codeam-cli 2.61.77 → 2.61.79

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.78] — 2026-07-31
+
+### Added
+
+- **shared:** Session-tools wire — SESSION_INTEGRATIONS_CHANGED event + repo stack-detect maps
+- **cli:** Session-tools relay — integrations_sync + integrations_detect handlers
+
+## [2.61.77] — 2026-07-31
+
+### Added
+
+- **shared:** Add Convex (convex.dev) database integration
+
 ## [2.61.76] — 2026-07-30
 
 ### Added

package/dist/index.js

@@ -1521,28 +1521,34 @@ var INTEGRATION_REGISTRY = {
     name: "Convex",
     icon: "convex",
     category: "database",
-    // LIVE — OAuth 2.0 (authorization code, Confidential). authorize
-    // dashboard.convex.dev/oauth/authorize/team (the scope is the URL PATH —
-    // `team` for team-wide access — NOT a query param); token
-    // api.convex.dev/oauth/token (form-urlencoded, client creds in the BODY).
-    // ⚠️ Convex issues NO refresh token and the team-scoped application token
-    // does not expire, so there is nothing to rotate (refresh() is a re-link
-    // surface). The OAuth app (Team Settings → OAuth Applications) is registered
-    // and CONVEX_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
-    // (prod+dev); the config-gated 503 keeps this safe mid-rollout.
+    // LIVE — api_key rail (the user pastes a Convex DEPLOY KEY).
+    // ⚠️ Convex's OAuth application token was tried first and DOES NOT WORK with
+    // the MCP: it's a narrow Management-API credential — verified live it fails
+    // `convex mcp start` as BOTH CONVEX_DEPLOY_KEY and CONVEX_OVERRIDE_ACCESS_TOKEN,
+    // and can't even enumerate the team's deployments ("requires a Personal
+    // Access Token"). The Convex MCP's DOCUMENTED headless credential is a
+    // DEPLOY KEY (CONVEX_DEPLOY_KEY=dev:…|… / prod:… / project:…), so the user
+    // pastes one (Convex Dashboard → Project Settings → Deploy Keys), exactly
+    // like Azure DevOps / Datadog / Trello. No OAuth app, no GSM secret.
     enabled: true,
     auth: {
-      kind: "oauth_redirect",
-      // ⚠️ Convex's scope is the authorize URL path (`/team`), NOT sent in the
-      // authorize URL as a query param — this list is informational.
-      scopes: []
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "Convex deploy key",
+          placeholder: "prod:happy-animal-123|eyJ2\u2026",
+          secret: true,
+          help: "Convex Dashboard \u2192 Project Settings \u2192 Deploy Keys \u2192 Generate a deploy key."
+        }
+      ]
     },
     delivery: {
       mcp: {
         // Convex's OFFICIAL MCP server ships inside the `convex` npm package
-        // (`convex mcp start`). The team-scoped OAuth application token doubles
-        // as the CLI/MCP deploy key → fed via CONVEX_DEPLOY_KEY (env only, never
-        // argv). Version PINNED; bump only after re-verifying headless.
+        // (`convex mcp start`). The pasted deploy key is fed via CONVEX_DEPLOY_KEY
+        // (env only, never argv) — its documented non-interactive credential.
+        // Version PINNED; bump only after re-verifying headless.
