codeam-cli 2.76.32 → 2.76.34

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.76.33] — 2026-10-14
+
+### Added
+
+- **box:** Bake PHP CLI + Composer into the Box image
+- **cli:** Composer pre-flight + PHP guidance for in-app Preview
+
+## [2.76.32] — 2026-10-14
+
+### Fixed
+
+- **cli:** Don't resume a session that was deleted from the app while the host slept (codeagent-xwoy)
+
+## [2.76.31] — 2026-10-14
+
+### Fixed
+
+- **cli:** Cap the chat-pipe text frame and never loop on a 413
+- **cli:** Make a python static-site preview ready instead of timing out
+- **cli:** Let codex one-shots run outside a git repo
+- **cli:** A failed agent preview hands the agent the dev server's output
+
+### Tests
+
+- **cli:** Skip the POSIX-only preview subdir spawn test on Windows
+
 ## [2.76.30] — 2026-10-14
 
 ### CI

package/dist/index.js

@@ -3428,14 +3428,23 @@ Rules:
   otherwise "python3".
 - Prefer binding to 0.0.0.0 \u2014 most frameworks default to localhost which the tunnel cannot reach.
 - For Expo: framework="Expo", command="npx", args=["expo","start","--tunnel"], port=8081, notes="Scan QR with Expo Go".
+- For PHP (composer.json / index.php): use PHP's built-in server bound to 0.0.0.0 with the
+  web root as docroot \u2014 command="php", args=["-S","0.0.0.0:8080","-t","public"] (Yii3,
+  Symfony, Slim, Mezzio; use the real docroot, e.g. "web" for Yii2, "." for plain PHP),
+  port=8080, ready_pattern="Development Server". Laravel: command="php",
+  args=["artisan","serve","--host=0.0.0.0","--port=8000"], port=8000,
+  ready_pattern="Server running". Do NOT use "composer serve", "symfony serve" or a
+  "./yii serve" wrapper \u2014 call php directly.
 - If no dev server applies (CLI library, lambda, batch script): {"framework":"unsupported","notes":"<reason>"}.
 
 CRITICAL \u2014 setup_commands:
 - DO NOT include an install command (npm install, pnpm install, yarn install,
-  yarn, bun install) in setup_commands. A lockfile-aware pre-flight installer
-  runs BEFORE setup_commands and picks the correct package manager from the
-  lockfile present (pnpm-lock.yaml -> pnpm, yarn.lock -> yarn, bun.lockb -> bun,
-  else npm). Emitting an install here either duplicates that work or, worse,
+  yarn, bun install, composer install) in setup_commands. Pre-flight installers
+  run BEFORE setup_commands: composer install whenever composer.json exists and
+  vendor/ is missing, and a lockfile-aware Node installer that picks the
+  correct package manager from the lockfile present (pnpm-lock.yaml -> pnpm,
+  yarn.lock -> yarn, bun.lockb -> bun, else npm). Emitting an install here
+  either duplicates that work or, worse,
   uses the WRONG package manager on top of node_modules just populated by the
   pre-flight, which crashes (e.g. npm errors with "Cannot read properties of
   null (reading 'matches')" when run over pnpm's .pnpm/ layout).
