codeam-cli 2.52.4 → 2.52.6

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.52.5] — 2026-07-02
+
+### CI
+
+- **workflow:** Free runner disk before the JetBrains publish job
+
 ## [2.52.3] — 2026-06-30
 
 ### Added

package/dist/index.js

@@ -5397,7 +5397,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.52.4" : "0.0.0-dev",
+    cliVersion: true ? "2.52.6" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5578,7 +5578,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.52.4",
+  version: "2.52.6",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6105,6 +6105,13 @@ function computePollDelay({ baseMs, failures }) {
 }
 
 // src/services/command-relay.service.ts
+function httpStatusOf(err) {
+  if (typeof err === "object" && err !== null && "statusCode" in err) {
+    const status2 = err.statusCode;
+    if (typeof status2 === "number") return status2;
+  }
+  return null;
+}
 var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
@@ -6120,6 +6127,7 @@ var CommandRelayService = class {
   agentMeta;
   agentsOverride;
   _running = false;
+  pairingInvalid = false;
   heartbeatTimer = null;
   agentsTimer = null;
   /** True once `/api/plugin/agents` has accepted at least one report. */
@@ -6197,7 +6205,22 @@ var CommandRelayService = class {
     });
   }
   async sendResult(commandId, status2, result) {
-    await _postJson(`${API_BASE2}/api/commands/result`, { commandId, status: status2, result });
+    if (this.pairingInvalid) return;
+    try {
+      await _postJson(`${API_BASE2}/api/commands/result`, { commandId, status: status2, result });
+    } catch (err) {
+      const statusCode = httpStatusOf(err);
+      if (statusCode === 401 || statusCode === 403) {
+        this.pairingInvalid = true;
+        process.stderr.write(
+          "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+        );
+        log.warn("relay", `pairing invalid (status=${statusCode}) \u2014 relay stopped`);
+        this.stop();
+        return;
+      }
+      throw err;
+    }
   }
   // ─── SSE pull (primary) ──────────────────────────────────────────
   connectSSE() {
@@ -7340,24 +7363,24 @@ async function refreshAuthToken(sessionId, pluginId) {
       },
       JSON.stringify({ sessionId, pluginId })
     );
-    if (statusCode === 404) {
-      log.warn("chunkEmitter", "[auth] reconnect 404 \u2014 session gone server-side");
-      return null;
+    if (statusCode === 404 || statusCode === 401 || statusCode === 403) {
+      log.warn("chunkEmitter", `[auth] reconnect ${statusCode} \u2014 session gone server-side`);
+      return { kind: "gone" };
     }
     if (statusCode >= 400) {
       log.warn("chunkEmitter", `[auth] reconnect failed status=${statusCode}`);
-      return null;
+      return { kind: "transient" };
     }
     const parsed = JSON.parse(body);
     const fresh = parsed.data?.pluginAuthToken;
     if (typeof fresh !== "string" || fresh.length === 0) {
       log.warn("chunkEmitter", "[auth] reconnect response missing pluginAuthToken");
-      return null;
+      return { kind: "transient" };
     }
-    return fresh;
+    return { kind: "fresh", token: fresh };
   } catch (err) {
     log.warn("chunkEmitter", `[auth] reconnect threw: ${String(err)}`);
-    return null;
+    return { kind: "transient" };
   }
 }
 var ChunkEmitter = class {
@@ -7375,6 +7398,11 @@ var ChunkEmitter = class {
   opts;
   url = `${API_BASE4}/api/commands/output`;
   headers;
+  /** Latched when the pairing is unrecoverable (401/403 whose refresh
+   *  says the session is gone, or a fresh token still rejected) —
+   *  every later send short-circuits (2026-06-28 incident: 401 ×34
+   *  with a dead token while the user saw nothing). */
+  pairingInvalid = false;
   /**
    * Send a chunk. `body` is the chunk fields minus `sessionId` /
    * `pluginId` — the emitter splices those in. `critical = true`
@@ -7394,7 +7422,11 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
+    if (this.pairingInvalid) {
+      return Promise.resolve({ dead: true });
+    }
     return new Promise((resolve7) => {
+      let refreshedOnce = false;
       const attempt = (attemptsLeft) => {
         _transport3.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
@@ -7404,18 +7436,27 @@ var ChunkEmitter = class {
             resolve7({ dead: true });
             return;
           }
-          if (statusCode === 401) {
-            log.warn("chunkEmitter", `auth 401 took=${tookMs}ms \u2014 attempting silent refresh`);
+          if (statusCode === 401 || statusCode === 403) {
+            if (refreshedOnce) {
+              this.markPairingInvalid(statusCode, tookMs);
+              resolve7({ dead: true });
+              return;
+            }
+            log.warn("chunkEmitter", `auth ${statusCode} took=${tookMs}ms \u2014 attempting silent refresh`);
