codeam-cli 2.39.38 → 2.39.40

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.39] — 2026-06-19
+
+### Fixed
+
+- **cli:** Gate preview tunnel on cloudflared 'Registered tunnel connection', not a host DNS probe
+
+## [2.39.38] — 2026-06-19
+
+### Added
+
+- **cli:** Host-agent runs the per-agent install script before spawning
+
 ## [2.39.37] — 2026-06-19
 
 ### Fixed

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.38",
+  version: "2.39.40",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.38" : "0.0.0-dev",
+    cliVersion: true ? "2.39.40" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -15259,7 +15259,7 @@ var fs35 = __toESM(require("fs"));
 var os28 = __toESM(require("os"));
 var path42 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
-var import_child_process18 = require("child_process");
+var import_child_process19 = require("child_process");
 
 // src/lib/payload.ts
 var import_zod = require("zod");
@@ -16464,37 +16464,21 @@ async function linkDryRunPreflight(ctx) {
 }
 
 // src/services/preview/cloudflared.ts
-var import_promises = __toESM(require("dns/promises"));
+var import_child_process11 = require("child_process");
 var import_fs = require("fs");
-var import_promises2 = __toESM(require("fs/promises"));
+var import_promises = __toESM(require("fs/promises"));
 var import_os6 = __toESM(require("os"));
 var import_path4 = __toESM(require("path"));
-var import_promises3 = require("stream/promises");
+var import_promises2 = require("stream/promises");
 var import_which = __toESM(require("which"));
 var CACHED_BINARY = import_path4.default.join(import_os6.default.homedir(), ".codeam", "bin", "cloudflared");
-async function waitForCloudflaredReady(url, timeoutMs = 6e4) {
-  const hostname3 = new URL(url).hostname;
-  const cares = new import_promises.Resolver();
-  const start2 = Date.now();
-  while (Date.now() - start2 < timeoutMs) {
-    const lookup = import_promises.default.lookup(hostname3, { all: true }).then((addrs) => addrs.length > 0, () => false);
-    const v4 = cares.resolve4(hostname3).then((addrs) => addrs.length > 0, () => false);
-    const v6 = cares.resolve6(hostname3).then((addrs) => addrs.length > 0, () => false);
-    const results = await Promise.all([lookup, v4, v6]);
-    if (results.some((ok) => ok)) return;
-    await new Promise((r) => setTimeout(r, 1e3));
-  }
-  throw new Error(
-    `DNS for ${hostname3} did not resolve within ${timeoutMs}ms (Cloudflare Quick Tunnel registration may have failed).`
-  );
-}
 async function resolveCloudflared(opts = {}) {
   try {
     return await (0, import_which.default)("cloudflared");
   } catch {
   }
   try {
-    await import_promises2.default.access(CACHED_BINARY);
+    await import_promises.default.access(CACHED_BINARY);
     return CACHED_BINARY;
   } catch {
   }
@@ -16508,14 +16492,14 @@ async function resolveCloudflared(opts = {}) {
 }
 async function downloadCloudflared(target) {
   const url = downloadUrlForPlatform();
-  await import_promises2.default.mkdir(import_path4.default.dirname(target), { recursive: true });
+  await import_promises.default.mkdir(import_path4.default.dirname(target), { recursive: true });
   const response = await fetch(url);
   if (!response.ok || !response.body) {
     throw new Error(
       `Failed to download cloudflared from ${url}: HTTP ${response.status}. Install manually from https://github.com/cloudflare/cloudflared/releases.`
     );
   }
-  await (0, import_promises3.pipeline)(
+  await (0, import_promises2.pipeline)(
     response.body,
     (0, import_fs.createWriteStream)(target, { mode: 493 })
   );
@@ -16533,14 +16517,41 @@ function downloadUrlForPlatform() {
     `cloudflared auto-install not supported on ${platform3}/${arch2}. Install manually from https://github.com/cloudflare/cloudflared/releases.`
   );
 }
+function decodeTunnelToken(token) {
+  const decoded = JSON.parse(Buffer.from(token, "base64").toString("utf8"));
+  if (!decoded.a || !decoded.t || !decoded.s) {
+    throw new Error("cloudflared token missing accountTag/tunnelID/tunnelSecret");
+  }
+  return { AccountTag: decoded.a, TunnelID: decoded.t, TunnelSecret: decoded.s };
+}
+async function spawnNamedTunnel(bin, token, port) {
+  const creds = decodeTunnelToken(token);
+  const credDir = import_path4.default.join(import_os6.default.homedir(), ".codeam");
+  await import_promises.default.mkdir(credDir, { recursive: true });
+  const credFile = import_path4.default.join(credDir, `tunnel-${creds.TunnelID}.json`);
+  await import_promises.default.writeFile(credFile, JSON.stringify(creds), { mode: 384 });
+  return (0, import_child_process11.spawn)(
+    bin,
+    [
+      "tunnel",
+      "run",
+      "--credentials-file",
+      credFile,
+      "--url",
+      `http://localhost:${port}`,
+      creds.TunnelID
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+}
 
