codeam-cli 2.51.2 → 2.52.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.51.3] — 2026-06-29
+
+### Fixed
+
+- **cli:** Stop retrying on terminal enroll-token 4xx (ENROLL_TOKEN_EXPIRED / ENROLL_TOKEN_INVALID)
+
+## [2.51.2] — 2026-06-29
+
+### Fixed
+
+- **headroom:** Route budget relaunch through supervisor when headroom install is active
+
 ## [2.51.1] — 2026-06-29
 
 ### Fixed

package/dist/index.js

@@ -5397,7 +5397,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.51.2" : "0.0.0-dev",
+    cliVersion: true ? "2.52.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5578,7 +5578,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.51.2",
+  version: "2.52.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5893,6 +5893,30 @@ async function postBeadsEvent(input) {
     };
   }
 }
+async function postCliUpdateEvent(input) {
+  try {
+    const payload = { phase: input.phase };
+    if (input.error) payload.error = input.error;
+    await _transport.postJsonAuthed(
+      `${API_BASE}/api/agents/cli-update/events`,
+      {
+        sessionId: input.sessionId,
+        pluginId: input.pluginId,
+        phase: input.phase,
+        ...input.error ? { error: input.error } : {}
+      },
+      input.pluginAuthToken
+    );
+    return { ok: true };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      status: typeof e.statusCode === "number" ? e.statusCode : 0,
+      message: e.message || "unknown"
+    };
+  }
+}
 async function postBeadsProvisioning(input) {
   try {
     await _transport.postJsonAuthed(
@@ -13984,13 +14008,16 @@ function saveHostIdentity(identity) {
   });
   fs27.chmodSync(file, 384);
 }
+var TERMINAL_ENROLL_CODES = /* @__PURE__ */ new Set(["ENROLL_TOKEN_EXPIRED", "ENROLL_TOKEN_INVALID"]);
 var HostHttpError = class extends Error {
-  constructor(message, status2) {
+  constructor(message, status2, code) {
     super(message);
     this.status = status2;
+    this.code = code;
     this.name = "HostHttpError";
   }
   status;
+  code;
   /**
    * True iff this is a genuine auth-rejection of the host identity:
    * 401 (token invalid), 403 (forbidden), 404 (host not found / deleted).
@@ -13999,10 +14026,25 @@ var HostHttpError = class extends Error {
   get isAuthRejection() {
     return this.status === 401 || this.status === 403 || this.status === 404;
   }
+  /**
+   * True iff the enroll token is permanently unusable: the backend returned
+   * a terminal 4xx (410 Gone for expired/replayed, 400 Bad Request for
+   * malformed/invalid) with a stable `ENROLL_TOKEN_*` error code.
+   *
+   * These failures must NOT be retried — the token will never become valid
+   * again. The host-agent must surface a clear message and exit so the user
+   * knows to generate a new token in the app.
+   */
+  get isTerminalEnrollError() {
+    return typeof this.code === "string" && TERMINAL_ENROLL_CODES.has(this.code);
+  }
 };
 function isHostAuthRejection(err) {
   return err instanceof HostHttpError && err.isAuthRejection;
 }
+function isTerminalEnrollError(err) {
+  return err instanceof HostHttpError && err.isTerminalEnrollError;
+}
 function deleteHostIdentity() {
   try {
     fs27.rmSync(hostIdentityPath(), { force: true });
@@ -14017,10 +14059,11 @@ async function postJson(pathname, body) {
   });
   const json = await res.json();
   if (!res.ok || !json.success) {
-    const err = !json.success ? json.error : void 0;
+    const errBody = !json.success ? json.error : void 0;
     throw new HostHttpError(
-      `${pathname} failed (${err?.code ?? `HTTP_${res.status}`}): ${err?.message ?? res.statusText}`,
-      res.status
+      `${pathname} failed (${errBody?.code ?? `HTTP_${res.status}`}): ${errBody?.message ?? res.statusText}`,
+      res.status,
+      errBody?.code
     );
   }
   return json.data;
@@ -14810,7 +14853,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.51.2" : null;
+  const current = true ? "2.52.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -14827,7 +14870,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.51.2" : null;
+  const current = true ? "2.52.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -15529,7 +15572,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process15.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.51.2" : null;
+  return true ? "2.52.0" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -16193,6 +16236,12 @@ async function resolveHostIdentity(enrollToken) {
       );
       return identity;
     } catch (err) {
+      if (isTerminalEnrollError(err)) {
+        throw new Error(
+          "Enrollment token expired or invalid \u2014 generate a new one in the app (Settings \u203A Servers \u203A Add server). Tokens expire after 15 minutes and are single-use.",
+          { cause: err }
+        );
+      }
       if (existing) {
         log.trace(
           "host-agent",
@@ -18921,6 +18970,87 @@ var beadsConfigureH = async (ctx, cmd, parsed) => {
