codeam-cli 2.76.46 → 2.76.47

package/dist/index.js

@@ -374,8 +374,8 @@ function defaultSpawn(timeoutMs) {
   });
 }
 function resolveConvexBin(cwd) {
-  const local = path117.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
-  if (fs105.existsSync(local)) return { cmd: local, args: [] };
+  const local = path118.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
+  if (fs106.existsSync(local)) return { cmd: local, args: [] };
   return { cmd: "npx", args: ["--yes", "convex"] };
 }
 function redact(text, key) {
@@ -506,13 +506,13 @@ async function runConvexAdminMcp(client3, id) {
   });
   await server.connect(new StdioServerTransport());
 }
-var import_node_child_process42, fs105, path117, TOOLS;
+var import_node_child_process42, fs106, path118, TOOLS;
 var init_convex_admin_mcp = __esm({
   "src/integrations/convex-admin-mcp.ts"() {
     "use strict";
     import_node_child_process42 = require("child_process");
-    fs105 = __toESM(require("fs"));
-    path117 = __toESM(require("path"));
+    fs106 = __toESM(require("fs"));
+    path118 = __toESM(require("path"));
     TOOLS = [
       {
         name: "tables",
@@ -4393,11 +4393,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path119) {
+function rmIfExistsQuiet(path120) {
   try {
-    fs2.rmSync(path119, { force: true });
+    fs2.rmSync(path120, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path119}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path120}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -4601,8 +4601,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path119) {
-  return path119.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path120) {
+  return path120.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/error-tracking/index.mjs
@@ -7335,13 +7335,13 @@ var PostHogCoreStateless = class {
       sentFromRoute += batchMessages.length;
     }
   }
-  async _sendOtlpBatch({ path: path119, payload }) {
+  async _sendOtlpBatch({ path: path120, payload }) {
     if (this.disabled) return {
       kind: "fatal",
       error: new Error("The client is disabled")
     };
     const serialized = JSON.stringify(payload);
-    const url2 = `${this.host}/i/v1/${path119}?token=${encodeURIComponent(this.apiKey)}`;
+    const url2 = `${this.host}/i/v1/${path120}?token=${encodeURIComponent(this.apiKey)}`;
     const gzippedPayload = this.disableCompression ? null : await this.compressPayload(serialized);
     const fetchOptions = {
       method: "POST",
@@ -8581,14 +8581,14 @@ async function addSourceContext(frames, openSourceFile = import_promises.open, l
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-async function openRegularSourceFile(path119, openSourceFile, logger) {
+async function openRegularSourceFile(path120, openSourceFile, logger) {
   let fileHandle;
   let isValid = false;
   try {
-    fileHandle = await openSourceFile(path119, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
+    fileHandle = await openSourceFile(path120, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
     const fileStat = await fileHandle.stat();
     if (!fileStat.isFile()) return;
-    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path119}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
+    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path120}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
     isValid = true;
     return fileHandle;
   } catch {
@@ -8598,8 +8598,8 @@ async function openRegularSourceFile(path119, openSourceFile, logger) {
     });
   }
 }
-async function getContextLinesFromFile(path119, ranges, output, cacheKey, openSourceFile, logger) {
-  const fileHandle = await openRegularSourceFile(path119, openSourceFile, logger);
+async function getContextLinesFromFile(path120, ranges, output, cacheKey, openSourceFile, logger) {
+  const fileHandle = await openRegularSourceFile(path120, openSourceFile, logger);
   if (void 0 === fileHandle) return void LRU_FILE_CONTENTS_FS_READ_FAILED.set(cacheKey, 1);
   const openedFileHandle = fileHandle;
   return new Promise((resolve13) => {
@@ -8701,22 +8701,22 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path119) {
