codeam-cli 2.39.24 → 2.39.25

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.24",
+  version: "2.39.25",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -1194,8 +1194,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path55) {
-  return path55.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path58) {
+  return path58.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -2347,10 +2347,10 @@ var PostHogCoreStateless = class {
   }
   async getRemoteConfig() {
     await this._initPromise;
-    let host = this.host;
-    if ("https://us.i.posthog.com" === host) host = "https://us-assets.i.posthog.com";
-    else if ("https://eu.i.posthog.com" === host) host = "https://eu-assets.i.posthog.com";
-    const url = `${host}/array/${this.apiKey}/config`;
+    let host2 = this.host;
+    if ("https://us.i.posthog.com" === host2) host2 = "https://us-assets.i.posthog.com";
+    else if ("https://eu.i.posthog.com" === host2) host2 = "https://eu-assets.i.posthog.com";
+    const url = `${host2}/array/${this.apiKey}/config`;
     const fetchOptions = {
       method: "GET",
       headers: {
@@ -3030,9 +3030,9 @@ var ErrorPropertiesBuilder = class {
 
 // ../../node_modules/@posthog/core/dist/error-tracking/parsers/base.mjs
 var UNKNOWN_FUNCTION = "?";
-function createFrame(platform2, filename, func, lineno, colno) {
+function createFrame(platform3, filename, func, lineno, colno) {
   const frame = {
-    platform: platform2,
+    platform: platform3,
     filename,
     function: "<anonymous>" === func ? UNKNOWN_FUNCTION : func,
     in_app: true
@@ -3059,11 +3059,11 @@ var extractSafariExtensionDetails = (func, filename) => {
 var chromeRegexNoFnName = /^\s*at (\S+?)(?::(\d+))(?::(\d+))\s*$/i;
 var chromeRegex = /^\s*at (?:(.+?\)(?: \[.+\])?|.*?) ?\((?:address at )?)?(?:async )?((?:<anonymous>|[-a-z]+:|.*bundle|\/)?.*?)(?::(\d+))?(?::(\d+))?\)?\s*$/i;
 var chromeEvalRegex = /\((\S*)(?::(\d+))(?::(\d+))\)/;
-var chromeStackLineParser = (line, platform2) => {
+var chromeStackLineParser = (line, platform3) => {
   const noFnParts = chromeRegexNoFnName.exec(line);
   if (noFnParts) {
     const [, filename, line2, col] = noFnParts;
-    return createFrame(platform2, filename, UNKNOWN_FUNCTION, +line2, +col);
+    return createFrame(platform3, filename, UNKNOWN_FUNCTION, +line2, +col);
   }
   const parts = chromeRegex.exec(line);
   if (parts) {
@@ -3077,14 +3077,14 @@ var chromeStackLineParser = (line, platform2) => {
       }
     }
     const [func, filename] = extractSafariExtensionDetails(parts[1] || UNKNOWN_FUNCTION, parts[2]);
-    return createFrame(platform2, filename, func, parts[3] ? +parts[3] : void 0, parts[4] ? +parts[4] : void 0);
+    return createFrame(platform3, filename, func, parts[3] ? +parts[3] : void 0, parts[4] ? +parts[4] : void 0);
   }
 };
 
 // ../../node_modules/@posthog/core/dist/error-tracking/parsers/gecko.mjs
 var geckoREgex = /^\s*(.*?)(?:\((.*?)\))?(?:^|@)?((?:[-a-z]+)?:\/.*?|\[native code\]|[^@]*(?:bundle|\d+\.js)|\/[\w\-. /=]+)(?::(\d+))?(?::(\d+))?\s*$/i;
 var geckoEvalRegex = /(\S+) line (\d+)(?: > eval line \d+)* > eval/i;
-var geckoStackLineParser = (line, platform2) => {
+var geckoStackLineParser = (line, platform3) => {
   const parts = geckoREgex.exec(line);
   if (parts) {
     const isEval = parts[3] && parts[3].indexOf(" > eval") > -1;
@@ -3100,33 +3100,33 @@ var geckoStackLineParser = (line, platform2) => {
     let filename = parts[3];
     let func = parts[1] || UNKNOWN_FUNCTION;
     [func, filename] = extractSafariExtensionDetails(func, filename);
-    return createFrame(platform2, filename, func, parts[4] ? +parts[4] : void 0, parts[5] ? +parts[5] : void 0);
+    return createFrame(platform3, filename, func, parts[4] ? +parts[4] : void 0, parts[5] ? +parts[5] : void 0);
   }
 };
 
 // ../../node_modules/@posthog/core/dist/error-tracking/parsers/winjs.mjs
 var winjsRegex = /^\s*at (?:((?:\[object object\])?.+) )?\(?((?:[-a-z]+):.*?):(\d+)(?::(\d+))?\)?\s*$/i;
-var winjsStackLineParser = (line, platform2) => {
+var winjsStackLineParser = (line, platform3) => {
   const parts = winjsRegex.exec(line);
-  return parts ? createFrame(platform2, parts[2], parts[1] || UNKNOWN_FUNCTION, +parts[3], parts[4] ? +parts[4] : void 0) : void 0;
+  return parts ? createFrame(platform3, parts[2], parts[1] || UNKNOWN_FUNCTION, +parts[3], parts[4] ? +parts[4] : void 0) : void 0;
 };
 
 // ../../node_modules/@posthog/core/dist/error-tracking/parsers/opera.mjs
 var opera10Regex = / line (\d+).*script (?:in )?(\S+)(?:: in function (\S+))?$/i;
-var opera10StackLineParser = (line, platform2) => {
+var opera10StackLineParser = (line, platform3) => {
   const parts = opera10Regex.exec(line);
-  return parts ? createFrame(platform2, parts[2], parts[3] || UNKNOWN_FUNCTION, +parts[1]) : void 0;
+  return parts ? createFrame(platform3, parts[2], parts[3] || UNKNOWN_FUNCTION, +parts[1]) : void 0;
 };
 var opera11Regex = / line (\d+), column (\d+)\s*(?:in (?:<anonymous function: ([^>]+)>|([^)]+))\(.*\))? in (.*):\s*$/i;
-var opera11StackLineParser = (line, platform2) => {
+var opera11StackLineParser = (line, platform3) => {
   const parts = opera11Regex.exec(line);
-  return parts ? createFrame(platform2, parts[5], parts[3] || parts[4] || UNKNOWN_FUNCTION, +parts[1], +parts[2]) : void 0;
+  return parts ? createFrame(platform3, parts[5], parts[3] || parts[4] || UNKNOWN_FUNCTION, +parts[1], +parts[2]) : void 0;
 };
 
 // ../../node_modules/@posthog/core/dist/error-tracking/parsers/node.mjs
 var FILENAME_MATCH = /^\s*[-]{4,}$/;
 var FULL_MATCH = /at (?:async )?(?:(.+?)\s+\()?(?:(.+):(\d+):(\d+)?|([^)]+))\)?/;
-var nodeStackLineParser = (line, platform2) => {
+var nodeStackLineParser = (line, platform3) => {
   const lineMatch = line.match(FULL_MATCH);
   if (lineMatch) {
     let object;
@@ -3172,12 +3172,12 @@ var nodeStackLineParser = (line, platform2) => {
       lineno: _parseIntOrUndefined(lineMatch[3]),
       colno: _parseIntOrUndefined(lineMatch[4]),
       in_app: filenameIsInApp(filename || "", isNative),
-      platform: platform2
+      platform: platform3
     };
   }
   if (line.match(FILENAME_MATCH)) return {
     filename: line,
-    platform: platform2
+    platform: platform3
   };
 };
 function filenameIsInApp(filename, isNative = false) {
@@ -3207,7 +3207,7 @@ function getLastStackFrame(arr) {
 function createDefaultStackParser() {
   return createStackParser("web:javascript", chromeStackLineParser, geckoStackLineParser);
