codeam-cli 2.60.21 → 2.60.23

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.22] — 2026-07-09
+
+### Fixed
+
+- **cli:** Baton — late-bind Codex's session id instead of blocking start()
+
+## [2.60.21] — 2026-07-09
+
+### Fixed
+
+- **cli:** Baton — discover Codex's self-minted session id (first-turn aware)
+
 ## [2.60.20] — 2026-07-09
 
 ### Fixed

package/dist/index.js

@@ -5680,7 +5680,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.21" : "0.0.0-dev",
+    cliVersion: true ? "2.60.23" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5861,7 +5861,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.21",
+  version: "2.60.23",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6932,7 +6932,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.21" ? { ideVersion: "2.60.21" } : {}
+      ..."2.60.23" ? { ideVersion: "2.60.23" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -13420,7 +13420,7 @@ function coderabbitLoginLauncher(os49) {
       return ensureCoderabbitInstalled(os49);
     },
     launch() {
-      return (0, import_node_child_process7.spawn)("coderabbit", ["login"], { stdio: "inherit" });
+      return (0, import_node_child_process7.spawn)("coderabbit", ["auth", "login"], { stdio: "inherit" });
     }
   };
 }
@@ -13429,31 +13429,166 @@ function coderabbitLoginLauncher(os49) {
 var HUNK_LINE_RE = /^([^\s:][^:]*?):(\d+)[\s:—-]+(?:\[?(info|warn|warning|error|critical)\]?[:\s—-]+)?(.+)$/i;
 var SEVERITY_MAP = {
   info: "info",
+  note: "info",
+  low: "info",
+  minor: "info",
   warn: "warn",
   warning: "warn",
+  medium: "warn",
+  major: "warn",
   error: "error",
-  critical: "error"
+  critical: "error",
+  high: "error",
+  blocker: "error"
 };
-function parseReview(stdout) {
+function normSeverity(v) {
+  if (typeof v !== "string") return void 0;
+  return SEVERITY_MAP[v.trim().toLowerCase()];
+}
+function pick(obj, keys) {
+  for (const k2 of keys) {
+    if (obj[k2] !== void 0 && obj[k2] !== null) return obj[k2];
+  }
+  return void 0;
+}
+function asString(v) {
+  return typeof v === "string" && v.trim().length > 0 ? v : void 0;
+}
+function pickLine(obj) {
+  const direct = pick(obj, ["line", "start_line", "startLine", "line_number", "lineNumber"]);
+  if (typeof direct === "number") return direct;
+  if (typeof direct === "string" && /^\d+$/.test(direct)) return Number(direct);
+  const range = pick(obj, ["line_range", "lineRange", "range", "lines"]);
+  if (Array.isArray(range) && typeof range[0] === "number") return range[0];
+  if (range && typeof range === "object") {
+    const start2 = pick(range, ["start", "begin", "from"]);
+    if (typeof start2 === "number") return start2;
+    if (start2 && typeof start2 === "object") {
+      const l = start2.line;
+      if (typeof l === "number") return l;
+    }
+  }
+  return void 0;
+}
+function toHunk(raw, groupSeverity) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  const path70 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path70) return null;
+  const message = asString(pick(o, ["comment", "message", "body", "description", "summary", "markdown", "text"])) ?? "";
+  const title = asString(pick(o, ["title", "rule", "category", "check"]));
+  const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
+  const locObj = pick(o, ["location"]) ?? o;
+  return {
+    path: path70.trim(),
+    line: pickLine(o) ?? pickLine(locObj),
+    severity,
+    message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
+  };
+}
+function findingsFrom(value) {
+  const out2 = [];
+  if (!value || typeof value !== "object") return out2;
+  const root = value;
+  const flat = pick(root, ["findings", "comments", "issues", "results", "review_comments", "reviewComments"]);
+  if (Array.isArray(flat)) {
+    for (const f of flat) {
+      const h = toHunk(f);
+      if (h) out2.push(h);
+    }
+  }
+  const grouped = flat && !Array.isArray(flat) ? flat : root;
+  for (const sev of ["critical", "warning", "warn", "error", "info", "note"]) {
+    const bucket = grouped[sev];
+    if (Array.isArray(bucket)) {
+      for (const f of bucket) {
+        const h = toHunk(f, sev);
+        if (h) out2.push(h);
+      }
+    }
+  }
+  return out2;
+}
+function errorFrom(obj) {
+  if (obj.type !== "error") return void 0;
+  return asString(pick(obj, ["message", "error"]));
+}
+function isControlEvent(obj) {
+  return obj.type === "review_context" || obj.type === "status" || obj.type === "progress" || obj.type === "error";
+}
+function parseStructured(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed || trimmed[0] !== "{" && trimmed[0] !== "[") return null;
+  try {
+    const doc = JSON.parse(trimmed);
+    const hunks2 = findingsFrom(Array.isArray(doc) ? { findings: doc } : doc);
+    const summary2 = asString(
+      pick(Array.isArray(doc) ? {} : doc, ["summary", "markdown", "report", "overview"])
+    );
+    if (hunks2.length > 0 || summary2) return { hunks: hunks2, summary: summary2 };
+  } catch {
+  }
   const hunks = [];
-  const lines = stdout.split(/\r?\n/);
-  for (const line of lines) {
+  let summary;
+  let error;
+  let sawJson = false;
+  for (const line of trimmed.split(/\r?\n/)) {
+    const l = line.trim();
+    if (!l || l[0] !== "{" && l[0] !== "[") continue;
+    try {
+      const obj = JSON.parse(l);
+      sawJson = true;
+      const rec = Array.isArray(obj) ? {} : obj;
+      error ??= errorFrom(rec);
+      if (isControlEvent(rec)) continue;
+      const found = findingsFrom(Array.isArray(obj) ? { findings: obj } : obj);
+      if (found.length > 0) hunks.push(...found);
+      else {
+        const single = toHunk(obj);
+        if (single) hunks.push(single);
+      }
+      summary ??= asString(pick(rec, ["summary", "markdown", "report"]));
+    } catch {
+    }
+  }
+  return sawJson ? { hunks, summary, error } : null;
+}
+function parsePlain(stdout) {
+  const hunks = [];
+  for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
     const [, path70, lineNo, sevToken, message] = m;
     if (!path70 || !lineNo || !message) continue;
-    const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
       path: path70.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
-      message: cleanedMessage
+      message: message.trim().replace(/^[*-]\s+/, "")
     });
   }
+  return hunks;
+}
+function severityCounts(hunks) {
+  const c2 = { error: 0, warn: 0, info: 0 };
+  for (const h of hunks) if (h.severity) c2[h.severity] += 1;
+  return c2;
+}
+function parseReview(stdout) {
+  const structured = parseStructured(stdout);
+  const hunks = structured && structured.hunks.length > 0 ? structured.hunks : parsePlain(stdout);
+  const counts = severityCounts(hunks);
+  const markdown = (structured?.summary ?? (hunks.length === 0 && structured?.error ? structured.error : stdout)).trim();
   return {
-    markdown: stdout.trim(),
+    markdown,
     hunks,
-    stats: { linesReviewed: lines.length, hunkCount: hunks.length }
+    stats: {
+      findingCount: hunks.length,
+      critical: counts.error,
+      warning: counts.warn,
+      info: counts.info,
+      ...structured?.error ? { error: structured.error } : {}
+    }
   };
 }
 
