codeam-cli 2.53.4 → 2.55.1

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.54.0] — 2026-07-06
+
+### Added
+
+- **shared:** Rename to @codeam/shared and make it publishable to npm (Phase 2 PR-0)
+- **shared:** Agent capability flags + identity module + headroom manifest + beads superset (Phase 2 PR-1)
+
+### Fixed
+
+- **cli:** Windows CI green — derive claude exe suffix from platformKey; win32-native install-target expectations
+- **cli:** Self-update can actually spawn npm on Windows — shell for the .cmd shim
+
+## [2.53.4] — 2026-07-06
+
+### Fixed
+
+- **jetbrains:** Eliminate all 8 internal-API usages flagged by Plugin Verifier
+- **shared:** Phase 1 anti-drift — sync wire contracts, USER_EVENTS constants, zod RemoteCommand guard, JB respondWith + drift tests
+
+### Tests
+
+- **cli:** Backend contract fixtures for beads_action + migrate off deprecated BeadsActionPayload alias
+
 ## [2.53.3] — 2026-07-06
 
 ### Fixed

package/dist/index.js

@@ -199,20 +199,6 @@ function renderToLines(raw) {
   return screen;
 }
 
-// ../../packages/shared/src/protocol/remote-command.ts
-var import_zod = require("zod");
-var remoteCommandSchema = import_zod.z.object({
-  id: import_zod.z.string(),
-  sessionId: import_zod.z.string(),
-  pluginId: import_zod.z.string(),
-  type: import_zod.z.string(),
-  // The backend may omit `payload` (or send null) for payload-less commands;
-  // clients have always normalized that to `{}` — keep that behavior here.
-  payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).nullish(),
-  status: import_zod.z.string(),
-  createdAt: import_zod.z.number()
-});
-
 // ../../packages/shared/src/models/pricing.ts
 var MODEL_PRICING = {
   // ── Anthropic / Claude ────────────────────────────────────
@@ -295,7 +281,11 @@ var AGENT_REGISTRY = {
     // capabilities). `setup_token` is the bare `sk-ant-oat01-…` from
     // `claude setup-token` → delivered via CLAUDE_CODE_OAUTH_TOKEN.
     supportedAuthKinds: ["setup_token", "oauth_token", "api_key"],
-    preferredAuthKind: "setup_token"
+    preferredAuthKind: "setup_token",
+    headroomWrappable: true,
+    headroomKind: "claude",
+    // npm adapter `@agentclientprotocol/claude-agent-acp`.
+    acp: true
   },
   codex: {
     id: "codex",
@@ -303,7 +293,15 @@ var AGENT_REGISTRY = {
     binaryName: "codex",
     enabled: true,
     supportedAuthKinds: ["oauth_token", "api_key"],
-    preferredAuthKind: "oauth_token"
+    preferredAuthKind: "oauth_token",
+    headroomWrappable: true,
+    headroomKind: "codex",
+    // npm adapter `@agentclientprotocol/codex-acp`.
+    acp: true,
+    // OAuth device-code flow; the user_code on the OpenAI page IS a real
+    // human-typed code — surfaces render it (with a copy affordance).
+    deviceFlow: true,
+    showsUserCode: true
   },
   copilot: {
     id: "copilot",
@@ -311,7 +309,12 @@ var AGENT_REGISTRY = {
     binaryName: "gh",
     enabled: false,
     supportedAuthKinds: ["oauth_token"],
-    preferredAuthKind: "oauth_token"
+    preferredAuthKind: "oauth_token",
+    // `headroom init --global copilot` exists even though the agent is
+    // still disabled here (no runtime builder yet).
+    headroomWrappable: true,
+    headroomKind: "copilot",
+    acp: false
   },
   coderabbit: {
     id: "coderabbit",
@@ -321,7 +324,10 @@ var AGENT_REGISTRY = {
     // Backend registry is authoritative: CodeRabbit links via a real
     // API key only (no OAuth flow exists in api-v2).
     supportedAuthKinds: ["api_key"],
-    preferredAuthKind: "api_key"
+    preferredAuthKind: "api_key",
+    headroomWrappable: false,
+    // Legacy PTY runtime — no ACP adapter registered.
+    acp: false
   },
   cursor: {
     id: "cursor",
@@ -334,7 +340,16 @@ var AGENT_REGISTRY = {
     // api_key rows may still exist server-side, but the link surface
     // no longer offers api_key.
     supportedAuthKinds: ["oauth_token"],
-    preferredAuthKind: "oauth_token"
+    preferredAuthKind: "oauth_token",
+    // `headroom wrap cursor` is "manual/print-only" (IDE settings; the
+    // headless cursor-agent CLI has no base-URL override) — runs native.
+    headroomWrappable: false,
+    // Native ACP server: `cursor-agent acp`.
+    acp: true,
+    // Reverse-engineered device/poll flow; `userCode` is the secret PKCE
+    // verifier echoed back on poll — NEVER human-facing.
