codeam-cli 2.61.24 → 2.61.26

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.25] — 2026-07-23
+
+### Fixed
+
+- **host-agent:** Enrol + present a control-channel poll secret (self-hosted deploy root fix)
+
+## [2.61.24] — 2026-07-22
+
+### Chore
+
+- **cli:** Declare yaml as devDependency (skills materialize test)
+- **deps:** Bump actions/setup-node from 4 to 7 (#452)
+- **deps-dev:** Bump typescript from 6.0.3 to 7.0.2 in /apps/cli (#432)
+- **deps-dev:** Bump typescript from 6.0.3 to 7.0.2 in /apps/vsc-plugin (#430)
+- **deps:** Bump org.jetbrains.kotlin.jvm in /apps/jetbrains-plugin (#453)
+- **deps:** Bump ignore from 5.3.2 to 7.0.6 in /apps/cli (#323)
+- **deps:** Bump org.jetbrains.intellij.platform (#454)
+
+### Fixed
+
+- **cli:** Break self-hosted enroll-token crash-loop on identity self-heal
+
 ## [2.61.23] — 2026-07-20
 
 ### Added

package/dist/index.js

@@ -6117,7 +6117,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.24" : "0.0.0-dev",
+    cliVersion: true ? "2.61.26" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6298,7 +6298,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.24",
+  version: "2.61.26",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7089,16 +7089,18 @@ var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
 var CommandRelayService = class _CommandRelayService {
-  constructor(pluginId, onCommand, agentMeta, agentsOverride) {
+  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret) {
     this.pluginId = pluginId;
     this.onCommand = onCommand;
     this.agentMeta = agentMeta;
     this.agentsOverride = agentsOverride;
+    this.explicitPollSecret = explicitPollSecret;
   }
   pluginId;
   onCommand;
   agentMeta;
   agentsOverride;
+  explicitPollSecret;
   _running = false;
   pairingInvalid = false;
   heartbeatTimer = null;
@@ -7390,6 +7392,10 @@ var CommandRelayService = class _CommandRelayService {
   // backends (which ignore it).
   pollSecretHeader() {
     const headers = { "X-Codeam-Cmd-Ack": "1" };
+    if (this.explicitPollSecret) {
+      headers["X-Plugin-Poll-Secret"] = this.explicitPollSecret;
+      return headers;
+    }
     try {
       const secret = loadCliConfig().sessions.find(
         (s) => s.pluginId === this.pluginId
@@ -7463,7 +7469,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.24" ? { ideVersion: "2.61.24" } : {}
+      ..."2.61.26" ? { ideVersion: "2.61.26" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -16791,6 +16797,7 @@ function describeReason(reason) {
 var fs35 = __toESM(require("fs"));
 var os31 = __toESM(require("os"));
 var path39 = __toESM(require("path"));
+var import_node_crypto9 = require("crypto");
 function sampleCpuTimes() {
   let idle = 0;
   let total = 0;
@@ -16853,7 +16860,13 @@ function loadHostIdentity() {
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
       const p2 = parsed;
-      return { hostId: p2.hostId, hostToken: p2.hostToken, controlPluginId: p2.controlPluginId };
+      return {
+        hostId: p2.hostId,
+        hostToken: p2.hostToken,
+        controlPluginId: p2.controlPluginId,
+        // Optional — absent on identities sealed by a pre-secret CLI.
+        ...typeof p2.controlPollSecret === "string" ? { controlPollSecret: p2.controlPollSecret } : {}
+      };
     }
     return null;
   } catch {
@@ -16936,15 +16949,21 @@ function resolveHostLabel(label) {
   return resolved.slice(0, 80);
 }
 async function redeemEnrollToken(token, label) {
+  const controlPollSecret = (0, import_node_crypto9.randomBytes)(32).toString("base64url");
+  const pluginSecretHash = (0, import_node_crypto9.createHash)("sha256").update(controlPollSecret).digest("hex");
   const data = await postJson("/api/self-hosted/redeem", {
     token,
     label: resolveHostLabel(label),
-    osInfo: collectOsInfo()
+    osInfo: collectOsInfo(),
+    // OPTIONAL + backward-compatible: older backends ignore the unknown field
+    // and keep the pre-existing (no-secret) control-channel behavior.
+    pluginSecretHash
   });
   return {
     hostId: data.hostId,
     hostToken: data.hostToken,
-    controlPluginId: data.controlPluginId
+    controlPluginId: data.controlPluginId,
+    controlPollSecret
   };
 }
 async function sendHostHeartbeat(identity, metrics) {
@@ -18312,7 +18331,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.24" : null;
+  const current = true ? "2.61.26" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18329,7 +18348,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.24" : null;
+  const current = true ? "2.61.26" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18349,7 +18368,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.24" : null;
+  return true ? "2.61.26" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve8) => {
@@ -18761,11 +18780,12 @@ var HostAgentSupervisor = class {
   }
   /** Open the control channel (reusing the relay) + start heartbeats. */
   start() {
-    const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta) => new CommandRelayService(pluginId, onCommand, meta));
+    const make = this.deps.makeRelay ?? ((pluginId, onCommand, meta, pollSecret) => new CommandRelayService(pluginId, onCommand, meta, void 0, pollSecret));
     this.relay = make(
       this.identity.controlPluginId,
       (cmd) => this.handleCommand(cmd),
-      CONTROL_AGENT_META
+      CONTROL_AGENT_META,
+      this.identity.controlPollSecret
     );
     this.relay.start();
     void this.beat();
@@ -25029,7 +25049,7 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
 }
 