         command: "npx",
         args: ["-y", "convex@1.42.3", "mcp", "start"],
         envMapping: {
@@ -1666,6 +1672,9 @@ var INTEGRATION_REGISTRY = {
     }
   }
 };
+function getEnabledIntegrations() {
+  return Object.values(INTEGRATION_REGISTRY).filter((m) => m.enabled);
+}
 function getIntegration(id) {
   const meta = INTEGRATION_REGISTRY[id];
   if (!meta) throw new Error(`Unknown integration id: ${id}`);
@@ -1675,6 +1684,145 @@ function isKnownIntegrationId(id) {
   return id in INTEGRATION_REGISTRY;
 }
 
+// ../../packages/shared/src/integrations/stack-detect.ts
+var DEP_TO_INTEGRATION = {
+  // errors / observability
+  "@sentry/node": "sentry",
+  "@sentry/react": "sentry",
+  "@sentry/nextjs": "sentry",
+  "@sentry/browser": "sentry",
+  "sentry-sdk": "sentry",
+  "dd-trace": "datadog",
+  "datadog-api-client": "datadog",
+  "datadog-metrics": "datadog",
+  // analytics
+  "posthog-js": "posthog",
+  "posthog-node": "posthog",
+  posthog: "posthog",
+  mixpanel: "mixpanel",
+  "mixpanel-browser": "mixpanel",
+  // database / backend platforms
+  convex: "convex",
+  "@supabase/supabase-js": "supabase",
+  "supabase": "supabase",
+  // infra / deploy
+  vercel: "vercel",
+  "@vercel/node": "vercel",
+  wrangler: "cloudflare",
+  // comms
+  "@slack/web-api": "slack",
+  "@slack/bolt": "slack",
+  "discord.js": "discord",
+  "discord-py": "discord",
+  "discord": "discord",
+  // trackers / docs / design
+  "@linear/sdk": "linear",
+  "@notionhq/client": "notion",
+  "jira.js": "jira",
+  jira: "jira",
+  newman: "postman",
+  "figma-api": "figma",
+  "figma-js": "figma",
+  // email / automation
+  resend: "resend",
+  n8n: "n8n"
+};
+var DEP_PREFIX_TO_INTEGRATION = [
+  ["@sentry/", "sentry"],
+  ["@vercel/", "vercel"],
+  ["@cloudflare/", "cloudflare"],
+  ["@supabase/", "supabase"],
+  ["@slack/", "slack"],
+  ["@datadog/", "datadog"],
+  ["@linear/", "linear"],
+  ["@notionhq/", "notion"]
+];
+var FRONTEND_MARKERS = [
+  "react",
+  "react-dom",
+  "next",
+  "vue",
+  "nuxt",
+  "@angular/core",
+  "svelte",
+  "@sveltejs/kit",
+  "solid-js",
+  "astro",
+  "gatsby",
+  "remix",
+  "@remix-run/react"
+];
+var MOBILE_MARKERS = ["react-native", "expo", "@react-native/core", "@ionic/core", "flutter"];
+var BACKEND_MARKERS = [
+  "express",
+  "fastify",
+  "@nestjs/core",
+  "koa",
+  "@hapi/hapi",
+  "django",
+  "flask",
+  "fastapi",
+  "rails",
+  "sinatra",
+  "gin-gonic",
+  "laravel/framework",
+  "actix-web",
+  "spring-boot"
+];
+function hasAny(deps, markers) {
+  for (const m of markers) if (deps.has(m)) return true;
+  return false;
+}
+function classifyStack(depNames) {
+  const deps = new Set(depNames);
+  const mobile = hasAny(deps, MOBILE_MARKERS);
+  if (mobile) return "mobile";
+  const frontend = hasAny(deps, FRONTEND_MARKERS);
+  const backend = hasAny(deps, BACKEND_MARKERS);
+  if (frontend && backend) return "fullstack";
+  if (frontend) return "frontend";
+  if (backend) return "backend";
+  return "unknown";
+}
+function detectedIntegrationsFromDeps(depNames) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (id) => {
+    if (!seen.has(id)) {
+      seen.add(id);
+      out2.push(id);
+    }
+  };
+  for (const name of depNames) {
+    const exact = DEP_TO_INTEGRATION[name];
+    if (exact) {
+      push(exact);
+      continue;
+    }
+    for (const [prefix, id] of DEP_PREFIX_TO_INTEGRATION) {
+      if (name.startsWith(prefix)) {
+        push(id);
+        break;
+      }
+    }
+  }
+  return out2;
+}
+var STACK_TO_RECOMMENDED = {
+  frontend: ["figma", "sentry", "posthog", "vercel"],
+  backend: ["sentry", "datadog", "supabase", "convex", "cloudflare"],
+  fullstack: ["sentry", "posthog", "vercel", "supabase", "convex"],
+  mobile: ["sentry", "posthog"],
+  unknown: []
+};
+function recommendForDeps(depNames) {
+  const stack = classifyStack(depNames);
+  const detected = detectedIntegrationsFromDeps(depNames);
+  const detectedSet = new Set(detected);
+  const recommended = STACK_TO_RECOMMENDED[stack].filter((id) => !detectedSet.has(id));
+  return { stack, detected, recommended, source: "scan" };
+}
+
 // ../../packages/shared/src/skills/code-review.ts
 var CODE_REVIEW_BODY = `Use this skill when reviewing a pull request. It defines what a high-signal
 review looks like so your inline comments are worth the author's time.