@@ -10627,7 +10636,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.76.32" : "0.0.0-dev",
+    cliVersion: true ? "2.76.34" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10876,7 +10885,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.76.32",
+  version: "2.76.34",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -10964,7 +10973,7 @@ var package_default = {
     zod: "^4.3.6"
   },
   optionalDependencies: {
-    "@beads/bd": "1.0.5"
+    "@beads/bd": "1.3.1"
   },
   devDependencies: {
     "@codeam/shared": "*",
@@ -12252,7 +12261,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.76.32" ? { ideVersion: "2.76.32" } : {}
+      ..."2.76.34" ? { ideVersion: "2.76.34" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body, this.pollSecretHeader());
@@ -24657,6 +24666,24 @@ function isJsInstallCommand(cmd, args2) {
   const verb = args2[0];
   return verb === "install" || verb === "i" || verb === "ci";
 }
+function detectMissingPhpDeps(cwd) {
+  if (!import_fs5.default.existsSync(import_path8.default.join(cwd, "composer.json"))) return null;
+  if (import_fs5.default.existsSync(import_path8.default.join(cwd, "vendor"))) return null;
+  return {
+    cmd: "composer",
+    args: [
+      "install",
+      "--no-interaction",
+      "--no-progress",
+      "--prefer-dist",
+      "--ignore-platform-req=ext-*"
+    ]
+  };
+}
+function isComposerInstallCommand(cmd, args2) {
+  if (cmd !== "composer") return false;
+  return args2[0] === "install" || args2[0] === "i";
+}
 
 // src/services/preview/script-candidates.ts
 var fs47 = __toESM(require("fs"));
@@ -27119,6 +27146,29 @@ function announceReady(ctx, dev, tun) {
     port: detection.port
   });
 }
+async function runPreflightInstall(ctx, install, why) {
+  const { detection, cwd, emit: emit2, emitProgress } = ctx;
+  const label = `${install.cmd} ${install.args.join(" ")}`;
+  emitProgress("SETUP_RUN", `${label} (pre-flight \u2014 ${why})`);
+  const result = await runSetupCommand(install.cmd, install.args, cwd, detection.env, {
+    timeoutMs: INSTALL_TIMEOUT_MS2
+  });
+  if (result.status === "timeout") {
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "ready_timeout",
+      message: `Dependency install (${label}) didn't finish within ${Math.round(INSTALL_TIMEOUT_MS2 / 1e3)}s and was stopped. Run it manually in this project, then try the preview again.`
+    });
+    return false;
+  }
+  if (result.status === "failed") {
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "spawn",
+      message: `Dependency install failed (${label}, exit ${result.code}). Run it manually in this project and try again.`
+    });
+    return false;
+  }
+  return true;
+}
 async function provisionDeps(ctx) {
   const { detection, cwd, emit: emit2, emitProgress } = ctx;
   if (ctx.projectEnvAuth?.pluginAuthToken) {
@@ -27155,32 +27205,21 @@ async function provisionDeps(ctx) {
         return false;
       }
     }
-    emitProgress(
-      "SETUP_RUN",
-      `${missingDeps.cmd} ${missingDeps.args.join(" ")} (pre-flight \u2014 node_modules missing)`
-    );
-    const result = await runSetupCommand(
-      missingDeps.cmd,
-      missingDeps.args,
-      cwd,
-      detection.env,
-      { timeoutMs: INSTALL_TIMEOUT_MS2 }
-    );
-    if (result.status === "timeout") {
-      emit2(USER_EVENTS.PREVIEW_ERROR, {
-        stage: "ready_timeout",
-        message: `Dependency install (${missingDeps.cmd} ${missingDeps.args.join(" ")}) didn't finish within ${Math.round(INSTALL_TIMEOUT_MS2 / 1e3)}s and was stopped. Run it manually in this project, then try the preview again.`
-      });
-      return false;
-    }
-    if (result.status === "failed") {
+    if (!await runPreflightInstall(ctx, missingDeps, "node_modules missing")) return false;
+    preflightRan = true;
+  }
+  const missingPhpDeps = detectMissingPhpDeps(cwd);
+  let composerPreflightRan = false;
+  if (missingPhpDeps) {
+    if (!await (0, import_which3.default)("composer", { nothrow: true })) {
       emit2(USER_EVENTS.PREVIEW_ERROR, {
         stage: "spawn",
-        message: `Dependency install failed (${missingDeps.cmd} ${missingDeps.args.join(" ")}, exit ${result.code}). Run it manually in this project and try again.`
+        message: "This is a PHP project (composer.json) but Composer isn't installed in this environment, so its dependencies (vendor/) can't be installed. Install PHP and Composer, then try the preview again."
