codeam-cli 2.67.7 → 2.69.0

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.68.0] — 2026-08-29
+
+### Added
+
+- **cli:** Inspector de preview — proxy inyector, script y E2E en navegador (#665)
+
+## [2.67.6] — 2026-08-27
+
+### Fixed
+
+- **cli:** Ordena los POST del ciclo de vida del preview
+- **cli:** Re-afirma el preview en el heartbeat para que su snapshot no caduque
+
 ## [2.67.5] — 2026-08-27
 
 ### Fixed

package/dist/index.js

@@ -8081,7 +8081,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.67.7" : "0.0.0-dev",
+    cliVersion: true ? "2.69.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8323,7 +8323,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.67.7",
+  version: "2.69.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -8345,7 +8345,8 @@ var package_default = {
     "test:coverage": "vitest run --coverage",
     typecheck: "tsc --noEmit",
     postinstall: "node dist/postinstall.js || true",
-    prepublishOnly: "npm run build"
+    prepublishOnly: "npm run build",
+    e2e: "playwright test"
   },
   keywords: [
     "claude",
@@ -8413,11 +8414,14 @@ var package_default = {
   },
   devDependencies: {
     "@codeam/shared": "*",
+    "@playwright/test": "^1.62.1",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^22.0.0",
     "@types/qrcode-terminal": "^0.12.0",
     "@types/which": "^3.0.4",
     "@types/ws": "^8.5.0",
     "@vitest/coverage-v8": "^4.1.7",
+    jsdom: "^29.1.1",
     "node-pty": "^1.1.0",
     tsup: "^8.0.0",
     typescript: "^7.0.2",
@@ -9855,7 +9859,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.67.7" ? { ideVersion: "2.67.7" } : {}
+      ..."2.69.0" ? { ideVersion: "2.69.0" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -14058,7 +14062,7 @@ function subscribeToPairCompletion(pluginId, onPaired, onTimeout, pollSecret) {
     onPaired(info);
   };
   dispatchers.add(dispatch);
-  const connect2 = () => {
+  const connect3 = () => {
     if (stopped) return;
     const url2 = new URL(`${API_BASE5}/api/commands/pending/stream`);
     url2.searchParams.set("pluginId", pluginId);
@@ -14084,7 +14088,7 @@ function subscribeToPairCompletion(pluginId, onPaired, onTimeout, pollSecret) {
             `sse status=${res.statusCode}; will reconnect in 1s`
           );
           res.resume();
-          setTimeout(connect2, 1e3);
+          setTimeout(connect3, 1e3);
           return;
         }
         let buf = "";
@@ -14099,23 +14103,23 @@ function subscribeToPairCompletion(pluginId, onPaired, onTimeout, pollSecret) {
           }
         });
         res.on("end", () => {
-          if (!stopped) setTimeout(connect2, 250);
+          if (!stopped) setTimeout(connect3, 250);
         });
         res.on("error", () => {
-          if (!stopped) setTimeout(connect2, 1e3);
+          if (!stopped) setTimeout(connect3, 1e3);
         });
       }
     );
     req.on("error", () => {
-      if (!stopped) setTimeout(connect2, 1e3);
+      if (!stopped) setTimeout(connect3, 1e3);
     });
     req.on("timeout", () => {
       req?.destroy();
-      if (!stopped) setTimeout(connect2, 250);
+      if (!stopped) setTimeout(connect3, 250);
     });
     req.end();
   };
-  connect2();
+  connect3();
   timeoutTimer = setTimeout(() => {
     stop();
     onTimeout();
@@ -22114,7 +22118,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.67.7" : null;
+  const current2 = true ? "2.69.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22131,7 +22135,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.67.7" : null;
+  const current2 = true ? "2.69.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22154,7 +22158,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.67.7" : null;
+  return true ? "2.69.0" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -25103,7 +25107,7 @@ function registerPreview(sessionId, preview) {
 }
 function killProcessTree(child, signal = "SIGTERM") {
   const pid = child.pid;
-  if (pid == null) return;