@@ -2102,6 +2250,14 @@ var USER_EVENTS = {
   INTEGRATION_LINKED: "integration_linked",
   INTEGRATION_UNLINKED: "integration_unlinked",
   INTEGRATION_CREDENTIAL_INVALID: "integration_credential_invalid",
+  // Session Tools — add/remove Agent Toolkit integrations on an ALREADY-ACTIVE
+  // session. The backend publishes SESSION_INTEGRATIONS_CHANGED after it persists
+  // the new attached set + relays `integrations_sync` to the box (the CLI rewrites
+  // the manifest + reprovisions the live agent, answered synchronously via the
+  // command result). Drives live UI on the sending device AND any other paired
+  // device on the same session. Mirrored in repo A. (`integrations_detect` is a
+  // pure request/response over the relay — no event.)
+  SESSION_INTEGRATIONS_CHANGED: "session_integrations_changed",
   // CodeRabbit reviewer — the CLI posts these to /api/coderabbit/events; the
   // backend re-publishes them on the per-user SSE bus (mirrored in repo A).
   CODERABBIT_PROGRESS: "coderabbit_progress",
@@ -2306,11 +2462,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path81) {
+function rmIfExistsQuiet(path82) {
   try {
-    fs2.rmSync(path81, { force: true });
+    fs2.rmSync(path82, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path81}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path82}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -2494,8 +2650,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path81) {
-  return path81.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path82) {
+  return path82.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -4975,9 +5131,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path81, ranges, output) {
+function getContextLinesFromFile(path82, ranges, output) {
   return new Promise((resolve9) => {
-    const stream = (0, import_node_fs.createReadStream)(path81);
+    const stream = (0, import_node_fs.createReadStream)(path82);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -4992,7 +5148,7 @@ function getContextLinesFromFile(path81, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path81, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path82, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -5053,8 +5209,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path81) {
-  return path81.startsWith("node:") || path81.endsWith(".min.js") || path81.endsWith(".min.cjs") || path81.endsWith(".min.mjs") || path81.startsWith("data:");
+function shouldSkipContextLinesForFile(path82) {
+  return path82.startsWith("node:") || path82.endsWith(".min.js") || path82.endsWith(".min.cjs") || path82.endsWith(".min.mjs") || path82.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -7208,7 +7364,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.77" : "0.0.0-dev",
+    cliVersion: true ? "2.61.79" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7389,7 +7545,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.77",
+  version: "2.61.79",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8621,7 +8777,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.77" ? { ideVersion: "2.61.77" } : {}
+      ..."2.61.79" ? { ideVersion: "2.61.79" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -15230,8 +15386,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path81 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path81) return null;
+  const path82 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path82) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -15248,7 +15404,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path81.trim(),
+    path: path82.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -15331,10 +15487,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path81, lineNo, sevToken, message] = m;
-    if (!path81 || !lineNo || !message) continue;
+    const [, path82, lineNo, sevToken, message] = m;
+    if (!path82 || !lineNo || !message) continue;
     hunks.push({
-      path: path81.trim(),
+      path: path82.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -19735,7 +19891,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.77" : null;
+  const current = true ? "2.61.79" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19752,7 +19908,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.77" : null;
+  const current = true ? "2.61.79" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19772,7 +19928,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.77" : null;
+  return true ? "2.61.79" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -25666,11 +25822,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path81 = fileFlag.slice("--token-file=".length);
+    const path82 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs59.readFileSync(path81, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path81} is empty`);
-      rmIfExistsQuiet(path81);
+      const content = fs59.readFileSync(path82, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path82} is empty`);
+      rmIfExistsQuiet(path82);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -31901,6 +32057,51 @@ var AcpClient = class {
     if (loaded?.modes !== void 0) this.captureModes(loaded.modes ?? null);
     log.info("acpClient", `loadSession \u2190 ok sessionId=${sessionId.slice(0, 8)}`);
   }
+  /** The conversation id the agent is currently serving (null before start). */
+  getActiveSessionId() {
+    return this.sessionId;
+  }
+  /**
+   * Re-register the agent's MCP servers on an ALREADY-RUNNING session (Session
+   * Tools — adding/removing an integration mid-session). MCP servers are bound
+   * at `session/new`, and `session/load` on the CURRENTLY-running session wedges
+   * Claude (the self-load guard in {@link loadSession}), so the only reliable way
+   * to add a server to a live session is a controlled RESPAWN that resumes the
+   * conversation: kill the agent → fresh `startOnce()` (a new session S2 bound to
+   * the new `mcpServers`) → `loadSession(prevConversationId)` (S1 ≠ S2, so the
+   * self-load guard doesn't fire) to resume the thread with the new tools live.
