codeam-cli 2.73.9 → 2.74.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.73.10] — 2026-09-03
+
+### Fixed
+
+- **cli:** Re-resolve the integrations manifest from the backend at session start (#697)
+
+## [2.73.9] — 2026-09-03
+
+### Tests
+
+- **cli:** Move the MCP licence audit to apps/cli — it broke the shared publish (#695)
+
 ## [2.73.8] — 2026-09-03
 
 ### Fixed

package/dist/index.js

@@ -8136,7 +8136,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.73.9" : "0.0.0-dev",
+    cliVersion: true ? "2.74.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8378,7 +8378,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.73.9",
+  version: "2.74.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9971,7 +9971,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.73.9" ? { ideVersion: "2.73.9" } : {}
+      ..."2.74.0" ? { ideVersion: "2.74.0" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22037,11 +22037,35 @@ function readHouseProxyChildEnv() {
     return {};
   }
 }
+var HOUSE_MODEL_CONTEXT_TOKENS = "512000";
 function buildHouseProxyChildEnv(cfg) {
   const env = {
     ANTHROPIC_BASE_URL: cfg.baseUrl,
     ANTHROPIC_AUTH_TOKEN: cfg.token,
-    CLAUDE_CODE_AUTO_COMPACT_WINDOW: "512000",
+    // ⚠️ MAX_CONTEXT_TOKENS, not (only) AUTO_COMPACT_WINDOW — and this is
+    // HOUSE-AGENT ONLY: it lives in this builder precisely so a user's own
+    // Claude Code (a real Anthropic model claude knows) is never touched.
+    //
+    // claude does not know `MiniMax-M3`, so it falls back to its
+    // unknown-model default (200k). `CLAUDE_CODE_AUTO_COMPACT_WINDOW` is then
+    // applied as `Math.min(assumedWindow, env)` — it can only SHRINK the
+    // window, never grow it — so the 512000 we used to set here was inert:
+    // claude kept believing 200k. Meanwhile a session with a dozen linked
+    // integrations carries ~175k tokens of MCP tool schemas on EVERY turn
+    // (measured: 475 tools ≈ 698 KB on a real box), so the context started
+    // ~88% full and a 28-character prompt triggered a compaction, then the
+    // next small tool result triggered another: "Autocompact is thrashing:
+    // the context refilled to the limit within 3 turns", 13 compactions in
+    // one session (rafaelph90.br@gmail.com, 2026-09-03).
+    //
+    // claude's own unknown-model notice names the fix: "set
+    // CLAUDE_CODE_MAX_CONTEXT_TOKENS to its real window" — that variable is
+    // what `wL()` returns for an unrecognised model. MiniMax-M3 is a 1M-context
+    // model with a guaranteed minimum of 512K, so 512000 here is the
+    // conservative truth, not a wish. AUTO_COMPACT_WINDOW stays as the
+    // compaction threshold beneath it.
+    CLAUDE_CODE_MAX_CONTEXT_TOKENS: HOUSE_MODEL_CONTEXT_TOKENS,
+    CLAUDE_CODE_AUTO_COMPACT_WINDOW: HOUSE_MODEL_CONTEXT_TOKENS,
     API_TIMEOUT_MS: "3000000"
   };
   if (cfg.openRouter === true) {
@@ -22066,6 +22090,7 @@ var HOUSE_PROXY_ENV_KEYS = [
   "ANTHROPIC_DEFAULT_OPUS_MODEL",
   "ANTHROPIC_DEFAULT_HAIKU_MODEL",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
+  "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
   "API_TIMEOUT_MS",
   "CLAUDE_CONFIG_DIR"
 ];
@@ -22247,7 +22272,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.73.9" : null;
+  const current2 = true ? "2.74.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22264,7 +22289,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.73.9" : null;
+  const current2 = true ? "2.74.0" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22287,7 +22312,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.73.9" : null;
+  return true ? "2.74.0" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -23464,20 +23489,7 @@ var HostAgentSupervisor = class {
       if (payload.houseProxy) {
         const { baseUrl, token, agentKind, openRouter } = payload.houseProxy;
         childEnv = {
-          ANTHROPIC_BASE_URL: baseUrl,
-          ANTHROPIC_AUTH_TOKEN: token,
-          // House pins MiniMax; OpenRouter routes the real Claude model names the
-          // agent sends, so it sets NO model overrides — but it DOES need
-          // ANTHROPIC_API_KEY empty so a stale key can't override the Bearer auth
-          // token (OpenRouter's Claude Code setup requires ANTHROPIC_API_KEY="").
