codeam-cli 2.29.0 → 2.30.0

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.29.0] — 2026-06-06
+
+### Added
+
+- **cli:** Forward originator HMAC to /api/pairing/code for QR-ready SSE
+
 ## [2.28.1] — 2026-06-06
 
 ### Fixed

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.29.0",
+  version: "2.30.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -682,14 +682,6 @@ var _execSeam = {
   }
 };
 
-// src/lib/poll-delay.ts
-var MAX_DELAY_MS = 3e4;
-function computePollDelay({ baseMs, failures }) {
-  const exp = Math.min(MAX_DELAY_MS, baseMs * Math.pow(2, failures));
-  const jitter = exp * (0.9 + Math.random() * 0.2);
-  return Math.round(jitter);
-}
-
 // src/services/pairing.service.ts
 var API_BASE = resolveApiBaseUrl();
 var REQUEST_CODE_TIMEOUT_MS = 1e4;
@@ -741,59 +733,6 @@ async function fetchCurrentPluginAuthToken(sessionId, pluginId) {
     return null;
   }
 }
-function pollStatus(pluginId, onPaired, onTimeout) {
-  let stopped = false;
-  let pollTimer = null;
-  let consecutiveFailures = 0;
-  const tick = async () => {
-    if (stopped) return;
-    try {
-      const result = await _transport.getJson(
-        `${API_BASE}/api/pairing/status?pluginId=${pluginId}`
-      );
-      consecutiveFailures = 0;
-      const data = result?.data;
-      if (data?.paired) {
-        stop();
-        const user = data.user ?? {};
-        const rawToken = data.pluginAuthToken;
-        onPaired({
-          sessionId: data.sessionId,
-          userId: typeof user.id === "string" && user.id.length > 0 ? user.id : void 0,
-          userName: user.name || "",
-          userEmail: user.email || "",
-          plan: user.plan || "FREE",
-          pluginAuthToken: typeof rawToken === "string" && rawToken.length > 0 ? rawToken : void 0
-        });
-        return;
-      }
-    } catch {
-      consecutiveFailures += 1;
-    }
-    if (stopped) return;
-    const delay = computePollDelay({ baseMs: 3e3, failures: consecutiveFailures });
-    pollTimer = setTimeout(() => {
-      void tick();
-    }, delay);
-  };
-  const initialDelay = computePollDelay({ baseMs: 3e3, failures: 0 });
-  pollTimer = setTimeout(() => {
-    void tick();
-  }, initialDelay);
-  const timeout = setTimeout(() => {
-    stop();
-    onTimeout();
-  }, 3e5);
-  function stop() {
-    stopped = true;
-    if (pollTimer) {
-      clearTimeout(pollTimer);
-      pollTimer = null;
-    }
-    clearTimeout(timeout);
-  }
-  return stop;
-}
 var _transport = {
   postJson: _postJson,
   getJson: _getJson,
@@ -1032,6 +971,14 @@ async function _getJson(url) {
   });
 }
 
+// src/lib/poll-delay.ts
+var MAX_DELAY_MS = 3e4;
+function computePollDelay({ baseMs, failures }) {
+  const exp = Math.min(MAX_DELAY_MS, baseMs * Math.pow(2, failures));
+  const jitter = exp * (0.9 + Math.random() * 0.2);
+  return Math.round(jitter);
+}
+
 // src/services/logger.ts
 var fs2 = __toESM(require("fs"));
 var os3 = __toESM(require("os"));
@@ -5902,7 +5849,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.29.0" : "0.0.0-dev",
+    cliVersion: true ? "2.30.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -14660,18 +14607,27 @@ var AcpClient = class {
    * a ceiling the relay command sits "pending" forever and mobile
    * shows a permanent "Thinking…" spinner with no way to recover.
    */
-  async prompt(text) {
+  async prompt(input) {
     if (!this.connection || !this.sessionId) {
       throw new Error("AcpClient.prompt called before start()");
     }
+    const blocks = typeof input === "string" ? [{ type: "text", text: input }] : input;
+    const textLen = blocks.reduce(
+      (n, b) => b.type === "text" ? n + b.text.length : n,
+      0
+    );
+    const imageCount = blocks.reduce(
+      (n, b) => b.type === "image" ? n + 1 : n,
+      0
+    );
     log.info(
       "acpClient",
-      `prompt \u2192 session=${this.sessionId.slice(0, 8)} chars=${text.length}`
+      `prompt \u2192 session=${this.sessionId.slice(0, 8)} textChars=${textLen} imageBlocks=${imageCount}`
     );
     const t0 = Date.now();
     const send = this.connection.prompt({
       sessionId: this.sessionId,
-      prompt: [{ type: "text", text }]
+      prompt: blocks
     });
     let timeoutId;
     const timeout = new Promise((_resolve, reject) => {
@@ -15143,6 +15099,59 @@ var AcpPublisher = class {
   }
 };
 
