codeam-cli 2.66.0 → 2.67.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.66.1] — 2026-08-24
+
+### Fixed
+
+- **jetbrains-plugin:** An undeliverable prompt must answer "failed", never "completed" (#650)
+- **cli:** Restart onto the version already on disk instead of failing to install it
+
+## [2.66.0] — 2026-08-21
+
+### Added
+
+- **cli:** Handle fleet_prune_host — reclaim Docker residue on the fleet host
+
+### Documentation
+
+- **cli:** Document the least-privilege Headroom installer resolution
+
 ## [2.65.17] — 2026-08-21
 
 ### Fixed

package/dist/index.js

@@ -8081,7 +8081,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.66.0" : "0.0.0-dev",
+    cliVersion: true ? "2.67.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8323,7 +8323,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.66.0",
+  version: "2.67.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8586,6 +8586,16 @@ async function postAiResult(input) {
     };
   }
 }
+async function fetchNamedPreviewTunnel(input) {
+  const res = await _transport.postJsonAuthed(
+    `${API_BASE}/api/preview/tunnel`,
+    { pluginId: input.pluginId },
+    input.pluginAuthToken
+  );
+  const body = res;
+  if (typeof body?.hostname !== "string" || typeof body?.token !== "string") return null;
+  return { hostname: body.hostname, token: body.token };
+}
 async function postPreviewEvent(input) {
   try {
     await _transport.postJsonAuthed(
@@ -9845,7 +9855,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.66.0" ? { ideVersion: "2.66.0" } : {}
+      ..."2.67.0" ? { ideVersion: "2.67.0" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22070,7 +22080,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.66.0" : null;
+  const current2 = true ? "2.67.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22087,7 +22097,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.66.0" : null;
+  const current2 = true ? "2.67.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22104,10 +22114,26 @@ function checkForUpdates() {
 // src/commands/host/self-update.ts
 var SELF_UPDATE_PKG = "codeam-cli";
 var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
+var SELF_UPDATE_DEFER_MAX_MS = 24 * 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
+var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
+var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.66.0" : null;
+  return true ? "2.67.0" : null;
+}
+async function installedVersion(deps) {
+  const ls = await deps.run(
+    "npm",
+    ["ls", "-g", "--depth=0", "--json", SELF_UPDATE_PKG],
+    SELF_UPDATE_LS_TIMEOUT_MS
+  );
+  try {
+    const parsed = JSON.parse(ls.stdout);
+    return parsed.dependencies?.[SELF_UPDATE_PKG]?.version ?? null;
+  } catch {
+    return null;
+  }
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve10) => {
@@ -22118,13 +22144,28 @@ function runCmd(cmd, args2, timeoutMs) {
   });
 }
 async function runSelfUpdate() {
+  return runSelfUpdateWith({
+    run: runCmd,
+    currentVersion: currentCliVersion,
+    isRoot: () => process.getuid?.() === 0
+  });
+}
+async function runSelfUpdateWith(deps) {
   try {
-    const current2 = currentCliVersion();
+    const current2 = deps.currentVersion();
     if (!current2) {
       log.trace("host-agent", "self-update: no __CLI_VERSION__ \u2014 skipping");
       return { status: "skipped" };
     }
-    const view = await runCmd(
+    const onDisk = await installedVersion(deps);
+    if (onDisk && compareSemver(onDisk, current2) > 0) {
+      log.info(
+        "host-agent",
+        `self-update: ${onDisk} already installed on disk (running ${current2}) \u2014 restarting onto it`
+      );
+      return { status: "updated", version: onDisk };
+    }
+    const view = await deps.run(
       "npm",
       ["view", SELF_UPDATE_PKG, "version"],
       SELF_UPDATE_VIEW_TIMEOUT_MS
@@ -22143,11 +22184,18 @@ async function runSelfUpdate() {
     }
     log.info("host-agent", `self-update: ${current2} \u2192 ${latest} available \u2014 installing`);
     const installArgs = ["install", "-g", `${SELF_UPDATE_PKG}@latest`];
-    let install = await runCmd("npm", installArgs, SELF_UPDATE_INSTALL_TIMEOUT_MS);
-    const isRoot = process.getuid?.() === 0;
-    if (install.code !== 0 && !isRoot && /EACCES/i.test(install.stderr)) {
-      log.info("host-agent", "self-update: install hit EACCES \u2014 retrying with sudo");
-      install = await runCmd("sudo", ["npm", ...installArgs], SELF_UPDATE_INSTALL_TIMEOUT_MS);
+    let install = await deps.run("npm", installArgs, SELF_UPDATE_INSTALL_TIMEOUT_MS);
+    if (install.code !== 0 && !deps.isRoot() && /EACCES/i.test(install.stderr)) {
+      const canSudo = await deps.run("sudo", ["-n", "true"], SUDO_PREFLIGHT_TIMEOUT_MS);
+      if (canSudo.code === 0) {
+        log.info("host-agent", "self-update: install hit EACCES \u2014 retrying with sudo");
+        install = await deps.run("sudo", ["npm", ...installArgs], SELF_UPDATE_INSTALL_TIMEOUT_MS);
+      } else {
+        log.warn(
+          "host-agent",
+          "self-update: the npm global prefix is not writable by this user and passwordless sudo is unavailable \u2014 install codeam-cli under a user-writable prefix, or let a privileged agent on this host install it (this box restarts onto it automatically)"
+        );
+      }
     }
     if (install.code !== 0) {
       log.warn(
@@ -22156,7 +22204,7 @@ async function runSelfUpdate() {
       );
       return { status: "skipped" };
     }
-    const after = await runCmd(
+    const after = await deps.run(
       "npm",
       ["view", SELF_UPDATE_PKG, "version"],
       SELF_UPDATE_VIEW_TIMEOUT_MS
@@ -22541,6 +22589,7 @@ var HostAgentSupervisor = class {
     this.disableService = deps.disableService ?? defaultDisableService;
     this.teardownHeadroom = deps.teardownHeadroom ?? defaultTeardownHeadroom;
     this.selfUpdate = deps.selfUpdate ?? runSelfUpdate;
+    this.now = deps.now ?? (() => Date.now());
     this.onUpdated = deps.onUpdated ?? defaultOnUpdated;
     this.docker = deps.docker ?? defaultDockerRunner;
     this.postResumeFailure = deps.postResumeFailure ?? postSessionErrorBubble;
@@ -22562,6 +22611,7 @@ var HostAgentSupervisor = class {
   selfUpdateTimer = null;
   /** Self-update check + install (injectable; defaults to runSelfUpdate). */
   selfUpdate;
+  now;
   /** Restart action after a successful self-update (defaults to process.exit). */
   onUpdated;
   /** Guards against overlapping self-update ticks (a slow npm install). */
@@ -22572,6 +22622,9 @@ var HostAgentSupervisor = class {
    * already-installed version for the restart log.
    */
   pendingRestartVersion = null;
+  /** epoch ms when the CURRENT pending restart was first owed — the ceiling
+   *  in {@link SELF_UPDATE_DEFER_MAX_MS} is measured from here. */
+  pendingRestartSince = null;
   /** Guards the one-shot 'connected' telemetry on the first heartbeat. */
   reportedConnected = false;
   /** Live-metrics collector — stateful across beats (CPU delta + latency). */
@@ -22715,12 +22768,12 @@ var HostAgentSupervisor = class {
     this.selfUpdating = true;
     try {
       if (this.pendingRestartVersion !== null) {
-        this.maybeRestartForUpdate(this.pendingRestartVersion);
-        return;
+        if (this.maybeRestartForUpdate(this.pendingRestartVersion)) return;
       }
       const result = await this.selfUpdate();
       if (result.status !== "updated") return;
       const version3 = result.version ?? "latest";
+      if (this.pendingRestartVersion === null) this.pendingRestartSince = this.now();
       this.pendingRestartVersion = version3;
       this.maybeRestartForUpdate(version3);
     } catch (err) {
@@ -22739,13 +22792,22 @@ var HostAgentSupervisor = class {
    */
   maybeRestartForUpdate(version3) {
     if (this.children.size > 0) {
-      log.info(
+      const since = this.pendingRestartSince ?? this.now();
+      const waited = this.now() - since;
+      if (waited < SELF_UPDATE_DEFER_MAX_MS) {
+        log.info(
+          "host-agent",
+          `self-update: ${version3} installed but ${this.children.size} child(ren) busy \u2014 deferring restart`
+        );
+        return false;
+      }
+      log.warn(
         "host-agent",
-        `self-update: ${version3} installed but ${this.children.size} child(ren) busy \u2014 deferring restart`
+        `self-update: ${version3} has been owed for ${Math.round(waited / 36e5)}h with ${this.children.size} child(ren) still running \u2014 restarting anyway rather than staying on old code`
       );
-      return;
     }
     this.onUpdated(version3);
+    return true;
   }
   /** Number of live children — for tests + diagnostics. */
   childCount() {
@@ -25086,6 +25148,26 @@ async function restoreProjectEnvIfMissing(cwd, ctx) {
   }
 }
 
