codeam-cli 2.76.20 → 2.76.22

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.76.21] — 2026-10-10
+
+### Fixed
+
+- **cli:** Refresh the manifest on a toolRouter change; stop start specs calling prod (#940)
+
+## [2.76.20] — 2026-10-10
+
+### Added
+
+- **shared:** Own the Composer, feature-gate and compression-savings wire types (#934)
+
+### Fixed
+
+- **cli:** Wake recreates a fleet box whose container is gone but volume remains (#933)
+- **cli:** Provision aider credentials on self-hosted and Box deploys (#935)
+- **both-plugins:** Open the command SSE on the stream host, not apiBaseUrl (#936)
+- **cli:** Keep the typed blocker tag on failure bubbles in pushed history (#937)
+- **cli:** Point USERPROFILE at the tmp home in the re-link credential test (#938)
+
 ## [2.76.19] — 2026-10-09
 
 ### Fixed

package/dist/index.js

@@ -10617,7 +10617,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.76.20" : "0.0.0-dev",
+    cliVersion: true ? "2.76.22" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10866,7 +10866,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.76.20",
+  version: "2.76.22",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -11145,7 +11145,7 @@ async function postAiResult(input) {
 async function fetchNamedPreviewTunnel(input) {
   const res = await _transport.postJsonAuthed(
     `${API_BASE}/api/preview/tunnel`,
-    { pluginId: input.pluginId },
+    { sessionId: input.sessionId, pluginId: input.pluginId },
     input.pluginAuthToken
   );
   const body = res;
@@ -12229,7 +12229,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.76.20" ? { ideVersion: "2.76.20" } : {}
+      ..."2.76.22" ? { ideVersion: "2.76.22" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body, this.pollSecretHeader());
@@ -23815,6 +23815,7 @@ function watchForBuildClobber(deps) {
     if (stopped) return;
     const current2 = readMarker2(markerPath5);
     if (current2 === lastKnownMarker) return;
+    if (current2 === null) return;
     lastKnownMarker = current2;
     const count = (healRestartCounts.get(deps.sessionId) ?? 0) + 1;
     healRestartCounts.set(deps.sessionId, count);
@@ -24896,7 +24897,7 @@ function acquire(inst) {
 async function setupStandalone(ctx, rec) {
   const named = await resolveNamedTunnel(
     { sessionId: ctx.sessionId, pluginId: ctx.pluginId, pluginAuthToken: ctx.pluginAuthToken ?? "" },
-    (c2) => fetchNamedPreviewTunnel({ pluginId: c2.pluginId, pluginAuthToken: c2.pluginAuthToken })
+    fetchNamedPreviewTunnel
   );
   if (!named || rec.cancelled) throw new Error("EXPORT_TUNNEL_UNAVAILABLE");
   const server = http8.createServer((req, res) => {
@@ -27273,7 +27274,7 @@ async function bringUpPublicUrl(ctx, tunnelPort) {
       pluginId: ctx.projectEnvAuth?.pluginId ?? "",
       pluginAuthToken: ctx.projectEnvAuth?.pluginAuthToken ?? ""
     },
-    (c2) => fetchNamedPreviewTunnel({ pluginId: c2.pluginId, pluginAuthToken: c2.pluginAuthToken })
+    fetchNamedPreviewTunnel
   );
   const namedToken = named?.token;
   const namedHostname = named?.hostname;
@@ -30049,7 +30050,7 @@ ${stdout}`);
   }
 }
 function originPayload(payload, origin) {
-  if (origin !== "agent") return payload;
+  if (origin === void 0 || origin === "user") return payload;
   return { ...payload ?? {}, origin };
 }
 async function resolvePreviewDetection(args2) {
@@ -30271,7 +30272,7 @@ async function restorePreviewAfterRestart(ctx, pluginAuthToken, deps = {}) {
     `restoring the preview that was serving before the restart (${detection.framework})`
   );
   void (deps.start ?? startPreviewFromDetection)(ctx, detection, pluginAuthToken, {
-    origin: "user"
+    origin: "auto"
   });
   return true;
 }
@@ -30334,7 +30335,9 @@ function maybeAttachBuildHeal(ctx, pluginAuthToken) {
         if (!activePreviews.has(ctx.sessionId)) return;
         await killPreview(ctx.sessionId);
         await new Promise((r) => setTimeout(r, 150));
-        void startPreviewFromDetection(ctx, preview.detection, pluginAuthToken);
+        void startPreviewFromDetection(ctx, preview.detection, pluginAuthToken, {
+          origin: "auto"
+        });
       })();
     },
     notify: (message) => {
@@ -36881,6 +36884,7 @@ var PROTOCOL_VERSION3 = 1;
 var FATAL_STARTUP_RE = /IneligibleTierError|UNSUPPORTED_CLIENT|no longer supported for Gemini Code Assist|not eligible for Gemini Code Assist|Error authenticating|ProjectIdRequiredError/i;
 var NEWSESSION_TIMEOUT_MS = 12e4;
 var MCP_STARTUP_TIMEOUT_MS = NEWSESSION_TIMEOUT_MS - 3e4;
+var AGENT_ENV_WITHHELD = ["PREVIEW_TUNNEL_TOKEN", "PREVIEW_TUNNEL_HOSTNAME"];
 var LOADSESSION_TIMEOUT_MS = 6e4;
 var PROMPT_IDLE_TIMEOUT_MS = 9e4;
 var PROMPT_ACTIVE_IDLE_TIMEOUT_MS = 6e5;
@@ -37066,6 +37070,7 @@ var AcpClient = class {
       ...this.opts.extraEnv ?? {},
       PATH: augmentedPath
     };
+    for (const key of AGENT_ENV_WITHHELD) delete childEnv[key];
     log.info(
       "acpClient",
       `provider routing ${formatProviderRouting(describeProviderRouting(childEnv, { cwd }), adapter.command)}`
@@ -39383,14 +39388,11 @@ function buildOnboardingWelcome(cwd) {
     "- **Smart Composer** \u2014 help crafting and structuring your prompts.",
     "- **Team Spaces** \u2014 share this session with your team, or hand it off to someone else.",
     "",
-    "Found a bug or have feedback? Reach us at:",
-    // EXPLICIT markdown links, not bare URLs. Relying on the app's autolinker
-    // rendered the GitHub bullet as an EMPTY link (the label was consumed, the
-    // href never attached) — a labelled link renders correctly everywhere and
-    // reads better than a raw URL on a phone-width bubble.
