codeam-cli 2.75.10 → 2.75.12

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.11] — 2026-09-24
+
+### Fixed
+
+- **cli:** Bound streaming-chunk snapshots under the API cap and coalesce big re-sends
+
+## [2.75.10] — 2026-09-23
+
+### Fixed
+
+- **cli:** Guardrails judge a write by its target; pack stage shows a mid-turn permission as awaiting
+
 ## [2.75.9] — 2026-09-23
 
 ### Added

package/dist/index.js

@@ -10509,7 +10509,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.10" : "0.0.0-dev",
+    cliVersion: true ? "2.75.12" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10751,7 +10751,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.10",
+  version: "2.75.12",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12081,7 +12081,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.10" ? { ideVersion: "2.75.10" } : {}
+      ..."2.75.12" ? { ideVersion: "2.75.12" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -18511,6 +18511,9 @@ function resolveHistoryDir2(_cwd, homeOverride) {
   if (!import_node_fs3.default.existsSync(todayDir)) return null;
   return todayDir;
 }
+function isHeadlessOneShotMeta(meta) {
+  return meta.source === "exec" || meta.originator === "codex_exec";
+}
 function parseLine(line) {
   try {
     const parsed = JSON.parse(line);
@@ -18790,6 +18793,7 @@ function newestRolloutIdSince(sessionsRoot, resolvedCwd, floorMs) {
       if (mtime < floorMs || mtime <= bestMtime) continue;
       let metaCwd;
       let metaId;
+      let headlessOneShot = false;
       try {
         const raw = import_node_fs3.default.readFileSync(filePath, "utf8");
         for (const line of raw.split("\n")) {
@@ -18800,13 +18804,14 @@ function newestRolloutIdSince(sessionsRoot, resolvedCwd, floorMs) {
             const meta = rec.payload;
             metaCwd = typeof meta?.cwd === "string" ? meta.cwd : void 0;
             metaId = typeof meta?.id === "string" ? meta.id : void 0;
+            headlessOneShot = meta !== void 0 && isHeadlessOneShotMeta(meta);
           }
           break;
         }
       } catch {
         continue;
       }
-      if (!metaId || !metaCwd) continue;
+      if (!metaId || !metaCwd || headlessOneShot) continue;
       let resolvedMeta;
       try {
         resolvedMeta = import_node_fs3.default.realpathSync(metaCwd);
@@ -27496,6 +27501,26 @@ var emitPreviewEvent = (args2) => {
     payload: { ...args2.payload ?? {}, missingServices: missing }
   });
 };
+var PREVIEW_DETECT_TIMEOUT_MS = 12e4;
+async function runDetectOneShot(generate, timeoutMs = PREVIEW_DETECT_TIMEOUT_MS) {
+  let timer;
+  const deadline = new Promise((resolve11) => {
+    timer = setTimeout(() => resolve11({ raw: null, timedOut: true }), timeoutMs);
+    timer.unref?.();
+  });
+  const oneShot = generate(PREVIEW_DETECT_PROMPT, { timeoutMs }).then(
+    (raw) => ({ raw, timedOut: false }),
+    (err) => {
+      log.info("preview", `detect: generateOneShot threw: ${String(err)}`);
+      return { raw: null, timedOut: false };
+    }
+  );
+  try {
+    return await Promise.race([oneShot, deadline]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var requestPreviewDetectH = (ctx) => {
   if (!ctx.pluginAuthToken) {
     log.info("preview", "no pluginAuthToken \u2014 skipping detect");
@@ -27516,6 +27541,7 @@ var requestPreviewDetectH = (ctx) => {
     return;
   }
   const pluginAuthToken = ctx.pluginAuthToken;
+  const generateOneShot = ctx.runtime.generateOneShot.bind(ctx.runtime);
   void (async () => {
     const fromFile = await readPreviewConfig(process.cwd());
     if (fromFile) {
@@ -27537,11 +27563,22 @@ var requestPreviewDetectH = (ctx) => {
     });
     log.info("preview", "detect: invoking generateOneShot");
     const startedAt = Date.now();
-    const raw = await ctx.runtime.generateOneShot(PREVIEW_DETECT_PROMPT).catch((err) => {
-      log.info("preview", `detect: generateOneShot threw: ${String(err)}`);
-      return null;
-    });
+    const { raw, timedOut } = await runDetectOneShot(generateOneShot);
     const tookMs = Date.now() - startedAt;
+    if (timedOut) {
+      log.info("preview", `detect: timed out after ${tookMs}ms \u2014 emitting preview_error`);
+      emitPreviewEvent({
+        sessionId: ctx.sessionId,
+        pluginId: ctx.pluginId,
+        pluginAuthToken,
+        type: USER_EVENTS.PREVIEW_ERROR,
+        payload: {
+          stage: "detection",
+          message: `Project detection timed out after ${Math.round(PREVIEW_DETECT_TIMEOUT_MS / 1e3)} s \u2014 the agent did not answer. Try again, or add a .codeam/preview.json override.`
+        }
+      });
+      return;
+    }
     const detection = safeParseDetection(raw);
     if (!detection) {
       const failure = describeDetectionFailure(raw);
@@ -27622,11 +27659,12 @@ function prewarmPreviewDetection(runtime) {
   if (previewPrewarmStarted) return;
   previewPrewarmStarted = true;
   if (typeof runtime.generateOneShot !== "function") return;
+  const generateOneShot = runtime.generateOneShot.bind(runtime);
   void (async () => {
     try {
       const cwd = process.cwd();
       if (await readPreviewConfig(cwd)) return;
-      const raw = await runtime.generateOneShot(PREVIEW_DETECT_PROMPT).catch(() => null);
+      const { raw } = await runDetectOneShot(generateOneShot);
       const detection = safeParseDetection(raw);
       if (!detection) {
         const failure = describeDetectionFailure(raw);
@@ -35576,6 +35614,18 @@ function _get(url2, headers) {
 }
 
