codeam-cli 2.39.86 → 2.40.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.39.87] — 2026-06-23
+
+### Added
+
+- **cli:** Link Claude via setup-token (dedicated non-rotating codespace credential)
+
+## [2.39.86] — 2026-06-23
+
+### Fixed
+
+- **cli:** Report credential-invalid on mid-turn auth 401, not just adapter exit
+
+### Tests
+
+- **cli:** Reproduce-first guard for self-hosted house-agent 401
+
 ## [2.39.85] — 2026-06-23
 
 ### Fixed

package/dist/index.js

@@ -5390,7 +5390,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.86" : "0.0.0-dev",
+    cliVersion: true ? "2.40.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5549,7 +5549,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.86",
+  version: "2.40.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -11230,6 +11230,37 @@ function claudeCredentialLocator() {
     validate: validateClaudeToken
   };
 }
+var SETUP_TOKEN_RE = /sk-ant-oat01-[A-Za-z0-9_-]+/;
+function extractSetupTokenFromOutput(output) {
+  const m = output.match(SETUP_TOKEN_RE);
+  return m ? m[0] : null;
+}
+function captureClaudeSetupToken() {
+  return new Promise((resolve7, reject) => {
+    const child = (0, import_node_child_process2.spawn)("claude", ["setup-token"], {
+      stdio: ["inherit", "pipe", "inherit"]
+    });
+    let out2 = "";
+    child.stdout?.on("data", (chunk) => {
+      const s = chunk.toString("utf8");
+      out2 += s;
+      process.stdout.write(s);
+    });
+    child.on("error", (err) => reject(err));
+    child.on("exit", (code) => {
+      const token = extractSetupTokenFromOutput(out2);
+      if (token) {
+        resolve7({ method: "setup_token", credential: token, source: "setup-token" });
+        return;
+      }
+      reject(
+        new Error(
+          `\`claude setup-token\` exited (code=${code ?? "null"}) without producing a token. Complete the browser authorization and paste the code when prompted, then re-run.`
+        )
+      );
+    });
+  });
+}
 function claudeLoginLauncher() {
   return {
     ensureInstalled: ensureClaudeInstalled,
@@ -11237,7 +11268,11 @@ function claudeLoginLauncher() {
       const child = (0, import_node_child_process2.spawn)("claude", [], { stdio: ["pipe", "inherit", "inherit"] });
       child.stdin?.write("/login\n");
       return child;
-    }
+    },
+    // Preferred path for Claude: a dedicated non-rotating setup-token,
+    // so the codespace credential never shares a refresh chain with the
+    // user's laptop session.
+    captureSetupToken: captureClaudeSetupToken
   };
 }
 
