codeam-cli 2.65.7 → 2.65.9

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.65.7] — 2026-08-15
+
+### Fixed
+
+- **cli:** Honest credential/empty-turn errors + partial-fence holdback
+- **cli:** Credential error propagation matches the real transport error shape
+
 ## [2.65.6] — 2026-08-15
 
 ### Fixed

package/dist/index.js

@@ -8079,7 +8079,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.65.7" : "0.0.0-dev",
+    cliVersion: true ? "2.65.9" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8260,7 +8260,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.65.7",
+  version: "2.65.9",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9358,18 +9358,20 @@ var API_BASE2 = resolveApiBaseUrl();
 var SSE_LIVENESS_TIMEOUT_MS = 45e3;
 var SSE_WATCHDOG_INTERVAL_MS = 1e4;
 var CommandRelayService = class _CommandRelayService {
-  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret) {
+  constructor(pluginId, onCommand, agentMeta, agentsOverride, explicitPollSecret, onHeartbeat) {
     this.pluginId = pluginId;
     this.onCommand = onCommand;
     this.agentMeta = agentMeta;
     this.agentsOverride = agentsOverride;
     this.explicitPollSecret = explicitPollSecret;
+    this.onHeartbeat = onHeartbeat;
   }
   pluginId;
   onCommand;
   agentMeta;
   agentsOverride;
   explicitPollSecret;
+  onHeartbeat;
   _running = false;
   pairingInvalid = false;
   heartbeatTimer = null;
@@ -9432,16 +9434,35 @@ var CommandRelayService = class _CommandRelayService {
    * freshness, and a punctual heartbeat matters far more.
    */
   cachedBranch = null;
+  /**
+   * Set whenever the command channel is (re-)established; consumed by the
+   * next {@link emitHeartbeatTick}. See the `onHeartbeat` ctor param.
+   */
+  heartbeatFirstAfterConnect = true;
+  /** Invoke the heartbeat rider (if any) exactly once per beat. Never throws. */
+  emitHeartbeatTick() {
+    if (!this.onHeartbeat) return;
+    const firstAfterConnect = this.heartbeatFirstAfterConnect;
+    this.heartbeatFirstAfterConnect = false;
+    try {
+      this.onHeartbeat({ firstAfterConnect });
+    } catch (err) {
+      log.trace("relay", "heartbeat rider threw (ignored)", err);
+    }
+  }
   start() {
     this.cleanup();
     this._running = true;
+    this.heartbeatFirstAfterConnect = true;
     this.agentsRegistered = false;
     log.info("relay", `start pluginId=${this.pluginId.slice(0, 8)} agent=${this.agentMeta.id}`);
     this.cachedBranch = detectCurrentBranch();
     this.sendHeartbeat(true);
+    this.emitHeartbeatTick();
     this.heartbeatTimer = setInterval(() => {
       void this.refreshBranch();
       this.sendHeartbeat(true);
+      this.emitHeartbeatTick();
     }, 2e4);
     this.agentsTimer = setInterval(() => {
       if (this._running && !this.agentsRegistered) this.reportAgents();
@@ -9525,6 +9546,7 @@ var CommandRelayService = class _CommandRelayService {
         }
         log.info("relay", "sse connected");
         this.sseFailures = 0;
+        this.heartbeatFirstAfterConnect = true;
         this.armSseWatchdog();
         let buffer = "";
         res.setEncoding("utf8");
@@ -9642,6 +9664,7 @@ var CommandRelayService = class _CommandRelayService {
   // ─── Polling fallback ────────────────────────────────────────────
   startPollingFallback() {
     if (this.pollTimer) return;
+    this.heartbeatFirstAfterConnect = true;
     void this.pollLoop();
   }
   async pollLoop() {
@@ -9738,7 +9761,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.65.7" ? { ideVersion: "2.65.7" } : {}
+      ..."2.65.9" ? { ideVersion: "2.65.9" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -21667,7 +21690,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.65.7" : null;
+  const current2 = true ? "2.65.9" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -21684,7 +21707,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.65.7" : null;
+  const current2 = true ? "2.65.9" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -21704,7 +21727,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.65.7" : null;
+  return true ? "2.65.9" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -36690,6 +36713,11 @@ ${tail}` : detail].join(
     "\n"
   );
 }
+function startupCredentialInvalidReason(agent, detail, recentStderr) {
+  const haystack2 = `${detail}
+${recentStderr}`;
+  return agentHooks(agent)?.classifyStartupFailure?.(haystack2) === "ineligible_tier" ? "ineligible_tier" : null;
+}
 function budgetBubbleMessage(agent, period) {
   return `\u{1F4B8} **Headroom budget reached for the ${period} period.**
 