 }
-function createStackParser(platform2, ...parsers) {
+function createStackParser(platform3, ...parsers) {
   return (stack, skipFirstLines = 0) => {
     const frames = [];
     const lines = stack.split("\n");
@@ -3217,7 +3217,7 @@ function createStackParser(platform2, ...parsers) {
       const cleanedLine = WEBPACK_ERROR_REGEXP.test(line) ? line.replace(WEBPACK_ERROR_REGEXP, "$1") : line;
       if (!cleanedLine.match(/\S*Error: /)) {
         for (const parser of parsers) {
-          const frame = parser(cleanedLine, platform2);
+          const frame = parser(cleanedLine, platform3);
           if (frame) {
             frames.push(frame);
             break;
@@ -3675,9 +3675,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path55, ranges, output) {
+function getContextLinesFromFile(path58, ranges, output) {
   return new Promise((resolve7) => {
-    const stream = (0, import_node_fs.createReadStream)(path55);
+    const stream = (0, import_node_fs.createReadStream)(path58);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -3692,7 +3692,7 @@ function getContextLinesFromFile(path55, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path55, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path58, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3753,8 +3753,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path55) {
-  return path55.startsWith("node:") || path55.endsWith(".min.js") || path55.endsWith(".min.cjs") || path55.endsWith(".min.mjs") || path55.startsWith("data:");
+function shouldSkipContextLinesForFile(path58) {
+  return path58.startsWith("node:") || path58.endsWith(".min.js") || path58.endsWith(".min.cjs") || path58.endsWith(".min.mjs") || path58.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -4109,7 +4109,7 @@ var RequiresServerEvaluation = class _RequiresServerEvaluation extends Error {
   }
 };
 var FeatureFlagsPoller = class {
-  constructor({ pollingInterval, personalApiKey, projectApiKey, timeout, host, customHeaders, ...options }) {
+  constructor({ pollingInterval, personalApiKey, projectApiKey, timeout, host: host2, customHeaders, ...options }) {
     this.debugMode = false;
     this.shouldBeginExponentialBackoff = false;
     this.backOffCount = 0;
@@ -4122,7 +4122,7 @@ var FeatureFlagsPoller = class {
     this.loadedSuccessfullyOnce = false;
     this.timeout = timeout;
     this.projectApiKey = projectApiKey;
-    this.host = host;
+    this.host = host2;
     this.poller = void 0;
     this.fetch = options.fetch || fetch;
     this.onError = options.onError;
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.24" : "0.0.0-dev",
+    cliVersion: true ? "2.39.25" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5942,10 +5942,10 @@ function initTelemetry() {
     log.trace("telemetry", "no PostHog API key baked into build \u2014 disabled");
     return false;
   }
-  const host = true ? "https://us.i.posthog.com" : "https://us.i.posthog.com";
+  const host2 = true ? "https://us.i.posthog.com" : "https://us.i.posthog.com";
   distinctId = readAnonId();
   client = new PostHog(apiKey, {
-    host,
+    host: host2,
     // 10s flush is generous for a CLI — most commands run < 30s
     // and we shutdown() before exit anyway. Per-batch size caps
     // memory growth on long-lived `codeam start` sessions.
@@ -5960,7 +5960,7 @@ function initTelemetry() {
     log.trace("telemetry", "posthog error (ignored)", err);
   });
   client.register(superProperties());
-  log.trace("telemetry", `posthog client initialised host=${host} distinctId=${distinctId}`);
+  log.trace("telemetry", `posthog client initialised host=${host2} distinctId=${distinctId}`);
   return true;
 }
 function identifyUser(params) {
@@ -7287,8 +7287,8 @@ function createOsStrategy() {
   cached = buildForPlatform(process.platform);
   return cached;
 }
-function buildForPlatform(platform2) {
-  switch (platform2) {
+function buildForPlatform(platform3) {
+  switch (platform3) {
     case "darwin":
       return new DarwinOsStrategy();
     case "win32":
@@ -7302,10 +7302,10 @@ function buildForPlatform(platform2) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os33 = createOsStrategy()) {
-  const found = os33.findInPath("claude") ?? os33.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os36 = createOsStrategy()) {
+  const found = os36.findInPath("claude") ?? os36.findInPath("claude-code");
   if (!found) return null;
-  return os33.buildLaunch(found, extraArgs);
+  return os36.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -9754,8 +9754,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -10374,8 +10374,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os33 = createOsStrategy();
-      return os33.findInPath("codex") !== null;
+      const os36 = createOsStrategy();
+      return os36.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process3.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -10398,8 +10398,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -10495,12 +10495,12 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os33) {
-  return os33.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os36) {
+  return os36.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os33) {
+async function installCodexViaNpm(os36) {
   return new Promise((resolve7, reject) => {
-    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os33), ["install", "-g", "@openai/codex"], {
+    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os36), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -10517,16 +10517,16 @@ async function installCodexViaNpm(os33) {
     });
   });
 }
-function augmentNpmGlobalBin(os33) {
+function augmentNpmGlobalBin(os36) {
   try {
-    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os33), ["prefix", "-g"], {
+    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os36), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os33.id === "win32" ? prefix : path17.join(prefix, "bin");
-    os33.augmentPath([binDir]);
+    const binDir = os36.id === "win32" ? prefix : path17.join(prefix, "bin");
+    os36.augmentPath([binDir]);
   } catch {
   }
 }
@@ -10610,9 +10610,9 @@ var import_node_child_process7 = require("child_process");
 // src/agents/coderabbit/installer.ts
 var import_node_child_process5 = require("child_process");
 var INSTALL_URL = "https://cli.coderabbit.ai/install.sh";
-async function ensureCoderabbitInstalled(os33) {
