codeam-cli 2.4.23 → 2.4.25

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.24] — 2026-05-03
+
+### Added
+
+- **cli:** List repos from user's orgs after expand-scopes (v2.4.24)
+
+## [2.4.23] — 2026-05-03
+
+### Fixed
+
+- **cli:** Shutdown_session also runs gh codespace stop (v2.4.23)
+
+## [2.4.22] — 2026-05-03
+
+### Added
+
+- **cli:** "+ Don't see your project?" expands gh OAuth scopes (v2.4.22)
+
 ## [2.4.21] — 2026-05-03
 
 ### Fixed

package/dist/index.js

@@ -179,7 +179,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.4.23",
+  version: "2.4.25",
   description: "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands \u2014 from anywhere.",
   main: "dist/index.js",
   bin: {
@@ -5148,12 +5148,12 @@ async function logout() {
 }
 
 // src/commands/deploy.ts
-var import_child_process6 = require("child_process");
+var import_child_process9 = require("child_process");
 var fs8 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
-var path9 = __toESM(require("path"));
-var import_util3 = require("util");
-var import_picocolors8 = __toESM(require("picocolors"));
+var path12 = __toESM(require("path"));
+var import_util6 = require("util");
+var import_picocolors9 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
 var import_child_process5 = require("child_process");
@@ -5430,20 +5430,43 @@ var GitHubCodespacesProvider = class {
     });
   }
   async listProjects() {
-    const { stdout } = await execFileP2(
-      "gh",
-      [
-        "repo",
-        "list",
+    const fetchRepos = async (owner) => {
+      const args2 = ["repo", "list"];
+      if (owner) args2.push(owner);
+      args2.push(
         "--json",
         "name,nameWithOwner,description,defaultBranchRef,isPrivate",
         "--limit",
         "200"
-      ],
-      { maxBuffer: MAX_BUFFER }
-    );
-    const raw = JSON.parse(stdout);
-    return raw.map((r) => ({
+      );
+      try {
+        const { stdout } = await execFileP2("gh", args2, { maxBuffer: MAX_BUFFER });
+        return JSON.parse(stdout);
+      } catch {
+        return [];
+      }
+    };
+    const own = await fetchRepos();
+    let orgRepos = [];
+    try {
+      const { stdout } = await execFileP2(
+        "gh",
+        ["api", "--paginate", "user/orgs", "--jq", ".[].login"],
+        { maxBuffer: MAX_BUFFER }
+      );
+      const orgLogins = stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+      const perOrg = await Promise.all(orgLogins.map((org) => fetchRepos(org)));
+      orgRepos = perOrg.flat();
+    } catch {
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const merged = [];
+    for (const r of [...own, ...orgRepos]) {
+      if (seen.has(r.nameWithOwner)) continue;
+      seen.add(r.nameWithOwner);
+      merged.push(r);
+    }
+    return merged.map((r) => ({
       id: r.nameWithOwner,
       name: r.name,
       fullName: r.nameWithOwner,
@@ -5692,20 +5715,892 @@ function shellQuote(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 
+// src/services/providers/gitpod.ts
+var import_child_process6 = require("child_process");
+var import_util3 = require("util");
+var path9 = __toESM(require("path"));
+var import_picocolors8 = __toESM(require("picocolors"));
+var execFileP3 = (0, import_util3.promisify)(import_child_process6.execFile);
+var MAX_BUFFER2 = 8 * 1024 * 1024;
+function resetStdinForChild2() {
+  if (process.stdin.isTTY) {
+    try {
+      process.stdin.setRawMode(false);
+    } catch {
+    }
+  }
+}
+var GitpodProvider = class {
+  id = "gitpod";
+  displayName = "Gitpod";
+  tagline = "Cloud dev environments from any Git repo";
+  available = true;
+  async authorize() {
+    try {
+      await execFileP3("gitpod", ["--version"], { maxBuffer: MAX_BUFFER2 });
+    } catch {
+      throw new Error(
+        [
+          "Gitpod CLI (`gitpod`) is required for Gitpod deploys.",
+          "Install it with one of:",
+          "  \u2022 macOS:  brew install gitpod-io/tap/gitpod",
+          "  \u2022 Other:  https://github.com/gitpod-io/gitpod-cli#installation",
+          "Then run `gitpod login` and try `codeam deploy` again."