-  return path119.startsWith("node:") || path119.endsWith(".min.js") || path119.endsWith(".min.cjs") || path119.endsWith(".min.mjs") || path119.startsWith("data:");
+function shouldSkipContextLinesForFile(path120) {
+  return path120.startsWith("node:") || path120.endsWith(".min.js") || path120.endsWith(".min.cjs") || path120.endsWith(".min.mjs") || path120.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
   if (void 0 !== frame.colno && frame.colno > MAX_CONTEXTLINES_COLNO) return true;
   return false;
 }
-function makeSourceCacheKey(path119, basePath) {
-  if ((0, import_node_path.isAbsolute)(path119)) return JSON.stringify([
+function makeSourceCacheKey(path120, basePath) {
+  if ((0, import_node_path.isAbsolute)(path120)) return JSON.stringify([
     null,
-    path119
+    path120
   ]);
   return void 0 === basePath ? void 0 : JSON.stringify([
     basePath,
-    path119
+    path120
   ]);
 }
 function rangeExistsInContentCache(cacheKey, range) {
@@ -11378,7 +11378,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.76.46" : "0.0.0-dev",
+    cliVersion: true ? "2.76.47" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -11627,7 +11627,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.76.46",
+  version: "2.76.47",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -13003,7 +13003,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.76.46" ? { ideVersion: "2.76.46" } : {}
+      ..."2.76.47" ? { ideVersion: "2.76.47" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body, this.pollSecretHeader());
@@ -13326,10 +13326,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir57) {
+function isUnsafeWindowsWatchRoot(dir, homedir58) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir57);
+  const home = norm(homedir58);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -18133,10 +18133,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto5 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os77 = createOsStrategy()) {
-  const found = os77.findInPath("claude") ?? os77.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os78 = createOsStrategy()) {
+  const found = os78.findInPath("claude") ?? os78.findInPath("claude-code");
   if (!found) return null;
-  return os77.buildLaunch(found, extraArgs);
+  return os78.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -18235,8 +18235,8 @@ function parseClaudeAuthStatus(stdout) {
     return "unknown";
   }
 }
-function probeClaudeLocalAuth(os77, timeoutMs = 1e4) {
-  const bin = os77.findInPath("claude") ?? os77.findInPath("claude-code");
+function probeClaudeLocalAuth(os78, timeoutMs = 1e4) {
+  const bin = os78.findInPath("claude") ?? os78.findInPath("claude-code");
   if (!bin) return Promise.resolve("unknown");
   return new Promise((resolve13) => {
     try {
@@ -19014,8 +19014,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   probeLocalAuth() {
     return probeClaudeLocalAuth(this.os);
@@ -20132,8 +20132,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os77 = createOsStrategy();
-      return os77.findInPath("codex") !== null;
+      const os78 = createOsStrategy();
+      return os78.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process4.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -20162,8 +20162,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -20284,12 +20284,12 @@ var CodexRuntimeStrategy = class {
     return (await runOnce()).text;
   }
 };
-function resolveNpm(os77) {
-  return os77.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os78) {
+  return os78.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os77) {
+async function installCodexViaNpm(os78) {
   return new Promise((resolve13, reject) => {
-    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os77), ["install", "-g", "--no-audit", "--no-fund", "@openai/codex"], {
+    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os78), ["install", "-g", "--no-audit", "--no-fund", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -20306,16 +20306,16 @@ async function installCodexViaNpm(os77) {
     });
   });
 }
-function augmentNpmGlobalBin(os77) {
+function augmentNpmGlobalBin(os78) {
   try {
-    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os77), ["prefix", "-g"], {
