codeam-cli 2.39.16 → 2.39.17

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.16] — 2026-06-14
+
+### Added
+
+- **jetbrains-plugin:** Proof-of-possession secret for /status + /reconnect (SEC crit1)
+
+## [2.39.15] — 2026-06-14
+
+### Added
+
+- **vsc-plugin:** Proof-of-possession secret for /status + /reconnect (SEC crit1)
+
 ## [2.39.14] — 2026-06-14
 
 ### Added

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.16",
+  version: "2.39.17",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -989,7 +989,7 @@ async function _postJson(url, body, extraHeaders) {
     req.end();
   });
 }
-async function _getJson(url) {
+async function _getJson(url, extraHeaders) {
   return new Promise((resolve7, reject) => {
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -999,7 +999,7 @@ async function _getJson(url) {
         port: u2.port || (u2.protocol === "https:" ? 443 : 80),
         path: u2.pathname + u2.search,
         method: "GET",
-        headers: { ...vercelBypassHeader() },
+        headers: { ...vercelBypassHeader(), ...extraHeaders ?? {} },
         timeout: 1e4
       },
       (res) => {
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.16" : "0.0.0-dev",
+    cliVersion: true ? "2.39.17" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6111,7 +6111,12 @@ var CommandRelayService = class {
         port: url.port || (url.protocol === "https:" ? 443 : 80),
         path: `${url.pathname}${url.search}`,
         method: "GET",
-        headers: { Accept: "text/event-stream", "Cache-Control": "no-cache", ...vercelBypassHeader() },
+        headers: {
+          Accept: "text/event-stream",
+          "Cache-Control": "no-cache",
+          ...vercelBypassHeader(),
+          ...this.pollSecretHeader()
+        },
         timeout: 35e3
       },
       (res) => {
@@ -6264,9 +6269,27 @@ var CommandRelayService = class {
       this.pollTimer = setTimeout(() => this.pollLoop(), delay);
     }
   }
+  // SEC crit1 (#8): the command-delivery endpoints are gated on the
+  // per-pairing pollSecret when the backend enforces it. Look it up from
+  // the persisted session (keyed by this relay's pluginId) and replay it
+  // as X-Plugin-Poll-Secret. Empty {} for legacy sessions / older
+  // backends (which ignore it).
+  pollSecretHeader() {
+    try {
+      const secret = loadCliConfig().sessions.find(
+        (s) => s.pluginId === this.pluginId
+      )?.pollSecret;
+      return secret ? { "X-Plugin-Poll-Secret": secret } : {};
+    } catch {
+      return {};
+    }
+  }
   async pollOnce() {
     try {
-      const data = await _getJson(`${API_BASE2}/api/commands/pending?pluginId=${this.pluginId}`);
+      const data = await _getJson(
+        `${API_BASE2}/api/commands/pending?pluginId=${this.pluginId}`,
+        this.pollSecretHeader()
+      );
       const commands = data?.data;
       this.pollFailures = 0;
       if (!Array.isArray(commands) || commands.length === 0) {
@@ -16661,7 +16684,7 @@ var http4 = __toESM(require("http"));
 var API_BASE3 = resolveApiBaseUrl();
 var PAIR_TIMEOUT_MS = 5 * 60 * 1e3;
 var dispatchers = /* @__PURE__ */ new Set();
-function subscribeToPairCompletion(pluginId, onPaired, onTimeout) {
+function subscribeToPairCompletion(pluginId, onPaired, onTimeout, pollSecret) {
   let stopped = false;
   let req = null;
   let timeoutTimer = null;
@@ -16696,7 +16719,8 @@ function subscribeToPairCompletion(pluginId, onPaired, onTimeout) {
         headers: {
           Accept: "text/event-stream",
           "Cache-Control": "no-cache",
-          ...vercelBypassHeader()
+          ...vercelBypassHeader(),
+          ...pollSecret ? { "X-Plugin-Poll-Secret": pollSecret } : {}
         },
         timeout: 35e3
       },
@@ -24340,7 +24364,10 @@ async function pair(args2 = []) {
         capture("pair_timed_out", { agentId, pluginId });
         showError("Pairing timed out after 5 minutes. Run codeam pair to try again.");
         process.exit(1);
-      }
+      },
+      // SEC crit1 (#8): replay this pairing's secret on the pre-pair
+      // subscription so it passes the command-endpoint gate when enforced.
+      pollSecret
     );
     process.once("SIGINT", sigintHandler);
   });
@@ -27017,7 +27044,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.16" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.17" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -27216,7 +27243,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.16" : "unknown";
+  const v = true ? "2.39.17" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27502,7 +27529,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.16" : null;
+  const current = true ? "2.39.17" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.16",
+  "version": "2.39.17",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",