       });
       return false;
     }
-    preflightRan = true;
+    if (!await runPreflightInstall(ctx, missingPhpDeps, "vendor/ missing")) return false;
+    composerPreflightRan = true;
   }
   const normalizedSetup = (detection.setup_commands ?? []).map((entry) => {
     if (typeof entry === "string") {
@@ -27193,10 +27232,12 @@ async function provisionDeps(ctx) {
       args: Array.isArray(o.args) ? o.args.filter((a) => typeof a === "string") : []
     };
   }).filter((s) => s.cmd.length > 0);
-  const agentSetupCommands = preflightRan ? normalizedSetup.filter((s) => !isJsInstallCommand(s.cmd, s.args)) : normalizedSetup;
+  const agentSetupCommands = normalizedSetup.filter(
+    (s) => !(preflightRan && isJsInstallCommand(s.cmd, s.args)) && !(composerPreflightRan && isComposerInstallCommand(s.cmd, s.args))
+  );
   for (const setup of agentSetupCommands) {
     emitProgress("SETUP_RUN", `${setup.cmd} ${setup.args.join(" ")}`);
-    const timeoutMs = isJsInstallCommand(setup.cmd, setup.args) ? INSTALL_TIMEOUT_MS2 : SETUP_TIMEOUT_MS;
+    const timeoutMs = isJsInstallCommand(setup.cmd, setup.args) || isComposerInstallCommand(setup.cmd, setup.args) ? INSTALL_TIMEOUT_MS2 : SETUP_TIMEOUT_MS;
     const result = await runSetupCommand(setup.cmd, setup.args, cwd, detection.env, {
       timeoutMs
     });
@@ -27468,6 +27509,43 @@ var import_child_process21 = require("child_process");
 var fs59 = __toESM(require("fs"));
 var os40 = __toESM(require("os"));
 var path67 = __toESM(require("path"));
+
+// src/beads/schema-migrate.ts
+var SCHEMA_SKEW_RE = /Error 1146|table not found|refusing to auto-apply \d+ pending schema migration/i;
+function isSchemaSkew(text) {
+  return SCHEMA_SKEW_RE.test(text);
+}
+var APPLIED_RE = /applying (\d+) pending schema migration/i;
+var REMOTE_GATE_RE = /remote-backed database/i;
+async function migrateSchema(bd) {
+  let forced = false;
+  let res = await bd.run(["migrate", "schema"]);
+  if (res.code !== 0 && REMOTE_GATE_RE.test(res.stderr + res.stdout)) {
+    log.info("beads", "schema migrate refused for a remote-backed DB \u2014 migrating with --force");
+    forced = true;
+    res = await bd.run(["migrate", "schema", "--force"]);
+  }
+  const text = `${res.stderr}
+${res.stdout}`;
+  if (res.code !== 0) {
+    const detail = (res.stderr || res.stdout).trim().slice(0, 200);
+    log.warn("beads", `bd migrate schema failed (code=${res.code}): ${detail}`);
+    return { status: "failed", detail };
+  }
+  const applied = APPLIED_RE.exec(text);
+  if (applied) {
+    const count = Number(applied[1]);
+    log.info(
+      "beads",
+      `bd migrate schema applied ${count} migration(s)${forced ? " (--force)" : ""}`
+    );
+    return { status: "applied", count, forced };
+  }
+  log.trace("beads", "bd migrate schema: already current");
+  return { status: "current" };
+}
+
+// src/beads/bd-adapter.ts
 var BD_PACKAGE = "@beads/bd";
 function resolveBundledBdBinary() {
   return _resolveSeam.resolveBundled();
@@ -27545,6 +27623,8 @@ var BdAdapter = class {
   }
   opts;
   resolved;
+  /** Set when a bd call failed on schema skew; read + cleared by `takeSchemaSkew`. */
+  schemaSkewSeen = false;
   /**
    * Resolve the bd binary lazily, caching the result. Order:
    * bundled @beads/bd → PATH. Returns null when neither is available — the
@@ -27600,8 +27680,20 @@ var BdAdapter = class {
       await _adapterSeam.sleep(750 * attempt);
       res = await _spawnSeam.run(binary, args2, { cwd, env });
     }
+    if (res.code !== 0 && isSchemaSkew(res.stderr + res.stdout)) this.schemaSkewSeen = true;
     return res;
   }
+  /**
+   * Whether a bd call since the last check failed because the project DB is
+   * behind this bd's schema (see `schema-migrate.ts`). `listIssues` /
+   * `statusSummary` swallow failures into []/null, so this is how the watcher
+   * learns the cause. Clears the flag.
