codeam-cli 2.52.5 → 2.52.7

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.52.6] — 2026-07-03
+
+### Fixed
+
+- **cli:** An invalid pairing latches the output pipeline — no more silent dead-token spam
+
+## [2.52.5] — 2026-07-02
+
+### CI
+
+- **workflow:** Free runner disk before the JetBrains publish job
+
 ## [2.52.3] — 2026-06-30
 
 ### Added

package/dist/index.js

@@ -560,8 +560,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path62) {
-  return path62.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path63) {
+  return path63.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -3041,9 +3041,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path62, ranges, output) {
+function getContextLinesFromFile(path63, ranges, output) {
   return new Promise((resolve7) => {
-    const stream = (0, import_node_fs.createReadStream)(path62);
+    const stream = (0, import_node_fs.createReadStream)(path63);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -3058,7 +3058,7 @@ function getContextLinesFromFile(path62, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path62, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path63, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3119,8 +3119,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path62) {
-  return path62.startsWith("node:") || path62.endsWith(".min.js") || path62.endsWith(".min.cjs") || path62.endsWith(".min.mjs") || path62.startsWith("data:");
+function shouldSkipContextLinesForFile(path63) {
+  return path63.startsWith("node:") || path63.endsWith(".min.js") || path63.endsWith(".min.cjs") || path63.endsWith(".min.mjs") || path63.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -5397,7 +5397,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.52.5" : "0.0.0-dev",
+    cliVersion: true ? "2.52.7" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5578,7 +5578,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.52.5",
+  version: "2.52.7",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6105,6 +6105,13 @@ function computePollDelay({ baseMs, failures }) {
 }
 
 // src/services/command-relay.service.ts
+function httpStatusOf(err) {
+  if (typeof err === "object" && err !== null && "statusCode" in err) {
+    const status2 = err.statusCode;
+    if (typeof status2 === "number") return status2;
+  }
+  return null;
+}
 var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
@@ -6120,6 +6127,7 @@ var CommandRelayService = class {
   agentMeta;
   agentsOverride;
   _running = false;
+  pairingInvalid = false;
   heartbeatTimer = null;
   agentsTimer = null;
   /** True once `/api/plugin/agents` has accepted at least one report. */
@@ -6197,7 +6205,22 @@ var CommandRelayService = class {
     });
   }
   async sendResult(commandId, status2, result) {
-    await _postJson(`${API_BASE2}/api/commands/result`, { commandId, status: status2, result });
+    if (this.pairingInvalid) return;
+    try {
+      await _postJson(`${API_BASE2}/api/commands/result`, { commandId, status: status2, result });
+    } catch (err) {
+      const statusCode = httpStatusOf(err);
+      if (statusCode === 401 || statusCode === 403) {
+        this.pairingInvalid = true;
+        process.stderr.write(
+          "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+        );
+        log.warn("relay", `pairing invalid (status=${statusCode}) \u2014 relay stopped`);
+        this.stop();
+        return;
+      }
+      throw err;
+    }
   }
   // ─── SSE pull (primary) ──────────────────────────────────────────
   connectSSE() {
@@ -7340,24 +7363,24 @@ async function refreshAuthToken(sessionId, pluginId) {
       },
       JSON.stringify({ sessionId, pluginId })
     );
-    if (statusCode === 404) {
-      log.warn("chunkEmitter", "[auth] reconnect 404 \u2014 session gone server-side");
-      return null;
+    if (statusCode === 404 || statusCode === 401 || statusCode === 403) {
+      log.warn("chunkEmitter", `[auth] reconnect ${statusCode} \u2014 session gone server-side`);
+      return { kind: "gone" };
     }
     if (statusCode >= 400) {
       log.warn("chunkEmitter", `[auth] reconnect failed status=${statusCode}`);
-      return null;