-  if (os33.findInPath("coderabbit")) return true;
-  if (os33.id === "win32") {
+async function ensureCoderabbitInstalled(os36) {
+  if (os36.findInPath("coderabbit")) return true;
+  if (os36.id === "win32") {
     console.error(
       "\n  \u2717 CodeRabbit on Windows requires WSL.\n    Install the CLI inside your WSL distribution\n    (curl -fsSL https://cli.coderabbit.ai/install.sh | sh)\n    then re-run `codeam link coderabbit` from WSL.\n"
     );
@@ -10627,8 +10627,8 @@ async function ensureCoderabbitInstalled(os33) {
     proc.on("error", () => resolve7(false));
   });
   if (!ok) return false;
-  os33.augmentPath([`${os33.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  return os33.findInPath("coderabbit") !== null;
+  os36.augmentPath([`${os36.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  return os36.findInPath("coderabbit") !== null;
 }
 
 // src/agents/coderabbit/link.ts
@@ -10655,10 +10655,10 @@ function coderabbitCredentialLocator() {
     extract: extractLocalCoderabbitToken
   };
 }
-function coderabbitLoginLauncher(os33) {
+function coderabbitLoginLauncher(os36) {
   return {
     async ensureInstalled() {
-      return ensureCoderabbitInstalled(os33);
+      return ensureCoderabbitInstalled(os36);
     },
     launch() {
       return (0, import_node_child_process6.spawn)("coderabbit", ["login"], { stdio: "inherit" });
@@ -10681,11 +10681,11 @@ function parseReview(stdout) {
   for (const line of lines) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path55, lineNo, sevToken, message] = m;
-    if (!path55 || !lineNo || !message) continue;
+    const [, path58, lineNo, sevToken, message] = m;
+    if (!path58 || !lineNo || !message) continue;
     const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
-      path: path55.trim(),
+      path: path58.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: cleanedMessage
@@ -10704,8 +10704,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   getDefaultArgs() {
     return ["review"];
@@ -10820,10 +10820,10 @@ function cursorCredentialLocator() {
     extract: extractLocalCursorToken
   };
 }
-function cursorLoginLauncher(os33) {
+function cursorLoginLauncher(os36) {
   return {
     async ensureInstalled() {
-      if (os33.findInPath("cursor-agent")) return true;
+      if (os36.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -10885,8 +10885,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -11006,10 +11006,10 @@ function aiderCredentialLocator() {
     extract: extractLocalAiderToken
   };
 }
-function aiderLoginLauncher(os33) {
+function aiderLoginLauncher(os36) {
   return {
     async ensureInstalled() {
-      if (os33.findInPath("aider")) return true;
+      if (os36.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -11019,7 +11019,7 @@ function aiderLoginLauncher(os33) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process9.spawn)(os33.id === "win32" ? "cmd.exe" : "sh", os33.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process9.spawn)(os36.id === "win32" ? "cmd.exe" : "sh", os36.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -11091,8 +11091,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("aider");
@@ -11221,8 +11221,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os33 = createOsStrategy();
-      return os33.findInPath("gemini") !== null;
+      const os36 = createOsStrategy();
+      return os36.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process10.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -11255,8 +11255,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os33) {
-    this.os = os33;
+  constructor(os36) {
+    this.os = os36;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -11355,18 +11355,18 @@ var GeminiRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os33) => new ClaudeRuntimeStrategy(os33),
-  codex: (os33) => new CodexRuntimeStrategy(os33),
-  coderabbit: (os33) => new CoderabbitRuntimeStrategy(os33),
-  cursor: (os33) => new CursorRuntimeStrategy(os33),
-  aider: (os33) => new AiderRuntimeStrategy(os33),
-  gemini: (os33) => new GeminiRuntimeStrategy(os33)
+  claude: (os36) => new ClaudeRuntimeStrategy(os36),
+  codex: (os36) => new CodexRuntimeStrategy(os36),
+  coderabbit: (os36) => new CoderabbitRuntimeStrategy(os36),
+  cursor: (os36) => new CursorRuntimeStrategy(os36),
+  aider: (os36) => new AiderRuntimeStrategy(os36),
+  gemini: (os36) => new GeminiRuntimeStrategy(os36)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os33 = createOsStrategy()) {
+function createAgentStrategy(agent, os36 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -11376,10 +11376,10 @@ function createAgentStrategy(agent, os33 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os33);
+  return build(os36);
 }
-function createInteractiveAgentStrategy(agent, os33 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os33);
+function createInteractiveAgentStrategy(agent, os36 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os36);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -16508,16 +16508,16 @@ async function downloadCloudflared(target) {
   );
 }
 function downloadUrlForPlatform() {
-  const platform2 = process.platform;
-  const arch = process.arch;
+  const platform3 = process.platform;
+  const arch2 = process.arch;
   const base = "https://github.com/cloudflare/cloudflared/releases/latest/download";
-  if (platform2 === "darwin" && arch === "arm64") return `${base}/cloudflared-darwin-arm64.tgz`;
-  if (platform2 === "darwin" && arch === "x64") return `${base}/cloudflared-darwin-amd64.tgz`;
-  if (platform2 === "linux" && arch === "x64") return `${base}/cloudflared-linux-amd64`;
-  if (platform2 === "linux" && arch === "arm64") return `${base}/cloudflared-linux-arm64`;
-  if (platform2 === "win32") return `${base}/cloudflared-windows-amd64.exe`;
+  if (platform3 === "darwin" && arch2 === "arm64") return `${base}/cloudflared-darwin-arm64.tgz`;
+  if (platform3 === "darwin" && arch2 === "x64") return `${base}/cloudflared-darwin-amd64.tgz`;
+  if (platform3 === "linux" && arch2 === "x64") return `${base}/cloudflared-linux-amd64`;
+  if (platform3 === "linux" && arch2 === "arm64") return `${base}/cloudflared-linux-arm64`;
+  if (platform3 === "win32") return `${base}/cloudflared-windows-amd64.exe`;
   throw new Error(
-    `cloudflared auto-install not supported on ${platform2}/${arch}. Install manually from https://github.com/cloudflare/cloudflared/releases.`
