codeam-cli 2.60.61 → 2.60.63

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.62] — 2026-07-15
+
+### Added
+
+- **shared:** Add Linear as a live Agent Toolkit integration
+
+## [2.60.61] — 2026-07-15
+
+### Added
+
+- **shared:** Sentry full read+write scopes + --add-scopes on the MCP server
+
 ## [2.60.60] — 2026-07-14
 
 ### Added

package/dist/index.js

@@ -572,6 +572,93 @@ var INTEGRATION_REGISTRY = {
         }
       }
     }
+  },
+  linear: {
+    id: "linear",
+    name: "Linear",
+    icon: "linear",
+    // LIVE — the Linear OAuth Application (Public + Confidential) is registered
+    // and LINEAR_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
+    // (prod+dev). The backend LinearOAuthProvider is config-gated (503 if env
+    // unset) so this is safe even mid-rollout before the secrets mount.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Linear's coarse scopes: `read` (all issues/projects/comments/cycles)
+      // + `write` (create/update issues, comments, state). `write` implies the
+      // create/update surface the agent's tools need. `admin` (destructive
+      // workspace management) is deliberately NOT requested. ⚠️ Changing these
+      // requires the user to RE-LINK Linear — the token only carries the scopes
+      // granted at link time. Linear expects a COMMA-separated `scope` param.
+      scopes: ["read", "write"]
+    },
+    delivery: {
+      mcp: {
+        // mcp-linear (stdio, @linear/sdk) in BYO-token headless mode: the OAuth
+        // access token is fed via LINEAR_API_KEY (env only, never argv) and the
+        // Linear GraphQL API accepts it as the Authorization header directly.
+        // Verified headless end-to-end (search_issues returned real issues) —
+        // the OFFICIAL remote MCP (mcp.linear.app) can't be used here because it
+        // forces its own interactive browser OAuth. Version PINNED; bump only
+        // after re-verifying headless. Tools: search/get/create/update issue +
+        // add comment (read + write).
+        command: "npx",
+        args: ["-y", "mcp-linear@0.1.8"],
+        envMapping: {
+          LINEAR_API_KEY: "accessToken"
+        }
+      }
+    }
+  },
+  slack: {
+    id: "slack",
+    name: "Slack",
+    icon: "slack",
+    // LIVE — the Slack app (OAuth v2, bot token) is registered and
+    // SLACK_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
+    // (prod+dev). The backend SlackOAuthProvider is config-gated (503 if env
+    // unset) so this is safe even mid-rollout before the secrets mount.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Slack Bot Token Scopes (OAuth v2). Read + write across channels,
+      // groups, DMs: list/read history, post messages, react. `scope` is
+      // COMMA-separated in the authorize URL. ⚠️ Changing these requires the
+      // user to RE-INSTALL the Slack app — the bot token only carries the
+      // scopes granted at install time. The bot can only read channels it's
+      // been invited to (standard Slack bot behavior).
+      scopes: [
+        "channels:read",
+        "channels:history",
+        "groups:read",
+        "groups:history",
+        "chat:write",
+        "reactions:read",
+        "reactions:write",
+        "users:read",
+        "im:read",
+        "im:history",
+        "mpim:read",
+        "mpim:history"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Slack's official reference MCP server (Node). BYO-token headless: the
+        // OAuth v2 bot token (xoxb-…) is fed via SLACK_BOT_TOKEN and the team
+        // id via SLACK_TEAM_ID (env only, never argv). The server sends the
+        // token as `Authorization: Bearer`. Version PINNED; bump only after
+        // re-verifying headless. Tools: list_channels, post_message,
+        // reply_to_thread, add_reaction, get_channel_history,
+        // get_thread_replies, get_users, get_user_profile (read + write).
+        command: "npx",
+        args: ["-y", "@modelcontextprotocol/server-slack@2025.4.25"],
+        envMapping: {
+          SLACK_BOT_TOKEN: "accessToken",
+          SLACK_TEAM_ID: "teamId"
+        }
+      }
+    }
   }
 };
 function getIntegration(id) {
@@ -5800,7 +5887,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.61" : "0.0.0-dev",
+    cliVersion: true ? "2.60.63" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -5981,7 +6068,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.61",
+  version: "2.60.63",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7090,7 +7177,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.61" ? { ideVersion: "2.60.61" } : {}
+      ..."2.60.63" ? { ideVersion: "2.60.63" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -17667,7 +17754,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.61" : null;
+  const current = true ? "2.60.63" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17684,7 +17771,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.61" : null;
+  const current = true ? "2.60.63" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17704,7 +17791,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.61" : null;
+  return true ? "2.60.63" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -35133,7 +35220,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.61" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.63" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -35610,7 +35697,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.61" : "unknown";
+  const v = true ? "2.60.63" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.61",
+  "version": "2.60.63",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",