codeam-cli 2.60.68 → 2.60.70

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.69] — 2026-07-15
+
+### Fixed
+
+- **cli:** Provision uvx via the standalone uv installer and resolve per-user bin paths for MCP launchers
+
+## [2.60.68] — 2026-07-15
+
+### Added
+
+- **shared:** 17 new COMING SOON integrations + official logos
+
 ## [2.60.67] — 2026-07-15
 
 ### Added

package/dist/index.js

@@ -1068,11 +1068,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path74) {
+function rmIfExistsQuiet(path75) {
   try {
-    fs2.rmSync(path74, { force: true });
+    fs2.rmSync(path75, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path74}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path75}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -1256,8 +1256,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path74) {
-  return path74.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path75) {
+  return path75.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -3737,9 +3737,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path74, ranges, output) {
+function getContextLinesFromFile(path75, ranges, output) {
   return new Promise((resolve7) => {
-    const stream = (0, import_node_fs.createReadStream)(path74);
+    const stream = (0, import_node_fs.createReadStream)(path75);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -3754,7 +3754,7 @@ function getContextLinesFromFile(path74, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path74, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path75, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3815,8 +3815,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path74) {
-  return path74.startsWith("node:") || path74.endsWith(".min.js") || path74.endsWith(".min.cjs") || path74.endsWith(".min.mjs") || path74.startsWith("data:");
+function shouldSkipContextLinesForFile(path75) {
+  return path75.startsWith("node:") || path75.endsWith(".min.js") || path75.endsWith(".min.cjs") || path75.endsWith(".min.mjs") || path75.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -5970,7 +5970,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.60.68" : "0.0.0-dev",
+    cliVersion: true ? "2.60.70" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6151,7 +6151,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.60.68",
+  version: "2.60.70",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7294,7 +7294,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.60.68" ? { ideVersion: "2.60.68" } : {}
+      ..."2.60.70" ? { ideVersion: "2.60.70" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -12127,10 +12127,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os52 = createOsStrategy()) {
-  const found = os52.findInPath("claude") ?? os52.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os53 = createOsStrategy()) {
+  const found = os53.findInPath("claude") ?? os53.findInPath("claude-code");
   if (!found) return null;
-  return os52.buildLaunch(found, extraArgs);
+  return os53.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -12720,8 +12720,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -13501,8 +13501,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os52 = createOsStrategy();
-      return os52.findInPath("codex") !== null;
+      const os53 = createOsStrategy();
+      return os53.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process4.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -13525,8 +13525,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -13635,12 +13635,12 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os52) {
-  return os52.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os53) {
+  return os53.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os52) {
+async function installCodexViaNpm(os53) {
   return new Promise((resolve7, reject) => {
-    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os52), ["install", "-g", "@openai/codex"], {
+    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os53), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -13657,16 +13657,16 @@ async function installCodexViaNpm(os52) {
     });
   });
 }
-function augmentNpmGlobalBin(os52) {
+function augmentNpmGlobalBin(os53) {
   try {
-    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os52), ["prefix", "-g"], {
+    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os53), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os52.id === "win32" ? prefix : path24.join(prefix, "bin");
-    os52.augmentPath([binDir]);
+    const binDir = os53.id === "win32" ? prefix : path24.join(prefix, "bin");
+    os53.augmentPath([binDir]);
   } catch {
   }
 }
@@ -13750,9 +13750,9 @@ var import_node_child_process8 = require("child_process");
 // src/agents/coderabbit/installer.ts
 var import_node_child_process6 = require("child_process");
 var INSTALL_URL = "https://cli.coderabbit.ai/install.sh";
-async function ensureCoderabbitInstalled(os52) {
-  if (os52.findInPath("coderabbit")) return true;
-  if (os52.id === "win32") {
+async function ensureCoderabbitInstalled(os53) {
+  if (os53.findInPath("coderabbit")) return true;
+  if (os53.id === "win32") {
     console.error(
       "\n  \u2717 CodeRabbit on Windows requires WSL.\n    Install the CLI inside your WSL distribution\n    (curl -fsSL https://cli.coderabbit.ai/install.sh | sh)\n    then re-run `codeam link coderabbit` from WSL.\n"