+    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os78), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os77.id === "win32" ? prefix : path27.join(prefix, "bin");
-    os77.augmentPath([binDir]);
+    const binDir = os78.id === "win32" ? prefix : path27.join(prefix, "bin");
+    os78.augmentPath([binDir]);
   } catch {
   }
 }
@@ -20509,10 +20509,10 @@ function manualInstallHint(runner, tools) {
   const argv = osPackageInstallArgv(detectPackageManager(runner), [...tools]);
   return argv ? `\`sudo ${argv.join(" ")}\`` : `your package manager (e.g. \`${pkgs}\`)`;
 }
-function writeUnzipShim(os77, runner) {
+function writeUnzipShim(os78, runner) {
   const python = ["python3", "python"].find((p2) => runner.which(p2));
   if (!python) return null;
-  const dir = os77.scratchPath("codeam-cr-prereq");
+  const dir = os78.scratchPath("codeam-cr-prereq");
   const shim = path29.join(dir, "unzip");
   const script = `#!/bin/sh
 set -e
@@ -20534,9 +20534,9 @@ exec ${python} -m zipfile -e "$archive" "$dest"
   (0, import_node_fs6.chmodSync)(shim, 448);
   return dir;
 }
-async function ensureInstallPrerequisites(os77, deps = {}) {
+async function ensureInstallPrerequisites(os78, deps = {}) {
   const runner = deps.runner ?? defaultOsRunner;
-  const missing = REQUIRED_TOOLS.filter((t2) => os77.findInPath(t2) === null);
+  const missing = REQUIRED_TOOLS.filter((t2) => os78.findInPath(t2) === null);
   if (missing.length === 0) return { ok: true, extraPath: [] };
   log.info(
     "coderabbit",
@@ -20555,10 +20555,10 @@ async function ensureInstallPrerequisites(os77, deps = {}) {
       );
     }
   }
-  const stillMissing = REQUIRED_TOOLS.filter((t2) => os77.findInPath(t2) === null);
+  const stillMissing = REQUIRED_TOOLS.filter((t2) => os78.findInPath(t2) === null);
   if (stillMissing.length === 0) return { ok: true, extraPath: [] };
   if (stillMissing.length === 1 && stillMissing[0] === "unzip") {
-    const shimDir = writeUnzipShim(os77, runner);
+    const shimDir = writeUnzipShim(os78, runner);
     if (shimDir) {
       log.info("coderabbit", "unzip is unavailable \u2014 using a scoped python zipfile shim");
       return { ok: true, extraPath: [shimDir] };
@@ -20621,15 +20621,15 @@ function summarizeInstallFailure(output) {
   }
   return lines.length > 0 ? lines[lines.length - 1] : null;
 }
-async function ensureCoderabbitInstalled(os77, deps = {}) {
-  if (os77.findInPath("coderabbit")) return { ok: true };
-  if (os77.id === "win32") {
+async function ensureCoderabbitInstalled(os78, deps = {}) {
+  if (os78.findInPath("coderabbit")) return { ok: true };
+  if (os78.id === "win32") {
     return {
       ok: false,
       error: "CodeRabbit on Windows requires WSL. Install the CLI inside your WSL distribution (curl -fsSL https://cli.coderabbit.ai/install.sh | sh), then try again."
     };
   }
-  const prereq = await ensureInstallPrerequisites(os77, deps);
+  const prereq = await ensureInstallPrerequisites(os78, deps);
   if (!prereq.ok) return { ok: false, error: prereq.error };
   const env = { ...process.env };
   if (prereq.extraPath.length > 0) {
@@ -20638,8 +20638,8 @@ async function ensureCoderabbitInstalled(os77, deps = {}) {
   log.info("coderabbit", "CodeRabbit CLI not found \u2014 installing via the official script");
   const run3 = deps.runInstallScript ?? defaultRunInstallScript;
   const { code, output } = await run3(env);
-  os77.augmentPath([`${os77.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  const binary = os77.findInPath("coderabbit");
+  os78.augmentPath([`${os78.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  const binary = os78.findInPath("coderabbit");
   const detail = summarizeInstallFailure(output);
   if (binary !== null) {
     if (code === 0) return { ok: true };
@@ -20693,10 +20693,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os77) {
+function coderabbitLoginLauncher(os78) {
   return {
     async ensureInstalled() {
-      const result = await ensureCoderabbitInstalled(os77);
+      const result = await ensureCoderabbitInstalled(os78);
       if (!result.ok && result.error) console.error(`
   \u2717 ${result.error}
 `);
@@ -20756,8 +20756,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path119 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path119) return null;
