codeam-cli 2.60.63 → 2.60.65

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.64] — 2026-07-15
+
+### Added
+
+- **shared:** Add Slack search:read scope (agent can search the user's messages)
+
+### Documentation
+
+- **shared:** Clarify Slack uses a USER token (agent acts as the user)
+
+## [2.60.63] — 2026-07-15
+
+### Added
+
+- **shared:** Add Slack as a live Agent Toolkit integration
+
 ## [2.60.62] — 2026-07-15
 
 ### Added

package/dist/index.js

@@ -614,19 +614,20 @@ var INTEGRATION_REGISTRY = {
     id: "slack",
     name: "Slack",
     icon: "slack",
-    // LIVE — the Slack app (OAuth v2, bot token) is registered and
+    // LIVE — the Slack app (OAuth v2, USER token — the agent acts AS THE USER)
+    // is registered and
     // SLACK_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
     // (prod+dev). The backend SlackOAuthProvider is config-gated (503 if env
     // unset) so this is safe even mid-rollout before the secrets mount.
     enabled: true,
     auth: {
       kind: "oauth_redirect",
-      // Slack Bot Token Scopes (OAuth v2). Read + write across channels,
-      // groups, DMs: list/read history, post messages, react. `scope` is
-      // COMMA-separated in the authorize URL. ⚠️ Changing these requires the
-      // user to RE-INSTALL the Slack app — the bot token only carries the
-      // scopes granted at install time. The bot can only read channels it's
-      // been invited to (standard Slack bot behavior).
+      // Slack USER Token Scopes (OAuth v2). Read + write across channels,
+      // groups, DMs: list/read history, post messages, react — all AS THE USER.
+      // The backend provider requests these under `user_scope` (comma-separated)
+      // and stores the authed_user `xoxp-…` token, so the agent sees everything
+      // the user sees (no bot needs to be invited to channels). ⚠️ Changing
+      // these requires the user to RE-AUTHORIZE the Slack app.
       scopes: [
         "channels:read",
         "channels:history",
@@ -639,15 +640,18 @@ var INTEGRATION_REGISTRY = {
         "im:read",
         "im:history",
         "mpim:read",
-        "mpim:history"
+        "mpim:history",
+        // Message search across the user's channels/DMs (a user-only scope).
+        "search:read"
       ]
     },
     delivery: {
       mcp: {
         // Slack's official reference MCP server (Node). BYO-token headless: the
-        // OAuth v2 bot token (xoxb-…) is fed via SLACK_BOT_TOKEN and the team
-        // id via SLACK_TEAM_ID (env only, never argv). The server sends the
-        // token as `Authorization: Bearer`. Version PINNED; bump only after
+        // OAuth v2 USER token (xoxp-…) is fed via SLACK_BOT_TOKEN (the server's
+        // env var name — it sends whatever token as `Authorization: Bearer`, and
+        // Slack's Web API accepts a user token there) and the team id via
+        // SLACK_TEAM_ID (env only, never argv). Version PINNED; bump only after
         // re-verifying headless. Tools: list_channels, post_message,
         // reply_to_thread, add_reaction, get_channel_history,
         // get_thread_replies, get_users, get_user_profile (read + write).
@@ -5887,7 +5891,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.63" : "0.0.0-dev",
+    cliVersion: true ? "2.60.65" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6068,7 +6072,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.63",
+  version: "2.60.65",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6836,7 +6840,7 @@ function httpStatusOf(err) {
 var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
-var CommandRelayService = class {
+var CommandRelayService = class _CommandRelayService {
   constructor(pluginId, onCommand, agentMeta, agentsOverride) {
     this.pluginId = pluginId;
     this.onCommand = onCommand;
@@ -6858,6 +6862,16 @@ var CommandRelayService = class {
   agentsRegistered = false;
   /** SSE connection (null when on the polling fallback or stopped). */
   sseRequest = null;
+  // At-least-once delivery: the backend now delivers commands NON-DESTRUCTIVELY