     );
@@ -13767,8 +13767,8 @@ async function ensureCoderabbitInstalled(os52) {
     proc.on("error", () => resolve7(false));
   });
   if (!ok) return false;
-  os52.augmentPath([`${os52.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  return os52.findInPath("coderabbit") !== null;
+  os53.augmentPath([`${os53.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  return os53.findInPath("coderabbit") !== null;
 }
 
 // src/agents/coderabbit/link.ts
@@ -13803,10 +13803,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os52) {
+function coderabbitLoginLauncher(os53) {
   return {
     async ensureInstalled() {
-      return ensureCoderabbitInstalled(os52);
+      return ensureCoderabbitInstalled(os53);
     },
     launch() {
       return (0, import_node_child_process7.spawn)("coderabbit", ["auth", "login"], { stdio: "inherit" });
@@ -13862,8 +13862,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path74 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path74) return null;
+  const path75 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path75) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -13880,7 +13880,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path74.trim(),
+    path: path75.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -13963,10 +13963,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path74, lineNo, sevToken, message] = m;
-    if (!path74 || !lineNo || !message) continue;
+    const [, path75, lineNo, sevToken, message] = m;
+    if (!path75 || !lineNo || !message) continue;
     hunks.push({
-      path: path74.trim(),
+      path: path75.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -14026,8 +14026,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -14298,10 +14298,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os52) {
+function cursorLoginLauncher(os53) {
   return {
     async ensureInstalled() {
-      if (os52.findInPath("cursor-agent")) return true;
+      if (os53.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -14365,8 +14365,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -14582,10 +14582,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os52) {
+function aiderLoginLauncher(os53) {
   return {
     async ensureInstalled() {
-      if (os52.findInPath("aider")) return true;
+      if (os53.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -14595,7 +14595,7 @@ function aiderLoginLauncher(os52) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process11.spawn)(os52.id === "win32" ? "cmd.exe" : "sh", os52.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process11.spawn)(os53.id === "win32" ? "cmd.exe" : "sh", os53.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -14667,8 +14667,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("aider");
@@ -14800,8 +14800,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os52 = createOsStrategy();
-      return os52.findInPath("gemini") !== null;
+      const os53 = createOsStrategy();
+      return os53.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process12.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -14991,8 +14991,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -15283,8 +15283,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os52) {
-    this.os = os52;
+  constructor(os53) {
+    this.os = os53;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -15397,19 +15397,19 @@ var KimiRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os52) => new ClaudeRuntimeStrategy(os52),
-  codex: (os52) => new CodexRuntimeStrategy(os52),
-  coderabbit: (os52) => new CoderabbitRuntimeStrategy(os52),
-  cursor: (os52) => new CursorRuntimeStrategy(os52),
-  aider: (os52) => new AiderRuntimeStrategy(os52),
-  gemini: (os52) => new GeminiRuntimeStrategy(os52),
-  kimi: (os52) => new KimiRuntimeStrategy(os52)
+  claude: (os53) => new ClaudeRuntimeStrategy(os53),
+  codex: (os53) => new CodexRuntimeStrategy(os53),
+  coderabbit: (os53) => new CoderabbitRuntimeStrategy(os53),
+  cursor: (os53) => new CursorRuntimeStrategy(os53),
+  aider: (os53) => new AiderRuntimeStrategy(os53),
+  gemini: (os53) => new GeminiRuntimeStrategy(os53),
+  kimi: (os53) => new KimiRuntimeStrategy(os53)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os52 = createOsStrategy()) {
+function createAgentStrategy(agent, os53 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -15419,10 +15419,10 @@ function createAgentStrategy(agent, os52 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os52);
+  return build(os53);
 }
-function createInteractiveAgentStrategy(agent, os52 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os52);
+function createInteractiveAgentStrategy(agent, os53 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os53);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -16119,26 +16119,26 @@ function restoreCoderabbitOauthBlob(value) {
   (0, import_node_fs5.writeFileSync)(path36.join(dir, file), contents, { mode: 384 });
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os52 = deps.os ?? createOsStrategy();
+  const os53 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os52.homeDir();
-  os52.augmentPath(
-    os52.id === "win32" ? [
+  const home = os53.homeDir();
+  os53.augmentPath(
