codeam-cli 2.39.29 → 2.39.31

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.30] — 2026-06-18
+
+### Added
+
+- **cli:** Report real system metrics in host-agent heartbeat
+
+## [2.39.29] — 2026-06-18
+
+### Added
+
+- **cli:** Report host-agent enrollment progress to backend
+
 ## [2.39.28] — 2026-06-18
 
 ### Added

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.29",
+  version: "2.39.31",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.29" : "0.0.0-dev",
+    cliVersion: true ? "2.39.31" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -26205,6 +26205,48 @@ async function stopWorkspaceFromLocal(target) {
 var fs41 = __toESM(require("fs"));
 var os32 = __toESM(require("os"));
 var path53 = __toESM(require("path"));
+function sampleCpuTimes() {
+  let idle = 0;
+  let total = 0;
+  for (const cpu of os32.cpus()) {
+    const t2 = cpu.times;
+    idle += t2.idle;
+    total += t2.user + t2.nice + t2.sys + t2.idle + t2.irq;
+  }
+  return { idle, total };
+}
+var MetricsCollector = class {
+  prevCpu = null;
+  lastLatencyMs = 0;
+  /** Record the measured round-trip of the heartbeat just sent. */
+  recordLatency(latencyMs) {
+    this.lastLatencyMs = Math.max(0, Math.round(latencyMs));
+  }
+  cpuPct() {
+    const current = sampleCpuTimes();
+    const prev = this.prevCpu;
+    this.prevCpu = current;
+    if (!prev) {
+      const cores = os32.cpus().length || 1;
+      const proxy = os32.loadavg()[0] / cores * 100;
+      return Math.min(100, Math.max(0, Math.round(proxy)));
+    }
+    const idleDelta = current.idle - prev.idle;
+    const totalDelta = current.total - prev.total;
+    if (totalDelta <= 0) return 0;
+    const busy = (1 - idleDelta / totalDelta) * 100;
+    return Math.min(100, Math.max(0, Math.round(busy)));
+  }
+  /** Collect the current metrics snapshot for this beat. */
+  collect() {
+    return {
+      cpuPct: this.cpuPct(),
+      ramUsedMb: Math.round((os32.totalmem() - os32.freemem()) / 1048576),
+      ramTotalMb: Math.round(os32.totalmem() / 1048576),
+      latencyMs: this.lastLatencyMs
+    };
+  }
+};
 function apiBase() {
   return process.env.CODEAM_API_URL ?? resolveApiBaseUrl();
 }
@@ -26241,6 +26283,31 @@ function saveHostIdentity(identity) {
   });
   fs41.chmodSync(file, 384);
 }
+var HostHttpError = class extends Error {
+  constructor(message, status2) {
+    super(message);
+    this.status = status2;
+    this.name = "HostHttpError";
+  }
+  status;
+  /**
+   * True iff this is a genuine auth-rejection of the host identity:
+   * 401 (token invalid), 403 (forbidden), 404 (host not found / deleted).
+   * Transient failures (5xx, timeouts, network errors) are NOT rejections.
+   */
+  get isAuthRejection() {
+    return this.status === 401 || this.status === 403 || this.status === 404;
+  }
+};
+function isHostAuthRejection(err) {
+  return err instanceof HostHttpError && err.isAuthRejection;
+}
+function deleteHostIdentity() {
+  try {
+    fs41.rmSync(hostIdentityPath(), { force: true });
+  } catch {
+  }
+}
 async function postJson(pathname, body) {
   const res = await fetch(`${apiBase()}${pathname}`, {
     method: "POST",
@@ -26250,8 +26317,9 @@ async function postJson(pathname, body) {
   const json = await res.json();
   if (!res.ok || !json.success) {
     const err = !json.success ? json.error : void 0;
-    throw new Error(
-      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`
+    throw new HostHttpError(
+      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`,
+      res.status
     );
   }
   return json.data;
@@ -26268,11 +26336,15 @@ async function redeemEnrollToken(token, label) {
     controlPluginId: data.controlPluginId
   };
 }
-async function sendHostHeartbeat(identity) {
+async function sendHostHeartbeat(identity, metrics) {
+  const start2 = process.hrtime.bigint();
   await postJson("/api/self-hosted/heartbeat", {
     hostId: identity.hostId,
-    hostToken: identity.hostToken
+    hostToken: identity.hostToken,
+    ...metrics ? { metrics } : {}
   });
+  const elapsedNs = process.hrtime.bigint() - start2;
+  return Math.round(Number(elapsedNs) / 1e6);
 }
 function isSealedEnvelope(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -26509,12 +26581,26 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process13.s
   stdio: "ignore",
   detached: false
 });
+var defaultOnIdentityRejected = () => {
+  deleteHostIdentity();
+  log.warn("host-agent", "host identity rejected by backend \u2014 wiped sealed identity, exiting");
+  process.exit(1);
+};
+var defaultDisableService = () => {
+  try {
+    (0, import_node_child_process13.execFileSync)("systemctl", ["disable", "--now", "codeam-host-agent"], { stdio: "ignore" });
+  } catch {
+  }
+};