+// src/services/preview/named-tunnel.ts
+async function resolveNamedTunnel(ctx, fetchTunnel) {
+  const envToken = process.env.PREVIEW_TUNNEL_TOKEN;
+  const envHostname = process.env.PREVIEW_TUNNEL_HOSTNAME;
+  if (envToken && envHostname) return { token: envToken, hostname: envHostname };
+  if (!ctx.pluginAuthToken) return null;
+  try {
+    const minted = await fetchTunnel(ctx);
+    if (!minted?.token || !minted.hostname) return null;
+    log.info("preview", `named tunnel minted on demand: ${minted.hostname}`);
+    return { token: minted.token, hostname: minted.hostname };
+  } catch (err) {
+    log.trace(
+      "preview",
+      `named tunnel unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 quick tunnel`
+    );
+    return null;
+  }
+}
+
 // src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
@@ -25458,8 +25540,16 @@ async function establishTunnel(ctx, dev) {
   let tunnel = null;
   let parsedUrl = null;
   let lastTunnelErr = "cloudflared did not emit a URL within 45s";
-  const namedToken = process.env.PREVIEW_TUNNEL_TOKEN;
-  const namedHostname = process.env.PREVIEW_TUNNEL_HOSTNAME;
+  const named = await resolveNamedTunnel(
+    {
+      sessionId: ctx.sessionId,
+      pluginId: ctx.projectEnvAuth?.pluginId ?? "",
+      pluginAuthToken: ctx.projectEnvAuth?.pluginAuthToken ?? ""
+    },
+    (c2) => fetchNamedPreviewTunnel({ pluginId: c2.pluginId, pluginAuthToken: c2.pluginAuthToken })
+  );
+  const namedToken = named?.token;
+  const namedHostname = named?.hostname;
   if (namedToken && namedHostname) {
     try {
       emitProgress("TUNNEL_STARTING", `named tunnel ${namedHostname}`);
@@ -45634,7 +45724,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.66.0" : "0.0.0-dev";
+  const cliVersion = true ? "2.67.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -46025,7 +46115,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.66.0" : "unknown";
+  const v = true ? "2.67.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.66.0",
+  "version": "2.67.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",