codeam-cli 2.60.41 → 2.60.43

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.42] — 2026-07-10
+
+### Added
+
+- **cli:** CodeRabbit 'provision' action — restore the vaulted credential, no re-login
+
+## [2.60.41] — 2026-07-10
+
+### Fixed
+
+- **cli:** Surface a clean error when a CodeRabbit review times out
+
 ## [2.60.40] — 2026-07-10
 
 ### Added

package/dist/index.js

@@ -5689,7 +5689,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.41" : "0.0.0-dev",
+    cliVersion: true ? "2.60.43" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5870,7 +5870,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.41",
+  version: "2.60.43",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6196,6 +6196,22 @@ async function postHeadroomEvent(input) {
     };
   }
 }
+async function fetchProvisionCredential(input) {
+  try {
+    const res = await _transport.postJsonAuthed(
+      `${API_BASE}/api/plugin/agents/${input.agentId}/provision-credential`,
+      { sessionId: input.sessionId, pluginId: input.pluginId },
+      input.pluginAuthToken
+    );
+    const data = res?.data;
+    if (data && (data.method === "api_key" || data.method === "oauth") && typeof data.credential === "string" && data.credential.length > 0) {
+      return { method: data.method, credential: data.credential };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 async function postCoderabbitEvent(input) {
   try {
     await _transport.postJsonAuthed(
@@ -6963,7 +6979,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.41" ? { ideVersion: "2.60.41" } : {}
+      ..."2.60.43" ? { ideVersion: "2.60.43" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -7190,10 +7206,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir42) {
+function isUnsafeWindowsWatchRoot(dir, homedir43) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir42);
+  const home = norm(homedir43);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -8414,6 +8430,9 @@ var startCommandSchema = import_zod.z.object({
     // loopback so a remote-host `link_oauth` login completes (session-relay).
     "link_deliver_callback",
     "link_apikey",
+    // Restore the caller's already-vaulted CodeRabbit credential onto this
+    // session (no re-login) — fetches from the backend + installs + writes it.
+    "provision",
     "review"
   ]).optional(),
   // `headroom_configure` — savings ingest URL delivered from the session
@@ -12419,8 +12438,8 @@ var ClaudeRuntimeStrategy = class {
     const sessionArgs = ["--session-id", sessionId];
     let launch = buildClaudeLaunch(sessionArgs, this.os);
     if (!launch) {
-      const installed = await ensureClaudeInstalled();
-      if (installed) launch = buildClaudeLaunch(sessionArgs, this.os);
+      const installed2 = await ensureClaudeInstalled();
+      if (installed2) launch = buildClaudeLaunch(sessionArgs, this.os);
     }
     if (!launch) {
       const cmd = this.os.id === "win32" ? "irm https://claude.ai/install.ps1 | iex" : "curl -fsSL https://claude.ai/install.sh | bash";
@@ -15285,8 +15304,8 @@ async function link(args2 = []) {
   }
   const installSpin = dist_exports.spinner();
   installSpin.start(`Checking that ${ctx.binary} is installed...`);
-  const installed = await ctx.launcher.ensureInstalled();
-  if (!installed) {
+  const installed2 = await ctx.launcher.ensureInstalled();
+  if (!installed2) {
     installSpin.stop("Failed");
     showError(`Could not install ${ctx.displayName}. Install it manually then re-run.`);
     process.exit(1);
@@ -15489,6 +15508,8 @@ async function linkDryRunPreflight(ctx) {
 
 // src/agents/coderabbit/configure.ts
 var import_node_child_process15 = require("child_process");
+var import_node_os4 = require("os");
+var import_node_fs5 = require("fs");
 var path36 = __toESM(require("path"));
 
 // src/agents/coderabbit/oauth.ts
@@ -15760,6 +15781,23 @@ function collectChangedFiles(cwd) {
   }
   return [...byPath.values()];
 }
+function restoreCoderabbitOauthBlob(value) {
+  const dir = path36.join((0, import_node_os4.homedir)(), ".coderabbit");
+  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+  let file = "auth.json";
+  let contents = value.trim();
+  if (contents.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(contents);
+      if (typeof parsed.file === "string" && typeof parsed.contents === "string") {
+        file = path36.basename(parsed.file);
+        contents = parsed.contents;
+      }
+    } catch {
+    }
+  }
+  (0, import_node_fs5.writeFileSync)(path36.join(dir, file), contents, { mode: 384 });
+}
 async function configureCoderabbit(input, deps = {}) {
   const os50 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
@@ -15776,7 +15814,7 @@ async function configureCoderabbit(input, deps = {}) {
       path36.join(home, "scoop", "shims")
     ] : [path36.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed = os50.findInPath("coderabbit") !== null;
+  const installed2 = os50.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
@@ -15810,9 +15848,43 @@ async function configureCoderabbit(input, deps = {}) {
       ...stored ? {} : { error: "Signed in, but storing the API key for reuse failed" }
     };
   }
+  if (input.action === "provision") {
+    const res2 = base();
+    const cred = input.provisionCredential;
+    if (!cred || !cred.credential.trim()) {
+      return { ...res2, error: "No vaulted CodeRabbit credential to provision" };
+    }
+    if (!res2.installed) {
+      deps.onEvent?.({ kind: "installing" });
+      const ok = await ensureInstalled(os50);
+      res2.installed = ok;
+      if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
+    }
+    if (cred.method === "api_key") {
+      const login = loginWithApiKey(cred.credential.trim());
+      if (!login.ok) {
+        return {
+          ...res2,
+          loggedIn: false,
+          linked: false,
+          error: login.error ?? "The vaulted CodeRabbit API key was rejected \u2014 re-link it."
+        };
+      }
+      return { ...res2, loggedIn: true, linked: true };
+    }
+    try {
+      restoreCoderabbitOauthBlob(cred.credential);
+    } catch (err) {
+      return {
+        ...res2,
+        error: err instanceof Error ? err.message : "Failed to restore the vaulted credential"
+      };
+    }
+    return { ...res2, loggedIn: true, linked: true };
+  }
   if (input.action === "link_oauth") {
     const res2 = base();
-    if (!installed) {
+    if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
       const ok = await ensureInstalled(os50);
       res2.installed = ok;
@@ -15890,8 +15962,8 @@ var os29 = __toESM(require("os"));
 var path37 = __toESM(require("path"));
 