+    os53.id === "win32" ? [
       path36.join(home, ".local", "bin"),
       path36.join(process.env.APPDATA ?? path36.join(home, "AppData", "Roaming"), "npm"),
       path36.join(home, "scoop", "shims")
     ] : [path36.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os52.findInPath("coderabbit") !== null;
+  const installed2 = os53.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os52.findInPath("coderabbit") !== null,
+    installed: os53.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -16152,7 +16152,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const ok = await ensureInstalled(os52);
+      const ok = await ensureInstalled(os53);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -16176,7 +16176,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os52);
+      const ok = await ensureInstalled(os53);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -16206,7 +16206,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os52);
+      const ok = await ensureInstalled(os53);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -16246,7 +16246,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const ok = await ensureInstalled(os52);
+    const ok = await ensureInstalled(os53);
     res.installed = ok;
     if (!ok) return { ...res, error: "CodeRabbit CLI is not installed" };
   }
@@ -17871,7 +17871,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.60.68" : null;
+  const current = true ? "2.60.70" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17888,7 +17888,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.60.68" : null;
+  const current = true ? "2.60.70" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -17908,7 +17908,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.60.68" : null;
+  return true ? "2.60.70" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve7) => {
@@ -18136,6 +18136,78 @@ function isDeployPayload(p2) {
 function isStopPayload(p2) {
   return typeof p2.sessionId === "string";
 }
+var FLEET_CONTAINER_NAME_RE = /^codeam-box-[a-z0-9]+$/;
+function isFleetContainerName(v) {
+  return typeof v === "string" && FLEET_CONTAINER_NAME_RE.test(v);
+}
+function isFiniteNumber(v) {
+  return typeof v === "number" && Number.isFinite(v);
+}
+function isFleetLimits(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const l = v;
+  return isFiniteNumber(l.memoryMb) && isFiniteNumber(l.cpus) && isFiniteNumber(l.pidsLimit) && isFiniteNumber(l.diskGb);
+}
+function isFleetCreateBoxPayload(p2) {
+  return typeof p2.boxId === "string" && isFleetContainerName(p2.containerName) && typeof p2.enrollToken === "string" && p2.enrollToken.length > 0 && typeof p2.apiOrigin === "string" && p2.apiOrigin.length > 0 && isFleetLimits(p2.limits);
+}
+function isFleetBoxRefPayload(p2) {
+  if (typeof p2.boxId !== "string") return false;
+  if (!isFleetContainerName(p2.containerName)) return false;
+  if (p2.removeVolume !== void 0 && typeof p2.removeVolume !== "boolean") return false;
+  return true;
+}
+function fleetUserIdFromContainerName(containerName) {
+  return containerName.slice("codeam-box-".length);
+}
+function isMissingContainerError(stderr) {
+  return /no such container/i.test(stderr);
+}
+function isMissingVolumeError(stderr) {
+  return /no such volume/i.test(stderr);
+}
+function resolveFleetBoxImage() {
+  return process.env.CODEAM_FLEET_BOX_IMAGE || "ghcr.io/edgar-durand/codeam-box:latest";
+}
+var DOCKER_RUN_TIMEOUT_MS = 12e4;
+var defaultDockerRunner = {
+  run(args2, opts = {}) {
+    return new Promise((resolve7) => {
+      const child = (0, import_node_child_process23.spawn)("docker", args2, {
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, ...opts.env }
+      });
+      let stdoutBuf = "";
+      let stderrBuf = "";
+      let settled = false;
+      const timer = setTimeout(
+        () => {
+          if (settled) return;
+          killQuiet(child);
+        },
+        opts.timeoutMs ?? DOCKER_RUN_TIMEOUT_MS
+      );
+      const done = (code) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve7({ code, stderr: stderrBuf, stdout: stdoutBuf });
+      };
+      child.stdout?.on("data", (b) => {
+        stdoutBuf += b.toString();
+      });
+      child.stderr?.on("data", (b) => {
+        stderrBuf += b.toString();
+      });
+      child.once("error", (err) => {
+        stderrBuf += stderrBuf ? `
+${err.message}` : err.message;
+        done(null);
+      });
+      child.once("exit", (code) => done(code));
+    });
+  }
+};
 var CONTROL_AGENT_META = {
   id: "claude",
   displayName: "CodeAgent Host Agent",
@@ -18177,6 +18249,7 @@ var HostAgentSupervisor = class {
     this.teardownHeadroom = deps.teardownHeadroom ?? defaultTeardownHeadroom;
     this.selfUpdate = deps.selfUpdate ?? runSelfUpdate;
     this.onUpdated = deps.onUpdated ?? defaultOnUpdated;
+    this.docker = deps.docker ?? defaultDockerRunner;
   }
   identity;
   deps;
@@ -18213,6 +18286,8 @@ var HostAgentSupervisor = class {
   /** Best-effort systemd de-provision used by `self_hosted_wipe`. */
   disableService;
   teardownHeadroom;
+  /** Docker runner for the fleet `fleet_*` control-plane handlers. */
+  docker;
   /** Guards against firing the self-heal more than once. */
   healing = false;
   /**
@@ -18380,6 +18455,38 @@ var HostAgentSupervisor = class {
    * arbitrary command surface).
