codeam-cli 2.72.0 → 2.73.0

package/dist/index.js

@@ -1750,7 +1750,12 @@ var INTEGRATION_REGISTRY = {
           label: "Token",
           placeholder: "Your Trello token",
           secret: true,
-          help: 'On the API-key page, click the "Token" link to authorize + generate a token (scope read,write, never-expiring).'
+          // WARNING - the Power-Up API-key page also shows a "Secret", and it is
+          // NOT the token: both are 64 hex characters and look identical, so it
+          // is the natural thing to copy. Pasting the Secret fails with Trello's
+          // misleading `invalid key`, which then sends the user to regenerate a
+          // perfectly good API key (owner report, 2026-09-01). Say so here.
+          help: 'On that same API-key page, click the "Token" link to authorize and generate a token (read,write, never-expiring). NOT the "Secret" on that page - it looks identical but will not work.'
         }
       ]
     },
@@ -8092,7 +8097,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.72.0" : "0.0.0-dev",
+    cliVersion: true ? "2.73.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8334,7 +8339,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.72.0",
+  version: "2.73.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9927,7 +9932,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.72.0" ? { ideVersion: "2.72.0" } : {}
+      ..."2.73.0" ? { ideVersion: "2.73.0" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22193,7 +22198,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.72.0" : null;
+  const current2 = true ? "2.73.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22210,7 +22215,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.72.0" : null;
+  const current2 = true ? "2.73.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22233,7 +22238,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.72.0" : null;
+  return true ? "2.73.0" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -22526,6 +22531,14 @@ function isFleetLimits(v) {
 function isFleetCreateBoxPayload(p2) {
   return typeof p2.boxId === "string" && isFleetContainerName(p2.containerName) && typeof p2.enrollToken === "string" && p2.enrollToken.length > 0 && typeof p2.apiOrigin === "string" && p2.apiOrigin.length > 0 && isFleetLimits(p2.limits);
 }
+function isFleetMigrateBoxImagePayload(p2) {
+  return typeof p2.boxId === "string" && isFleetContainerName(p2.containerName) && typeof p2.apiOrigin === "string" && p2.apiOrigin.length > 0 && isFleetLimits(p2.limits) && // ⚠️ REJECT a token outright rather than ignoring it. A migrate that
+  // carried one would bake a 15-minute credential into a container that may
+  // not start for days — a terminal 4xx at boot, i.e. a box that never comes
+  // back. If a future backend starts sending one, this must fail loudly here
+  // rather than silently produce that box.
+  p2.enrollToken === void 0;
+}
 function isFleetBoxRefPayload(p2) {
   if (typeof p2.boxId !== "string") return false;
   if (!isFleetContainerName(p2.containerName)) return false;
@@ -22557,6 +22570,9 @@ function isMissingVolumeError(stderr) {
 function resolveFleetBoxImage() {
   return process.env.CODEAM_FLEET_BOX_IMAGE || "ghcr.io/edgar-durand/codeam-box:latest";
 }
+function buildFleetBoxMigrateArgs(p2) {
+  return buildFleetBoxRunArgs(p2).map((a) => a === "run" ? "create" : a).filter((a) => a !== "--pull=always" && a !== "-d");
+}
 function buildFleetBoxRunArgs(p2) {
   const userId = fleetUserIdFromContainerName(p2.containerName);
   const image = resolveFleetBoxImage();
@@ -22956,6 +22972,14 @@ var HostAgentSupervisor = class {
       await this.fleetCreateBox(cmd.payload);
       return;
     }
+    if (cmd.type === "fleet_migrate_box_image") {
+      if (!isFleetMigrateBoxImagePayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed fleet_migrate_box_image id=${cmd.id}`);
+        return;
+      }
+      await this.fleetMigrateBoxImage(cmd.payload);
+      return;
+    }
     if (cmd.type === "fleet_start_box") {
       if (!isFleetBoxRefPayload(cmd.payload)) {
         log.warn("host-agent", `ignoring malformed fleet_start_box id=${cmd.id}`);
@@ -23126,6 +23150,90 @@ var HostAgentSupervisor = class {
   }
   /** `fleet_start_box` — wake a sleeping box (`docker start`). Idempotent: a
    *  container the host already removed is treated as success. */
+  /**
+   * `fleet_migrate_box_image` — re-point a SLEEPING box at the current
+   * `:latest` without waking it, so the version it was pinned to becomes
+   * reclaimable by the (already automated) dangling-image prune.