+  if (!pid) return;
   if (process.platform !== "win32") {
     try {
       process.kill(-pid, signal);
@@ -25125,6 +25129,10 @@ async function killPreview(sessionId) {
     killProcessTree(preview.tunnel, "SIGTERM");
   }
   await new Promise((r) => setTimeout(r, 100));
+  try {
+    await preview.inspector?.close();
+  } catch {
+  }
   killProcessTree(preview.devServer, "SIGTERM");
   const sigkillTimer = setTimeout(() => {
     killProcessTree(preview.devServer, "SIGKILL");
@@ -25309,6 +25317,378 @@ async function resolveNamedTunnel(ctx, fetchTunnel) {
   }
 }
 
+// src/services/preview/inspector-proxy.ts
+var http6 = __toESM(require("http"));
+var net3 = __toESM(require("net"));
+var INJECTION_SCAN_BUDGET_BYTES = 64 * 1024;
+var INJECTION_ANCHORS = ["</head>", "<body>", "</body>"];
+function wantsHtml(accept) {
+  return typeof accept === "string" && accept.includes("text/html");
+}
+function isHtmlResponse(contentType) {
+  return typeof contentType === "string" && contentType.toLowerCase().includes("text/html");
+}
+function injectAt(html, script) {
+  for (const anchor of INJECTION_ANCHORS) {
+    const at3 = html.indexOf(anchor);
+    if (at3 === -1) continue;
+    const insertAt = anchor.startsWith("</") ? at3 : at3 + anchor.length;
+    return html.slice(0, insertAt) + script + html.slice(insertAt);
+  }
+  return null;
+}
+async function startInspectorProxy(opts) {
+  const targetHost = opts.targetHost ?? "127.0.0.1";
+  const upgraded = /* @__PURE__ */ new Set();
+  const server = http6.createServer((req, res) => {
+    const inject = wantsHtml(req.headers.accept);
+    const headers = { ...req.headers };
+    if (inject) delete headers["accept-encoding"];
+    const upstream = http6.request(
+      { host: targetHost, port: opts.targetPort, method: req.method, path: req.url, headers },
+      (originRes) => {
+        const outHeaders = { ...originRes.headers };
+        const willInject = inject && isHtmlResponse(originRes.headers["content-type"]);
+        if (willInject) delete outHeaders["content-length"];
+        res.writeHead(originRes.statusCode ?? 502, outHeaders);
+        if (!willInject) {
+          originRes.pipe(res);
+          return;
+        }
+        let buffered = "";
+        let done = false;
+        originRes.setEncoding("utf8");
+        originRes.on("data", (chunk) => {
+          if (done) {
+            res.write(chunk);
+            return;
+          }
+          buffered += chunk;
+          const injected = injectAt(buffered, opts.script);
+          if (injected !== null) {
+            done = true;
+            res.write(injected);
+            buffered = "";
+            return;
+          }
+          if (buffered.length >= INJECTION_SCAN_BUDGET_BYTES) {
+            done = true;
+            res.write(buffered);
+            buffered = "";
+          }
+        });
+        originRes.on("end", () => {
+          if (!done && buffered.length > 0) res.write(buffered);
+          res.end();
+        });
+      }
+    );
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
+      res.end("preview origin unreachable");
+    });
+    req.pipe(upstream);
+  });
+  server.on("upgrade", (req, clientSocket, head) => {
+    upgraded.add(clientSocket);
+    const upstream = net3.connect(opts.targetPort, targetHost, () => {
+      const lines = [`${req.method} ${req.url} HTTP/1.1`];
+      for (const [k2, v] of Object.entries(req.headers)) {
+        for (const one of Array.isArray(v) ? v : [v]) {
+          if (one !== void 0) lines.push(`${k2}: ${one}`);
+        }
+      }
+      upstream.write(`${lines.join("\r\n")}\r
+\r
+`);
+      if (head?.length) upstream.write(head);
+      upstream.pipe(clientSocket);
+      clientSocket.pipe(upstream);
+    });
+    const drop = () => {
+      upgraded.delete(clientSocket);
+      upstream.destroy();
+      clientSocket.destroy();
+    };
+    upstream.on("error", drop);
+    upstream.on("close", drop);