 // src/agents/acp/runner.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 
 // src/services/history.service.ts
 var fs60 = __toESM(require("fs"));
@@ -31130,7 +31150,7 @@ async function runOnboardingTurn(opts) {
 }
 
 // src/agents/acp/mappers.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 function mapSessionUpdate(notification) {
   const update = notification.update;
   switch (update.sessionUpdate) {
@@ -31193,7 +31213,7 @@ function mapPermissionRequest(request) {
   }
   return {
     event: {
-      questionId: (0, import_node_crypto9.randomUUID)(),
+      questionId: (0, import_node_crypto10.randomUUID)(),
       prompt,
       options: labels.length > 0 ? labels : void 0
     },
@@ -31203,7 +31223,7 @@ function mapPermissionRequest(request) {
 }
 function messageChunkId(messageId) {
   if (typeof messageId === "string" && messageId.length > 0) return messageId;
-  return (0, import_node_crypto9.randomUUID)();
+  return (0, import_node_crypto10.randomUUID)();
 }
 function extractText4(content) {
   if (!content || typeof content !== "object") return null;
@@ -31998,7 +32018,7 @@ function describeError(err) {
   if (err instanceof Error) return err.message;
   return String(err);
 }
-var AUTH_FAILURE_RE = /invalid authentication credentials|authentication[_ ](?:error|required)|please run \/login|\bunauthorized\b|\binvalid x-api-key\b|oauth token (?:expired|revoked)|(?:api error|http|status)[:\s]+401|\b401\b[^\n]{0,40}(?:unauthor|authenticat|credential|api[_ ]?key|login)/i;
+var AUTH_FAILURE_RE = /invalid authentication credentials|failed to authenticate|authentication[_ ](?:error|required)|please run \/login|\bunauthorized\b|\binvalid x-api-key\b|oauth (?:token|session) (?:expired|revoked)|(?:session|token|credentials?|oauth)[^\n]{0,40}could not be refreshed|(?:api error|http|status)[:\s]+401|\b401\b[^\n]{0,40}(?:unauthor|authenticat|credential|api[_ ]?key|login)/i;
 function looksLikeAuthFailure(text) {
   return AUTH_FAILURE_RE.test(text);
 }
@@ -33197,7 +33217,7 @@ var AcpHistory = class {
       this.summary = trimmed.length > 120 ? trimmed.slice(0, 117) + "\u2026" : trimmed;
     }
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "user",
       text,
       timestamp: Date.now()
@@ -33206,7 +33226,7 @@ var AcpHistory = class {
   appendAgentReply(text) {
     if (text.length === 0) return;
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "agent",
       text,
       timestamp: Date.now()
@@ -33424,7 +33444,7 @@ async function runAcpSession(opts) {
       currentIndex: 0,
       done: true
     }),
-    publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto10.randomUUID)(), prompt, options }),
+    publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto11.randomUUID)(), prompt, options }),
     publishRawChunk: (chunk) => publisher.publishOutput(chunk),
     sendResult: (commandId, status2, result) => relay.sendResult(commandId, status2, result),
     appendAgentReply: (text) => history.appendAgentReply(text),
@@ -34911,7 +34931,7 @@ var NativeTuiDriver = class _NativeTuiDriver {
 };
 
 // src/baton/acp-driver.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var AcpDriver = class {
   constructor(deps) {
     this.deps = deps;
@@ -35004,7 +35024,7 @@ var AcpDriver = class {
         currentIndex: 0,
         done: true
       }),
-      publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto11.randomUUID)(), prompt, options }),
+      publishAwaitingAnswer: (prompt, options) => publisher.publishAwaitingAnswer({ questionId: (0, import_node_crypto12.randomUUID)(), prompt, options }),
       publishRawChunk: (chunk) => publisher.publishOutput(chunk),
       sendResult: (commandId, status2, result) => relay.sendResult(commandId, status2, result),
       appendAgentReply: (text) => history.appendAgentReply(text),
@@ -38171,7 +38191,7 @@ async function invite() {
 // src/commands/doctor.ts
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var fs68 = __toESM(require("fs"));
 var path76 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
@@ -38341,9 +38361,9 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.24" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.26" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
-  const diagnosticId = (0, import_node_crypto12.randomUUID)();
+  const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
   const [dns, health] = await Promise.all([
     checkDns(apiBase2),
@@ -38852,7 +38872,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.24" : "unknown";
+  const v = true ? "2.61.26" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.24",
+  "version": "2.61.26",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",