+   *
+   * WHY THIS IS NEEDED AT ALL. Boxes are created with `--pull=always` on
+   * purpose, so each stays pinned to the image it was born on, and Docker
+   * refuses to delete an image any container references INCLUDING stopped
+   * ones — which is precisely what stops the prune from destroying a sleeping
+   * user's box. So every image release strands ~7.7 GB per lagging box until it
+   * wakes or is reaped on day 7 (fleet-1, 2026-09-02: 9 boxes across 4
+   * versions, ~31 GB held).
+   *
+   * ⚠️ THE HOST RE-CHECKS THAT THE BOX IS STOPPED, even though the backend only
+   * selects `status: 'SLEEPING'`. The DB's view can lag the host by a sweep —
+   * a box that woke seconds ago is still SLEEPING in the row — and re-creating
+   * a RUNNING container kills a live agent mid-turn. The authority on whether a
+   * container is running is the daemon, so we ask it here and refuse rather
+   * than trust the payload.
+   *
+   * ⚠️ `docker create`, and NO enroll token. `run` would start the container,
+   * so migrating the sleeping set in a batch would wake all of them (9 ×
+   * 1536 MB on a 16 GB host) only for the sleep sweep to re-sleep them 30
+   * minutes later. And a token would be a 15-minute credential baked into a
+   * container that may not start for days — a terminal 4xx at boot, i.e. a box
+   * that never comes back. The sealed identity is in the named volume, which
+   * `rm` WITHOUT `-v` preserves.
+   *
+   * Idempotent and best-effort: a box already on `:latest` is skipped, a
+   * missing container is success (a concurrent reap), and nothing here may
+   * throw into the relay — this is housekeeping.
+   */
+  async fleetMigrateBoxImage(payload) {
+    const { containerName } = payload;
+    const state = await this.docker.run([
+      "inspect",
+      "--format",
+      "{{.State.Running}}",
+      containerName
+    ]);
+    if (state.code !== 0) {
+      if (isMissingContainerError(state.stderr)) return;
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: inspect of ${containerName} failed (code=${state.code}) \u2014 skipping`
+      );
+      return;
+    }
+    if (state.stdout.trim() === "true") {
+      log.info(
+        "host-agent",
+        `fleet_migrate_box_image: ${containerName} is RUNNING \u2014 skipping (never touch a live box)`
+      );
+      return;
+    }
+    if (!await this.fleetBoxImageStale(containerName)) {
+      log.info("host-agent", `fleet_migrate_box_image: ${containerName} already current`);
+      return;
+    }
+    const rm = await this.docker.run(["rm", "-f", containerName], {
+      timeoutMs: DOCKER_RUN_TIMEOUT_MS
+    });
+    if (rm.code !== 0 && !isMissingContainerError(rm.stderr)) {
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: rm of ${containerName} failed (code=${rm.code}): ${rm.stderr.trim().slice(-200)} \u2014 NOT creating a replacement`
+      );
+      return;
+    }
+    const res = await this.docker.run(buildFleetBoxMigrateArgs(payload), {
+      timeoutMs: DOCKER_RUN_TIMEOUT_MS
+    });
+    if (res.code !== 0) {
+      log.warn(
+        "host-agent",
+        `fleet_migrate_box_image: create of ${containerName} failed (code=${res.code}): ${res.stderr.trim().slice(-200)}`
+      );
+      return;
+    }
+    log.info(
+      "host-agent",
+      `fleet_migrate_box_image: ${containerName} re-pointed at :latest (still stopped)`
+    );
+  }
   async fleetStartBox(payload) {
     const { containerName } = payload;
     if (fleetRefCanRecreate(payload) && await this.fleetBoxImageStale(containerName)) {
@@ -46905,7 +47013,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.72.0" : "0.0.0-dev";
+  const cliVersion = true ? "2.73.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -47296,7 +47404,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.72.0" : "unknown";
+  const v = true ? "2.73.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.72.0",
+  "version": "2.73.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",