codeam-cli 2.75.37 → 2.75.39

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.38] — 2026-09-27
+
+### Fixed
+
+- **cli:** Beads never commits to the user's repo (bd init --stealth) (#844)
+
+## [2.75.37] — 2026-09-27
+
+### Fixed
+
+- **cli:** The review lists files, not new folders; skip sockets and beads state (#839)
+
 ## [2.75.36] — 2026-09-26
 
 ### Fixed

package/dist/index.js

@@ -10529,7 +10529,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.37" : "0.0.0-dev",
+    cliVersion: true ? "2.75.39" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10771,7 +10771,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.37",
+  version: "2.75.39",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12101,7 +12101,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.37" ? { ideVersion: "2.75.37" } : {}
+      ..."2.75.39" ? { ideVersion: "2.75.39" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -12436,6 +12436,10 @@ function isUnsafeWindowsWatchRoot(dir, homedir53) {
   }
   return false;
 }
+function isFilesystemRoot(dir) {
+  const resolved = path5.resolve(dir);
+  return resolved === path5.parse(resolved).root;
+}
 var _chokidarSeam = {
   load: () => {
     try {
@@ -12520,6 +12524,13 @@ var FileWatcherService = class {
     if (this.stopped) {
       throw new Error("FileWatcherService has already been stopped \u2014 re-instantiate to restart.");
     }
+    if (isFilesystemRoot(this.opts.workingDir)) {
+      log.warn(
+        "fileWatcher",
+        `refusing to watch ${this.opts.workingDir} \u2014 the filesystem root. Run codeam from your project folder to enable file change emission.`
+      );
+      return;
+    }
     const isWin = process.platform === "win32";
     if (isWin && isUnsafeWindowsWatchRoot(this.opts.workingDir, os5.homedir())) {
       log.warn(
@@ -20458,14 +20469,14 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync31 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync32 = deps.existsSync ?? import_fs.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
   const scopeDir = import_path4.default.dirname(sdkDir);
   const binName = platformKey.startsWith("win32-") ? "claude.exe" : "claude";
   const candidate = import_path4.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
-  return existsSync31(candidate) ? candidate : null;
+  return existsSync32(candidate) ? candidate : null;
 }
 var realSleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
 async function waitForClaudeNativeBinary(opts = {}) {
@@ -20547,18 +20558,18 @@ function augmentUserLocalBinPaths(deps = {}) {
   env.PATH = [...additions, ...parts].join(p2.delimiter);
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync31 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync32 = deps.existsSync ?? import_fs.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
     const localAppData = env.LOCALAPPDATA;
     if (!localAppData) return null;
     const exe = import_path4.default.win32.join(localAppData, "cursor-agent", "cursor-agent.exe");
-    return existsSync31(exe) ? exe : null;
+    return existsSync32(exe) ? exe : null;
   }
   const home = deps.homedir ?? import_os4.default.homedir();
   const unix = import_path4.default.posix.join(home, ".local", "bin", "cursor-agent");
-  return existsSync31(unix) ? unix : null;
+  return existsSync32(unix) ? unix : null;
 }
 async function waitForCursorAgent(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
@@ -26214,7 +26225,14 @@ async function provisionBeads(opts = {}) {
     "--shared-server",
     "--skip-agents",
     "--skip-hooks",
-    "--non-interactive"
+    "--non-interactive",
+    // ⚠️ Without it `bd init` COMMITS ("bd init: initialize beads issue
+    // tracking") on whatever branch the user's repo is on — verified with bd
+    // 1.0.5 on a scratch repo, and seen on a fleet box's feature branch
+    // (break-it 2026-09-24/26). Stealth keeps beads out of git: it only writes
+    // `.git/info/exclude` (local, never committed); the global git config was
+    // verified untouched.
+    "--stealth"
   ]);
   const alreadyInit = /already initialized|already exists/i.test(init.stderr + init.stdout);
   if (init.code !== 0 && !alreadyInit) {
@@ -26222,6 +26240,8 @@ async function provisionBeads(opts = {}) {
     return result;
   }
   result.initialized = true;
+  const workdir = opts.cwd ?? process.cwd();
+  ensureLocalGitExclude(findRepoRoot(workdir) ?? workdir, [".beads/", ".dolt/"]);
   const server = await _provisionSeam.ensureSharedServer(bd);
   result.serverUp = server.up;
   if (!server.up) {
@@ -26264,7 +26284,8 @@ async function provisionBeads(opts = {}) {
           // `git push` on a box without git-lfs (fleet box 2026-09-24).
           "--skip-agents",
           "--skip-hooks",
-          "--non-interactive"
+          "--non-interactive",
+          "--stealth"
         ]);
         if (mint.code !== 0) {
           log.warn(
@@ -26335,6 +26356,23 @@ function dedupeRecipes(agents) {
   }
   return [...seen2];
 }
+function ensureLocalGitExclude(cwd, patterns) {
+  try {
+    const gitDir = path54.join(cwd, ".git");
+    if (!fs46.statSync(gitDir).isDirectory()) return;
+    const file = path54.join(gitDir, "info", "exclude");
+    fs46.mkdirSync(path54.dirname(file), { recursive: true });
+    const current2 = fs46.existsSync(file) ? fs46.readFileSync(file, "utf8") : "";
+    const have = new Set(current2.split(/\r?\n/).map((l) => l.trim()));
+    const missing = patterns.filter((p2) => !have.has(p2));
+    if (missing.length === 0) return;
+    const prefix = current2.length > 0 && !current2.endsWith("\n") ? "\n" : "";
+    fs46.appendFileSync(file, `${prefix}# CodeAgent: beads state stays local
+${missing.join("\n")}
+`);
+  } catch {
+  }
+}
 
