codeam-cli 2.65.6 → 2.65.8

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.65.7] — 2026-08-15
+
+### Fixed
+
+- **cli:** Honest credential/empty-turn errors + partial-fence holdback
+- **cli:** Credential error propagation matches the real transport error shape
+
+## [2.65.6] — 2026-08-15
+
+### Fixed
+
+- **cli:** Accumulated stream keeps post-cut deltas + unclosed trailing fence tolerated
+
 ## [2.65.4] — 2026-08-14
 
 ### Fixed

package/dist/index.js

@@ -8079,7 +8079,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.65.6" : "0.0.0-dev",
+    cliVersion: true ? "2.65.8" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8260,7 +8260,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.65.6",
+  version: "2.65.8",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8632,7 +8632,19 @@ async function postHeadroomEvent(input) {
     };
   }
 }
-async function fetchProvisionCredential(input) {
+function parseBackendErrorBody(body) {
+  if (!body) return null;
+  try {
+    const parsed = JSON.parse(body);
+    const nested = parsed.error;
+    const code = typeof nested?.code === "string" ? nested.code : typeof parsed.code === "string" ? parsed.code : void 0;
+    const message = typeof nested?.message === "string" ? nested.message : typeof parsed.message === "string" ? parsed.message : void 0;
+    return code || message ? { code, message } : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchProvisionCredentialDetailed(input) {
   try {
     const res = await _transport.postJsonAuthed(
       `${API_BASE}/api/plugin/agents/${input.agentId}/provision-credential`,
@@ -8646,16 +8658,29 @@ async function fetchProvisionCredential(input) {
     const data = res?.data;
     if (data && (data.method === "api_key" || data.method === "oauth") && typeof data.credential === "string" && data.credential.length > 0) {
       return {
+        ok: true,
         method: data.method,
         credential: data.credential,
         ...typeof data.installScript === "string" && data.installScript.length > 0 ? { installScript: data.installScript } : {}
       };
     }
-    return null;
-  } catch {
-    return null;
+    return { ok: false, status: 0 };
+  } catch (err) {
+    const e = err;
+    const status2 = typeof e.statusCode === "number" ? e.statusCode : 0;
+    const parsed = parseBackendErrorBody(e.body);
+    return { ok: false, status: status2, code: parsed?.code, message: parsed?.message };
   }
 }
+async function fetchProvisionCredential(input) {
+  const res = await fetchProvisionCredentialDetailed(input);
+  if (!res.ok) return null;
+  return {
+    method: res.method,
+    credential: res.credential,
+    ...res.installScript ? { installScript: res.installScript } : {}
+  };
+}
 async function fetchSquadRoster(input) {
   try {
     const res = await _transport.postJsonAuthed(
@@ -8860,6 +8885,7 @@ function makeHttpError(statusCode, retryAfterHeader, responseBody) {
   );
   err.statusCode = statusCode;
   if (typeof retryAfterSeconds === "number") err.retryAfterSeconds = retryAfterSeconds;
+  if (responseBody) err.body = responseBody;
   return err;
 }
 async function _postJson(url2, body, extraHeaders) {
@@ -9332,18 +9358,20 @@ var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
 var CommandRelayService = class _CommandRelayService {
-  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret) {
+  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret, onHeartbeat) {
     this.pluginId = pluginId;
     this.onCommand = onCommand;
     this.agentMeta = agentMeta;
     this.agentsOverride = agentsOverride;
     this.explicitPollSecret = explicitPollSecret;
+    this.onHeartbeat = onHeartbeat;
   }
   pluginId;
   onCommand;
   agentMeta;
   agentsOverride;
   explicitPollSecret;
+  onHeartbeat;
   _running = false;
   pairingInvalid = false;
   heartbeatTimer = null;
@@ -9406,16 +9434,35 @@ var CommandRelayService = class _CommandRelayService {
    * freshness, and a punctual heartbeat matters far more.
    */
   cachedBranch = null;
+  /**
+   * Set whenever the command channel is (re-)established; consumed by the
+   * next {@link emitHeartbeatTick}. See the `onHeartbeat` ctor param.
