codeam-cli 2.26.13 → 2.26.15

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.26.14] — 2026-06-04
+
+### Chore
+
+- **deps:** Bump actions/setup-node from 4 to 6 (#246)
+- **deps:** Bump actions/checkout from 4 to 6 (#247)
+- **deps:** Bump org.jetbrains.kotlin.jvm in /apps/jetbrains-plugin (#248)
+- **cli:** Bump which 2.0.2 → 5.0.0 (#251)
+
+### Fixed
+
+- **cli:** Drop redundant install from agent setup_commands + warn agent (#256)
+
+## [2.26.13] — 2026-06-04
+
+### Added
+
+- **cli:** Pre-flight install for missing node_modules before preview (#250)
+
 ## [2.26.12] — 2026-06-04
 
 ### Fixed

package/dist/index.js

@@ -344,7 +344,7 @@ Return ONLY a JSON object on stdout (no prose, no markdown fences):
   "port": <number>,
   "ready_pattern": "<regex matching the server-ready stdout line>",
   "env": { "HOST": "0.0.0.0" },
-  "setup_commands": [{"cmd":"npm","args":["install"]}],
+  "setup_commands": [],
   "notes": "<one-line caveat or null>"
 }
 
@@ -354,6 +354,20 @@ Rules:
 - For Expo: framework="Expo", command="npx", args=["expo","start","--tunnel"], port=8081, notes="Scan QR with Expo Go".
 - If no dev server applies (CLI library, lambda, batch script): {"framework":"unsupported","notes":"<reason>"}.
 
+CRITICAL \u2014 setup_commands:
+- DO NOT include an install command (npm install, pnpm install, yarn install,
+  yarn, bun install) in setup_commands. A lockfile-aware pre-flight installer
+  runs BEFORE setup_commands and picks the correct package manager from the
+  lockfile present (pnpm-lock.yaml -> pnpm, yarn.lock -> yarn, bun.lockb -> bun,
+  else npm). Emitting an install here either duplicates that work or, worse,
+  uses the WRONG package manager on top of node_modules just populated by the
+  pre-flight, which crashes (e.g. npm errors with "Cannot read properties of
+  null (reading 'matches')" when run over pnpm's .pnpm/ layout).
+- ONLY include setup_commands for genuinely non-install work the project needs
+  before its dev server can boot: prisma generate, codegen, prebuild scripts,
+  database migrations against a local SQLite, etc.
+- For most projects, setup_commands should be an empty array [].
+
 OUTPUT JSON ONLY. NO MARKDOWN. NO COMMENTARY.
 `.trim();
 
@@ -472,7 +486,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.26.13",
+  version: "2.26.15",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -546,7 +560,7 @@ var package_default = {
     chokidar: "^3.6.0",
     picocolors: "^1.1.0",
     "qrcode-terminal": "^0.12.0",
-    which: "^2.0.2",
+    which: "^5.0.0",
     ws: "^8.18.0",
     zod: "^4.3.6"
   },
@@ -5829,7 +5843,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.26.13" : "0.0.0-dev",
+    cliVersion: true ? "2.26.15" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10874,6 +10888,40 @@ async function extractLocalCodexToken() {
 function codexCredentialsPaths() {
   return [codexCredentialsPath()];
 }
+function validateLocalCodexToken(credential) {
+  let parsed;
+  try {
+    parsed = JSON.parse(credential);
+  } catch {
+    return { status: "unknown" };
+  }
+  const directExp = typeof parsed.expires_at === "number" ? parsed.expires_at : typeof parsed.tokens?.expires_at === "number" ? parsed.tokens.expires_at : void 0;
+  const jwtExp = decodeJwtExp(parsed.tokens?.id_token);
+  const exp = directExp ?? jwtExp;
+  if (exp === void 0) return { status: "unknown" };
+  const expiresAt = exp < 1e12 ? exp * 1e3 : exp;
+  if (Date.now() >= expiresAt) {
+    return {
+      status: "expired",
+      reason: "Codex OAuth access token expired",
+      expiresAt
+    };
+  }
+  return { status: "valid", expiresAt };
+}
+function decodeJwtExp(jwt) {
+  if (!jwt) return void 0;
+  const parts = jwt.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "===".slice((base64.length + 3) % 4);
+    const payload = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
 