+// src/agents/acp/buildAcpPromptBlocks.ts
+var MIME_FROM_EXT = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  heic: "image/heic",
+  heif: "image/heif"
+};
+function inferMime(filename) {
+  const ext = filename.toLowerCase().split(".").pop() ?? "";
+  return MIME_FROM_EXT[ext] ?? "application/octet-stream";
+}
+var PLACEHOLDER_PROMPT = "Please review the attached image(s) and let me know what you find.";
+function buildAcpPromptBlocks(payload) {
+  const blocks = [];
+  for (const file of payload.files ?? []) {
+    if (!file.base64 || file.base64.length === 0) continue;
+    blocks.push({
+      type: "image",
+      mimeType: file.mimeType ?? inferMime(file.filename),
+      data: file.base64
+    });
+  }
+  const text = (payload.prompt ?? "").trim();
+  if (text.length > 0) {
+    blocks.push({ type: "text", text });
+  } else if (blocks.length > 0) {
+    blocks.push({ type: "text", text: PLACEHOLDER_PROMPT });
+  }
+  return blocks;
+}
+
+// src/agents/acp/promptEcho.ts
+var MAX_PROMPT_CHARS = 200;
+function formatPromptEchoLine(payload) {
+  const rawText = (payload.prompt ?? "").replace(/\s+/g, " ").trim();
+  const imageCount = (payload.files ?? []).filter(
+    (f) => typeof f.base64 === "string" && f.base64.length > 0
+  ).length;
+  if (rawText.length === 0 && imageCount === 0) return "";
+  const truncatedText = rawText.length > MAX_PROMPT_CHARS ? rawText.slice(0, MAX_PROMPT_CHARS) + "\u2026" : rawText;
+  const parts = [];
+  if (truncatedText.length > 0) {
+    parts.push(`Mobile: ${truncatedText}`);
+  }
+  if (imageCount > 0) {
+    parts.push(`+ ${imageCount} image${imageCount === 1 ? "" : "s"}`);
+  }
+  return `\u203A ${parts.join(" ")}`;
+}
+
 // src/services/terminal-ops.service.ts
 var import_child_process8 = require("child_process");
 var import_crypto2 = require("crypto");
@@ -16320,6 +16329,125 @@ async function selectSession(sessions3, activeId) {
   return result;
 }
 