    */
   async handleCommand(cmd) {
+    if (cmd.type === "fleet_create_box") {
+      if (!isFleetCreateBoxPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_create_box id=${cmd.id}`);
+        return;
+      }
+      await this.fleetCreateBox(cmd.payload);
+      return;
+    }
+    if (cmd.type === "fleet_start_box") {
+      if (!isFleetBoxRefPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_start_box id=${cmd.id}`);
+        return;
+      }
+      await this.fleetStartBox(cmd.payload);
+      return;
+    }
+    if (cmd.type === "fleet_stop_box") {
+      if (!isFleetBoxRefPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_stop_box id=${cmd.id}`);
+        return;
+      }
+      await this.fleetStopBox(cmd.payload);
+      return;
+    }
+    if (cmd.type === "fleet_delete_box") {
+      if (!isFleetBoxRefPayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_delete_box id=${cmd.id}`);
+        return;
+      }
+      await this.fleetDeleteBox(cmd.payload);
+      return;
+    }
     if (cmd.type === "self_hosted_deploy") {
       if (!isDeployPayload(cmd.payload)) {
         log.warn("host-agent", `ignoring malformed self_hosted_deploy id=${cmd.id}`);
@@ -18417,6 +18524,131 @@ var HostAgentSupervisor = class {
     }
     log.trace("host-agent", `ignoring unsupported command type=${cmd.type}`);
   }
+  /**
+   * `fleet_create_box` — `docker run` a per-user rescue box. Builds the FULL
+   * argv from a fixed template (Global Constraints — nothing from the wire
+   * is passed through as a raw docker argument beyond the already-validated
+   * `containerName` and the numeric resource limits): hard isolation
+   * (`--cap-drop ALL`, `--security-opt no-new-privileges`, resource caps,
+   * the isolated `fleet-net` network, a SINGLE named volume mounted at
+   * `/home/box` — named identically to the container, per the Global
+   * Constraints — and the ops labels). NEVER `--privileged`, NEVER a
+   * `docker.sock` mount, NEVER a host bind mount. The api origin (not a
+   * secret) is delivered via a normal `-e KEY=value`. The enroll token IS a
+   * secret — spec invariant #1 is "token via env, NEVER argv" — so it is
+   * delivered as a BARE `-e CODEAM_ENROLL_TOKEN` (no `=value`) with the
+   * actual value passed only through {@link DockerRunner.run}'s `env` map,
+   * which the runner merges into the `docker` CLI process's OWN env; docker
+   * then reads a bare `-e NAME` from its own env and forwards it into the
+   * container. The value never appears in the `docker run` argv, so it's
+   * never visible via `ps` on the shared fleet host; never logged either.
+   */
+  async fleetCreateBox(payload) {
+    const { containerName, limits } = payload;
+    const userId = fleetUserIdFromContainerName(containerName);
+    log.info(
+      "host-agent",
+      `fleet_create_box id=${payload.boxId} name=${containerName} mem=${limits.memoryMb}m cpus=${limits.cpus} pids=${limits.pidsLimit}`
+    );
+    const args2 = [
+      "run",
+      "-d",
+      "--name",
+      containerName,
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--memory",
+      `${limits.memoryMb}m`,
+      "--cpus",
+      String(limits.cpus),
+      "--pids-limit",
+      String(limits.pidsLimit),
+      "--network",
+      "fleet-net",
+      "--label",
+      `com.codeagent.user-id=${userId}`,
+      "--label",
+      `com.codeagent.box-id=${payload.boxId}`,
+      "--label",
+      "com.codeagent.created-by=fleet",
+      "-v",
+      `${containerName}:/home/box`,
+      // Bare `-e NAME` (no `=value`) — docker reads the value from ITS OWN
+      // process env (supplied below via `opts.env`), never from this argv.