 // src/services/preview/codespace.ts
-var import_child_process11 = require("child_process");
+var import_child_process12 = require("child_process");
 var import_util3 = require("util");
-var execFileP4 = (0, import_util3.promisify)(import_child_process11.execFile);
+var execFileP4 = (0, import_util3.promisify)(import_child_process12.execFile);
 
 // src/services/preview/config-file.ts
-var import_promises4 = __toESM(require("fs/promises"));
+var import_promises3 = __toESM(require("fs/promises"));
 var import_path5 = __toESM(require("path"));
 var CONFIG_DIR = ".codeam";
 var CONFIG_FILE = "preview.json";
@@ -16557,7 +16568,7 @@ var REQUIRED_FIELDS = [
 async function readPreviewConfig(cwd) {
   let raw;
   try {
-    raw = await import_promises4.default.readFile(configPath(cwd), "utf-8");
+    raw = await import_promises3.default.readFile(configPath(cwd), "utf-8");
   } catch {
     return null;
   }
@@ -16576,8 +16587,8 @@ async function readPreviewConfig(cwd) {
 }
 async function writePreviewConfig(cwd, detection) {
   const filePath = configPath(cwd);
-  await import_promises4.default.mkdir(import_path5.default.dirname(filePath), { recursive: true });
-  await import_promises4.default.writeFile(filePath, JSON.stringify(detection, null, 2) + "\n", "utf-8");
+  await import_promises3.default.mkdir(import_path5.default.dirname(filePath), { recursive: true });
+  await import_promises3.default.writeFile(filePath, JSON.stringify(detection, null, 2) + "\n", "utf-8");
 }
 
 // src/services/preview/parser.ts
@@ -16691,10 +16702,10 @@ var import_fs2 = require("fs");
 var import_path6 = __toESM(require("path"));
 
 // src/services/preview/run-setup.ts
-var import_child_process12 = require("child_process");
+var import_child_process13 = require("child_process");
 function runSetupCommand(cmd, args2, cwd, env, opts) {
   return new Promise((resolve7) => {
-    const child = (0, import_child_process12.spawn)(cmd, args2, {
+    const child = (0, import_child_process13.spawn)(cmd, args2, {
       cwd,
       env: { ...process.env, ...env ?? {} },
       stdio: ["ignore", "pipe", "pipe"]
@@ -16991,7 +17002,7 @@ function activePreviewSessionIds() {
 }
 
 // src/beads/bd-adapter.ts
-var import_child_process13 = require("child_process");
+var import_child_process14 = require("child_process");
 var fs31 = __toESM(require("fs"));
 var os25 = __toESM(require("os"));
 var path37 = __toESM(require("path"));
@@ -17045,7 +17056,7 @@ function _defaultSpawn(binaryPath, args2, opts) {
   return new Promise((resolve7) => {
     let proc;
     try {
-      proc = (0, import_child_process13.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
+      proc = (0, import_child_process14.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
     } catch (err) {
       resolve7({ code: -1, stdout: "", stderr: err.message });
       return;
@@ -17199,13 +17210,13 @@ function coerceIssue(row, projectKey) {
 }
 
 // src/beads/provisioner.ts
-var import_child_process17 = require("child_process");
+var import_child_process18 = require("child_process");
 var fs34 = __toESM(require("fs"));
 var os27 = __toESM(require("os"));
 var path40 = __toESM(require("path"));
 