+// src/services/pair-completion-subscriber.ts
+var https4 = __toESM(require("https"));
+var http4 = __toESM(require("http"));
+var API_BASE3 = resolveApiBaseUrl();
+var PAIR_TIMEOUT_MS = 5 * 60 * 1e3;
+var dispatchers = /* @__PURE__ */ new Set();
+function subscribeToPairCompletion(pluginId, onPaired, onTimeout) {
+  let stopped = false;
+  let req = null;
+  let timeoutTimer = null;
+  const dispatch = (cmd) => {
+    if (stopped) return;
+    if (cmd.pluginId !== pluginId) return;
+    if (cmd.type !== "pair_completed") return;
+    const payload = cmd.payload ?? {};
+    const info = {
+      sessionId: typeof payload.sessionId === "string" ? payload.sessionId : cmd.sessionId,
+      userId: typeof payload.userId === "string" ? payload.userId : void 0,
+      userName: typeof payload.userName === "string" ? payload.userName : "",
+      userEmail: typeof payload.userEmail === "string" ? payload.userEmail : "",
+      plan: typeof payload.plan === "string" ? payload.plan : "FREE",
+      pluginAuthToken: typeof payload.pluginAuthToken === "string" ? payload.pluginAuthToken : void 0
+    };
+    stop();
+    onPaired(info);
+  };
+  dispatchers.add(dispatch);
+  const connect = () => {
+    if (stopped) return;
+    const url = new URL(`${API_BASE3}/api/commands/pending/stream`);
+    url.searchParams.set("pluginId", pluginId);
+    const transport = url.protocol === "https:" ? https4 : http4;
+    req = transport.request(
+      {
+        hostname: url.hostname,
+        port: url.port || (url.protocol === "https:" ? 443 : 80),
+        path: `${url.pathname}${url.search}`,
+        method: "GET",
+        headers: {
+          Accept: "text/event-stream",
+          "Cache-Control": "no-cache",
+          ...vercelBypassHeader()
+        },
+        timeout: 35e3
+      },
+      (res) => {
+        if (res.statusCode !== 200) {
+          log.trace(
+            "pairSubscribe",
+            `sse status=${res.statusCode}; will reconnect in 1s`
+          );
+          res.resume();
+          setTimeout(connect, 1e3);
+          return;
+        }
+        let buf = "";
+        res.setEncoding("utf8");
+        res.on("data", (chunk) => {
+          buf += chunk;
+          let idx;
+          while ((idx = buf.indexOf("\n\n")) >= 0) {
+            const frame = buf.slice(0, idx);
+            buf = buf.slice(idx + 2);
+            parseFrame(frame, dispatch);
+          }
+        });
+        res.on("end", () => {
+          if (!stopped) setTimeout(connect, 250);
+        });
+        res.on("error", () => {
+          if (!stopped) setTimeout(connect, 1e3);
+        });
+      }
+    );
+    req.on("error", () => {
+      if (!stopped) setTimeout(connect, 1e3);
+    });
+    req.on("timeout", () => {
+      req?.destroy();
+      if (!stopped) setTimeout(connect, 250);
+    });
+    req.end();
+  };
+  connect();
+  timeoutTimer = setTimeout(() => {
+    stop();
+    onTimeout();
+  }, PAIR_TIMEOUT_MS);
+  function stop() {
+    if (stopped) return;
+    stopped = true;
+    dispatchers.delete(dispatch);
+    if (timeoutTimer) {
+      clearTimeout(timeoutTimer);
+      timeoutTimer = null;
+    }
+    if (req) {
+      req.destroy();
+      req = null;
+    }
+  }
+  return stop;
+}
+function parseFrame(frame, dispatch) {
+  let eventType = "message";
+  let data = "";
+  for (const line of frame.split("\n")) {
+    if (line.startsWith("event:")) eventType = line.slice(6).trim();
+    else if (line.startsWith("data:")) data += line.slice(5).trimStart();
+  }
+  if (eventType !== "commands") return;
+  try {
+    const parsed = JSON.parse(data);
+    if (!Array.isArray(parsed.commands)) return;
+    for (const cmd of parsed.commands) dispatch(cmd);
+  } catch {
+  }
+}
+
 // src/commands/link.ts
 function buildLinkContext(agentId) {
   const runtime = createRuntimeStrategy(agentId);
@@ -16413,7 +16541,7 @@ async function link(args2 = []) {
       stopPoll?.();
       reject(new Error("cancelled"));
     };
-    stopPoll = pollStatus(
+    stopPoll = subscribeToPairCompletion(
       pluginId,
       (info) => {
         process.removeListener("SIGINT", sigint);
@@ -18012,8 +18140,8 @@ function isIgnoredFilePath(filePath) {
 }
 
 // src/services/file-watcher/transport.ts
-var http4 = __toESM(require("http"));
-var https4 = __toESM(require("https"));
+var http5 = __toESM(require("http"));
+var https5 = __toESM(require("https"));
 var _transport3 = {
   post: _post2
 };
@@ -18021,7 +18149,7 @@ function _post2(url, headers, payload) {
   return new Promise((resolve6, reject) => {
     let settled = false;
     const u2 = new URL(url);
-    const lib = u2.protocol === "https:" ? https4 : http4;
+    const lib = u2.protocol === "https:" ? https5 : http5;
     const req = lib.request(
       {
         hostname: u2.hostname,
@@ -18061,7 +18189,7 @@ function _post2(url, headers, payload) {
 }
 
 // src/services/file-watcher.service.ts
-var API_BASE3 = resolveApiBaseUrl();
+var API_BASE4 = resolveApiBaseUrl();
 var DEBOUNCE_MS = 250;
 var COALESCE_WINDOW_MS = 250;
 var COALESCE_MAX_HOLD_MS = 2e3;
@@ -18134,7 +18262,7 @@ function _defaultFindGitRoot(startDir) {
 var FileWatcherService = class {
   constructor(opts) {
     this.opts = opts;
-    this.apiBase = opts.apiBaseUrl ?? API_BASE3;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE4;
   }
   opts;
   watcher = null;
@@ -19085,13 +19213,13 @@ function homeDir() {
 }
 
