codeam-cli 2.75.27 → 2.75.29

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.28] — 2026-09-25
+
+### Fixed
+
+- **cli:** Preview proxy forwards to the address the dev server really serves (#820)
+
+## [2.75.27] — 2026-09-25
+
+### Fixed
+
+- **cli:** On-demand Box session resume, link reporting, per-boot logs, MCP secrets off argv (#818)
+
 ## [2.75.26] — 2026-09-25
 
 ### Added

package/dist/index.js

@@ -10516,7 +10516,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.27" : "0.0.0-dev",
+    cliVersion: true ? "2.75.29" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10758,7 +10758,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.27",
+  version: "2.75.29",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12088,7 +12088,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.27" ? { ideVersion: "2.75.27" } : {}
+      ..."2.75.29" ? { ideVersion: "2.75.29" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -24273,6 +24273,18 @@ function injectAt(html, script) {
   }
   return null;
 }
+function upstreamRequestHeaders(headers, targetPort) {
+  const out2 = { ...headers, host: `localhost:${targetPort}` };
+  if (headers.host && !headers["x-forwarded-host"]) out2["x-forwarded-host"] = headers.host;
+  if (!headers["x-forwarded-proto"]) out2["x-forwarded-proto"] = "https";
+  return out2;
+}
+function publicLocation(location, targetPort) {
+  if (!location) return location;
+  const m = /^https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]):(\d+)(\/.*)?$/i.exec(location);
+  if (!m || Number(m[1]) !== targetPort) return location;
+  return m[2] ?? "/";
+}
 async function startInspectorProxy(opts) {
   const targetHost = opts.targetHost ?? "127.0.0.1";
   const upgraded = /* @__PURE__ */ new Set();
@@ -24283,12 +24295,14 @@ async function startInspectorProxy(opts) {
       secFetchDest: one(req.headers["sec-fetch-dest"]),
       secFetchMode: one(req.headers["sec-fetch-mode"])
     });
-    const headers = { ...req.headers };
+    const headers = upstreamRequestHeaders(req.headers, opts.targetPort);
     if (inject) delete headers["accept-encoding"];
     const upstream = http8.request(
       { host: targetHost, port: opts.targetPort, method: req.method, path: req.url, headers },
       (originRes) => {
         const outHeaders = { ...originRes.headers };
+        const location = publicLocation(originRes.headers.location, opts.targetPort);
+        if (location !== void 0) outHeaders.location = location;
         const willInject = inject && isHtmlResponse(originRes.headers["content-type"]);
         if (willInject) delete outHeaders["content-length"];
         res.writeHead(originRes.statusCode ?? 502, outHeaders);
@@ -24334,7 +24348,7 @@ async function startInspectorProxy(opts) {
     upgraded.add(clientSocket);
     const upstream = net3.connect(opts.targetPort, targetHost, () => {
       const lines = [`${req.method} ${req.url} HTTP/1.1`];
-      for (const [k2, v] of Object.entries(req.headers)) {
+      for (const [k2, v] of Object.entries(upstreamRequestHeaders(req.headers, opts.targetPort))) {
         for (const one of Array.isArray(v) ? v : [v]) {
           if (one !== void 0) lines.push(`${k2}: ${one}`);
         }
@@ -24868,9 +24882,10 @@ async function bringUpInspector(targetPort, deps = {}) {
     const start2 = deps.start ?? startInspectorProxy;
     const proxy = await start2({
       targetPort,
+      ...deps.targetHost ? { targetHost: deps.targetHost } : {},
       script: inspectorClientSource({ allowedOrigins: resolveInspectorOrigins(env) })
     });
-    log2(`preview inspector proxy on :${proxy.port} \u2192 :${targetPort}`);
+    log2(`preview inspector proxy on :${proxy.port} \u2192 ${deps.targetHost ?? "127.0.0.1"}:${targetPort}`);
     return { port: proxy.port, proxy };
   } catch (e) {
     log2(`preview inspector unavailable (${e.message}) \u2014 going direct`);
@@ -24878,6 +24893,39 @@ async function bringUpInspector(targetPort, deps = {}) {
   }
 }
 