+   *
+   * Best-effort + degrade-safe: `this.opts.mcpServers` is updated FIRST (so even
+   * a failed respawn leaves the new set to bind on the next natural
+   * re-establishment — wake/resume/recovery), and any throw resolves to
+   * `'deferred'` rather than tearing down the session. Returns which happened so
+   * the caller can tell the user "active now" vs "active on next restart".
+   */
+  async reprovisionMcp(servers) {
+    this.opts.mcpServers = servers;
+    const prevConversationId = this.sessionId;
+    if (!this.connection || !prevConversationId) return "deferred";
+    try {
+      log.info(
+        "acpClient",
+        `reprovisionMcp \u2192 respawn to bind ${servers.length} MCP server(s), resuming ${prevConversationId.slice(0, 8)}`
+      );
+      await this.stop();
+      this.stopping = false;
+      await this.startOnce();
+      if (this.supportsLoadSession && prevConversationId !== this.sessionId) {
+        await this.loadSession(prevConversationId);
+      }
+      log.info("acpClient", "reprovisionMcp \u2190 reloaded (tools live)");
+      return "reloaded";
+    } catch (err) {
+      log.warn(
+        "acpClient",
+        `reprovisionMcp respawn failed \u2014 tools apply on next restart: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return "deferred";
+    }
+  }
   /**
    * Enumerate the workspace's conversations via the ACP `session/list` RPC.
    * Agent-agnostic — works for ANY adapter that advertises
@@ -33275,7 +33476,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs71 = await import("fs/promises");
+  const fs72 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -33283,7 +33484,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs71.readdir(dir, { withFileTypes: true });
+      const dirents = await fs72.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -33926,6 +34127,146 @@ async function postBudgetReached(opts, fetchImpl = fetch) {
   }
 }
 
+// src/integrations/provision.ts
+function buildMcpServersForStart(ctx) {
+  const manifest = readIntegrationsManifest();
+  if (!manifest || manifest.integrations.length === 0) return [];
+  if (!ctx.pluginAuthToken) {
+    log.warn("integrations", "manifest present but no plugin auth token \u2014 skipping MCP injection");
+    return [];
+  }
+  const servers = [];
+  for (const entry of manifest.integrations) {
+    if (!entry.delivery.mcp) continue;
+    const env = [
+      { name: "CODEAM_MCP_INTEGRATION_ID", value: entry.id },
+      { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
+      { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
+      // Plugin token in ENV, never argv — argv is visible via `ps`.
+      { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
+      ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+    ];
+    servers.push({
+      name: entry.id,
+      // Never trust the agent's PATH for the shim binary (beads v2.39.5
+      // lesson) — re-invoke this same Node runtime + CLI entrypoint.
+      command: process.execPath,
+      args: [process.argv[1], "mcp-run", entry.id],
+      env
+    });
+  }
+  if (servers.length) {
+    log.info(
+      "integrations",
+      `injecting ${servers.length} MCP server(s): ${servers.map((s) => s.name).join(", ")}`
+    );
+  }
+  return servers;
+}
+
+// src/integrations/detect-stack.ts
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
+function readSafe(cwd, rel) {
+  try {
+    return import_node_fs11.default.readFileSync(import_node_path11.default.join(cwd, rel), "utf8");
+  } catch {
+    return "";
+  }
+}
+function collectRepoDeps(cwd) {
+  const names = /* @__PURE__ */ new Set();
+  const pkgRaw = readSafe(cwd, "package.json");
+  if (pkgRaw) {
+    try {
+      const pkg = JSON.parse(pkgRaw);
+      for (const k2 of Object.keys(pkg.dependencies ?? {})) names.add(k2);
+      for (const k2 of Object.keys(pkg.devDependencies ?? {})) names.add(k2);
+    } catch {
+    }
+  }
+  const req = readSafe(cwd, "requirements.txt");