+      return { kind: "transient" };
     }
     const parsed = JSON.parse(body);
     const fresh = parsed.data?.pluginAuthToken;
     if (typeof fresh !== "string" || fresh.length === 0) {
       log.warn("chunkEmitter", "[auth] reconnect response missing pluginAuthToken");
-      return null;
+      return { kind: "transient" };
     }
-    return fresh;
+    return { kind: "fresh", token: fresh };
   } catch (err) {
     log.warn("chunkEmitter", `[auth] reconnect threw: ${String(err)}`);
-    return null;
+    return { kind: "transient" };
   }
 }
 var ChunkEmitter = class {
@@ -7375,6 +7398,11 @@ var ChunkEmitter = class {
   opts;
   url = `${API_BASE4}/api/commands/output`;
   headers;
+  /** Latched when the pairing is unrecoverable (401/403 whose refresh
+   *  says the session is gone, or a fresh token still rejected) —
+   *  every later send short-circuits (2026-06-28 incident: 401 ×34
+   *  with a dead token while the user saw nothing). */
+  pairingInvalid = false;
   /**
    * Send a chunk. `body` is the chunk fields minus `sessionId` /
    * `pluginId` — the emitter splices those in. `critical = true`
@@ -7394,7 +7422,11 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
+    if (this.pairingInvalid) {
+      return Promise.resolve({ dead: true });
+    }
     return new Promise((resolve7) => {
+      let refreshedOnce = false;
       const attempt = (attemptsLeft) => {
         _transport3.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
@@ -7404,18 +7436,27 @@ var ChunkEmitter = class {
             resolve7({ dead: true });
             return;
           }
-          if (statusCode === 401) {
-            log.warn("chunkEmitter", `auth 401 took=${tookMs}ms \u2014 attempting silent refresh`);
+          if (statusCode === 401 || statusCode === 403) {
+            if (refreshedOnce) {
+              this.markPairingInvalid(statusCode, tookMs);
+              resolve7({ dead: true });
+              return;
+            }
+            log.warn("chunkEmitter", `auth ${statusCode} took=${tookMs}ms \u2014 attempting silent refresh`);
             void (async () => {
-              const fresh = await refreshAuthToken(this.opts.sessionId, this.opts.pluginId);
-              if (fresh) {
-                this.headers["X-Plugin-Auth-Token"] = fresh;
-                this.opts.pluginAuthToken = fresh;
+              const refresh = await refreshAuthToken(this.opts.sessionId, this.opts.pluginId);
+              if (refresh.kind === "fresh") {
+                this.headers["X-Plugin-Auth-Token"] = refresh.token;
+                this.opts.pluginAuthToken = refresh.token;
+                refreshedOnce = true;
                 log.info("chunkEmitter", "auth refreshed silently");
-                if (attemptsLeft > 0 || opts.critical) {
-                  attempt(Math.max(attemptsLeft, 1));
-                  return;
-                }
+                attempt(Math.max(attemptsLeft, 1));
+                return;
+              }
+              if (refresh.kind === "gone") {
+                this.markPairingInvalid(statusCode, tookMs);
+                resolve7({ dead: true });
+                return;
               }
               resolve7({ dead: false });
             })();
@@ -7446,6 +7487,17 @@ var ChunkEmitter = class {
       attempt(maxRetries);
     });
   }
+  markPairingInvalid(statusCode, tookMs) {
+    if (this.pairingInvalid) return;
+    this.pairingInvalid = true;
+    process.stderr.write(
+      "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+    );
+    log.warn(
+      "chunkEmitter",
+      `pairing invalid (status=${statusCode}) took=${tookMs}ms \u2014 emitter latched, no further posts`
+    );
+  }
 };
 var _transport3 = {
   post: _post2
@@ -12790,11 +12842,11 @@ function parseReview(stdout) {
   for (const line of lines) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path62, lineNo, sevToken, message] = m;
-    if (!path62 || !lineNo || !message) continue;
+    const [, path63, lineNo, sevToken, message] = m;
+    if (!path63 || !lineNo || !message) continue;
     const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
-      path: path62.trim(),