+    clientSocket.on("error", drop);
+    clientSocket.on("close", drop);
+  });
+  await new Promise((resolve10, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve10());
+  });
+  const port = server.address().port;
+  return {
+    port,
+    close: () => new Promise((resolve10) => {
+      for (const socket of upgraded) socket.destroy();
+      upgraded.clear();
+      server.closeAllConnections?.();
+      server.close(() => resolve10());
+    })
+  };
+}
+
+// src/services/preview/inspector-client.ts
+var INSPECTOR_CHANNEL = "codeam-inspector";
+function inspectorClientSource(opts) {
+  const origins = JSON.stringify(opts.allowedOrigins);
+  const channel = JSON.stringify(INSPECTOR_CHANNEL);
+  return `<script id="codeam-inspector" data-codeam="inspector">
+(function () {
+  'use strict';
+  try {
+    var CHANNEL = ${channel};
+    var ALLOWED = ${origins};
+
+    var enabled = false;
+    var driver = null;   // el origen que nos encendio
+    var overlay = null;
+    var label = null;
+    var current = null;
+
+    function allowed(origin) {
+      return ALLOWED.indexOf(origin) !== -1;
+    }
+
+    // \xBFEstamos dentro del WebView de la app movil?
+    //
+    // \u26A0\uFE0F En un WebView el documento es de NIVEL SUPERIOR, asi que
+    // \`window.parent === window\` y la via del iframe no existe: el script
+    // hablaba solo, y en movil el inspector no devolvia nada. React Native
+    // expone su propio canal, que es el unico que sale de ahi.
+    function rnBridge() {
+      return typeof window.ReactNativeWebView !== 'undefined' &&
+        window.ReactNativeWebView &&
+        typeof window.ReactNativeWebView.postMessage === 'function'
+        ? window.ReactNativeWebView
+        : null;
+    }
+
+    function send(type, payload) {
+      if (!driver) return;
+      var msg = { source: CHANNEL, type: type };
+      for (var k in payload) if (Object.prototype.hasOwnProperty.call(payload, k)) msg[k] = payload[k];
+
+      var rn = rnBridge();
+      if (rn) {
+        // El canal de RN transporta CADENAS, no objetos: pasarle el objeto
+        // llega al otro lado como "[object Object]".
+        rn.postMessage(JSON.stringify(msg));
+        return;
+      }
+      if (window.parent === window) return;
+      window.parent.postMessage(msg, driver);
+    }
+
+    // El resaltado. Un div fijo por encima de todo que NUNCA captura el
+    // puntero: si lo capturara, el elemento de debajo dejaria de recibir el
+    // mousemove y el resaltado se quedaria pegado al primero que tocara.
+    function ensureOverlay() {
+      if (overlay) return;
+      overlay = document.createElement('div');
+      overlay.setAttribute('data-codeam', 'inspector-overlay');
+      overlay.style.cssText = [
+        'position:fixed', 'pointer-events:none', 'z-index:2147483647',
+        'border:1px solid #a855f7', 'background:rgba(168,85,247,0.14)',
+        'border-radius:2px', 'transition:none', 'display:none'
+      ].join(';');
+      label = document.createElement('div');
+      label.setAttribute('data-codeam', 'inspector-label');
+      label.style.cssText = [
+        'position:fixed', 'pointer-events:none', 'z-index:2147483647',
+        'background:#a855f7', 'color:#000', 'font:600 11px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace',
+        'padding:2px 6px', 'border-radius:3px', 'white-space:nowrap', 'display:none'
+      ].join(';');
+      document.body.appendChild(overlay);
+      document.body.appendChild(label);
+    }
+
+    function removeOverlay() {
+      if (overlay && overlay.parentNode) overlay.parentNode.removeChild(overlay);
+      if (label && label.parentNode) label.parentNode.removeChild(label);
+      overlay = null;
+      label = null;
+    }
+
+    // Fichero y linea del componente de React, cuando el dev server los
+    // expone. Es lo que hace que el agente reciba
+    // "components/whatsapp-button.tsx:42" en vez de "x:0.62 y:0.81".