+    deviceFlow: true,
+    showsUserCode: false
   },
   aider: {
     id: "aider",
@@ -345,7 +360,10 @@ var AGENT_REGISTRY = {
     // / etc. env vars or `~/.aider.conf.yml`. The link flow surfaces
     // this via the existing --api-key escape hatch in commands/link.ts.
     supportedAuthKinds: ["api_key"],
-    preferredAuthKind: "api_key"
+    preferredAuthKind: "api_key",
+    headroomWrappable: false,
+    // Legacy PTY runtime — no ACP adapter registered.
+    acp: false
   },
   gemini: {
     id: "gemini",
@@ -357,7 +375,11 @@ var AGENT_REGISTRY = {
     // accepted by the backend's GeminiProvisioningStrategy and propagated
     // into codespace deploys.
     supportedAuthKinds: ["oauth_token", "api_key"],
-    preferredAuthKind: "oauth_token"
+    preferredAuthKind: "oauth_token",
+    // Not listed by `headroom wrap --help` — runs native.
+    headroomWrappable: false,
+    // Native ACP server: `gemini --skip-trust --acp`.
+    acp: true
   }
 };
 function getEnabledAgents() {
@@ -372,6 +394,56 @@ function isKnownAgentId(id) {
   return id in AGENT_REGISTRY;
 }
 
+// ../../packages/shared/src/agents/identity.ts
+var HOUSE_AGENT_ID = "house-codeagent-cloud";
+var PUBLIC_TO_INTERNAL = {
+  claude_code: "claude",
+  // CLI-side extra: self-hosted deploy payloads may carry the internal id.
+  claude: "claude",
+  codex: "codex",
+  // CLI-side extra: copilot has no public LinkedAgentId (backend doesn't
+  // expose it) but the self-hosted path accepts it.
+  copilot: "copilot",
+  cursor: "cursor",
+  aider: "aider",
+  coderabbit: "coderabbit",
+  gemini: "gemini",
+  // The house agent runs Claude Code under the hood (pointed at the
+  // MiniMax proxy). Its internal runtime is therefore `claude`.
+  [HOUSE_AGENT_ID]: "claude"
+};
+var TERMINAL_AGENT_PREFIX = "__terminal__:";
+var AGENT_ID_ALIASES = {
+  claude_code: "claude",
+  "claude-code": "claude",
+  "anthropic.claude-code": "claude",
+  "anthropics.claude": "claude",
+  "anthropic.claude-ce": "claude",
+  "anthropic.claude": "claude",
+  "com.anthropic.claudecode": "claude",
+  "com.anthropic.claude": "claude",
+  "openai.chatgpt": "codex",
+  "coderabbitai.coderabbit-vscode": "coderabbit"
+};
+function normalizeAgentId(raw) {
+  const value = (raw ?? "").trim().toLowerCase();
+  if (!value) return null;
+  if (isKnownAgentId(value)) return value;
+  const unprefixed = value.startsWith(TERMINAL_AGENT_PREFIX) ? value.slice(TERMINAL_AGENT_PREFIX.length) : value;
+  if (isKnownAgentId(unprefixed)) return unprefixed;
+  return AGENT_ID_ALIASES[unprefixed] ?? null;
+}
+function headroomKindFor(agentId) {
+  const normalized = (agentId ?? "").toLowerCase().replace(/[_-]/g, "");
+  if (!normalized) return null;
+  for (const meta of Object.values(AGENT_REGISTRY)) {
+    if (meta.headroomKind !== void 0 && normalized.startsWith(meta.id)) {
+      return meta.headroomKind;
+    }
+  }
+  return null;
+}
+
 // ../../packages/shared/src/api-url.ts
 var DEFAULT_API_BASE_URL = "https://api.codeagent-mobile.com";
 var DEV_API_BASE_URL = "https://dev-api.codeagent-mobile.com";
@@ -384,6 +456,44 @@ function resolveApiBaseUrl() {
   return DEFAULT_API_BASE_URL;
 }
 
+// ../../packages/shared/src/headroom/manifest.ts
+var HEADROOM_PIP_COMPANIONS = [
+  "fastapi",
+  "uvicorn",
+  "httpx[http2]",
+  "websockets",
+  "zstandard"
+];
+var HEADROOM_EXTRAS_BY_SURFACE = {
+  codespace: ["proxy", "code"],
+  selfHosted: ["proxy", "code"],
+  onDemand: ["proxy", "code", "image"]
+};
+function headroomPipPackage(extras) {
+  return `headroom-ai[${extras.join(",")}]`;
+}
+var HEADROOM_MODELS = [
+  {
+    repo: "chopratejas/kompress-v2-base",
+    allowPatterns: ["*.json", "onnx/*.onnx", "kompress-int8-wo.onnx"]
+  },
+  {
+    repo: "answerdotai/ModernBERT-base",
+    allowPatterns: ["*.json", "tokenizer*", "*.txt", "vocab*", "merges*"]
+  }
+];
+function headroomSnapshotDownloadLine(model, opts = {}) {
+  const sep7 = opts.spaceAfterComma ? ", " : ",";
+  const patterns = model.allowPatterns.map((p2) => `"${p2}"`).join(sep7);
+  return `snapshot_download("${model.repo}", allow_patterns=[${patterns}])`;
+}
+function headroomModelPredownloadScript(opts = {}) {
+  return [
+    "from huggingface_hub import snapshot_download",
+    ...HEADROOM_MODELS.map((m) => headroomSnapshotDownloadLine(m, opts))
+  ].join("\n");
+}
+
 // ../../packages/shared/src/types/events.ts
