codeam-cli 2.61.78 → 2.61.80

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.79] — 2026-07-31
+
+### Fixed
+
+- **shared:** Convex uses the api_key (deploy key) rail, not OAuth
+
+## [2.61.78] — 2026-07-31
+
+### Added
+
+- **shared:** Session-tools wire — SESSION_INTEGRATIONS_CHANGED event + repo stack-detect maps
+- **cli:** Session-tools relay — integrations_sync + integrations_detect handlers
+
 ## [2.61.77] — 2026-07-31
 
 ### Added

package/dist/index.js

@@ -1521,28 +1521,34 @@ var INTEGRATION_REGISTRY = {
     name: "Convex",
     icon: "convex",
     category: "database",
-    // LIVE — OAuth 2.0 (authorization code, Confidential). authorize
-    // dashboard.convex.dev/oauth/authorize/team (the scope is the URL PATH —
-    // `team` for team-wide access — NOT a query param); token
-    // api.convex.dev/oauth/token (form-urlencoded, client creds in the BODY).
-    // ⚠️ Convex issues NO refresh token and the team-scoped application token
-    // does not expire, so there is nothing to rotate (refresh() is a re-link
-    // surface). The OAuth app (Team Settings → OAuth Applications) is registered
-    // and CONVEX_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
-    // (prod+dev); the config-gated 503 keeps this safe mid-rollout.
+    // LIVE — api_key rail (the user pastes a Convex DEPLOY KEY).
+    // ⚠️ Convex's OAuth application token was tried first and DOES NOT WORK with
+    // the MCP: it's a narrow Management-API credential — verified live it fails
+    // `convex mcp start` as BOTH CONVEX_DEPLOY_KEY and CONVEX_OVERRIDE_ACCESS_TOKEN,
+    // and can't even enumerate the team's deployments ("requires a Personal
+    // Access Token"). The Convex MCP's DOCUMENTED headless credential is a
+    // DEPLOY KEY (CONVEX_DEPLOY_KEY=dev:…|… / prod:… / project:…), so the user
+    // pastes one (Convex Dashboard → Project Settings → Deploy Keys), exactly
+    // like Azure DevOps / Datadog / Trello. No OAuth app, no GSM secret.
     enabled: true,
     auth: {
-      kind: "oauth_redirect",
-      // ⚠️ Convex's scope is the authorize URL path (`/team`), NOT sent in the
-      // authorize URL as a query param — this list is informational.
-      scopes: []
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "Convex deploy key",
+          placeholder: "prod:happy-animal-123|eyJ2\u2026",
+          secret: true,
+          help: "Convex Dashboard \u2192 Project Settings \u2192 Deploy Keys \u2192 Generate a deploy key."
+        }
+      ]
     },
     delivery: {
       mcp: {
         // Convex's OFFICIAL MCP server ships inside the `convex` npm package
-        // (`convex mcp start`). The team-scoped OAuth application token doubles
-        // as the CLI/MCP deploy key → fed via CONVEX_DEPLOY_KEY (env only, never
-        // argv). Version PINNED; bump only after re-verifying headless.
+        // (`convex mcp start`). The pasted deploy key is fed via CONVEX_DEPLOY_KEY
+        // (env only, never argv) — its documented non-interactive credential.
+        // Version PINNED; bump only after re-verifying headless.
         command: "npx",
         args: ["-y", "convex@1.42.3", "mcp", "start"],
         envMapping: {
@@ -7358,7 +7364,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.78" : "0.0.0-dev",
+    cliVersion: true ? "2.61.80" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7539,7 +7545,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.78",
+  version: "2.61.80",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8771,7 +8777,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.78" ? { ideVersion: "2.61.78" } : {}
+      ..."2.61.80" ? { ideVersion: "2.61.80" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -19885,7 +19891,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.78" : null;
+  const current = true ? "2.61.80" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19902,7 +19908,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.78" : null;
+  const current = true ? "2.61.80" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19922,7 +19928,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.78" : null;
+  return true ? "2.61.80" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -40620,7 +40626,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.78" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.80" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -40877,6 +40883,10 @@ var import_node_child_process31 = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 var RESTART_CHECK_INTERVAL_MS = 3e4;
