codeam-cli 2.39.87 → 2.40.1

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.40.0] — 2026-06-24
+
+### Added
+
+- **cli:** Add formatAgentReplyLine for the pair full-thread echo
+- **cli:** Echo agent reply in codeam pair so the full thread is visible
+
+### Fixed
+
+- **cli:** Refresh plugin-auth token and retry once on 401/403 output POST
+- **cli:** Wire plugin-auth token refresh into ACP publisher
+- **cli:** Await bounded terminal-frame flush before adapter-exit teardown
+
+### Merge
+
+- Session-hang CLI fix (token self-heal + flush-before-exit) + codeam pair agent-reply echo
+
+## [2.39.87] — 2026-06-23
+
+### Added
+
+- **cli:** Link Claude via setup-token (dedicated non-rotating codespace credential)
+
 ## [2.39.86] — 2026-06-23
 
 ### Fixed

package/dist/index.js

@@ -5390,7 +5390,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.39.87" : "0.0.0-dev",
+    cliVersion: true ? "2.40.1" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5549,7 +5549,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.39.87",
+  version: "2.40.1",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -17749,7 +17749,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.39.87" : null;
+  const current = true ? "2.40.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17766,7 +17766,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.39.87" : null;
+  const current = true ? "2.40.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18204,7 +18204,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process14.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.39.87" : null;
+  return true ? "2.40.1" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -23143,15 +23143,35 @@ var AcpPublisher = class {
   constructor(opts) {
     this.opts = opts;
     this.apiBase = opts.apiBaseUrl ?? resolveApiBaseUrl();
-    this.headers = {
+    this.token = opts.pluginAuthToken;
+  }
+  opts;
+  apiBase;
+  token;
+  authHeaders() {
+    return {
       "Content-Type": "application/json",
       "X-Codeam-Protocol-Version": "2.0.0",
-      "X-Plugin-Auth-Token": opts.pluginAuthToken
+      "X-Plugin-Auth-Token": this.token
     };
   }
-  opts;
-  apiBase;
-  headers;
+  /**
+   * POST with the current plugin-auth token. On a 401/403 the token is
+   * stale (JWT_SECRET rotated on deploy, or the session re-paired);
+   * refresh it via the injected callback and retry ONCE. Any other
+   * status (or a refresh that yields no token) returns the first
+   * response unchanged — callers log non-2xx but never throw.
+   */
+  async postWithReauth(url, payload) {
+    const first = await _transport4.post(url, this.authHeaders(), payload);
+    if (first.statusCode !== 401 && first.statusCode !== 403) return first;
+    if (!this.opts.refreshAuthToken) return first;
+    const fresh = await this.opts.refreshAuthToken();
+    if (!fresh) return first;
+    this.token = fresh;
+    log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+    return _transport4.post(url, this.authHeaders(), payload);
+  }
   /**
    * Wrap the body with `sessionId` + `pluginId` at the top level.
    * The backend's `PluginAuthGuard` reads both fields from the JSON
@@ -23182,16 +23202,11 @@ var AcpPublisher = class {
   async publishOutput(body) {
     const url = `${this.apiBase}/api/commands/output`;
     try {
-      const { statusCode, body: resBody } = await _transport4.post(
-        url,
-        this.headers,
-        this.envelope(body)
-      );
+      const { statusCode, body: resBody } = await this.postWithReauth(url, this.envelope(body));
       if (statusCode < 200 || statusCode >= 300) {
-        const tok = this.opts.pluginAuthToken;
         log.warn(
           "acpPublisher",
-          `output type=${String(body.type)} done=${body.done === true} status=${statusCode} body=${resBody.slice(0, 200)} | sentSessionId=${this.opts.sessionId} sentPluginId=${this.opts.pluginId} tokenLen=${tok.length} tokenHead=${tok.slice(0, 12)} tokenTail=${tok.slice(-8)}`
+          `output type=${String(body.type)} done=${body.done === true} status=${statusCode} body=${resBody.slice(0, 200)} | sentSessionId=${this.opts.sessionId} sentPluginId=${this.opts.pluginId} tokenLen=${this.token.length} tokenHead=${this.token.slice(0, 12)} tokenTail=${this.token.slice(-8)}`
         );
       }
     } catch (err) {
@@ -23210,9 +23225,8 @@ var AcpPublisher = class {
   async publishAwaitingAnswer(event) {
     const url = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/awaiting-answer`;
     try {
-      const { statusCode, body } = await _transport4.post(
+      const { statusCode, body } = await this.postWithReauth(
         url,
-        this.headers,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
@@ -23244,9 +23258,8 @@ var AcpPublisher = class {
   async publishStreamingChunk(event) {
     const url = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/streaming-chunk`;
     try {
-      const { statusCode, body } = await _transport4.post(
+      const { statusCode, body } = await this.postWithReauth(
         url,
-        this.headers,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
@@ -23281,7 +23294,7 @@ var AcpPublisher = class {
       sessions: args2.sessions
     });
     try {
-      const { statusCode, body: resBody } = await _transport4.post(url, this.headers, body);
+      const { statusCode, body: resBody } = await this.postWithReauth(url, body);
       if (statusCode < 200 || statusCode >= 300) {
         log.warn(
           "acpPublisher",
@@ -23316,7 +23329,7 @@ var AcpPublisher = class {
       mode: "replace"
     });
     try {
-      const { statusCode, body: resBody } = await _transport4.post(url, this.headers, body);
+      const { statusCode, body: resBody } = await this.postWithReauth(url, body);
       if (statusCode < 200 || statusCode >= 300) {
         log.warn(
           "acpPublisher",
@@ -23447,6 +23460,7 @@ async function runOnboardingTurn(opts) {
 