+  for (const line of req.split("\n")) {
+    const name = line.trim().split(/[=<>!~;[\s]/)[0];
+    if (name && !name.startsWith("#") && !name.startsWith("-")) names.add(name.toLowerCase());
+  }
+  const pyproject = readSafe(cwd, "pyproject.toml");
+  for (const m of pyproject.matchAll(/^\s*["']?([A-Za-z0-9._-]+)["']?\s*[=~<>]/gm)) {
+    if (m[1]) names.add(m[1].toLowerCase());
+  }
+  const goMod = readSafe(cwd, "go.mod");
+  for (const m of goMod.matchAll(/^\s*([\w./-]+)\s+v\d/gm)) {
+    if (m[1]) names.add(m[1]);
+  }
+  const gemfile = readSafe(cwd, "Gemfile");
+  for (const m of gemfile.matchAll(/^\s*gem\s+["']([A-Za-z0-9._-]+)["']/gm)) {
+    if (m[1]) names.add(m[1]);
+  }
+  const composerRaw = readSafe(cwd, "composer.json");
+  if (composerRaw) {
+    try {
+      const composer = JSON.parse(composerRaw);
+      for (const k2 of Object.keys(composer.require ?? {})) names.add(k2);
+      for (const k2 of Object.keys(composer["require-dev"] ?? {})) names.add(k2);
+    } catch {
+    }
+  }
+  const cargo = readSafe(cwd, "Cargo.toml");
+  const cargoDepsBlock = cargo.match(/\[(?:dev-)?dependencies\]([\s\S]*?)(?:\n\[|$)/g);
+  if (cargoDepsBlock) {
+    for (const block of cargoDepsBlock) {
+      for (const m of block.matchAll(/^\s*([A-Za-z0-9._-]+)\s*=/gm)) {
+        if (m[1] && m[1] !== "dependencies" && m[1] !== "dev-dependencies") names.add(m[1]);
+      }
+    }
+  }
+  return [...names];
+}
+function enabledCatalogIds() {
+  return getEnabledIntegrations().map((m) => m.id);
+}
+function parseAgentSuggestions(raw) {
+  const match = raw.match(/\[[\s\S]*?\]/);
+  if (!match) return [];
+  let arr;
+  try {
+    arr = JSON.parse(match[0]);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(arr)) return [];
+  const enabled = new Set(enabledCatalogIds());
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const v of arr) {
+    if (typeof v === "string" && isKnownIntegrationId(v) && enabled.has(v) && !seen.has(v)) {
+      seen.add(v);
+      out2.push(v);
+    }
+  }
+  return out2;
+}
+async function detectRepoStack(cwd, runtime) {
+  const deps = collectRepoDeps(cwd);
+  const scan = recommendForDeps(deps);
+  if (scan.detected.length > 0 || scan.recommended.length > 0) return scan;
+  if (!runtime?.generateOneShot) return scan;
+  try {
+    const catalog = enabledCatalogIds().join(", ");
+    const prompt = `Inspect this repository (frameworks, languages, services it integrates with) and suggest which of these developer tools would be most useful to connect. Respond with ONLY a JSON array of ids chosen from this exact set: [${catalog}]. No prose, no ids outside the set. Example: ["sentry","posthog"].`;
+    const reply = await runtime.generateOneShot(prompt, { cwd, timeoutMs: 45e3 });
+    if (!reply) return scan;
+    const recommended = parseAgentSuggestions(reply);
+    return { stack: scan.stack, detected: [], recommended, source: "agent" };
+  } catch (err) {
+    log.warn("integrations", `stack detect agent fallback failed: ${err instanceof Error ? err.message : String(err)}`);
+    return scan;
+  }
+}
+
+// src/agents/acp/command-handlers.ts
+var import_node_child_process30 = require("child_process");
+
 // src/agents/acp/buildAcpPromptBlocks.ts
 var MIME_FROM_EXT = {
   png: "image/png",
@@ -34537,7 +34878,74 @@ async function legacyOrUnsupportedH(ctx) {
   });
   return;
 }
+async function prewarmNewMcpEntries(manifest, previousIds) {
+  const PREWARMABLE = /* @__PURE__ */ new Set(["npx", "uvx"]);
+  const fresh = manifest.integrations.filter(
+    (e) => !previousIds.has(e.id) && e.delivery.mcp && PREWARMABLE.has(e.delivery.mcp.command)
+  );
+  await Promise.all(
+    fresh.map(
+      (e) => new Promise((resolve9) => {
+        const mcp = e.delivery.mcp;
+        const child = (0, import_node_child_process30.execFile)(
+          mcp.command,
+          [...mcp.args, "--help"],
+          { timeout: 9e4 },
+          () => resolve9()
+        );
