codeam-cli 2.39.17 → 2.39.18

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.17",
+  version: "2.39.18",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.17" : "0.0.0-dev",
+    cliVersion: true ? "2.39.18" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -23046,7 +23046,7 @@ function parseJsonl(filePath) {
   }
   return messages;
 }
-function post(endpoint, body) {
+function post(endpoint, body, pluginAuthToken) {
   return new Promise((resolve7) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE8}${endpoint}`);
@@ -23060,7 +23060,11 @@ function post(endpoint, body) {
         headers: {
           "Content-Type": "application/json",
           "Content-Length": Buffer.byteLength(payload),
-          ...vercelBypassHeader()
+          ...vercelBypassHeader(),
+          // SEC crit1 (#819): authenticate conversation-history writes so
+          // the backend can verify the (sessionId, pluginId) ownership.
+          // Older backends ignore the header.
+          ...pluginAuthToken ? { "X-Plugin-Auth-Token": pluginAuthToken } : {}
         },
         timeout: 15e3
       },
@@ -23089,6 +23093,7 @@ var HistoryService = class _HistoryService {
     this.pluginId = pluginId;
     this.cwd = cwd;
     this.runtime = runtime;
+    this.pluginAuthToken = options?.pluginAuthToken;
     this.bootTimeMs = options?.bootTimeMs ?? Date.now();
   }
   pluginId;
@@ -23125,6 +23130,7 @@ var HistoryService = class _HistoryService {
    */
   static BIRTHTIME_GRACE_MS = 5e3;
   runtime;
+  pluginAuthToken;
   /** Store rate limit reset info detected from Claude Code output */
   setRateLimitReset(reset) {
     this._rateLimitReset = reset;
@@ -23364,11 +23370,15 @@ var HistoryService = class _HistoryService {
     }
     const sessions3 = this.runtime.listResumableSessions(this.cwd);
     if (sessions3.length === 0) return;
-    await post("/api/sessions/list", {
-      pluginId: this.pluginId,
-      agentId: this.runtime.id,
-      sessions: sessions3
-    });
+    await post(
+      "/api/sessions/list",
+      {
+        pluginId: this.pluginId,
+        agentId: this.runtime.id,
+        sessions: sessions3
+      },
+      this.pluginAuthToken
+    );
   }
   /**
    * Read a specific session's full conversation and POST it to the API in batches.
@@ -23398,10 +23408,10 @@ var HistoryService = class _HistoryService {
         batchIndex: i,
         totalBatches
       };
-      let ok = await post("/api/sessions/conversation", body);
+      let ok = await post("/api/sessions/conversation", body, this.pluginAuthToken);
       for (let attempt = 0; !ok && attempt < RETRY_DELAYS.length; attempt++) {
         await new Promise((r) => setTimeout(r, RETRY_DELAYS[attempt]));
-        ok = await post("/api/sessions/conversation", body);
+        ok = await post("/api/sessions/conversation", body, this.pluginAuthToken);
       }
       if (!ok) {
         throw new Error(`Failed to upload conversation batch ${i + 1}/${totalBatches} after all retries`);
@@ -23452,7 +23462,7 @@ var HistoryService = class _HistoryService {
       messages: newMessages,
       mode: "append"
     };
-    const ok = await post("/api/sessions/conversation", body);
+    const ok = await post("/api/sessions/conversation", body, this.pluginAuthToken);
     if (ok) {
       const last = newMessages[newMessages.length - 1];
       this.lastUploadedUuid.set(sessionId, last.id);
@@ -24042,7 +24052,9 @@ async function start(requestedAgent) {
     showInfo("CODEAM_ACP_DISABLED is set \u2014 running the legacy PTY pipeline.");
   }
   const runtime = createRuntimeStrategy(session.agent);
-  const historySvc = new HistoryService(runtime, pluginId, cwd);
+  const historySvc = new HistoryService(runtime, pluginId, cwd, {
+    pluginAuthToken: session.pluginAuthToken
+  });
   const keepAliveCtx = {
     inCodespace: process.env.CODESPACES === "true",
     codespaceName: process.env.CODESPACE_NAME
@@ -27044,7 +27056,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.17" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.18" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -27243,7 +27255,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.17" : "unknown";
+  const v = true ? "2.39.18" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27529,7 +27541,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.17" : null;
+  const current = true ? "2.39.18" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.17",
+  "version": "2.39.18",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",