codeam-cli 2.60.60 → 2.60.62

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.61] — 2026-07-15
+
+### Added
+
+- **shared:** Sentry full read+write scopes + --add-scopes on the MCP server
+
+## [2.60.60] — 2026-07-14
+
+### Added
+
+- **shared:** Use Sentry's official mark for the integration catalog icon
+
 ## [2.60.59] — 2026-07-14
 
 ### Added

package/dist/index.js

@@ -531,12 +531,25 @@ var INTEGRATION_REGISTRY = {
     enabled: true,
     auth: {
       kind: "oauth_redirect",
-      // Sentry OAuth scopes for the MCP's read-first surface: read orgs /
-      // projects / teams, read issues+events (the error→fix loop), and
-      // read releases. `org:read` covers org+project discovery. No write
-      // scopes in the MVP — writes (resolve/assign an issue) land with the
-      // designed Approval-Gates phase, same as Jira's write path.
-      scopes: ["org:read", "project:read", "team:read", "event:read", "project:releases"]
+      // FULL read+write across every Sentry resource — the agent can read
+      // issues/events/projects AND act (resolve/assign issues, manage
+      // projects/teams/members, releases). `:write` implies `:read`. Admin
+      // (destructive org/member management) is deliberately NOT requested.
+      // ⚠️ Changing these requires the user to RE-LINK Sentry — the existing
+      // token only carries whatever scopes it was granted at link time.
+      scopes: [
+        "org:read",
+        "org:write",
+        "project:read",
+        "project:write",
+        "team:read",
+        "team:write",
+        "member:read",
+        "member:write",
+        "event:read",
+        "event:write",
+        "project:releases"
+      ]
     },
     delivery: {
       mcp: {
@@ -545,13 +558,57 @@ var INTEGRATION_REGISTRY = {
         // SENTRY_HOST (never argv — env only). Version PINNED; bump only
         // after re-verifying headless in the mcp-shim integration test.
         command: "npx",
-        args: ["-y", "@sentry/mcp-server@0.18.0"],
+        // `--add-scopes` widens the server's default READ-ONLY tool surface to
+        // include the write tools our OAuth scopes now grant (resolve/assign
+        // issue, update project, etc.), so the agent exposes read AND write.
+        args: [
+          "-y",
+          "@sentry/mcp-server@0.18.0",
+          "--add-scopes=org:write,project:write,team:write,member:write,event:write"
+        ],
         envMapping: {
           SENTRY_ACCESS_TOKEN: "accessToken",
           SENTRY_HOST: "host"
         }
       }
     }
+  },
+  linear: {
+    id: "linear",
+    name: "Linear",
+    icon: "linear",
+    // LIVE — the Linear OAuth Application (Public + Confidential) is registered
+    // and LINEAR_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
+    // (prod+dev). The backend LinearOAuthProvider is config-gated (503 if env
+    // unset) so this is safe even mid-rollout before the secrets mount.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Linear's coarse scopes: `read` (all issues/projects/comments/cycles)
+      // + `write` (create/update issues, comments, state). `write` implies the
+      // create/update surface the agent's tools need. `admin` (destructive
+      // workspace management) is deliberately NOT requested. ⚠️ Changing these
+      // requires the user to RE-LINK Linear — the token only carries the scopes
+      // granted at link time. Linear expects a COMMA-separated `scope` param.
+      scopes: ["read", "write"]
+    },
+    delivery: {
+      mcp: {
+        // mcp-linear (stdio, @linear/sdk) in BYO-token headless mode: the OAuth
+        // access token is fed via LINEAR_API_KEY (env only, never argv) and the
+        // Linear GraphQL API accepts it as the Authorization header directly.
+        // Verified headless end-to-end (search_issues returned real issues) —
+        // the OFFICIAL remote MCP (mcp.linear.app) can't be used here because it
+        // forces its own interactive browser OAuth. Version PINNED; bump only
+        // after re-verifying headless. Tools: search/get/create/update issue +
+        // add comment (read + write).
+        command: "npx",
+        args: ["-y", "mcp-linear@0.1.8"],
+        envMapping: {
+          LINEAR_API_KEY: "accessToken"
+        }
+      }
+    }
   }
 };
 function getIntegration(id) {
@@ -5780,7 +5837,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.60" : "0.0.0-dev",
+    cliVersion: true ? "2.60.62" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5961,7 +6018,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.60",
+  version: "2.60.62",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7070,7 +7127,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.60" ? { ideVersion: "2.60.60" } : {}
+      ..."2.60.62" ? { ideVersion: "2.60.62" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -17647,7 +17704,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.60" : null;
+  const current = true ? "2.60.62" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17664,7 +17721,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.60" : null;
+  const current = true ? "2.60.62" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17684,7 +17741,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.60" : null;
+  return true ? "2.60.62" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -35113,7 +35170,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.60" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.62" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -35590,7 +35647,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.60" : "unknown";
+  const v = true ? "2.60.62" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.60",
+  "version": "2.60.62",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",