             void (async () => {
-              const fresh = await refreshAuthToken(this.opts.sessionId, this.opts.pluginId);
-              if (fresh) {
-                this.headers["X-Plugin-Auth-Token"] = fresh;
-                this.opts.pluginAuthToken = fresh;
+              const refresh = await refreshAuthToken(this.opts.sessionId, this.opts.pluginId);
+              if (refresh.kind === "fresh") {
+                this.headers["X-Plugin-Auth-Token"] = refresh.token;
+                this.opts.pluginAuthToken = refresh.token;
+                refreshedOnce = true;
                 log.info("chunkEmitter", "auth refreshed silently");
-                if (attemptsLeft > 0 || opts.critical) {
-                  attempt(Math.max(attemptsLeft, 1));
-                  return;
-                }
+                attempt(Math.max(attemptsLeft, 1));
+                return;
+              }
+              if (refresh.kind === "gone") {
+                this.markPairingInvalid(statusCode, tookMs);
+                resolve7({ dead: true });
+                return;
               }
               resolve7({ dead: false });
             })();
@@ -7446,6 +7487,17 @@ var ChunkEmitter = class {
       attempt(maxRetries);
     });
   }
+  markPairingInvalid(statusCode, tookMs) {
+    if (this.pairingInvalid) return;
+    this.pairingInvalid = true;
+    process.stderr.write(
+      "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+    );
+    log.warn(
+      "chunkEmitter",
+      `pairing invalid (status=${statusCode}) took=${tookMs}ms \u2014 emitter latched, no further posts`
+    );
+  }
 };
 var _transport3 = {
   post: _post2
@@ -14876,7 +14928,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.52.4" : null;
+  const current = true ? "2.52.6" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -14893,7 +14945,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.52.4" : null;
+  const current = true ? "2.52.6" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -15595,7 +15647,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process15.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.52.4" : null;
+  return true ? "2.52.6" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -24652,6 +24704,10 @@ var AcpPublisher = class {
   opts;
   apiBase;
   token;
+  /** Latched on an unrecoverable 401/403 — every surface stops posting
+   *  (2026-06-28 incident: a dead-token publisher spammed 401 ×34 while
+   *  the agent's replies silently never reached the phone). */
+  pairingInvalid = false;
   authHeaders() {
     return {
       "Content-Type": "application/json",
@@ -24667,14 +24723,39 @@ var AcpPublisher = class {
    * response unchanged — callers log non-2xx but never throw.
    */
   async postWithReauth(url, payload) {
+    if (this.pairingInvalid) {
+      return { statusCode: 401, body: "PAIRING_INVALID" };
+    }
     const first = await _transport4.post(url, this.authHeaders(), payload);
     if (first.statusCode !== 401 && first.statusCode !== 403) return first;
-    if (!this.opts.refreshAuthToken) return first;
-    const fresh = await this.opts.refreshAuthToken();
-    if (!fresh) return first;
-    this.token = fresh;
-    log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
-    return _transport4.post(url, this.authHeaders(), payload);
+    if (this.opts.refreshAuthToken) {
+      const fresh = await this.opts.refreshAuthToken();
+      if (fresh) {
+        this.token = fresh;
+        log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+        const second = await _transport4.post(url, this.authHeaders(), payload);
+        if (second.statusCode !== 401 && second.statusCode !== 403) return second;
+        this.markPairingInvalid(second.statusCode);
+        return second;
+      }
+    }
+    this.markPairingInvalid(first.statusCode);
+    return first;
+  }
+  markPairingInvalid(statusCode) {
+    if (this.pairingInvalid) return;
+    this.pairingInvalid = true;
+    process.stderr.write(
+      "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+    );
+    log.warn(
+      "acpPublisher",
+      `pairing invalid (status=${statusCode}) \u2014 publisher latched, no further posts`
+    );
+    try {
+      this.opts.onPairingInvalid?.();
+    } catch {
+    }
   }
   /**
    * Wrap the body with `sessionId` + `pluginId` at the top level.
@@ -31207,7 +31288,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.52.4" : "0.0.0-dev";
+  const cliVersion = true ? "2.52.6" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -31406,7 +31487,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.52.4" : "unknown";
+  const v = true ? "2.52.6" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.52.4",
+  "version": "2.52.6",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",