+        child.on("error", () => resolve9());
+      })
+    )
+  );
+}
+async function integrationsSyncH(ctx) {
+  const { cmd, relay, opts, client: client3 } = ctx;
+  const manifest = cmd.payload.manifest;
+  if (!manifest || !Array.isArray(manifest.integrations)) {
+    await relay.sendResult(cmd.id, "failed", { error: "integrations_sync: missing manifest" });
+    return;
+  }
+  try {
+    const previousIds = new Set((readIntegrationsManifest()?.integrations ?? []).map((e) => e.id));
+    persistIntegrationsManifest(manifest);
+    await prewarmNewMcpEntries(manifest, previousIds);
+    const servers = buildMcpServersForStart({
+      sessionId: opts.sessionId,
+      pluginId: opts.pluginId,
+      pluginAuthToken: opts.pluginAuthToken,
+      pollSecret: opts.pollSecret
+    });
+    const applied = await client3.reprovisionMcp(servers);
+    await relay.sendResult(cmd.id, "completed", {
+      synced: true,
+      applied,
+      // 'reloaded' (live now) | 'deferred' (next restart)
+      attached: manifest.integrations.map((e) => e.id)
+    });
+  } catch (err) {
+    log.warn("acpRunner", `integrations_sync failed (tools apply next restart): ${describeError(err)}`);
+    await relay.sendResult(cmd.id, "completed", { synced: false, error: describeError(err) });
+  }
+}
+async function integrationsDetectH(ctx) {
+  const { cmd, relay, opts } = ctx;
+  try {
+    const runtime = createInteractiveAgentStrategy(opts.agent, createOsStrategy());
+    const detection = await detectRepoStack(opts.cwd, runtime);
+    await relay.sendResult(cmd.id, "completed", detection);
+  } catch (err) {
+    log.warn("acpRunner", `integrations_detect failed: ${describeError(err)}`);
+    await relay.sendResult(cmd.id, "completed", {
+      stack: "unknown",
+      detected: [],
+      recommended: [],
+      source: "scan"
+    });
+  }
+}
 var ACP_COMMAND_HANDLERS = {
+  integrations_sync: integrationsSyncH,
+  integrations_detect: integrationsDetectH,
   beads_action: beadsActionH,
   start_task: startTaskH,
   group_mention_task: groupMentionTaskH,
@@ -36510,8 +36918,8 @@ function startClaudeCredentialSync(opts) {
 }
 
 // src/beads/workflow-hint.ts
-var fs67 = __toESM(require("fs"));
-var path73 = __toESM(require("path"));
+var fs68 = __toESM(require("fs"));
+var path74 = __toESM(require("path"));
 var os55 = __toESM(require("os"));
 var BEADS_HINT_MARKER = "<!-- codeam:beads-workflow -->";
 var BEADS_HINT = `${BEADS_HINT_MARKER}
@@ -36528,61 +36936,24 @@ This environment uses **bd (beads)** for issue/task tracking and persistent memo
 ${BEADS_HINT_MARKER}`;
 function ensureBeadsWorkflowHint(homeDir2 = os55.homedir()) {
   try {
-    const file = path73.join(homeDir2, ".claude", "CLAUDE.md");
+    const file = path74.join(homeDir2, ".claude", "CLAUDE.md");
     let existing = "";
     try {
-      existing = fs67.readFileSync(file, "utf8");
+      existing = fs68.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT_MARKER)) return;
-    fs67.mkdirSync(path73.dirname(file), { recursive: true });
+    fs68.mkdirSync(path74.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${BEADS_HINT}
 ` : `${BEADS_HINT}
 `;
-    fs67.writeFileSync(file, next);
+    fs68.writeFileSync(file, next);
   } catch {
   }
 }
 
-// src/integrations/provision.ts
-function buildMcpServersForStart(ctx) {
-  const manifest = readIntegrationsManifest();
-  if (!manifest || manifest.integrations.length === 0) return [];
-  if (!ctx.pluginAuthToken) {
-    log.warn("integrations", "manifest present but no plugin auth token \u2014 skipping MCP injection");
-    return [];
-  }
-  const servers = [];
-  for (const entry of manifest.integrations) {
-    if (!entry.delivery.mcp) continue;
-    const env = [
-      { name: "CODEAM_MCP_INTEGRATION_ID", value: entry.id },
-      { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
-      { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
-      // Plugin token in ENV, never argv — argv is visible via `ps`.