+    // Solo existe en builds de desarrollo; en produccion devuelve null y se
+    // cae al selector CSS.
+    function reactSource(el) {
+      try {
+        for (var key in el) {
+          if (key.indexOf('__reactFiber$') !== 0) continue;
+          var fiber = el[key];
+          while (fiber) {
+            var src = fiber._debugSource;
+            if (src && src.fileName) {
+              return { file: String(src.fileName), line: Number(src.lineNumber) || null };
+            }
+            fiber = fiber.return;
+          }
+        }
+      } catch (e) { /* nunca romper la pagina por esto */ }
+      return null;
+    }
+
+    // Un selector corto y legible, el respaldo cuando no hay React.
+    function selectorFor(el) {
+      if (el.id) return '#' + el.id;
+      var name = el.tagName ? el.tagName.toLowerCase() : 'node';
+      var cls = (el.className && typeof el.className === 'string')
+        ? el.className.trim().split(/\\s+/).slice(0, 3).join('.')
+        : '';
+      return cls ? name + '.' + cls : name;
+    }
+
+    function describe(el) {
+      var r = el.getBoundingClientRect();
+      var text = (el.textContent || '').replace(/\\s+/g, ' ').trim();
+      return {
+        tag: el.tagName ? el.tagName.toLowerCase() : 'node',
+        id: el.id || null,
+        classes: (el.className && typeof el.className === 'string') ? el.className.trim() : '',
+        selector: selectorFor(el),
+        // Un recorte, no el contenido: describir no es extraer.
+        text: text.length > 120 ? text.slice(0, 120) + '\u2026' : text,
+        rect: { x: r.left, y: r.top, w: r.width, h: r.height },
+        viewport: { w: window.innerWidth, h: window.innerHeight },
+        source: reactSource(el)
+      };
+    }
+
+    function paint(el) {
+      ensureOverlay();
+      var r = el.getBoundingClientRect();
+      overlay.style.display = 'block';
+      overlay.style.left = r.left + 'px';
+      overlay.style.top = r.top + 'px';
+      overlay.style.width = r.width + 'px';
+      overlay.style.height = r.height + 'px';
+      label.style.display = 'block';
+      label.textContent = selectorFor(el) + '  ' + Math.round(r.width) + '\xD7' + Math.round(r.height);
+      // Encima si cabe; si no, dentro. Una etiqueta cortada por el borde
+      // superior no se lee.
+      var above = r.top >= 20;
+      label.style.left = r.left + 'px';
+      label.style.top = (above ? r.top - 20 : r.top + 2) + 'px';
+    }
+
+    function onMove(e) {
+      if (!enabled) return;
+      var el = e.target;
+      if (!el || el === current || !el.getBoundingClientRect) return;
+      if (el.getAttribute && el.getAttribute('data-codeam')) return;
+      current = el;
+      paint(el);
+      send('hover', { element: describe(el) });
+    }
+
+    // Captura, y se traga el evento: mientras el modo esta activo un clic
+    // SELECCIONA, no navega. Sin esto, pulsar un enlace se llevaria el
+    // preview a otra pagina en mitad del gesto.