 var USER_EVENTS = {
   PAIRED_SESSION_STATUS: "paired_session_status",
@@ -5511,7 +5621,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.53.4" : "0.0.0-dev",
+    cliVersion: true ? "2.55.1" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5692,7 +5802,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.53.4",
+  version: "2.55.1",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5780,7 +5890,7 @@ var package_default = {
     "@beads/bd": "1.0.5"
   },
   devDependencies: {
-    "@codeagent/shared": "*",
+    "@codeam/shared": "*",
     "@types/node": "^22.0.0",
     "@types/qrcode-terminal": "^0.12.0",
     "@types/which": "^3.0.4",
@@ -6045,6 +6155,8 @@ async function postBeadsProvisioning(input) {
   try {
     await _transport.postJsonAuthed(
       `${API_BASE}/api/beads/provisioning`,
+      // The CLI is the producer of this hop — the body is the shared wire
+      // shape (`@codeam/shared` `BeadsProvisioningPayload`), validated here.
       {
         sessionId: input.sessionId,
         pluginId: input.pluginId,
@@ -6726,7 +6838,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.53.4" ? { ideVersion: "2.53.4" } : {}
+      ..."2.55.1" ? { ideVersion: "2.55.1" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -8108,68 +8220,68 @@ var import_child_process22 = require("child_process");
 var import_which2 = __toESM(require("which"));
 
 // src/lib/payload.ts
-var import_zod2 = require("zod");
-var fileEntrySchema = import_zod2.z.object({
-  filename: import_zod2.z.string().min(1).max(256),
-  mimeType: import_zod2.z.string(),
-  base64: import_zod2.z.string()
+var import_zod = require("zod");
+var fileEntrySchema = import_zod.z.object({
+  filename: import_zod.z.string().min(1).max(256),
+  mimeType: import_zod.z.string(),
+  base64: import_zod.z.string()
 });
-var startCommandSchema = import_zod2.z.object({
-  prompt: import_zod2.z.string().optional(),
-  files: import_zod2.z.array(fileEntrySchema).optional(),
-  input: import_zod2.z.string().optional(),
-  index: import_zod2.z.number().optional(),
-  from: import_zod2.z.number().optional(),
-  id: import_zod2.z.string().optional(),
-  auto: import_zod2.z.boolean().optional(),
+var startCommandSchema = import_zod.z.object({
+  prompt: import_zod.z.string().optional(),
+  files: import_zod.z.array(fileEntrySchema).optional(),
+  input: import_zod.z.string().optional(),
+  index: import_zod.z.number().optional(),
+  from: import_zod.z.number().optional(),
+  id: import_zod.z.string().optional(),
+  auto: import_zod.z.boolean().optional(),
   // `read_file` / `write_file` for the mobile + landing mini-IDE modal.
   // `path` is bounded to 4096 chars (a comfortable POSIX path max) so a
   // malformed payload can't blow up the disk-side validator.
-  path: import_zod2.z.string().min(1).max(4096).optional(),
-  content: import_zod2.z.string().optional(),
+  path: import_zod.z.string().min(1).max(4096).optional(),
+  content: import_zod.z.string().optional(),
   // Mini-IDE / project ops. `paths` (plural, strings) is used for
   // git_commit's optional file selection — distinct from `files`
   // (FileEntry[]) used by `start_task` for attachments.
-  query: import_zod2.z.string().max(256).optional(),
-  message: import_zod2.z.string().max(8e3).optional(),
-  paths: import_zod2.z.array(import_zod2.z.string().max(4096)).optional(),
+  query: import_zod.z.string().max(256).optional(),
+  message: import_zod.z.string().max(8e3).optional(),
+  paths: import_zod.z.array(import_zod.z.string().max(4096)).optional(),
   // `show_install_command` — backend pushes the self-hosted install
   // one-liner the user copies onto their own box. DISPLAY-ONLY: the
   // CLI prints it to the terminal and never executes it. Bounded to
   // 8192 chars so a malformed payload can't flood the terminal.
-  command: import_zod2.z.string().min(1).max(8192).optional(),
-  side: import_zod2.z.enum(["ours", "theirs"]).optional(),
-  limit: import_zod2.z.number().int().min(1).max(500).optional(),
+  command: import_zod.z.string().min(1).max(8192).optional(),
+  side: import_zod.z.enum(["ours", "theirs"]).optional(),
+  limit: import_zod.z.number().int().min(1).max(500).optional(),
   // search_files options. `query` is the haystack/needle string,
   // declared above for list_files. The rest mirror VS Code's
   // search panel toggles + the @codeam/ide-core SearchOptions
   // contract.
