codeam-cli 2.39.85 → 2.39.87

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.86] — 2026-06-23
+
+### Fixed
+
+- **cli:** Report credential-invalid on mid-turn auth 401, not just adapter exit
+
+### Tests
+
+- **cli:** Reproduce-first guard for self-hosted house-agent 401
+
+## [2.39.85] — 2026-06-23
+
+### Fixed
+
+- **cli:** Isolate house agent's Claude config on self-hosted boxes
+
 ## [2.39.84] — 2026-06-22
 
 ### Added

package/dist/index.js

@@ -5390,7 +5390,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.85" : "0.0.0-dev",
+    cliVersion: true ? "2.39.87" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5549,7 +5549,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.85",
+  version: "2.39.87",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -11230,6 +11230,37 @@ function claudeCredentialLocator() {
     validate: validateClaudeToken
   };
 }
+var SETUP_TOKEN_RE = /sk-ant-oat01-[A-Za-z0-9_-]+/;
+function extractSetupTokenFromOutput(output) {
+  const m = output.match(SETUP_TOKEN_RE);
+  return m ? m[0] : null;
+}
+function captureClaudeSetupToken() {
+  return new Promise((resolve7, reject) => {
+    const child = (0, import_node_child_process2.spawn)("claude", ["setup-token"], {
+      stdio: ["inherit", "pipe", "inherit"]
+    });
+    let out2 = "";
+    child.stdout?.on("data", (chunk) => {
+      const s = chunk.toString("utf8");
+      out2 += s;
+      process.stdout.write(s);
+    });
+    child.on("error", (err) => reject(err));
+    child.on("exit", (code) => {
+      const token = extractSetupTokenFromOutput(out2);
+      if (token) {
+        resolve7({ method: "setup_token", credential: token, source: "setup-token" });
+        return;
+      }
+      reject(
+        new Error(
+          `\`claude setup-token\` exited (code=${code ?? "null"}) without producing a token. Complete the browser authorization and paste the code when prompted, then re-run.`
+        )
+      );
+    });
+  });
+}
 function claudeLoginLauncher() {
   return {
     ensureInstalled: ensureClaudeInstalled,
@@ -11237,7 +11268,11 @@ function claudeLoginLauncher() {
       const child = (0, import_node_child_process2.spawn)("claude", [], { stdio: ["pipe", "inherit", "inherit"] });
       child.stdin?.write("/login\n");
       return child;
-    }
+    },
+    // Preferred path for Claude: a dedicated non-rotating setup-token,
+    // so the codespace credential never shares a refresh chain with the
+    // user's laptop session.
+    captureSetupToken: captureClaudeSetupToken
   };
 }
 
@@ -13448,6 +13483,16 @@ async function link(args2 = []) {
     process.exit(1);
   }
   installSpin.stop(`${ctx.displayName} is installed`);
+  if (ctx.launcher.captureSetupToken && !parsed.reuseExisting) {
+    showInfo(
+      `Creating a dedicated ${ctx.displayName} token for your codespaces \u2014 complete the sign-in in your browser and paste the code when prompted.`
+    );
+    console.log("");
+    const setupToken = await ctx.launcher.captureSetupToken();
+    console.log("");
+    await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, setupToken);
+    return;
+  }
   const existing = await ctx.locator.extract();
   if (existing) {
     if (await refuseIfStale(ctx, paired, pluginId, pluginAuthToken, existing)) return;
@@ -17704,7 +17749,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.39.85" : null;
+  const current = true ? "2.39.87" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17721,7 +17766,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.85" : null;
+  const current = true ? "2.39.87" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18159,7 +18204,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process14.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.39.85" : null;
+  return true ? "2.39.87" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -24531,6 +24576,22 @@ function failureBubble(opts) {
   if (!opts.hadText) return TURN_FAILURE_MESSAGE;
   return null;
 }
+async function reportCredentialInvalid(opts, fetchImpl = fetch) {
+  try {
+    await fetchImpl(
+      `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-Plugin-Auth-Token": opts.pluginAuthToken
+        },
+        body: JSON.stringify({ sessionId: opts.sessionId, pluginId: opts.pluginId })
+      }
+    );
+  } catch {
+  }
+}
 async function handleGetConversation(args2) {
   const { relay, commandId, jsonlHistory, acpSessionId } = args2;
   try {
@@ -24619,17 +24680,7 @@ async function runAcpSession(opts) {
       log.warn("acpRunner", `adapter died code=${code} signal=${signal}; shutting down session`);
       const authFail = looksLikeAuthFailure(recentStderr.join("\n"));
       if (authFail) {
-        void fetch(
-          `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`,
-          {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "X-Plugin-Auth-Token": opts.pluginAuthToken
-            },
-            body: JSON.stringify({ sessionId: opts.sessionId, pluginId: opts.pluginId })
-          }
-        ).catch(() => void 0);
+        void reportCredentialInvalid(opts);
       }
       void streaming.closeAll().then(
         () => publisher.publishOutput({
@@ -24822,6 +24873,9 @@ async function handleCommand(cmd, client2, relay, acpSessionId, models, streamin
           history.appendAgentReply(bubble);
           void history.flush();
         }
+        if (bubble === AUTH_FAILURE_MESSAGE) {
+          void reportCredentialInvalid(opts);
+        }
         await relay.sendResult(cmd.id, "failed", { error: detail });
       }
       return;
@@ -28970,7 +29024,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.85" : "0.0.0-dev";
+  const cliVersion = true ? "2.39.87" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -29169,7 +29223,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors14 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.85" : "unknown";
+  const v = true ? "2.39.87" : "unknown";
   console.log(`${import_picocolors14.default.bold("codeam-cli")} ${import_picocolors14.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.85",
+  "version": "2.39.87",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",