+    function onClick(e) {
+      if (!enabled) return;
+      var el = e.target;
+      if (el && el.getAttribute && el.getAttribute('data-codeam')) return;
+      e.preventDefault();
+      e.stopPropagation();
+      if (el) send('pick', { element: describe(el) });
+    }
+
+    function enable(origin) {
+      if (enabled) return;
+      enabled = true;
+      driver = origin;
+      document.addEventListener('mousemove', onMove, true);
+      document.addEventListener('click', onClick, true);
+      send('ready', {});
+    }
+
+    function disable() {
+      if (!enabled) return;
+      enabled = false;
+      current = null;
+      document.removeEventListener('mousemove', onMove, true);
+      document.removeEventListener('click', onClick, true);
+      removeOverlay();
+      driver = null;
+    }
+
+    window.addEventListener('message', function (e) {
+      if (!allowed(e.origin)) return;
+      var data = e.data;
+      if (!data || data.source !== CHANNEL) return;
+      if (data.type === 'enable') enable(e.origin);
+      else if (data.type === 'disable') disable();
+    });
+
+    /**
+     * La puerta para React Native, que no puede usar \`postMessage\`.
+     *
+     * \u26A0\uFE0F Aqui NO hay lista blanca de origenes, y no es un descuido: quien
+     * llama esto es la app anfitriona sobre SU PROPIO WebView, via
+     * \`injectJavaScript\` \u2014 no hay un tercero al que filtrar. La lista blanca
+     * protege el caso del iframe, donde cualquier pagina puede embeber el
+     * preview y mandar mensajes; ese caso sigue exactamente igual de cerrado.
+     *
+     * Solo se expone donde ese puente existe, para no dejar en una pagina
+     * normal una funcion global que encienda el inspector sin permiso.
+     */
+    if (rnBridge()) {
+      window.__codeamInspector = {
+        enable: function () { enable('react-native'); },
+        disable: disable,
+      };
+    }
+  } catch (e) {
+    // Pase lo que pase, la app del usuario sigue funcionando.
+  }
+})();
+</script>`;
+}
+
+// src/services/preview/inspector-bringup.ts
+var DEFAULT_INSPECTOR_ORIGINS = [
+  "https://www.codeagent-mobile.com",
+  "https://codeagent-mobile.com",
+  "https://dev.codeagent-mobile.com"
+];
+function inspectorEnabled(env) {
+  const raw = env.CODEAM_PREVIEW_INSPECTOR;
+  return raw !== "0" && raw !== "false";
+}
+function resolveInspectorOrigins(env) {
+  const raw = env.CODEAM_INSPECTOR_ORIGINS;
+  if (!raw) return DEFAULT_INSPECTOR_ORIGINS;
+  const extra = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  return [...DEFAULT_INSPECTOR_ORIGINS, ...extra];
+}
+async function bringUpInspector(targetPort, deps = {}) {
+  const env = deps.env ?? process.env;
+  const log2 = deps.log ?? (() => void 0);
+  if (!inspectorEnabled(env)) {
+    log2("preview inspector disabled by CODEAM_PREVIEW_INSPECTOR");
+    return { port: targetPort, proxy: null };
+  }
+  try {
+    const start2 = deps.start ?? startInspectorProxy;
+    const proxy = await start2({
+      targetPort,
+      script: inspectorClientSource({ allowedOrigins: resolveInspectorOrigins(env) })
+    });
+    log2(`preview inspector proxy on :${proxy.port} \u2192 :${targetPort}`);
+    return { port: proxy.port, proxy };
+  } catch (e) {
+    log2(`preview inspector unavailable (${e.message}) \u2014 going direct`);
+    return { port: targetPort, proxy: null };
+  }
+}
+
 // src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
@@ -25420,6 +25800,7 @@ async function runPreviewStart(args2) {
     sessionId,
     devServer: dev.devServer,
     tunnel: tun.tunnel,
+    inspector: tun.inspector,
     url: tun.url,
     framework: detection.framework,
     detection,
@@ -25665,8 +26046,12 @@ async function establishTunnel(ctx, dev) {
