codeam-cli 2.39.43 → 2.39.45

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.44] — 2026-06-19
+
+### Fixed
+
+- **cli:** Surface untracked new files with real line counts in changeset
+
+## [2.39.43] — 2026-06-19
+
+### Fixed
+
+- **cli:** Extract macOS cloudflared .tgz + self-heal gzip-corrupt cache
+
 ## [2.39.42] — 2026-06-19
 
 ### Added

package/dist/index.js

@@ -498,7 +498,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.43",
+  version: "2.39.45",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5908,7 +5908,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.43" : "0.0.0-dev",
+    cliVersion: true ? "2.39.45" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -16173,9 +16173,11 @@ async function link(args2 = []) {
     return;
   }
   const pluginId = (0, import_node_crypto6.randomUUID)();
+  const pollSecret = (0, import_node_crypto6.randomBytes)(32).toString("base64url");
+  const pluginSecretHash = (0, import_node_crypto6.createHash)("sha256").update(pollSecret).digest("hex");
   const spin = dist_exports.spinner();
   spin.start("Requesting pairing code...");
-  const pairing = await requestCode(pluginId);
+  const pairing = await requestCode(pluginId, pluginSecretHash);
   if (!pairing.ok) {
     spin.stop("Failed");
     if (pairing.reason === "rate-limited") {
@@ -16219,15 +16221,30 @@ async function link(args2 = []) {
         clearInterval(countdown);
         waitSpin.stop("Timed out");
         reject(new Error("Pairing timed out after 5 minutes. Run codeam link again."));
-      }
+      },
+      // SEC: replay the PoP secret so the pending-stream gate passes
+      // under PoP enforcement.
+      pollSecret
     );
     process.once("SIGINT", sigint);
   });
-  if (!paired.pluginAuthToken) {
-    showError(
-      "Backend did not return a pluginAuthToken \u2014 upgrade api-v2 (deploy includes the link endpoint)."
-    );
-    process.exit(1);
+  let pluginAuthToken = paired.pluginAuthToken;
+  if (!pluginAuthToken) {
+    const fetchSpin = dist_exports.spinner();
+    fetchSpin.start("Fetching plugin auth token via secure reconnect...");
+    pluginAuthToken = await fetchCurrentPluginAuthToken(
+      paired.sessionId,
+      pluginId,
+      pollSecret
+    ) ?? void 0;
+    if (!pluginAuthToken) {
+      fetchSpin.stop("Failed");
+      showError(
+        "Could not obtain a pluginAuthToken \u2014 the pairing did not supply one and the /api/pairing/reconnect fallback also failed. Ensure api-v2 is deployed and try running codeam link again."
+      );
+      process.exit(1);
+    }
+    fetchSpin.stop("Token retrieved");
   }
   addSession({
     id: paired.sessionId,
@@ -16236,12 +16253,15 @@ async function link(args2 = []) {
     userEmail: paired.userEmail,
     plan: paired.plan,
     pairedAt: Date.now(),
-    pluginAuthToken: paired.pluginAuthToken,
+    pluginAuthToken,
+    // SEC: persist so command-relay and future reconnects can prove
+    // possession on the gated endpoint.
+    pollSecret,
     agent: ctx.runtime.id
   });
   saveCliConfig({ ...loadCliConfig(), preferredAgent: ctx.runtime.id });
   if (parsed.apiKey) {
-    await uploadAndSucceed(ctx, paired, pluginId, {
+    await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, {
       method: "api_key",
       credential: parsed.apiKey.trim(),
       source: "manual"
@@ -16254,7 +16274,7 @@ async function link(args2 = []) {
       showError(`--token-file ${parsed.tokenFile} is empty.`);
       process.exit(1);
     }
-    await uploadAndSucceed(ctx, paired, pluginId, {
+    await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, {
       method: "oauth",
       credential,
       source: "manual"
@@ -16272,9 +16292,9 @@ async function link(args2 = []) {
   installSpin.stop(`${ctx.displayName} is installed`);
   const existing = await ctx.locator.extract();
   if (existing) {
-    if (await refuseIfStale(ctx, paired, pluginId, existing)) return;
+    if (await refuseIfStale(ctx, paired, pluginId, pluginAuthToken, existing)) return;
     showInfo(`Found existing ${ctx.displayName} credentials at ${import_picocolors2.default.bold(existing.source)}.`);
-    await uploadAndSucceed(ctx, paired, pluginId, existing);
+    await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, existing);
     return;
   }
   if (parsed.reuseExisting) {
@@ -16289,23 +16309,21 @@ async function link(args2 = []) {
   console.log("");
   const captured = await captureFreshCredentials(ctx);
   console.log("");
-  if (await refuseIfStale(ctx, paired, pluginId, captured)) return;
-  await uploadAndSucceed(ctx, paired, pluginId, captured);
+  if (await refuseIfStale(ctx, paired, pluginId, pluginAuthToken, captured)) return;
+  await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, captured);
 }
-async function refuseIfStale(ctx, paired, pluginId, token) {
+async function refuseIfStale(ctx, paired, pluginId, pluginAuthToken, token) {
   const verdict = ctx.locator.validate?.(token);