+   */
+  heartbeatFirstAfterConnect = true;
+  /** Invoke the heartbeat rider (if any) exactly once per beat. Never throws. */
+  emitHeartbeatTick() {
+    if (!this.onHeartbeat) return;
+    const firstAfterConnect = this.heartbeatFirstAfterConnect;
+    this.heartbeatFirstAfterConnect = false;
+    try {
+      this.onHeartbeat({ firstAfterConnect });
+    } catch (err) {
+      log.trace("relay", "heartbeat rider threw (ignored)", err);
+    }
+  }
   start() {
     this.cleanup();
     this._running = true;
+    this.heartbeatFirstAfterConnect = true;
     this.agentsRegistered = false;
     log.info("relay", `start pluginId=${this.pluginId.slice(0, 8)} agent=${this.agentMeta.id}`);
     this.cachedBranch = detectCurrentBranch();
     this.sendHeartbeat(true);
+    this.emitHeartbeatTick();
     this.heartbeatTimer = setInterval(() => {
       void this.refreshBranch();
       this.sendHeartbeat(true);
+      this.emitHeartbeatTick();
     }, 2e4);
     this.agentsTimer = setInterval(() => {
       if (this._running && !this.agentsRegistered) this.reportAgents();
@@ -9499,6 +9546,7 @@ var CommandRelayService = class _CommandRelayService {
         }
         log.info("relay", "sse connected");
         this.sseFailures = 0;
+        this.heartbeatFirstAfterConnect = true;
         this.armSseWatchdog();
         let buffer = "";
         res.setEncoding("utf8");
@@ -9616,6 +9664,7 @@ var CommandRelayService = class _CommandRelayService {
   // ─── Polling fallback ────────────────────────────────────────────
   startPollingFallback() {
     if (this.pollTimer) return;
+    this.heartbeatFirstAfterConnect = true;
     void this.pollLoop();
   }
   async pollLoop() {
@@ -9712,7 +9761,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.65.6" ? { ideVersion: "2.65.6" } : {}
+      ..."2.65.8" ? { ideVersion: "2.65.8" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -21641,7 +21690,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.65.6" : null;
+  const current2 = true ? "2.65.8" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -21658,7 +21707,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.65.6" : null;
+  const current2 = true ? "2.65.8" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -21678,7 +21727,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.65.6" : null;
+  return true ? "2.65.8" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -34738,6 +34787,10 @@ var NON_SWITCHABLE = /* @__PURE__ */ new Set([
 function displayName(id) {
   return isKnownAgentId(id) ? AGENT_REGISTRY[id]?.displayName ?? id : id;
 }
+function credentialFailureMessage(agentId, failure) {
+  if (failure.message) return failure.message;
+  return `No linked credential for ${displayName(agentId)}. Link it in Profile \u203A Agents first.`;
+}
 function resolveSwitchTarget(raw, currentAgent) {
   if (typeof raw !== "string" || raw.length === 0) {
     return { ok: false, error: "switch_agent: missing agentId" };
@@ -34854,10 +34907,8 @@ async function performAgentSwitch(deps, rawAgentId, fastPath = {}) {
   if (!fastPath.skipProvision) {
     void emitStep("credential");
     const cred = await deps.fetchCredential(agentId);
-    if (!cred) {
-      return fail2(
-        `No linked credential for ${displayName(agentId)}. Link it in Profile \u203A Agents first.`
-      );
+    if (!cred.ok) {
+      return fail2(credentialFailureMessage(agentId, cred));
     }
     try {
       deps.provisionCredential(agentId, toAgentAuth(cred.method, cred.credential));
@@ -35574,6 +35625,15 @@ function handoffFenceStartMasked(text) {
   }
   return -1;
 }
+function withholdTrailingPartialFenceMarker(text) {
+  const maxLen = Math.min(text.length, FENCE_OPEN.length - 1);
+  for (let len = maxLen; len > 0; len--) {
+    if (FENCE_OPEN.startsWith(text.slice(text.length - len))) {
+      return text.slice(0, text.length - len);
+    }
+  }
+  return text;
+}
 
 // src/agents/acp/onboarding.ts
 var import_child_process28 = require("child_process");
@@ -36608,6 +36668,11 @@ var AUTH_FAILURE_MESSAGE = "\u{1F512} **Authentication failed \u2014 your agent