 // src/beads/install-bd.ts
-var import_child_process14 = require("child_process");
+var import_child_process15 = require("child_process");
 var INSTALL_SH_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh";
 var INSTALL_PS1_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/install.ps1";
 function resolveInstallStrategy(platform3) {
@@ -17236,7 +17247,7 @@ function _defaultInstallSpawn(strategy) {
   return new Promise((resolve7) => {
     let proc;
     try {
-      proc = (0, import_child_process14.spawn)(strategy.command, strategy.args, { env: process.env });
+      proc = (0, import_child_process15.spawn)(strategy.command, strategy.args, { env: process.env });
     } catch (err) {
       resolve7({ ok: false, code: -1, stderr: err.message });
       return;
@@ -17266,7 +17277,7 @@ async function installBd(platform3 = process.platform) {
 }
 
 // src/beads/install-dolt.ts
-var import_child_process15 = require("child_process");
+var import_child_process16 = require("child_process");
 var fs32 = __toESM(require("fs"));
 var os26 = __toESM(require("os"));
 var path38 = __toESM(require("path"));
@@ -17428,7 +17439,7 @@ function _defaultDoltInstallSpawn(strategy) {
     };
     let proc;
     try {
-      proc = (0, import_child_process15.spawn)(strategy.command, strategy.args, {
+      proc = (0, import_child_process16.spawn)(strategy.command, strategy.args, {
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -17501,7 +17512,7 @@ async function ensureSharedServer(adapter) {
 }
 