 // src/lib/restrict-to-owner.ts
-var import_node_fs5 = __toESM(require("fs"));
-var import_node_os4 = __toESM(require("os"));
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_os5 = __toESM(require("os"));
 var import_node_child_process16 = require("child_process");
 var BROAD_WINDOWS_SIDS = [
   "*S-1-1-0",
@@ -15903,7 +15975,7 @@ var BROAD_WINDOWS_SIDS = [
 function restrictToOwner(filePath) {
   try {
     if (process.platform === "win32") {
-      const username = import_node_os4.default.userInfo().username;
+      const username = import_node_os5.default.userInfo().username;
       (0, import_node_child_process16.execFileSync)(
         "icacls",
         [
@@ -15916,7 +15988,7 @@ function restrictToOwner(filePath) {
         { stdio: "ignore" }
       );
     } else {
-      import_node_fs5.default.chmodSync(filePath, 384);
+      import_node_fs6.default.chmodSync(filePath, 384);
     }
   } catch {
   }
@@ -17421,7 +17493,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.41" : null;
+  const current = true ? "2.60.43" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17438,7 +17510,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.41" : null;
+  const current = true ? "2.60.43" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17458,7 +17530,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.41" : null;
+  return true ? "2.60.43" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -17512,8 +17584,8 @@ async function runSelfUpdate() {
       ["view", SELF_UPDATE_PKG, "version"],
       SELF_UPDATE_VIEW_TIMEOUT_MS
     );
-    const installed = after.code === 0 ? after.stdout.trim() || latest : latest;
-    return { status: "updated", version: installed };
+    const installed2 = after.code === 0 ? after.stdout.trim() || latest : latest;
+    return { status: "updated", version: installed2 };
   } catch (err) {
     log.warn(
       "host-agent",
@@ -20776,15 +20848,15 @@ async function handleBeadsActionCommand(action, started) {
 }
 
 // src/beads/config-store.ts
-var import_node_fs6 = __toESM(require("fs"));
-var import_node_os5 = __toESM(require("os"));
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_os6 = __toESM(require("os"));
 var import_node_path5 = __toESM(require("path"));
 function beadsConfigPath() {
-  return import_node_path5.default.join(import_node_os5.default.homedir(), ".codeam", "beads-config.json");
+  return import_node_path5.default.join(import_node_os6.default.homedir(), ".codeam", "beads-config.json");
 }
 function readBeadsEnabled() {
   try {
-    const raw = import_node_fs6.default.readFileSync(beadsConfigPath(), "utf8");
+    const raw = import_node_fs7.default.readFileSync(beadsConfigPath(), "utf8");
     const cfg = JSON.parse(raw);
     return cfg.enabled !== false;
   } catch {
@@ -20793,10 +20865,10 @@ function readBeadsEnabled() {
 }
 function persistBeadsConfig(cfg) {
   const file = beadsConfigPath();
-  import_node_fs6.default.mkdirSync(import_node_path5.default.dirname(file), { recursive: true });
+  import_node_fs7.default.mkdirSync(import_node_path5.default.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  import_node_fs6.default.writeFileSync(tmp, JSON.stringify(cfg), { mode: 384 });
-  import_node_fs6.default.renameSync(tmp, file);
+  import_node_fs7.default.writeFileSync(tmp, JSON.stringify(cfg), { mode: 384 });
+  import_node_fs7.default.renameSync(tmp, file);
   restrictToOwner(file);
 }
 