@@ -13448,6 +13483,16 @@ async function link(args2 = []) {
     process.exit(1);
   }
   installSpin.stop(`${ctx.displayName} is installed`);
+  if (ctx.launcher.captureSetupToken && !parsed.reuseExisting) {
+    showInfo(
+      `Creating a dedicated ${ctx.displayName} token for your codespaces \u2014 complete the sign-in in your browser and paste the code when prompted.`
+    );
+    console.log("");
+    const setupToken = await ctx.launcher.captureSetupToken();
+    console.log("");
+    await uploadAndSucceed(ctx, paired, pluginId, pluginAuthToken, setupToken);
+    return;
+  }
   const existing = await ctx.locator.extract();
   if (existing) {
     if (await refuseIfStale(ctx, paired, pluginId, pluginAuthToken, existing)) return;
@@ -17704,7 +17749,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.39.86" : null;
+  const current = true ? "2.40.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17721,7 +17766,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.86" : null;
+  const current = true ? "2.40.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18159,7 +18204,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process14.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.39.86" : null;
+  return true ? "2.40.0" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -23098,15 +23143,35 @@ var AcpPublisher = class {
   constructor(opts) {
     this.opts = opts;
     this.apiBase = opts.apiBaseUrl ?? resolveApiBaseUrl();
-    this.headers = {
+    this.token = opts.pluginAuthToken;
+  }
+  opts;
+  apiBase;
+  token;
+  authHeaders() {
+    return {
       "Content-Type": "application/json",
       "X-Codeam-Protocol-Version": "2.0.0",
-      "X-Plugin-Auth-Token": opts.pluginAuthToken
+      "X-Plugin-Auth-Token": this.token
     };
   }
-  opts;
-  apiBase;
-  headers;
+  /**
+   * POST with the current plugin-auth token. On a 401/403 the token is
+   * stale (JWT_SECRET rotated on deploy, or the session re-paired);
+   * refresh it via the injected callback and retry ONCE. Any other
+   * status (or a refresh that yields no token) returns the first
+   * response unchanged — callers log non-2xx but never throw.
+   */
+  async postWithReauth(url, payload) {
+    const first = await _transport4.post(url, this.authHeaders(), payload);
+    if (first.statusCode !== 401 && first.statusCode !== 403) return first;
+    if (!this.opts.refreshAuthToken) return first;
+    const fresh = await this.opts.refreshAuthToken();
+    if (!fresh) return first;
+    this.token = fresh;
+    log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+    return _transport4.post(url, this.authHeaders(), payload);
+  }
   /**
    * Wrap the body with `sessionId` + `pluginId` at the top level.
    * The backend's `PluginAuthGuard` reads both fields from the JSON
@@ -23137,16 +23202,11 @@ var AcpPublisher = class {
   async publishOutput(body) {
     const url = `${this.apiBase}/api/commands/output`;
     try {
-      const { statusCode, body: resBody } = await _transport4.post(
-        url,
-        this.headers,
-        this.envelope(body)
-      );
+      const { statusCode, body: resBody } = await this.postWithReauth(url, this.envelope(body));
       if (statusCode < 200 || statusCode >= 300) {
-        const tok = this.opts.pluginAuthToken;
         log.warn(
           "acpPublisher",
-          `output type=${String(body.type)} done=${body.done === true} status=${statusCode} body=${resBody.slice(0, 200)} | sentSessionId=${this.opts.sessionId} sentPluginId=${this.opts.pluginId} tokenLen=${tok.length} tokenHead=${tok.slice(0, 12)} tokenTail=${tok.slice(-8)}`
+          `output type=${String(body.type)} done=${body.done === true} status=${statusCode} body=${resBody.slice(0, 200)} | sentSessionId=${this.opts.sessionId} sentPluginId=${this.opts.pluginId} tokenLen=${this.token.length} tokenHead=${this.token.slice(0, 12)} tokenTail=${this.token.slice(-8)}`
         );
       }
     } catch (err) {
@@ -23165,9 +23225,8 @@ var AcpPublisher = class {
   async publishAwaitingAnswer(event) {
     const url = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/awaiting-answer`;
     try {
-      const { statusCode, body } = await _transport4.post(
+      const { statusCode, body } = await this.postWithReauth(
         url,
-        this.headers,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
@@ -23199,9 +23258,8 @@ var AcpPublisher = class {
   async publishStreamingChunk(event) {
     const url = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/streaming-chunk`;
     try {
-      const { statusCode, body } = await _transport4.post(
+      const { statusCode, body } = await this.postWithReauth(
         url,
-        this.headers,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
@@ -23236,7 +23294,7 @@ var AcpPublisher = class {
       sessions: args2.sessions
     });
     try {
-      const { statusCode, body: resBody } = await _transport4.post(url, this.headers, body);
+      const { statusCode, body: resBody } = await this.postWithReauth(url, body);
       if (statusCode < 200 || statusCode >= 300) {
         log.warn(
           "acpPublisher",
@@ -23271,7 +23329,7 @@ var AcpPublisher = class {
       mode: "replace"
     });
     try {
-      const { statusCode, body: resBody } = await _transport4.post(url, this.headers, body);
+      const { statusCode, body: resBody } = await this.postWithReauth(url, body);
       if (statusCode < 200 || statusCode >= 300) {
         log.warn(
           "acpPublisher",
@@ -23402,6 +23460,7 @@ async function runOnboardingTurn(opts) {
 