-  caseSensitive: import_zod2.z.boolean().optional(),
-  wholeWord: import_zod2.z.boolean().optional(),
-  regex: import_zod2.z.boolean().optional(),
-  include: import_zod2.z.array(import_zod2.z.string().max(512)).max(64).optional(),
-  exclude: import_zod2.z.array(import_zod2.z.string().max(512)).max(64).optional(),
-  maxResults: import_zod2.z.number().int().min(1).max(500).optional(),
+  caseSensitive: import_zod.z.boolean().optional(),
+  wholeWord: import_zod.z.boolean().optional(),
+  regex: import_zod.z.boolean().optional(),
+  include: import_zod.z.array(import_zod.z.string().max(512)).max(64).optional(),
+  exclude: import_zod.z.array(import_zod.z.string().max(512)).max(64).optional(),
+  maxResults: import_zod.z.number().int().min(1).max(500).optional(),
   // terminal_open / _write / _resize / _close. `sessionId` is the
   // opaque uuid returned by `terminal_open` and required by every
   // subsequent op. `data` carries keystrokes (any UTF-8 string).
   // `cwd` lets the host pin the spawn directory.
-  sessionId: import_zod2.z.string().min(1).max(128).optional(),
-  data: import_zod2.z.string().max(64 * 1024).optional(),
-  cwd: import_zod2.z.string().max(4096).optional(),
-  cols: import_zod2.z.number().int().min(1).max(500).optional(),
-  rows: import_zod2.z.number().int().min(1).max(200).optional(),
+  sessionId: import_zod.z.string().min(1).max(128).optional(),
+  data: import_zod.z.string().max(64 * 1024).optional(),
+  cwd: import_zod.z.string().max(4096).optional(),
+  cols: import_zod.z.number().int().min(1).max(500).optional(),
+  rows: import_zod.z.number().int().min(1).max(200).optional(),
   // `apply_file_review` (Epic B follow-up — backend pushes this when
   // the user clicks APPROVE_CHANGES / REJECT_CHANGES in the diff
   // drawer). `filePath` is relative to the enclosing git repo; the
   // handler walks up from it to find `.git/` and runs `git add` or
   // `git restore` from there. `action='approved'` stages the edit,
   // `action='rejected'` discards every worktree change on the file.
-  filePath: import_zod2.z.string().min(1).max(4096).optional(),
-  action: import_zod2.z.enum(["approved", "rejected", "enable", "disable", "status"]).optional(),
+  filePath: import_zod.z.string().min(1).max(4096).optional(),
+  action: import_zod.z.enum(["approved", "rejected", "enable", "disable", "status"]).optional(),
   // `headroom_configure` — savings ingest URL delivered from the session
   // when enabling Headroom on-demand. Bounded to 2048 chars.
-  savingsIngestUrl: import_zod2.z.string().url().max(2048).optional(),
+  savingsIngestUrl: import_zod.z.string().url().max(2048).optional(),
   // `request_link_credentials` — backend fires this from the
   // heartbeat handler when it notices the user is running an agent
   // they haven't vaulted yet. Also reused by `get_context` /
@@ -8185,7 +8297,7 @@ var startCommandSchema = import_zod2.z.object({
   // Without nullable() zod rejects the whole payload, the dispatcher
   // logs "Ignoring malformed list_models payload" and the model
   // picker / context never load.
-  agentId: import_zod2.z.string().max(64).nullable().optional(),
+  agentId: import_zod.z.string().max(64).nullable().optional(),
   // `request_ai_summary` / `request_ai_insight` — backend fires
   // these on turn-end (+ file selection) when LinkedAgent.
   // aiInsightsEnabled is true. The CLI spawns the agent in
@@ -8199,37 +8311,37 @@ var startCommandSchema = import_zod2.z.object({
   // unchanged on the result POST so the backend doesn't have to
   // recompute (numbers came from file_changes; the agent only
   // writes the narrative).
-  turnId: import_zod2.z.string().max(128).optional(),
-  fileChangeId: import_zod2.z.string().max(128).optional(),
-  stats: import_zod2.z.object({
-    added: import_zod2.z.number().int(),
-    removed: import_zod2.z.number().int(),
-    complexityShift: import_zod2.z.number().int()
+  turnId: import_zod.z.string().max(128).optional(),
+  fileChangeId: import_zod.z.string().max(128).optional(),
+  stats: import_zod.z.object({
+    added: import_zod.z.number().int(),
+    removed: import_zod.z.number().int(),
+    complexityShift: import_zod.z.number().int()
   }).optional(),
   // `preview_start` carries the agent-detected `PreviewDetection`
   // shape from the mobile / web confirmation sheet. Mirrors
-  // `@codeagent/shared`'s `PreviewDetection` byte-for-byte. Kept
+  // `@codeam/shared`'s `PreviewDetection` byte-for-byte. Kept
   // loose (`unknown` for env / setup_commands) so a CLI version
   // running against a newer backend that adds optional fields still
   // accepts the payload; the handler validates the shape it needs
   // before spawning.