   if (!verdict || verdict.status !== "expired") return false;
   const reason = verdict.reason ?? "Token expired";
-  if (paired.pluginAuthToken) {
-    await postLinkErrorSignal({
-      agentId: ctx.locator.publicId,
-      sessionId: paired.sessionId,
-      pluginId,
-      pluginAuthToken: paired.pluginAuthToken,
-      code: "credentials_expired",
-      reason
-    });
-  }
+  await postLinkErrorSignal({
+    agentId: ctx.locator.publicId,
+    sessionId: paired.sessionId,
+    pluginId,
+    pluginAuthToken,
+    code: "credentials_expired",
+    reason
+  });
   showError(
     `Your local ${ctx.displayName} credentials at ${import_picocolors2.default.bold(ctx.locator.hint)} are already expired:
    ${reason}
@@ -16394,18 +16412,14 @@ async function captureFreshCredentials(ctx) {
     throw err;
   }
 }
-async function uploadAndSucceed(ctx, paired, pluginId, token) {
-  if (!paired.pluginAuthToken) {
-    showError("Missing pluginAuthToken; re-run codeam link.");
-    process.exit(1);
-  }
+async function uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, token) {
   const uploadSpin = dist_exports.spinner();
   uploadSpin.start("Sealing credential in your vault...");
   const result = await postLinkCredential({
     agentId: ctx.locator.publicId,
     sessionId: paired.sessionId,
     pluginId,
-    pluginAuthToken: paired.pluginAuthToken,
+    pluginAuthToken,
     method: token.method,
     credential: token.credential,
     agentState: token.agentState
@@ -20253,6 +20267,7 @@ var import_crypto4 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process21 = require("child_process");
+var fs37 = __toESM(require("fs/promises"));
 var path44 = __toESM(require("path"));
 async function collectRepoChangeset(opts) {
   const status2 = await runGit3(opts.repoRoot, ["status", "--porcelain=v1", "-z"]);
@@ -20267,7 +20282,16 @@ async function collectRepoChangeset(opts) {
   const entries = [];
   for (const row of parseStatus(status2)) {
     if (isIgnoredFilePath(row.filePath)) continue;
-    const stats = numstat.get(row.filePath) ?? { added: 0, removed: 0 };
+    const numstatEntry = numstat.get(row.filePath);
+    let stats;
+    if (row.fileStatus === "added" && numstatEntry === void 0) {
+      const lineCount = await readUntrackedLineCount(
+        path44.join(opts.repoRoot, row.filePath)
+      );
+      stats = { added: lineCount, removed: 0 };
+    } else {
+      stats = numstatEntry ?? { added: 0, removed: 0 };
+    }
     entries.push({
       filePath: row.filePath,
       fileStatus: row.fileStatus,
@@ -20284,6 +20308,27 @@ async function collectRepoChangeset(opts) {
   }
   return entries;
 }
+var MAX_UNTRACKED_LINE_SCAN = 1e5;
+var _readUntrackedLineCountImpl = {
+  read: defaultReadUntrackedLineCount
+};
+function readUntrackedLineCount(absPath) {
+  return _readUntrackedLineCountImpl.read(absPath);
+}
+async function defaultReadUntrackedLineCount(absPath) {
+  try {
+    const content = await fs37.readFile(absPath, "utf8");
+    let count = 0;
+    let pos = -1;
+    while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
+      count += 1;
+      if (count >= MAX_UNTRACKED_LINE_SCAN) return count;
+    }
+    return content.length > 0 ? Math.max(count, 1) : 0;
+  } catch {
+    return 0;
+  }
+}
 function parseStatus(raw) {
   const tokens = raw.split("\0");
   const rows = [];
@@ -20364,7 +20409,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs46 = await import("fs/promises");
+  const fs47 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -20372,7 +20417,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs46.readdir(dir, { withFileTypes: true });
+      const dirents = await fs47.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -20398,7 +20443,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs37 = __toESM(require("fs/promises"));
+var fs38 = __toESM(require("fs/promises"));
 var path45 = __toESM(require("path"));
 var import_os7 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
@@ -20440,8 +20485,8 @@ var FilesOutbox = class {
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs37.mkdir(path45.dirname(this.filePath), { recursive: true });
-    await fs37.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs38.mkdir(path45.dirname(this.filePath), { recursive: true });
+    await fs38.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -20530,7 +20575,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs37.readFile(this.filePath, "utf8");
+      raw = await fs38.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -20554,12 +20599,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs37.unlink(this.filePath).catch(() => void 0);
+      await fs38.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs37.writeFile(tmpPath, payload, "utf8");
-    await fs37.rename(tmpPath, this.filePath);
+    await fs38.writeFile(tmpPath, payload, "utf8");
+    await fs38.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -22457,7 +22502,7 @@ var OutputService = class _OutputService {
 };
 