       });
       return null;
     }
-    return { url: expoUrl, tunnel: null };
+    return { url: expoUrl, tunnel: null, inspector: null };
   }
+  const inspection = await bringUpInspector(detection.port, {
+    log: (m) => log.info("preview", m)
+  });
+  const tunnelPort = inspection.port;
   let bin;
   try {
     bin = await resolveCloudflared();
@@ -25694,7 +26079,7 @@ async function establishTunnel(ctx, dev) {
   if (namedToken && namedHostname) {
     try {
       emitProgress("TUNNEL_STARTING", `named tunnel ${namedHostname}`);
-      const candidate = await spawnNamedTunnel(bin, namedToken, detection.port);
+      const candidate = await spawnNamedTunnel(bin, namedToken, tunnelPort);
       const outcome = await awaitTunnelRegistered(
         candidate,
         namedHostname,
@@ -25727,7 +26112,7 @@ async function establishTunnel(ctx, dev) {
     }
     const candidate = (0, import_child_process22.spawn)(
       bin,
-      ["tunnel", "--url", `http://localhost:${detection.port}`],
+      ["tunnel", "--url", `http://localhost:${tunnelPort}`],
       { stdio: ["ignore", "pipe", "pipe"] }
     );
     const outcome = await awaitTunnelRegistered(
@@ -25752,7 +26137,7 @@ async function establishTunnel(ctx, dev) {
     });
     return null;
   }
-  return { url: parsedUrl, tunnel };
+  return { url: parsedUrl, tunnel, inspector: inspection.proxy };
 }
 
 // src/beads/bd-adapter.ts
@@ -29842,7 +30227,7 @@ var fs67 = __toESM(require("fs"));
 var path74 = __toESM(require("path"));
 var os56 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
-var http6 = __toESM(require("http"));
+var http7 = __toESM(require("http"));
 var import_zod2 = require("zod");
 var historyRecordSchema = import_zod2.z.object({
   type: import_zod2.z.string().optional(),
@@ -29925,7 +30310,7 @@ function post(endpoint, body, pluginAuthToken) {
   return new Promise((resolve10) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE8}${endpoint}`);
-    const transport = u2.protocol === "https:" ? https7 : http6;
+    const transport = u2.protocol === "https:" ? https7 : http7;
     const req = transport.request(
       {
         hostname: u2.hostname,
@@ -32822,8 +33207,8 @@ var ConnectionBuilder = class {
         if (message.kind !== "request" || message.method !== method) {
           return Handled.no(message);
         }
-        const request = parse(message.params);
-        return await handler(request, message.responder, cx) ?? Handled.yes();
+        const request2 = parse(message.params);
+        return await handler(request2, message.responder, cx) ?? Handled.yes();
       },
       describe: () => `${this.connectionName ?? "request"}:${method}`
     });
@@ -33384,23 +33769,23 @@ var AsyncQueue = class {
     });
   }
 };
-function cloneNewSessionRequest(request) {
+function cloneNewSessionRequest(request2) {
   return {
-    ...request,
-    additionalDirectories: request.additionalDirectories ? [...request.additionalDirectories] : void 0,
-    mcpServers: [...request.mcpServers]
+    ...request2,
+    additionalDirectories: request2.additionalDirectories ? [...request2.additionalDirectories] : void 0,
+    mcpServers: [...request2.mcpServers]
   };
 }
 var SessionBuilder = class _SessionBuilder {
   cx;
   request;
-  constructor(cx, request) {
+  constructor(cx, request2) {
     this.cx = cx;
-    this.request = cloneNewSessionRequest(request);
+    this.request = cloneNewSessionRequest(request2);
   }
   /** @internal */
-  static create(cx, request) {
-    return new _SessionBuilder(cx, request);
+  static create(cx, request2) {
+    return new _SessionBuilder(cx, request2);
   }
   /**
    * Returns the `session/new` request that will be sent.