+      "-e",
+      "CODEAM_ENROLL_TOKEN",
+      "-e",
+      `CODEAM_API_URL=${payload.apiOrigin}`,
+      resolveFleetBoxImage()
+    ];
+    const res = await this.docker.run(args2, {
+      timeoutMs: DOCKER_RUN_TIMEOUT_MS,
+      env: { CODEAM_ENROLL_TOKEN: payload.enrollToken }
+    });
+    if (res.code === 0) {
+      log.info(
+        "host-agent",
+        `fleet box ${containerName} created (${res.stdout.trim().slice(0, 12)})`
+      );
+    } else {
+      log.warn(
+        "host-agent",
+        `fleet_create_box ${containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-300)}`
+      );
+    }
+  }
+  /** `fleet_start_box` — wake a sleeping box (`docker start`). Idempotent: a
+   *  container the host already removed is treated as success. */
+  async fleetStartBox(payload) {
+    log.info("host-agent", `fleet_start_box id=${payload.boxId} name=${payload.containerName}`);
+    const res = await this.docker.run(["start", payload.containerName]);
+    if (res.code !== 0 && !isMissingContainerError(res.stderr)) {
+      log.warn(
+        "host-agent",
+        `fleet_start_box ${payload.containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-300)}`
+      );
+    }
+  }
+  /** `fleet_stop_box` — sleep an idle box (`docker stop`). MUST be
+   *  idempotent — the backend's reap sweeps may re-send a stop for a box
+   *  the host already stopped/removed; "No such container" is success. */
+  async fleetStopBox(payload) {
+    log.info("host-agent", `fleet_stop_box id=${payload.boxId} name=${payload.containerName}`);
+    const res = await this.docker.run(["stop", payload.containerName]);
+    if (res.code !== 0 && !isMissingContainerError(res.stderr)) {
+      log.warn(
+        "host-agent",
+        `fleet_stop_box ${payload.containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-300)}`
+      );
+    }
+  }
+  /** `fleet_delete_box` — `docker rm -f`, plus `docker volume rm` when the
+   *  backend asks for a reap (`removeVolume`). MUST be idempotent — deleting
+   *  an already-gone container/volume is success, never a failure. */
+  async fleetDeleteBox(payload) {
+    log.info(
+      "host-agent",
+      `fleet_delete_box id=${payload.boxId} name=${payload.containerName} removeVolume=${Boolean(payload.removeVolume)}`
+    );
+    const res = await this.docker.run(["rm", "-f", payload.containerName]);
+    if (res.code !== 0 && !isMissingContainerError(res.stderr)) {
+      log.warn(
+        "host-agent",
+        `fleet_delete_box ${payload.containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-300)}`
+      );
+    }
+    if (payload.removeVolume) {
+      const volRes = await this.docker.run(["volume", "rm", payload.containerName]);
+      if (volRes.code !== 0 && !isMissingVolumeError(volRes.stderr)) {
+        log.warn(
+          "host-agent",
+          `fleet_delete_box volume rm ${payload.containerName} failed (code=${volRes.code}): ${volRes.stderr.trim().slice(-300)}`
+        );
+      }
+    }
+  }
   /**
    * Prepare the workspace, write the agent credential (same as codespace
    * provisioning), and spawn a supervised `codeam pair-auto` child.