-    "- [GitHub issues](https://github.com/edgar-durand/codeagent-mobile-clients/issues)",
-    "- [Discord community](https://discord.gg/Np2pbMrV9f)",
-    "",
+    // ⚠️ No support links here. The first message a new user reads is the
+    // invitation to start; "Found a bug? GitHub issues / Discord" pointed a
+    // non-developer at a developer bug tracker before they had sent a single
+    // task (replay 2026-10-04, PRO user in Malaysia, bead codeagent-sak0).
+    // Help lives in the app (Profile › Help → FAQ + Contact support).
     `Ready when you are \u2014 try **"explain ${repo}"** or **"what should I work on first?"**`
   ].join("\n");
 }
@@ -41822,7 +41824,7 @@ var SHORT_TIMEOUT_MS = 2e4;
 var PREVIEW_TOOLS = [
   {
     name: "start_preview",
-    description: "Open this project's live Preview in the user's CodeAgent app \u2014 the same thing as their Preview button: it installs dependencies if needed, starts the dev server, publishes it on a public URL and switches the user's screen to it. Use it after you change anything visual (UI, styles, layout, copy) so you and the user can check the result, or whenever the user asks to see the app. Returns the public URL (you can curl it) or the exact error. Reuses a preview that is already running. Usually leave the arguments out: the project is detected automatically. Pass command/args/port only if you know the exact dev command.",
+    description: `Open this project's live Preview in the user's CodeAgent app \u2014 the same thing as their Preview button: it installs dependencies if needed, starts the dev server, publishes it on a public URL and switches the user's screen to it. Use it after you change anything visual (UI, styles, layout, copy) so you and the user can check the result, or whenever the user asks to see the app. Returns the public URL (you can curl it) or the exact error. Only give the user a preview link when this tool says the preview is live \u2014 after an error or a "still starting" answer there is NO working link. Reuses a preview that is already running (code changes hot-reload; never stop and start it to refresh). Usually leave the arguments out: the project is detected automatically. Pass command/args/port only if you know the exact dev command.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -41859,7 +41861,7 @@ var PREVIEW_TOOLS = [
   },
   {
     name: "stop_preview",
-    description: "Stop the Preview (dev server + public URL). Only when the user asks, or to restart it cleanly.",
+    description: "Stop the Preview (dev server + public URL). Only when the user asks. Never to apply code changes \u2014 the dev server hot-reloads them; to run a different dev command, call start_preview with that command instead.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false }
   }
 ];
@@ -41919,12 +41921,17 @@ function describeResult(raw) {
       };
     }
     case "starting":
-      return { text: String(r.message ?? "The preview is starting."), isError: false };
+      return {
+        text: `${String(r.message ?? "The preview is starting.")} It is not serving yet, so there is no link to give the user until preview_status says it is running.`,
+        isError: false
+      };
     case "idle":
       return { text: "No preview is running.", isError: false };
     case "error":
       return {
-        text: `Preview failed at ${String(r.stage)}: ${String(r.message)}`,
+        // The agent once answered a failed spawn with "the preview is open, here
+        // is the link" (2026-10-05). Say plainly that nothing is serving.