-      { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
-      ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
-    ];
-    servers.push({
-      name: entry.id,
-      // Never trust the agent's PATH for the shim binary (beads v2.39.5
-      // lesson) — re-invoke this same Node runtime + CLI entrypoint.
-      command: process.execPath,
-      args: [process.argv[1], "mcp-run", entry.id],
-      env
-    });
-  }
-  if (servers.length) {
-    log.info(
-      "integrations",
-      `injecting ${servers.length} MCP server(s): ${servers.map((s) => s.name).join(", ")}`
-    );
-  }
-  return servers;
-}
-
 // src/skills/provision.ts
 var import_node_os13 = __toESM(require("os"));
 function provisionSkillsForStart(home = import_node_os13.default.homedir()) {
@@ -36950,7 +37321,7 @@ var AcpDriver = class {
 };
 
 // src/baton/transcript-mirror.ts
-var fs68 = __toESM(require("fs"));
+var fs69 = __toESM(require("fs"));
 var TranscriptMirror = class {
   constructor(deps) {
     this.deps = deps;
@@ -37017,7 +37388,7 @@ var TranscriptMirror = class {
   }
 };
 function defaultWatch(file, onChange) {
-  const w3 = fs68.watch(file, { persistent: false }, () => onChange());
+  const w3 = fs69.watch(file, { persistent: false }, () => onChange());
   return () => w3.close();
 }
 
@@ -37279,16 +37650,16 @@ function toEpochMs(ts) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs69 = __toESM(require("fs"));
+var fs70 = __toESM(require("fs"));
 var os57 = __toESM(require("os"));
-var path74 = __toESM(require("path"));
+var path75 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path74.join(os57.homedir(), ".claude.json");
+    const file = path75.join(os57.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs69.readFileSync(file, "utf8"));
+      config = JSON.parse(fs70.readFileSync(file, "utf8"));
     } catch {
     }
     let changed = false;
@@ -37313,8 +37684,8 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs69.mkdirSync(path74.dirname(file), { recursive: true });
-    fs69.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs70.mkdirSync(path75.dirname(file), { recursive: true });
+    fs70.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
       `pre-completed Claude onboarding${cwd ? ` + trusted workspace ${cwd}` : ""}`
@@ -38041,7 +38412,7 @@ var import_picocolors11 = __toESM(require("picocolors"));
 var import_child_process29 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors9 = __toESM(require("picocolors"));
-var path75 = __toESM(require("path"));
+var path76 = __toESM(require("path"));
 var execFileP6 = (0, import_util4.promisify)(import_child_process29.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -38530,7 +38901,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path75.posix.dirname(remotePath);
+    const remoteDir = path76.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -38600,7 +38971,7 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process30 = require("child_process");
 var import_util5 = require("util");
-var path76 = __toESM(require("path"));
+var path77 = __toESM(require("path"));
 var import_picocolors10 = __toESM(require("picocolors"));
 var execFileP7 = (0, import_util5.promisify)(import_child_process30.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
@@ -38840,7 +39211,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path76.posix.dirname(remotePath);
+    const remoteDir = path77.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -38876,7 +39247,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process31 = require("child_process");
 var import_util6 = require("util");
-var path77 = __toESM(require("path"));
+var path78 = __toESM(require("path"));
 var execFileP8 = (0, import_util6.promisify)(import_child_process31.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -39136,7 +39507,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path77.posix.dirname(remotePath);
+    const remoteDir = path78.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -39204,7 +39575,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process32 = require("child_process");
 var import_util7 = require("util");
-var path78 = __toESM(require("path"));
+var path79 = __toESM(require("path"));
 var execFileP9 = (0, import_util7.promisify)(import_child_process32.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -39440,7 +39811,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path78.posix.dirname(remotePath);
+    const remoteDir = path79.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -39971,9 +40342,9 @@ async function probeCodeamPair(provider, workspace) {
 }
 async function stopWorkspaceFromLocal(target) {
   if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile14 } = await import("child_process");
+    const { execFile: execFile15 } = await import("child_process");
     const { promisify: promisify11 } = await import("util");
-    const execFileP10 = promisify11(execFile14);
+    const execFileP10 = promisify11(execFile15);