+        ].join("\n")
+      );
+    }
+    try {
+      await execFileP3("gitpod", ["whoami"], { maxBuffer: MAX_BUFFER2 });
+      return;
+    } catch {
+    }
+    wt(
+      "A login URL will print below. Open it in your browser and approve.",
+      "Authenticating Gitpod"
+    );
+    resetStdinForChild2();
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process6.spawn)("gitpod", ["login"], { stdio: "inherit" });
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error("gitpod login failed."));
+      });
+      proc.on("error", reject);
+    });
+  }
+  async listProjects() {
+    try {
+      const { stdout } = await execFileP3(
+        "gitpod",
+        ["workspace", "list", "--output", "json", "--limit", "200"],
+        { maxBuffer: MAX_BUFFER2 }
+      );
+      const list = JSON.parse(stdout);
+      const seen = /* @__PURE__ */ new Set();
+      const projects = [];
+      for (const w3 of list) {
+        const url = w3.contextUrl ?? "";
+        if (!url || seen.has(url)) continue;
+        seen.add(url);
+        const m = url.match(/^https?:\/\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/.+)?$/);
+        if (!m) continue;
+        const fullName = `${m[2]}/${m[3]}`;
+        projects.push({
+          id: url,
+          // Gitpod indexes workspaces by URL
+          name: m[3],
+          fullName,
+          description: w3.description,
+          private: false
+          // Gitpod doesn't expose visibility here
+        });
+      }
+      return projects;
+    } catch {
+      return [];
+    }
+  }
+  async createWorkspace(projectId, machineTypeId) {
+    const args2 = ["workspace", "create", projectId, "--start", "--output", "json"];
+    if (machineTypeId) args2.push("--class", machineTypeId);
+    const { stdout } = await execFileP3("gitpod", args2, {
+      maxBuffer: MAX_BUFFER2,
+      timeout: 3e5
+    });
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout);
+    } catch {
+      parsed = { id: stdout.trim() };
+    }
+    if (!parsed.id) {
+      throw new Error("Gitpod did not return a workspace id.");
+    }
+    await this.waitUntilRunning(parsed.id);
+    return {
+      id: parsed.id,
+      displayName: parsed.id,
+      webUrl: parsed.url ?? `https://gitpod.io/start/#${parsed.id}`
+    };
+  }
+  async waitUntilRunning(workspaceId) {
+    const deadline = Date.now() + 5 * 60 * 1e3;
+    while (Date.now() < deadline) {
+      try {
+        const { stdout } = await execFileP3(
+          "gitpod",
+          ["workspace", "get", workspaceId, "--output", "json"],
+          { maxBuffer: MAX_BUFFER2 }
+        );
+        const status2 = JSON.parse(stdout).status?.toLowerCase() ?? "";
+        if (status2 === "running" || status2 === "available") return;
+        if (status2 === "failed" || status2 === "stopped") {
+          throw new Error(`Gitpod workspace state: ${status2}.`);
+        }
+      } catch {
+      }
+      await new Promise((r) => setTimeout(r, 3e3));
+    }
+    throw new Error("Gitpod workspace did not become Running within 5 minutes.");
+  }
+  async listMachineTypes(_projectId) {
+    try {
+      const { stdout } = await execFileP3(
+        "gitpod",
+        ["organization", "list-classes", "--output", "json"],
+        { maxBuffer: MAX_BUFFER2 }
+      );
+      const list = JSON.parse(stdout);
+      return list.map((c2) => ({
+        id: c2.id,
+        label: c2.displayName ?? c2.id,
+        memoryGb: 8
+      }));
+    } catch {
+      return [];
+    }
+  }
+  async listExistingWorkspaces(projectId) {
+    try {
+      const args2 = ["workspace", "list", "--output", "json", "--limit", "200"];
+      const { stdout } = await execFileP3("gitpod", args2, { maxBuffer: MAX_BUFFER2 });
+      const list = JSON.parse(stdout);
+      return list.filter((w3) => !projectId || w3.contextUrl === projectId).map((w3) => ({
+        id: w3.id,
+        displayName: w3.id,
+        webUrl: `https://gitpod.io/start/#${w3.id}`,
+        state: w3.status ?? "Unknown",
+        lastUsedAt: w3.lastActivity
+      }));
+    } catch {
+      return [];
+    }
+  }
+  async startWorkspace(workspaceId) {
+    try {
+      await execFileP3(
+        "gitpod",
+        ["workspace", "start", workspaceId],
+        { maxBuffer: MAX_BUFFER2, timeout: 6e4 }
+      );
+    } catch {
+    }
+    await this.waitUntilRunning(workspaceId);
+    return {
+      id: workspaceId,
+      displayName: workspaceId,
+      webUrl: `https://gitpod.io/start/#${workspaceId}`
+    };
+  }
+  async exec(workspaceId, command2) {
+    try {
+      const { stdout, stderr } = await execFileP3(
+        "gitpod",
+        ["workspace", "ssh", workspaceId, "--", command2],
+        { maxBuffer: MAX_BUFFER2, timeout: 6e5 }
+      );
+      return { stdout, stderr, code: 0 };
+    } catch (err) {
+      const e = err;
+      return {
+        stdout: e.stdout ?? "",
+        stderr: e.stderr ?? e.message ?? "gitpod workspace ssh failed",
+        code: typeof e.code === "number" ? e.code : 1
+      };
+    }
+  }
+  async streamCommand(workspaceId, command2) {
+    resetStdinForChild2();
+    return new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process6.spawn)(
+        "gitpod",
+        ["workspace", "ssh", workspaceId, "--", "-tt", command2],
+        { stdio: "inherit" }
+      );
+      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("error", reject);
+    });
+  }
+  async uploadDirectory(workspaceId, localDir, remoteDir, options = {}) {
+    const tarArgs = ["-czf", "-", "-C", localDir];
+    for (const pattern of options.exclude ?? []) {
+      tarArgs.push(`--exclude=${pattern}`);
+      const stripped = pattern.replace(/^\.\/+/, "");
