codeam-cli 2.65.13 → 2.65.14

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.65.13] — 2026-08-20
+
+### Fixed
+
+- **cli:** Filter non-chat models out of the native ACP model catalog
+
 ## [2.65.12] — 2026-08-19
 
 ### CI

package/dist/index.js

@@ -8079,7 +8079,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.65.13" : "0.0.0-dev",
+    cliVersion: true ? "2.65.14" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8321,7 +8321,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.65.13",
+  version: "2.65.14",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9842,7 +9842,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.65.13" ? { ideVersion: "2.65.13" } : {}
+      ..."2.65.14" ? { ideVersion: "2.65.14" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -21966,7 +21966,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.65.13" : null;
+  const current2 = true ? "2.65.14" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -21983,7 +21983,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.65.13" : null;
+  const current2 = true ? "2.65.14" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22003,7 +22003,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.65.13" : null;
+  return true ? "2.65.14" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve10) => {
@@ -33942,6 +33942,10 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
 var path74 = __toESM(require("path"));
 var os57 = __toESM(require("os"));
 var INTERNAL_TOKENS = [".codeam", "house-claude"];
+var PROSE_ONLY_TOOL_KINDS = /* @__PURE__ */ new Set(["think", "switch_mode"]);
+function isProseOnlyToolKind(kind) {
+  return kind != null && PROSE_ONLY_TOOL_KINDS.has(kind);
+}
 var SELF_HOSTED_WORKSPACE_RE = /\.codeam[/\\]self-hosted/gi;
 function textReferencesInternal(text) {
   if (!text) return false;
@@ -33956,7 +33960,9 @@ function pathIsInternal(p2, homeDir2 = os57.homedir()) {
   if (within(path74.join(home, ".codeam", "self-hosted"))) return false;
   return within(path74.join(home, ".codeam")) || within(path74.join(home, ".beads")) || abs === path74.join(home, ".codeam-host.log") || abs.includes(`${path74.sep}house-claude${path74.sep}`) || abs.endsWith(`${path74.sep}house-claude`);
 }
-function toolCallReferencesInternal(call) {
+function toolCallReferencesInternal(call, homeDir2) {
+  if (call.locations?.some((l) => pathIsInternal(l.path, homeDir2))) return true;
+  if (isProseOnlyToolKind(call.kind)) return false;
   if (textReferencesInternal(call.title)) return true;
   if (call.rawInput != null) {
     try {
@@ -33967,9 +33973,9 @@ function toolCallReferencesInternal(call) {
   }
   return false;
 }
-function internalPathPermissionOutcome(request) {
-  if (!toolCallReferencesInternal(request.toolCall)) return null;
-  const reject = request.options.find((o) => o.kind === "reject_always") ?? request.options.find((o) => o.kind === "reject_once");
+function internalPathPermissionOutcome(request, homeDir2) {
+  if (!toolCallReferencesInternal(request.toolCall, homeDir2)) return null;
+  const reject = request.options.find((o) => o.kind === "reject_once") ?? request.options.find((o) => o.kind === "reject_always");
   if (reject) return { outcome: { outcome: "selected", optionId: reject.optionId } };
   return { outcome: { outcome: "cancelled" } };
 }
@@ -34029,6 +34035,7 @@ function toolPathIsSecret(p2) {
 }
 var GUARDRAIL_SECRET_READ_BLOCK_REASON = "Reading this secret file is blocked by this session's guardrails (Reading secrets = Deny). Adjust it in the session Guardrails settings if intended.";
 function guardrailDecision(request, policy) {
+  if (isProseOnlyToolKind(request.toolCall.kind)) return null;
   const hay = haystack(request.toolCall);
   if (!hay) return null;
   const matched = matchedCategories(hay);
@@ -36226,6 +36233,73 @@ function humanizeKind(kind) {
   }
 }
 