-          ...openRouter ? { ANTHROPIC_API_KEY: "" } : {
-            ANTHROPIC_MODEL: "MiniMax-M3",
-            ANTHROPIC_DEFAULT_SONNET_MODEL: "MiniMax-M3",
-            ANTHROPIC_DEFAULT_OPUS_MODEL: "MiniMax-M3",
-            ANTHROPIC_DEFAULT_HAIKU_MODEL: "MiniMax-M3"
-          },
-          CLAUDE_CODE_AUTO_COMPACT_WINDOW: "512000",
-          API_TIMEOUT_MS: "3000000",
+          ...buildHouseProxyChildEnv({ baseUrl, token, openRouter: openRouter === true }),
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
         const houseConfigDir = path52.join(
@@ -39580,6 +39592,172 @@ var packStatusH = async (ctx) => {
   await ctx.relay.sendResult(ctx.cmd.id, "completed", { state });
 };
 
+// src/integrations/mcp-router.ts
+var MCP_ROUTER_SERVER_NAME = "codeam";
+var CALL_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 12e4;
+})();
+var CHILD_START_TIMEOUT_MS = 9e4;
+function qualifiedName(integration, tool) {
+  return `${integration}/${tool}`;
+}
+function splitQualifiedName(q2) {
+  const i = q2.indexOf("/");
+  if (i <= 0 || i === q2.length - 1) return null;
+  return { integration: q2.slice(0, i), tool: q2.slice(i + 1) };
+}
+function searchTools(tools, query, integration) {
+  const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+  return tools.filter((t2) => !integration || t2.integration === integration).filter((t2) => {
+    if (words.length === 0) return true;
+    const hay = `${t2.integration} ${t2.name} ${t2.description}`.toLowerCase();
+    return words.every((w3) => hay.includes(w3));
+  }).sort((a, b) => {
+    const an = words.some((w3) => a.name.toLowerCase().includes(w3)) ? 0 : 1;
+    const bn = words.some((w3) => b.name.toLowerCase().includes(w3)) ? 0 : 1;
+    return an - bn || a.integration.localeCompare(b.integration) || a.name.localeCompare(b.name);
+  });
+}
+function routerToolDefinitions() {
+  return [
+    {
+      name: "list_integrations",
+      description: "List the integrations attached to this session (Jira, Linear, ClickUp, Postman, \u2026) with how many tools each exposes and whether it is available. Call this first when the user asks what you can do with an external service.",
+      inputSchema: { type: "object", properties: {}, additionalProperties: false }
+    },
+    {
+      name: "search_tools",
+      description: 'Search the tools of the attached integrations by keywords (e.g. "create task", "list boards", "send email"). Returns each match as `<integration>/<tool>` with a one-line description. Use `describe_tool` for the full argument schema, then `call_tool` to run it.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: { type: "string", description: "Keywords to match against tool names and descriptions." },
+          integration: { type: "string", description: 'Optional: restrict to one integration id, e.g. "clickup".' },
+          limit: { type: "integer", minimum: 1, maximum: 50, default: 20 }
+        },
+        required: ["query"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "describe_tool",
+      description: "Return the full JSON input schema of one tool, given its `<integration>/<tool>` name from `search_tools`.",
+      inputSchema: {
+        type: "object",
+        properties: { tool: { type: "string", description: '`<integration>/<tool>`, e.g. "clickup/create_task".' } },
+        required: ["tool"],
+        additionalProperties: false
+      }
+    },
+    {
+      name: "call_tool",
+      description: "Invoke one integration tool by its `<integration>/<tool>` name with the arguments its schema expects. The result is returned verbatim from the integration.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          tool: { type: "string", description: "`<integration>/<tool>`." },
+          arguments: { type: "object", description: "Arguments matching the schema from `describe_tool`.", additionalProperties: true }
+        },
+        required: ["tool"],
+        additionalProperties: false
+      }
+    }
+  ];
+}
+async function startChild(id, env, sdk) {
+  const state = { id, client: null, tools: [], error: null };
+  const timer = new Promise((_2, rej) => {
+    const t2 = setTimeout(
+      () => rej(new Error(`timed out after ${CHILD_START_TIMEOUT_MS / 1e3}s starting`)),
+      CHILD_START_TIMEOUT_MS
+    );
+    t2.unref?.();
+  });
+  try {
+    const transport = new sdk.StdioClientTransport({
+      command: process.execPath,
+      args: [process.argv[1], "mcp-run", id],
+      env: Object.fromEntries(
+        Object.entries(env).filter((e) => typeof e[1] === "string")
+      ),
+      stderr: "inherit"
+    });
+    const client3 = new sdk.Client({ name: "codeam-router", version: "1.0.0" }, { capabilities: {} });
+    await Promise.race([client3.connect(transport), timer]);
+    const listed = await Promise.race([client3.listTools(), timer]);
+    state.client = client3;
+    state.tools = listed.tools.map((t2) => ({
+      integration: id,
+      name: t2.name,