+      if (stripped !== pattern) tarArgs.push(`--exclude=${stripped}`);
+    }
+    tarArgs.push(".");
+    const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
+    const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
+    await new Promise((resolve2, reject) => {
+      const tar = (0, import_child_process6.spawn)("tar", tarArgs, {
+        stdio: ["ignore", "pipe", "pipe"],
+        env: tarEnv
+      });
+      const ssh = (0, import_child_process6.spawn)(
+        "gitpod",
+        ["workspace", "ssh", workspaceId, "--", remoteCmd],
+        { stdio: [tar.stdout, "pipe", "pipe"] }
+      );
+      let tarErr = "";
+      let sshErr = "";
+      tar.stderr?.on("data", (d3) => {
+        tarErr += d3.toString();
+      });
+      ssh.stderr?.on("data", (d3) => {
+        sshErr += d3.toString();
+      });
+      tar.on("error", reject);
+      ssh.on("error", reject);
+      ssh.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+    });
+  }
+  async uploadFile(workspaceId, remotePath, contents, options = {}) {
+    const remoteDir = path9.posix.dirname(remotePath);
+    const parts = [
+      `mkdir -p ${shellQuote2(remoteDir)}`,
+      `cat > ${shellQuote2(remotePath)}`
+    ];
+    if (options.mode != null) {
+      parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
+    }
+    const cmd = parts.join(" && ");
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process6.spawn)(
+        "gitpod",
+        ["workspace", "ssh", workspaceId, "--", cmd],
+        { stdio: ["pipe", "pipe", "pipe"] }
+      );
+      let stderr = "";
+      proc.stderr?.on("data", (d3) => {
+        stderr += d3.toString();
+      });
+      proc.on("error", reject);
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+      proc.stdin?.write(contents);
+      proc.stdin?.end();
+    });
+  }
+};
+function shellQuote2(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/services/providers/gitlab-workspaces.ts
+var import_child_process7 = require("child_process");
+var import_util4 = require("util");
+var path10 = __toESM(require("path"));
+var execFileP4 = (0, import_util4.promisify)(import_child_process7.execFile);
+var MAX_BUFFER3 = 8 * 1024 * 1024;
+var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
+function resetStdinForChild3() {
+  if (process.stdin.isTTY) {
+    try {
+      process.stdin.setRawMode(false);
+    } catch {
+    }
+  }
+}
+var GitLabWorkspacesProvider = class {
+  id = "gitlab-workspaces";
+  displayName = "GitLab Workspaces";
+  tagline = "Self-hosted dev environments on your K8s cluster";
+  available = true;
+  async authorize() {
+    try {
+      await execFileP4("glab", ["--version"], { maxBuffer: MAX_BUFFER3 });
+    } catch {
+      throw new Error(
+        [
+          "GitLab CLI (`glab`) is required for GitLab Workspaces deploys.",
+          "Install it with one of:",
+          "  \u2022 macOS:  brew install glab",
+          "  \u2022 Linux:  https://gitlab.com/gitlab-org/cli#installation",
+          "  \u2022 Windows: winget install GitLab.glab",
+          "Then run `glab auth login` and try `codeam deploy` again."
+        ].join("\n")
+      );
+    }
+    try {
+      await execFileP4("glab", ["auth", "status"], { maxBuffer: MAX_BUFFER3 });
+      return;
+    } catch {
+    }
+    wt(
+      "A token / OAuth flow will open below. After approval the deploy resumes.",
+      "Authenticating GitLab"
+    );
+    resetStdinForChild3();
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process7.spawn)(
+        "glab",
+        ["auth", "login", "--scopes", "api,read_user,read_repository"],
+        { stdio: "inherit" }
+      );
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error("glab auth login failed."));
+      });
+      proc.on("error", reject);
+    });
+  }
+  async listProjects() {
+    try {
+      const { stdout } = await execFileP4(
+        "glab",
+        ["repo", "list", "--per-page", "200", "--output", "json"],
+        { maxBuffer: MAX_BUFFER3 }
+      );
+      const list = JSON.parse(stdout);
+      return list.filter((r) => r.path_with_namespace).map((r) => ({
+        id: r.path_with_namespace,
+        name: r.name ?? r.path_with_namespace,
+        fullName: r.path_with_namespace,
+        description: r.description ?? void 0,
+        defaultBranch: r.default_branch,
+        private: r.visibility !== "public"
+      }));
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * GitLab.com's machine sizes are tied to whatever the agent's
+   * K8s cluster offers — this is project / agent specific and the
+   * GraphQL API doesn't enumerate "available classes" today. We
+   * return an empty list, which makes the orchestrator skip the
+   * picker. Users with multiple sizes wired to their agent should
+   * change the default in their devfile.yaml.
+   */
+  async listMachineTypes(_projectId) {
+    return [];
+  }
+  async createWorkspace(projectId, _machineTypeId) {
+    const token = await this.getGlabToken();
+    if (!token) {
+      throw new Error(
+        "Could not extract GitLab token from `glab`. Run `glab auth login` and retry."
+      );
+    }
+    const projectFullPath = projectId;
+    const mutation = `mutation Create($p: WorkspaceCreateInput!) {
+      workspaceCreate(input: $p) {
+        workspace { id name desiredState actualState url }
+        errors
+      }
+    }`;
+    const body = JSON.stringify({
+      query: mutation,
+      variables: {
+        p: {
+          projectId: `gid://gitlab/Project/${projectFullPath}`,
+          editor: "webide",
+          desiredState: "RUNNING",
+          // The devfile MUST exist in the repo at .devfile.yaml.