+    `cloudflared auto-install not supported on ${platform3}/${arch2}. Install manually from https://github.com/cloudflare/cloudflared/releases.`
   );
 }
 
@@ -16676,7 +16676,7 @@ function parseExpoUrl(stdout) {
 
 // src/services/preview/port-ready.ts
 var net = __toESM(require("net"));
-function isPortListening(port, host = "127.0.0.1") {
+function isPortListening(port, host2 = "127.0.0.1") {
   return new Promise((resolve7) => {
     const socket = new net.Socket();
     const done = (result) => {
@@ -16688,7 +16688,7 @@ function isPortListening(port, host = "127.0.0.1") {
     socket.once("connect", () => done(true));
     socket.once("timeout", () => done(false));
     socket.once("error", () => done(false));
-    socket.connect(port, host);
+    socket.connect(port, host2);
   });
 }
 async function waitForPortListening(port, opts) {
@@ -17221,8 +17221,8 @@ var path40 = __toESM(require("path"));
 var import_child_process14 = require("child_process");
 var INSTALL_SH_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh";
 var INSTALL_PS1_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/install.ps1";
-function resolveInstallStrategy(platform2) {
-  if (platform2 === "win32") {
+function resolveInstallStrategy(platform3) {
+  if (platform3 === "win32") {
     return {
       command: "powershell.exe",
       args: [
@@ -17265,8 +17265,8 @@ function _defaultInstallSpawn(strategy) {
     );
   });
 }
-async function installBd(platform2 = process.platform) {
-  const strategy = resolveInstallStrategy(platform2);
+async function installBd(platform3 = process.platform) {
+  const strategy = resolveInstallStrategy(platform3);
   log.info("beads", `installing bd via ${strategy.description}`);
   const result = await _installSpawnSeam.run(strategy);
   if (!result.ok) {
@@ -17285,8 +17285,8 @@ var os25 = __toESM(require("os"));
 var path38 = __toESM(require("path"));
 var DOLT_INSTALL_SH_URL = "https://github.com/dolthub/dolt/releases/latest/download/install.sh";
 var DOLT_MSI_URL = "https://github.com/dolthub/dolt/releases/latest/download/dolt-windows-amd64.msi";
-function resolveDoltInstallStrategy(platform2) {
-  if (platform2 === "win32") {
+function resolveDoltInstallStrategy(platform3) {
+  if (platform3 === "win32") {
     const script = [
       `$ErrorActionPreference='Stop';`,
       `$u='${DOLT_MSI_URL}';`,
@@ -17307,7 +17307,7 @@ function resolveDoltInstallStrategy(platform2) {
       description: "PowerShell: download official dolt MSI + silent msiexec"
     };
   }
-  if (platform2 === "darwin") {
+  if (platform3 === "darwin") {
     return {
       command: "brew",
       args: ["install", "dolt"],
@@ -17321,17 +17321,17 @@ function resolveDoltInstallStrategy(platform2) {
   };
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
-function doltPlatformTuple(platform2, arch) {
-  const os33 = platform2 === "win32" ? "windows" : platform2 === "darwin" ? "darwin" : "linux";
-  const a = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : null;
+function doltPlatformTuple(platform3, arch2) {
+  const os36 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os33 === "windows" && a !== "amd64") return null;
-  return `${os33}-${a}`;
+  if (os36 === "windows" && a !== "amd64") return null;
+  return `${os36}-${a}`;
 }
-function resolveDoltTarballStrategy(targetDir, platform2, arch) {
-  const tuple = doltPlatformTuple(platform2, arch);
+function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
+  const tuple = doltPlatformTuple(platform3, arch2);
   if (!tuple) return null;
-  if (platform2 === "win32") {
+  if (platform3 === "win32") {
     const url2 = `${DOLT_RELEASE_BASE}/dolt-${tuple}.zip`;
     const script = [
       `$ErrorActionPreference='Stop';`,
@@ -17357,11 +17357,11 @@ function resolveDoltTarballStrategy(targetDir, platform2, arch) {
     description: `download dolt ${tuple} tarball \u2192 ${targetDir} (no sudo)`
   };
 }
-async function installDoltToDir(targetDir, platform2 = process.platform, arch = process.arch) {
-  const strategy = resolveDoltTarballStrategy(targetDir, platform2, arch);
+async function installDoltToDir(targetDir, platform3 = process.platform, arch2 = process.arch) {
+  const strategy = resolveDoltTarballStrategy(targetDir, platform3, arch2);
   if (!strategy) {
-    log.warn("beads", `no dolt prebuilt for ${platform2}/${arch} \u2014 cannot fall back`);
-    return { ok: false, code: -1, stderr: `unsupported platform ${platform2}/${arch}` };
+    log.warn("beads", `no dolt prebuilt for ${platform3}/${arch2} \u2014 cannot fall back`);
+    return { ok: false, code: -1, stderr: `unsupported platform ${platform3}/${arch2}` };
   }
   log.info("beads", `dolt fallback: ${strategy.description}`);
   const result = await _doltInstallSpawnSeam.run(strategy);
@@ -17385,13 +17385,13 @@ var _doltPathSeam = {
     }
   }
 };
-function doltBinaryNames(platform2) {
-  return platform2 === "win32" ? ["dolt.exe", "dolt.cmd", "dolt"] : ["dolt"];
+function doltBinaryNames(platform3) {
+  return platform3 === "win32" ? ["dolt.exe", "dolt.cmd", "dolt"] : ["dolt"];
 }
-function knownDoltDirs(platform2) {
-  const P3 = platform2 === "win32" ? path38.win32 : path38.posix;
+function knownDoltDirs(platform3) {
+  const P3 = platform3 === "win32" ? path38.win32 : path38.posix;
   const home = _doltPathSeam.homedir();
-  if (platform2 === "win32") {
+  if (platform3 === "win32") {
     return [
       "C:\\Program Files\\Dolt\\bin",
       home ? P3.join(home, "AppData", "Local", "Programs", "dolt", "bin") : ""
@@ -17404,17 +17404,17 @@ function knownDoltDirs(platform2) {
     home ? P3.join(home, "bin") : ""
   ].filter(Boolean);
 }
-function ensureDoltResolvable(platform2 = process.platform) {
-  const P3 = platform2 === "win32" ? path38.win32 : path38.posix;
-  const delim = platform2 === "win32" ? ";" : ":";
-  const names = doltBinaryNames(platform2);
+function ensureDoltResolvable(platform3 = process.platform) {
+  const P3 = platform3 === "win32" ? path38.win32 : path38.posix;
+  const delim = platform3 === "win32" ? ";" : ":";
+  const names = doltBinaryNames(platform3);
   const pathDirs = _doltPathSeam.getPath().split(delim).filter(Boolean);
   for (const dir of pathDirs) {
     for (const n of names) {
       if (_doltPathSeam.exists(P3.join(dir, n))) return true;
     }
   }
-  for (const dir of knownDoltDirs(platform2)) {
+  for (const dir of knownDoltDirs(platform3)) {