 // src/services/history.service.ts
-var fs38 = __toESM(require("fs"));
+var fs39 = __toESM(require("fs"));
 var path46 = __toESM(require("path"));
 var os30 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
@@ -22486,7 +22531,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs38.readFileSync(filePath, "utf8");
+    raw = fs39.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -22676,9 +22721,9 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs38.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs39.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs38.statSync(path46.join(dir, e.name));
+          const stat3 = fs39.statSync(path46.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
@@ -22719,13 +22764,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs38.readdirSync(dir, { withFileTypes: true });
+      entries = fs39.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs38.statSync(path46.join(dir, e.name));
+        const stat3 = fs39.statSync(path46.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -22739,7 +22784,7 @@ var HistoryService = class _HistoryService {
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs38.readFileSync(filePath, "utf8");
+      raw = fs39.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -22784,9 +22829,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs38.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs39.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs38.statSync(path46.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs39.statSync(path46.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -22797,7 +22842,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs38.readFileSync(path46.join(projectDir, file), "utf8");
+        raw = fs39.readFileSync(path46.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -23388,7 +23433,7 @@ function buildKeepAlive(ctx) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs39 = __toESM(require("fs"));
+var fs40 = __toESM(require("fs"));
 var os31 = __toESM(require("os"));
 var path47 = __toESM(require("path"));
 function ensureClaudeOnboarded() {
@@ -23396,7 +23441,7 @@ function ensureClaudeOnboarded() {
     const file = path47.join(os31.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs39.readFileSync(file, "utf8"));
+      config = JSON.parse(fs40.readFileSync(file, "utf8"));
     } catch {
     }
     if (config.hasCompletedOnboarding === true && typeof config.theme === "string") {
@@ -23407,8 +23452,8 @@ function ensureClaudeOnboarded() {
     if (typeof config.lastOnboardingVersion !== "string") {
       config.lastOnboardingVersion = "2.1.177";
     }
-    fs39.mkdirSync(path47.dirname(file), { recursive: true });
-    fs39.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs40.mkdirSync(path47.dirname(file), { recursive: true });
+    fs40.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info("claude", "pre-completed Claude onboarding (skip first-run theme picker)");
   } catch (err) {
     log.warn("claude", `ensureClaudeOnboarded failed (non-fatal): ${err.message}`);
@@ -23899,7 +23944,7 @@ async function autoLinkAfterPair(opts) {
 }
 
