codeam-cli 2.66.1 → 2.67.1

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.67.0] — 2026-08-24
+
+### Added
+
+- **cli:** Ask the backend for a named preview tunnel when the env has none
+
+### Fixed
+
+- **cli:** Cap how long a self-update restart can be deferred
+
+## [2.66.1] — 2026-08-24
+
+### Fixed
+
+- **jetbrains-plugin:** An undeliverable prompt must answer "failed", never "completed" (#650)
+- **cli:** Restart onto the version already on disk instead of failing to install it
+
 ## [2.66.0] — 2026-08-21
 
 ### Added

package/dist/index.js

@@ -8081,7 +8081,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.66.1" : "0.0.0-dev",
+    cliVersion: true ? "2.67.1" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8323,7 +8323,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.66.1",
+  version: "2.67.1",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8586,6 +8586,16 @@ async function postAiResult(input) {
     };
   }
 }
+async function fetchNamedPreviewTunnel(input) {
+  const res = await _transport.postJsonAuthed(
+    `${API_BASE}/api/preview/tunnel`,
+    { pluginId: input.pluginId },
+    input.pluginAuthToken
+  );
+  const body = res;
+  if (typeof body?.hostname !== "string" || typeof body?.token !== "string") return null;
+  return { hostname: body.hostname, token: body.token };
+}
 async function postPreviewEvent(input) {
   try {
     await _transport.postJsonAuthed(
@@ -9845,7 +9855,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.66.1" ? { ideVersion: "2.66.1" } : {}
+      ..."2.67.1" ? { ideVersion: "2.67.1" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22070,7 +22080,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.66.1" : null;
+  const current2 = true ? "2.67.1" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22087,7 +22097,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.66.1" : null;
+  const current2 = true ? "2.67.1" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22104,12 +22114,13 @@ function checkForUpdates() {
 // src/commands/host/self-update.ts
 var SELF_UPDATE_PKG = "codeam-cli";
 var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
+var SELF_UPDATE_DEFER_MAX_MS = 24 * 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.66.1" : null;
+  return true ? "2.67.1" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -22578,6 +22589,7 @@ var HostAgentSupervisor = class {
     this.disableService = deps.disableService ?? defaultDisableService;
     this.teardownHeadroom = deps.teardownHeadroom ?? defaultTeardownHeadroom;
     this.selfUpdate = deps.selfUpdate ?? runSelfUpdate;
+    this.now = deps.now ?? (() => Date.now());
     this.onUpdated = deps.onUpdated ?? defaultOnUpdated;
     this.docker = deps.docker ?? defaultDockerRunner;
     this.postResumeFailure = deps.postResumeFailure ?? postSessionErrorBubble;
@@ -22599,6 +22611,7 @@ var HostAgentSupervisor = class {
   selfUpdateTimer = null;
   /** Self-update check + install (injectable; defaults to runSelfUpdate). */
   selfUpdate;
+  now;
   /** Restart action after a successful self-update (defaults to process.exit). */
   onUpdated;
   /** Guards against overlapping self-update ticks (a slow npm install). */
@@ -22609,6 +22622,9 @@ var HostAgentSupervisor = class {
    * already-installed version for the restart log.
    */
   pendingRestartVersion = null;
+  /** epoch ms when the CURRENT pending restart was first owed — the ceiling
+   *  in {@link SELF_UPDATE_DEFER_MAX_MS} is measured from here. */
+  pendingRestartSince = null;
   /** Guards the one-shot 'connected' telemetry on the first heartbeat. */
   reportedConnected = false;
   /** Live-metrics collector — stateful across beats (CPU delta + latency). */
@@ -22752,12 +22768,12 @@ var HostAgentSupervisor = class {
     this.selfUpdating = true;
     try {
       if (this.pendingRestartVersion !== null) {
-        this.maybeRestartForUpdate(this.pendingRestartVersion);
-        return;
+        if (this.maybeRestartForUpdate(this.pendingRestartVersion)) return;
       }
       const result = await this.selfUpdate();
       if (result.status !== "updated") return;
       const version3 = result.version ?? "latest";
+      if (this.pendingRestartVersion === null) this.pendingRestartSince = this.now();
       this.pendingRestartVersion = version3;
       this.maybeRestartForUpdate(version3);
     } catch (err) {
@@ -22776,13 +22792,22 @@ var HostAgentSupervisor = class {
    */
   maybeRestartForUpdate(version3) {
     if (this.children.size > 0) {
-      log.info(
+      const since = this.pendingRestartSince ?? this.now();
+      const waited = this.now() - since;
+      if (waited < SELF_UPDATE_DEFER_MAX_MS) {
+        log.info(
+          "host-agent",
+          `self-update: ${version3} installed but ${this.children.size} child(ren) busy \u2014 deferring restart`
+        );
+        return false;
+      }
+      log.warn(
         "host-agent",
-        `self-update: ${version3} installed but ${this.children.size} child(ren) busy \u2014 deferring restart`
+        `self-update: ${version3} has been owed for ${Math.round(waited / 36e5)}h with ${this.children.size} child(ren) still running \u2014 restarting anyway rather than staying on old code`
       );
-      return;
     }
     this.onUpdated(version3);
+    return true;
   }
   /** Number of live children — for tests + diagnostics. */
   childCount() {
@@ -25123,6 +25148,26 @@ async function restoreProjectEnvIfMissing(cwd, ctx) {
   }
 }
 