 var CURSOR_UPGRADE_MESSAGE = "\u26A1 **Cursor needs a paid plan to run the agent.**\n\nThe headless Cursor Agent requires Cursor **Pro** \u2014 your Free plan\u2019s included usage does NOT cover Agent runs, even with quota left. This is your Cursor account (not CodeAgent). Upgrade, then send your message again:\n\n[Upgrade to Cursor Pro \u2192](https://cursor.com/dashboard)";
 var ONE_M_CREDITS_MESSAGE = "\u{1F504} **Reconnect your Claude subscription to continue.**\n\nClaude requested 1M-context but your account doesn\u2019t have the usage credits for it on this credential. Reconnecting refreshes your subscription so the agent can keep going \u2014 disabling 1M context won\u2019t fix a credits gate.\n\nTap [Reconnect this agent](codeam://reauth) to reconnect your Claude subscription in Profile \u203A Agents, then send your message again.";
 var TURN_FAILURE_MESSAGE = "\u26A0\uFE0F **The agent hit an error and couldn\u2019t finish this turn.** Please send your message again.";
+function emptyReplyMessage(agent) {
+  const label = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].displayName : agent;
+  const binary = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].binaryName : agent;
+  return `\u26A0\uFE0F **${label} returned an empty reply.** Its provider may be having issues \u2014 check the agent's login/subscription on this machine (e.g. run \`${binary} -p "test"\` there).`;
+}
 var PROVIDER_OUTAGE_RE = /overloaded_error|\boverloaded\b|service[ _]unavailable|temporarily[ _]unavailable|(?:api error|http|status)[:\s]+(?:529|503|502|504)\b|\b(?:529|503|502|504)\b[^\n]{0,40}(?:overload|unavailable|gateway|upstream|server error)|bad gateway|gateway time-?out|upstream (?:error|connect|timeout)/i;
 function looksLikeProviderOutage(text) {
   return PROVIDER_OUTAGE_RE.test(text);
@@ -36643,12 +36708,10 @@ ${recentStderr}`;
   if (looksLikeAuthFailure(haystack2)) return AUTH_FAILURE_MESSAGE;
   if (looksLikeProviderOutage(haystack2)) return providerOutageMessage(agent);
   const tail = recentStderr.split("\n").filter(Boolean).slice(-3).join("\n");
-  return [
-    `\u26A0\uFE0F The ${agent} agent failed to start.`,
-    "",
-    tail ? `Details:
-${tail}` : detail
-  ].join("\n");
+  return [`\u26A0\uFE0F The ${agent} agent failed to start.`, "", tail ? `Details:
+${tail}` : detail].join(
+    "\n"
+  );
 }
 function budgetBubbleMessage(agent, period) {
   return `\u{1F4B8} **Headroom budget reached for the ${period} period.**
@@ -38064,6 +38127,18 @@ async function startTaskH(ctx) {
           error: "agent reply reported 1M-context usage-credits gate"
         });
         return;
+      } else if (reply.stopReason === "end_turn" && finalText.trim().length === 0 && !streaming.hasVisibleProgress()) {
+        const bubble = emptyReplyMessage(opts.agent);
+        await streaming.closeWithBubble(bubble);
+        turnClosed = true;
+        history.appendAgentReply(bubble);
+        void history.flush();
+        turnFiles.flushTurn().catch((err) => {
+          log.warn("acpRunner", `turnFiles.flushTurn failed: ${describeError(err)}`);
+        });
+        log.info("acpRunner", `start_task \u2190 empty-reply id=${cmd.id.slice(0, 8)}`);
+        await relay.sendResult(cmd.id, "failed", { error: "agent turn ended with an empty reply" });
+        return;
       } else {
         await streaming.closeTurnWithInteractiveDetection();
         turnClosed = true;
@@ -38956,13 +39031,14 @@ var StreamingState = class {
     const cumulativeContent = reconcileCumulative(existing?.content ?? "", delta.delta);
     this.streamingChunks.set(chunkId, { kind: delta.kind, content: cumulativeContent });
     let fenceCut = -1;
+    let textVisible = null;
     if (delta.kind === "text") {
       this.recomputeText();
       fenceCut = handoffFenceStartMasked(this.text);
-      const visibleText = fenceCut === -1 ? this.text : this.text.slice(0, fenceCut).trimEnd();
-      void this.publisher.publishOutput({ type: "text", content: visibleText, done: false });
+      textVisible = fenceCut === -1 ? withholdTrailingPartialFenceMarker(this.text) : this.text.slice(0, fenceCut).trimEnd();
+      void this.publisher.publishOutput({ type: "text", content: textVisible, done: false });
     }
-    const visibleChunkContent = delta.kind === "text" && fenceCut !== -1 ? cumulativeContent.slice(0, fenceCut).trimEnd() : cumulativeContent;