     for (const n of names) {
       if (_doltPathSeam.exists(P3.join(dir, n))) {
         _doltPathSeam.setPath(`${dir}${delim}${_doltPathSeam.getPath()}`);
@@ -17468,8 +17468,8 @@ function _defaultDoltInstallSpawn(strategy) {
     proc.on("close", (code) => finish({ ok: code === 0, code: code ?? -1, stderr }));
   });
 }
-async function installDolt(platform2 = process.platform) {
-  const strategy = resolveDoltInstallStrategy(platform2);
+async function installDolt(platform3 = process.platform) {
+  const strategy = resolveDoltInstallStrategy(platform3);
   log.info("beads", `installing dolt via ${strategy.description}`);
   const result = await _doltInstallSpawnSeam.run(strategy);
   if (!result.ok) {
@@ -17521,11 +17521,11 @@ var path39 = __toESM(require("path"));
 function normalizeOrigin(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
-  let host;
+  let host2;
   let pathPart;
   const scpLike = /^[^/@]+@([^:]+):(.+)$/.exec(trimmed);
   if (scpLike && !trimmed.includes("://")) {
-    host = scpLike[1];
+    host2 = scpLike[1];
     pathPart = scpLike[2];
   } else {
     let url;
@@ -17534,13 +17534,13 @@ function normalizeOrigin(raw) {
     } catch {
       return null;
     }
-    host = url.hostname;
+    host2 = url.hostname;
     pathPart = url.pathname;
   }
-  host = host.toLowerCase();
+  host2 = host2.toLowerCase();
   pathPart = pathPart.replace(/^\/+/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
-  if (!host || !pathPart) return null;
-  return `${host}/${pathPart}`;
+  if (!host2 || !pathPart) return null;
+  return `${host2}/${pathPart}`;
 }
 function findRepoRoot(cwd) {
   let dir = path39.resolve(cwd);
@@ -18056,11 +18056,11 @@ var BeadsWatcher = class {
 
 // src/beads/inherit-team-memories.ts
 async function inheritTeamMemories(opts) {
-  const apiBase = opts.apiBaseUrl ?? resolveApiBaseUrl();
+  const apiBase2 = opts.apiBaseUrl ?? resolveApiBaseUrl();
   let memories = [];
   try {
     const res = await _transport3.post(
-      `${apiBase}/api/beads/team-memories`,
+      `${apiBase2}/api/beads/team-memories`,
       {
         "Content-Type": "application/json",
         "X-Codeam-Protocol-Version": "2.0.0",
@@ -19440,10 +19440,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir26) {
+function isUnsafeWindowsWatchRoot(dir, homedir29) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir26);
+  const home = norm(homedir29);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -20237,7 +20237,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs43 = await import("fs/promises");
+  const fs46 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -20245,7 +20245,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs43.readdir(dir, { withFileTypes: true });
+      const dirents = await fs46.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -23920,12 +23920,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path55 = fileFlag.slice("--token-file=".length);
+    const path58 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs40.readFileSync(path55, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path55} is empty`);
+      const content = fs40.readFileSync(path58, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path58} is empty`);
       try {
-        fs40.unlinkSync(path55);
+        fs40.unlinkSync(path58);
       } catch {
       }
       return content;
@@ -24409,12 +24409,12 @@ var GitHubCodespacesProvider = class {
    * install error if it's still missing.
    */
   async tryInstallGh() {
-    const platform2 = process.platform;
+    const platform3 = process.platform;
     wt(
       `GitHub CLI (${import_picocolors8.default.cyan("gh")}) is required for Codespaces deploys but isn't on your PATH.`,
       "Heads up"
     );
-    if (platform2 === "linux") {
+    if (platform3 === "linux") {
       wt(
         [
           "On Linux, please install gh from the official guide:",
@@ -24426,7 +24426,7 @@ var GitHubCodespacesProvider = class {
       return;
     }
     let installCmd = null;
-    if (platform2 === "darwin") {
+    if (platform3 === "darwin") {
       try {
         await execFileP5("brew", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
@@ -24445,7 +24445,7 @@ var GitHubCodespacesProvider = class {
         args: ["install", "gh"],
         describe: "brew install gh"
       };
-    } else if (platform2 === "win32") {
+    } else if (platform3 === "win32") {
       try {
         await execFileP5("winget", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
@@ -26175,50 +26175,488 @@ async function probeCodeamPair(provider, workspace) {
 }
 async function stopWorkspaceFromLocal(target) {
   if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile9 } = await import("child_process");
-    const { promisify: promisify10 } = await import("util");
-    const execFileP9 = promisify10(execFile9);
-    await execFileP9("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
+    const { execFile: execFile10 } = await import("child_process");
+    const { promisify: promisify11 } = await import("util");
+    const execFileP10 = promisify11(execFile10);
+    await execFileP10("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
     return;
   }
 }
 
+// src/commands/host/host-client.ts
+var fs41 = __toESM(require("fs"));
+var os32 = __toESM(require("os"));
+var path53 = __toESM(require("path"));
+function apiBase() {
+  return process.env.CODEAM_API_URL ?? resolveApiBaseUrl();
+}
+function hostIdentityPath() {
+  return path53.join(os32.homedir(), ".codeam", "host-agent.json");
+}
+function collectOsInfo() {
+  return {
+    distro: os32.platform(),
+    arch: os32.arch(),
+    kernel: os32.release(),
+    nodeVersion: process.versions.node
+  };
+}
+function loadHostIdentity() {
+  try {
+    const raw = fs41.readFileSync(hostIdentityPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
+      const p2 = parsed;
+      return { hostId: p2.hostId, hostToken: p2.hostToken, controlPluginId: p2.controlPluginId };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveHostIdentity(identity) {
+  const file = hostIdentityPath();
+  fs41.mkdirSync(path53.dirname(file), { recursive: true, mode: 448 });
+  fs41.writeFileSync(file, JSON.stringify(identity, null, 2), {
+    encoding: "utf8",
+    mode: 384
+  });
+  fs41.chmodSync(file, 384);
+}
+async function postJson(pathname, body) {