+  const path120 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path120) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -20774,7 +20774,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path119.trim(),
+    path: path120.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -20857,10 +20857,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path119, lineNo, sevToken, message] = m;
-    if (!path119 || !lineNo || !message) continue;
+    const [, path120, lineNo, sevToken, message] = m;
+    if (!path120 || !lineNo || !message) continue;
     hunks.push({
-      path: path119.trim(),
+      path: path120.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -20920,8 +20920,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -21192,10 +21192,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os77) {
+function cursorLoginLauncher(os78) {
   return {
     async ensureInstalled() {
-      if (os77.findInPath("cursor-agent")) return true;
+      if (os78.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -21259,8 +21259,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -21478,10 +21478,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os77) {
+function aiderLoginLauncher(os78) {
   return {
     async ensureInstalled() {
-      if (os77.findInPath("aider")) return true;
+      if (os78.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -21491,7 +21491,7 @@ function aiderLoginLauncher(os77) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process12.spawn)(os77.id === "win32" ? "cmd.exe" : "sh", os77.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process12.spawn)(os78.id === "win32" ? "cmd.exe" : "sh", os78.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -21775,8 +21775,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     augmentUserLocalBinPaths();
@@ -21909,8 +21909,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os77 = createOsStrategy();
-      return os77.findInPath("gemini") !== null;
+      const os78 = createOsStrategy();
+      return os78.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process13.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -22100,8 +22100,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -22394,8 +22394,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -22539,8 +22539,8 @@ var OpencodeRuntimeStrategy = class {
   meta = getAgent("opencode");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("opencode");
@@ -22723,8 +22723,8 @@ var AntigravityRuntimeStrategy = class {
   meta = getAgent("antigravity");
   mode = "interactive";
   os;
-  constructor(os77) {
-    this.os = os77;
+  constructor(os78) {
+    this.os = os78;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("agy");
@@ -22821,21 +22821,21 @@ var AntigravityRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os77) => new ClaudeRuntimeStrategy(os77),
-  codex: (os77) => new CodexRuntimeStrategy(os77),
-  coderabbit: (os77) => new CoderabbitRuntimeStrategy(os77),
-  cursor: (os77) => new CursorRuntimeStrategy(os77),
-  aider: (os77) => new AiderRuntimeStrategy(os77),
-  gemini: (os77) => new GeminiRuntimeStrategy(os77),
-  kimi: (os77) => new KimiRuntimeStrategy(os77),
-  opencode: (os77) => new OpencodeRuntimeStrategy(os77),
-  antigravity: (os77) => new AntigravityRuntimeStrategy(os77)
+  claude: (os78) => new ClaudeRuntimeStrategy(os78),
+  codex: (os78) => new CodexRuntimeStrategy(os78),
+  coderabbit: (os78) => new CoderabbitRuntimeStrategy(os78),
+  cursor: (os78) => new CursorRuntimeStrategy(os78),
+  aider: (os78) => new AiderRuntimeStrategy(os78),
+  gemini: (os78) => new GeminiRuntimeStrategy(os78),
+  kimi: (os78) => new KimiRuntimeStrategy(os78),
+  opencode: (os78) => new OpencodeRuntimeStrategy(os78),
+  antigravity: (os78) => new AntigravityRuntimeStrategy(os78)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os77 = createOsStrategy()) {
+function createAgentStrategy(agent, os78 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -22845,10 +22845,10 @@ function createAgentStrategy(agent, os77 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os77);
+  return build(os78);
 }
-function createInteractiveAgentStrategy(agent, os77 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os77);