+          devfilePath: ".devfile.yaml"
+        }
+      }
+    });
+    const data = await this.gql(token, body);
+    const ws = data.data?.workspaceCreate?.workspace;
+    const errs = data.data?.workspaceCreate?.errors ?? data.errors?.map((e) => e.message ?? "") ?? [];
+    if (!ws?.id || errs.length > 0) {
+      throw new Error(
+        `GitLab Workspaces createWorkspace failed: ${errs.join("; ") || "no workspace returned"}.
+Common causes: project has no .devfile.yaml; no agent registered; user lacks permission.
+Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
+      );
+    }
+    await this.waitUntilRunning(token, ws.id);
+    return {
+      id: ws.id,
+      displayName: ws.name ?? ws.id,
+      webUrl: ws.url
+    };
+  }
+  async waitUntilRunning(token, workspaceId) {
+    const deadline = Date.now() + 5 * 60 * 1e3;
+    const query = `query Get($id: WorkspaceID!) {
+      workspace(id: $id) { actualState }
+    }`;
+    while (Date.now() < deadline) {
+      try {
+        const data = await this.gql(
+          token,
+          JSON.stringify({ query, variables: { id: workspaceId } })
+        );
+        const state = data.data?.workspace?.actualState?.toUpperCase() ?? "";
+        if (state === "RUNNING") return;
+        if (state === "FAILED" || state === "STOPPED") {
+          throw new Error(`Workspace state: ${state}.`);
+        }
+      } catch {
+      }
+      await new Promise((r) => setTimeout(r, 4e3));
+    }
+    throw new Error("GitLab workspace did not become Running within 5 minutes.");
+  }
+  async listExistingWorkspaces(_projectId) {
+    const token = await this.getGlabToken();
+    if (!token) return [];
+    const query = `query { currentUser { workspaces { nodes {
+      id name actualState url updatedAt
+    } } } }`;
+    try {
+      const data = await this.gql(token, JSON.stringify({ query }));
+      const nodes = data.data?.currentUser?.workspaces?.nodes ?? [];
+      return nodes.map((n) => ({
+        id: n.id,
+        displayName: n.name ?? n.id,
+        webUrl: n.url,
+        state: n.actualState,
+        lastUsedAt: n.updatedAt
+      }));
+    } catch {
+      return [];
+    }
+  }
+  async startWorkspace(workspaceId) {
+    const token = await this.getGlabToken();
+    if (!token) throw new Error("Not authenticated with GitLab.");
+    const mutation = `mutation Start($id: WorkspaceID!) {
+      workspaceUpdate(input: { id: $id, desiredState: RUNNING }) {
+        workspace { id name url } errors
+      }
+    }`;
+    await this.gql(
+      token,
+      JSON.stringify({ query: mutation, variables: { id: workspaceId } })
+    );
+    await this.waitUntilRunning(token, workspaceId);
+    return { id: workspaceId, displayName: workspaceId };
+  }
+  async exec(workspaceId, command2) {
+    const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
+    try {
+      const { stdout, stderr } = await execFileP4(
+        "ssh",
+        [
+          "-o",
+          "StrictHostKeyChecking=accept-new",
+          "-o",
+          "BatchMode=yes",
+          `${workspaceId}@${sshHost}`,
+          command2
+        ],
+        { maxBuffer: MAX_BUFFER3, timeout: 6e5 }
+      );
+      return { stdout, stderr, code: 0 };
+    } catch (err) {
+      const e = err;
+      return {
+        stdout: e.stdout ?? "",
+        stderr: e.stderr ?? e.message ?? "ssh to GitLab workspace failed",
+        code: typeof e.code === "number" ? e.code : 1
+      };
+    }
+  }
+  async streamCommand(workspaceId, command2) {
+    const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
+    resetStdinForChild3();
+    return new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process7.spawn)(
+        "ssh",
+        ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
+        { stdio: "inherit" }
+      );
+      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("error", reject);
+    });
+  }
+  async uploadDirectory(workspaceId, localDir, remoteDir, options = {}) {
+    const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
+    const tarArgs = ["-czf", "-", "-C", localDir];
+    for (const pattern of options.exclude ?? []) {
+      tarArgs.push(`--exclude=${pattern}`);
+      const stripped = pattern.replace(/^\.\/+/, "");
+      if (stripped !== pattern) tarArgs.push(`--exclude=${stripped}`);
+    }
+    tarArgs.push(".");
+    const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
+    const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
+    await new Promise((resolve2, reject) => {
+      const tar = (0, import_child_process7.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const ssh = (0, import_child_process7.spawn)(
+        "ssh",
+        ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, remoteCmd],
+        { stdio: [tar.stdout, "pipe", "pipe"] }
+      );
+      let tarErr = "";
+      let sshErr = "";
+      tar.stderr?.on("data", (d3) => {
+        tarErr += d3.toString();
+      });
+      ssh.stderr?.on("data", (d3) => {
+        sshErr += d3.toString();
+      });
+      tar.on("error", reject);
+      ssh.on("error", reject);
+      ssh.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+    });
+  }
+  async uploadFile(workspaceId, remotePath, contents, options = {}) {
+    const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
+    const remoteDir = path10.posix.dirname(remotePath);
+    const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
+    if (options.mode != null) {
+      parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
+    }
+    const cmd = parts.join(" && ");
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process7.spawn)(
+        "ssh",
+        ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
+        { stdio: ["pipe", "pipe", "pipe"] }
+      );
+      let stderr = "";
+      proc.stderr?.on("data", (d3) => {
+        stderr += d3.toString();
+      });
+      proc.on("error", reject);
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+      proc.stdin?.write(contents);
+      proc.stdin?.end();
+    });
+  }
+  /**
+   * Pull the user's `glab` token via `glab auth status -t`, since
+   * `glab` stores it in its own config and we need it to call the
+   * GraphQL API directly.