+  // (peek) when we advertise `X-Codeam-Cmd-Ack: 1`, and drains the queue only
+  // when we ack the ids. So a command can never be lost to a ghost/racing SSE
+  // subscriber during codespace boot (the 2026-07-15 first-prompt loss). The
+  // trade-off is possible REDELIVERY (reconnect, publish re-fire, ghost race),
+  // so we dedupe by id here — a bounded FIFO set of ids we've already
+  // dispatched. Cap keeps memory flat over a long session; the oldest ids are
+  // evicted (a command that old is long gone from the server queue anyway).
+  processedIds = /* @__PURE__ */ new Set();
+  static PROCESSED_ID_CAP = 1e3;
   /** Polling backoff state (only used on the fallback). */
   pollTimer = null;
   pollFailures = 0;
@@ -7127,14 +7141,15 @@ var CommandRelayService = class {
   // as X-Plugin-Poll-Secret. Empty {} for legacy sessions / older
   // backends (which ignore it).
   pollSecretHeader() {
+    const headers = { "X-Codeam-Cmd-Ack": "1" };
     try {
       const secret = loadCliConfig().sessions.find(
         (s) => s.pluginId === this.pluginId
       )?.pollSecret;
-      return secret ? { "X-Plugin-Poll-Secret": secret } : {};
+      if (secret) headers["X-Plugin-Poll-Secret"] = secret;
     } catch {
-      return {};
     }
+    return headers;
   }
   async pollOnce() {
     try {
@@ -7157,7 +7172,13 @@ var CommandRelayService = class {
     }
   }
   async dispatchCommands(commands) {
+    this.ackCommands(commands.map((c2) => c2.id));
     for (const cmd of commands) {
+      if (cmd.id && this.processedIds.has(cmd.id)) {
+        log.trace("relay", `dedupe skip already-dispatched id=${cmd.id}`);
+        continue;
+      }
+      if (cmd.id) this.rememberProcessed(cmd.id);
       try {
         log.trace("relay", `dispatch type=${cmd.type} id=${cmd.id}`);
         await this.onCommand(cmd);
@@ -7166,6 +7187,23 @@ var CommandRelayService = class {
       }
     }
   }
+  /** Record a dispatched id, evicting the oldest when over the cap (FIFO). */
+  rememberProcessed(id) {
+    this.processedIds.add(id);
+    if (this.processedIds.size > _CommandRelayService.PROCESSED_ID_CAP) {
+      const oldest = this.processedIds.values().next().value;
+      if (oldest !== void 0) this.processedIds.delete(oldest);
+    }
+  }
+  /** Confirm receipt of command ids so the backend removes them from the queue
+   *  (the at-least-once delivery guarantee). Best-effort — never throws. */
+  ackCommands(ids) {
+    const commandIds = ids.filter((id) => typeof id === "string" && id.length > 0);
+    if (commandIds.length === 0) return;
+    void _postJson(`${API_BASE2}/api/commands/ack`, { pluginId: this.pluginId, commandIds }, {
+      ...this.pollSecretHeader()
+    }).catch((err) => log.trace("relay", "ack post failed (will redeliver+dedupe)", err));
+  }
   // ─── Heartbeat + agents ──────────────────────────────────────────
   async sendHeartbeat(online) {
     await _postJson(`${API_BASE2}/api/plugin/heartbeat`, {
@@ -7177,7 +7215,7 @@ var CommandRelayService = class {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.63" ? { ideVersion: "2.60.63" } : {}
+      ..."2.60.65" ? { ideVersion: "2.60.65" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -17754,7 +17792,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.63" : null;
+  const current = true ? "2.60.65" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17771,7 +17809,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.63" : null;
+  const current = true ? "2.60.65" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17791,7 +17829,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.63" : null;
+  return true ? "2.60.65" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -35220,7 +35258,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.63" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.65" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -35697,7 +35735,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.63" : "unknown";
+  const v = true ? "2.60.65" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.63",
+  "version": "2.60.65",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",