 // src/services/turn-files/turn-file-aggregator.ts
-var API_BASE4 = resolveApiBaseUrl();
+var API_BASE5 = resolveApiBaseUrl();
 var ENDPOINT = "/api/files/batch";
 var MAX_BATCH_SIZE = 1e3;
 var TurnFileAggregator = class {
   constructor(opts) {
     this.opts = opts;
-    this.apiBase = opts.apiBaseUrl ?? API_BASE4;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE5;
     this.outbox = new FilesOutbox({
       sessionId: opts.sessionId,
       baseDir: opts.outboxDir,
@@ -19731,17 +19859,26 @@ async function handleCommand(cmd, client2, relay, acpSessionId, models, streamin
   switch (cmd.type) {
     case "start_task": {
       const payload = cmd.payload;
-      const prompt = payload?.prompt?.trim();
-      if (!prompt) {
-        log.warn("acpRunner", "start_task with empty prompt; ignoring");
+      const blocks = buildAcpPromptBlocks(payload ?? {});
+      if (blocks.length === 0) {
+        log.warn("acpRunner", "start_task with empty prompt + no attachments; ignoring");
         await relay.sendResult(cmd.id, "failed", { error: "empty prompt" });
         return;
       }
-      log.info("acpRunner", `start_task \u2192 forwarding prompt chars=${prompt.length} id=${cmd.id.slice(0, 8)}`);
+      const promptText = blocks.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+      const imageCount = blocks.filter((b) => b.type === "image").length;
+      log.info(
+        "acpRunner",
+        `start_task \u2192 forwarding textChars=${promptText.length} imageBlocks=${imageCount} id=${cmd.id.slice(0, 8)}`
+      );
+      const echoLine = formatPromptEchoLine(payload ?? {});
+      if (echoLine.length > 0) {
+        showInfo(echoLine);
+      }
       await streaming.beginTurn();
-      history.appendUserPrompt(prompt);
+      history.appendUserPrompt(promptText);
       try {
-        const reply = await client2.prompt(prompt);
+        const reply = await client2.prompt(blocks);
         const finalText = streaming.getCurrentText();
         await streaming.closeTurnWithInteractiveDetection();
         history.appendAgentReply(finalText);
@@ -20076,13 +20213,13 @@ var ChromeStepTracker = class {
 };
 
 // src/services/output/chunk-emitter.ts
-var https5 = __toESM(require("https"));
-var http5 = __toESM(require("http"));
-var API_BASE5 = resolveApiBaseUrl();
+var https6 = __toESM(require("https"));
+var http6 = __toESM(require("http"));
+var API_BASE6 = resolveApiBaseUrl();
 async function refreshAuthToken(sessionId, pluginId) {
   try {
     const { statusCode, body } = await _transport4.post(
-      `${API_BASE5}/api/pairing/reconnect`,
+      `${API_BASE6}/api/pairing/reconnect`,
       {
         "Content-Type": "application/json",
         "X-Codeam-Protocol-Version": PROTOCOL_VERSION,
@@ -20123,7 +20260,7 @@ var ChunkEmitter = class {
     }
   }
   opts;
-  url = `${API_BASE5}/api/commands/output`;
+  url = `${API_BASE6}/api/commands/output`;
   headers;
   /**
    * Send a chunk. `body` is the chunk fields minus `sessionId` /
@@ -20204,7 +20341,7 @@ function _post3(url, headers, payload) {
   return new Promise((resolve6, reject) => {
     let settled = false;
     const u2 = new URL(url);
-    const transport = u2.protocol === "https:" ? https5 : http5;
+    const transport = u2.protocol === "https:" ? https6 : http6;
     const req = transport.request(
       {
         hostname: u2.hostname,
@@ -20802,8 +20939,8 @@ var OutputService = class _OutputService {
 var fs32 = __toESM(require("fs"));
 var path38 = __toESM(require("path"));
 var os25 = __toESM(require("os"));
-var https6 = __toESM(require("https"));
-var http6 = __toESM(require("http"));
+var https7 = __toESM(require("https"));
+var http7 = __toESM(require("http"));
 var import_zod2 = require("zod");
 var historyRecordSchema = import_zod2.z.object({
   type: import_zod2.z.string().optional(),
@@ -20815,7 +20952,7 @@ var historyRecordSchema = import_zod2.z.object({
     content: import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.unknown())]).optional()
   }).passthrough().optional()
 }).passthrough();
-var API_BASE6 = resolveApiBaseUrl();
+var API_BASE7 = resolveApiBaseUrl();
 function extractText3(content) {
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
@@ -20867,8 +21004,8 @@ function parseJsonl(filePath) {
 function post(endpoint, body) {
   return new Promise((resolve6) => {
     const payload = JSON.stringify(body);
-    const u2 = new URL(`${API_BASE6}${endpoint}`);
-    const transport = u2.protocol === "https:" ? https6 : http6;
+    const u2 = new URL(`${API_BASE7}${endpoint}`);
+    const transport = u2.protocol === "https:" ? https7 : http7;
     const req = transport.request(
       {
         hostname: u2.hostname,
@@ -21316,7 +21453,7 @@ var RepoDirtyTracker = class {
 
