settled) {
           settled = true;
-          resolve4(t2);
+          resolve5(t2);
         }
       };
       watcher.on("add", () => void tryExtract());
@@ -17767,8 +17879,8 @@ async function linkDryRunPreflight(ctx) {
 var import_node_dns = require("dns");
 var import_node_util4 = require("util");
 var import_node_crypto5 = require("crypto");
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 var import_picocolors12 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util4.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase) {
@@ -17824,13 +17936,13 @@ async function checkHealth(apiBase) {
   }
 }
 function checkConfigDir() {
-  const dir = path37.join(require("os").homedir(), ".codeam");
+  const dir = path38.join(require("os").homedir(), ".codeam");
   try {
-    fs28.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path37.join(dir, ".doctor-probe");
-    fs28.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs28.readFileSync(probe, "utf8");
-    fs28.unlinkSync(probe);
+    fs29.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path38.join(dir, ".doctor-probe");
+    fs29.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs29.readFileSync(probe, "utf8");
+    fs29.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -17894,7 +18006,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path37.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path38.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -17936,7 +18048,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.21.0" : "0.0.0-dev";
+  const cliVersion = true ? "2.21.2" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto5.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -18135,7 +18247,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.21.0" : "unknown";
+  const v = true ? "2.21.2" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -18263,9 +18375,9 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/lib/updateNotifier.ts
-var fs29 = __toESM(require("fs"));
+var fs30 = __toESM(require("fs"));
 var os25 = __toESM(require("os"));
-var path38 = __toESM(require("path"));
+var path39 = __toESM(require("path"));
 var https7 = __toESM(require("https"));
 var import_picocolors16 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
@@ -18273,12 +18385,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path38.join(os25.homedir(), ".codeam");
-  return path38.join(dir, "update-check.json");
+  const dir = path39.join(os25.homedir(), ".codeam");
+  return path39.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs29.readFileSync(cachePath(), "utf8");
+    const raw = fs30.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -18289,10 +18401,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs29.mkdirSync(path38.dirname(file), { recursive: true });
+    fs30.mkdirSync(path39.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs29.writeFileSync(tmp, JSON.stringify(cache));
-    fs29.renameSync(tmp, file);
+    fs30.writeFileSync(tmp, JSON.stringify(cache));
+    fs30.renameSync(tmp, file);
   } catch {
   }
 }
@@ -18310,14 +18422,14 @@ function compareSemver(a, b) {
   return 0;
 }
 function fetchLatest() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const req = https7.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve4(null);
+          resolve5(null);
           return;
         }
         let buf = "";
@@ -18329,21 +18441,21 @@ function fetchLatest() {
           try {
             const json = JSON.parse(buf);
             if (typeof json.version === "string") {
-              resolve4(json.version);
+              resolve5(json.version);
             } else {
-              resolve4(null);
+              resolve5(null);
             }
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve4(null);
+      resolve5(null);
     });
-    req.on("error", () => resolve4(null));
+    req.on("error", () => resolve5(null));
   });
 }
 function notifyIfStale(currentVersion, latest) {
@@ -18363,7 +18475,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.21.0" : null;
+  const current = true ? "2.21.2" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;