+   */
+  takeSchemaSkew() {
+    const seen2 = this.schemaSkewSeen;
+    this.schemaSkewSeen = false;
+    return seen2;
+  }
   /**
    * `bd ready --json` → typed issue array. `bd list --json` shares the shape,
    * so `listIssues` reuses the same parser. Bad JSON / non-zero exit → [].
@@ -28167,7 +28259,8 @@ async function provisionBeads(opts = {}) {
     prefix: null,
     initialized: false,
     exportEnabled: false,
-    agentsWired: []
+    agentsWired: [],
+    schemaMigrate: null
   };
   if (!bd.isAvailable()) {
     log.info("beads", "bd binary missing \u2014 running OS installer fallback");
@@ -28249,6 +28342,7 @@ async function provisionBeads(opts = {}) {
     log.warn("beads", "shared dolt sql-server not up \u2014 beads disabled this run");
     return result;
   }
+  result.schemaMigrate = await migrateSchemaSafely(bd);
   try {
     if (!await projectDbReachable(bd)) {
       log.info(
@@ -28264,6 +28358,8 @@ async function provisionBeads(opts = {}) {
             "beads",
             `bd bootstrap failed (code=${boot.code}): ${boot.stderr.slice(0, 200)} \u2014 prefix DB may be absent`
           );
+        } else {
+          result.schemaMigrate = await migrateSchemaSafely(bd);
         }
       }
       if (!await projectDbReachable(bd)) {
@@ -28315,10 +28411,25 @@ async function provisionBeads(opts = {}) {
   result.agentsWired = await setupAgents(bd, opts.agents ?? []);
   log.info(
     "beads",
-    `provision done dolt=${result.doltAvailable} server=${result.serverUp} prefix=${result.prefix} initialized=${result.initialized} export=${result.exportEnabled} agentsWired=[${result.agentsWired.join(",")}]`
+    `provision done dolt=${result.doltAvailable} server=${result.serverUp} prefix=${result.prefix} initialized=${result.initialized} schema=${describeSchemaMigrate(result.schemaMigrate)} export=${result.exportEnabled} agentsWired=[${result.agentsWired.join(",")}]`
   );
   return result;
 }
+async function migrateSchemaSafely(bd) {
+  try {
+    return await migrateSchema(bd);
+  } catch (err) {
+    log.warn("beads", "bd migrate schema threw (non-fatal)", err);
+    return { status: "failed", detail: err.message };
+  }
+}
+function describeSchemaMigrate(outcome) {
+  if (!outcome) return "skipped";
+  if (outcome.status === "applied") {
+    return `applied:${outcome.count}${outcome.forced ? ":forced" : ""}`;
+  }
+  return outcome.status;
+}
 async function projectDbReachable(bd) {
   const ping = await bd.run(["ping"]);
   return ping.code === 0;
@@ -28414,6 +28525,8 @@ var BeadsWatcher = class {
   debounceTimer = null;
   stopped = false;
   lastPushedHash = null;
+  /** One schema-heal attempt per watcher — a failing migrate must not loop. */
+  schemaHealTried = false;
   bd;
   feedPath;
   apiBase;
@@ -28482,10 +28595,15 @@ var BeadsWatcher = class {
   async syncNow() {
     if (this.stopped) return;
     const { projectKey, projectLabel } = deriveProjectIdentity(this.opts.cwd);
-    const [issues, summary] = await Promise.all([
-      this.bd.listIssues(projectKey),
-      this.bd.statusSummary()
-    ]);
+    let [issues, summary] = await this.readSnapshot(projectKey);
+    if (!this.schemaHealTried && this.bd.takeSchemaSkew()) {
+      this.schemaHealTried = true;
+      log.info("beads", "snapshot hit schema skew \u2014 running bd migrate schema once");
+      const outcome = await migrateSchema(this.bd);
+      if (outcome.status !== "failed") {
+        [issues, summary] = await this.readSnapshot(projectKey);
+      }
+    }
     const payload = {
       sessionId: this.opts.sessionId,
       pluginId: this.opts.pluginId,
@@ -28524,6 +28642,9 @@ var BeadsWatcher = class {
       log.warn("beads", "ingest POST error", err);
     }
   }
+  readSnapshot(projectKey) {
+    return Promise.all([this.bd.listIssues(projectKey), this.bd.statusSummary()]);
+  }
   headers() {
     return {
       "Content-Type": "application/json",