+  const res = await fetch(`${apiBase()}${pathname}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...vercelBypassHeader() },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json();
+  if (!res.ok || !json.success) {
+    const err = !json.success ? json.error : void 0;
+    throw new Error(
+      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`
+    );
+  }
+  return json.data;
+}
+async function redeemEnrollToken(token, label) {
+  const data = await postJson("/api/self-hosted/redeem", {
+    token,
+    ...label ? { label } : {},
+    osInfo: collectOsInfo()
+  });
+  return {
+    hostId: data.hostId,
+    hostToken: data.hostToken,
+    controlPluginId: data.controlPluginId
+  };
+}
+async function sendHostHeartbeat(identity) {
+  await postJson("/api/self-hosted/heartbeat", {
+    hostId: identity.hostId,
+    hostToken: identity.hostToken
+  });
+}
+function isSealedEnvelope(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const o = v;
+  return typeof o.ciphertext === "string" && typeof o.iv === "string" && typeof o.authTag === "string" && typeof o.keyVersion === "number";
+}
+function isAgentAuth(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const o = v;
+  return (o.kind === "oauth_token" || o.kind === "api_key") && typeof o.value === "string";
+}
+async function unsealAgentAuth(identity, sealedAgentAuth) {
+  const envelope = JSON.parse(sealedAgentAuth);
+  if (!isSealedEnvelope(envelope)) {
+    throw new Error("sealedAgentAuth is not a valid vault envelope");
+  }
+  const data = await postJson(
+    "/api/self-hosted/unseal-agent-auth",
+    {
+      hostId: identity.hostId,
+      hostToken: identity.hostToken,
+      sealedAgentAuth
+    }
+  );
+  if (!isAgentAuth(data)) {
+    throw new Error("unseal-agent-auth returned an unexpected shape");
+  }
+  return data;
+}
+
+// src/commands/host.ts
+function readTokenFlag(args2) {
+  const flag = args2.find((a) => a.startsWith("--token="));
+  if (!flag) return void 0;
+  const value = flag.slice("--token=".length).trim();
+  return value.length > 0 ? value : void 0;
+}
+function readLabelFlag(args2) {
+  const flag = args2.find((a) => a.startsWith("--label="));
+  if (!flag) return void 0;
+  const value = flag.slice("--label=".length).trim();
+  return value.length > 0 ? value : void 0;
+}
+async function hostEnroll(args2) {
+  const existing = loadHostIdentity();
+  if (existing) {
+    console.log(
+      `  Already enrolled (host ${existing.hostId}). Run \`codeam host-agent\` to connect.`
+    );
+    return;
+  }
+  const token = readTokenFlag(args2);
+  if (!token) {
+    throw new Error(
+      "codeam host enroll requires --token=<EPHEMERAL>. Copy the command from the app."
+    );
+  }
+  const identity = await redeemEnrollToken(token, readLabelFlag(args2));
+  saveHostIdentity(identity);
+  console.log(
+    `  Enrolled host ${identity.hostId}. Sealed credentials to ~/.codeam/host-agent.json (0600).`
+  );
+  console.log("  Run `codeam host-agent` (or let systemd start it) to connect.");
+}
+async function host(args2) {
+  const sub = args2[0];
+  if (sub === "enroll") {
+    await hostEnroll(args2.slice(1));
+    return;
+  }
+  throw new Error(
+    `Unknown 'codeam host' subcommand: ${sub ?? "(none)"}. Try: codeam host enroll --token=<EPHEMERAL>`
+  );
+}
+
+// src/commands/host-agent.ts
+var import_node_child_process13 = require("child_process");
+
+// src/commands/host/workspace.ts
+var fs42 = __toESM(require("fs"));
+var os33 = __toESM(require("os"));
+var path54 = __toESM(require("path"));
+var import_node_child_process12 = require("child_process");
+var import_node_util4 = require("util");
+var execFileP9 = (0, import_node_util4.promisify)(import_node_child_process12.execFile);
+function isAbsolutePathTarget(target) {
+  return path54.isAbsolute(target);
+}
+function selfHostedWorkspaceRoot() {
+  return path54.join(os33.homedir(), ".codeam", "self-hosted");
+}
+function repoCloneUrl(repoRef) {
+  const trimmed = repoRef.trim();
+  if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  return `https://github.com/${trimmed.replace(/\.git$/, "")}.git`;
+}
+async function prepareWorkspace(repoOrPath, deployId) {
+  if (isAbsolutePathTarget(repoOrPath)) {
+    if (!fs42.existsSync(repoOrPath)) {
+      throw new Error(`deploy target path does not exist: ${repoOrPath}`);
+    }
+    return repoOrPath;
+  }
+  const dest = path54.join(selfHostedWorkspaceRoot(), deployId);
+  if (fs42.existsSync(path54.join(dest, ".git"))) {
+    return dest;
+  }
+  fs42.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
+  await execFileP9("git", ["clone", "--depth", "1", repoCloneUrl(repoOrPath), dest], {
+    timeout: 12e4,
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return dest;
+}
+
+// src/commands/host/agent-provisioning.ts
+var fs43 = __toESM(require("fs"));
+var os34 = __toESM(require("os"));
+var path55 = __toESM(require("path"));
+var PUBLIC_TO_INTERNAL_AGENT = {
+  claude_code: "claude",
+  claude: "claude",
+  codex: "codex",
+  copilot: "copilot",
+  cursor: "cursor",
+  aider: "aider",
+  coderabbit: "coderabbit",
+  gemini: "gemini"
+};
+function toInternalAgentId(publicAgentId) {
+  return PUBLIC_TO_INTERNAL_AGENT[publicAgentId] ?? null;
+}
+function ensureDir(dir) {
+  fs43.mkdirSync(dir, { recursive: true, mode: 448 });
+}
+function writeFile0600(filePath, contents) {
+  ensureDir(path55.dirname(filePath));
+  fs43.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
+  fs43.chmodSync(filePath, 384);
+}
+var claudeProvisioner = {
+  write(auth, home) {
+    if (auth.kind === "api_key") {
+      return { ANTHROPIC_API_KEY: auth.value };
+    }
+    writeFile0600(path55.join(home, ".claude", ".credentials.json"), auth.value);
+    const claudeJson = path55.join(home, ".claude.json");
+    if (!fs43.existsSync(claudeJson)) {
+      writeFile0600(
+        claudeJson,
+        JSON.stringify({ hasCompletedOnboarding: true, customApiKeyResponses: { approved: [] } })
+      );
+    }
+    return {};
+  }
+};
+var codexProvisioner = {
+  write(auth, home) {
+    if (auth.kind === "api_key") {
+      return { OPENAI_API_KEY: auth.value };
+    }
+    writeFile0600(path55.join(home, ".codex", "auth.json"), auth.value);
+    return {};
+  }
+};
+var PROVISIONERS = {
+  claude: claudeProvisioner,
+  codex: codexProvisioner
+};
+var UnsupportedAgentError = class extends Error {
+  agentId;
+  constructor(agentId) {
+    super(`Self-hosted provisioning is not implemented for agent "${agentId}"`);