 // src/beads/watcher.ts
 var crypto4 = __toESM(require("crypto"));
@@ -27620,7 +27658,7 @@ var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
   const readdirSync14 = deps?.readdirSync ?? fs51.readdirSync;
-  const statSync15 = deps?.statSync ?? fs51.statSync;
+  const statSync16 = deps?.statSync ?? fs51.statSync;
   const rmSync10 = deps?.rmSync ?? fs51.rmSync;
   let removed = 0;
   let entries;
@@ -27633,7 +27671,7 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
     if (!/^\.codeam-cli-/.test(name)) continue;
     const full = path59.join(nodeModulesDir, name);
     try {
-      const st3 = statSync15(full);
+      const st3 = statSync16(full);
       if (now - st3.mtimeMs < STALE_STAGING_AGE_MS) continue;
       rmSync10(full, { recursive: true, force: true });
       removed++;
@@ -33071,13 +33109,13 @@ var ConnectionBuilder = class {
   /**
    * Adds a typed request handler for one method.
    */
-  onReceiveRequest(method, parse, handler) {
+  onReceiveRequest(method, parse2, handler) {
     return this.withHandler({
       handleMessage: async (message, cx) => {
         if (message.kind !== "request" || message.method !== method) {
           return Handled.no(message);
         }
-        const request2 = parse(message.params);
+        const request2 = parse2(message.params);
         return await handler(request2, message.responder, cx) ?? Handled.yes();
       },
       describe: () => `${this.connectionName ?? "request"}:${method}`
@@ -33086,13 +33124,13 @@ var ConnectionBuilder = class {
   /**
    * Adds a typed notification handler for one method.
    */
-  onReceiveNotification(method, parse, handler) {
+  onReceiveNotification(method, parse2, handler) {
     return this.withHandler({
       handleMessage: async (message, cx) => {
         if (message.kind !== "notification" || message.method !== method) {
           return Handled.no(message);
         }
-        const notification = parse(message.params);
+        const notification = parse2(message.params);
         return await handler(notification, cx) ?? Handled.yes();
       },
       describe: () => `${this.connectionName ?? "notification"}:${method}`
@@ -48317,9 +48355,9 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
     load() {
       try {
         const raw = JSON.parse(fs77.readFileSync(file, "utf8"));
-        return Array.isArray(raw?.sessions) ? raw.sessions.filter(isRecord5) : [];
+        return Array.isArray(raw?.sessions) ? raw.sessions.filter(isRecord5) : null;
       } catch {
-        return [];
+        return null;
       }
     },
     save(list) {
@@ -48808,7 +48846,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.37" : null;
+  const current2 = true ? "2.75.39" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48825,7 +48863,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.37" : null;
+  const current2 = true ? "2.75.39" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48848,7 +48886,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.37" : null;
+  return true ? "2.75.39" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -50122,11 +50160,12 @@ var HostAgentSupervisor = class {
     try {
       if (this.children.size > 0) return;
       const records = this.sessionStore.load();
-      if (records.length === 0) {
+      if (records === null) {
         const target = this.fallbackResumeTarget();
         if (target) this.resumeOne(target);
         return;
       }
+      if (records.length === 0) return;
       const max = resolveMaxResumeSessions();
       const { resume, dropped } = planSessionResume(records, max);
       for (const rec of dropped) {
@@ -50174,6 +50213,13 @@ var HostAgentSupervisor = class {
     const session = getActiveSession();
     if (!session || !session.pluginId || !session.pollSecret || !session.agent) return null;
     const cwd = session.cwd && fs80.existsSync(session.cwd) ? session.cwd : process.cwd();
+    if (isFilesystemRoot(cwd)) {
+      log.warn(
+        "host-agent",
+        `resume: skipping session ${session.id.slice(0, 8)} \u2014 it has no saved workspace and the fallback is the filesystem root`
+      );
+      return null;
+    }
     const deployId = deployIdFromWorkspace(session.cwd) ?? session.id;
     return { deployId, cwd, session };
   }
@@ -50245,7 +50291,7 @@ var HostAgentSupervisor = class {
    */
   knownSavedSessions() {
     try {
-      const persisted = new Map(this.sessionStore.load().map((r) => [r.deployId, r.agent]));
+      const persisted = new Map((this.sessionStore.load() ?? []).map((r) => [r.deployId, r.agent]));
       for (const c2 of this.children.values()) persisted.set(c2.deployId, c2.agent);
       return this.listSavedSessions().map((s) => ({ s, deployId: deployIdFromWorkspace(s.cwd) })).filter(
         (x) => x.deployId !== null && !!x.s.cwd && fs80.existsSync(x.s.cwd)
@@ -50816,7 +50862,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.37" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.39" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -51340,7 +51386,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.37" : "unknown";
+  const v = true ? "2.75.39" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.75.37",
+  "version": "2.75.39",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",