-  detection: import_zod2.z.object({
-    framework: import_zod2.z.string().max(64),
-    command: import_zod2.z.string().min(1).max(256),
-    args: import_zod2.z.array(import_zod2.z.string().max(1024)).max(64),
-    port: import_zod2.z.number().int().min(1).max(65535),
-    ready_pattern: import_zod2.z.string().min(1).max(4096),
-    env: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string().max(8192)).optional(),
+  detection: import_zod.z.object({
+    framework: import_zod.z.string().max(64),
+    command: import_zod.z.string().min(1).max(256),
+    args: import_zod.z.array(import_zod.z.string().max(1024)).max(64),
+    port: import_zod.z.number().int().min(1).max(65535),
+    ready_pattern: import_zod.z.string().min(1).max(4096),
+    env: import_zod.z.record(import_zod.z.string(), import_zod.z.string().max(8192)).optional(),
     // The agent emits entries as either {cmd,args} objects OR bare command
     // strings ("npx prisma generate"). Accept both and normalize strings to
     // {cmd,args} so a string entry doesn't reject the whole detection (which
     // would silently drop the preview) and downstream always gets objects.
-    setup_commands: import_zod2.z.array(
-      import_zod2.z.union([
-        import_zod2.z.string().min(1).max(1024),
-        import_zod2.z.object({
-          cmd: import_zod2.z.string().min(1).max(256),
-          args: import_zod2.z.array(import_zod2.z.string().max(1024)).max(64)
+    setup_commands: import_zod.z.array(
+      import_zod.z.union([
+        import_zod.z.string().min(1).max(1024),
+        import_zod.z.object({
+          cmd: import_zod.z.string().min(1).max(256),
+          args: import_zod.z.array(import_zod.z.string().max(1024)).max(64)
         })
       ]).transform((entry) => {
         if (typeof entry !== "string") return entry;
@@ -8237,15 +8349,15 @@ var startCommandSchema = import_zod2.z.object({
         return { cmd: parts[0] ?? "", args: parts.slice(1) };
       })
     ).max(32).optional(),
-    notes: import_zod2.z.string().max(4096).nullable().optional()
+    notes: import_zod.z.string().max(4096).nullable().optional()
   }).optional(),
   // `env_write` carries the full desired set of environment variables
   // for the project `.env`. Bounded so a malformed payload can't flood
   // the disk-side serializer. `env_read` / `preview_restart` send no payload.
-  vars: import_zod2.z.array(
-    import_zod2.z.object({
-      key: import_zod2.z.string().min(1).max(256),
-      value: import_zod2.z.string().max(32768)
+  vars: import_zod.z.array(
+    import_zod.z.object({
+      key: import_zod.z.string().min(1).max(256),
+      value: import_zod.z.string().max(32768)
     })
   ).max(512).optional()
 });
@@ -8910,7 +9022,7 @@ __export(dist_exports, {
   S_ERROR: () => ge,
   S_INFO: () => he,
   S_PASSWORD_MASK: () => xe,
-  S_RADIO_ACTIVE: () => z4,
+  S_RADIO_ACTIVE: () => z3,
   S_RADIO_INACTIVE: () => H2,
   S_STEP_ACTIVE: () => _e,
   S_STEP_CANCEL: () => oe,
@@ -9389,7 +9501,7 @@ function w(r, t2) {
   const e = r;
   e.isTTY && e.setRawMode(t2);
 }
-function z3({ input: r = import_node_process.stdin, output: t2 = import_node_process.stdout, overwrite: e = true, hideCursor: s = true } = {}) {
+function z2({ input: r = import_node_process.stdin, output: t2 = import_node_process.stdout, overwrite: e = true, hideCursor: s = true } = {}) {
   const i = _.createInterface({ input: r, output: t2, prompt: "", tabSize: 1 });
   _.emitKeypressEvents(r, i), r instanceof import_node_tty.ReadStream && r.isTTY && r.setRawMode(true);
   const n = (o, { name: a, sequence: h }) => {
@@ -10001,7 +10113,7 @@ var d2 = w2("\u2502", "|");
 var E2 = w2("\u2514", "\u2014");
 var Ie = w2("\u2510", "T");
 var Ee = w2("\u2518", "\u2014");
-var z4 = w2("\u25CF", ">");
