codeam-cli 2.67.0 → 2.67.2

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.67.1] — 2026-08-24
+
+### Fixed
+
+- **cli:** A Headroom proxy that is briefly down is not an invalid credential
+- **cli:** Log the credential-invalid report instead of firing it blind
+
+## [2.67.0] — 2026-08-24
+
+### Added
+
+- **cli:** Ask the backend for a named preview tunnel when the env has none
+
+### Fixed
+
+- **cli:** Cap how long a self-update restart can be deferred
+
 ## [2.66.1] — 2026-08-24
 
 ### Fixed

package/dist/index.js

@@ -8081,7 +8081,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.67.0" : "0.0.0-dev",
+    cliVersion: true ? "2.67.2" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8323,7 +8323,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.67.0",
+  version: "2.67.2",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9855,7 +9855,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.67.0" ? { ideVersion: "2.67.0" } : {}
+      ..."2.67.2" ? { ideVersion: "2.67.2" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -14938,6 +14938,8 @@ function validateClaudeToken(token) {
   }
   const expiresAt = typeof oauth.expiresAt === "number" ? oauth.expiresAt : null;
   if (expiresAt === null) return { status: "unknown" };
+  const hasAnyToken = typeof oauth.accessToken === "string" && oauth.accessToken.length > 0 || typeof oauth.refreshToken === "string" && oauth.refreshToken.length > 0;
+  if (!hasAnyToken) return { status: "unknown" };
   if (expiresAt >= Date.now()) return { status: "valid" };
   const hasRefresh = typeof oauth.refreshToken === "string" && oauth.refreshToken.length > 0;
   if (hasRefresh) return { status: "unknown" };
@@ -22080,7 +22082,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.67.0" : null;
+  const current2 = true ? "2.67.2" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22097,7 +22099,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.67.0" : null;
+  const current2 = true ? "2.67.2" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22120,7 +22122,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.67.0" : null;
+  return true ? "2.67.2" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -36074,7 +36076,11 @@ You have two options:
 }
 
 // src/agents/acp/wakeCredentialProbe.ts
+function usesHouseProxy(env = process.env) {
+  return /\/agent-proxy(\/|$)/.test(env.ANTHROPIC_BASE_URL ?? "");
+}
 async function localCredentialExpiryStatus(agent) {
+  if (usesHouseProxy()) return "unknown";
   if (!/claude/i.test(agent)) return "unknown";
   const token = await extractLocalClaudeToken();
   if (!token) return "unknown";
@@ -37436,8 +37442,14 @@ var HOUSE_AGENT_LIMIT_RE = /HOUSE_AGENT_CEILING|CodeAgent Cloud[^\n]{0,60}(?:usa
 function looksLikeHouseAgentLimit(text) {
   return HOUSE_AGENT_LIMIT_RE.test(text);
 }
+var LOCAL_PROXY_RE = /(?:127\.0\.0\.1|localhost|\[::1\]):\d+/i;
+var CONNECTION_ERROR_RE = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|socket hang up|fetch failed|network error|connection (?:refused|reset|closed)/i;
+function looksLikeLocalProxyUnavailable(text) {
+  return LOCAL_PROXY_RE.test(text) && CONNECTION_ERROR_RE.test(text);
+}
 function looksLikeAuthFailure(text) {
   if (looksLikeHouseAgentLimit(text)) return false;
+  if (looksLikeLocalProxyUnavailable(text)) return false;
   return AUTH_FAILURE_RE.test(text);
 }
 function replyIsAuthFailure(finalText) {
@@ -37455,7 +37467,14 @@ function houseAgentLimitMessage(text) {
   const canUpgrade = /upgrade to pro/i.test(text);
   return "\u{1F4CA} **You\u2019ve reached your daily CodeAgent Cloud limit.**\n\nThe free CodeAgent Cloud agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
 }
-var AUTH_FAILURE_MESSAGE = "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired (API 401).**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again.";
+var AUTH_FAILURE_MESSAGE = (
+  // ⚠️ Do NOT name a status code here. This bubble fires for several
+  // different failures, and the old hard-coded "(API 401)" told users the API
+  // had answered 401 when it never had — it also sent a live investigation
+  // hunting for 401s in proxy logs that were serving 200s throughout
+  // (2026-08-24). Say what happened, not a number we did not see.
+  "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired.**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again."
+);
 var CURSOR_UPGRADE_MESSAGE = "\u26A1 **Cursor needs a paid plan to run the agent.**\n\nThe headless Cursor Agent requires Cursor **Pro** \u2014 your Free plan\u2019s included usage does NOT cover Agent runs, even with quota left. This is your Cursor account (not CodeAgent). Upgrade, then send your message again:\n\n[Upgrade to Cursor Pro \u2192](https://cursor.com/dashboard)";
 var ONE_M_CREDITS_MESSAGE = "\u{1F504} **Reconnect your Claude subscription to continue.**\n\nClaude requested 1M-context but your account doesn\u2019t have the usage credits for it on this credential. Reconnecting refreshes your subscription so the agent can keep going \u2014 disabling 1M context won\u2019t fix a credits gate.\n\nTap [Reconnect this agent](codeam://reauth) to reconnect your Claude subscription in Profile \u203A Agents, then send your message again.";
 var TURN_FAILURE_MESSAGE = "\u26A0\uFE0F **The agent hit an error and couldn\u2019t finish this turn.** Please send your message again.";
@@ -37553,6 +37572,10 @@ async function reportCredentialInvalid(opts, fetchImpl = fetch) {
     pluginId: opts.pluginId,
     ...opts.reason ? { reason: opts.reason } : {}
   });
+  log.info(
+    "acpRunner",
+    `credential-invalid \u2192 reporting agent=${opts.agent} reason=${opts.reason ?? "unspecified"}`
+  );
   try {
     const makeHeaders = (token) => ({
       "Content-Type": "application/json",
@@ -37570,10 +37593,21 @@ async function reportCredentialInvalid(opts, fetchImpl = fetch) {
         opts.pollSecret
       );
       if (freshToken !== null) {
-        await fetchImpl(url2, { method: "POST", headers: makeHeaders(freshToken), body });
+        const retried = await fetchImpl(url2, {
+          method: "POST",
+          headers: makeHeaders(freshToken),
+          body
+        });
+        log.info("acpRunner", `credential-invalid \u2190 ${retried.status} (after token refresh)`);
+        return;
       }
     }
-  } catch {
+    log.info("acpRunner", `credential-invalid \u2190 ${response.status}`);
+  } catch (err) {
+    log.warn(
+      "acpRunner",
+      `credential-invalid \u2192 failed: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 async function postCredentialSync(opts, fetchImpl = fetch) {
@@ -45724,7 +45758,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.67.0" : "0.0.0-dev";
+  const cliVersion = true ? "2.67.2" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -46115,7 +46149,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.67.0" : "unknown";
+  const v = true ? "2.67.2" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.67.0",
+  "version": "2.67.2",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",