codeam-cli 2.61.79 → 2.61.81

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.80] — 2026-08-03
+
+### Fixed
+
+- **cli:** MCP tools/call watchdog — a hung MCP server no longer wedges the turn
+
+## [2.61.79] — 2026-07-31
+
+### Fixed
+
+- **shared:** Convex uses the api_key (deploy key) rail, not OAuth
+
 ## [2.61.78] — 2026-07-31
 
 ### Added

package/dist/index.js

@@ -89,6 +89,165 @@ var require_src = __commonJS({
   }
 });
 
+// src/integrations/convex-admin-mcp.ts
+var convex_admin_mcp_exports = {};
+__export(convex_admin_mcp_exports, {
+  callConvexTool: () => callConvexTool,
+  deploymentNameFromKey: () => deploymentNameFromKey,
+  runConvexAdminMcp: () => runConvexAdminMcp
+});
+function deploymentNameFromKey(key) {
+  const prefix = key.split("|")[0];
+  const segs = prefix.split(":");
+  if ((segs[0] === "dev" || segs[0] === "prod" || segs[0] === "preview") && segs[1]) {
+    return segs[1];
+  }
+  return null;
+}
+async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) {
+  const res = await fetchImpl(`${baseUrl}/api/${api}`, {
+    method: "POST",
+    headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const text = await res.text();
+  const ok = res.ok && !/"status"\s*:\s*"error"/.test(text);
+  return { ok, text };
+}
+async function callConvexTool(baseUrl, key, tool, args2, fetchImpl = fetch) {
+  switch (tool) {
+    case "tables":
+      return adminQuery(baseUrl, key, "query", {
+        path: "_system/frontend/getTableMapping",
+        args: {},
+        format: "json"
+      }, fetchImpl);
+    case "schema":
+      return adminQuery(baseUrl, key, "query", {
+        path: "_system/frontend/getSchemas",
+        args: {},
+        format: "json"
+      }, fetchImpl);
+    case "data":
+      return adminQuery(baseUrl, key, "query", {
+        path: "_system/cli/queryTable",
+        args: { tableName: String(args2.table ?? ""), order: "desc", limit: Number(args2.limit ?? 50) },
+        format: "json"
+      }, fetchImpl);
+    case "run_query":
+      return adminQuery(baseUrl, key, "query", {
+        path: String(args2.functionPath ?? ""),
+        args: args2.args ?? {},
+        format: "json"
+      }, fetchImpl);
+    case "run_mutation":
+      return adminQuery(baseUrl, key, "mutation", {
+        path: String(args2.functionPath ?? ""),
+        args: args2.args ?? {},
+        format: "json"
+      }, fetchImpl);
+    default:
+      return { ok: false, text: `Unknown tool: ${tool}` };
+  }
+}
+async function runConvexAdminMcp(client3, id) {
+  const token = await client3.getToken(id);
+  const key = token.accessToken;
+  const name = deploymentNameFromKey(key);
+  if (!name) {
+    process.stderr.write(
+      `[codeam mcp-run convex] could not derive a deployment from the deploy key (expected a dev/prod deploy key like dev:name|\u2026 \u2014 got prefix "${key.split(":")[0]}"). Generate a deploy key at Convex Dashboard \u2192 Project Settings \u2192 Deploy Keys.
+`
+    );
+    process.exit(1);
+  }
+  const baseUrl = `https://${name}.convex.cloud`;
+  const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { ListToolsRequestSchema, CallToolRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
+  const server = new Server(
+    { name: "convex", version: "1.0.0" },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const tool = req.params.name;
+    const args2 = req.params.arguments ?? {};
+    try {
+      const { ok, text } = await callConvexTool(baseUrl, key, tool, args2);
+      return { content: [{ type: "text", text }], isError: !ok };
+    } catch (err) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Convex admin API request failed: ${err instanceof Error ? err.message : String(err)}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  await server.connect(new StdioServerTransport());
+}
+var TOOLS;
+var init_convex_admin_mcp = __esm({
+  "src/integrations/convex-admin-mcp.ts"() {
+    "use strict";
+    TOOLS = [
+      {
+        name: "tables",
+        description: "List the tables in the connected Convex deployment (name + id). Start here to discover the schema.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false }
+      },
+      {
+        name: "schema",
+        description: "Get the deployed schema (table definitions + validators) of the Convex deployment.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false }
+      },
+      {
+        name: "data",
+        description: "Read documents from a table (most-recent first). Provide the table name.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            table: { type: "string", description: "The table name (from `tables`)." },
+            limit: { type: "number", description: "Max documents to return (default 50)." }
+          },
+          required: ["table"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "run_query",