@@ -13467,7 +13602,7 @@ var CoderabbitRuntimeStrategy = class {
     this.os = os49;
   }
   getDefaultArgs() {
-    return ["review"];
+    return ["review", "--agent"];
   }
   async prepareInvocation(input) {
     const binary = this.os.findInPath(this.meta.binaryName);
@@ -13476,14 +13611,12 @@ var CoderabbitRuntimeStrategy = class {
         `CodeRabbit binary "${this.meta.binaryName}" not on PATH. Run \`codeam link coderabbit\` to install it first.`
       );
     }
-    const args2 = this.getDefaultArgs();
-    if (input.prRef) args2.push("--pr", input.prRef);
-    if (input.files && input.files.length > 0) {
-      args2.push(...input.files);
-    }
-    if (input.prompt) {
-      args2.push("--message", input.prompt);
-    }
+    const args2 = input.structured === false ? ["review", "--plain"] : this.getDefaultArgs();
+    if (input.changeSet) args2.push("--type", input.changeSet);
+    if (input.base) args2.push("--base", input.base);
+    if (input.baseCommit) args2.push("--base-commit", input.baseCommit);
+    if (input.dir) args2.push("--dir", input.dir);
+    if (input.apiKey) args2.push("--api-key", input.apiKey);
     if (input.extraArgs && input.extraArgs.length > 0) {
       args2.push(...input.extraArgs);
     }
@@ -13791,10 +13924,20 @@ var CursorRuntimeStrategy = class {
    * failure. `cursor-agent create-chat` prints a bare UUID and exits 0 (verified
    * on cursor-agent 2026.06.24). Synchronous + bounded so prepareLaunch stays a
    * single deterministic step; a timeout/parse failure just disables pre-mint.
+   *
+   * ⚠️ Windows: `findInPath` resolves `cursor-agent.cmd` (or `.ps1`) via PATHEXT,
+   * and Windows CANNOT spawn a `.cmd`/`.bat`/`.ps1` directly — it needs
+   * `cmd.exe /c` / `powershell -File`. Spawning `binary` raw (as this used to)
+   * failed with EINVAL on Windows → null id → no pre-mint → the baton threw
+   * "agent did not expose a session id after spawn" (Windows-only). Route the
+   * spawn through `os.buildLaunch`, exactly like the TUI launch above, so the
+   * command is wrapped correctly per-platform. On macOS/Linux buildLaunch returns
+   * the bare `{cmd: binary, args: ['create-chat']}` → behaviour unchanged.
    */
   mintChatId(binary) {
     try {
-      const r = (0, import_node_child_process10.spawnSync)(binary, ["create-chat"], {
+      const launch = this.os.buildLaunch(binary, ["create-chat"]);
+      const r = (0, import_node_child_process10.spawnSync)(launch.cmd, launch.args, {
         encoding: "utf8",
         timeout: 2e4,
         stdio: ["ignore", "pipe", "pipe"]
@@ -16733,7 +16876,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.21" : null;
+  const current = true ? "2.60.23" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -16750,7 +16893,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.21" : null;
+  const current = true ? "2.60.23" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -16770,7 +16913,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.21" : null;
+  return true ? "2.60.23" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -30118,6 +30261,20 @@ var BatonController = class {
     this._active = "local_tui";
     this.setState("LOCAL_DRIVE");
   }
+  /**
+   * Late-bind the conversation id for an agent (Codex) that minted it only on the
+   * user's first turn, so `begin()` returned null. Fires from the native driver's
+   * background discovery. Idempotent + guarded: only binds while we're still in
+   * the INITIAL, id-less LOCAL_DRIVE — if the user already took control (which
+   * started its own session) or an id is already set, it's a no-op, so a stray
+   * native id can never clobber the live conversation. Re-publishes LOCAL_DRIVE so
+   * the read-only mirror arms on the now-known id.
+   */
+  rebindConversation(conversationId) {
+    if (this._conversationId !== null || this._state !== "LOCAL_DRIVE") return;
+    this._conversationId = conversationId;
+    this.setState("LOCAL_DRIVE");
+  }
   async takeControl() {
     await this.switchDriver(
       "LOCAL_DRIVE",
@@ -30179,7 +30336,7 @@ function parkTerminalForReadonly(term = {}) {
 }
 