+function createInteractiveAgentStrategy(agent, os78 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os78);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -23562,8 +23562,8 @@ function collectChangedFiles(cwd) {
   }
   return [...byPath.values()];
 }
-function restoreCoderabbitOauthBlob(os77, value) {
-  const dir = path42.join(os77.homeDir(), ".coderabbit");
+function restoreCoderabbitOauthBlob(os78, value) {
+  const dir = path42.join(os78.homeDir(), ".coderabbit");
   (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
   let file = "auth.json";
   let contents = value.trim();
@@ -23583,26 +23583,26 @@ function installFailureMessage(result) {
   return result.error ?? "CodeRabbit CLI could not be installed";
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os77 = deps.os ?? createOsStrategy();
+  const os78 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os77.homeDir();
-  os77.augmentPath(
-    os77.id === "win32" ? [
+  const home = os78.homeDir();
+  os78.augmentPath(
+    os78.id === "win32" ? [
       path42.join(home, ".local", "bin"),
       path42.join(process.env.APPDATA ?? path42.join(home, "AppData", "Roaming"), "npm"),
       path42.join(home, "scoop", "shims")
     ] : [path42.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os77.findInPath("coderabbit") !== null;
+  const installed2 = os78.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os77.findInPath("coderabbit") !== null,
+    installed: os78.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -23616,7 +23616,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const inst = await ensureInstalled(os77);
+      const inst = await ensureInstalled(os78);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -23640,7 +23640,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os77);
+      const inst = await ensureInstalled(os78);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -23657,7 +23657,7 @@ async function configureCoderabbit(input, deps = {}) {
       return { ...res2, loggedIn: true, linked: true };
     }
     try {
-      restoreCoderabbitOauthBlob(os77, cred.credential);
+      restoreCoderabbitOauthBlob(os78, cred.credential);
     } catch (err) {
       return {
         ...res2,
@@ -23681,7 +23681,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os77);
+      const inst = await ensureInstalled(os78);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -23721,7 +23721,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const inst = await ensureInstalled(os77);
+    const inst = await ensureInstalled(os78);
     res.installed = inst.ok;
     if (!inst.ok) return { ...res, error: installFailureMessage(inst) };
   }
@@ -28766,11 +28766,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os77 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os78 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os77 === "windows" && a !== "amd64") return null;
-  return `${os77}-${a}`;
+  if (os78 === "windows" && a !== "amd64") return null;
+  return `${os78}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -30618,7 +30618,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
   });
   const token = ctx.pluginAuthToken;
   void (async () => {
-    const os77 = createOsStrategy();
+    const os78 = createOsStrategy();
     try {
       const report = await reviewPullRequest(
         {
@@ -30627,7 +30627,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
           baseBranch: parsed.baseBranch
         },
         {
-          runReview: (input) => new CoderabbitRuntimeStrategy(os77).runOneShot(input),
+          runReview: (input) => new CoderabbitRuntimeStrategy(os78).runOneShot(input),
           runGh: (args2) => defaultRunGh(args2),
           postReport: async (r) => {
             if (!token) return;
@@ -30774,7 +30774,7 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
   const readdirSync20 = deps?.readdirSync ?? fs71.readdirSync;
   const statSync19 = deps?.statSync ?? fs71.statSync;
-  const rmSync15 = deps?.rmSync ?? fs71.rmSync;
+  const rmSync16 = deps?.rmSync ?? fs71.rmSync;
   let removed = 0;
   let entries2;
   try {
@@ -30788,7 +30788,7 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
     try {