 // src/agents/codex/link.ts
 function codexCredentialLocator() {
@@ -10882,7 +10930,11 @@ function codexCredentialLocator() {
     vendor: "OpenAI",
     hint: "~/.codex/auth.json",
     watchPaths: codexCredentialsPaths,
-    extract: extractLocalCodexToken
+    extract: extractLocalCodexToken,
+    validate: (token) => {
+      const result = validateLocalCodexToken(token.credential);
+      return { status: result.status, reason: result.reason };
+    }
   };
 }
 function codexLoginLauncher() {
@@ -15893,6 +15945,7 @@ async function link(args2 = []) {
   installSpin.stop(`${ctx.displayName} is installed`);
   const existing = await ctx.locator.extract();
   if (existing) {
+    if (refuseIfStale(ctx, existing)) return;
     showInfo(`Found existing ${ctx.displayName} credentials at ${import_picocolors2.default.bold(existing.source)}.`);
     await uploadAndSucceed(ctx, paired, pluginId, existing);
     return;
@@ -15909,8 +15962,26 @@ async function link(args2 = []) {
   console.log("");
   const captured = await captureFreshCredentials(ctx);
   console.log("");
+  if (refuseIfStale(ctx, captured)) return;
   await uploadAndSucceed(ctx, paired, pluginId, captured);
 }
+function refuseIfStale(ctx, token) {
+  const verdict = ctx.locator.validate?.(token);
+  if (!verdict || verdict.status !== "expired") return false;
+  const reason = verdict.reason ?? "Token expired";
+  showError(
+    `Your local ${ctx.displayName} credentials at ${import_picocolors2.default.bold(ctx.locator.hint)} are already expired:
+   ${reason}
+
+Uploading them would land a dead snapshot in the vault \u2014 every codespace bootstrapped from it would immediately return 401.
+
+Run on your machine, then re-link:
+   ${import_picocolors2.default.cyan(`${ctx.binary} logout`)}
+   ${import_picocolors2.default.cyan(`${ctx.binary} login`)}
+   ${import_picocolors2.default.cyan(`codeam link ${ctx.locator.publicId}`)}`
+  );
+  process.exit(1);
+}
 async function captureFreshCredentials(ctx) {
   const isWin = ctx.runtime.os.id === "win32";
   const watcher = import_chokidar.default.watch(ctx.locator.watchPaths(), {
@@ -16298,6 +16369,13 @@ function detectMissingNodeDeps(cwd) {
   }
   return { cmd: "npm", args: ["install"] };
 }
+function isJsInstallCommand(cmd, args2) {
+  const known = ["npm", "pnpm", "yarn", "bun"];
+  if (!known.includes(cmd)) return false;
+  if (cmd === "yarn" && args2.length === 0) return true;
+  const verb = args2[0];
+  return verb === "install" || verb === "i" || verb === "ci";
+}
 
 // src/services/preview/index.ts
 var activePreviews = /* @__PURE__ */ new Map();
@@ -16940,6 +17018,7 @@ var previewStartH = (ctx, _cmd, parsed) => {
     });
     emitProgress("ENV_DETECTED", `${detection.framework}`);
     const missingDeps = detectMissingNodeDeps(process.cwd());
+    let preflightRan = false;
     if (missingDeps) {
       emitProgress(
         "SETUP_RUN",
@@ -16964,8 +17043,12 @@ var previewStartH = (ctx, _cmd, parsed) => {
         });
         return;
       }
+      preflightRan = true;
     }
-    for (const setup of detection.setup_commands ?? []) {
+    const agentSetupCommands = preflightRan ? (detection.setup_commands ?? []).filter(
+      (s) => !isJsInstallCommand(s.cmd, s.args)
+    ) : detection.setup_commands ?? [];
+    for (const setup of agentSetupCommands) {
       emitProgress("SETUP_RUN", `${setup.cmd} ${setup.args.join(" ")}`);
       const exitCode = await runOnce(setup.cmd, setup.args, process.cwd(), detection.env);
       if (exitCode !== 0) {
@@ -20231,7 +20314,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.26.13" : "0.0.0-dev";
+  const cliVersion = true ? "2.26.15" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto6.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -20430,7 +20513,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.26.13" : "unknown";
+  const v = true ? "2.26.15" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -20658,7 +20741,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.26.13" : null;
+  const current = true ? "2.26.15" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.26.13",
+  "version": "2.26.15",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -74,7 +74,7 @@
     "chokidar": "^3.6.0",
     "picocolors": "^1.1.0",
     "qrcode-terminal": "^0.12.0",
-    "which": "^2.0.2",
+    "which": "^5.0.0",
     "ws": "^8.18.0",
     "zod": "^4.3.6"
   },