+      path: path63.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: cleanedMessage
@@ -14876,7 +14928,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.52.5" : null;
+  const current = true ? "2.52.7" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -14893,7 +14945,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.52.5" : null;
+  const current = true ? "2.52.7" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -15595,7 +15647,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process15.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.52.5" : null;
+  return true ? "2.52.7" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -20337,12 +20389,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path62 = fileFlag.slice("--token-file=".length);
+    const path63 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs44.readFileSync(path62, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path62} is empty`);
+      const content = fs44.readFileSync(path63, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path63} is empty`);
       try {
-        fs44.unlinkSync(path62);
+        fs44.unlinkSync(path63);
       } catch {
       }
       return content;
@@ -21023,12 +21075,58 @@ function requiresAcp(agent) {
   return getAcpAdapter(agent) !== null;
 }
 
+// src/agents/acp/claude-binary.ts
+var import_fs4 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
+function currentPlatformKey() {
+  return `${process.platform}-${process.arch}`;
+}
+function defaultSdkDir() {
+  try {
+    const manifest = require.resolve("@anthropic-ai/claude-agent-sdk/package.json");
+    return import_path8.default.dirname(manifest);
+  } catch {
+    return null;
+  }
+}
+function resolveClaudeNativeBinary(deps = {}) {
+  const existsSync21 = deps.existsSync ?? import_fs4.default.existsSync;
+  const platformKey = deps.platformKey ?? currentPlatformKey();
+  const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
+  if (!sdkDir) return null;
+  const scopeDir = import_path8.default.dirname(sdkDir);
+  const binName = process.platform === "win32" ? "claude.exe" : "claude";
+  const candidate = import_path8.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
+  return existsSync21(candidate) ? candidate : null;
+}
+var realSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+async function waitForClaudeNativeBinary(opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 18e4;
+  const pollMs = opts.pollMs ?? 500;
+  const now = opts.now ?? Date.now;
+  const sleep3 = opts.sleep ?? realSleep;
+  const deps = {
+    sdkDir: opts.sdkDir,
+    platformKey: opts.platformKey,
+    existsSync: opts.existsSync
+  };
+  const deadline = now() + timeoutMs;
+  let found = resolveClaudeNativeBinary(deps);
+  if (found) return found;
+  while (now() < deadline) {
+    await sleep3(pollMs);
+    found = resolveClaudeNativeBinary(deps);
+    if (found) return found;
+  }
+  return resolveClaudeNativeBinary(deps);
+}
+
 // src/agents/acp/runner.ts
 var import_node_crypto7 = require("crypto");
 
 // src/services/history.service.ts
-var fs45 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var fs46 = __toESM(require("fs"));
+var path52 = __toESM(require("path"));
 var os38 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
 var http6 = __toESM(require("http"));
@@ -21056,7 +21154,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs45.readFileSync(filePath, "utf8");
+    raw = fs46.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -21197,7 +21295,7 @@ var HistoryService = class _HistoryService {
     return this._quotaPercent === null || Date.now() - this._quotaFetchedAt > ttlMs;
   }
   get projectDir() {
-    return this.runtime.resolveHistoryDir(this.cwd) ?? path51.join(os38.homedir(), ".claude", "projects", encodeCwd(this.cwd));
+    return this.runtime.resolveHistoryDir(this.cwd) ?? path52.join(os38.homedir(), ".claude", "projects", encodeCwd(this.cwd));
   }
   /** Set the current Claude conversation ID (extracted from /cost command or session start) */
   setCurrentConversationId(id) {
@@ -21209,7 +21307,7 @@ var HistoryService = class _HistoryService {
   /** Return the current message count in the active conversation. */
   getCurrentMessageCount() {
