codeam-cli 2.71.2 → 2.73.0

package/dist/index.js

@@ -1750,7 +1750,12 @@ var INTEGRATION_REGISTRY = {
           label: "Token",
           placeholder: "Your Trello token",
           secret: true,
-          help: 'On the API-key page, click the "Token" link to authorize + generate a token (scope read,write, never-expiring).'
+          // WARNING - the Power-Up API-key page also shows a "Secret", and it is
+          // NOT the token: both are 64 hex characters and look identical, so it
+          // is the natural thing to copy. Pasting the Secret fails with Trello's
+          // misleading `invalid key`, which then sends the user to regenerate a
+          // perfectly good API key (owner report, 2026-09-01). Say so here.
+          help: 'On that same API-key page, click the "Token" link to authorize and generate a token (read,write, never-expiring). NOT the "Secret" on that page - it looks identical but will not work.'
         }
       ]
     },
@@ -8092,7 +8097,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.71.2" : "0.0.0-dev",
+    cliVersion: true ? "2.73.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8334,7 +8339,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.71.2",
+  version: "2.73.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9902,7 +9907,7 @@ var CommandRelayService = class _CommandRelayService {
       if (/PLUGIN_SECRET_REQUIRED|INVALID_PLUGIN_SECRET/.test(reason)) {
         log.warn(
           "relay",
-          `ack REJECTED (${reason}) \u2014 this host needs to be re-paired; commands will be redelivered forever until it is`
+          `ack REJECTED (${reason}) \u2014 this host must be re-paired; retrying will never fix it. Delivery still works while this client drains on receive, but the ack rail is dead and ack-mode would stall here.`
         );
         return;
       }
@@ -9927,7 +9932,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.71.2" ? { ideVersion: "2.71.2" } : {}
+      ..."2.73.0" ? { ideVersion: "2.73.0" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -11527,6 +11532,13 @@ var startCommandSchema = import_zod.z.object({
       value: import_zod.z.string().max(32768)
     })
   ).max(512).optional(),
+  // `env_parse` — how a pasted `.env` blob meets the project's current one.
+  // `merge` (the default when absent) keeps variables the paste does not
+  // mention, because a PARTIAL paste is the common case: people copy the block
+  // they care about, not the whole file. `replace` is opt-in and destructive
+  // in intent, so it must be asked for explicitly. The blob itself rides the
+  // existing `content` field.
+  mode: import_zod.z.enum(["merge", "replace"]).optional(),
   // `skills_configure` — the curated `SkillId` to add/remove. `list` (and a
   // malformed/unknown id on add/remove) sends no `skillId` or an invalid one;
   // `configureSkill` itself validates against the shared registry.
@@ -22186,7 +22198,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.71.2" : null;
+  const current2 = true ? "2.73.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22203,7 +22215,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.71.2" : null;
+  const current2 = true ? "2.73.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22226,7 +22238,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.71.2" : null;
+  return true ? "2.73.0" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -22519,6 +22531,14 @@ function isFleetLimits(v) {
 function isFleetCreateBoxPayload(p2) {
   return typeof p2.boxId === "string" && isFleetContainerName(p2.containerName) && typeof p2.enrollToken === "string" && p2.enrollToken.length > 0 && typeof p2.apiOrigin === "string" && p2.apiOrigin.length > 0 && isFleetLimits(p2.limits);
 }
+function isFleetMigrateBoxImagePayload(p2) {
+  return typeof p2.boxId === "string" && isFleetContainerName(p2.containerName) && typeof p2.apiOrigin === "string" && p2.apiOrigin.length > 0 && isFleetLimits(p2.limits) && // ⚠️ REJECT a token outright rather than ignoring it. A migrate that
+  // carried one would bake a 15-minute credential into a container that may
+  // not start for days — a terminal 4xx at boot, i.e. a box that never comes
+  // back. If a future backend starts sending one, this must fail loudly here
+  // rather than silently produce that box.