+      description: t2.description ?? "",
+      inputSchema: t2.inputSchema
+    }));
+    log.info("mcpRouter", `${id}: ${state.tools.length} tool(s) ready`);
+  } catch (err) {
+    state.error = err instanceof Error ? err.message : String(err);
+    log.warn("mcpRouter", `${id}: unavailable \u2014 ${state.error}`);
+  }
+  return state;
+}
+async function mcpRouter() {
+  const manifest = readIntegrationsManifest();
+  const ids = (manifest?.integrations ?? []).filter((e) => e.delivery?.mcp).map((e) => e.id);
+  const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { ListToolsRequestSchema, CallToolRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
+  const { Client: ClientCtor } = await import("@modelcontextprotocol/sdk/client/index.js");
+  const { StdioClientTransport: TransportCtor } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+  const sdk = { Client: ClientCtor, StdioClientTransport: TransportCtor };
+  const children = await Promise.all(ids.map((id) => startChild(id, process.env, sdk)));
+  const byId = new Map(children.map((c2) => [c2.id, c2]));
+  const allTools = children.flatMap((c2) => c2.tools);
+  log.info("mcpRouter", `fronting ${children.filter((c2) => c2.client).length}/${ids.length} integration server(s), ${allTools.length} tools behind 4`);
+  const server = new Server({ name: MCP_ROUTER_SERVER_NAME, version: "1.0.0" }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: routerToolDefinitions() }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const name = req.params.name;
+    const args2 = req.params.arguments ?? {};
+    const text = (v, isError2 = false) => ({ content: [{ type: "text", text: typeof v === "string" ? v : JSON.stringify(v, null, 2) }], isError: isError2 });
+    if (name === "list_integrations") {
+      return text(children.map((c2) => ({ integration: c2.id, available: c2.client !== null, tools: c2.tools.length, ...c2.error ? { error: c2.error } : {} })));
+    }
+    if (name === "search_tools") {
+      const q2 = typeof args2.query === "string" ? args2.query : "";
+      const integration = typeof args2.integration === "string" ? args2.integration : void 0;
+      const limit = typeof args2.limit === "number" ? Math.max(1, Math.min(50, args2.limit)) : 20;
+      const hits = searchTools(allTools, q2, integration).slice(0, limit);
+      return text(hits.map((t2) => ({ tool: qualifiedName(t2.integration, t2.name), description: t2.description })));
+    }
+    if (name === "describe_tool" || name === "call_tool") {
+      const q2 = typeof args2.tool === "string" ? args2.tool : "";
+      const parts = splitQualifiedName(q2);
+      if (!parts) return text(`Expected "<integration>/<tool>", got "${q2}". Use search_tools to find the name.`, true);
+      const child = byId.get(parts.integration);
+      if (!child) return text(`No integration "${parts.integration}" is attached to this session. Use list_integrations.`, true);
+      if (!child.client) return text(`Integration "${parts.integration}" is unavailable: ${child.error ?? "failed to start"}.`, true);
+      const tool = child.tools.find((t2) => t2.name === parts.tool);
+      if (!tool) return text(`No tool "${parts.tool}" in "${parts.integration}". Use search_tools.`, true);
+      if (name === "describe_tool") return text({ tool: q2, description: tool.description, inputSchema: tool.inputSchema });
+      const timer = new Promise((_2, rej) => setTimeout(() => rej(new Error(`"${q2}" did not answer within ${CALL_TIMEOUT_MS / 1e3}s`)), CALL_TIMEOUT_MS).unref?.());
+      try {
+        const res = await Promise.race([
+          child.client.callTool({ name: parts.tool, arguments: args2.arguments ?? {} }),
+          timer
+        ]);
+        return { content: res.content ?? [], isError: res.isError === true };
+      } catch (err) {
+        return text(`${q2} failed: ${err instanceof Error ? err.message : String(err)}`, true);
+      }
+    }
+    return text(`Unknown tool "${name}".`, true);
+  });
+  await server.connect(new StdioServerTransport());
+  process.stdin.on("close", () => {
+    for (const c2 of children) void c2.client?.close().catch(() => void 0);
+  });
+}
+
 // src/integrations/provision.ts
 function buildMcpServersForStart(ctx) {
   const manifest = readIntegrationsManifest();
@@ -39608,6 +39786,30 @@ function buildMcpServersForStart(ctx) {
       env
     });
   }
+  if (manifest.toolRouter === true && servers.length > 0) {
+    const routed = servers.map((s) => s.name);
+    log.info(
+      "integrations",
+      `tool router ON \u2014 fronting ${routed.length} MCP server(s) behind one: ${routed.join(", ")}`
+    );
+    return [
+      {
+        name: MCP_ROUTER_SERVER_NAME,
+        command: process.execPath,
+        args: [process.argv[1], "mcp-router"],
+        // The router re-spawns each shim with THIS env: the same session /
+        // plugin id / token / secret the shims got when injected directly.
