codeam-cli 2.39.30 → 2.39.31

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.30] — 2026-06-18
+
+### Added
+
+- **cli:** Report real system metrics in host-agent heartbeat
+
 ## [2.39.29] — 2026-06-18
 
 ### Added

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.30",
+  version: "2.39.31",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.30" : "0.0.0-dev",
+    cliVersion: true ? "2.39.31" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -26283,6 +26283,31 @@ function saveHostIdentity(identity) {
   });
   fs41.chmodSync(file, 384);
 }
+var HostHttpError = class extends Error {
+  constructor(message, status2) {
+    super(message);
+    this.status = status2;
+    this.name = "HostHttpError";
+  }
+  status;
+  /**
+   * True iff this is a genuine auth-rejection of the host identity:
+   * 401 (token invalid), 403 (forbidden), 404 (host not found / deleted).
+   * Transient failures (5xx, timeouts, network errors) are NOT rejections.
+   */
+  get isAuthRejection() {
+    return this.status === 401 || this.status === 403 || this.status === 404;
+  }
+};
+function isHostAuthRejection(err) {
+  return err instanceof HostHttpError && err.isAuthRejection;
+}
+function deleteHostIdentity() {
+  try {
+    fs41.rmSync(hostIdentityPath(), { force: true });
+  } catch {
+  }
+}
 async function postJson(pathname, body) {
   const res = await fetch(`${apiBase()}${pathname}`, {
     method: "POST",
@@ -26292,8 +26317,9 @@ async function postJson(pathname, body) {
   const json = await res.json();
   if (!res.ok || !json.success) {
     const err = !json.success ? json.error : void 0;
-    throw new Error(
-      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`
+    throw new HostHttpError(
+      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`,
+      res.status
     );
   }
   return json.data;
@@ -26555,6 +26581,17 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process13.s
   stdio: "ignore",
   detached: false
 });
+var defaultOnIdentityRejected = () => {
+  deleteHostIdentity();
+  log.warn("host-agent", "host identity rejected by backend \u2014 wiped sealed identity, exiting");
+  process.exit(1);
+};
+var defaultDisableService = () => {
+  try {
+    (0, import_node_child_process13.execFileSync)("systemctl", ["disable", "--now", "codeam-host-agent"], { stdio: "ignore" });
+  } catch {
+  }
+};
 var HostAgentSupervisor = class {
   constructor(identity, deps = {}) {
     this.identity = identity;
@@ -26562,6 +26599,8 @@ var HostAgentSupervisor = class {
     this.spawnChild = deps.spawnChild ?? defaultSpawner;
     this.resolveAgentAuth = deps.resolveAgentAuth ?? unsealAgentAuth;
     this.metrics = deps.metricsCollector ?? new MetricsCollector();
+    this.onIdentityRejected = deps.onIdentityRejected ?? defaultOnIdentityRejected;
+    this.disableService = deps.disableService ?? defaultDisableService;
   }
   identity;
   deps;
@@ -26574,6 +26613,12 @@ var HostAgentSupervisor = class {
   reportedConnected = false;
   /** Live-metrics collector — stateful across beats (CPU delta + latency). */
   metrics;
+  /** Self-heal action when the backend rejects this identity. */
+  onIdentityRejected;
+  /** Best-effort systemd de-provision used by `self_hosted_wipe`. */
+  disableService;
+  /** Guards against firing the self-heal more than once. */
+  healing = false;
   /** Open the control channel (reusing the relay) + start heartbeats. */
   start() {
     const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta) => new CommandRelayService(pluginId, onCommand, meta));
@@ -26622,6 +26667,14 @@ var HostAgentSupervisor = class {
         );
       }
     } catch (err) {
+      if (isHostAuthRejection(err)) {
+        if (!this.healing) {
+          this.healing = true;
+          log.warn("host-agent", "heartbeat rejected \u2014 host deleted/revoked, self-healing", err);
+          this.onIdentityRejected();
+        }
+        return;
+      }
       log.trace("host-agent", "heartbeat failed", err);
     }
   }
@@ -26651,6 +26704,16 @@ var HostAgentSupervisor = class {
       this.stopChild(cmd.payload.sessionId);
       return;
     }
+    if (cmd.type === "self_hosted_wipe") {
+      log.warn("host-agent", `self_hosted_wipe received id=${cmd.id} \u2014 de-provisioning`);
+      this.stop();
+      this.disableService();
+      if (!this.healing) {
+        this.healing = true;
+        this.onIdentityRejected();
+      }
+      return;
+    }
     log.trace("host-agent", `ignoring unsupported command type=${cmd.type}`);
   }
   /**
@@ -26725,17 +26788,31 @@ var HostAgentSupervisor = class {
 };
 async function resolveHostIdentity(enrollToken) {
   const existing = loadHostIdentity();
+  if (enrollToken) {
+    await reportProgress({ enrollToken }, "redeeming", "redeeming enrollment token\u2026");
+    try {
+      const identity = await redeemEnrollToken(enrollToken);
+      saveHostIdentity(identity);
+      await reportProgress(
+        { hostId: identity.hostId, hostToken: identity.hostToken },
+        "enrolled",
+        "host enrolled"
+      );
+      return identity;
+    } catch (err) {
+      if (existing) {
+        log.trace(
+          "host-agent",
+          "enroll-token redeem failed; reusing sealed identity (likely a restart)",
+          err
+        );
+        return existing;
+      }
+      throw err;
+    }
+  }
   if (existing) return existing;
-  if (!enrollToken) return null;
-  await reportProgress({ enrollToken }, "redeeming", "redeeming enrollment token\u2026");
-  const identity = await redeemEnrollToken(enrollToken);
-  saveHostIdentity(identity);
-  await reportProgress(
-    { hostId: identity.hostId, hostToken: identity.hostToken },
-    "enrolled",
-    "host enrolled"
-  );
-  return identity;
+  return null;
 }
 async function hostAgent(args2 = []) {
   const tokenArg = args2.find((a) => a.startsWith("--token="));
@@ -26931,7 +27008,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.30" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.31" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -27130,7 +27207,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.30" : "unknown";
+  const v = true ? "2.39.31" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27416,7 +27493,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.30" : null;
+  const current = true ? "2.39.31" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.30",
+  "version": "2.39.31",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",