+  p2.enrollToken === void 0;
+}
 function isFleetBoxRefPayload(p2) {
   if (typeof p2.boxId !== "string") return false;
   if (!isFleetContainerName(p2.containerName)) return false;
@@ -22550,6 +22570,9 @@ function isMissingVolumeError(stderr) {
 function resolveFleetBoxImage() {
   return process.env.CODEAM_FLEET_BOX_IMAGE || "ghcr.io/edgar-durand/codeam-box:latest";
 }
+function buildFleetBoxMigrateArgs(p2) {
+  return buildFleetBoxRunArgs(p2).map((a) => a === "run" ? "create" : a).filter((a) => a !== "--pull=always" && a !== "-d");
+}
 function buildFleetBoxRunArgs(p2) {
   const userId = fleetUserIdFromContainerName(p2.containerName);
   const image = resolveFleetBoxImage();
@@ -22949,6 +22972,14 @@ var HostAgentSupervisor = class {
       await this.fleetCreateBox(cmd.payload);
       return;
     }
+    if (cmd.type === "fleet_migrate_box_image") {
+      if (!isFleetMigrateBoxImagePayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_migrate_box_image id=${cmd.id}`);
+        return;
+      }
+      await this.fleetMigrateBoxImage(cmd.payload);
+      return;
+    }
     if (cmd.type === "fleet_start_box") {
       if (!isFleetBoxRefPayload(cmd.payload)) {
         log.warn("host-agent", `ignoring malformed fleet_start_box id=${cmd.id}`);
@@ -23119,6 +23150,90 @@ var HostAgentSupervisor = class {
   }
   /** `fleet_start_box` — wake a sleeping box (`docker start`). Idempotent: a
    *  container the host already removed is treated as success. */
+  /**
+   * `fleet_migrate_box_image` — re-point a SLEEPING box at the current
+   * `:latest` without waking it, so the version it was pinned to becomes
+   * reclaimable by the (already automated) dangling-image prune.
+   *
+   * WHY THIS IS NEEDED AT ALL. Boxes are created with `--pull=always` on
+   * purpose, so each stays pinned to the image it was born on, and Docker
+   * refuses to delete an image any container references INCLUDING stopped
+   * ones — which is precisely what stops the prune from destroying a sleeping
+   * user's box. So every image release strands ~7.7 GB per lagging box until it
+   * wakes or is reaped on day 7 (fleet-1, 2026-09-02: 9 boxes across 4
+   * versions, ~31 GB held).
+   *
+   * ⚠️ THE HOST RE-CHECKS THAT THE BOX IS STOPPED, even though the backend only
+   * selects `status: 'SLEEPING'`. The DB's view can lag the host by a sweep —
+   * a box that woke seconds ago is still SLEEPING in the row — and re-creating
+   * a RUNNING container kills a live agent mid-turn. The authority on whether a
+   * container is running is the daemon, so we ask it here and refuse rather
+   * than trust the payload.
+   *
+   * ⚠️ `docker create`, and NO enroll token. `run` would start the container,
+   * so migrating the sleeping set in a batch would wake all of them (9 ×
+   * 1536 MB on a 16 GB host) only for the sleep sweep to re-sleep them 30
+   * minutes later. And a token would be a 15-minute credential baked into a
+   * container that may not start for days — a terminal 4xx at boot, i.e. a box
+   * that never comes back. The sealed identity is in the named volume, which
+   * `rm` WITHOUT `-v` preserves.
+   *
+   * Idempotent and best-effort: a box already on `:latest` is skipped, a
+   * missing container is success (a concurrent reap), and nothing here may
+   * throw into the relay — this is housekeeping.