+    this.name = "UnsupportedAgentError";
+    this.agentId = agentId;
+  }
+};
+function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os34.homedir()) {
+  const internal = toInternalAgentId(publicAgentId);
+  if (!internal) throw new UnsupportedAgentError(publicAgentId);
+  const provisioner = PROVISIONERS[internal];
+  if (!provisioner) throw new UnsupportedAgentError(publicAgentId);
+  return provisioner.write(auth, homeDir2);
+}
+
+// src/commands/host-agent.ts
+var HEARTBEAT_INTERVAL_MS = 2e4;
+function isDeployPayload(p2) {
+  return typeof p2.deployId === "string" && typeof p2.repoOrPath === "string" && typeof p2.agentId === "string" && typeof p2.sealedAgentAuth === "string" && typeof p2.autoPairToken === "string";
+}
+function isStopPayload(p2) {
+  return typeof p2.sessionId === "string";
+}
+var CONTROL_AGENT_META = {
+  id: "claude",
+  displayName: "CodeAgent Host Agent",
+  binaryName: "codeam",
+  enabled: true,
+  supportedAuthKinds: ["oauth_token"],
+  preferredAuthKind: "oauth_token"
+};
+var defaultSpawner = (env, cwd) => (0, import_node_child_process13.spawn)(process.execPath, [process.argv[1], "pair-auto"], {
+  cwd,
+  env: { ...process.env, ...env },
+  stdio: "ignore",
+  detached: false
+});
+var HostAgentSupervisor = class {
+  constructor(identity, deps = {}) {
+    this.identity = identity;
+    this.deps = deps;
+    this.spawnChild = deps.spawnChild ?? defaultSpawner;
+    this.resolveAgentAuth = deps.resolveAgentAuth ?? unsealAgentAuth;
+  }
+  identity;
+  deps;
+  children = /* @__PURE__ */ new Map();
+  spawnChild;
+  resolveAgentAuth;
+  relay = null;
+  heartbeatTimer = null;
+  /** Open the control channel (reusing the relay) + start heartbeats. */
+  start() {
+    const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta) => new CommandRelayService(pluginId, onCommand, meta));
+    this.relay = make(
+      this.identity.controlPluginId,
+      (cmd) => this.handleCommand(cmd),
+      CONTROL_AGENT_META
+    );
+    this.relay.start();
+    void this.beat();
+    this.heartbeatTimer = setInterval(() => void this.beat(), HEARTBEAT_INTERVAL_MS);
+    this.heartbeatTimer.unref?.();
+    log.info("host-agent", `supervisor up host=${this.identity.hostId.slice(0, 8)}`);
+  }
+  /** Stop the control channel + heartbeats + kill every child. */
+  stop() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+    this.relay?.stop();
+    for (const child of this.children.values()) {
+      try {
+        child.proc.kill("SIGTERM");
+      } catch {
+      }
+    }
+    this.children.clear();
+  }
+  async beat() {
+    try {
+      await sendHostHeartbeat(this.identity);
+    } catch (err) {
+      log.trace("host-agent", "heartbeat failed", err);
+    }
+  }
+  /** Number of live children — for tests + diagnostics. */
+  childCount() {
+    return this.children.size;
+  }
+  /**
+   * Route a relay command. Only `self_hosted_deploy` / `self_hosted_stop`
+   * are understood; anything else is ignored (the box accepts no
+   * arbitrary command surface).
+   */
+  async handleCommand(cmd) {
+    if (cmd.type === "self_hosted_deploy") {
+      if (!isDeployPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed self_hosted_deploy id=${cmd.id}`);
+        return;
+      }
+      await this.deploy(cmd.payload);
+      return;
+    }
+    if (cmd.type === "self_hosted_stop") {
+      if (!isStopPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed self_hosted_stop id=${cmd.id}`);
+        return;
+      }
+      this.stopChild(cmd.payload.sessionId);
+      return;
+    }
+    log.trace("host-agent", `ignoring unsupported command type=${cmd.type}`);
+  }
+  /**
+   * Prepare the workspace, write the agent credential (same as codespace
+   * provisioning), and spawn a supervised `codeam pair-auto` child.
+   *
+   * The child claims its session via `CODEAM_AUTO_TOKEN`; the backend's
+   * claim response is what binds the sessionId on the server side. We key
+   * the child by `deployId` immediately (and adopt the sessionId — which
+   * for self-hosted equals the deployId-correlated session) so a
+   * subsequent `self_hosted_stop` can find it.
+   */
+  async deploy(payload) {
+    log.info(
+      "host-agent",
+      `deploy id=${payload.deployId.slice(0, 8)} agent=${payload.agentId} target=${payload.repoOrPath}`
+    );
+    const cwd = await prepareWorkspace(payload.repoOrPath, payload.deployId);
+    const auth = await this.resolveAgentAuth(this.identity, payload.sealedAgentAuth);
+    const credEnv = provisionAgentCredentials(payload.agentId, auth, void 0);
+    const childEnv = {
+      ...credEnv,
+      CODEAM_AUTO_TOKEN: payload.autoPairToken
+    };
+    const proc = this.spawnChild(childEnv, cwd);
+    const child = { deployId: payload.deployId, sessionId: payload.deployId, proc };
+    this.children.set(payload.deployId, child);
+    proc.once("exit", () => {
+      if (this.children.get(payload.deployId)?.proc === proc) {
+        this.children.delete(payload.deployId);
+      }
+    });
+  }
+  /** Kill the child matching `sessionId` (or its deployId). No-op if absent. */
+  stopChild(sessionId) {
+    const child = this.children.get(sessionId) ?? this.findBySessionId(sessionId);
+    if (!child) {
+      log.trace("host-agent", `stop: no child for sessionId=${sessionId}`);
+      return;
+    }
+    log.info("host-agent", `stopping child deploy=${child.deployId.slice(0, 8)}`);
+    try {
+      child.proc.kill("SIGTERM");
+    } catch {
+    }
+    this.children.delete(child.deployId);
+  }
+  findBySessionId(sessionId) {
+    for (const child of this.children.values()) {
+      if (child.sessionId === sessionId) return child;
+    }
+    return void 0;
+  }
+};
+async function resolveHostIdentity(enrollToken) {
+  const existing = loadHostIdentity();
+  if (existing) return existing;
+  if (!enrollToken) return null;
+  const identity = await redeemEnrollToken(enrollToken);
+  saveHostIdentity(identity);
+  return identity;
+}
+async function hostAgent(args2 = []) {
+  const tokenArg = args2.find((a) => a.startsWith("--token="));
+  const enrollToken = (tokenArg ? tokenArg.slice("--token=".length).trim() : "") || process.env.CODEAM_ENROLL_TOKEN || void 0;
+  const identity = await resolveHostIdentity(enrollToken);
+  if (!identity) {
+    throw new Error(
+      "host-agent: no sealed host identity and no enroll token. Re-run the installer from the app (tokens expire after 15 min)."