+        description: 'Run a read-only Convex query function by its path (e.g. "messages:list") with JSON args.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            functionPath: { type: "string", description: 'Function path, e.g. "messages:list".' },
+            args: { type: "object", description: "Arguments object for the function (default {})." }
+          },
+          required: ["functionPath"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "run_mutation",
+        description: "Run a Convex mutation function by its path with JSON args (writes data).",
+        inputSchema: {
+          type: "object",
+          properties: {
+            functionPath: { type: "string" },
+            args: { type: "object" }
+          },
+          required: ["functionPath"],
+          additionalProperties: false
+        }
+      }
+    ];
+  }
+});
+
 // src/integrations/http-relay.ts
 var http_relay_exports = {};
 __export(http_relay_exports, {
@@ -1521,15 +1680,19 @@ var INTEGRATION_REGISTRY = {
     name: "Convex",
     icon: "convex",
     category: "database",
-    // LIVE — api_key rail (the user pastes a Convex DEPLOY KEY).
-    // ⚠️ Convex's OAuth application token was tried first and DOES NOT WORK with
-    // the MCP: it's a narrow Management-API credential — verified live it fails
-    // `convex mcp start` as BOTH CONVEX_DEPLOY_KEY and CONVEX_OVERRIDE_ACCESS_TOKEN,
-    // and can't even enumerate the team's deployments ("requires a Personal
-    // Access Token"). The Convex MCP's DOCUMENTED headless credential is a
-    // DEPLOY KEY (CONVEX_DEPLOY_KEY=dev:…|… / prod:… / project:…), so the user
-    // pastes one (Convex Dashboard → Project Settings → Deploy Keys), exactly
-    // like Azure DevOps / Datadog / Trello. No OAuth app, no GSM secret.
+    // LIVE — api_key rail (the user pastes a Convex DEPLOY KEY) + a BUILT-IN MCP.
+    // ⚠️ Convex's OWN `convex mcp start` server CANNOT work headlessly: it
+    // categorically requires an INTERACTIVE `npx convex dev`/`login`
+    // personal-access-token and REJECTS every headless credential — OAuth token,
+    // dev/prod deploy key, self-hosted admin key, with every flag
+    // (--deployment/--prod/--project-dir) — all return "Not Authorized: Run
+    // `npx convex dev` to login" (verified LIVE, exhaustively, 2026-08-03; it
+    // also HANGS on the failed auth = the mareado/no-Stop wedge). BUT the
+    // deployment's own HTTP admin API accepts the deploy key directly
+    // (`Authorization: Convex <deployKey>` → 200; verified). So we serve Convex's
+    // tools ourselves via a BUILT-IN MCP (delivery.builtin) against that admin
+    // API — see apps/cli/src/integrations/convex-admin-mcp.ts. The user still
+    // pastes a deploy key (Dashboard → Project Settings → Deploy Keys).
     enabled: true,
     auth: {
       kind: "api_key",
@@ -1545,15 +1708,14 @@ var INTEGRATION_REGISTRY = {
     },
     delivery: {
       mcp: {
-        // Convex's OFFICIAL MCP server ships inside the `convex` npm package
-        // (`convex mcp start`). The pasted deploy key is fed via CONVEX_DEPLOY_KEY
-        // (env only, never argv) — its documented non-interactive credential.
-        // Version PINNED; bump only after re-verifying headless.
-        command: "npx",
-        args: ["-y", "convex@1.42.3", "mcp", "start"],
-        envMapping: {
-          CONVEX_DEPLOY_KEY: "accessToken"
-        }
+        // BUILT-IN MCP: the CLI serves Convex's tools itself against the
+        // deployment admin REST API with the brokered deploy key (Convex's own
+        // `convex mcp start` rejects all headless creds — see the note above).
+        // No spawned child, no npx. command/args/envMapping are empty.
+        builtin: "convex-admin",
+        command: "",
+        args: [],
+        envMapping: {}
       }
     }
   },
@@ -7364,7 +7526,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.79" : "0.0.0-dev",
+    cliVersion: true ? "2.61.81" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7545,7 +7707,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.79",
+  version: "2.61.81",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8777,7 +8939,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.79" ? { ideVersion: "2.61.79" } : {}
+      ..."2.61.81" ? { ideVersion: "2.61.81" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -19891,7 +20053,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.79" : null;
+  const current = true ? "2.61.81" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19908,7 +20070,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.79" : null;
+  const current = true ? "2.61.81" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19928,7 +20090,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.79" : null;
+  return true ? "2.61.81" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -40626,7 +40788,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.79" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.81" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -40883,6 +41045,10 @@ var import_node_child_process31 = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 var RESTART_CHECK_INTERVAL_MS = 3e4;