@@ -34528,9 +34913,9 @@ function toolCallReferencesInternal(call, homeDir2) {
   }
   return false;
 }
-function internalPathPermissionOutcome(request, homeDir2) {
-  if (!toolCallReferencesInternal(request.toolCall, homeDir2)) return null;
-  const reject = request.options.find((o) => o.kind === "reject_once") ?? request.options.find((o) => o.kind === "reject_always");
+function internalPathPermissionOutcome(request2, homeDir2) {
+  if (!toolCallReferencesInternal(request2.toolCall, homeDir2)) return null;
+  const reject = request2.options.find((o) => o.kind === "reject_once") ?? request2.options.find((o) => o.kind === "reject_always");
   if (reject) return { outcome: { outcome: "selected", optionId: reject.optionId } };
   return { outcome: { outcome: "cancelled" } };
 }
@@ -34589,9 +34974,9 @@ function toolPathIsSecret(p2) {
   return !!p2 && SECRET_RE.test(p2);
 }
 var GUARDRAIL_SECRET_READ_BLOCK_REASON = "Reading this secret file is blocked by this session's guardrails (Reading secrets = Deny). Adjust it in the session Guardrails settings if intended.";
-function guardrailDecision(request, policy) {
-  if (isProseOnlyToolKind(request.toolCall.kind)) return null;
-  const hay = haystack(request.toolCall);
+function guardrailDecision(request2, policy) {
+  if (isProseOnlyToolKind(request2.toolCall.kind)) return null;
+  const hay = haystack(request2.toolCall);
   if (!hay) return null;
   const matched = matchedCategories(hay);
   if (matched.size === 0) return null;
@@ -34611,7 +34996,7 @@ function guardrailDecision(request, policy) {
       kind: "deny",
       category: denyCat,
       reason: GUARDRAIL_CATEGORY_META[denyCat].description,
-      outcome: rejectOutcome(request.options)
+      outcome: rejectOutcome(request2.options)
     };
   }
   if (confirmCat) {
@@ -35876,7 +36261,7 @@ async function performAgentSwitch(deps, rawAgentId, fastPath = {}) {
 }
 
 // src/services/streaming/transport.ts
-var http7 = __toESM(require("http"));
+var http8 = __toESM(require("http"));
 var https8 = __toESM(require("https"));
 var _transport4 = {
   post: _post3,
@@ -35886,7 +36271,7 @@ function _post3(url2, headers, payload) {
   return new Promise((resolve10, reject) => {
     let settled = false;
     const u2 = new URL(url2);
-    const lib = u2.protocol === "https:" ? https8 : http7;
+    const lib = u2.protocol === "https:" ? https8 : http8;
     const req = lib.request(
       {
         hostname: u2.hostname,
@@ -35928,7 +36313,7 @@ function _get(url2, headers) {
   return new Promise((resolve10, reject) => {
     let settled = false;
     const u2 = new URL(url2);
-    const lib = u2.protocol === "https:" ? https8 : http7;
+    const lib = u2.protocol === "https:" ? https8 : http8;
     const req = lib.request(
       {
         hostname: u2.hostname,
@@ -36733,12 +37118,12 @@ function mapSessionUpdate(notification) {
       return [];
   }
 }
-function mapPermissionRequest(request) {
-  const prompt = describeToolCall(request.toolCall) ?? "The agent requested permission to continue.";
+function mapPermissionRequest(request2) {
+  const prompt = describeToolCall(request2.toolCall) ?? "The agent requested permission to continue.";
   const optionIdByLabel = {};
   const kindByLabel = {};
   const labels = [];
-  for (const opt of request.options) {
+  for (const opt of request2.options) {
     const label = opt.name?.trim() || humanizeKind(opt.kind);
     if (label in optionIdByLabel) continue;
     optionIdByLabel[label] = opt.optionId;
@@ -36834,10 +37219,10 @@ function guardrailBlockNotice(decision, toolCall) {
   return `\u26D4 Guardrail auto-blocked ${describeToolCallForNotice(toolCall)} \u2014 ${decision.reason} This session's "${decision.category}" guardrail is set to Deny (adjust it in the session's Guardrails settings if intended). This was an automatic block, not a rejection by you.`;