@@ -21404,6 +21476,54 @@ var coderabbitConfigureH = async (ctx, cmd, parsed) => {
     });
     return r.ok === true;
   } : void 0;
+  if (action === "provision") {
+    await ctx.relay.sendResult(cmd.id, "completed", {
+      action: "provision",
+      supported: true,
+      installed: false,
+      loggedIn: false,
+      linked: false
+    });
+    void (async () => {
+      try {
+        const cred = token ? await fetchProvisionCredential({
+          agentId: "coderabbit",
+          sessionId: ctx.sessionId,
+          pluginId: ctx.pluginId,
+          pluginAuthToken: token
+        }) : null;
+        if (!cred) {
+          emit2("coderabbit_status", {
+            installed: false,
+            loggedIn: false,
+            linked: false,
+            error: "No vaulted CodeRabbit credential \u2014 sign in once to link it."
+          });
+          await emitChain;
+          return;
+        }
+        const result2 = await configureCoderabbit(
+          { action: "provision", provisionCredential: cred },
+          { onEvent }
+        );
+        emit2("coderabbit_status", {
+          installed: result2.installed,
+          loggedIn: result2.loggedIn,
+          linked: result2.linked ?? false,
+          ...result2.error ? { error: result2.error } : {}
+        });
+      } catch (err) {
+        emit2("coderabbit_status", {
+          installed: false,
+          loggedIn: false,
+          linked: false,
+          error: err instanceof Error ? err.message : "CodeRabbit provisioning failed"
+        });
+      }
+      await emitChain;
+    })();
+    return;
+  }
   if (action === "link_oauth") {
     await ctx.relay.sendResult(cmd.id, "completed", {
       action: "link_oauth",
@@ -22249,6 +22369,29 @@ function buildKeepAlive(ctx) {
   };
 }
 
+// src/lib/process-guards.ts
+var installed = false;
+function installRelayCrashGuards() {
+  if (installed) return;
+  installed = true;
+  process.on("unhandledRejection", (reason) => {
+    log.error("process", `unhandledRejection \u2014 relay kept alive \u2014 ${describeReason(reason)}`);
+  });
+  process.on("uncaughtException", (err) => {
+    log.error("process", `uncaughtException \u2014 relay kept alive \u2014 ${describeReason(err)}`);
+  });
+}
+function describeReason(reason) {
+  if (reason instanceof Error) {
+    return reason.stack ?? `${reason.name}: ${reason.message}`;
+  }
+  try {
+    return typeof reason === "string" ? reason : JSON.stringify(reason);
+  } catch {
+    return String(reason);
+  }
+}
+
 // src/commands/start-infra-only.ts
 var INFRA_ONLY_COMMAND_TYPES = /* @__PURE__ */ new Set([
   // File ops (drive the dashboard's Files panel + open-file).
@@ -22282,6 +22425,7 @@ var INFRA_ONLY_COMMAND_TYPES = /* @__PURE__ */ new Set([
   "set_keep_alive"
 ]);
 async function startInfraOnly(agentId) {
+  installRelayCrashGuards();
   const session = getActiveSession();
   if (!session?.pluginId) {
     throw new Error("startInfraOnly: no active session found in config");
@@ -22620,6 +22764,7 @@ function acquireSingletonLock() {
   }
 }
 async function pairAuto(args2) {
+  installRelayCrashGuards();
   if (!acquireSingletonLock()) {
     capture("pair_auto_deferred_singleton", {});
     console.log("  A codeam session is already running here \u2014 deferring to it.");
@@ -23229,11 +23374,11 @@ async function waitForAdapterModuleGraph(command2, args2, opts = {}) {
 
 // src/agents/kimi/installer.ts
 var import_node_child_process25 = require("child_process");
-var import_node_os6 = require("os");
+var import_node_os7 = require("os");
 var import_node_path6 = require("path");
 var INSTALL_URL2 = "https://code.kimi.com/kimi-code/install.sh";
 function kimiBinDir() {
-  return (0, import_node_path6.join)(process.env.KIMI_CODE_HOME || (0, import_node_path6.join)((0, import_node_os6.homedir)(), ".kimi-code"), "bin");
+  return (0, import_node_path6.join)(process.env.KIMI_CODE_HOME || (0, import_node_path6.join)((0, import_node_os7.homedir)(), ".kimi-code"), "bin");
 }
 function kimiRuns() {
   const r = (0, import_node_child_process25.spawnSync)("kimi", ["--version"], { stdio: "ignore", timeout: 15e3 });
@@ -28075,7 +28220,9 @@ var FilesOutbox = class {
     const jittered = delayMs === 0 ? 0 : applyJitter(delayMs);
     this.flushTimer = setTimeout(() => {
       this.flushTimer = null;
-      void this.flush();
+      this.flush().catch((err) => {
+        log.warn("turnFiles", `outbox flush loop threw: ${err.message}`);
+      });
     }, jittered);
   }
   async flush() {
@@ -31639,6 +31786,7 @@ function ensureClaudeOnboarded(cwd) {
 
 // src/commands/start.ts
 async function start(requestedAgent) {
+  installRelayCrashGuards();
   showIntro();
   const session = requestedAgent ? getActiveSessionForAgent(requestedAgent) : getActiveSession();
   if (!session) {
@@ -34518,7 +34666,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.41" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.43" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -34717,7 +34865,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.41" : "unknown";
+  const v = true ? "2.60.43" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.41",
+  "version": "2.60.43",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",