 // src/agents/acp/promptEcho.ts
 var MAX_PROMPT_CHARS = 200;
+var MAX_AGENT_REPLY_CHARS = 280;
 function formatPromptEchoLine(payload) {
   const rawText = (payload.prompt ?? "").replace(/\s+/g, " ").trim();
   const imageCount = (payload.files ?? []).filter(
@@ -23463,6 +23477,12 @@ function formatPromptEchoLine(payload) {
   }
   return `\u203A ${parts.join(" ")}`;
 }
+function formatAgentReplyLine(text) {
+  const collapsed = (text ?? "").replace(/\s+/g, " ").trim();
+  if (collapsed.length === 0) return "";
+  const truncated = collapsed.length > MAX_AGENT_REPLY_CHARS ? collapsed.slice(0, MAX_AGENT_REPLY_CHARS) + "\u2026" : collapsed;
+  return `\u2039 Agent: ${truncated}`;
+}
 
 // src/agents/acp/mappers.ts
 var import_node_crypto6 = require("crypto");
@@ -24174,6 +24194,32 @@ function baselineKey(entry) {
   return `${entry.repoPath}|${entry.filePath}`;
 }
 
+// src/agents/acp/withTimeout.ts
+function withTimeout(p2, ms) {
+  return new Promise((resolve7) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      resolve7(void 0);
+    }, ms);
+    p2.then(
+      (v) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve7(v);
+      },
+      () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve7(void 0);
+      }
+    );
+  });
+}
+
 // src/agents/acp/runner.ts
 var StreamingState = class {
   constructor(publisher) {
@@ -24577,18 +24623,28 @@ function failureBubble(opts) {
   return null;
 }
 async function reportCredentialInvalid(opts, fetchImpl = fetch) {
+  const url = `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`;
+  const body = JSON.stringify({ sessionId: opts.sessionId, pluginId: opts.pluginId });
   try {
-    await fetchImpl(
-      `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-Plugin-Auth-Token": opts.pluginAuthToken
-        },
-        body: JSON.stringify({ sessionId: opts.sessionId, pluginId: opts.pluginId })
+    const makeHeaders = (token) => ({
+      "Content-Type": "application/json",
+      "X-Plugin-Auth-Token": token
+    });
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers: makeHeaders(opts.pluginAuthToken),
+      body
+    });
+    if (response.status === 401 || response.status === 403) {
+      const freshToken = await fetchCurrentPluginAuthToken(
+        opts.sessionId,
+        opts.pluginId,
+        opts.pollSecret
+      );
+      if (freshToken !== null) {
+        await fetchImpl(url, { method: "POST", headers: makeHeaders(freshToken), body });
       }
-    );
+    }
   } catch {
   }
 }
@@ -24608,7 +24664,8 @@ async function runAcpSession(opts) {
   const publisher = new AcpPublisher({
     sessionId: opts.sessionId,
     pluginId: opts.pluginId,
-    pluginAuthToken: opts.pluginAuthToken
+    pluginAuthToken: opts.pluginAuthToken,
+    refreshAuthToken: () => fetchCurrentPluginAuthToken(opts.sessionId, opts.pluginId, opts.pollSecret)
   });
   const streaming = new StreamingState(publisher);
   const recentStderr = [];
@@ -24682,14 +24739,20 @@ async function runAcpSession(opts) {
       if (authFail) {
         void reportCredentialInvalid(opts);
       }
-      void streaming.closeAll().then(
-        () => publisher.publishOutput({
-          type: "text",
-          content: authFail ? AUTH_FAILURE_MESSAGE : `Agent adapter exited unexpectedly (code=${code ?? "null"} signal=${signal ?? "null"}).`,
-          done: true
-        })
-      );
-      process.exit(1);
+      void (async () => {
+        await withTimeout(
+          (async () => {
+            await streaming.closeAll();
+            await publisher.publishOutput({
+              type: "text",
+              content: authFail ? AUTH_FAILURE_MESSAGE : `Agent adapter exited unexpectedly (code=${code ?? "null"} signal=${signal ?? "null"}).`,
+              done: true
+            });
+          })(),
+          5e3
+        );
+        process.exit(1);
+      })();
     }
   });
   showInfo(`Starting ${opts.agent} via ACP adapter (${opts.adapter.requiresAgentBinary})\u2026`);
@@ -24851,6 +24914,10 @@ async function handleCommand(cmd, client2, relay, acpSessionId, models, streamin
         const reply = await client2.prompt(blocks);
         const finalText = streaming.getCurrentText();
         await streaming.closeTurnWithInteractiveDetection();
+        const replyLine = formatAgentReplyLine(finalText);
+        if (replyLine.length > 0) {
+          showInfo(replyLine);
+        }
         history.appendAgentReply(finalText);
         void history.flush();
         turnFiles.flushTurn().catch((err) => {
@@ -26353,6 +26420,7 @@ async function start(requestedAgent) {
       adapter,
       cwd,
       getBeads,
+      pollSecret: session.pollSecret,
       // AUTO mode for headless, mobile-driven sessions: no human at the box
       // to answer permission prompts, so auto-approve them rather than stall
       // the turn (the agent-agnostic equivalent of
@@ -29024,7 +29092,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.39.87" : "0.0.0-dev";
+  const cliVersion = true ? "2.40.1" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -29223,7 +29291,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors14 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.39.87" : "unknown";
+  const v = true ? "2.40.1" : "unknown";
   console.log(`${import_picocolors14.default.bold("codeam-cli")} ${import_picocolors14.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.39.87",
+  "version": "2.40.1",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",