     if (!this.currentConversationId) return 0;
-    const filePath = path51.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+    const filePath = path52.join(this.projectDir, `${this.currentConversationId}.jsonl`);
     return parseJsonl(filePath).length;
   }
   /**
@@ -21220,7 +21318,7 @@ var HistoryService = class _HistoryService {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.currentConversationId) return null;
-      const filePath = path51.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+      const filePath = path52.join(this.projectDir, `${this.currentConversationId}.jsonl`);
       const messages = parseJsonl(filePath);
       if (messages.length > previousCount) {
         for (let i = messages.length - 1; i >= previousCount; i--) {
@@ -21246,16 +21344,16 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs45.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs46.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs45.statSync(path51.join(dir, e.name));
+          const stat3 = fs46.statSync(path52.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
         }
       }).filter((f) => f.birthtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       if (files.length > 0) {
-        this.currentConversationId = path51.basename(files[0].name, ".jsonl");
+        this.currentConversationId = path52.basename(files[0].name, ".jsonl");
       }
     } catch {
     }
@@ -21289,13 +21387,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs45.readdirSync(dir, { withFileTypes: true });
+      entries = fs46.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs45.statSync(path51.join(dir, e.name));
+        const stat3 = fs46.statSync(path52.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -21304,12 +21402,12 @@ var HistoryService = class _HistoryService {
     if (files.length === 0) return null;
     const targetFile = this.currentConversationId ? `${this.currentConversationId}.jsonl` : files[0].name;
     if (!files.some((f) => f.name === targetFile)) return null;
-    return this.extractUsageFromFile(path51.join(dir, targetFile));
+    return this.extractUsageFromFile(path52.join(dir, targetFile));
   }
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs45.readFileSync(filePath, "utf8");
+      raw = fs46.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -21354,9 +21452,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs45.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs46.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs45.statSync(path51.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs46.statSync(path52.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -21367,7 +21465,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs45.readFileSync(path51.join(projectDir, file), "utf8");
+        raw = fs46.readFileSync(path52.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -21446,7 +21544,7 @@ var HistoryService = class _HistoryService {
     if (this.runtime.resolveHistoryFile) {
       return this.runtime.resolveHistoryFile(this.cwd, sessionId);
     }
-    return path51.join(this.projectDir, `${sessionId}.jsonl`);
+    return path52.join(this.projectDir, `${sessionId}.jsonl`);
   }
   /**
    * Parse a conversation's messages from disk, agent-aware. Claude uses the
@@ -21480,7 +21578,7 @@ var HistoryService = class _HistoryService {
         };
       });
     }
-    return parseJsonl(path51.join(this.projectDir, `${sessionId}.jsonl`));
+    return parseJsonl(path52.join(this.projectDir, `${sessionId}.jsonl`));
   }
   async loadConversation(sessionId) {
     const messages = this.readConversation(sessionId);
@@ -21536,7 +21634,7 @@ var HistoryService = class _HistoryService {
     if (!filePath) return false;
     let mtimeMs;
     try {
-      mtimeMs = fs45.statSync(filePath).mtimeMs;
+      mtimeMs = fs46.statSync(filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -21605,10 +21703,10 @@ var HistoryService = class _HistoryService {
 
 // src/agents/acp/client.ts
 var import_node_child_process17 = require("child_process");
-var fs46 = __toESM(require("fs/promises"));
+var fs47 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
 var os39 = __toESM(require("os"));
