codeam-cli 2.61.23 → 2.61.25

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.24] — 2026-07-22
+
+### Chore
+
+- **cli:** Declare yaml as devDependency (skills materialize test)
+- **deps:** Bump actions/setup-node from 4 to 7 (#452)
+- **deps-dev:** Bump typescript from 6.0.3 to 7.0.2 in /apps/cli (#432)
+- **deps-dev:** Bump typescript from 6.0.3 to 7.0.2 in /apps/vsc-plugin (#430)
+- **deps:** Bump org.jetbrains.kotlin.jvm in /apps/jetbrains-plugin (#453)
+- **deps:** Bump ignore from 5.3.2 to 7.0.6 in /apps/cli (#323)
+- **deps:** Bump org.jetbrains.intellij.platform (#454)
+
+### Fixed
+
+- **cli:** Break self-hosted enroll-token crash-loop on identity self-heal
+
+## [2.61.23] — 2026-07-20
+
+### Added
+
+- **shared:** Add Agent Skills wire types (SkillDefinition, SkillsManifest)
+- **shared:** Seed SKILL_REGISTRY with code-review + resolve-conflicts
+- **cli:** Skills.json manifest read/persist/clear util
+- **cli:** Materialize curated SKILL.md bundles under $HOME (namespaced)
+- **cli:** ProvisionSkillsForStart materializes skills before agent spawn
+- **cli:** Persist self-hosted deploy skills manifest to skills.json
+- **cli:** Skills_configure relay command (add/remove/list) in both registries
+- **shared:** Add skillIds to AgentReviewPlan wire type
+
+### Fixed
+
+- **cli:** SKILL.md frontmatter name must match codeam-<id> skill dir
+- **cli:** ConfigureSkill rejects unknown action instead of destructive remove fall-through
+- **cli:** Quote SKILL.md description (valid YAML) + harden skills manifest read
+
+### Tests
+
+- **cli:** Make skills path assertions separator-agnostic (Windows CI)
+
 ## [2.61.21] — 2026-07-18
 
 ### Added

package/dist/index.js

@@ -6117,7 +6117,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.23" : "0.0.0-dev",
+    cliVersion: true ? "2.61.25" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6298,7 +6298,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.23",
+  version: "2.61.25",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -6375,7 +6375,7 @@ var package_default = {
     "@agentclientprotocol/sdk": "1.2.1",
     "@clack/prompts": "^1.2.0",
     chokidar: "^3.6.0",
-    ignore: "^5.3.2",
+    ignore: "^7.0.6",
     picocolors: "^1.1.0",
     "qrcode-terminal": "^0.12.0",
     which: "^6.0.0",
@@ -6394,8 +6394,9 @@ var package_default = {
     "@vitest/coverage-v8": "^4.1.7",
     "node-pty": "^1.1.0",
     tsup: "^8.0.0",
-    typescript: "^6.0.3",
-    vitest: "^4.1.5"
+    typescript: "^7.0.2",
+    vitest: "^4.1.5",
+    yaml: "^2.9.0"
   }
 };
 
@@ -7088,16 +7089,18 @@ var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
 var CommandRelayService = class _CommandRelayService {
-  constructor(pluginId, onCommand, agentMeta, agentsOverride) {
+  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret) {
     this.pluginId = pluginId;
     this.onCommand = onCommand;
     this.agentMeta = agentMeta;
     this.agentsOverride = agentsOverride;
+    this.explicitPollSecret = explicitPollSecret;
   }
   pluginId;
   onCommand;
   agentMeta;
   agentsOverride;
+  explicitPollSecret;
   _running = false;
   pairingInvalid = false;
   heartbeatTimer = null;
@@ -7389,6 +7392,10 @@ var CommandRelayService = class _CommandRelayService {
   // backends (which ignore it).
   pollSecretHeader() {
     const headers = { "X-Codeam-Cmd-Ack": "1" };
+    if (this.explicitPollSecret) {
+      headers["X-Plugin-Poll-Secret"] = this.explicitPollSecret;
+      return headers;
+    }
     try {
       const secret = loadCliConfig().sessions.find(
         (s) => s.pluginId === this.pluginId
@@ -7462,7 +7469,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.23" ? { ideVersion: "2.61.23" } : {}
+      ..."2.61.25" ? { ideVersion: "2.61.25" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -16763,10 +16770,34 @@ function persistOrClearSkillsFromPayload(skills) {
   else clearSkillsManifest();
 }
 
