codeam-cli 2.61.66 → 2.61.68

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.67] — 2026-07-28
+
+### Added
+
+- **shared:** Cloudflare integration (deployment, OAuth + Cloudflare MCP)
+
+## [2.61.66] — 2026-07-28
+
+### Added
+
+- **shared:** Figma dual-auth (OAuth primary + PAT fallback) — enable design
+
 ## [2.61.65] — 2026-07-28
 
 ### Added

package/dist/index.js

@@ -1255,7 +1255,7 @@ var INTEGRATION_REGISTRY = {
     id: "vercel",
     name: "Vercel",
     icon: "vercel",
-    category: "deployment",
+    category: "infrastructure",
     // DARK — OAuth (PKCE public client). The user authorizes our registered
     // Vercel OAuth app; the access token calls Vercel's OFFICIAL hosted remote
     // MCP (mcp.vercel.com, Streamable HTTP) as a Bearer header — the SAME shim
@@ -1543,6 +1543,92 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
       }
     }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    icon: "cloudflare",
+    category: "infrastructure",
+    // LIVE — Cloudflare self-managed OAuth (dash.cloudflare.com OAuth server,
+    // the same one Wrangler uses). Confidential (Client Secret POST). The agent
+    // inspects/deploys Workers, Pages, DNS, KV, R2 + reads analytics/logs on the
+    // user's account. CLOUDFLARE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI in Secret
+    // Manager (prod+dev); the backend CloudflareOAuthProvider is config-gated (503).
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Cloudflare OAuth scope IDs == API-token permission-group names (dot
+      // form, e.g. `workers-scripts.write`). ⚠️ MUST exactly match the scopes
+      // configured on the OAuth client (b2b4b87e…). `offline_access` → refresh.
+      scopes: [
+        // Developer Platform (Workers / Pages / KV / R2 / D1 / observability)
+        "d1.read",
+        "page.read",
+        "page.write",
+        "workers-ci.read",
+        "workers-ci.write",
+        "containers.read",
+        "containers.write",
+        "workers-kv-storage.read",
+        "workers-kv-storage.write",
+        "workers-observability.read",
+        "workers-observability-telemetry.write",
+        "workers-observability.write",
+        "r2-catalog.read",
+        "r2-catalog.write",
+        "r2-catalog-sql.read",
+        "workers-r2-bucket-item.read",
+        "workers-r2-bucket-item.write",
+        "workers-r2.read",
+        "workers-r2.write",
+        "workers-routes.read",
+        "workers-routes.write",
+        "workers-scripts.read",
+        "workers-scripts.write",
+        "workers-tail.read",
+        // DNS & Zones
+        "account-dns-settings.read",
+        "account-dns-settings.write",
+        "dns-firewall.read",
+        "dns-firewall.write",
+        "dns.read",
+        "dns-view.read",
+        "dns.write",
+        "registrar-domains.admin",
+        "registrar-sandbox-domains.admin",
+        "zone-dns-settings.read",
+        "zone-dns-settings.write",
+        "zone.read",
+        "zone-settings.read",
+        "zone-settings.write",
+        // Analytics & Logs
+        "account-analytics.read",
+        "analytics.read",
+        "account-logs.read",
+        "logs.read",
+        "radar.read",
+        // Account & Billing
+        "account-api-gateway.read",
+        "account-settings.read",
+        "memberships.read",
+        "notifications.read",
+        "user-details.read",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Headless stdio Cloudflare MCP (Cloudflare API v4) — BYO token via env,
+        // the OAuth access token works as a Bearer against api.cloudflare.com.
+        // The account id is the discriminator for account-level ops. PINNED.
+        command: "npx",
+        args: ["-y", "@itunified.io/mcp-cloudflare@2026.4.10-1"],
+        envMapping: {
+          CLOUDFLARE_API_TOKEN: "accessToken",
+          CLOUDFLARE_ACCOUNT_ID: "accountId"
+        }
+      }
+    }
   }
 };
 function getIntegration(id) {
@@ -6988,7 +7074,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.66" : "0.0.0-dev",
+    cliVersion: true ? "2.61.68" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7169,7 +7255,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.66",
+  version: "2.61.68",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8341,7 +8427,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.66" ? { ideVersion: "2.61.66" } : {}
+      ..."2.61.68" ? { ideVersion: "2.61.68" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -19450,7 +19536,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.66" : null;
+  const current = true ? "2.61.68" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19467,7 +19553,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.66" : null;
+  const current = true ? "2.61.68" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19487,7 +19573,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.66" : null;
+  return true ? "2.61.68" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve8) => {
@@ -39726,7 +39812,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.66" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.68" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -40248,7 +40334,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.66" : "unknown";
+  const v = true ? "2.61.68" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.66",
+  "version": "2.61.68",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",