+var z3 = w2("\u25CF", ">");
 var H2 = w2("\u25CB", " ");
 var te = w2("\u25FB", "[\u2022]");
 var U = w2("\u25FC", "[+]");
@@ -10093,7 +10205,7 @@ var Ae = (e) => new H({ options: e.options, initialValue: e.initialValue ? [e.in
     const $2 = Me(a), y2 = a.hint && a.value === this.focusedValue ? (0, import_node_util2.styleText)("dim", ` (${a.hint})`) : "";
     switch (l) {
       case "active":
-        return `${(0, import_node_util2.styleText)("green", z4)} ${$2}${y2}`;
+        return `${(0, import_node_util2.styleText)("green", z3)} ${$2}${y2}`;
       case "inactive":
         return `${(0, import_node_util2.styleText)("dim", H2)} ${(0, import_node_util2.styleText)("dim", $2)}`;
       case "disabled":
@@ -10206,9 +10318,9 @@ ${(0, import_node_util2.styleText)("gray", d2)}` : ""}`;
       }
       default: {
         const l = r ? `${(0, import_node_util2.styleText)("cyan", d2)}  ` : "", $2 = r ? (0, import_node_util2.styleText)("cyan", E2) : "";
-        return `${c2}${l}${this.value ? `${(0, import_node_util2.styleText)("green", z4)} ${i}` : `${(0, import_node_util2.styleText)("dim", H2)} ${(0, import_node_util2.styleText)("dim", i)}`}${e.vertical ? r ? `
+        return `${c2}${l}${this.value ? `${(0, import_node_util2.styleText)("green", z3)} ${i}` : `${(0, import_node_util2.styleText)("dim", H2)} ${(0, import_node_util2.styleText)("dim", i)}`}${e.vertical ? r ? `
 ${(0, import_node_util2.styleText)("cyan", d2)}  ` : `
-` : ` ${(0, import_node_util2.styleText)("dim", "/")} `}${this.value ? `${(0, import_node_util2.styleText)("dim", H2)} ${(0, import_node_util2.styleText)("dim", s)}` : `${(0, import_node_util2.styleText)("green", z4)} ${s}`}
+` : ` ${(0, import_node_util2.styleText)("dim", "/")} `}${this.value ? `${(0, import_node_util2.styleText)("dim", H2)} ${(0, import_node_util2.styleText)("dim", s)}` : `${(0, import_node_util2.styleText)("green", z3)} ${s}`}
 ${$2}
 `;
       }
@@ -10539,7 +10651,7 @@ var fe = ({ indicator: e = "dots", onCancel: i, output: s = process.stdout, canc
     const A2 = (performance.now() - _2) / 1e3, k2 = Math.floor(A2 / 60), L2 = Math.floor(A2 % 60);
     return k2 > 0 ? `[${k2}m ${L2}s]` : `[${L2}s]`;
   }, D2 = a.withGuide ?? u.withGuide, ie = (_2 = "") => {
-    p2 = true, $2 = z3({ output: s }), g = R2(_2), h = performance.now(), D2 && s.write(`${(0, import_node_util2.styleText)("gray", d2)}
+    p2 = true, $2 = z2({ output: s }), g = R2(_2), h = performance.now(), D2 && s.write(`${(0, import_node_util2.styleText)("gray", d2)}
 `);
     let A2 = 0, k2 = 0;
     x(), y2 = setInterval(() => {
@@ -10610,7 +10722,7 @@ var _t = (e) => {
       case "selected":
         return `${re(u2, (n) => (0, import_node_util2.styleText)("dim", n))}`;
       case "active":
-        return `${(0, import_node_util2.styleText)("green", z4)} ${u2}${s.hint ? ` ${(0, import_node_util2.styleText)("dim", `(${s.hint})`)}` : ""}`;
+        return `${(0, import_node_util2.styleText)("green", z3)} ${u2}${s.hint ? ` ${(0, import_node_util2.styleText)("dim", `(${s.hint})`)}` : ""}`;
       case "cancelled":
         return `${re(u2, (n) => (0, import_node_util2.styleText)(["strikethrough", "dim"], n))}`;
       default:
@@ -15226,7 +15338,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.53.4" : null;
+  const current = true ? "2.55.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -15243,7 +15355,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.53.4" : null;
+  const current = true ? "2.55.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -15406,7 +15518,10 @@ var CONTROL_AGENT_META = {
   binaryName: "codeam",
   enabled: true,
   supportedAuthKinds: ["oauth_token"],
-  preferredAuthKind: "oauth_token"
+  preferredAuthKind: "oauth_token",
+  // Synthetic control channel — capability flags are moot (no agent runs).