+    );
+  }
+  const supervisor = new HostAgentSupervisor(identity);
+  supervisor.start();
+  const shutdown = () => {
+    supervisor.stop();
+    process.exit(0);
+  };
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  await new Promise(() => {
+  });
+}
+
 // src/commands/doctor.ts
 var import_node_dns = require("dns");
-var import_node_util4 = require("util");
+var import_node_util5 = require("util");
 var import_node_crypto8 = require("crypto");
-var fs41 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path56 = __toESM(require("path"));
 var import_picocolors12 = __toESM(require("picocolors"));
-var dnsResolveP = (0, import_node_util4.promisify)(import_node_dns.resolve);
-async function checkDns(apiBase) {
-  const host = (() => {
+var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
+async function checkDns(apiBase2) {
+  const host2 = (() => {
     try {
-      return new URL(apiBase).host;
+      return new URL(apiBase2).host;
     } catch {
-      return apiBase;
+      return apiBase2;
     }
   })();
   try {
-    const addrs = await dnsResolveP(host);
+    const addrs = await dnsResolveP(host2);
     return {
       id: "dns",
-      label: `DNS resolves ${host}`,
+      label: `DNS resolves ${host2}`,
       ok: true,
       detail: `${addrs.length} record(s)`
     };
   } catch (err) {
     return {
       id: "dns",
-      label: `DNS resolves ${host}`,
+      label: `DNS resolves ${host2}`,
       ok: false,
       detail: err.message,
       hint: "Check your network connection / DNS configuration. The backend host MUST resolve before `codeam pair` can succeed."
     };
   }
 }
-async function checkHealth(apiBase) {
-  const url = `${apiBase}/health`;
+async function checkHealth(apiBase2) {
+  const url = `${apiBase2}/health`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 5e3);
   try {
@@ -26244,13 +26682,13 @@ async function checkHealth(apiBase) {
   }
 }
 function checkConfigDir() {
-  const dir = path53.join(require("os").homedir(), ".codeam");
+  const dir = path56.join(require("os").homedir(), ".codeam");
   try {
-    fs41.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path53.join(dir, ".doctor-probe");
-    fs41.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs41.readFileSync(probe, "utf8");
-    fs41.unlinkSync(probe);
+    fs44.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path56.join(dir, ".doctor-probe");
+    fs44.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs44.readFileSync(probe, "utf8");
+    fs44.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -26290,9 +26728,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os33 = createOsStrategy();
+  const os36 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os33.findInPath(meta.binaryName);
+    const found = os36.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -26314,7 +26752,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path53.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path56.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -26356,13 +26794,13 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.24" : "0.0.0-dev";
-  const apiBase = resolveApiBaseUrl();
+  const cliVersion = true ? "2.39.25" : "0.0.0-dev";
+  const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
   const [dns2, health] = await Promise.all([
-    checkDns(apiBase),
-    checkHealth(apiBase)
+    checkDns(apiBase2),
+    checkHealth(apiBase2)
   ]);
   const checks = [
     dns2,
@@ -26379,7 +26817,7 @@ async function doctor(args2 = []) {
     node: process.version,
     platform: process.platform,
     arch: process.arch,
-    apiBase,
+    apiBase: apiBase2,
     checks,
     // Optional checks (e.g. agent-binary probes) report status but
     // don't gate exit code — see CheckResult.optional.
@@ -26555,7 +26993,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.24" : "unknown";
+  const v = true ? "2.39.25" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -26683,23 +27121,23 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/lib/updateNotifier.ts
-var fs42 = __toESM(require("fs"));
-var os32 = __toESM(require("os"));
-var path54 = __toESM(require("path"));
+var fs45 = __toESM(require("fs"));
+var os35 = __toESM(require("os"));
+var path57 = __toESM(require("path"));
 var https8 = __toESM(require("https"));
-var import_node_child_process12 = require("child_process");
+var import_node_child_process14 = require("child_process");
 var import_picocolors16 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
 var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path54.join(os32.homedir(), ".codeam");
-  return path54.join(dir, "update-check.json");
+  const dir = path57.join(os35.homedir(), ".codeam");
+  return path57.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs42.readFileSync(cachePath(), "utf8");
+    const raw = fs45.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -26710,10 +27148,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs42.mkdirSync(path54.dirname(file), { recursive: true });
+    fs45.mkdirSync(path57.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs42.writeFileSync(tmp, JSON.stringify(cache));
-    fs42.renameSync(tmp, file);
+    fs45.writeFileSync(tmp, JSON.stringify(cache));
+    fs45.renameSync(tmp, file);
   } catch {
   }
 }
@@ -26781,14 +27219,14 @@ function notifyIfStale(currentVersion, latest) {
 }
 function isLinkedInstall() {
   try {
-    const root = (0, import_node_child_process12.execSync)("npm root -g", {
+    const root = (0, import_node_child_process14.execSync)("npm root -g", {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 2e3
     }).trim();
     if (!root) return false;
-    const pkgPath = path54.join(root, PKG_NAME);
-    return fs42.lstatSync(pkgPath).isSymbolicLink();
+    const pkgPath = path57.join(root, PKG_NAME);
+    return fs45.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -26809,7 +27247,7 @@ function maybeAutoUpdate(currentVersion, latest) {
 
 `
   );
-  const install = (0, import_node_child_process12.spawnSync)("npm", ["install", "-g", `${PKG_NAME}@latest`], {
+  const install = (0, import_node_child_process14.spawnSync)("npm", ["install", "-g", `${PKG_NAME}@latest`], {
     stdio: "inherit",
     env: process.env
   });
@@ -26824,13 +27262,13 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs42.unlinkSync(cachePath());
+    fs45.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors16.default.green("\u2713")} Updated. Resuming session...
 
 `);
-  const child = (0, import_node_child_process12.spawnSync)("codeam", process.argv.slice(2), {
+  const child = (0, import_node_child_process14.spawnSync)("codeam", process.argv.slice(2), {
     stdio: "inherit",
     env: process.env
   });
@@ -26841,7 +27279,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.24" : null;
+  const current = true ? "2.39.25" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -26886,6 +27324,8 @@ async function main() {
   const commands = {
     "pair": () => pair(args),
     "pair-auto": () => pairAuto(args),
+    "host-agent": () => hostAgent(args),
+    "host": () => host(args),
     "sessions": () => sessions2(args),
     "status": () => status(),
     "logout": () => logout(),