codeam-cli 2.75.10 → 2.75.11

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.10] — 2026-09-23
+
+### Fixed
+
+- **cli:** Guardrails judge a write by its target; pack stage shows a mid-turn permission as awaiting
+
 ## [2.75.9] — 2026-09-23
 
 ### Added

package/dist/index.js

@@ -10509,7 +10509,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.10" : "0.0.0-dev",
+    cliVersion: true ? "2.75.11" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10751,7 +10751,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.10",
+  version: "2.75.11",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12081,7 +12081,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.10" ? { ideVersion: "2.75.10" } : {}
+      ..."2.75.11" ? { ideVersion: "2.75.11" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -35576,6 +35576,18 @@ function _get(url2, headers) {
 }
 
 // src/agents/acp/publisher.ts
+var STREAMING_CHUNK_SNAPSHOT_MAX_CHARS = 56 * 1024;
+var STREAMING_CHUNK_COALESCE_MIN_CHARS = 8 * 1024;
+var STREAMING_CHUNK_COALESCE_WINDOW_MS = 300;
+function boundStreamingChunkContent(content, max = STREAMING_CHUNK_SNAPSHOT_MAX_CHARS) {
+  if (content.length <= max) return { content, truncated: false };
+  const dropped = content.length - max;
+  return {
+    content: `${content.slice(0, max)}
+\u2026 [output truncated: ${dropped} more characters \u2014 the full text is in the conversation transcript]`,
+    truncated: true
+  };
+}
 var AcpPublisher = class {
   constructor(opts) {
     this.opts = opts;
@@ -35585,6 +35597,11 @@ var AcpPublisher = class {
   opts;
   apiBase;
   token;
+  /** chunkIds whose truncated snapshot already went out — nothing new to show
+   *  until the terminal frame. */
+  truncatedChunks = /* @__PURE__ */ new Set();
+  lastChunkPostAt = /* @__PURE__ */ new Map();
+  pendingChunkPosts = /* @__PURE__ */ new Map();
   /** Latched on an unrecoverable 401/403 — every surface stops posting
    *  (2026-06-28 incident: a dead-token publisher spammed 401 ×34 while
    *  the agent's replies silently never reached the phone). */
@@ -35613,7 +35630,10 @@ var AcpPublisher = class {
       const fresh = await this.opts.refreshAuthToken();
       if (fresh) {
         this.token = fresh;
-        log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+        log.info(
+          "acpPublisher",
+          `plugin-auth token refreshed after ${first.statusCode}; retrying POST`
+        );
         const second = await _transport4.post(url2, this.authHeaders(), payload);
         if (second.statusCode !== 401 && second.statusCode !== 403) return second;
         this.markPairingInvalid(second.statusCode);
@@ -35722,17 +35742,51 @@ var AcpPublisher = class {
    * richer SessionDetail surface.
    */
   async publishStreamingChunk(event) {
+    const { chunkId, isFinal } = event;
+    const pending = this.pendingChunkPosts.get(chunkId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      this.pendingChunkPosts.delete(chunkId);
+    }
+    const bounded = boundStreamingChunkContent(event.content);
+    if (bounded.truncated) {
+      if (!isFinal && this.truncatedChunks.has(chunkId)) return;
+      if (!this.truncatedChunks.has(chunkId)) {
+        log.warn(
+          "acpPublisher",
+          `streaming-chunk ${chunkId.slice(0, 12)} (${event.kind}) exceeds ${STREAMING_CHUNK_SNAPSHOT_MAX_CHARS} chars \u2014 sending a truncated snapshot once`
+        );
+      }
+      this.truncatedChunks.add(chunkId);
+    }
+    if (isFinal) {
+      this.truncatedChunks.delete(chunkId);
+      this.lastChunkPostAt.delete(chunkId);
+    } else if (!bounded.truncated && bounded.content.length >= STREAMING_CHUNK_COALESCE_MIN_CHARS) {
+      const last = this.lastChunkPostAt.get(chunkId) ?? 0;
+      const wait = STREAMING_CHUNK_COALESCE_WINDOW_MS - (Date.now() - last);
+      if (wait > 0) {
+        const timer = setTimeout(() => {
+          const latest = this.pendingChunkPosts.get(chunkId);
+          this.pendingChunkPosts.delete(chunkId);
+          if (latest) void this.postStreamingChunk(latest.event);
+        }, wait);
+        this.pendingChunkPosts.set(chunkId, { timer, event });
+        return;
+      }
+    }
+    await this.postStreamingChunk({ ...event, content: bounded.content });
+  }
+  async postStreamingChunk(event) {
     const url2 = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/streaming-chunk`;
+    if (!event.isFinal) this.lastChunkPostAt.set(event.chunkId, Date.now());
     try {
       const { statusCode, body } = await this.postWithReauth(
         url2,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
-        log.warn(
-          "acpPublisher",
-          `streaming-chunk status=${statusCode} body=${body.slice(0, 200)}`
-        );
+        log.warn("acpPublisher", `streaming-chunk status=${statusCode} body=${body.slice(0, 200)}`);
       }
     } catch (err) {
       log.trace("acpPublisher", "streaming-chunk post failed", err);
@@ -47060,7 +47114,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.10" : null;
+  const current2 = true ? "2.75.11" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47077,7 +47131,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.10" : null;
+  const current2 = true ? "2.75.11" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47100,7 +47154,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.10" : null;
+  return true ? "2.75.11" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -48840,7 +48894,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.10" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.11" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -49364,7 +49418,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.10" : "unknown";
+  const v = true ? "2.75.11" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.75.10",
+  "version": "2.75.11",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",