-var path52 = __toESM(require("path"));
+var path53 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/acp.js
@@ -24441,7 +24539,7 @@ var AcpClient = class {
       },
       readTextFile: async (params) => {
         try {
-          const content = await fs46.readFile(params.path, "utf8");
+          const content = await fs47.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
         } catch (err) {
           const code = err.code;
@@ -24461,7 +24559,7 @@ var AcpClient = class {
       },
       writeTextFile: async (params) => {
         try {
-          await fs46.writeFile(params.path, params.content, "utf8");
+          await fs47.writeFile(params.path, params.content, "utf8");
           return {};
         } catch (err) {
           const code = err.code;
@@ -24515,20 +24613,20 @@ function knownAgentBinaryDirs() {
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path52.join(home, ".nvm/versions/node")
+    path53.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path52.join(root, child, "bin"));
+        out2.push(path53.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path52.join(home, ".volta/bin"));
+  out2.push(path53.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path52.join(home, ".local/bin"));
-  out2.push(path52.join(home, "bin"));
+  out2.push(path53.join(home, ".local/bin"));
+  out2.push(path53.join(home, "bin"));
   return out2.filter((p2) => {
     try {
       return fsSync.statSync(p2).isDirectory();
@@ -24539,7 +24637,7 @@ function knownAgentBinaryDirs() {
 }
 function expandPathForAgentBinaries(existingPath) {
   const existing = new Set(
-    existingPath.split(path52.delimiter).filter((p2) => p2.length > 0)
+    existingPath.split(path53.delimiter).filter((p2) => p2.length > 0)
   );
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
@@ -24549,7 +24647,7 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path52.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path53.delimiter);
 }
 
 // src/services/streaming/transport.ts
@@ -24652,6 +24750,10 @@ var AcpPublisher = class {
   opts;
   apiBase;
   token;
+  /** Latched on an unrecoverable 401/403 — every surface stops posting
+   *  (2026-06-28 incident: a dead-token publisher spammed 401 ×34 while
+   *  the agent's replies silently never reached the phone). */
+  pairingInvalid = false;
   authHeaders() {
     return {
       "Content-Type": "application/json",
@@ -24667,14 +24769,39 @@ var AcpPublisher = class {
    * response unchanged — callers log non-2xx but never throw.
    */
   async postWithReauth(url, payload) {
+    if (this.pairingInvalid) {
+      return { statusCode: 401, body: "PAIRING_INVALID" };
+    }
     const first = await _transport4.post(url, this.authHeaders(), payload);
     if (first.statusCode !== 401 && first.statusCode !== 403) return first;
-    if (!this.opts.refreshAuthToken) return first;
-    const fresh = await this.opts.refreshAuthToken();
-    if (!fresh) return first;
-    this.token = fresh;
-    log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
-    return _transport4.post(url, this.authHeaders(), payload);
+    if (this.opts.refreshAuthToken) {
+      const fresh = await this.opts.refreshAuthToken();
+      if (fresh) {
+        this.token = fresh;
+        log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+        const second = await _transport4.post(url, this.authHeaders(), payload);
+        if (second.statusCode !== 401 && second.statusCode !== 403) return second;
+        this.markPairingInvalid(second.statusCode);
+        return second;
+      }
+    }
+    this.markPairingInvalid(first.statusCode);
+    return first;
+  }
+  markPairingInvalid(statusCode) {
+    if (this.pairingInvalid) return;
+    this.pairingInvalid = true;
+    process.stderr.write(
+      "[codeam] This pairing is no longer valid \u2014 run `codeam pair` again to reconnect this session.\n"
+    );
+    log.warn(
+      "acpPublisher",
+      `pairing invalid (status=${statusCode}) \u2014 publisher latched, no further posts`
+    );
+    try {
+      this.opts.onPairingInvalid?.();
+    } catch {
+    }
   }
   /**
    * Wrap the body with `sessionId` + `pluginId` at the top level.
