codeam-cli 2.75.32 → 2.75.34

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.33] — 2026-09-26
+
+### Fixed
+
+- **cli:** Keep a fresher Codex login; legacy hosts self-enrol their poll secret (#830)
+
+## [2.75.32] — 2026-09-26
+
+### Fixed
+
+- **cli:** Clear a preview that died with its machine on the first heartbeat (#828)
+
 ## [2.75.31] — 2026-09-26
 
 ### Fixed

package/dist/index.js

@@ -10516,7 +10516,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.32" : "0.0.0-dev",
+    cliVersion: true ? "2.75.34" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10758,7 +10758,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.32",
+  version: "2.75.34",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12088,7 +12088,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.32" ? { ideVersion: "2.75.32" } : {}
+      ..."2.75.34" ? { ideVersion: "2.75.34" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -36325,10 +36325,33 @@ var codexProvisioner = {
       writeFile0600(authJson, JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: auth.value }));
       return { OPENAI_API_KEY: auth.value };
     }
-    writeFile0600(authJson, auth.value);
+    if (!keepsFresherCodexLogin(authJson, auth.value)) writeFile0600(authJson, auth.value);
     return {};
   }
 };
+function codexLoginStamp(raw) {
+  try {
+    const blob = JSON.parse(raw);
+    const refreshedAt = typeof blob.last_refresh === "string" ? Date.parse(blob.last_refresh) : NaN;
+    const accountId = blob.tokens?.account_id;
+    if (!Number.isFinite(refreshedAt) || typeof accountId !== "string" || !accountId) return null;
+    return { refreshedAt, accountId };
+  } catch {
+    return null;
+  }
+}
+function keepsFresherCodexLogin(authJsonPath, incoming) {
+  let onDisk;
+  try {
+    onDisk = fs58.readFileSync(authJsonPath, "utf8");
+  } catch {
+    return false;
+  }
+  const current2 = codexLoginStamp(onDisk);
+  const next = codexLoginStamp(incoming);
+  if (!current2 || !next) return false;
+  return current2.accountId === next.accountId && current2.refreshedAt > next.refreshedAt;
+}
 var geminiProvisioner = {
   write(auth, home) {
     const settingsJson = path68.join(home, ".gemini", "settings.json");
@@ -47897,6 +47920,15 @@ function loadHostIdentity() {
     return null;
   }
 }
+function pollSecretHash(secret) {
+  return (0, import_node_crypto12.createHash)("sha256").update(secret).digest("hex");
+}
+function ensureControlPollSecret(identity, save = saveHostIdentity) {
+  if (!identity || identity.controlPollSecret) return identity;
+  const upgraded = { ...identity, controlPollSecret: (0, import_node_crypto12.randomBytes)(32).toString("base64url") };
+  save(upgraded);
+  return upgraded;
+}
 function saveHostIdentity(identity) {
   const file = hostIdentityPath();
   fs75.mkdirSync(path89.dirname(file), { recursive: true, mode: 448 });
@@ -47995,7 +48027,11 @@ async function sendHostHeartbeat(identity, metrics) {
   await postJson("/api/self-hosted/heartbeat", {
     hostId: identity.hostId,
     hostToken: identity.hostToken,
-    ...metrics ? { metrics } : {}
+    ...metrics ? { metrics } : {},
+    // The backend enrols this ONLY if the control plugin has no secret yet
+    // (first writer wins), so re-sending it every beat is idempotent — and it
+    // is the one way a host that never had one (or lost it) gets it back.
+    ...identity.controlPollSecret ? { pluginSecretHash: pollSecretHash(identity.controlPollSecret) } : {}
   });
   const elapsedNs = process.hrtime.bigint() - start2;
   return Math.round(Number(elapsedNs) / 1e6);
@@ -48227,14 +48263,18 @@ function planSessionResume(records, max) {
   const bound = Math.max(0, Math.floor(max));
   return { resume: ordered.slice(0, bound), dropped: ordered.slice(bound) };
 }
-function pickSavedSessionForWorkspace(sessions3, cwd) {
+function pickSavedSessionForWorkspace(sessions3, cwd, deployId) {
   const target = path90.resolve(cwd);
+  const reconnectable = (s) => !!s.pluginId && !!s.pollSecret && !!s.agent;
   const matches = sessions3.filter(
-    (s) => !!s.cwd && path90.resolve(s.cwd) === target && !!s.pluginId && !!s.pollSecret && !!s.agent
+    (s) => !!s.cwd && path90.resolve(s.cwd) === target && reconnectable(s)
   );
-  if (matches.length === 0) return null;
-  matches.sort((a, b) => b.pairedAt - a.pairedAt);
-  return matches[0];
+  if (matches.length > 0) {
+    matches.sort((a, b) => b.pairedAt - a.pairedAt);
+    return matches[0];
+  }
+  if (!deployId) return null;
+  return sessions3.find((s) => !s.cwd && s.id === deployId && reconnectable(s)) ?? null;
 }
 
 // src/commands/host/git-tooling.ts
@@ -48674,7 +48714,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.32" : null;
+  const current2 = true ? "2.75.34" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48691,7 +48731,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.32" : null;
+  const current2 = true ? "2.75.34" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48714,7 +48754,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.32" : null;
+  return true ? "2.75.34" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -50005,7 +50045,7 @@ var HostAgentSupervisor = class {
       const saved = this.listSavedSessions();
       let resumed = 0;
       for (const rec of resume) {
-        const session = pickSavedSessionForWorkspace(saved, rec.cwd);
+        const session = pickSavedSessionForWorkspace(saved, rec.cwd, rec.deployId);
         if (!session) {
           log.warn(
             "host-agent",
@@ -50386,7 +50426,7 @@ var HostAgentSupervisor = class {
   }
 };
 async function resolveHostIdentity(enrollToken) {
-  const existing = loadHostIdentity();
+  const existing = ensureControlPollSecret(loadHostIdentity());
   if (enrollToken) {
     await reportProgress({ enrollToken }, "redeeming", "redeeming enrollment token\u2026");
     try {
@@ -50679,7 +50719,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.32" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.34" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -51203,7 +51243,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.32" : "unknown";
+  const v = true ? "2.75.34" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.75.32",
+  "version": "2.75.34",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",