 // src/commands/pair-auto.ts
-var fs40 = __toESM(require("fs"));
+var fs41 = __toESM(require("fs"));
 var os32 = __toESM(require("os"));
 var path48 = __toESM(require("path"));
 var import_crypto7 = require("crypto");
@@ -24098,10 +24143,10 @@ function readTokenFromArgs(args2) {
   if (fileFlag) {
     const path58 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs40.readFileSync(path58, "utf8").trim();
+      const content = fs41.readFileSync(path58, "utf8").trim();
       if (content.length === 0) fail(`--token-file ${path58} is empty`);
       try {
-        fs40.unlinkSync(path58);
+        fs41.unlinkSync(path58);
       } catch {
       }
       return content;
@@ -24198,7 +24243,7 @@ function isLivePairAuto(pid) {
     if (e.code !== "EPERM") return false;
   }
   try {
-    return fs40.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
+    return fs41.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
   } catch {
     return true;
   }
@@ -24206,19 +24251,19 @@ function isLivePairAuto(pid) {
 function acquireSingletonLock() {
   const lockPath = pairAutoLockPath();
   try {
-    fs40.mkdirSync(path48.dirname(lockPath), { recursive: true });
+    fs41.mkdirSync(path48.dirname(lockPath), { recursive: true });
     try {
-      fs40.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+      fs41.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      const holder = Number(fs40.readFileSync(lockPath, "utf8").trim());
+      const holder = Number(fs41.readFileSync(lockPath, "utf8").trim());
       if (isLivePairAuto(holder)) return false;
-      fs40.writeFileSync(lockPath, String(process.pid));
+      fs41.writeFileSync(lockPath, String(process.pid));
     }
     process.once("exit", () => {
       try {
-        if (fs40.existsSync(lockPath) && Number(fs40.readFileSync(lockPath, "utf8").trim()) === process.pid) {
-          fs40.unlinkSync(lockPath);
+        if (fs41.existsSync(lockPath) && Number(fs41.readFileSync(lockPath, "utf8").trim()) === process.pid) {
+          fs41.unlinkSync(lockPath);
         }
       } catch {
       }
@@ -26360,7 +26405,7 @@ async function stopWorkspaceFromLocal(target) {
 }
 
 // src/commands/host/host-client.ts
-var fs41 = __toESM(require("fs"));
+var fs42 = __toESM(require("fs"));
 var os33 = __toESM(require("os"));
 var path53 = __toESM(require("path"));
 function sampleCpuTimes() {
@@ -26421,7 +26466,7 @@ function collectOsInfo() {
 }
 function loadHostIdentity() {
   try {
-    const raw = fs41.readFileSync(hostIdentityPath(), "utf8");
+    const raw = fs42.readFileSync(hostIdentityPath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
       const p2 = parsed;
@@ -26434,12 +26479,12 @@ function loadHostIdentity() {
 }
 function saveHostIdentity(identity) {
   const file = hostIdentityPath();
-  fs41.mkdirSync(path53.dirname(file), { recursive: true, mode: 448 });
-  fs41.writeFileSync(file, JSON.stringify(identity, null, 2), {
+  fs42.mkdirSync(path53.dirname(file), { recursive: true, mode: 448 });
+  fs42.writeFileSync(file, JSON.stringify(identity, null, 2), {
     encoding: "utf8",
     mode: 384
   });
-  fs41.chmodSync(file, 384);
+  fs42.chmodSync(file, 384);
 }
 var HostHttpError = class extends Error {
   constructor(message, status2) {
@@ -26462,7 +26507,7 @@ function isHostAuthRejection(err) {
 }
 function deleteHostIdentity() {
   try {
-    fs41.rmSync(hostIdentityPath(), { force: true });
+    fs42.rmSync(hostIdentityPath(), { force: true });
   } catch {
   }
 }
@@ -26626,7 +26671,7 @@ var import_node_child_process13 = require("child_process");
 var os36 = __toESM(require("os"));
 
 // src/commands/host/workspace.ts
-var fs42 = __toESM(require("fs"));
+var fs43 = __toESM(require("fs"));
 var os34 = __toESM(require("os"));
 var path54 = __toESM(require("path"));
 var import_node_child_process12 = require("child_process");
@@ -26679,16 +26724,16 @@ function maskToken(text, cloneToken) {
 }
 async function prepareWorkspace(repoOrPath, deployId, cloneToken) {
   if (isAbsolutePathTarget(repoOrPath)) {
-    if (!fs42.existsSync(repoOrPath)) {
+    if (!fs43.existsSync(repoOrPath)) {
       throw new Error(`deploy target path does not exist: ${repoOrPath}`);
     }
     return repoOrPath;
   }
   const dest = path54.join(selfHostedWorkspaceRoot(), deployId);
-  if (fs42.existsSync(path54.join(dest, ".git"))) {
+  if (fs43.existsSync(path54.join(dest, ".git"))) {
     return dest;
   }
-  fs42.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
+  fs43.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
   const cloneUrl = repoCloneUrl(repoOrPath, cloneToken);
   try {
     await execFileP9("git", ["clone", "--depth", "1", cloneUrl, dest], {
@@ -26704,7 +26749,7 @@ async function prepareWorkspace(repoOrPath, deployId, cloneToken) {
 }
 