+    const visibleChunkContent = delta.kind === "text" ? textVisible : cumulativeContent;
     void this.publisher.publishStreamingChunk({
       chunkId,
       kind: delta.kind,
@@ -39697,7 +39773,7 @@ async function runAcpSession(opts) {
   const switchDeps = {
     currentAgent: () => opts.agent,
     postEvent: emitSwitchEvent,
-    fetchCredential: (agentId) => fetchProvisionCredential({
+    fetchCredential: (agentId) => fetchProvisionCredentialDetailed({
       agentId,
       sessionId: opts.sessionId,
       pluginId: opts.pluginId,
@@ -40956,6 +41032,17 @@ var BatonController = class {
   get conversationId() {
     return this._conversationId;
   }
+  /** The exact triple the last `publishState` emitted — the CLI's current view
+   *  of who holds the baton. Read by the heartbeat re-affirmation rider
+   *  ({@link makeBatonHeartbeatReaffirm}), which re-posts it periodically so the
+   *  backend's 1 h Redis snapshot never expires under a live session. */
+  currentState() {
+    return {
+      state: this._state,
+      driver: this._active,
+      conversationId: this._conversationId
+    };
+  }
   async begin() {
     this._conversationId = await this.deps.local.start(void 0);
     this._active = "local_tui";
@@ -41431,6 +41518,21 @@ function makeSerializedBatonPoster(post2) {
     void chain;
   };
 }
+var BATON_REAFFIRM_INTERVAL_MS = 5 * 6e4;
+function makeBatonHeartbeatReaffirm(deps) {
+  const now = deps.now ?? Date.now;
+  const intervalMs = deps.intervalMs ?? BATON_REAFFIRM_INTERVAL_MS;
+  let lastAffirmedAt = null;
+  return ({ firstAfterConnect }) => {
+    const current2 = deps.currentState();
+    if (!current2) return;
+    if (current2.state === "SWITCHING") return;
+    const at3 = now();
+    if (!firstAfterConnect && lastAffirmedAt !== null && at3 - lastAffirmedAt < intervalMs) return;
+    lastAffirmedAt = at3;
+    deps.publish(current2.state, current2.driver, current2.conversationId);
+  };
+}
 async function runBatonSession(opts) {
   const publisher = new AcpPublisher({
     sessionId: opts.sessionId,
@@ -41542,18 +41644,21 @@ async function runBatonSession(opts) {
     mirror.start();
   };
   const postBatonState = makeSerializedBatonPoster(postBatonEvent);
+  const publishBatonState = (state, driver, conversationId) => {
+    postBatonState({
+      sessionId: opts.sessionId,
+      pluginId: opts.pluginId,
+      pluginAuthToken: opts.pluginAuthToken,
+      state,
+      driver,
+      conversationId
+    });
+  };
   const controller = new BatonController({
     local: nativeDriver,
     mobile: mobileDriver,
     publishState: (state, driver, conversationId) => {
-      postBatonState({
-        sessionId: opts.sessionId,
-        pluginId: opts.pluginId,
-        pluginAuthToken: opts.pluginAuthToken,
-        state,
-        driver,
-        conversationId
-      });
+      publishBatonState(state, driver, conversationId);
       if (state === "LOCAL_DRIVE" && conversationId) {
         startMirror(conversationId, firstLocalDrive);
         firstLocalDrive = false;
@@ -41563,6 +41668,7 @@ async function runBatonSession(opts) {
     }
   });
   const dispatchActive = (cmd) => controller.activeSessionDriver.dispatch(cmd);
+  let torn = false;
   relay = new CommandRelayService(
     opts.pluginId,
     makeOnCommand({
@@ -41570,9 +41676,15 @@ async function runBatonSession(opts) {
       dispatchActive,
       ack: (id, status2, result) => relay.sendResult(id, status2, result)
     }),
-    runtime.meta
+    runtime.meta,
+    void 0,
+    void 0,
+    makeBatonHeartbeatReaffirm({
+      // Nothing to affirm once the session is torn down.
+      currentState: () => torn ? null : controller.currentState(),
+      publish: publishBatonState
+    })
   );
-  let torn = false;
   function teardown() {
     if (torn) return;
     torn = true;
@@ -44625,7 +44737,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.65.6" : "0.0.0-dev";
+  const cliVersion = true ? "2.65.8" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -45016,7 +45128,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.65.6" : "unknown";
+  const v = true ? "2.65.8" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.65.6",
+  "version": "2.65.8",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",