 // src/agents/acp/promptEcho.ts
 var MAX_PROMPT_CHARS = 200;
+var MAX_AGENT_REPLY_CHARS = 280;
 function formatPromptEchoLine(payload) {
   const rawText = (payload.prompt ?? "").replace(/\s+/g, " ").trim();
   const imageCount = (payload.files ?? []).filter(
@@ -23418,6 +23477,12 @@ function formatPromptEchoLine(payload) {
   }
   return `\u203A ${parts.join(" ")}`;
 }
+function formatAgentReplyLine(text) {
+  const collapsed = (text ?? "").replace(/\s+/g, " ").trim();
+  if (collapsed.length === 0) return "";
+  const truncated = collapsed.length > MAX_AGENT_REPLY_CHARS ? collapsed.slice(0, MAX_AGENT_REPLY_CHARS) + "\u2026" : collapsed;
+  return `\u2039 Agent: ${truncated}`;
+}
 
 // src/agents/acp/mappers.ts
 var import_node_crypto6 = require("crypto");
@@ -24129,6 +24194,32 @@ function baselineKey(entry) {
   return `${entry.repoPath}|${entry.filePath}`;
 }
 
+// src/agents/acp/withTimeout.ts
+function withTimeout(p2, ms) {
+  return new Promise((resolve7) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      resolve7(void 0);
+    }, ms);
+    p2.then(
+      (v) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve7(v);
+      },
+      () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve7(void 0);
+      }
+    );
+  });
+}
+
 // src/agents/acp/runner.ts
 var StreamingState = class {
   constructor(publisher) {
@@ -24563,7 +24654,8 @@ async function runAcpSession(opts) {
   const publisher = new AcpPublisher({
     sessionId: opts.sessionId,
     pluginId: opts.pluginId,
-    pluginAuthToken: opts.pluginAuthToken
+    pluginAuthToken: opts.pluginAuthToken,
+    refreshAuthToken: () => fetchCurrentPluginAuthToken(opts.sessionId, opts.pluginId, opts.pollSecret)
   });
   const streaming = new StreamingState(publisher);
   const recentStderr = [];
@@ -24637,14 +24729,20 @@ async function runAcpSession(opts) {
       if (authFail) {
         void reportCredentialInvalid(opts);
       }
-      void streaming.closeAll().then(
-        () => publisher.publishOutput({
-          type: "text",
-          content: authFail ? AUTH_FAILURE_MESSAGE : `Agent adapter exited unexpectedly (code=${code ?? "null"} signal=${signal ?? "null"}).`,
-          done: true
-        })
-      );
-      process.exit(1);
+      void (async () => {
+        await withTimeout(
+          (async () => {
+            await streaming.closeAll();
+            await publisher.publishOutput({
+              type: "text",
+              content: authFail ? AUTH_FAILURE_MESSAGE : `Agent adapter exited unexpectedly (code=${code ?? "null"} signal=${signal ?? "null"}).`,
+              done: true
+            });
+          })(),
+          5e3
+        );
+        process.exit(1);
+      })();
     }
   });
   showInfo(`Starting ${opts.agent} via ACP adapter (${opts.adapter.requiresAgentBinary})\u2026`);
@@ -24806,6 +24904,10 @@ async function handleCommand(cmd, client2, relay, acpSessionId, models, streamin
         const reply = await client2.prompt(blocks);
         const finalText = streaming.getCurrentText();
         await streaming.closeTurnWithInteractiveDetection();
+        const replyLine = formatAgentReplyLine(finalText);
+        if (replyLine.length > 0) {
+          showInfo(replyLine);
+        }
         history.appendAgentReply(finalText);
         void history.flush();
         turnFiles.flushTurn().catch((err) => {
@@ -26308,6 +26410,7 @@ async function start(requestedAgent) {
       adapter,
       cwd,
       getBeads,
+      pollSecret: session.pollSecret,
       // AUTO mode for headless, mobile-driven sessions: no human at the box
       // to answer permission prompts, so auto-approve them rather than stall
       // the turn (the agent-agnostic equivalent of
@@ -28979,7 +29082,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.86" : "0.0.0-dev";
+  const cliVersion = true ? "2.40.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -29178,7 +29281,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors14 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.86" : "unknown";
+  const v = true ? "2.40.0" : "unknown";
   console.log(`${import_picocolors14.default.bold("codeam-cli")} ${import_picocolors14.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.86",
+  "version": "2.40.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",