+// src/services/preview/named-tunnel.ts
+async function resolveNamedTunnel(ctx, fetchTunnel) {
+  const envToken = process.env.PREVIEW_TUNNEL_TOKEN;
+  const envHostname = process.env.PREVIEW_TUNNEL_HOSTNAME;
+  if (envToken && envHostname) return { token: envToken, hostname: envHostname };
+  if (!ctx.pluginAuthToken) return null;
+  try {
+    const minted = await fetchTunnel(ctx);
+    if (!minted?.token || !minted.hostname) return null;
+    log.info("preview", `named tunnel minted on demand: ${minted.hostname}`);
+    return { token: minted.token, hostname: minted.hostname };
+  } catch (err) {
+    log.trace(
+      "preview",
+      `named tunnel unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 quick tunnel`
+    );
+    return null;
+  }
+}
+
 // src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
@@ -25495,8 +25540,16 @@ async function establishTunnel(ctx, dev) {
   let tunnel = null;
   let parsedUrl = null;
   let lastTunnelErr = "cloudflared did not emit a URL within 45s";
-  const namedToken = process.env.PREVIEW_TUNNEL_TOKEN;
-  const namedHostname = process.env.PREVIEW_TUNNEL_HOSTNAME;
+  const named = await resolveNamedTunnel(
+    {
+      sessionId: ctx.sessionId,
+      pluginId: ctx.projectEnvAuth?.pluginId ?? "",
+      pluginAuthToken: ctx.projectEnvAuth?.pluginAuthToken ?? ""
+    },
+    (c2) => fetchNamedPreviewTunnel({ pluginId: c2.pluginId, pluginAuthToken: c2.pluginAuthToken })
+  );
+  const namedToken = named?.token;
+  const namedHostname = named?.hostname;
   if (namedToken && namedHostname) {
     try {
       emitProgress("TUNNEL_STARTING", `named tunnel ${namedHostname}`);
@@ -37383,8 +37436,14 @@ var HOUSE_AGENT_LIMIT_RE = /HOUSE_AGENT_CEILING|CodeAgent Cloud[^\n]{0,60}(?:usa
 function looksLikeHouseAgentLimit(text) {
   return HOUSE_AGENT_LIMIT_RE.test(text);
 }
+var LOCAL_PROXY_RE = /(?:127\.0\.0\.1|localhost|\[::1\]):\d+/i;
+var CONNECTION_ERROR_RE = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|socket hang up|fetch failed|network error|connection (?:refused|reset|closed)/i;
+function looksLikeLocalProxyUnavailable(text) {
+  return LOCAL_PROXY_RE.test(text) && CONNECTION_ERROR_RE.test(text);
+}
 function looksLikeAuthFailure(text) {
   if (looksLikeHouseAgentLimit(text)) return false;
+  if (looksLikeLocalProxyUnavailable(text)) return false;
   return AUTH_FAILURE_RE.test(text);
 }
 function replyIsAuthFailure(finalText) {
@@ -37402,7 +37461,14 @@ function houseAgentLimitMessage(text) {
   const canUpgrade = /upgrade to pro/i.test(text);
   return "\u{1F4CA} **You\u2019ve reached your daily CodeAgent Cloud limit.**\n\nThe free CodeAgent Cloud agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
 }
-var AUTH_FAILURE_MESSAGE = "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired (API 401).**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again.";
+var AUTH_FAILURE_MESSAGE = (
+  // ⚠️ Do NOT name a status code here. This bubble fires for several
+  // different failures, and the old hard-coded "(API 401)" told users the API