 var HostAgentSupervisor = class {
   constructor(identity, deps = {}) {
     this.identity = identity;
     this.deps = deps;
     this.spawnChild = deps.spawnChild ?? defaultSpawner;
     this.resolveAgentAuth = deps.resolveAgentAuth ?? unsealAgentAuth;
+    this.metrics = deps.metricsCollector ?? new MetricsCollector();
+    this.onIdentityRejected = deps.onIdentityRejected ?? defaultOnIdentityRejected;
+    this.disableService = deps.disableService ?? defaultDisableService;
   }
   identity;
   deps;
@@ -26525,6 +26611,14 @@ var HostAgentSupervisor = class {
   heartbeatTimer = null;
   /** Guards the one-shot 'connected' telemetry on the first heartbeat. */
   reportedConnected = false;
+  /** Live-metrics collector — stateful across beats (CPU delta + latency). */
+  metrics;
+  /** Self-heal action when the backend rejects this identity. */
+  onIdentityRejected;
+  /** Best-effort systemd de-provision used by `self_hosted_wipe`. */
+  disableService;
+  /** Guards against firing the self-heal more than once. */
+  healing = false;
   /** Open the control channel (reusing the relay) + start heartbeats. */
   start() {
     const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta) => new CommandRelayService(pluginId, onCommand, meta));
@@ -26556,7 +26650,14 @@ var HostAgentSupervisor = class {
   }
   async beat() {
     try {
-      await sendHostHeartbeat(this.identity);
+      let metrics;
+      try {
+        metrics = this.metrics.collect();
+      } catch (err) {
+        log.trace("host-agent", "metrics collection failed", err);
+      }
+      const latencyMs = await sendHostHeartbeat(this.identity, metrics);
+      this.metrics.recordLatency(latencyMs);
       if (!this.reportedConnected) {
         this.reportedConnected = true;
         void reportProgress(
@@ -26566,6 +26667,14 @@ var HostAgentSupervisor = class {
         );
       }
     } catch (err) {
+      if (isHostAuthRejection(err)) {
+        if (!this.healing) {
+          this.healing = true;
+          log.warn("host-agent", "heartbeat rejected \u2014 host deleted/revoked, self-healing", err);
+          this.onIdentityRejected();
+        }
+        return;
+      }
       log.trace("host-agent", "heartbeat failed", err);
     }
   }
@@ -26595,6 +26704,16 @@ var HostAgentSupervisor = class {
       this.stopChild(cmd.payload.sessionId);
       return;
     }
+    if (cmd.type === "self_hosted_wipe") {
+      log.warn("host-agent", `self_hosted_wipe received id=${cmd.id} \u2014 de-provisioning`);
+      this.stop();
+      this.disableService();
+      if (!this.healing) {
+        this.healing = true;
+        this.onIdentityRejected();
+      }
+      return;
+    }
     log.trace("host-agent", `ignoring unsupported command type=${cmd.type}`);
   }
   /**
@@ -26669,17 +26788,31 @@ var HostAgentSupervisor = class {
 };
 async function resolveHostIdentity(enrollToken) {
   const existing = loadHostIdentity();
+  if (enrollToken) {
+    await reportProgress({ enrollToken }, "redeeming", "redeeming enrollment token\u2026");
+    try {
+      const identity = await redeemEnrollToken(enrollToken);
+      saveHostIdentity(identity);
+      await reportProgress(
+        { hostId: identity.hostId, hostToken: identity.hostToken },
+        "enrolled",
+        "host enrolled"
+      );
+      return identity;
+    } catch (err) {
+      if (existing) {
+        log.trace(
+          "host-agent",
+          "enroll-token redeem failed; reusing sealed identity (likely a restart)",
+          err
+        );
+        return existing;
+      }
+      throw err;
+    }
+  }
   if (existing) return existing;
-  if (!enrollToken) return null;
-  await reportProgress({ enrollToken }, "redeeming", "redeeming enrollment token\u2026");
-  const identity = await redeemEnrollToken(enrollToken);
-  saveHostIdentity(identity);
-  await reportProgress(
-    { hostId: identity.hostId, hostToken: identity.hostToken },
-    "enrolled",
-    "host enrolled"
-  );
-  return identity;
+  return null;
 }
 async function hostAgent(args2 = []) {
   const tokenArg = args2.find((a) => a.startsWith("--token="));
@@ -26875,7 +27008,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.29" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.31" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -27074,7 +27207,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.29" : "unknown";
+  const v = true ? "2.39.31" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27360,7 +27493,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.29" : null;
+  const current = true ? "2.39.31" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.29",
+  "version": "2.39.31",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",