+// src/lib/process-guards.ts
+var installed = false;
+function installRelayCrashGuards() {
+  if (installed) return;
+  installed = true;
+  process.on("unhandledRejection", (reason) => {
+    log.error("process", `unhandledRejection \u2014 relay kept alive \u2014 ${describeReason(reason)}`);
+  });
+  process.on("uncaughtException", (err) => {
+    log.error("process", `uncaughtException \u2014 relay kept alive \u2014 ${describeReason(err)}`);
+  });
+}
+function describeReason(reason) {
+  if (reason instanceof Error) {
+    return reason.stack ?? `${reason.name}: ${reason.message}`;
+  }
+  try {
+    return typeof reason === "string" ? reason : JSON.stringify(reason);
+  } catch {
+    return String(reason);
+  }
+}
+
 // src/commands/host/host-client.ts
 var fs35 = __toESM(require("fs"));
 var os31 = __toESM(require("os"));
 var path39 = __toESM(require("path"));
+var import_node_crypto9 = require("crypto");
 function sampleCpuTimes() {
   let idle = 0;
   let total = 0;
@@ -16829,7 +16860,13 @@ function loadHostIdentity() {
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
       const p2 = parsed;
-      return { hostId: p2.hostId, hostToken: p2.hostToken, controlPluginId: p2.controlPluginId };
+      return {
+        hostId: p2.hostId,
+        hostToken: p2.hostToken,
+        controlPluginId: p2.controlPluginId,
+        // Optional — absent on identities sealed by a pre-secret CLI.
+        ...typeof p2.controlPollSecret === "string" ? { controlPollSecret: p2.controlPollSecret } : {}
+      };
     }
     return null;
   } catch {
@@ -16912,15 +16949,21 @@ function resolveHostLabel(label) {
   return resolved.slice(0, 80);
 }
 async function redeemEnrollToken(token, label) {
+  const controlPollSecret = (0, import_node_crypto9.randomBytes)(32).toString("base64url");
+  const pluginSecretHash = (0, import_node_crypto9.createHash)("sha256").update(controlPollSecret).digest("hex");
   const data = await postJson("/api/self-hosted/redeem", {
     token,
     label: resolveHostLabel(label),
-    osInfo: collectOsInfo()
+    osInfo: collectOsInfo(),
+    // OPTIONAL + backward-compatible: older backends ignore the unknown field
+    // and keep the pre-existing (no-secret) control-channel behavior.
+    pluginSecretHash
   });
   return {
     hostId: data.hostId,
     hostToken: data.hostToken,
-    controlPluginId: data.controlPluginId
+    controlPluginId: data.controlPluginId,
+    controlPollSecret
   };
 }
 async function sendHostHeartbeat(identity, metrics) {
@@ -18288,7 +18331,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.23" : null;
+  const current = true ? "2.61.25" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18305,7 +18348,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.23" : null;
+  const current = true ? "2.61.25" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18325,7 +18368,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.23" : null;
+  return true ? "2.61.25" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve8) => {
@@ -18652,8 +18695,12 @@ var defaultResumeSpawner = (env, cwd) => (0, import_node_child_process24.spawn)(
   detached: false
 });
 var defaultOnIdentityRejected = () => {
+  defaultDisableService();
   deleteHostIdentity();