+  headroomWrappable: false,
+  acp: false
 };
 var PEP668_MARKER = "externally-managed-environment";
 var PM_INSTALL_TIMEOUT_MS = 18e4;
@@ -15577,15 +15692,10 @@ async function ensurePip(runner) {
   return true;
 }
 function agentIdToHeadroomKind(agentId) {
-  const normalized = (agentId ?? "").toLowerCase().replace(/[_-]/g, "");
-  if (normalized.startsWith("claude")) return "claude";
-  if (normalized.startsWith("codex")) return "codex";
-  if (normalized.startsWith("copilot")) return "copilot";
-  return "claude";
+  return headroomKindFor(agentId) ?? "claude";
 }
 function isHeadroomSupportedAgent(agentId) {
-  const n = (agentId ?? "").toLowerCase().replace(/[_-]/g, "");
-  return n.startsWith("claude") || n.startsWith("codex") || n.startsWith("copilot");
+  return headroomKindFor(agentId) !== null;
 }
 function headroomConfigPath() {
   return path38.join(os31.homedir(), ".codeam", "headroom-config.json");
@@ -15838,10 +15948,10 @@ async function ensureModernPython(runner) {
   return py;
 }
 async function setupHeadroomForSelfHosted(agent, runner = defaultHeadroomRunner, opts = {}) {
-  const extras = opts.extras ?? ["proxy", "code"];
+  const extras = opts.extras ?? [...HEADROOM_EXTRAS_BY_SURFACE.selfHosted];
   const onProgress = opts.onProgress ?? (() => {
   });
-  const SERVER_DEPS = ["fastapi", "uvicorn", "httpx[http2]", "websockets", "zstandard"];
+  const SERVER_DEPS = HEADROOM_PIP_COMPANIONS;
   const pipAvailable = await ensurePip(runner);
   if (!pipAvailable) {
     return false;
@@ -15866,7 +15976,7 @@ async function setupHeadroomForSelfHosted(agent, runner = defaultHeadroomRunner,
     return false;
   };
   onProgress("pip");
-  const headroomPkg = `headroom-ai[${extras.join(",")}]`;
+  const headroomPkg = headroomPipPackage(extras);
   const installOk = await pipInstall([headroomPkg, ...SERVER_DEPS], [], ENGINE_INSTALL_TIMEOUT_MS);
   if (!installOk) {
     log.warn("host-agent", `headroom engine install failed (${headroomPkg}) \u2014 skipping Headroom`);
@@ -15874,11 +15984,7 @@ async function setupHeadroomForSelfHosted(agent, runner = defaultHeadroomRunner,
   }
   log.info("host-agent", `headroom + ONNX engines installed (${headroomPkg})`);
   onProgress("model");
-  const predownloadPy = [
-    "from huggingface_hub import snapshot_download",
-    'snapshot_download("chopratejas/kompress-v2-base", allow_patterns=["*.json","onnx/*.onnx","kompress-int8-wo.onnx"])',
-    'snapshot_download("answerdotai/ModernBERT-base", allow_patterns=["*.json","tokenizer*","*.txt","vocab*","merges*"])'
-  ].join("\n");
+  const predownloadPy = headroomModelPredownloadScript();
   const dl = await runner.run(py, ["-c", predownloadPy], {
     timeoutMs: ENGINE_INSTALL_TIMEOUT_MS
   });
@@ -15954,7 +16060,7 @@ var defaultSpawner = (env, cwd, args2 = []) => (0, import_node_child_process16.s
   detached: false
 });
 function currentCliVersion() {
-  return true ? "2.53.4" : null;
+  return true ? "2.55.1" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -16666,7 +16772,9 @@ async function configureHeadroom(action, ctx, deps) {
   if (action === "enable") {
     if (!isHeadroomSupportedAgent(ctx.agent)) return { supported: false };
     const ok = await deps.setup(ctx.agent, void 0, {
-      extras: ["proxy", "code", "image"],
+      // On-demand surface ships the extra `image` compression support — see
+      // the shared Headroom manifest (`HEADROOM_EXTRAS_BY_SURFACE`).
+      extras: [...HEADROOM_EXTRAS_BY_SURFACE.onDemand],
       onProgress: (step) => deps.emit({ type: USER_EVENTS.HEADROOM_PROGRESS, step })
     });
     if (!ok) {
@@ -18512,7 +18620,7 @@ var BeadsWatcher = class {
       issues,
       // We don't track edges in the P0 snapshot yet, so send an empty array.
       // (The backend DTO marks `dependencies` optional and tolerates absence,
-      // but the wire contract in @codeagent/shared says "always sent" — keep
+      // but the wire contract in @codeam/shared says "always sent" — keep
       // the payload deterministic.)