@@ -20440,11 +20672,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os52 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os53 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os52 === "windows" && a !== "amd64") return null;
-  return `${os52}-${a}`;
+  if (os53 === "windows" && a !== "amd64") return null;
+  return `${os53}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -23068,11 +23300,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path74 = fileFlag.slice("--token-file=".length);
+    const path75 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs56.readFileSync(path74, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path74} is empty`);
-      rmIfExistsQuiet(path74);
+      const content = fs56.readFileSync(path75, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path75} is empty`);
+      rmIfExistsQuiet(path75);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -23712,14 +23944,14 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync26 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
   const scopeDir = import_path8.default.dirname(sdkDir);
   const binName = platformKey.startsWith("win32-") ? "claude.exe" : "claude";
   const candidate = import_path8.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
-  return existsSync26(candidate) ? candidate : null;
+  return existsSync27(candidate) ? candidate : null;
 }
 var realSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function waitForClaudeNativeBinary(opts = {}) {
@@ -23770,18 +24002,18 @@ async function waitForCommandOnPath(cmd, opts = {}) {
   return check();
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync26 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
     const localAppData = env.LOCALAPPDATA;
     if (!localAppData) return null;
     const exe = import_path8.default.win32.join(localAppData, "cursor-agent", "cursor-agent.exe");
-    return existsSync26(exe) ? exe : null;
+    return existsSync27(exe) ? exe : null;
   }
   const home = deps.homedir ?? import_os10.default.homedir();
   const unix = import_path8.default.posix.join(home, ".local", "bin", "cursor-agent");
-  return existsSync26(unix) ? unix : null;
+  return existsSync27(unix) ? unix : null;
 }
 async function waitForCursorAgent(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
@@ -35271,9 +35503,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os52 = createOsStrategy();
+  const os53 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os52.findInPath(meta.binaryName);
+    const found = os53.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -35337,7 +35569,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.60.68" : "0.0.0-dev";
+  const cliVersion = true ? "2.60.70" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -35535,6 +35767,9 @@ async function completion(args2) {
 
 // src/integrations/mcp-run.ts
 var import_node_child_process28 = require("child_process");
+var import_node_fs9 = require("fs");
+var import_node_os9 = __toESM(require("os"));
+var import_node_path8 = __toESM(require("path"));
 
 // src/integrations/token-client.ts
 var REFRESH_AHEAD_MS = 5 * 60 * 1e3;
@@ -35754,8 +35989,24 @@ function commandExists(command2) {
     return false;
   }
 }
+function localBinCandidates(command2) {
+  return [
+    import_node_path8.default.join(import_node_os9.default.homedir(), ".local", "bin", command2),
+    import_node_path8.default.join(import_node_os9.default.homedir(), ".cargo", "bin", command2)
+  ];
+}
+function resolveLauncherPath(command2, deps = {
+  commandExists,
+  existsSync: import_node_fs9.existsSync
+}) {
+  if (deps.commandExists(command2)) return command2;
+  for (const candidate of localBinCandidates(command2)) {
+    if (deps.existsSync(candidate)) return candidate;
+  }
+  return command2;
+}
 function ensureCommand(command2) {
-  if (commandExists(command2)) return;
+  if (resolveLauncherPath(command2) !== command2 || commandExists(command2)) return;
   if (process.platform === "win32") {
     process.stderr.write(
       `[codeam mcp-run] '${command2}' not found on PATH \u2014 install it and retry.
@@ -35764,6 +36015,15 @@ function ensureCommand(command2) {
     return;
   }
   if (command2 === "uvx") {
+    try {
+      (0, import_node_child_process28.execSync)("curl -LsSf https://astral.sh/uv/install.sh | sh", {
+        stdio: ["ignore", process.stderr, process.stderr],
+        timeout: 18e4,
+        env: { ...process.env, UV_NO_MODIFY_PATH: "1" }
+      });
+    } catch {
+    }
+    if (resolveLauncherPath(command2) !== command2) return;
     try {
       (0, import_node_child_process28.execSync)("python3 -m pip install --user --quiet uv", {
         stdio: ["ignore", process.stderr, process.stderr],
@@ -35771,6 +36031,11 @@ function ensureCommand(command2) {
       });
     } catch {
     }
+    if (resolveLauncherPath(command2) !== command2) return;
+    process.stderr.write(
+      `[codeam mcp-run] could not provision '${command2}' (standalone installer + pip both failed) \u2014 the '${command2}'-launched MCP server will be unavailable.
+`
+    );
   }
 }
 async function mcpRun(args2) {
@@ -35789,6 +36054,7 @@ async function mcpRun(args2) {
     process.exit(1);
   }
   ensureCommand(delivery.command);
+  const launcher = resolveLauncherPath(delivery.command);
   const client2 = new IntegrationTokenClient({
     sessionId,
     pluginId,
@@ -35804,7 +36070,7 @@ async function mcpRun(args2) {
         const value = current[field];
         if (typeof value === "string" && value) env[envVar] = value;
       }
-      return { command: delivery.command, args: delivery.args, env };
+      return { command: launcher, args: delivery.args, env };
     },
     shouldRestartNow: () => current !== null && new Date(current.expiresAt).getTime() - Date.now() < RESTART_AHEAD_MS
   });
@@ -35814,7 +36080,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.60.68" : "unknown";
+  const v = true ? "2.60.70" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -35963,10 +36229,10 @@ var EXIT_CODE_NAMES = {
 };
 
 // src/index.ts
-var os51 = __toESM(require("os"));
+var os52 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os51.homedir();
+    const home = os52.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.60.68",
+  "version": "2.60.70",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",