codeam-cli 2.74.1 → 2.74.3

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.74.2] — 2026-09-04
+
+### Fixed
+
+- **cli:** A "no dev server" detection is a verdict, not a malformed answer (#704)
+
+## [2.74.1] — 2026-09-04
+
+### Fixed
+
+- **cli:** Npx integration servers start with npm audit off; bound mcp-warm; 25-min fleet-box step (#701)
+
 ## [2.74.0] — 2026-09-03
 
 ### Added

package/dist/index.js

@@ -8136,7 +8136,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.74.1" : "0.0.0-dev",
+    cliVersion: true ? "2.74.3" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8378,7 +8378,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.74.1",
+  version: "2.74.3",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -9971,7 +9971,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.74.1" ? { ideVersion: "2.74.1" } : {}
+      ..."2.74.3" ? { ideVersion: "2.74.3" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -22272,7 +22272,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.74.1" : null;
+  const current2 = true ? "2.74.3" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22289,7 +22289,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.74.1" : null;
+  const current2 = true ? "2.74.3" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -22312,7 +22312,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.74.1" : null;
+  return true ? "2.74.3" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -24956,11 +24956,23 @@ function safeParseDetection(raw) {
   if (!raw) return null;
   const parsed = parseDetectionObject(raw);
   if (!parsed) return null;
+  if (isUnsupportedAnswer(parsed)) {
+    return {
+      framework: "unsupported",
+      notes: typeof parsed.notes === "string" ? parsed.notes : void 0
+    };
+  }
   for (const field of REQUIRED_FIELDS2) {
     if (!(field in parsed)) return null;
   }
   return parsed;
 }
+function isUnsupportedAnswer(parsed) {
+  return parsed.framework === "unsupported";
+}
+function isUnsupportedDetection(d3) {
+  return d3.framework === "unsupported";
+}
 function parseDetectionObject(raw) {
   let parsed = tryParseObject(raw.trim());
   if (!parsed) {
@@ -25044,6 +25056,7 @@ function describeDetectionFailure(raw) {
       rawExcerpt
     };
   }
+  if (isUnsupportedAnswer(parsed)) return null;
   const missing = REQUIRED_FIELDS2.filter((f) => !(f in parsed)).map(String);
   if (missing.length > 0) {
     return {
@@ -25507,6 +25520,25 @@ async function ensureYarnInstalled(deps) {
   if (!res.ok) return res;
   return await deps.hasYarn() ? { ok: true, code: 0 } : { ok: false, code: res.code };
 }
+function isExpoTunnelCommand(command2, args2) {
+  const flat = [import_path8.default.basename(command2), ...args2];
+  return flat.includes("expo") && flat.includes("--tunnel");
+}
+var EXPO_NGROK_SPEC = "@expo/ngrok@^4.1.0";
+async function ensureExpoTunnelDeps(deps) {
+  if (await deps.hasNgrok()) return { ok: true, code: 0, installed: false };
+  const res = await deps.installNgrok();
+  if (!res.ok) return { ...res, installed: false };
+  return await deps.hasNgrok() ? { ok: true, code: 0, installed: true } : { ok: false, code: res.code, installed: false };
+}
+function ngrokResolvesFrom(cwd) {
+  try {
+    require.resolve("@expo/ngrok/package.json", { paths: [cwd] });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isJsInstallCommand(cmd, args2) {
   const known = ["npm", "pnpm", "yarn", "bun"];
   if (!known.includes(cmd)) return false;
@@ -26383,10 +26415,7 @@ async function runPreviewStart(args2) {
   };
   const existing = activePreviews.get(sessionId);
   if (existing && existing.devServer?.exitCode !== 0 && existing.devServer?.exitCode == null) {
-    log.info(
-      "preview",
-      `reusing running preview for session=${sessionId} url=${existing.url}`
-    );
+    log.info("preview", `reusing running preview for session=${sessionId} url=${existing.url}`);
     ctx.emitProgress("READY_DETECTED", "reusing running preview");
     emit2(USER_EVENTS.PREVIEW_READY, {
       url: existing.url,
@@ -26435,6 +26464,7 @@ async function provisionDeps(ctx) {
       pluginAuthToken: ctx.projectEnvAuth.pluginAuthToken
     });
   }
+  const needsExpoNgrok = isExpoTunnelCommand(detection.command, detection.args ?? []);
   const missingDeps = detectMissingNodeDeps(cwd);
   let preflightRan = false;
   if (missingDeps) {
@@ -26488,6 +26518,32 @@ async function provisionDeps(ctx) {
     }
     preflightRan = true;
   }
+  if (needsExpoNgrok) {
+    const ensured = await ensureExpoTunnelDeps({
+      hasNgrok: async () => ngrokResolvesFrom(cwd),
+      installNgrok: async () => {
+        emitProgress(