 // src/beads/project-key.ts
-var import_child_process16 = require("child_process");
+var import_child_process17 = require("child_process");
 var crypto2 = __toESM(require("crypto"));
 var fs33 = __toESM(require("fs"));
 var path39 = __toESM(require("path"));
@@ -17548,7 +17559,7 @@ function findRepoRoot(cwd) {
 }
 var _execSeam2 = {
   exec: (file, args2, opts) => {
-    const out2 = (0, import_child_process16.execFileSync)(file, args2, opts);
+    const out2 = (0, import_child_process17.execFileSync)(file, args2, opts);
     return typeof out2 === "string" ? out2 : out2.toString("utf8");
   },
   realpath: (p2) => fs33.realpathSync(p2)
@@ -17708,7 +17719,7 @@ function linkBdOntoPath(binaryPath) {
   log.info("beads", `linked bd onto PATH: ${linkPath} -> ${binaryPath}`);
 }
 function setGitBeadsRole() {
-  (0, import_child_process17.execFileSync)("git", ["config", "--global", "beads.role", "contributor"], {
+  (0, import_child_process18.execFileSync)("git", ["config", "--global", "beads.role", "contributor"], {
     stdio: "ignore"
   });
 }
@@ -18394,7 +18405,7 @@ var sessionTerminated = async (ctx, cmd) => {
   } catch {
   }
   try {
-    const proc = (0, import_child_process18.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process19.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -18416,7 +18427,7 @@ var shutdownSession = async (ctx, cmd) => {
   }
   if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
     try {
-      const stopProc = (0, import_child_process18.spawn)(
+      const stopProc = (0, import_child_process19.spawn)(
         "bash",
         ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
         { detached: true, stdio: "ignore" }
@@ -18426,7 +18437,7 @@ var shutdownSession = async (ctx, cmd) => {
     }
   }
   try {
-    const proc = (0, import_child_process18.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process19.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -19031,7 +19042,7 @@ var previewStartH = (ctx, _cmd, parsed) => {
       "BOOT_SEQUENCE",
       `${spawnable.command} ${spawnable.args.join(" ")}`
     );
-    const devServer = (0, import_child_process18.spawn)(spawnable.command, spawnable.args, {
+    const devServer = (0, import_child_process19.spawn)(spawnable.command, spawnable.args, {
       cwd: process.cwd(),
       env: { ...process.env, ...spawnable.env ?? {} },
       stdio: ["ignore", "pipe", "pipe"]
@@ -19134,6 +19145,47 @@ var previewStartH = (ctx, _cmd, parsed) => {
       const MAX_TUNNEL_ATTEMPTS = 3;
       let parsedUrl = null;
       let lastTunnelErr = "cloudflared did not emit a URL within 45s";
+      const namedToken = process.env.PREVIEW_TUNNEL_TOKEN;
+      const namedHostname = process.env.PREVIEW_TUNNEL_HOSTNAME;
+      if (namedToken && namedHostname) {
+        try {
+          emitProgress("TUNNEL_STARTING", `named tunnel ${namedHostname}`);
+          const candidate = await spawnNamedTunnel(bin, namedToken, detection.port);
+          let registered = false;
+          const onNamedChunk = (chunk) => {
+            const s = chunk.toString();
+            if (/Registered tunnel connection/i.test(s)) registered = true;
+            const trimmed = s.replace(/\n+$/g, "");
+            if (trimmed.length > 0) log.info("preview", `cloudflared: ${trimmed}`);
+          };
+          candidate.stderr.on("data", onNamedChunk);
+          candidate.stdout.on("data", onNamedChunk);
+          const namedDeadline = Date.now() + 45e3;
+          while (!registered && Date.now() < namedDeadline) {
+            await new Promise((r) => setTimeout(r, 250));
+          }
+          if (registered) {
+            const namedUrl = `https://${namedHostname}`;
+            log.info("preview", `named tunnel registered: ${namedUrl}`);
+            tunnel = candidate;
+            parsedUrl = namedUrl;
+          } else {
+            log.info(
+              "preview",
+              "named tunnel did not register within 45s \u2014 falling back to quick tunnel"
+            );
+            try {
+              candidate.kill("SIGTERM");
+            } catch {
+            }
+          }
+        } catch (e) {
+          log.info(
+            "preview",
+            `named tunnel failed (${e.message}) \u2014 falling back to quick tunnel`
+          );
+        }
+      }
       for (let attempt = 1; attempt <= MAX_TUNNEL_ATTEMPTS && !parsedUrl; attempt += 1) {
         if (attempt > 1) {
           emitProgress(
@@ -19141,39 +19193,32 @@ var previewStartH = (ctx, _cmd, parsed) => {
             `cloudflared quick tunnel (retry ${attempt}/${MAX_TUNNEL_ATTEMPTS})`
           );
         }
-        const candidate = (0, import_child_process18.spawn)(
+        const candidate = (0, import_child_process19.spawn)(
           bin,
           ["tunnel", "--url", `http://localhost:${detection.port}`],
           { stdio: ["ignore", "pipe", "pipe"] }
         );
         let candidateUrl = null;
+        let registered = false;
         const onTunnelChunk = (chunk) => {
           const s = chunk.toString();
           if (!candidateUrl) candidateUrl = parseCloudflaredUrl(s);
+          if (/Registered tunnel connection/i.test(s)) registered = true;
           const trimmed = s.replace(/\n+$/g, "");
           if (trimmed.length > 0) log.info("preview", `cloudflared: ${trimmed}`);
         };
         candidate.stderr.on("data", onTunnelChunk);
         candidate.stdout.on("data", onTunnelChunk);
-        const urlDeadline = Date.now() + 45e3;
-        while (!candidateUrl && Date.now() < urlDeadline) {
+        const deadline = Date.now() + 45e3;
+        while ((!candidateUrl || !registered) && Date.now() < deadline) {
           await new Promise((r) => setTimeout(r, 250));
         }
-        if (!candidateUrl) {
-          lastTunnelErr = "cloudflared did not emit a URL within 45s";
-          try {
-            candidate.kill("SIGTERM");
-          } catch {
-          }
-          continue;
-        }
-        try {
-          await waitForCloudflaredReady(candidateUrl, 4e4);
-          log.info("preview", `cloudflared probe: ${candidateUrl} reachable from CLI host`);
+        if (candidateUrl && registered) {
+          log.info("preview", `cloudflared tunnel registered: ${candidateUrl}`);
           tunnel = candidate;
           parsedUrl = candidateUrl;
-        } catch (e) {
-          lastTunnelErr = e.message;
+        } else {
+          lastTunnelErr = candidateUrl ? "cloudflared did not register a tunnel connection within 45s" : "cloudflared did not emit a URL within 45s";
           try {
             candidate.kill("SIGTERM");
           } catch {
@@ -19315,7 +19360,7 @@ async function dispatchCommand(ctx, cmd) {
 }
 