 // src/agents/acp/publisher.ts
+var STREAMING_CHUNK_SNAPSHOT_MAX_CHARS = 56 * 1024;
+var STREAMING_CHUNK_COALESCE_MIN_CHARS = 8 * 1024;
+var STREAMING_CHUNK_COALESCE_WINDOW_MS = 300;
+function boundStreamingChunkContent(content, max = STREAMING_CHUNK_SNAPSHOT_MAX_CHARS) {
+  if (content.length <= max) return { content, truncated: false };
+  const dropped = content.length - max;
+  return {
+    content: `${content.slice(0, max)}
+\u2026 [output truncated: ${dropped} more characters \u2014 the full text is in the conversation transcript]`,
+    truncated: true
+  };
+}
 var AcpPublisher = class {
   constructor(opts) {
     this.opts = opts;
@@ -35585,6 +35635,11 @@ var AcpPublisher = class {
   opts;
   apiBase;
   token;
+  /** chunkIds whose truncated snapshot already went out — nothing new to show
+   *  until the terminal frame. */
+  truncatedChunks = /* @__PURE__ */ new Set();
+  lastChunkPostAt = /* @__PURE__ */ new Map();
+  pendingChunkPosts = /* @__PURE__ */ new Map();
   /** Latched on an unrecoverable 401/403 — every surface stops posting
    *  (2026-06-28 incident: a dead-token publisher spammed 401 ×34 while
    *  the agent's replies silently never reached the phone). */
@@ -35613,7 +35668,10 @@ var AcpPublisher = class {
       const fresh = await this.opts.refreshAuthToken();
       if (fresh) {
         this.token = fresh;
-        log.info("acpPublisher", `plugin-auth token refreshed after ${first.statusCode}; retrying POST`);
+        log.info(
+          "acpPublisher",
+          `plugin-auth token refreshed after ${first.statusCode}; retrying POST`
+        );
         const second = await _transport4.post(url2, this.authHeaders(), payload);
         if (second.statusCode !== 401 && second.statusCode !== 403) return second;
         this.markPairingInvalid(second.statusCode);
@@ -35722,17 +35780,51 @@ var AcpPublisher = class {
    * richer SessionDetail surface.
    */
   async publishStreamingChunk(event) {
+    const { chunkId, isFinal } = event;
+    const pending = this.pendingChunkPosts.get(chunkId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      this.pendingChunkPosts.delete(chunkId);
+    }
+    const bounded = boundStreamingChunkContent(event.content);
+    if (bounded.truncated) {
+      if (!isFinal && this.truncatedChunks.has(chunkId)) return;
+      if (!this.truncatedChunks.has(chunkId)) {
+        log.warn(
+          "acpPublisher",
+          `streaming-chunk ${chunkId.slice(0, 12)} (${event.kind}) exceeds ${STREAMING_CHUNK_SNAPSHOT_MAX_CHARS} chars \u2014 sending a truncated snapshot once`
+        );
+      }
+      this.truncatedChunks.add(chunkId);
+    }
+    if (isFinal) {
+      this.truncatedChunks.delete(chunkId);
+      this.lastChunkPostAt.delete(chunkId);
+    } else if (!bounded.truncated && bounded.content.length >= STREAMING_CHUNK_COALESCE_MIN_CHARS) {
+      const last = this.lastChunkPostAt.get(chunkId) ?? 0;
+      const wait = STREAMING_CHUNK_COALESCE_WINDOW_MS - (Date.now() - last);
+      if (wait > 0) {
+        const timer = setTimeout(() => {
+          const latest = this.pendingChunkPosts.get(chunkId);
+          this.pendingChunkPosts.delete(chunkId);
+          if (latest) void this.postStreamingChunk(latest.event);
+        }, wait);
+        this.pendingChunkPosts.set(chunkId, { timer, event });
+        return;
+      }
+    }
+    await this.postStreamingChunk({ ...event, content: bounded.content });
+  }
+  async postStreamingChunk(event) {
     const url2 = `${this.apiBase}/api/sessions/${encodeURIComponent(this.opts.sessionId)}/streaming-chunk`;
+    if (!event.isFinal) this.lastChunkPostAt.set(event.chunkId, Date.now());
     try {
       const { statusCode, body } = await this.postWithReauth(
         url2,
         this.envelope(event)
       );
       if (statusCode < 200 || statusCode >= 300) {
-        log.warn(
-          "acpPublisher",
-          `streaming-chunk status=${statusCode} body=${body.slice(0, 200)}`
-        );
+        log.warn("acpPublisher", `streaming-chunk status=${statusCode} body=${body.slice(0, 200)}`);
       }
     } catch (err) {
       log.trace("acpPublisher", "streaming-chunk post failed", err);
@@ -47060,7 +47152,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.10" : null;
+  const current2 = true ? "2.75.12" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47077,7 +47169,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.10" : null;
+  const current2 = true ? "2.75.12" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47100,7 +47192,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.10" : null;
+  return true ? "2.75.12" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -48840,7 +48932,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.10" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.12" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto12.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -49364,7 +49456,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.10" : "unknown";
+  const v = true ? "2.75.12" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.75.10",
+  "version": "2.75.12",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",