+  // had answered 401 when it never had — it also sent a live investigation
+  // hunting for 401s in proxy logs that were serving 200s throughout
+  // (2026-08-24). Say what happened, not a number we did not see.
+  "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired.**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again."
+);
 var CURSOR_UPGRADE_MESSAGE = "\u26A1 **Cursor needs a paid plan to run the agent.**\n\nThe headless Cursor Agent requires Cursor **Pro** \u2014 your Free plan\u2019s included usage does NOT cover Agent runs, even with quota left. This is your Cursor account (not CodeAgent). Upgrade, then send your message again:\n\n[Upgrade to Cursor Pro \u2192](https://cursor.com/dashboard)";
 var ONE_M_CREDITS_MESSAGE = "\u{1F504} **Reconnect your Claude subscription to continue.**\n\nClaude requested 1M-context but your account doesn\u2019t have the usage credits for it on this credential. Reconnecting refreshes your subscription so the agent can keep going \u2014 disabling 1M context won\u2019t fix a credits gate.\n\nTap [Reconnect this agent](codeam://reauth) to reconnect your Claude subscription in Profile \u203A Agents, then send your message again.";
 var TURN_FAILURE_MESSAGE = "\u26A0\uFE0F **The agent hit an error and couldn\u2019t finish this turn.** Please send your message again.";
@@ -37500,6 +37566,10 @@ async function reportCredentialInvalid(opts, fetchImpl = fetch) {
     pluginId: opts.pluginId,
     ...opts.reason ? { reason: opts.reason } : {}
   });
+  log.info(
+    "acpRunner",
+    `credential-invalid \u2192 reporting agent=${opts.agent} reason=${opts.reason ?? "unspecified"}`
+  );
   try {
     const makeHeaders = (token) => ({
       "Content-Type": "application/json",
@@ -37517,10 +37587,21 @@ async function reportCredentialInvalid(opts, fetchImpl = fetch) {
         opts.pollSecret
       );
       if (freshToken !== null) {
-        await fetchImpl(url2, { method: "POST", headers: makeHeaders(freshToken), body });
+        const retried = await fetchImpl(url2, {
+          method: "POST",
+          headers: makeHeaders(freshToken),
+          body
+        });
+        log.info("acpRunner", `credential-invalid \u2190 ${retried.status} (after token refresh)`);
+        return;
       }
     }
-  } catch {
+    log.info("acpRunner", `credential-invalid \u2190 ${response.status}`);
+  } catch (err) {
+    log.warn(
+      "acpRunner",
+      `credential-invalid \u2192 failed: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 async function postCredentialSync(opts, fetchImpl = fetch) {
@@ -45671,7 +45752,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.66.1" : "0.0.0-dev";
+  const cliVersion = true ? "2.67.1" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -46062,7 +46143,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.66.1" : "unknown";
+  const v = true ? "2.67.1" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.66.1",
+  "version": "2.67.1",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",