 }
 function createOnRequestPermission(deps) {
-  return async (request) => {
+  return async (request2) => {
     let guardrailConfirm = false;
     if (!deps.isLocal()) {
-      const denied = internalPathPermissionOutcome(request);
+      const denied = internalPathPermissionOutcome(request2);
       if (denied) {
         log.warn(
           "acpRunner",
@@ -36845,17 +37230,17 @@ function createOnRequestPermission(deps) {
         );
         void deps.publisher.publishOutput({
           type: "text",
-          content: internalBlockNotice(request.toolCall),
+          content: internalBlockNotice(request2.toolCall),
           done: true
         });
         return denied;
       }
-      const g = guardrailDecision(request, deps.getPolicy());
+      const g = guardrailDecision(request2, deps.getPolicy());
       if (g?.kind === "deny") {
         log.warn("acpRunner", `guardrail [${g.category}] \u2014 denying tool call`);
         void deps.publisher.publishOutput({
           type: "text",
-          content: guardrailBlockNotice(g, request.toolCall),
+          content: guardrailBlockNotice(g, request2.toolCall),
           done: true
         });
         return g.outcome;
@@ -36866,7 +37251,7 @@ function createOnRequestPermission(deps) {
       }
     }
     if (deps.autoApprovePermissions && !guardrailConfirm) {
-      const allow = pickAllowOption(request.options);
+      const allow = pickAllowOption(request2.options);
       if (allow) {
         log.info(
           "acpRunner",
@@ -36876,7 +37261,7 @@ function createOnRequestPermission(deps) {
       }
       log.warn("acpRunner", "AUTO mode \u2014 no allow option offered; falling back to interactive");
     }
-    const { event, optionIdByLabel } = mapPermissionRequest(request);
+    const { event, optionIdByLabel } = mapPermissionRequest(request2);
     await deps.publisher.publishAwaitingAnswer(event);
     return deps.registerPermission({
       questionId: event.questionId,
@@ -42787,8 +43172,8 @@ async function runBatonSession(opts) {
     // instance the baton's own AcpDriver.start bracketing uses.
     beginLoadReplay: () => streaming.beginLoadReplay(),
     endLoadReplay: () => streaming.endLoadReplay(),
-    onRequestPermission: async (request) => {
-      const { event, optionIdByLabel } = mapPermissionRequest(request);
+    onRequestPermission: async (request2) => {
+      const { event, optionIdByLabel } = mapPermissionRequest(request2);
       await publisher.publishAwaitingAnswer(event);
       return streaming.registerPermission({
         questionId: event.questionId,
@@ -45990,7 +46375,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.67.7" : "0.0.0-dev";
+  const cliVersion = true ? "2.69.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -46381,7 +46766,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.67.7" : "unknown";
+  const v = true ? "2.69.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.67.7",
+  "version": "2.69.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -22,7 +22,8 @@
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
     "postinstall": "node dist/postinstall.js || true",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "e2e": "playwright test"
   },
   "keywords": [
     "claude",
@@ -90,11 +91,14 @@
   },
   "devDependencies": {
     "@codeam/shared": "*",
+    "@playwright/test": "^1.62.1",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^22.0.0",
     "@types/qrcode-terminal": "^0.12.0",
     "@types/which": "^3.0.4",
     "@types/ws": "^8.5.0",
     "@vitest/coverage-v8": "^4.1.7",
+    "jsdom": "^29.1.1",
     "node-pty": "^1.1.0",
     "tsup": "^8.0.0",
     "typescript": "^7.0.2",