       const st3 = statSync19(full);
       if (now - st3.mtimeMs < STALE_STAGING_AGE_MS) continue;
-      rmSync15(full, { recursive: true, force: true });
+      rmSync16(full, { recursive: true, force: true });
       removed++;
     } catch {
     }
@@ -31933,11 +31933,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path119 = fileFlag.slice("--token-file=".length);
+    const path120 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs72.readFileSync(path119, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path119} is empty`);
-      rmIfExistsQuiet(path119);
+      const content = fs72.readFileSync(path120, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path120} is empty`);
+      rmIfExistsQuiet(path120);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -41394,7 +41394,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs106 = await import("fs/promises");
+  const fs107 = await import("fs/promises");
   const out2 = [];
   await walk2(workingDir, 0);
   return out2;
@@ -41402,7 +41402,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth2 > maxDepth) return;
     let entries2 = [];
     try {
-      const dirents = await fs106.readdir(dir, { withFileTypes: true });
+      const dirents = await fs107.readdir(dir, { withFileTypes: true });
       entries2 = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -43255,11 +43255,11 @@ function previewMcpServer(bridge) {
   };
 }
 function httpCall(baseUrl, token) {
-  return async (path119, method, body, timeoutMs) => {
+  return async (path120, method, body, timeoutMs) => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetch(`${baseUrl}${path119}`, {
+      const res = await fetch(`${baseUrl}${path120}`, {
         method,
         headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
         ...method === "POST" ? { body: JSON.stringify(body ?? {}) } : {},
@@ -43396,11 +43396,11 @@ function scratchMcpServer(bridge) {
   };
 }
 function httpCall2(baseUrl, token) {
-  return async (path119, method, body, timeoutMs) => {
+  return async (path120, method, body, timeoutMs) => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetch(`${baseUrl}${path119}`, {
+      const res = await fetch(`${baseUrl}${path120}`, {
         method,
         headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
         ...method === "POST" ? { body: JSON.stringify(body ?? {}) } : {},
@@ -52191,11 +52191,49 @@ async function host(args2) {
   );
 }
 
+// src/commands/host/credential-env-store.ts
+var fs97 = __toESM(require("fs"));
+var os69 = __toESM(require("os"));
+var path109 = __toESM(require("path"));
+function credentialEnvPath(deployId) {
+  if (!DEPLOY_ID_RE.test(deployId) || deployId.includes("..")) return null;
+  return path109.join(os69.homedir(), ".codeam", "credential-env", `${deployId}.json`);
+}
+function persistCredentialEnv(deployId, env) {
+  const file = credentialEnvPath(deployId);
+  if (!file) return;
+  try {
+    if (Object.keys(env).length === 0) fs97.rmSync(file, { force: true });
+    else writeJson0600(file, env);
+  } catch (err) {
+    log.warn(
+      "host-agent",
+      `failed to persist the credential env of deploy=${deployId.slice(0, 8)} (best-effort): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function readCredentialEnv(deployId) {
+  const file = credentialEnvPath(deployId);
+  if (!file) return {};
+  try {
+    const parsed = JSON.parse(fs97.readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const out2 = {};
+    for (const [k2, v] of Object.entries(parsed)) if (typeof v === "string") out2[k2] = v;
+    return out2;
+  } catch {
+    return {};
+  }
+}
+function clearCredentialEnv(deployId) {
+  persistCredentialEnv(deployId, {});
+}
+
 // src/commands/host-agent.ts
 var import_node_child_process40 = require("child_process");
-var os74 = __toESM(require("os"));
-var fs103 = __toESM(require("fs"));
-var path115 = __toESM(require("path"));
+var os75 = __toESM(require("os"));
+var fs104 = __toESM(require("fs"));
+var path116 = __toESM(require("path"));
 
 // src/skills/persist-from-payload.ts
 function persistOrClearSkillsFromPayload(skills) {
@@ -52204,13 +52242,13 @@ function persistOrClearSkillsFromPayload(skills) {
 }
 