+        text: `Preview failed at ${String(r.stage)}: ${String(r.message)}. The preview is NOT running \u2014 do not give the user a preview link; tell them what failed.`,
         isError: true
       };
     default:
@@ -42253,6 +42260,8 @@ function mergeWithLocalMcpServers(integrationServers) {
 var http12 = __toESM(require("http"));
 var import_node_crypto14 = require("crypto");
 var START_WAIT_MS = 24e4;
+var MAX_AGENT_RESTARTS = 3;
+var AGENT_RESTART_WINDOW_MS = 10 * 6e4;
 var MAX_SELECTOR = 500;
 var MAX_LABEL = 80;
 var AgentPreviewBridge = class {
@@ -42264,6 +42273,12 @@ var AgentPreviewBridge = class {
   inflight = null;
   lastError = null;
   bound = null;
+  /** When the agent tore the preview down, per session (see MAX_AGENT_RESTARTS). */
+  restarts = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+  }
   /** Start the loopback server once. `null` when it could not bind — the
    *  preview tools are then simply absent, never a failed session. */
   listen() {
@@ -42390,6 +42405,7 @@ var AgentPreviewBridge = class {
     const ctx = this.ctx;
     if (!ctx?.pluginAuthToken) return { ok: false, message: "The session is still starting." };
     if (!activePreviews.has(ctx.sessionId)) return { ok: true, message: "No preview was running." };
+    if (!this.takeRestart(ctx.sessionId)) return { ok: false, message: RESTART_CAPPED_MESSAGE };
     await killPreview(ctx.sessionId);
     resetBuildHealState(ctx.sessionId);
     await postPreviewEvent({
@@ -42411,7 +42427,15 @@ var AgentPreviewBridge = class {
   // ─── Internals ─────────────────────────────────────────────────────────
   async launch(ctx, pluginAuthToken, override) {
     this.lastError = null;
-    const already = serving(ctx.sessionId);
+    let already = serving(ctx.sessionId);
+    const wanted = override && detectionFromOverride(override);
+    if (already && wanted && !sameCommand(already.detection, wanted)) {
+      if (!this.takeRestart(ctx.sessionId)) {
+        return { status: "error", stage: "restart_limit", message: RESTART_CAPPED_MESSAGE };
+      }
+      await killPreview(ctx.sessionId);
+      already = null;
+    }
     if (already) {
       await postPreviewEvent({
         sessionId: ctx.sessionId,
@@ -42458,6 +42482,21 @@ var AgentPreviewBridge = class {
     this.lastError = err;
     return { status: "error", ...err };
   }
+  /** Records one agent-driven teardown; false once the window's cap is spent. */
+  takeRestart(sessionId) {
+    const now = this.now();
+    const recent = (this.restarts.get(sessionId) ?? []).filter(
+      (t2) => now - t2 < AGENT_RESTART_WINDOW_MS
+    );
+    if (recent.length >= MAX_AGENT_RESTARTS) {
+      this.restarts.set(sessionId, recent);
+      log.info("agent-preview", `restart cap reached for session=${sessionId}`);
+      return false;
+    }
+    recent.push(now);
+    this.restarts.set(sessionId, recent);
+    return true;
+  }
   async handle(req, res) {
     const reply = (code, body) => {
       res.writeHead(code, { "content-type": "application/json" });
@@ -42500,6 +42539,10 @@ function running(active2, reused) {
     inspector: Boolean(active2.inspector)
   };
 }
+var RESTART_CAPPED_MESSAGE = `The preview was already restarted ${MAX_AGENT_RESTARTS} times in the last ${AGENT_RESTART_WINDOW_MS / 6e4} minutes, so it stays as it is. Dev servers hot-reload: your code changes show up without a restart. If it is genuinely broken, tell the user what you saw.`;
+function sameCommand(a, b) {
+  return a.command === b.command && a.port === b.port && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
+}
 function detectionFromOverride(o) {
   if (!o.command || !Number.isInteger(o.port) || o.port <= 0 || o.port > 65535) return null;
   return {
@@ -46382,7 +46425,7 @@ function sanitizeRetiredProxyConfig(homeDir2 = os62.homedir()) {
 // src/integrations/refresh-manifest.ts
 function fingerprint(m) {
   const norm = [...m.integrations].map((e) => ({ id: e.id, delivery: e.delivery })).sort((a, b) => a.id.localeCompare(b.id));
-  return JSON.stringify(norm);
+  return JSON.stringify({ integrations: norm, toolRouter: m.toolRouter === true });
 }
 async function refreshIntegrationsManifest(ctx, fetchImpl = fetch, timeoutMs = 8e3) {
   const result = await fetchAndPersist(ctx, fetchImpl, timeoutMs);
@@ -51224,7 +51267,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.76.20" : null;
+  const current2 = true ? "2.76.22" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -51241,7 +51284,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.76.20" : null;
+  const current2 = true ? "2.76.22" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -51523,7 +51566,7 @@ var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 function currentCliVersion() {
-  return true ? "2.76.20" : null;
+  return true ? "2.76.22" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -51734,7 +51777,7 @@ function signalHostReady(send = process.send?.bind(process)) {
 }
 function defaultDeps() {
   return {
-    ownVersion: true ? "2.76.20" : null,
+    ownVersion: true ? "2.76.22" : null,
     root: cliVersionsRoot(),
     args: process.argv.slice(3),
     execPath: process.execPath,
@@ -54245,7 +54288,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.76.20" : "0.0.0-dev";
+  const cliVersion = true ? "2.76.22" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto17.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -54781,7 +54824,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.76.20" : "unknown";
+  const v = true ? "2.76.22" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.76.20",
+  "version": "2.76.22",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",