+        // No per-integration id — each child receives its own via
+        // `mcp-run <id>` argv, which the shim prefers.
+        env: [
+          { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
+          { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
+          { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
+          ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+        ]
+      }
+    ];
+  }
   if (servers.length) {
     log.info(
       "integrations",
@@ -43268,6 +43470,54 @@ ${BEADS_HINT}
   }
 }
 
+// src/integrations/refresh-manifest.ts
+function fingerprint(m) {
+  const norm = [...m.integrations].map((e) => ({ id: e.id, delivery: e.delivery })).sort((a, b) => a.id.localeCompare(b.id));
+  return JSON.stringify(norm);
+}
+async function refreshIntegrationsManifest(ctx, fetchImpl = fetch, timeoutMs = 8e3) {
+  const url2 = `${resolveApiBaseUrl()}/api/plugin/integrations/manifest`;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(url2, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Plugin-Auth-Token": ctx.pluginAuthToken },
+      body: JSON.stringify({
+        sessionId: ctx.sessionId,
+        pluginId: ctx.pluginId,
+        ...ctx.agent ? { agent: ctx.agent } : {}
+      }),
+      signal: ac.signal
+    });
+    if (!resp.ok) {
+      return { status: "skipped", reason: `HTTP ${resp.status}` };
+    }
+    const json = await resp.json();
+    const fresh = json.data;
+    if (!json.success || !fresh || !Array.isArray(fresh.integrations)) {
+      return { status: "skipped", reason: "malformed response" };
+    }
+    const onDisk = readIntegrationsManifest();
+    if (onDisk && fingerprint(onDisk) === fingerprint(fresh)) return { status: "unchanged" };
+    persistIntegrationsManifest(fresh);
+    const result = {
+      status: "rewritten",
+      before: onDisk?.integrations.length ?? 0,
+      after: fresh.integrations.length
+    };
+    log.info(
+      "integrations",
+      `manifest refreshed from backend at start (${result.before} \u2192 ${result.after} entr${result.after === 1 ? "y" : "ies"}) \u2014 the on-disk copy was stale`
+    );
+    return result;
+  } catch (err) {
+    return { status: "skipped", reason: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/skills/provision.ts
 var import_node_os13 = __toESM(require("os"));
 function provisionSkillsForStart(home = import_node_os13.default.homedir()) {
@@ -44328,6 +44578,17 @@ async function start(requestedAgent, presetSession) {
     beads = started;
     return started;
   });
+  if (session.pluginAuthToken) {
+    await refreshIntegrationsManifest({
+      sessionId: session.id,
+      pluginId,
+      pluginAuthToken: session.pluginAuthToken,
+      // The house agent runs the `claude` runtime, so `session.agent` cannot
+      // tell it apart; the managed-proxy env can (`isHouseProxyEnv`). The
+      // backend turns the tool router on for the house agent ONLY.
+      agent: isHouseProxyEnv(process.env) ? HOUSE_AGENT_ID : session.agent
+    });
+  }
   const mcpServers = mergeWithLocalMcpServers(
     buildMcpServersForStart({
       sessionId: session.id,
@@ -47176,7 +47437,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.73.9" : "0.0.0-dev";
+  const cliVersion = true ? "2.74.0" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -47647,7 +47908,7 @@ async function mcpWarm(argv = []) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.73.9" : "unknown";
+  const v = true ? "2.74.0" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -47851,6 +48112,9 @@ async function main() {
   if (command === "mcp-warm") {
     return mcpWarm(args);
   }
+  if (command === "mcp-router") {
+    return mcpRouter();
+  }
   if (command === "deploy") {
     if (args[0] === "ls" || args[0] === "list") return deployList();
     if (args[0] === "stop" || args[0] === "remove") return deployStop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.73.9",
+  "version": "2.74.0",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",