     await execFileP10("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
     return;
   }
@@ -40086,8 +40457,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto13 = require("crypto");
-var fs70 = __toESM(require("fs"));
-var path79 = __toESM(require("path"));
+var fs71 = __toESM(require("fs"));
+var path80 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -40143,13 +40514,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path79.join(require("os").homedir(), ".codeam");
+  const dir = path80.join(require("os").homedir(), ".codeam");
   try {
-    fs70.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path79.join(dir, ".doctor-probe");
-    fs70.writeFileSync(probe, "ok", { mode: 384 });
-    const read2 = fs70.readFileSync(probe, "utf8");
-    fs70.unlinkSync(probe);
+    fs71.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path80.join(dir, ".doctor-probe");
+    fs71.writeFileSync(probe, "ok", { mode: 384 });
+    const read2 = fs71.readFileSync(probe, "utf8");
+    fs71.unlinkSync(probe);
     if (read2 !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -40213,7 +40584,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path79.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path80.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -40255,7 +40626,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.77" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.79" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -40452,10 +40823,10 @@ async function completion(args2) {
 }
 
 // src/integrations/mcp-run.ts
-var import_node_child_process31 = require("child_process");
-var import_node_fs11 = require("fs");
+var import_node_child_process32 = require("child_process");
+var import_node_fs12 = require("fs");
 var import_node_os14 = __toESM(require("os"));
-var import_node_path11 = __toESM(require("path"));
+var import_node_path12 = __toESM(require("path"));
 
 // src/integrations/token-client.ts
 var REFRESH_AHEAD_MS = 5 * 60 * 1e3;
@@ -40508,7 +40879,7 @@ var IntegrationTokenClient = class {
 };
 
 // src/integrations/stdio-proxy.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process31 = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 var RESTART_CHECK_INTERVAL_MS = 3e4;
 var SIGKILL_ESCALATION_MS = 2e3;
@@ -40629,7 +41000,7 @@ var RestartableStdioProxy = class {
   }
   async spawnChild(stdout, preResolved) {
     const spec = preResolved ?? await this.opts.spawnSpec();
-    const spawn44 = this.opts.spawnImpl ?? import_node_child_process30.spawn;
+    const spawn44 = this.opts.spawnImpl ?? import_node_child_process31.spawn;
     const child = spawn44(spec.command, spec.args, {
       env: { ...process.env, ...spec.env },
       // env only — never argv
@@ -40669,7 +41040,7 @@ function resolveDelivery(id) {
 function commandExists(command2) {
   try {
     const probe = process.platform === "win32" ? "where" : "which";
-    (0, import_node_child_process31.execFileSync)(probe, [command2], { stdio: "ignore" });
+    (0, import_node_child_process32.execFileSync)(probe, [command2], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -40677,13 +41048,13 @@ function commandExists(command2) {
 }
 function localBinCandidates(command2) {
   return [
-    import_node_path11.default.join(import_node_os14.default.homedir(), ".local", "bin", command2),
-    import_node_path11.default.join(import_node_os14.default.homedir(), ".cargo", "bin", command2)
+    import_node_path12.default.join(import_node_os14.default.homedir(), ".local", "bin", command2),
+    import_node_path12.default.join(import_node_os14.default.homedir(), ".cargo", "bin", command2)
   ];
 }
 function resolveLauncherPath(command2, deps = {
   commandExists,
-  existsSync: import_node_fs11.existsSync
+  existsSync: import_node_fs12.existsSync
 }) {
   if (deps.commandExists(command2)) return command2;
   for (const candidate of localBinCandidates(command2)) {
@@ -40702,7 +41073,7 @@ function ensureCommand(command2) {
   }
   if (command2 === "uvx") {
     try {
-      (0, import_node_child_process31.execSync)("curl -LsSf https://astral.sh/uv/install.sh | sh", {
+      (0, import_node_child_process32.execSync)("curl -LsSf https://astral.sh/uv/install.sh | sh", {
         stdio: ["ignore", process.stderr, process.stderr],
         timeout: 18e4,
         env: { ...process.env, UV_NO_MODIFY_PATH: "1" }
@@ -40711,7 +41082,7 @@ function ensureCommand(command2) {
     }
     if (resolveLauncherPath(command2) !== command2) return;
     try {
-      (0, import_node_child_process31.execSync)("python3 -m pip install --user --quiet uv", {
+      (0, import_node_child_process32.execSync)("python3 -m pip install --user --quiet uv", {
         stdio: ["ignore", process.stderr, process.stderr],
         timeout: 18e4
       });
@@ -40777,7 +41148,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.77" : "unknown";
+  const v = true ? "2.61.79" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.77",
+  "version": "2.61.79",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",