   const result = await configureBeads(action, { agent: rawAgentId, cwd: process.cwd(), pluginAuthToken: ctx.pluginAuthToken }, deps);
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
+var defaultCliUpdateDeps = {
+  install: () => runNpmInstallLatest(),
+  // "Don't self-relaunch" gate — leave this process running and let the
+  // on-disk update apply on the next natural restart, instead of killing it:
+  //   - self-hosted (CODEAM_AUTO_APPROVE=1): the HostAgentSupervisor does NOT
+  //     auto-restart children on exit, so exiting would orphan the session.
+  //   - codespace (CODESPACES=true): the pair-auto daemon owns a daemon lock +
+  //     the relay connection; a naive detached re-exec does NOT replicate the
+  //     careful setsid/lock-aware restart the install flow uses, so a failed
+  //     respawn would leave the mobile session permanently OFFLINE. Codespaces
+  //     sleep/resume often, so the update lands on next wake — safe + non-fatal.
+  // Only a truly local `codeam start` (neither marker) re-execs in place below.
+  isSupervised: () => process.env["CODEAM_AUTO_APPROVE"] === "1" || process.env["CODESPACES"] === "true",
+  relaunch: (args2) => {
+    const entry = process.argv[1];
+    const child = (0, import_child_process21.spawn)(process.execPath, [entry, ...args2], {
+      detached: true,
+      stdio: "inherit"
+    });
+    child.unref();
+    process.exit(0);
+  }
+};
+var CLI_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
+var CLI_UPDATE_MAX_ATTEMPTS = 3;
+async function runNpmInstallLatest() {
+  let lastError = "";
+  for (let attempt = 1; attempt <= CLI_UPDATE_MAX_ATTEMPTS; attempt++) {
+    const result = await new Promise((resolve7) => {
+      (0, import_child_process21.execFile)(
+        "npm",
+        ["install", "-g", "codeam-cli@latest"],
+        { timeout: CLI_UPDATE_INSTALL_TIMEOUT_MS },
+        (err, _stdout, stderr) => {
+          if (!err) {
+            resolve7({ ok: true });
+          } else {
+            resolve7({ ok: false, error: (stderr || err.message).slice(0, 300) });
+          }
+        }
+      );
+    });
+    if (result.ok) return { ok: true };
+    lastError = result.error ?? "unknown";
+    if (attempt < CLI_UPDATE_MAX_ATTEMPTS) {
+      await new Promise((r) => setTimeout(r, 1e3 * attempt));
+    }
+  }
+  return { ok: false, error: lastError };
+}
+var cliSelfUpdateH = (deps = defaultCliUpdateDeps) => async (ctx, cmd) => {
+  const report = async (phase, error) => {
+    if (!ctx.pluginAuthToken) return;
+    try {
+      await postCliUpdateEvent({
+        sessionId: ctx.sessionId,
+        pluginId: ctx.pluginId,
+        pluginAuthToken: ctx.pluginAuthToken,
+        phase,
+        error
+      });
+    } catch {
+    }
+  };
+  await report("updating");
+  const result = await deps.install();
+  if (!result.ok) {
+    await report("failed", result.error?.slice(0, 200));
+    await ctx.relay.sendResult(cmd.id, "completed", { updated: false });
+    return;
+  }
+  await report("relaunching");
+  await ctx.relay.sendResult(cmd.id, "completed", { updated: true });
+  if (deps.isSupervised()) {
+    log.info("cli-update", "supervised context \u2014 update installed, applies on next restart");
+    return;
+  }
+  const origArgs = process.argv.slice(2);
+  log.info("cli-update", `re-execing ${process.argv[1]} with args: ${origArgs.join(" ")}`);
+  deps.relaunch(origArgs);
+};
 var terminalOpenH = async (ctx, cmd, parsed) => {
   const r = openTerminal({
     cols: typeof parsed.cols === "number" ? parsed.cols : void 0,
@@ -19908,7 +20038,8 @@ var handlers = {
   env_write: envWriteH,
   headroom_configure: headroomConfigureH,
   headroom_budget: headroomBudgetH,
-  beads_configure: beadsConfigureH
+  beads_configure: beadsConfigureH,
+  cli_self_update: cliSelfUpdateH()
 };
 async function dispatchCommand(ctx, cmd) {
   if (cmd.type === "beads_action") {
@@ -30777,9 +30908,9 @@ async function probeCodeamPair(provider, workspace) {
 }
 async function stopWorkspaceFromLocal(target) {
   if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile13 } = await import("child_process");
+    const { execFile: execFile14 } = await import("child_process");
     const { promisify: promisify11 } = await import("util");
-    const execFileP10 = promisify11(execFile13);
+    const execFileP10 = promisify11(execFile14);
     await execFileP10("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
     return;
   }
@@ -31061,7 +31192,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.51.2" : "0.0.0-dev";
+  const cliVersion = true ? "2.52.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -31260,7 +31391,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.51.2" : "unknown";
+  const v = true ? "2.52.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.51.2",
+  "version": "2.52.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",