+// src/agents/acp/permission-gate.ts
+function pickAllowOption(options) {
+  return options.find((o) => o.kind === "allow_always") ?? options.find((o) => o.kind === "allow_once") ?? null;
+}
+function describeToolCallForNotice(toolCall) {
+  const title = toolCall.title?.trim();
+  return title ? `"${title}"` : "a tool call";
+}
+function internalBlockNotice(toolCall) {
+  return `\u26D4 CodeAgent auto-blocked ${describeToolCallForNotice(toolCall)} \u2014 it targets CodeAgent's own runtime files (~/.codeam), which are off-limits to the agent. This was an automatic block by CodeAgent, not a rejection by you.`;
+}
+function guardrailBlockNotice(decision, toolCall) {
+  return `\u26D4 Guardrail auto-blocked ${describeToolCallForNotice(toolCall)} \u2014 ${decision.reason} This session's "${decision.category}" guardrail is set to Deny (adjust it in the session's Guardrails settings if intended). This was an automatic block, not a rejection by you.`;
+}
+function createOnRequestPermission(deps) {
+  return async (request) => {
+    let guardrailConfirm = false;
+    if (!deps.isLocal()) {
+      const denied = internalPathPermissionOutcome(request);
+      if (denied) {
+        log.warn(
+          "acpRunner",
+          "internal-path guard \u2014 denying tool call referencing a CodeAgent platform internal"
+        );
+        void deps.publisher.publishOutput({
+          type: "text",
+          content: internalBlockNotice(request.toolCall),
+          done: true
+        });
+        return denied;
+      }
+      const g = guardrailDecision(request, deps.getPolicy());
+      if (g?.kind === "deny") {
+        log.warn("acpRunner", `guardrail [${g.category}] \u2014 denying tool call`);
+        void deps.publisher.publishOutput({
+          type: "text",
+          content: guardrailBlockNotice(g, request.toolCall),
+          done: true
+        });
+        return g.outcome;
+      }
+      if (g?.kind === "confirm") {
+        guardrailConfirm = true;
+        log.info("acpRunner", `guardrail [${g.category}] \u2014 requiring confirmation`);
+      }
+    }
+    if (deps.autoApprovePermissions && !guardrailConfirm) {
+      const allow = pickAllowOption(request.options);
+      if (allow) {
+        log.info(
+          "acpRunner",
+          `AUTO mode \u2014 auto-approving permission (${allow.kind}) optionId=${allow.optionId}`
+        );
+        return { outcome: { outcome: "selected", optionId: allow.optionId } };
+      }
+      log.warn("acpRunner", "AUTO mode \u2014 no allow option offered; falling back to interactive");
+    }
+    const { event, optionIdByLabel } = mapPermissionRequest(request);
+    await deps.publisher.publishAwaitingAnswer(event);
+    return deps.registerPermission({
+      questionId: event.questionId,
+      labels: event.options ?? [],
+      optionIdByLabel
+    });
+  };
+}
+
 // src/agents/acp/selectPromptExtractor.ts
 var MAX_OPTIONS = 6;
 var MAX_OPTION_BODY_CHARS = 200;
@@ -39555,9 +39629,6 @@ var StreamingState = class {
   }
 };
 var PERMISSION_TIMEOUT_MS = 5 * 60 * 1e3;
-function pickAllowOption(options) {
-  return options.find((o) => o.kind === "allow_always") ?? options.find((o) => o.kind === "allow_once") ?? null;
-}
 var AcpHistory = class {
   constructor(publisher, opts) {
     this.publisher = publisher;
@@ -39798,46 +39869,19 @@ async function runAcpSession(opts) {
     // Same guard the baton uses; the happy path never calls loadSession.
     beginLoadReplay: () => streaming.beginLoadReplay(),
     endLoadReplay: () => streaming.endLoadReplay(),
-    onRequestPermission: async (request) => {
-      let guardrailConfirm = false;
-      if (!isLocalSession()) {
-        const denied = internalPathPermissionOutcome(request);
-        if (denied) {
-          log.warn(
-            "acpRunner",
-            "internal-path guard \u2014 denying tool call referencing a CodeAgent platform internal"
-          );
-          return denied;
-        }
-        const g = guardrailDecision(request, getGuardrailPolicy());
-        if (g?.kind === "deny") {
-          log.warn("acpRunner", `guardrail [${g.category}] \u2014 denying tool call`);
-          return g.outcome;
-        }
-        if (g?.kind === "confirm") {
-          guardrailConfirm = true;
-          log.info("acpRunner", `guardrail [${g.category}] \u2014 requiring confirmation`);
-        }
-      }
-      if (opts.autoApprovePermissions && !guardrailConfirm) {
-        const allow = pickAllowOption(request.options);
-        if (allow) {
-          log.info(
-            "acpRunner",
-            `AUTO mode \u2014 auto-approving permission (${allow.kind}) optionId=${allow.optionId}`
-          );
-          return { outcome: { outcome: "selected", optionId: allow.optionId } };
-        }
-        log.warn("acpRunner", "AUTO mode \u2014 no allow option offered; falling back to interactive");
-      }
-      const { event, optionIdByLabel } = mapPermissionRequest(request);
-      await publisher.publishAwaitingAnswer(event);
-      return streaming.registerPermission({
-        questionId: event.questionId,
-        labels: event.options ?? [],
-        optionIdByLabel
-      });
-    },
+    // The full `session/request_permission` decision path (internal-path guard
+    // → guardrails → AUTO auto-approve → interactive prompt) lives in
+    // ./permission-gate.ts so it is unit-tested exactly as it runs here.
+    // HARD RULE enforced there: every auto-REJECT publishes a visible chat
+    // line — a guard must never silently answer for the user (the 2026-08-19
+    // ExitPlanMode silent-rejection P0).
+    onRequestPermission: createOnRequestPermission({
+      autoApprovePermissions: opts.autoApprovePermissions === true,
+      isLocal: isLocalSession,
+      getPolicy: getGuardrailPolicy,
+      publisher,
+      registerPermission: (args2) => streaming.registerPermission(args2)
+    }),
     onStderr: (line) => {
       recentStderr.push(line);
       if (recentStderr.length > 40) recentStderr.shift();
@@ -45272,7 +45316,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.65.13" : "0.0.0-dev";
+  const cliVersion = true ? "2.65.14" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -45663,7 +45707,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.65.13" : "unknown";
+  const v = true ? "2.65.14" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.65.13",
+  "version": "2.65.14",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",