 var SIGKILL_ESCALATION_MS = 2e3;
+var TOOL_CALL_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 12e4;
+})();
 var REPLAY_INIT_ID = "__codeam_replay_init__";
 var RestartableStdioProxy = class {
   constructor(opts) {
@@ -40893,12 +41059,16 @@ var RestartableStdioProxy = class {
   childRl = null;
   initializeLine = null;
   inflight = /* @__PURE__ */ new Set();
+  /** Per-`tools/call` request-id watchdog timers (see TOOL_CALL_TIMEOUT_MS). */
+  toolTimers = /* @__PURE__ */ new Map();
+  stdout = null;
   swapping = false;
   pendingClientLines = [];
   ended = () => void 0;
   async start() {
     const stdin = this.opts.stdin ?? process.stdin;
     const stdout = this.opts.stdout ?? process.stdout;
+    this.stdout = stdout;
     await this.spawnChild(stdout);
     const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity });
     rl.on("line", (line) => this.onClientLine(line));
@@ -40925,9 +41095,15 @@ var RestartableStdioProxy = class {
       }
       if (msg.method === "notifications/cancelled") {
         const requestId = msg.params?.requestId;
-        if (requestId !== void 0) this.inflight.delete(requestId);
+        if (requestId !== void 0) {
+          this.inflight.delete(requestId);
+          this.clearToolTimeout(requestId);
+        }
+      }
+      if (msg.id !== void 0 && msg.method !== void 0) {
+        this.inflight.add(msg.id);
+        if (msg.method === "tools/call") this.armToolTimeout(msg.id);
       }
-      if (msg.id !== void 0 && msg.method !== void 0) this.inflight.add(msg.id);
     } catch {
     }
     this.child?.stdin?.write(line + "\n");
@@ -40940,12 +41116,54 @@ var RestartableStdioProxy = class {
           return;
         }
         this.inflight.delete(msg.id);
+        this.clearToolTimeout(msg.id);
       }
     } catch {
     }
     stdout.write(line + "\n");
     if (this.inflight.size === 0) this.checkRestart(stdout);
   }
+  /**
+   * Arm a per-`tools/call` watchdog. If the server never answers this request
+   * id within {@link TOOL_CALL_TIMEOUT_MS}, synthesize a JSON-RPC error response
+   * to the client so the agent's turn unblocks (clean tool error) instead of
+   * hanging forever with no Stop. Idempotent per id.
+   */
+  armToolTimeout(id) {
+    const existing = this.toolTimers.get(id);
+    if (existing) clearTimeout(existing);
+    const t2 = setTimeout(() => {
+      this.toolTimers.delete(id);
+      if (!this.inflight.has(id)) return;
+      this.inflight.delete(id);
+      process.stderr.write(
+        `[codeam mcp-run] tools/call id=${String(id)} timed out after ${TOOL_CALL_TIMEOUT_MS}ms \u2014 server did not respond; failing the call so the turn can proceed
+`
+      );
+      const errResponse = {
+        jsonrpc: "2.0",
+        id,
+        error: {
+          code: -32001,
+          message: `MCP tool call timed out after ${Math.round(TOOL_CALL_TIMEOUT_MS / 1e3)}s \u2014 the server did not respond. The target service/deployment may be unreachable (e.g. a Convex dev deployment is only reachable while \`convex dev\` is running \u2014 use a production deploy key or start \`convex dev\`).`
+        }
+      };
+      (this.stdout ?? process.stdout).write(JSON.stringify(errResponse) + "\n");
+    }, TOOL_CALL_TIMEOUT_MS);
+    t2.unref();
+    this.toolTimers.set(id, t2);
+  }
+  clearToolTimeout(id) {
+    const t2 = this.toolTimers.get(id);
+    if (t2) {
+      clearTimeout(t2);
+      this.toolTimers.delete(id);
+    }
+  }
+  clearAllToolTimeouts() {
+    for (const t2 of this.toolTimers.values()) clearTimeout(t2);
+    this.toolTimers.clear();
+  }
   /**
    * Failsafe wrapper for the fire-and-forget call sites (post-response check
    * + the 30 s timer): `maybeRestart` handles the token-fetch failure itself,
@@ -41016,6 +41234,7 @@ var RestartableStdioProxy = class {
     });
     child.on("exit", (code) => {
       if (child !== this.child) return;
+      this.clearAllToolTimeouts();
       this.ended(code ?? 1);
     });
   }
@@ -41110,6 +41329,17 @@ async function mcpRun(args2) {
 `);
     process.exit(1);
   }
+  if (delivery.builtin === "convex-admin") {
+    const client4 = new IntegrationTokenClient({
+      sessionId,
+      pluginId,
+      pluginAuthToken,
+      pollSecret: process.env.CODEAM_MCP_POLL_SECRET
+    });
+    const { runConvexAdminMcp: runConvexAdminMcp2 } = await Promise.resolve().then(() => (init_convex_admin_mcp(), convex_admin_mcp_exports));
+    await runConvexAdminMcp2(client4, id);
+    return;
+  }
   if (delivery.httpUrl) {
     const httpClient = new IntegrationTokenClient({
       sessionId,
@@ -41148,7 +41378,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.79" : "unknown";
+  const v = true ? "2.61.81" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.79",
+  "version": "2.61.81",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",