codeam-cli 2.73.4 → 2.73.6

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.73.5] — 2026-09-03
+
+### Fixed
+
+- **shared:** Postman's MCP server never installed — npm refuses it (#688)
+
+## [2.73.4] — 2026-09-03
+
+### Fixed
+
+- **cli:** MCP startup budget that fits our shim + stop the baton mirror replaying history as live turns (#686)
+
 ## [2.73.3] — 2026-09-02
 
 ### Fixed

package/dist/index.js

@@ -1872,8 +1872,27 @@ var INTEGRATION_REGISTRY = {
       mcp: {
         // Postman's OFFICIAL stdio MCP server (Node). BYO key via POSTMAN_API_KEY
         // (env only). Version PINNED; bump only after re-verifying headless.
+        //
+        // ⚠️ `--ignore-scripts` IS LOAD-BEARING — without it this integration
+        // does not work at all, on any box, and never did. The package declares
+        // a `preinstall` guard of `npx only-allow pnpm`, so npm REFUSES to
+        // install it:
+        //   info run @postman/postman-mcp-server@2.11.2 preinstall npx only-allow pnpm
+        //   info run @postman/postman-mcp-server@2.11.2 preinstall { code: 1 }
+        // and `npx -y @postman/postman-mcp-server@2.11.2` exits 1 before the
+        // server is ever reached — which the agent reports as
+        // `Server "postman" is not connected`, indistinguishable from a slow
+        // start (found while pre-warming the box image, 2026-09-03; the user's
+        // report was "Postman: idem", alongside clickup/trello, whose cause was
+        // entirely different).
+        //
+        // Skipping scripts is safe here: the guard is the only preinstall step
+        // and the published tarball already ships the built
+        // `dist/src/index.js` its `bin` points at. Verified on node:22-slim:
+        // `npx -y <pkg>` → exit 1; `npx -y --ignore-scripts <pkg>` with a key in
+        // the env → starts; and warmed once, the bin resolves offline.
         command: "npx",
-        args: ["-y", "@postman/postman-mcp-server@2.11.2"],
+        args: ["-y", "--ignore-scripts", "@postman/postman-mcp-server@2.11.2"],
         envMapping: {
           POSTMAN_API_KEY: "accessToken"
         }
@@ -8097,7 +8116,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.73.4" : "0.0.0-dev",
+    cliVersion: true ? "2.73.6" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8339,7 +8358,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.73.4",
+  version: "2.73.6",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9932,7 +9951,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.73.4" ? { ideVersion: "2.73.4" } : {}
+      ..."2.73.6" ? { ideVersion: "2.73.6" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22208,7 +22227,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.73.4" : null;
+  const current2 = true ? "2.73.6" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22225,7 +22244,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.73.4" : null;
+  const current2 = true ? "2.73.6" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22248,7 +22267,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.73.4" : null;
+  return true ? "2.73.6" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -35865,9 +35884,24 @@ var AcpClient = class {
         ...this.opts.extraEnv ?? {},
         PATH: augmentedPath
       },
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      // ⚠️ Own process group, so `stop()` can reap the WHOLE tree. The adapter
+      // is only the top of it: it spawns the real `claude`, which spawns one
+      // `codeam mcp-run` shim per integration, each of which spawns the
+      // vendor's MCP server. Killing the adapter alone orphaned all of that —
+      // see `stop()` for the incident. Windows has no process groups; there
+      // the tree is reaped with `taskkill /T` instead.
+      detached: process.platform !== "win32"
     });
     this.child = child;
+    const pid = child.pid;
+    if (pid && process.platform !== "win32") {
+      const reapOnExit = () => {
+        if (this.child === child) killQuiet(-pid, "SIGKILL");
+      };
+      process.once("exit", reapOnExit);
+      child.once("exit", () => process.removeListener("exit", reapOnExit));
+    }
     child.stderr?.setEncoding("utf8");
     child.stderr?.on("data", (chunk) => {
       for (const line of chunk.split(/\r?\n/)) {
@@ -36516,10 +36550,18 @@ var AcpClient = class {
     this.connection = null;
     this.sessionId = null;
     try {
-      child.kill("SIGTERM");
+      const pid = child.pid;
+      if (process.platform === "win32") {
+        if (pid) (0, import_node_child_process29.spawnSync)("taskkill", ["/F", "/T", "/PID", String(pid)], { stdio: "ignore" });
+      } else if (pid) {
+        killQuiet(-pid, "SIGTERM");
+      } else {
+        child.kill("SIGTERM");
+      }
       const grace = new Promise((resolve11) => {
         const t2 = setTimeout(() => {
-          killQuiet(child, "SIGKILL");
+          if (process.platform !== "win32" && pid) killQuiet(-pid, "SIGKILL");
+          else killQuiet(child, "SIGKILL");
           resolve11();
         }, 2e3);
         child.once("exit", () => {
@@ -47099,7 +47141,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.73.4" : "0.0.0-dev";
+  const cliVersion = true ? "2.73.6" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -47494,6 +47536,11 @@ function specOf(delivery) {
   const spec = (delivery.args ?? []).find((a) => !a.startsWith("-"));
   return spec ?? null;
 }
+function launcherFlagsOf(delivery) {
+  const args2 = delivery.args ?? [];
+  const specIndex = args2.findIndex((a) => !a.startsWith("-"));
+  return specIndex === -1 ? [...args2] : args2.slice(0, specIndex);
+}
 function warmTargets() {
   const bySpec = /* @__PURE__ */ new Map();
   for (const integration of getEnabledIntegrations()) {
@@ -47502,14 +47549,20 @@ function warmTargets() {
     const spec = specOf(delivery);
     if (!spec) continue;
     if (!bySpec.has(spec)) {
-      bySpec.set(spec, { id: integration.id, launcher: delivery.command, spec });
+      bySpec.set(spec, {
+        id: integration.id,
+        launcher: delivery.command,
+        flags: launcherFlagsOf(delivery),
+        spec
+      });
     }
   }
   return [...bySpec.values()];
 }
 function warmCommand(target) {
   if (target.launcher === "npx") {
-    return { command: "npx", args: ["-y", "--package", target.spec, "-c", "true"] };
+    const extra = target.flags.filter((f) => f !== "-y");
+    return { command: "npx", args: ["-y", ...extra, "--package", target.spec, "-c", "true"] };
   }
   if (target.launcher === "uvx") {
     return { command: "uv", args: ["tool", "install", target.spec] };
@@ -47540,7 +47593,9 @@ async function mcpWarm(argv = []) {
       result.warmed.push(target.spec);
       console.log(`  OK   ${target.spec} (${secs}s)`);
     } else {
-      const reason = run.error?.message ?? (run.stderr ?? "").trim().split("\n").slice(-1)[0] ?? `exit ${String(run.status)}`;
+      const noise = /^npm (warn|notice)\b/;
+      const lines = (run.stderr ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !noise.test(l));
+      const reason = run.error?.message ?? lines[lines.length - 1] ?? `exit ${String(run.status)} (no stderr)`;
       result.failed.push({ spec: target.spec, reason });
       console.log(`  MISS ${target.spec} (${secs}s) \u2014 fetched at runtime instead: ${reason}`);
     }
@@ -47557,7 +47612,7 @@ async function mcpWarm(argv = []) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.73.4" : "unknown";
+  const v = true ? "2.73.6" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.73.4",
+  "version": "2.73.6",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",