+   */
+  async getGlabToken() {
+    try {
+      const { stdout, stderr } = await execFileP4(
+        "glab",
+        ["auth", "status", "--show-token"],
+        { maxBuffer: MAX_BUFFER3 }
+      );
+      const haystack = stdout + "\n" + stderr;
+      const m = haystack.match(/Token:\s+(\S+)/);
+      return m?.[1] ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async gql(token, body) {
+    const url = `${GITLAB_API_BASE.replace(/\/$/, "").replace(/\/v4$/, "")}/api/graphql`;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`GitLab GraphQL ${res.status}: ${text.slice(0, 400)}`);
+    }
+    return await res.json();
+  }
+};
+function shellQuote3(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/services/providers/railway.ts
+var import_child_process8 = require("child_process");
+var import_util5 = require("util");
+var path11 = __toESM(require("path"));
+var execFileP5 = (0, import_util5.promisify)(import_child_process8.execFile);
+var MAX_BUFFER4 = 8 * 1024 * 1024;
+function resetStdinForChild4() {
+  if (process.stdin.isTTY) {
+    try {
+      process.stdin.setRawMode(false);
+    } catch {
+    }
+  }
+}
+var RailwayProvider = class {
+  id = "railway";
+  displayName = "Railway";
+  tagline = "Always-on container \u2014 no IDE, just an agent terminal";
+  available = true;
+  async authorize() {
+    try {
+      await execFileP5("railway", ["--version"], { maxBuffer: MAX_BUFFER4 });
+    } catch {
+      throw new Error(
+        [
+          "Railway CLI (`railway`) is required for Railway deploys.",
+          "Install it with one of:",
+          "  \u2022 npm:    npm install -g @railway/cli",
+          "  \u2022 macOS:  brew install railway",
+          "  \u2022 Linux:  https://docs.railway.app/develop/cli#install",
+          "Then run `railway login` and try `codeam deploy` again."
+        ].join("\n")
+      );
+    }
+    try {
+      await execFileP5("railway", ["whoami"], { maxBuffer: MAX_BUFFER4 });
+      return;
+    } catch {
+    }
+    wt(
+      "A login URL prints below. Open it in your browser and approve.",
+      "Authenticating Railway"
+    );
+    resetStdinForChild4();
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process8.spawn)("railway", ["login"], { stdio: "inherit" });
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error("railway login failed."));
+      });
+      proc.on("error", reject);
+    });
+  }
+  async listProjects() {
+    try {
+      const { stdout } = await execFileP5(
+        "railway",
+        ["list", "--json"],
+        { maxBuffer: MAX_BUFFER4 }
+      );
+      const list = JSON.parse(stdout);
+      return list.filter((r) => r.id && r.name).map((r) => ({
+        id: r.id,
+        name: r.name,
+        fullName: r.name,
+        description: r.description ?? void 0,
+        private: true
+        // Railway projects are private by default
+      }));
+    } catch {
+      try {
+        const { stdout } = await execFileP5("railway", ["list"], { maxBuffer: MAX_BUFFER4 });
+        const projects = [];
+        for (const line of stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed || trimmed.startsWith("Project")) continue;
+          const idMatch = trimmed.match(/id:\s*(\S+)/);
+          const nameMatch = trimmed.match(/name:\s*([^|]+)/);
+          if (idMatch && nameMatch) {
+            const name = nameMatch[1].trim();
+            projects.push({
+              id: idMatch[1],
+              name,
+              fullName: name,
+              private: true
+            });
+          }
+        }
+        return projects;
+      } catch {
+        return [];
+      }
+    }
+  }
+  /**
+   * Railway exposes resource sizes (CPU / RAM) at the SERVICE level,
+   * not the project level — and only on paid plans. The CLI has no
+   * `list-classes` equivalent today. Returning empty makes the
+   * orchestrator skip the picker; users on paid plans can resize
+   * a service from the Railway dashboard after deploy.
+   */
+  async listMachineTypes(_projectId) {
+    return [];
+  }
+  async createWorkspace(_projectId, _machineTypeId) {
+    wt(
+      [
+        "Railway service auto-creation from `codeam deploy` isn't implemented yet.",
+        "Workaround for now:",
+        "  1. From your repo:  railway link  (pick this project)",
+        "  2. Run:             railway up --detach",
+        "  3. Re-run codeam deploy and pick the existing service."
+      ].join("\n"),
+      "Heads up \u2014 manual step needed"
+    );
+    throw new Error(
+      "Railway provider needs an existing service to attach to. See the note above."