@@ -36729,7 +36757,11 @@ function adapterExitMessage(opts) {
 // src/agents/acp/backend-reports.ts
 async function reportCredentialInvalid(opts, fetchImpl = fetch) {
   const url2 = `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`;
-  const body = JSON.stringify({ sessionId: opts.sessionId, pluginId: opts.pluginId });
+  const body = JSON.stringify({
+    sessionId: opts.sessionId,
+    pluginId: opts.pluginId,
+    ...opts.reason ? { reason: opts.reason } : {}
+  });
   try {
     const makeHeaders = (token) => ({
       "Content-Type": "application/json",
@@ -39308,8 +39340,21 @@ var AcpHistory = class {
     ]);
   }
 };
+var _startupCredentialReportGuard = { reported: false };
 async function surfaceStartupFailure(opts) {
   const msg = startupFailureMessage(opts.agent, opts.detail, opts.recentStderr);
+  const reason = startupCredentialInvalidReason(opts.agent, opts.detail, opts.recentStderr);
+  if (reason !== null && !_startupCredentialReportGuard.reported && opts.sessionId && opts.pluginAuthToken) {
+    _startupCredentialReportGuard.reported = true;
+    void reportCredentialInvalid({
+      agent: opts.agent,
+      sessionId: opts.sessionId,
+      pluginId: opts.pluginId,
+      pluginAuthToken: opts.pluginAuthToken,
+      pollSecret: opts.pollSecret,
+      reason
+    });
+  }
   const publish = async () => {
     try {
       await opts.publisher.publishOutput({ type: "new_turn", done: false });
@@ -39514,7 +39559,10 @@ async function runAcpSession(opts) {
       pluginId: opts.pluginId,
       detail,
       recentStderr: recentStderr.join("\n"),
-      publisher
+      publisher,
+      sessionId: opts.sessionId,
+      pluginAuthToken: opts.pluginAuthToken,
+      pollSecret: opts.pollSecret
     });
     return;
   }
@@ -41009,6 +41057,17 @@ var BatonController = class {
   get conversationId() {
     return this._conversationId;
   }
+  /** The exact triple the last `publishState` emitted — the CLI's current view
+   *  of who holds the baton. Read by the heartbeat re-affirmation rider
+   *  ({@link makeBatonHeartbeatReaffirm}), which re-posts it periodically so the
+   *  backend's 1 h Redis snapshot never expires under a live session. */
+  currentState() {
+    return {
+      state: this._state,
+      driver: this._active,
+      conversationId: this._conversationId
+    };
+  }
   async begin() {
     this._conversationId = await this.deps.local.start(void 0);
     this._active = "local_tui";
@@ -41484,6 +41543,21 @@ function makeSerializedBatonPoster(post2) {
     void chain;
   };
 }
+var BATON_REAFFIRM_INTERVAL_MS = 5 * 6e4;
+function makeBatonHeartbeatReaffirm(deps) {
+  const now = deps.now ?? Date.now;
+  const intervalMs = deps.intervalMs ?? BATON_REAFFIRM_INTERVAL_MS;
+  let lastAffirmedAt = null;
+  return ({ firstAfterConnect }) => {
+    const current2 = deps.currentState();
+    if (!current2) return;
+    if (current2.state === "SWITCHING") return;
+    const at3 = now();
+    if (!firstAfterConnect && lastAffirmedAt !== null && at3 - lastAffirmedAt < intervalMs) return;
+    lastAffirmedAt = at3;
+    deps.publish(current2.state, current2.driver, current2.conversationId);
+  };
+}
 async function runBatonSession(opts) {
   const publisher = new AcpPublisher({
     sessionId: opts.sessionId,
@@ -41595,18 +41669,21 @@ async function runBatonSession(opts) {
     mirror.start();
   };
   const postBatonState = makeSerializedBatonPoster(postBatonEvent);
+  const publishBatonState = (state, driver, conversationId) => {
+    postBatonState({
+      sessionId: opts.sessionId,
+      pluginId: opts.pluginId,
+      pluginAuthToken: opts.pluginAuthToken,
+      state,
+      driver,
+      conversationId
+    });
+  };
   const controller = new BatonController({
     local: nativeDriver,
     mobile: mobileDriver,
     publishState: (state, driver, conversationId) => {
-      postBatonState({
-        sessionId: opts.sessionId,
-        pluginId: opts.pluginId,
-        pluginAuthToken: opts.pluginAuthToken,
-        state,
-        driver,
-        conversationId
-      });
+      publishBatonState(state, driver, conversationId);
       if (state === "LOCAL_DRIVE" && conversationId) {
         startMirror(conversationId, firstLocalDrive);
         firstLocalDrive = false;
@@ -41616,6 +41693,7 @@ async function runBatonSession(opts) {
     }
   });
   const dispatchActive = (cmd) => controller.activeSessionDriver.dispatch(cmd);
+  let torn = false;
   relay = new CommandRelayService(
     opts.pluginId,
     makeOnCommand({
@@ -41623,9 +41701,15 @@ async function runBatonSession(opts) {
       dispatchActive,
       ack: (id, status2, result) => relay.sendResult(id, status2, result)
     }),
-    runtime.meta
+    runtime.meta,
+    void 0,
+    void 0,
+    makeBatonHeartbeatReaffirm({
+      // Nothing to affirm once the session is torn down.
+      currentState: () => torn ? null : controller.currentState(),
+      publish: publishBatonState
+    })
   );
-  let torn = false;
   function teardown() {
     if (torn) return;
     torn = true;
@@ -41922,7 +42006,10 @@ async function start(requestedAgent, presetSession) {
             pluginId,
             pluginAuthToken: session.pluginAuthToken,
             refreshAuthToken: () => fetchCurrentPluginAuthToken(session.id, pluginId, session.pollSecret)
-          })
+          }),
+          sessionId: session.id,
+          pluginAuthToken: session.pluginAuthToken,
+          pollSecret: session.pollSecret
         });
         return;
       }
@@ -44678,7 +44765,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.65.7" : "0.0.0-dev";
+  const cliVersion = true ? "2.65.9" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -45069,7 +45156,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.65.7" : "unknown";
+  const v = true ? "2.65.9" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.65.7",
+  "version": "2.65.9",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",