 // src/services/file-watcher.service.ts
-var import_child_process19 = require("child_process");
+var import_child_process20 = require("child_process");
 var fs36 = __toESM(require("fs"));
 var os29 = __toESM(require("os"));
 var path43 = __toESM(require("path"));
@@ -20081,7 +20126,7 @@ async function _runGitImpl(cwd, args2, opts = {}) {
   return new Promise((resolve7) => {
     let proc;
     try {
-      proc = (0, import_child_process19.spawn)("git", args2, { cwd, env: process.env });
+      proc = (0, import_child_process20.spawn)("git", args2, { cwd, env: process.env });
     } catch {
       resolve7(null);
       return;
@@ -20113,7 +20158,7 @@ function _runGit(cwd, args2, opts = {}) {
 var import_crypto4 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
-var import_child_process20 = require("child_process");
+var import_child_process21 = require("child_process");
 var path44 = __toESM(require("path"));
 async function collectRepoChangeset(opts) {
   const status2 = await runGit3(opts.repoRoot, ["status", "--porcelain=v1", "-z"]);
@@ -20197,7 +20242,7 @@ function defaultRunGit(cwd, args2) {
   return new Promise((resolve7) => {
     let proc;
     try {
-      proc = (0, import_child_process20.spawn)("git", args2, { cwd, env: process.env });
+      proc = (0, import_child_process21.spawn)("git", args2, { cwd, env: process.env });
     } catch {
       resolve7(null);
       return;
@@ -23206,13 +23251,13 @@ function fetchQuotaUsage(runtime, historySvc) {
 }
 
 // src/commands/start/keep-alive.ts
-var import_child_process21 = require("child_process");
+var import_child_process22 = require("child_process");
 function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
     await new Promise((resolve7) => {
-      const proc = (0, import_child_process21.spawn)(
+      const proc = (0, import_child_process22.spawn)(
         "gh",
         [
           "api",
@@ -24279,11 +24324,11 @@ async function logout() {
 var import_picocolors10 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
-var import_child_process22 = require("child_process");
+var import_child_process23 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors8 = __toESM(require("picocolors"));
 var path49 = __toESM(require("path"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process22.execFile);
+var execFileP5 = (0, import_util4.promisify)(import_child_process23.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -24327,7 +24372,7 @@ var GitHubCodespacesProvider = class {
     if (!isAuthed) {
       resetStdinForChild();
       await new Promise((resolve7, reject) => {
-        const proc = (0, import_child_process22.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
+        const proc = (0, import_child_process23.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
@@ -24361,7 +24406,7 @@ var GitHubCodespacesProvider = class {
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
       const refreshCode = await new Promise((resolve7, reject) => {
-        const proc = (0, import_child_process22.spawn)(
+        const proc = (0, import_child_process23.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
@@ -24511,7 +24556,7 @@ var GitHubCodespacesProvider = class {
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
     const ok = await new Promise((resolve7) => {
-      const proc = (0, import_child_process22.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
+      const proc = (0, import_child_process23.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
       proc.on("exit", (code) => resolve7(code === 0));
       proc.on("error", () => resolve7(false));
     });
@@ -24538,7 +24583,7 @@ var GitHubCodespacesProvider = class {
     );
     resetStdinForChild();
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process22.spawn)(
+      const proc = (0, import_child_process23.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
@@ -24716,7 +24761,7 @@ var GitHubCodespacesProvider = class {
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
     return new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process22.spawn)(
+      const proc = (0, import_child_process23.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
@@ -24743,11 +24788,11 @@ var GitHubCodespacesProvider = class {
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
     await new Promise((resolve7, reject) => {
-      const tar = (0, import_child_process22.spawn)("tar", tarArgs, {
+      const tar = (0, import_child_process23.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process22.spawn)("gh", sshArgs, {
+      const ssh = (0, import_child_process23.spawn)("gh", sshArgs, {
         stdio: [tar.stdout, "pipe", "pipe"]
       });
       let tarErr = "";
@@ -24781,7 +24826,7 @@ var GitHubCodespacesProvider = class {
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process22.spawn)(
+      const proc = (0, import_child_process23.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -24839,11 +24884,11 @@ function shellQuote(s) {
 }
 
 // src/services/providers/gitpod.ts
-var import_child_process23 = require("child_process");
+var import_child_process24 = require("child_process");
 var import_util5 = require("util");
 var path50 = __toESM(require("path"));
 var import_picocolors9 = __toESM(require("picocolors"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process23.execFile);
+var execFileP6 = (0, import_util5.promisify)(import_child_process24.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -24883,7 +24928,7 @@ var GitpodProvider = class {
     );
     resetStdinForChild2();
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process23.spawn)("gitpod", ["login"], { stdio: "inherit" });
+      const proc = (0, import_child_process24.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
         if (code === 0) resolve7();
         else reject(new Error("gitpod login failed."));
@@ -25035,7 +25080,7 @@ var GitpodProvider = class {
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
     return new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process23.spawn)(
+      const proc = (0, import_child_process24.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
@@ -25055,11 +25100,11 @@ var GitpodProvider = class {
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
     await new Promise((resolve7, reject) => {
-      const tar = (0, import_child_process23.spawn)("tar", tarArgs, {
+      const tar = (0, import_child_process24.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process23.spawn)(
+      const ssh = (0, import_child_process24.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -25091,7 +25136,7 @@ var GitpodProvider = class {
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process23.spawn)(
+      const proc = (0, import_child_process24.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -25115,10 +25160,10 @@ function shellQuote2(s) {
 }
 