 // src/commands/host/agent-provisioning.ts
-var fs43 = __toESM(require("fs"));
+var fs44 = __toESM(require("fs"));
 var os35 = __toESM(require("os"));
 var path55 = __toESM(require("path"));
 var PUBLIC_TO_INTERNAL_AGENT = {
@@ -26721,12 +26766,12 @@ function toInternalAgentId(publicAgentId) {
   return PUBLIC_TO_INTERNAL_AGENT[publicAgentId] ?? null;
 }
 function ensureDir(dir) {
-  fs43.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs44.mkdirSync(dir, { recursive: true, mode: 448 });
 }
 function writeFile0600(filePath, contents) {
   ensureDir(path55.dirname(filePath));
-  fs43.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
-  fs43.chmodSync(filePath, 384);
+  fs44.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
+  fs44.chmodSync(filePath, 384);
 }
 var claudeProvisioner = {
   write(auth, home) {
@@ -26735,7 +26780,7 @@ var claudeProvisioner = {
     }
     writeFile0600(path55.join(home, ".claude", ".credentials.json"), auth.value);
     const claudeJson = path55.join(home, ".claude.json");
-    if (!fs43.existsSync(claudeJson)) {
+    if (!fs44.existsSync(claudeJson)) {
       writeFile0600(
         claudeJson,
         JSON.stringify({ hasCompletedOnboarding: true, customApiKeyResponses: { approved: [] } })
@@ -27165,7 +27210,7 @@ async function hostAgent(args2 = []) {
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto8 = require("crypto");
-var fs44 = __toESM(require("fs"));
+var fs45 = __toESM(require("fs"));
 var path56 = __toESM(require("path"));
 var import_picocolors12 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
@@ -27224,11 +27269,11 @@ async function checkHealth(apiBase2) {
 function checkConfigDir() {
   const dir = path56.join(require("os").homedir(), ".codeam");
   try {
-    fs44.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs45.mkdirSync(dir, { recursive: true, mode: 448 });
     const probe = path56.join(dir, ".doctor-probe");
-    fs44.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs44.readFileSync(probe, "utf8");
-    fs44.unlinkSync(probe);
+    fs45.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs45.readFileSync(probe, "utf8");
+    fs45.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -27334,7 +27379,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.43" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.45" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -27533,7 +27578,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.43" : "unknown";
+  const v = true ? "2.39.45" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -27661,7 +27706,7 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/lib/updateNotifier.ts
-var fs45 = __toESM(require("fs"));
+var fs46 = __toESM(require("fs"));
 var os37 = __toESM(require("os"));
 var path57 = __toESM(require("path"));
 var https8 = __toESM(require("https"));
@@ -27677,7 +27722,7 @@ function cachePath() {
 }
 function readCache() {
   try {
-    const raw = fs45.readFileSync(cachePath(), "utf8");
+    const raw = fs46.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -27688,10 +27733,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs45.mkdirSync(path57.dirname(file), { recursive: true });
+    fs46.mkdirSync(path57.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs45.writeFileSync(tmp, JSON.stringify(cache));
-    fs45.renameSync(tmp, file);
+    fs46.writeFileSync(tmp, JSON.stringify(cache));
+    fs46.renameSync(tmp, file);
   } catch {
   }
 }
@@ -27766,7 +27811,7 @@ function isLinkedInstall() {
     }).trim();
     if (!root) return false;
     const pkgPath = path57.join(root, PKG_NAME);
-    return fs45.lstatSync(pkgPath).isSymbolicLink();
+    return fs46.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -27802,7 +27847,7 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs45.unlinkSync(cachePath());
+    fs46.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors16.default.green("\u2713")} Updated. Resuming session...
@@ -27819,7 +27864,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.43" : null;
+  const current = true ? "2.39.45" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.43",
+  "version": "2.39.45",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",