 var SIGKILL_ESCALATION_MS = 2e3;
+var TOOL_CALL_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 12e4;
+})();
 var REPLAY_INIT_ID = "__codeam_replay_init__";
 var RestartableStdioProxy = class {
   constructor(opts) {
@@ -40887,12 +40897,16 @@ var RestartableStdioProxy = class {
   childRl = null;
   initializeLine = null;
   inflight = /* @__PURE__ */ new Set();
+  /** Per-`tools/call` request-id watchdog timers (see TOOL_CALL_TIMEOUT_MS). */
+  toolTimers = /* @__PURE__ */ new Map();
+  stdout = null;
   swapping = false;
   pendingClientLines = [];
   ended = () => void 0;
   async start() {
     const stdin = this.opts.stdin ?? process.stdin;
     const stdout = this.opts.stdout ?? process.stdout;
+    this.stdout = stdout;
     await this.spawnChild(stdout);
     const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity });
     rl.on("line", (line) => this.onClientLine(line));
@@ -40919,9 +40933,15 @@ var RestartableStdioProxy = class {
       }
       if (msg.method === "notifications/cancelled") {
         const requestId = msg.params?.requestId;
-        if (requestId !== void 0) this.inflight.delete(requestId);
+        if (requestId !== void 0) {
+          this.inflight.delete(requestId);
+          this.clearToolTimeout(requestId);
+        }
+      }
+      if (msg.id !== void 0 && msg.method !== void 0) {
+        this.inflight.add(msg.id);
+        if (msg.method === "tools/call") this.armToolTimeout(msg.id);
       }
-      if (msg.id !== void 0 && msg.method !== void 0) this.inflight.add(msg.id);
     } catch {
     }
     this.child?.stdin?.write(line + "\n");
@@ -40934,12 +40954,54 @@ var RestartableStdioProxy = class {
           return;
         }
         this.inflight.delete(msg.id);
+        this.clearToolTimeout(msg.id);
       }
     } catch {
     }
     stdout.write(line + "\n");
     if (this.inflight.size === 0) this.checkRestart(stdout);
   }
+  /**
+   * Arm a per-`tools/call` watchdog. If the server never answers this request
+   * id within {@link TOOL_CALL_TIMEOUT_MS}, synthesize a JSON-RPC error response
+   * to the client so the agent's turn unblocks (clean tool error) instead of
+   * hanging forever with no Stop. Idempotent per id.
+   */
+  armToolTimeout(id) {
+    const existing = this.toolTimers.get(id);
+    if (existing) clearTimeout(existing);
+    const t2 = setTimeout(() => {
+      this.toolTimers.delete(id);
+      if (!this.inflight.has(id)) return;
+      this.inflight.delete(id);
+      process.stderr.write(
+        `[codeam mcp-run] tools/call id=${String(id)} timed out after ${TOOL_CALL_TIMEOUT_MS}ms \u2014 server did not respond; failing the call so the turn can proceed
+`
+      );
+      const errResponse = {
+        jsonrpc: "2.0",
+        id,
+        error: {
+          code: -32001,
+          message: `MCP tool call timed out after ${Math.round(TOOL_CALL_TIMEOUT_MS / 1e3)}s \u2014 the server did not respond. The target service/deployment may be unreachable (e.g. a Convex dev deployment is only reachable while \`convex dev\` is running \u2014 use a production deploy key or start \`convex dev\`).`
+        }
+      };
+      (this.stdout ?? process.stdout).write(JSON.stringify(errResponse) + "\n");
+    }, TOOL_CALL_TIMEOUT_MS);
+    t2.unref();
+    this.toolTimers.set(id, t2);
+  }
+  clearToolTimeout(id) {
+    const t2 = this.toolTimers.get(id);
+    if (t2) {
+      clearTimeout(t2);
+      this.toolTimers.delete(id);
+    }
+  }
+  clearAllToolTimeouts() {
+    for (const t2 of this.toolTimers.values()) clearTimeout(t2);
+    this.toolTimers.clear();
+  }
   /**
    * Failsafe wrapper for the fire-and-forget call sites (post-response check
    * + the 30 s timer): `maybeRestart` handles the token-fetch failure itself,
@@ -41010,6 +41072,7 @@ var RestartableStdioProxy = class {
     });
     child.on("exit", (code) => {
       if (child !== this.child) return;
+      this.clearAllToolTimeouts();
       this.ended(code ?? 1);
     });
   }
@@ -41142,7 +41205,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.78" : "unknown";
+  const v = true ? "2.61.80" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.78",
+  "version": "2.61.80",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",