@@ -25034,15 +25161,15 @@ function commonPrefixLength(a, b) {
 
 // src/agents/acp/onboarding.ts
 var import_child_process23 = require("child_process");
-var fs47 = __toESM(require("fs"));
+var fs48 = __toESM(require("fs"));
 var os40 = __toESM(require("os"));
-var path53 = __toESM(require("path"));
+var path54 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path53.join(os40.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
-  exists: (p2) => fs47.existsSync(p2),
+  markerPath: (sessionId) => path54.join(os40.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  exists: (p2) => fs48.existsSync(p2),
   write: (p2) => {
-    fs47.mkdirSync(path53.dirname(p2), { recursive: true });
-    fs47.writeFileSync(p2, "");
+    fs48.mkdirSync(path54.dirname(p2), { recursive: true });
+    fs48.writeFileSync(p2, "");
   },
   disabled: () => {
     const v = process.env.CODEAM_ONBOARDING_DISABLED;
@@ -25079,7 +25206,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path53.basename(cwd || "");
+  const base = path54.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -25357,8 +25484,8 @@ var import_crypto5 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process24 = require("child_process");
-var fs48 = __toESM(require("fs/promises"));
-var path54 = __toESM(require("path"));
+var fs49 = __toESM(require("fs/promises"));
+var path55 = __toESM(require("path"));
 async function collectRepoChangeset(opts) {
   const status2 = await runGit3(opts.repoRoot, ["status", "--porcelain=v1", "-z"]);
   if (status2 === null) return null;
@@ -25376,7 +25503,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path54.join(opts.repoRoot, row.filePath)
+        path55.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -25407,7 +25534,7 @@ function readUntrackedLineCount(absPath) {
 }
 async function defaultReadUntrackedLineCount(absPath) {
   try {
-    const content = await fs48.readFile(absPath, "utf8");
+    const content = await fs49.readFile(absPath, "utf8");
     let count = 0;
     let pos = -1;
     while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
@@ -25499,7 +25626,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs52 = await import("fs/promises");
+  const fs53 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -25507,7 +25634,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs52.readdir(dir, { withFileTypes: true });
+      const dirents = await fs53.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -25518,8 +25645,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path54.relative(workingDir, dir),
-        repoName: path54.basename(dir)
+        repoPath: path55.relative(workingDir, dir),
+        repoName: path55.basename(dir)
       });
       return;
     }
@@ -25527,14 +25654,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path54.join(dir, entry.name), depth + 1);
+      await walk(path55.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs49 = __toESM(require("fs/promises"));
-var path55 = __toESM(require("path"));
+var fs50 = __toESM(require("fs/promises"));
+var path56 = __toESM(require("path"));
 var import_os7 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -25567,16 +25694,16 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path55.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path55.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path56.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path56.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs49.mkdir(path55.dirname(this.filePath), { recursive: true });
-    await fs49.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs50.mkdir(path56.dirname(this.filePath), { recursive: true });
+    await fs50.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -25665,7 +25792,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs49.readFile(this.filePath, "utf8");
+      raw = await fs50.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -25689,12 +25816,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs49.unlink(this.filePath).catch(() => void 0);
+      await fs50.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs49.writeFile(tmpPath, payload, "utf8");
-    await fs49.rename(tmpPath, this.filePath);
+    await fs50.writeFile(tmpPath, payload, "utf8");
+    await fs50.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -28323,15 +28450,15 @@ function fetchQuotaUsage(runtime, historySvc) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs50 = __toESM(require("fs"));
+var fs51 = __toESM(require("fs"));
 var os41 = __toESM(require("os"));
-var path56 = __toESM(require("path"));
+var path57 = __toESM(require("path"));
 function ensureClaudeOnboarded() {
   try {
-    const file = path56.join(os41.homedir(), ".claude.json");
+    const file = path57.join(os41.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs50.readFileSync(file, "utf8"));
+      config = JSON.parse(fs51.readFileSync(file, "utf8"));
     } catch {
     }
     if (config.hasCompletedOnboarding === true && typeof config.theme === "string") {
@@ -28342,8 +28469,8 @@ function ensureClaudeOnboarded() {
     if (typeof config.lastOnboardingVersion !== "string") {