       dependencies: [],
       memories: [],
@@ -19119,7 +19227,7 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
   }
   const savingsIngestUrl = parsed.savingsIngestUrl;
   let rawAgentId = ctx.agentId || (typeof parsed.agentId === "string" ? parsed.agentId : "");
-  if (rawAgentId === "claude_code") rawAgentId = "claude";
+  rawAgentId = normalizeAgentId(rawAgentId) ?? rawAgentId;
   let configuredAgent = rawAgentId;
   if (!configuredAgent) {
     try {
@@ -19233,9 +19341,9 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
 var headroomBudgetH = async (ctx, cmd) => {
   const payload = cmd.payload;
   let rawAgentId = ctx.agentId || (typeof payload.agentId === "string" ? payload.agentId : "");
-  if (rawAgentId === "claude_code") rawAgentId = "claude";
+  rawAgentId = normalizeAgentId(rawAgentId) ?? rawAgentId;
   let payloadAgentId = typeof payload.agentId === "string" ? payload.agentId : "";
-  if (payloadAgentId === "claude_code") payloadAgentId = "claude";
+  payloadAgentId = normalizeAgentId(payloadAgentId) ?? payloadAgentId;
   if (!rawAgentId || !isHeadroomSupportedAgent(rawAgentId)) {
     await ctx.relay.sendResult(cmd.id, "completed", { applied: false });
     return;
@@ -19295,7 +19403,7 @@ var beadsConfigureH = async (ctx, cmd, parsed) => {
     return;
   }
   let rawAgentId = ctx.agentId || (typeof parsed.agentId === "string" ? parsed.agentId : "");
-  if (rawAgentId === "claude_code") rawAgentId = "claude";
+  rawAgentId = normalizeAgentId(rawAgentId) ?? rawAgentId;
   const agentIds = rawAgentId && isKnownAgentId(rawAgentId) ? [rawAgentId] : [];
   const deps = {
     provision: async () => {
@@ -19390,12 +19498,14 @@ function buildNpmInstallInvocation(opts) {
 async function runNpmInstallLatest() {
   let lastError = "";
   const invocation = buildNpmInstallInvocation();
+  const useShell = process.platform === "win32";
+  const command2 = useShell && invocation.command.includes(" ") ? `"${invocation.command}"` : invocation.command;
   for (let attempt = 1; attempt <= CLI_UPDATE_MAX_ATTEMPTS; attempt++) {
     const result = await new Promise((resolve7) => {
       (0, import_child_process22.execFile)(
-        invocation.command,
+        command2,
         invocation.args,
-        { timeout: CLI_UPDATE_INSTALL_TIMEOUT_MS },
+        { timeout: CLI_UPDATE_INSTALL_TIMEOUT_MS, shell: useShell },
         (err, _stdout, stderr) => {
           if (!err) {
             resolve7({ ok: true });
@@ -19562,9 +19672,9 @@ var requestLinkCredentialsH = (ctx, _cmd, parsed) => {
     log.trace("auto-link", "skipped \u2014 no pluginAuthToken on this paired session");
     return;
   }
-  const internalId = publicId === "claude_code" ? "claude" : publicId;
-  if (!isKnownAgentId(internalId) || !AGENT_REGISTRY[internalId].enabled) {
-    log.trace("auto-link", `unknown / disabled agent: ${internalId}`);
+  const internalId = normalizeAgentId(publicId);
+  if (!internalId || !AGENT_REGISTRY[internalId].enabled) {
+    log.trace("auto-link", `unknown / disabled agent: ${publicId}`);
     return;
   }
   const pluginAuthToken = ctx.pluginAuthToken;
@@ -21352,7 +21462,7 @@ function resolveClaudeNativeBinary(deps = {}) {
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
   const scopeDir = import_path8.default.dirname(sdkDir);
-  const binName = process.platform === "win32" ? "claude.exe" : "claude";
+  const binName = platformKey.startsWith("win32-") ? "claude.exe" : "claude";
   const candidate = import_path8.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
   return existsSync21(candidate) ? candidate : null;
 }
@@ -21554,15 +21664,15 @@ var path54 = __toESM(require("path"));
 var os40 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
 var http6 = __toESM(require("http"));
-var import_zod3 = require("zod");
-var historyRecordSchema = import_zod3.z.object({
-  type: import_zod3.z.string().optional(),
-  timestamp: import_zod3.z.union([import_zod3.z.string(), import_zod3.z.number()]).optional(),
-  uuid: import_zod3.z.string().optional(),
-  isMeta: import_zod3.z.boolean().optional(),
-  message: import_zod3.z.object({
+var import_zod2 = require("zod");
+var historyRecordSchema = import_zod2.z.object({
+  type: import_zod2.z.string().optional(),
+  timestamp: import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]).optional(),
+  uuid: import_zod2.z.string().optional(),
+  isMeta: import_zod2.z.boolean().optional(),
+  message: import_zod2.z.object({
     // Claude content is either a string or an array of typed blocks.
-    content: import_zod3.z.union([import_zod3.z.string(), import_zod3.z.array(import_zod3.z.unknown())]).optional()
+    content: import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.unknown())]).optional()
   }).passthrough().optional()
 }).passthrough();
 var API_BASE8 = resolveApiBaseUrl();
@@ -31816,7 +31926,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.53.4" : "0.0.0-dev";
+  const cliVersion = true ? "2.55.1" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto8.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -32015,7 +32125,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.53.4" : "unknown";
+  const v = true ? "2.55.1" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.53.4",
+  "version": "2.55.1",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -88,7 +88,7 @@
     "@beads/bd": "1.0.5"
   },
   "devDependencies": {
-    "@codeagent/shared": "*",
+    "@codeam/shared": "*",
     "@types/node": "^22.0.0",
     "@types/qrcode-terminal": "^0.12.0",
     "@types/which": "^3.0.4",