+          "SETUP_RUN",
+          `npm install --no-save ${EXPO_NGROK_SPEC} (Expo tunnel needs ngrok; not found)`
+        );
+        const r = await runSetupCommand(
+          "npm",
+          ["install", "--no-save", "--no-audit", "--no-fund", EXPO_NGROK_SPEC],
+          cwd,
+          detection.env,
+          { timeoutMs: INSTALL_TIMEOUT_MS2 }
+        );
+        return { ok: r.status === "ok", code: r.code };
+      }
+    });
+    if (!ensured.ok) {
+      emit2(USER_EVENTS.PREVIEW_ERROR, {
+        stage: "spawn",
+        message: `Expo's tunnel needs @expo/ngrok and installing it automatically failed (npm install --no-save ${EXPO_NGROK_SPEC}, exit ${ensured.code}). Install it in the project and try the preview again.`
+      });
+      return false;
+    }
+  }
   const normalizedSetup = (detection.setup_commands ?? []).map((entry) => {
     if (typeof entry === "string") {
       const parts = entry.trim().split(/\s+/).filter(Boolean);
@@ -26503,13 +26559,9 @@ async function provisionDeps(ctx) {
   for (const setup of agentSetupCommands) {
     emitProgress("SETUP_RUN", `${setup.cmd} ${setup.args.join(" ")}`);
     const timeoutMs = isJsInstallCommand(setup.cmd, setup.args) ? INSTALL_TIMEOUT_MS2 : SETUP_TIMEOUT_MS;
-    const result = await runSetupCommand(
-      setup.cmd,
-      setup.args,
-      cwd,
-      detection.env,
-      { timeoutMs }
-    );
+    const result = await runSetupCommand(setup.cmd, setup.args, cwd, detection.env, {
+      timeoutMs
+    });
     if (result.status === "timeout") {
       emit2(USER_EVENTS.PREVIEW_ERROR, {
         stage: "ready_timeout",
@@ -26577,10 +26629,7 @@ async function startDevServer(ctx) {
     } else {
       const verdict = await canAdoptPort(detection.port);
       if (verdict.adopt) {
-        log.info(
-          "preview",
-          `adopting the dev server already serving on port ${detection.port}`
-        );
+        log.info("preview", `adopting the dev server already serving on port ${detection.port}`);
         emitProgress("READY_DETECTED", `adopted the server already on port ${detection.port}`);
         return { devServer: null, expoUrlRef: { current: null } };
       }
@@ -26731,11 +26780,9 @@ async function establishTunnel(ctx, dev) {
         `cloudflared quick tunnel (retry ${attempt}/${MAX_TUNNEL_ATTEMPTS})`
       );
     }
-    const candidate = (0, import_child_process23.spawn)(
-      bin,
-      ["tunnel", "--url", `http://localhost:${tunnelPort}`],
-      { stdio: ["ignore", "pipe", "pipe"] }
-    );
+    const candidate = (0, import_child_process23.spawn)(bin, ["tunnel", "--url", `http://localhost:${tunnelPort}`], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
     const outcome = await awaitTunnelRegistered(
       candidate,
       null,
@@ -29462,7 +29509,7 @@ ${failure?.rawExcerpt ?? ""}`
       });
       return;
     }
-    if (detection.framework === "unsupported") {
+    if (isUnsupportedDetection(detection)) {
       log.info("preview", "detect: framework=unsupported");
       emitPreviewEvent({
         sessionId: ctx.sessionId,
@@ -29530,7 +29577,7 @@ function prewarmPreviewDetection(runtime) {
         log.info("preview", `prewarm: detection failed reason=${failure?.reason ?? "unknown"}`);
         return;
       }
-      if (detection.framework === "unsupported") return;
+      if (isUnsupportedDetection(detection)) return;
       await writePreviewConfig(cwd, detection);
       log.info(
         "preview",
@@ -47437,7 +47484,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.74.1" : "0.0.0-dev";
+  const cliVersion = true ? "2.74.3" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -47884,7 +47931,12 @@ function runCapturing(command2, args2, timeoutMs) {
   return new Promise((resolve11) => {
     const child = (0, import_node_child_process35.spawn)(command2, args2, {
       env: { ...process.env, ...LAUNCHER_ENV },
-      stdio: ["ignore", "ignore", "pipe"]
+      stdio: ["ignore", "ignore", "pipe"],
+      // `npx`/`uv` are `.cmd` shims on Windows; Node ≥ 20.12 refuses to spawn a
+      // `.cmd` without a shell and a bare `npx` is ENOENT — the same reason the
+      // licence audit test needed it. The launchers here are ours, never user
+      // input, so the shell is safe.
+      shell: process.platform === "win32"
     });
     let stderr = "";
     child.stderr?.setEncoding("utf8");
@@ -47956,7 +48008,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.74.1" : "unknown";
+  const v = true ? "2.74.3" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.74.1",
+  "version": "2.74.3",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",