       config.lastOnboardingVersion = "2.1.177";
     }
-    fs50.mkdirSync(path56.dirname(file), { recursive: true });
-    fs50.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs51.mkdirSync(path57.dirname(file), { recursive: true });
+    fs51.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info("claude", "pre-completed Claude onboarding (skip first-run theme picker)");
   } catch (err) {
     log.warn("claude", `ensureClaudeOnboarded failed (non-fatal): ${err.message}`);
@@ -28447,9 +28574,10 @@ async function start(requestedAgent) {
   const depsReady = process.env.CODESPACES === "true" ? provisionProjectDependencies(cwd).catch(() => void 0) : Promise.resolve();
   if (process.env.CODESPACES === "true") {
     const GATE_TIMEOUT_MS = 24e4;
+    const claudeBinaryReady = session.agent === "claude" ? waitForClaudeNativeBinary({ timeoutMs: GATE_TIMEOUT_MS }).catch(() => null) : Promise.resolve();
     let gateTimer;
     await Promise.race([
-      Promise.all([beadsReady.catch(() => null), depsReady]),
+      Promise.all([beadsReady.catch(() => null), depsReady, claudeBinaryReady]),
       new Promise((resolve7) => {
         gateTimer = setTimeout(resolve7, GATE_TIMEOUT_MS);
       })
@@ -28993,7 +29121,7 @@ var import_picocolors11 = __toESM(require("picocolors"));
 var import_child_process25 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors9 = __toESM(require("picocolors"));
-var path57 = __toESM(require("path"));
+var path58 = __toESM(require("path"));
 var execFileP6 = (0, import_util4.promisify)(import_child_process25.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -29482,7 +29610,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path57.posix.dirname(remotePath);
+    const remoteDir = path58.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -29552,7 +29680,7 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process26 = require("child_process");
 var import_util5 = require("util");
-var path58 = __toESM(require("path"));
+var path59 = __toESM(require("path"));
 var import_picocolors10 = __toESM(require("picocolors"));
 var execFileP7 = (0, import_util5.promisify)(import_child_process26.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
@@ -29792,7 +29920,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path58.posix.dirname(remotePath);
+    const remoteDir = path59.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -29828,7 +29956,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process27 = require("child_process");
 var import_util6 = require("util");
-var path59 = __toESM(require("path"));
+var path60 = __toESM(require("path"));
 var execFileP8 = (0, import_util6.promisify)(import_child_process27.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -30088,7 +30216,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path59.posix.dirname(remotePath);
+    const remoteDir = path60.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -30156,7 +30284,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process28 = require("child_process");
 var import_util7 = require("util");
-var path60 = __toESM(require("path"));
+var path61 = __toESM(require("path"));
 var execFileP9 = (0, import_util7.promisify)(import_child_process28.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -30392,7 +30520,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path60.posix.dirname(remotePath);
+    const remoteDir = path61.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -31038,8 +31166,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto8 = require("crypto");
-var fs51 = __toESM(require("fs"));
-var path61 = __toESM(require("path"));
+var fs52 = __toESM(require("fs"));
+var path62 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -31095,13 +31223,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path61.join(require("os").homedir(), ".codeam");
+  const dir = path62.join(require("os").homedir(), ".codeam");
   try {
-    fs51.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path61.join(dir, ".doctor-probe");
-    fs51.writeFileSync(probe, "ok", { mode: 384 });
-    const read2 = fs51.readFileSync(probe, "utf8");
-    fs51.unlinkSync(probe);
+    fs52.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path62.join(dir, ".doctor-probe");
+    fs52.writeFileSync(probe, "ok", { mode: 384 });
+    const read2 = fs52.readFileSync(probe, "utf8");
+    fs52.unlinkSync(probe);
     if (read2 !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -31165,7 +31293,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path61.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path62.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -31207,7 +31335,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.52.5" : "0.0.0-dev";
+  const cliVersion = true ? "2.52.7" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -31406,7 +31534,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.52.5" : "unknown";
+  const v = true ? "2.52.7" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.52.5",
+  "version": "2.52.7",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",