 // src/commands/host/session-state.ts
-var fs97 = __toESM(require("fs"));
-var os69 = __toESM(require("os"));
-var path109 = __toESM(require("path"));
+var fs98 = __toESM(require("fs"));
+var os70 = __toESM(require("os"));
+var path110 = __toESM(require("path"));
 function hostSessionStatePath(env = process.env) {
   const override = env.CODEAM_HOST_SESSION_STATE_FILE;
   if (override && override.trim()) return override.trim();
-  return path109.join(os69.homedir(), ".codeam", "host-agent-sessions.json");
+  return path110.join(os70.homedir(), ".codeam", "host-agent-sessions.json");
 }
 function isRecord6(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -52221,7 +52259,7 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
   return {
     load() {
       try {
-        const raw = JSON.parse(fs97.readFileSync(file, "utf8"));
+        const raw = JSON.parse(fs98.readFileSync(file, "utf8"));
         return Array.isArray(raw?.sessions) ? raw.sessions.filter(isRecord6) : null;
       } catch {
         return null;
@@ -52229,18 +52267,18 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
     },
     save(list) {
       try {
-        fs97.mkdirSync(path109.dirname(file), { recursive: true, mode: 448 });
+        fs98.mkdirSync(path110.dirname(file), { recursive: true, mode: 448 });
         const tmp = `${file}.${process.pid}.tmp`;
-        fs97.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
+        fs98.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
           mode: 384
         });
-        fs97.renameSync(tmp, file);
+        fs98.renameSync(tmp, file);
       } catch {
       }
     },
     clear() {
       try {
-        fs97.rmSync(file, { force: true });
+        fs98.rmSync(file, { force: true });
       } catch {
       }
     }
@@ -52263,10 +52301,10 @@ function planSessionResume(records, max) {
   return { resume: ordered.slice(0, bound), dropped: ordered.slice(bound) };
 }
 function pickSavedSessionForWorkspace(sessions3, cwd, deployId) {
-  const target = path109.resolve(cwd);
+  const target = path110.resolve(cwd);
   const reconnectable = (s) => !!s.pluginId && !!s.pollSecret && !!s.agent;
   const matches = sessions3.filter(
-    (s) => !!s.cwd && path109.resolve(s.cwd) === target && reconnectable(s)
+    (s) => !!s.cwd && path110.resolve(s.cwd) === target && reconnectable(s)
   );
   if (matches.length > 0) {
     matches.sort((a, b) => b.pairedAt - a.pairedAt);
@@ -52278,11 +52316,11 @@ function pickSavedSessionForWorkspace(sessions3, cwd, deployId) {
 
 // src/commands/host/git-tooling.ts
 var import_node_child_process34 = require("child_process");
-var fs98 = __toESM(require("fs"));
-var os70 = __toESM(require("os"));
-var path110 = __toESM(require("path"));
+var fs99 = __toESM(require("fs"));
+var os71 = __toESM(require("os"));
+var path111 = __toESM(require("path"));
 function codeamBinDir() {
-  return process.env.CODEAM_BIN_DIR ?? path110.join(os70.homedir(), ".codeam", "bin");
+  return process.env.CODEAM_BIN_DIR ?? path111.join(os71.homedir(), ".codeam", "bin");
 }
 var FALLBACK_GH_VERSION = "2.62.0";
 var RELEASE_API = "https://api.github.com/repos/cli/cli/releases/latest";
@@ -52314,7 +52352,7 @@ async function download(url2, dest) {
     const res = await fetch(url2, { headers: { "User-Agent": "codeam-cli" } });
     if (!res.ok || !res.body) return false;
     const buf = Buffer.from(await res.arrayBuffer());
-    fs98.writeFileSync(dest, buf);
+    fs99.writeFileSync(dest, buf);
     return true;
   } catch {
     return false;
@@ -52337,8 +52375,8 @@ async function ensureGhCli(runner, token, deps = {}) {
     const version3 = await resolveVersionFn(token);
     const asset = `gh_${version3}_${osToken}_${arch2}`;
     const url2 = `https://github.com/cli/cli/releases/download/v${version3}/${asset}.${ext}`;
-    const tmpRoot = fs98.mkdtempSync(path110.join(os70.tmpdir(), "codeam-gh-"));
-    const archive = path110.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs99.mkdtempSync(path111.join(os71.tmpdir(), "codeam-gh-"));
+    const archive = path111.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "gh download failed \u2014 skipping (git pull/push still work via the credential helper)");
       return null;