 // src/services/streaming-emitter.service.ts
 var import_crypto5 = require("crypto");
-var API_BASE7 = resolveApiBaseUrl();
+var API_BASE8 = resolveApiBaseUrl();
 var TICK_MS = 50;
 var ANSWER_POLL_MS = 1500;
 var SELECTOR_STABLE_MS = 800;
@@ -21327,7 +21464,7 @@ var TAIL_KEEP_BYTES2 = 1.5 * 1024 * 1024;
 var StreamingEmitterService = class {
   constructor(opts) {
     this.opts = opts;
-    this.apiBase = opts.apiBaseUrl ?? API_BASE7;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE8;
     this.headers = {
       "Content-Type": "application/json",
       "X-Codeam-Protocol-Version": "2.0.0",
@@ -22046,7 +22183,7 @@ async function pair(args2 = []) {
       console.log("");
       process.exit(0);
     }
-    stopPolling = pollStatus(
+    stopPolling = subscribeToPairCompletion(
       pluginId,
       (info) => {
         process.removeListener("SIGINT", sigintHandler);
@@ -22292,7 +22429,7 @@ async function startInfraOnly(agentId) {
 }
 
 // src/commands/pair-auto.ts
-var API_BASE8 = resolveApiBaseUrl();
+var API_BASE9 = resolveApiBaseUrl();
 function fail(msg) {
   console.error(`
   ${msg}
@@ -22332,7 +22469,7 @@ function networkError(msg, cause) {
   return err;
 }
 async function claimOnce(token, pluginId) {
-  const url = `${API_BASE8}/api/pairing/claim-auto-token`;
+  const url = `${API_BASE9}/api/pairing/claim-auto-token`;
   const body = {
     token,
     pluginId,
@@ -22535,7 +22672,7 @@ function status() {
 
 // src/commands/logout.ts
 var import_picocolors7 = __toESM(require("picocolors"));
-var API_BASE9 = resolveApiBaseUrl();
+var API_BASE10 = resolveApiBaseUrl();
 async function notifyBackendOffline() {
   const cfg = loadCliConfig();
   const pluginIds = /* @__PURE__ */ new Set([
@@ -22547,7 +22684,7 @@ async function notifyBackendOffline() {
   try {
     await Promise.all(
       Array.from(pluginIds).map(
-        (pluginId) => _postJson(`${API_BASE9}/api/plugin/heartbeat`, {
+        (pluginId) => _postJson(`${API_BASE10}/api/plugin/heartbeat`, {
           pluginId,
           online: false
         }).catch((err) => {
@@ -24689,7 +24826,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.29.0" : "0.0.0-dev";
+  const cliVersion = true ? "2.30.0" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -24888,7 +25025,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.29.0" : "unknown";
+  const v = true ? "2.30.0" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -25019,7 +25156,7 @@ var _subcommandHelpKeys = Object.keys(HELPS);
 var fs35 = __toESM(require("fs"));
 var os27 = __toESM(require("os"));
 var path44 = __toESM(require("path"));
-var https7 = __toESM(require("https"));
+var https8 = __toESM(require("https"));
 var import_node_child_process12 = require("child_process");
 var import_picocolors16 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
@@ -25065,7 +25202,7 @@ function compareSemver(a, b) {
 }
 function fetchLatest() {
   return new Promise((resolve6) => {
-    const req = https7.get(
+    const req = https8.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
@@ -25174,7 +25311,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.29.0" : null;
+  const current = true ? "2.30.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.29.0",
+  "version": "2.30.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",