-  log.warn("host-agent", "host identity rejected by backend \u2014 wiped sealed identity, exiting");
+  log.warn(
+    "host-agent",
+    "host identity rejected by backend \u2014 disabled service + wiped sealed identity, exiting"
+  );
   process.exit(1);
 };
 var defaultOnUpdated = (version3) => {
@@ -18733,11 +18780,12 @@ var HostAgentSupervisor = class {
   }
   /** Open the control channel (reusing the relay) + start heartbeats. */
   start() {
-    const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta) => new CommandRelayService(pluginId, onCommand, meta));
+    const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta, pollSecret) => new CommandRelayService(pluginId, onCommand, meta, void 0, pollSecret));
     this.relay = make(
       this.identity.controlPluginId,
       (cmd) => this.handleCommand(cmd),
-      CONTROL_AGENT_META
+      CONTROL_AGENT_META,
+      this.identity.controlPollSecret
     );
     this.relay.start();
     void this.beat();
@@ -19072,10 +19120,13 @@ var HostAgentSupervisor = class {
       "CODEAM_HOST_LABEL=CodeAgent Box",
       // The enroll token above is a SINGLE-USE bootstrap, but it lives in the
       // container's fixed env — it can't be stripped after first boot like the
-      // self-hosted systemd unit does. This flag tells `resolveHostIdentity`
-      // that on a restart (docker restart / reboot / fleet_start_box wake) an
-      // expired-token redeem is EXPECTED: resume from the sealed identity
-      // instead of dying with "token expired". Not a secret → plain KEY=value.
+      // self-hosted systemd unit does, so on every restart (docker restart /
+      // reboot / fleet_start_box wake) the redeem terminally expires.
+      // `resolveHostIdentity` now resumes from a sealed identity on ANY
+      // terminal enroll-token rejection (not just ephemeral boxes — see its
+      // doc comment), so this flag is no longer load-bearing for that
+      // decision; kept set for observability/back-compat with older CLI
+      // builds that still gate on it. Not a secret → plain KEY=value.
       "-e",
       "CODEAM_ENROLL_EPHEMERAL=1",
       image
@@ -19522,10 +19573,10 @@ async function resolveHostIdentity(enrollToken) {
       return identity;
     } catch (err) {
       if (isTerminalEnrollError(err)) {
-        if (existing && process.env.CODEAM_ENROLL_EPHEMERAL === "1") {
+        if (existing) {
           log.info(
             "host-agent",
-            "ephemeral enroll token expired on restart; resuming from sealed identity"
+            "enroll token terminally rejected (expired/replayed) but a sealed identity is present; resuming from it \u2014 likely a restart, not a re-enroll"
           );
           return existing;
         }
@@ -19549,6 +19600,7 @@ async function resolveHostIdentity(enrollToken) {
   return null;
 }
 async function hostAgent(args2 = []) {
+  installRelayCrashGuards();
   const tokenArg = args2.find((a) => a.startsWith("--token="));
   const enrollToken = (tokenArg ? tokenArg.slice("--token=".length).trim() : "") || process.env.CODEAM_ENROLL_TOKEN || void 0;
   const identity = await resolveHostIdentity(enrollToken);
@@ -23809,29 +23861,6 @@ function buildKeepAlive(ctx) {
   };
 }
 