+    );
+  }
+  async listExistingWorkspaces(projectId) {
+    if (!projectId) return [];
+    try {
+      const { stdout } = await execFileP5(
+        "railway",
+        ["service", "list", "--project", projectId, "--json"],
+        { maxBuffer: MAX_BUFFER4 }
+      );
+      const list = JSON.parse(stdout);
+      return list.filter((s) => s.id && s.name).map((s) => {
+        const latest = s.deployments?.[0];
+        return {
+          id: `${projectId}/${s.id}`,
+          displayName: s.name,
+          state: latest?.status ?? "Unknown",
+          lastUsedAt: latest?.updatedAt
+        };
+      });
+    } catch {
+      return [];
+    }
+  }
+  async startWorkspace(workspaceId) {
+    const [projectId, serviceId] = workspaceId.split("/");
+    if (!projectId || !serviceId) {
+      throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
+    }
+    try {
+      await execFileP5(
+        "railway",
+        ["service", "restart", "--service", serviceId, "--project", projectId],
+        { maxBuffer: MAX_BUFFER4, timeout: 6e4 }
+      );
+    } catch {
+    }
+    return { id: workspaceId, displayName: serviceId };
+  }
+  async exec(workspaceId, command2) {
+    const [projectId, serviceId] = workspaceId.split("/");
+    if (!projectId || !serviceId) {
+      return {
+        stdout: "",
+        stderr: "Invalid Railway workspace id (expected projectId/serviceId).",
+        code: 1
+      };
+    }
+    try {
+      const { stdout, stderr } = await execFileP5(
+        "railway",
+        ["run", "--project", projectId, "--service", serviceId, "--", "bash", "-lc", command2],
+        { maxBuffer: MAX_BUFFER4, timeout: 6e5 }
+      );
+      return { stdout, stderr, code: 0 };
+    } catch (err) {
+      const e = err;
+      return {
+        stdout: e.stdout ?? "",
+        stderr: e.stderr ?? e.message ?? "railway run failed",
+        code: typeof e.code === "number" ? e.code : 1
+      };
+    }
+  }
+  async streamCommand(workspaceId, command2) {
+    const [projectId, serviceId] = workspaceId.split("/");
+    if (!projectId || !serviceId) {
+      throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
+    }
+    resetStdinForChild4();
+    return new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process8.spawn)(
+        "railway",
+        ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
+        { stdio: "inherit" }
+      );
+      proc.on("exit", (code) => resolve2({ code: code ?? 0 }));
+      proc.on("error", reject);
+    });
+  }
+  async uploadDirectory(workspaceId, localDir, remoteDir, options = {}) {
+    const [projectId, serviceId] = workspaceId.split("/");
+    if (!projectId || !serviceId) {
+      throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
+    }
+    const tarArgs = ["-czf", "-", "-C", localDir];
+    for (const pattern of options.exclude ?? []) {
+      tarArgs.push(`--exclude=${pattern}`);
+      const stripped = pattern.replace(/^\.\/+/, "");
+      if (stripped !== pattern) tarArgs.push(`--exclude=${stripped}`);
+    }
+    tarArgs.push(".");
+    const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
+    const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
+    await new Promise((resolve2, reject) => {
+      const tar = (0, import_child_process8.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const sh = (0, import_child_process8.spawn)(
+        "railway",
+        ["shell", "--project", projectId, "--service", serviceId, "--command", remoteCmd],
+        { stdio: [tar.stdout, "pipe", "pipe"] }
+      );
+      let tarErr = "";
+      let shErr = "";
+      tar.stderr?.on("data", (d3) => {
+        tarErr += d3.toString();
+      });
+      sh.stderr?.on("data", (d3) => {
+        shErr += d3.toString();
+      });
+      tar.on("error", reject);
+      sh.on("error", reject);
+      sh.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+    });
+  }
+  async uploadFile(workspaceId, remotePath, contents, options = {}) {
+    const [projectId, serviceId] = workspaceId.split("/");
+    if (!projectId || !serviceId) {
+      throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
+    }
+    const remoteDir = path11.posix.dirname(remotePath);
+    const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
+    if (options.mode != null) {
+      parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
+    }
+    const cmd = parts.join(" && ");
+    await new Promise((resolve2, reject) => {
+      const proc = (0, import_child_process8.spawn)(
+        "railway",
+        ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
+        { stdio: ["pipe", "pipe", "pipe"] }
+      );
+      let stderr = "";
+      proc.stderr?.on("data", (d3) => {
+        stderr += d3.toString();
+      });
+      proc.on("error", reject);
+      proc.on("exit", (code) => {
+        if (code === 0) resolve2();
+        else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
+      });
+      proc.stdin?.write(contents);
+      proc.stdin?.end();
+    });
+  }
+};
+function shellQuote4(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/services/providers/index.ts
 var PROVIDERS = [
-  new GitHubCodespacesProvider()
-  // Sketches for future providers — uncomment + implement when ready.