+   */
+  async fleetMigrateBoxImage(payload) {
+    const { containerName } = payload;
+    const state = await this.docker.run([
+      "inspect",
+      "--format",
+      "{{.State.Running}}",
+      containerName
+    ]);
+    if (state.code !== 0) {
+      if (isMissingContainerError(state.stderr)) return;
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: inspect of ${containerName} failed (code=${state.code}) \u2014 skipping`
+      );
+      return;
+    }
+    if (state.stdout.trim() === "true") {
+      log.info(
+        "host-agent",
+        `fleet_migrate_box_image: ${containerName} is RUNNING \u2014 skipping (never touch a live box)`
+      );
+      return;
+    }
+    if (!await this.fleetBoxImageStale(containerName)) {
+      log.info("host-agent", `fleet_migrate_box_image: ${containerName} already current`);
+      return;
+    }
+    const rm = await this.docker.run(["rm", "-f", containerName], {
+      timeoutMs: DOCKER_RUN_TIMEOUT_MS
+    });
+    if (rm.code !== 0 && !isMissingContainerError(rm.stderr)) {
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: rm of ${containerName} failed (code=${rm.code}): ${rm.stderr.trim().slice(-200)} \u2014 NOT creating a replacement`
+      );
+      return;
+    }
+    const res = await this.docker.run(buildFleetBoxMigrateArgs(payload), {
+      timeoutMs: DOCKER_RUN_TIMEOUT_MS
+    });
+    if (res.code !== 0) {
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: create of ${containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-200)}`
+      );
+      return;
+    }
+    log.info(
+      "host-agent",
+      `fleet_migrate_box_image: ${containerName} re-pointed at :latest (still stopped)`
+    );
+  }
   async fleetStartBox(payload) {
     const { containerName } = payload;
     if (fleetRefCanRecreate(payload) && await this.fleetBoxImageStale(containerName)) {
@@ -28213,6 +28328,44 @@ var envReadH = async (ctx, cmd) => {
     await ctx.relay.sendResult(cmd.id, "failed", { error: err.message });
   }
 };
+var envParseH = async (ctx, cmd, parsed) => {
+  const content = typeof parsed.content === "string" ? parsed.content : null;
+  if (content === null) {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing content" });
+    return;
+  }
+  const replace = parsed.mode === "replace";
+  const incoming = /* @__PURE__ */ new Map();
+  for (const v of parseDotenv(content)) incoming.set(v.key, v.value);
+  const distinctAssignments = new Set(
+    content.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#") && l.includes("=")).map((l) => l.startsWith("export ") ? l.slice("export ".length).trim() : l).map((l) => l.slice(0, l.indexOf("=")).trim())
+  );
+  const unrecognized = Math.max(0, distinctAssignments.size - incoming.size);
+  const existing = /* @__PURE__ */ new Map();
+  if (!replace) {
+    try {
+      const raw = await fs65.promises.readFile(path71.join(process.cwd(), ".env"), "utf8");
+      for (const v of parseDotenv(raw)) existing.set(v.key, v.value);
+    } catch {
+    }
+  }
+  let added = 0;
+  let updated = 0;
+  for (const [key, value] of incoming) {
+    if (existing.has(key)) {
+      if (existing.get(key) !== value) updated += 1;
+    } else {
+      added += 1;
+    }
+    existing.set(key, value);
+  }
+  await ctx.relay.sendResult(cmd.id, "completed", {
+    vars: [...existing].map(([key, value]) => ({ key, value })),
+    added,
+    updated,
+    unrecognized
+  });
+};
 var envWriteH = async (ctx, cmd, parsed) => {
   const vars = parsed.vars;
   if (!Array.isArray(vars)) {
@@ -29490,6 +29643,7 @@ var handlers = {
   save_preview_config: savePreviewConfigH,
   env_read: envReadH,
   env_write: envWriteH,
+  env_parse: envParseH,
   skills_configure: skillsConfigureH,
   take_control: takeControlH,
   handback: handbackH,
@@ -46859,7 +47013,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.71.2" : "0.0.0-dev";
+  const cliVersion = true ? "2.73.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -47250,7 +47404,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.71.2" : "unknown";
+  const v = true ? "2.73.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.71.2",
+  "version": "2.73.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",