 // src/baton/native-tui-driver.ts
-var NativeTuiDriver = class {
+var NativeTuiDriver = class _NativeTuiDriver {
   constructor(deps) {
     this.deps = deps;
     this.agent = deps.agent;
@@ -30208,6 +30365,9 @@ var NativeTuiDriver = class {
   idleMs;
   now;
   lastOutput;
+  /** How long `start()` waits for a boot-time session store (Kimi) before
+   *  falling back to background/late-bind discovery (Codex, first-turn store). */
+  static QUICK_DISCOVER_MS = 8e3;
   outputSvc;
   historySvc;
   setKeepAlive;
@@ -30222,11 +30382,20 @@ var NativeTuiDriver = class {
     await this.agent.spawn();
     const preMinted = this.agent.spawnedSessionId;
     if (preMinted) return preMinted;
-    const discovered = await this.deps.runtime.discoverSessionId?.(this.deps.opts.cwd, {
-      sinceMs: spawnedAt
+    const discover = this.deps.runtime.discoverSessionId;
+    if (!discover) {
+      throw new Error("NativeTuiDriver: agent did not expose a session id after spawn");
+    }
+    const quick = await discover(this.deps.opts.cwd, {
+      sinceMs: spawnedAt,
+      timeoutMs: _NativeTuiDriver.QUICK_DISCOVER_MS
     });
-    if (discovered) return discovered;
-    throw new Error("NativeTuiDriver: agent did not expose a session id after spawn");
+    if (quick) return quick;
+    void discover(this.deps.opts.cwd, { sinceMs: spawnedAt }).then((id) => {
+      if (id) this.deps.onLateBind?.(id);
+    }).catch(() => {
+    });
+    return null;
   }
   async stop() {
     this.agent.kill();
@@ -30640,7 +30809,12 @@ async function runBatonSession(opts) {
       cwd: opts.cwd
     },
     getRelay: () => relay,
-    getBeads: opts.getBeads ?? (() => null)
+    getBeads: opts.getBeads ?? (() => null),
+    // Late-bind for first-turn-minted ids (Codex): the background discovery
+    // calls this once the user's first terminal turn creates the transcript.
+    // Safe forward-ref — `controller` is initialised long before `begin()` runs,
+    // and onLateBind only fires from inside `begin()`'s spawn.
+    onLateBind: (id) => controller.rebindConversation(id)
   });
   let mirror = null;
   let firstLocalDrive = true;
@@ -33632,7 +33806,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.21" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.23" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -33831,7 +34005,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.21" : "unknown";
+  const v = true ? "2.60.23" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.21",
+  "version": "2.60.23",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",