-  // new GitpodProvider(),
-  // new CoderProvider(),
-  // new GitLabWebIDEProvider(),
+  new GitHubCodespacesProvider(),
+  new GitpodProvider(),
+  new GitLabWorkspacesProvider(),
+  new RailwayProvider()
 ];
 
 // src/commands/deploy.ts
-var execFileP3 = (0, import_util3.promisify)(import_child_process6.execFile);
+var execFileP6 = (0, import_util6.promisify)(import_child_process9.execFile);
 async function deploy() {
   console.log();
-  mt(import_picocolors8.default.bgMagenta(import_picocolors8.default.white(" codeam deploy ")));
+  mt(import_picocolors9.default.bgMagenta(import_picocolors9.default.white(" codeam deploy ")));
   const provider = await pickProvider();
   if (!provider) {
     pt("No provider selected.");
@@ -5742,7 +6637,7 @@ async function deploy() {
     if (provider.expandListScopes) {
       options.push({
         value: EXPAND_SCOPES,
-        label: import_picocolors8.default.cyan("+ Don't see your project? Expand scopes\u2026"),
+        label: import_picocolors9.default.cyan("+ Don't see your project? Expand scopes\u2026"),
         hint: "Re-authorize with broader scopes (org / team repos)"
       });
     }
@@ -5790,7 +6685,7 @@ async function deploy() {
             label: w3.displayName ?? w3.id,
             hint: [w3.state, formatLastUsed(w3.lastUsedAt)].filter(Boolean).join(" \xB7 ")
           })),
-          { value: "__new__", label: import_picocolors8.default.green("+ Create a new workspace"), hint: "fresh codespace" }
+          { value: "__new__", label: import_picocolors9.default.green("+ Create a new workspace"), hint: "fresh codespace" }
         ]
       });
       if (q(choice)) {
@@ -5857,7 +6752,7 @@ async function deploy() {
       process.exit(1);
     }
   }
-  const localClaudeDir = path9.join(os6.homedir(), ".claude");
+  const localClaudeDir = path12.join(os6.homedir(), ".claude");
   const localCredsKind = await detectLocalClaudeCredentials(localClaudeDir);
   let bridged = "none";
   if (localCredsKind !== "none") {
@@ -5955,7 +6850,7 @@ async function deploy() {
     }
   }
   if (bridged !== "none") {
-    const localClaudeJson = path9.join(os6.homedir(), ".claude.json");
+    const localClaudeJson = path12.join(os6.homedir(), ".claude.json");
     if (fs8.existsSync(localClaudeJson)) {
       try {
         const contents = fs8.readFileSync(localClaudeJson);
@@ -5997,12 +6892,12 @@ async function deploy() {
   cliStep.stop("\u2713 codeam-cli installed");
   wt(
     [
-      `Workspace: ${import_picocolors8.default.cyan(workspace.displayName ?? workspace.id)}`,
-      workspace.webUrl ? `Web:       ${import_picocolors8.default.cyan(workspace.webUrl)}` : "",
+      `Workspace: ${import_picocolors9.default.cyan(workspace.displayName ?? workspace.id)}`,
+      workspace.webUrl ? `Web:       ${import_picocolors9.default.cyan(workspace.webUrl)}` : "",
       "",
       "Starting `codeam pair` on the workspace.",
       "Scan the QR code below with the CodeAgent Mobile app to finish pairing.",
-      import_picocolors8.default.dim("(Once paired, this terminal disconnects automatically; the session stays alive on the codespace.)")
+      import_picocolors9.default.dim("(Once paired, this terminal disconnects automatically; the session stays alive on the codespace.)")
     ].filter(Boolean).join("\n"),
     "Almost there"
   );
@@ -6118,11 +7013,11 @@ async function deploy() {
   ].join("\n");
   const code = (await provider.streamCommand(workspace.id, `bash -lc ${shellQuoteSingle(wrapper)}`)).code;
   if (code === 0) {
-    gt(import_picocolors8.default.green("\u2713 Workspace deployed and paired. Drive from your phone, anywhere."));
+    gt(import_picocolors9.default.green("\u2713 Workspace deployed and paired. Drive from your phone, anywhere."));
   } else if (code === 130) {
-    gt(import_picocolors8.default.yellow("Disconnected from local terminal. Mobile session keeps running on the codespace."));
+    gt(import_picocolors9.default.yellow("Disconnected from local terminal. Mobile session keeps running on the codespace."));
   } else {
-    gt(import_picocolors8.default.yellow('Pairing did not complete. Run "codeam pair" inside the codespace if needed.'));
+    gt(import_picocolors9.default.yellow('Pairing did not complete. Run "codeam pair" inside the codespace if needed.'));
   }
 }
 function shellQuoteSingle(s) {
@@ -6148,12 +7043,12 @@ async function runRemoteClaudeLogin(provider, workspaceId) {
   }
 }
 async function detectLocalClaudeCredentials(localClaudeDir) {
-  if (fs8.existsSync(path9.join(localClaudeDir, ".credentials.json"))) {
+  if (fs8.existsSync(path12.join(localClaudeDir, ".credentials.json"))) {
     return "flat-file";
   }
   if (process.platform === "darwin") {
     try {
-      await execFileP3(
+      await execFileP6(
         "security",
         ["find-generic-password", "-s", "Claude Code-credentials"],
         { maxBuffer: 1024 * 1024 }
@@ -6181,11 +7076,11 @@ async function verifyClaudeAuth(provider, workspaceId) {
   }
 }
 async function bridgeClaudeCredentials(provider, workspaceId, localClaudeDir) {
-  const fileBased = path9.join(localClaudeDir, ".credentials.json");
+  const fileBased = path12.join(localClaudeDir, ".credentials.json");