-// src/lib/process-guards.ts
-var installed = false;
-function installRelayCrashGuards() {
-  if (installed) return;
-  installed = true;
-  process.on("unhandledRejection", (reason) => {
-    log.error("process", `unhandledRejection \u2014 relay kept alive \u2014 ${describeReason(reason)}`);
-  });
-  process.on("uncaughtException", (err) => {
-    log.error("process", `uncaughtException \u2014 relay kept alive \u2014 ${describeReason(err)}`);
-  });
-}
-function describeReason(reason) {
-  if (reason instanceof Error) {
-    return reason.stack ?? `${reason.name}: ${reason.message}`;
-  }
-  try {
-    return typeof reason === "string" ? reason : JSON.stringify(reason);
-  } catch {
-    return String(reason);
-  }
-}
-
 // src/commands/start-infra-only.ts
 var INFRA_ONLY_COMMAND_TYPES = /* @__PURE__ */ new Set([
   // File ops (drive the dashboard's Files panel + open-file).
@@ -25020,7 +25049,7 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
 }
 
 // src/agents/acp/runner.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 
 // src/services/history.service.ts
 var fs60 = __toESM(require("fs"));
@@ -31121,7 +31150,7 @@ async function runOnboardingTurn(opts) {
 }
 
 // src/agents/acp/mappers.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 function mapSessionUpdate(notification) {
   const update = notification.update;
   switch (update.sessionUpdate) {
@@ -31184,7 +31213,7 @@ function mapPermissionRequest(request) {
   }
   return {
     event: {
-      questionId: (0, import_node_crypto9.randomUUID)(),
+      questionId: (0, import_node_crypto10.randomUUID)(),
       prompt,
       options: labels.length > 0 ? labels : void 0
     },
@@ -31194,7 +31223,7 @@ function mapPermissionRequest(request) {
 }
 function messageChunkId(messageId) {
   if (typeof messageId === "string" && messageId.length > 0) return messageId;
-  return (0, import_node_crypto9.randomUUID)();
+  return (0, import_node_crypto10.randomUUID)();
 }
 function extractText4(content) {
   if (!content || typeof content !== "object") return null;
@@ -33188,7 +33217,7 @@ var AcpHistory = class {
       this.summary = trimmed.length > 120 ? trimmed.slice(0, 117) + "\u2026" : trimmed;
     }
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "user",
       text,
       timestamp: Date.now()
@@ -33197,7 +33226,7 @@ var AcpHistory = class {
   appendAgentReply(text) {
     if (text.length === 0) return;
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "agent",
       text,
       timestamp: Date.now()
@@ -33415,7 +33444,7 @@ async function runAcpSession(opts) {
       currentIndex: 0,
       done: true
     }),
-    publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto10.randomUUID)(), prompt, options }),
+    publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto11.randomUUID)(), prompt, options }),
     publishRawChunk: (chunk) => publisher.publishOutput(chunk),
     sendResult: (commandId, status2, result) => relay.sendResult(commandId, status2, result),
     appendAgentReply: (text) => history.appendAgentReply(text),
@@ -34902,7 +34931,7 @@ var NativeTuiDriver = class _NativeTuiDriver {
 };
 
 // src/baton/acp-driver.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var AcpDriver = class {
   constructor(deps) {
     this.deps = deps;
@@ -34995,7 +35024,7 @@ var AcpDriver = class {
         currentIndex: 0,
         done: true
       }),
-      publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto11.randomUUID)(), prompt, options }),
+      publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto12.randomUUID)(), prompt, options }),
       publishRawChunk: (chunk) => publisher.publishOutput(chunk),
       sendResult: (commandId, status2, result) => relay.sendResult(commandId, status2, result),
       appendAgentReply: (text) => history.appendAgentReply(text),
@@ -38162,7 +38191,7 @@ async function invite() {
 // src/commands/doctor.ts
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var fs68 = __toESM(require("fs"));
 var path76 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
@@ -38332,9 +38361,9 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.23" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.25" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
-  const diagnosticId = (0, import_node_crypto12.randomUUID)();
+  const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
   const [dns, health] = await Promise.all([
     checkDns(apiBase2),
@@ -38843,7 +38872,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.23" : "unknown";
+  const v = true ? "2.61.25" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.23",
+  "version": "2.61.25",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -77,7 +77,7 @@
     "@agentclientprotocol/sdk": "1.2.1",
     "@clack/prompts": "^1.2.0",
     "chokidar": "^3.6.0",
-    "ignore": "^5.3.2",
+    "ignore": "^7.0.6",
     "picocolors": "^1.1.0",
     "qrcode-terminal": "^0.12.0",
     "which": "^6.0.0",
@@ -96,7 +96,8 @@
     "@vitest/coverage-v8": "^4.1.7",
     "node-pty": "^1.1.0",
     "tsup": "^8.0.0",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.5",
+    "yaml": "^2.9.0"
   }
 }