 // src/services/providers/gitlab-workspaces.ts
-var import_child_process24 = require("child_process");
+var import_child_process25 = require("child_process");
 var import_util6 = require("util");
 var path51 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process24.execFile);
+var execFileP7 = (0, import_util6.promisify)(import_child_process25.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -25160,7 +25205,7 @@ var GitLabWorkspacesProvider = class {
     );
     resetStdinForChild3();
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process24.spawn)(
+      const proc = (0, import_child_process25.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
@@ -25332,7 +25377,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
     return new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process24.spawn)(
+      const proc = (0, import_child_process25.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
@@ -25353,8 +25398,8 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
     await new Promise((resolve7, reject) => {
-      const tar = (0, import_child_process24.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const ssh = (0, import_child_process24.spawn)(
+      const tar = (0, import_child_process25.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const ssh = (0, import_child_process25.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -25384,7 +25429,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process24.spawn)(
+      const proc = (0, import_child_process25.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -25443,10 +25488,10 @@ function shellQuote3(s) {
 }
 
 // src/services/providers/railway.ts
-var import_child_process25 = require("child_process");
+var import_child_process26 = require("child_process");
 var import_util7 = require("util");
 var path52 = __toESM(require("path"));
-var execFileP8 = (0, import_util7.promisify)(import_child_process25.execFile);
+var execFileP8 = (0, import_util7.promisify)(import_child_process26.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -25487,7 +25532,7 @@ var RailwayProvider = class {
     );
     resetStdinForChild4();
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process25.spawn)("railway", ["login"], { stdio: "inherit" });
+      const proc = (0, import_child_process26.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
         if (code === 0) resolve7();
         else reject(new Error("railway login failed."));
@@ -25630,7 +25675,7 @@ var RailwayProvider = class {
     }
     resetStdinForChild4();
     return new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process25.spawn)(
+      const proc = (0, import_child_process26.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
@@ -25654,8 +25699,8 @@ var RailwayProvider = class {
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
     await new Promise((resolve7, reject) => {
-      const tar = (0, import_child_process25.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const sh = (0, import_child_process25.spawn)(
+      const tar = (0, import_child_process26.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const sh = (0, import_child_process26.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -25688,7 +25733,7 @@ var RailwayProvider = class {
     }
     const cmd = parts.join(" && ");
     await new Promise((resolve7, reject) => {
-      const proc = (0, import_child_process25.spawn)(
+      const proc = (0, import_child_process26.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -26863,6 +26908,10 @@ var HostAgentSupervisor = class {
       }
       const home = process.env.HOME || os36.homedir();
       childEnv.PATH = `${home}/.local/bin:${process.env.PATH ?? ""}`;
+      if (payload.previewTunnelToken && payload.previewHostname) {
+        childEnv.PREVIEW_TUNNEL_TOKEN = payload.previewTunnelToken;
+        childEnv.PREVIEW_TUNNEL_HOSTNAME = payload.previewHostname;
+      }
       report("spawning", "starting agent");
       const proc = this.spawnChild(childEnv, cwd, extraArgs);
       const child = { deployId: payload.deployId, proc };
@@ -27191,16 +27240,16 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.38" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.40" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
-  const [dns2, health] = await Promise.all([
+  const [dns, health] = await Promise.all([
     checkDns(apiBase2),
     checkHealth(apiBase2)
   ]);
   const checks = [
-    dns2,
+    dns,
     health,
     checkConfigDir(),
     checkSessions(),
@@ -27390,7 +27439,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.38" : "unknown";
+  const v = true ? "2.39.40" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27676,7 +27725,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.38" : null;
+  const current = true ? "2.39.40" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.38",
+  "version": "2.39.40",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",