+// src/services/preview/served-address.ts
+var LOOPBACK_HOSTS = ["127.0.0.1", "::1"];
+var ANSI_RE2 = /\x1b\[[0-9;]*m/g;
+var LOCAL_URL_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1?\]|\[::\]):(\d{2,5})\b/gi;
+function announcedPorts(output) {
+  const clean = output.replace(ANSI_RE2, "");
+  const ports = [];
+  for (const m of clean.matchAll(LOCAL_URL_RE)) {
+    const port = Number(m[1]);
+    if (port > 0 && port < 65536) ports.push(port);
+  }
+  return [...new Set(ports.reverse())];
+}
+async function resolveServedAddress(output, detectedPort, deps = {}) {
+  const listening = deps.listening ?? isPortListening;
+  const candidates = [.../* @__PURE__ */ new Set([...announcedPorts(output), detectedPort])];
+  for (const port of candidates) {
+    for (const host2 of LOOPBACK_HOSTS) {
+      if (await listening(port, host2)) return { host: host2, port };
+    }
+  }
+  return { host: "127.0.0.1", port: detectedPort };
+}
+async function announcedPortListening(output, deps = {}) {
+  const listening = deps.listening ?? isPortListening;
+  for (const port of announcedPorts(output)) {
+    for (const host2 of LOOPBACK_HOSTS) {
+      if (await listening(port, host2)) return true;
+    }
+  }
+  return false;
+}
+
 // src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
@@ -25186,7 +25234,10 @@ async function startDevServer(ctx, extraEnv = {}) {
       if (verdict.adopt) {
         log.info("preview", `adopting the dev server already serving on port ${detection.port}`);
         emitProgress("READY_DETECTED", `adopted the server already on port ${detection.port}`);
-        return { devServer: null };
+        return {
+          devServer: null,
+          served: await resolveServedAddress("", detection.port)
+        };
       }
       emit2(USER_EVENTS.PREVIEW_ERROR, {
         stage: "spawn",
@@ -25223,7 +25274,7 @@ async function startDevServer(ctx, extraEnv = {}) {
     "i"
   ) : compileReadyPattern(detection.ready_pattern);
   const isNextJs = /next/i.test(detection.framework);
-  const portProbe = isExpo ? () => waitForExpoManifest(detection.port, { timeoutMs: 1e3, intervalMs: 250 }) : isNextJs ? () => waitForPortListening(detection.port, { timeoutMs: 1e3, intervalMs: 250 }) : void 0;
+  const portProbe = isExpo ? () => waitForExpoManifest(detection.port, { timeoutMs: 1e3, intervalMs: 250 }) : isNextJs ? () => waitForPortListening(detection.port, { timeoutMs: 1e3, intervalMs: 250 }) : () => announcedPortListening(outputTail);
   const outcome = await waitForDevServerReady(devServer, readyRe, {
     timeoutMs: devServerReadyTimeoutMs(detection),
     onChunk: (s) => {
@@ -25249,15 +25300,23 @@ async function startDevServer(ctx, extraEnv = {}) {
     });
     return null;
   }
-  emitProgress("READY_DETECTED", `port ${detection.port}`);
-  return { devServer };
+  const served = await resolveServedAddress(outputTail, detection.port);
+  if (served.port !== detection.port || served.host !== "127.0.0.1") {
+    log.info(
+      "preview",
+      `dev server serves on ${served.host}:${served.port} (detection said :${detection.port})`
+    );
+  }
+  emitProgress("READY_DETECTED", `port ${served.port}`);
+  return { devServer, served };
 }
 var MAX_TUNNEL_ATTEMPTS = 3;
 async function establishTunnel(ctx, dev) {
   const { detection, emit: emit2, emitProgress } = ctx;
   const { devServer } = dev;
   emitProgress("TUNNEL_STARTING", "cloudflared quick tunnel");
-  const inspection = await bringUpInspector(detection.port, {
+  const inspection = await bringUpInspector(dev.served.port, {
+    targetHost: dev.served.host,
     log: (m) => log.info("preview", m)
   });
   const pub = await bringUpPublicUrl(ctx, inspection.port);
@@ -38354,10 +38413,10 @@ function completedReplyFailureBubble(opts) {
 }
 function houseAgentLimitMessage(text) {
   if (/temporarily (?:unavailable|disabled)/i.test(text)) {
-    return "\u23F3 **CodeAgent Cloud is temporarily unavailable \u2014 this one\u2019s on us, not your account.**\n\nThere\u2019s nothing to buy and nothing owed, and it isn\u2019t a problem with your login, so re-authenticating won\u2019t help. Send your message again in a bit, or connect your own agent (Claude Code, Codex, Cursor, Gemini) in **Profile \u203A Agents** to keep going now.";
+    return "\u23F3 **Our agent service is temporarily unavailable \u2014 this one\u2019s on us, not your account.**\n\nThere\u2019s nothing to buy and nothing owed, and it isn\u2019t a problem with your login, so re-authenticating won\u2019t help. Send your message again in a bit, or connect your own agent (Claude Code, Codex, Cursor, Gemini) in **Profile \u203A Agents** to keep going now.";
   }
   const canUpgrade = /upgrade to pro/i.test(text);
-  return "\u{1F4CA} **You\u2019ve reached your daily CodeAgent Cloud limit.**\n\nThe free CodeAgent Cloud agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
+  return "\u{1F4CA} **You\u2019ve reached today\u2019s agent usage limit.**\n\nThe free agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
 }
 var AUTH_FAILURE_MESSAGE = (
   // ⚠️ Do NOT name a status code here. This bubble fires for several
@@ -38387,10 +38446,10 @@ function agentStatusPage(agent, railWireId) {
 }
 function providerOutageMessage(agent, railWireId) {
   if (railWireId) {
-    const who2 = isManagedProviderId(railWireId) ? MANAGED_PROVIDER_DISPLAY_NAMES[railWireId] : HOUSE_AGENT_NAME;
+    const who2 = isManagedProviderId(railWireId) ? `${MANAGED_PROVIDER_DISPLAY_NAMES[railWireId]} ` : "";
     return `\u{1F310} **CodeAgent's agent service is having a disruption \u2014 this isn't your session.**
 
-Your ${who2} agent couldn't finish this turn because our provider returned an overload error. It usually clears up on its own \u2014 just send your message again in a bit.`;
+Your ${who2}agent couldn't finish this turn because our provider returned an overload error. It usually clears up on its own \u2014 just send your message again in a bit.`;
   }
   const info = agentStatusPage(agent);
   const who = info ? info.vendor : "The agent provider";
@@ -48578,7 +48637,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.27" : null;
+  const current2 = true ? "2.75.29" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48595,7 +48654,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.27" : null;
+  const current2 = true ? "2.75.29" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48618,7 +48677,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.27" : null;
+  return true ? "2.75.29" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -50583,7 +50642,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.27" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.29" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -51107,7 +51166,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.27" : "unknown";
+  const v = true ? "2.75.29" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.75.27",
+  "version": "2.75.29",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",