   if (fs8.existsSync(fileBased)) return "flat-file";
   if (process.platform === "darwin") {
     try {
-      const { stdout } = await execFileP3(
+      const { stdout } = await execFileP6(
         "security",
         ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
         { maxBuffer: 1024 * 1024 }
@@ -6233,7 +7128,7 @@ async function pickProvider() {
     message: "Where do you want to deploy?",
     options: PROVIDERS.map((prov) => ({
       value: prov.id,
-      label: prov.available ? prov.displayName : `${prov.displayName} ${import_picocolors8.default.dim("(coming soon)")}`,
+      label: prov.available ? prov.displayName : `${prov.displayName} ${import_picocolors9.default.dim("(coming soon)")}`,
       hint: prov.tagline
     }))
   });
@@ -6250,27 +7145,27 @@ async function pickProvider() {
 }
 
 // src/commands/deploy-manage.ts
-var import_picocolors9 = __toESM(require("picocolors"));
+var import_picocolors10 = __toESM(require("picocolors"));
 async function deployList() {
   console.log();
-  mt(import_picocolors9.default.bgMagenta(import_picocolors9.default.white(" codeam deploy ls ")));
+  mt(import_picocolors10.default.bgMagenta(import_picocolors10.default.white(" codeam deploy ls ")));
   const workspaces = await collectWorkspacesWithStatus();
   if (workspaces.length === 0) {
-    gt(import_picocolors9.default.dim("No deployed workspaces found."));
+    gt(import_picocolors10.default.dim("No deployed workspaces found."));
     return;
   }
   for (const w3 of workspaces) {
-    const tag = w3.codeamRunning ? import_picocolors9.default.green("\u25CF running") : w3.state === "Available" ? import_picocolors9.default.dim("\u25CB idle") : import_picocolors9.default.dim(`\u25CB ${w3.state ?? "stopped"}`);
-    console.log(`  ${tag}  ${import_picocolors9.default.cyan(w3.displayName ?? w3.id)}  ${import_picocolors9.default.dim("(" + w3.providerName + ")")}`);
+    const tag = w3.codeamRunning ? import_picocolors10.default.green("\u25CF running") : w3.state === "Available" ? import_picocolors10.default.dim("\u25CB idle") : import_picocolors10.default.dim(`\u25CB ${w3.state ?? "stopped"}`);
+    console.log(`  ${tag}  ${import_picocolors10.default.cyan(w3.displayName ?? w3.id)}  ${import_picocolors10.default.dim("(" + w3.providerName + ")")}`);
   }
-  gt(import_picocolors9.default.dim("Use `codeam deploy stop` to terminate a session."));
+  gt(import_picocolors10.default.dim("Use `codeam deploy stop` to terminate a session."));
 }
 async function deployStop() {
   console.log();
-  mt(import_picocolors9.default.bgMagenta(import_picocolors9.default.white(" codeam deploy stop ")));
+  mt(import_picocolors10.default.bgMagenta(import_picocolors10.default.white(" codeam deploy stop ")));
   const workspaces = await collectWorkspacesWithStatus();
   if (workspaces.length === 0) {
-    gt(import_picocolors9.default.dim("No deployed workspaces found."));
+    gt(import_picocolors10.default.dim("No deployed workspaces found."));
     return;
   }
   const choice = await _t({
@@ -6280,7 +7175,7 @@ async function deployStop() {
       label: w3.displayName ?? w3.id,
       hint: [
         w3.providerName,
-        w3.codeamRunning ? import_picocolors9.default.green("\u25CF codeam-pair running") : import_picocolors9.default.dim("\u25CB no codeam-pair"),
+        w3.codeamRunning ? import_picocolors10.default.green("\u25CF codeam-pair running") : import_picocolors10.default.dim("\u25CB no codeam-pair"),
         w3.state ?? ""
       ].filter(Boolean).join(" \xB7 ")
     }))
@@ -6308,7 +7203,7 @@ async function deployStop() {
     O2.info("No codeam-pair process to stop on this workspace.");
   }
   const alsoStop = await ot2({
-    message: `Also stop the workspace ${import_picocolors9.default.cyan(target.displayName ?? target.id)} to save compute hours?`,
+    message: `Also stop the workspace ${import_picocolors10.default.cyan(target.displayName ?? target.id)} to save compute hours?`,
     initialValue: true
   });
   if (!q(alsoStop) && alsoStop) {
@@ -6330,7 +7225,7 @@ async function deployStop() {
       O2.warn(err instanceof Error ? err.message : String(err));
     }
   }
-  gt(import_picocolors9.default.green("\u2713 Done."));
+  gt(import_picocolors10.default.green("\u2713 Done."));
 }
 async function collectWorkspacesWithStatus() {
   const out = [];
@@ -6379,10 +7274,10 @@ async function probeCodeamPair(provider, workspace) {
 }
 async function stopWorkspaceFromLocal(target) {
   if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile4 } = await import("child_process");
-    const { promisify: promisify4 } = await import("util");
-    const execFileP4 = promisify4(execFile4);
-    await execFileP4("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
+    const { execFile: execFile7 } = await import("child_process");
+    const { promisify: promisify7 } = await import("util");
+    const execFileP7 = promisify7(execFile7);
+    await execFileP7("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
     return;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.4.23",
+  "version": "2.4.25",
   "description": "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands — from anywhere.",
   "main": "dist/index.js",
   "bin": {