@@ -51501,7 +51622,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.76.32" : null;
+  const current2 = true ? "2.76.34" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -51518,7 +51639,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.76.32" : null;
+  const current2 = true ? "2.76.34" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -51694,14 +51815,37 @@ function pidAlive3(pid) {
     return err.code === "EPERM";
   }
 }
+var CLK_TCK = 100;
+function processStartMs(pid) {
+  try {
+    const stat3 = fs96.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const ticks = Number(stat3.slice(stat3.lastIndexOf(")") + 2).split(" ")[19]);
+    const btime = /^btime (\d+)$/m.exec(fs96.readFileSync("/proc/stat", "utf8"))?.[1];
+    if (!Number.isFinite(ticks) || !btime) return null;
+    return Number(btime) * 1e3 + ticks * 1e3 / CLK_TCK;
+  } catch {
+    return null;
+  }
+}
+var PID_REUSE_SLACK_MS = 2e3;
 function livePids(versionDir) {
+  const dir = path109.join(versionDir, ".pids");
   let names;
   try {
-    names = fs96.readdirSync(path109.join(versionDir, ".pids"));
+    names = fs96.readdirSync(dir);
   } catch {
     return [];
   }
-  return names.map(Number).filter((pid) => Number.isInteger(pid) && pid > 0 && pidAlive3(pid));
+  return names.map(Number).filter((pid) => {
+    if (!Number.isInteger(pid) || pid <= 0 || !pidAlive3(pid)) return false;
+    const started = processStartMs(pid);
+    if (started === null) return true;
+    try {
+      return started <= fs96.statSync(path109.join(dir, String(pid))).mtimeMs + PID_REUSE_SLACK_MS;
+    } catch {
+      return true;
+    }
+  });
 }
 function registerRunningVersion(root = cliVersionsRoot(), entry = process.argv[1]) {
   const dir = versionDirContaining(root, entry);
@@ -51801,7 +51945,7 @@ var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 function currentCliVersion() {
-  return true ? "2.76.32" : null;
+  return true ? "2.76.34" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -51886,6 +52030,7 @@ async function runSelfUpdateWith(deps) {
     }
     if (compareSemver(latest, current2) <= 0) {
       log.info("host-agent", `self-update: running ${current2}, npm latest ${latest} \u2014 up to date`);
+      if (versionedModeSupported(deps.platform)) collectOldVersions(root);
       return { status: "current" };
     }
     if (!versionedModeSupported(deps.platform)) {
@@ -51902,6 +52047,17 @@ async function runSelfUpdateWith(deps) {
     return { status: "skipped" };
   }
 }
+function collectOldVersions(root) {
+  const release3 = acquireInstallLock(root);
+  if (!release3) return [];
+  try {
+    const removed = gcVersions(root);
+    if (removed.length) log.info("host-agent", `self-update: gc removed ${removed.join(", ")}`);
+    return removed;
+  } finally {
+    release3();
+  }
+}
 var VERIFY_TIMEOUT_MS = 3e4;
 async function installVersioned(deps, root, latest, running2) {
   const node = deps.nodePath ?? process.execPath;
@@ -52012,7 +52168,7 @@ function signalHostReady(send = process.send?.bind(process)) {
 }
 function defaultDeps() {
   return {
-    ownVersion: true ? "2.76.32" : null,
+    ownVersion: true ? "2.76.34" : null,
     root: cliVersionsRoot(),
     args: process.argv.slice(3),
     execPath: process.execPath,
@@ -54550,7 +54706,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.76.32" : "0.0.0-dev";
+  const cliVersion = true ? "2.76.34" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto17.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -55086,7 +55242,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.76.32" : "unknown";
+  const v = true ? "2.76.34" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.76.32",
+  "version": "2.76.34",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -88,7 +88,7 @@
     "zod": "^4.3.6"
   },
   "optionalDependencies": {
-    "@beads/bd": "1.0.5"
+    "@beads/bd": "1.3.1"
   },
   "devDependencies": {
     "@codeam/shared": "*",