@@ -52348,16 +52386,16 @@ async function ensureGhCli(runner, token, deps = {}) {
       log.warn("host-agent", `gh archive extraction failed (code=${String(extract.code)}) \u2014 skipping`);
       return null;
     }
-    const extractedBin = path110.join(tmpRoot, asset, "bin", binaryName);
-    if (!fs98.existsSync(extractedBin)) {
+    const extractedBin = path111.join(tmpRoot, asset, "bin", binaryName);
+    if (!fs99.existsSync(extractedBin)) {
       log.warn("host-agent", "gh binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs98.mkdirSync(binDir, { recursive: true });
-    const target = path110.join(binDir, binaryName);
-    fs98.copyFileSync(extractedBin, target);
-    fs98.chmodSync(target, 493);
+    fs99.mkdirSync(binDir, { recursive: true });
+    const target = path111.join(binDir, binaryName);
+    fs99.copyFileSync(extractedBin, target);
+    fs99.chmodSync(target, 493);
     log.info("host-agent", `gh installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -52394,19 +52432,19 @@ async function ensureGhAuth(runner, ghCmd, token) {
 }
 function ghConfigDir() {
   if (process.env.GH_CONFIG_DIR) return process.env.GH_CONFIG_DIR;
-  if (process.env.XDG_CONFIG_HOME) return path110.join(process.env.XDG_CONFIG_HOME, "gh");
+  if (process.env.XDG_CONFIG_HOME) return path111.join(process.env.XDG_CONFIG_HOME, "gh");
   if (process.platform === "win32" && process.env.APPDATA) {
-    return path110.join(process.env.APPDATA, "GitHub CLI");
+    return path111.join(process.env.APPDATA, "GitHub CLI");
   }
-  return path110.join(os70.homedir(), ".config", "gh");
+  return path111.join(os71.homedir(), ".config", "gh");
 }
 function writeGhHostsToken(token) {
   try {
     const dir = ghConfigDir();
-    const file = path110.join(dir, "hosts.yml");
-    if (fs98.existsSync(file)) return false;
-    fs98.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs98.writeFileSync(
+    const file = path111.join(dir, "hosts.yml");
+    if (fs99.existsSync(file)) return false;
+    fs99.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs99.writeFileSync(
       file,
       `github.com:
     oauth_token: ${token}
@@ -52449,8 +52487,8 @@ async function ensureGlabCli(runner, deps = {}) {
     const version3 = await resolveLatestGlabVersion();
     const asset = `glab_${version3}_${osToken}_${arch2}`;
     const url2 = `https://gitlab.com/gitlab-org/cli/-/releases/v${version3}/downloads/${asset}.${ext}`;
-    const tmpRoot = fs98.mkdtempSync(path110.join(os70.tmpdir(), "codeam-glab-"));
-    const archive = path110.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs99.mkdtempSync(path111.join(os71.tmpdir(), "codeam-glab-"));
+    const archive = path111.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "glab download failed \u2014 skipping (git push/pull still work)");
       return null;
@@ -52461,20 +52499,20 @@ async function ensureGlabCli(runner, deps = {}) {
       return null;
     }
     const candidates = [
-      path110.join(tmpRoot, "bin", binaryName),
-      path110.join(tmpRoot, asset, "bin", binaryName),
-      path110.join(tmpRoot, binaryName)
+      path111.join(tmpRoot, "bin", binaryName),
+      path111.join(tmpRoot, asset, "bin", binaryName),
+      path111.join(tmpRoot, binaryName)
     ];
-    const extractedBin = candidates.find((c2) => fs98.existsSync(c2));
+    const extractedBin = candidates.find((c2) => fs99.existsSync(c2));
     if (!extractedBin) {
       log.warn("host-agent", "glab binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs98.mkdirSync(binDir, { recursive: true });
-    const target = path110.join(binDir, binaryName);
-    fs98.copyFileSync(extractedBin, target);
-    fs98.chmodSync(target, 493);
+    fs99.mkdirSync(binDir, { recursive: true });
+    const target = path111.join(binDir, binaryName);
+    fs99.copyFileSync(extractedBin, target);
+    fs99.chmodSync(target, 493);
     log.info("host-agent", `glab installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -52553,14 +52591,14 @@ var defaultGitToolingRunner = {
 };
 
 // src/lib/cli-versions.ts
+var fs101 = __toESM(require("fs"));
+var os73 = __toESM(require("os"));
+var path113 = __toESM(require("path"));
+
+// src/lib/updateNotifier.ts
 var fs100 = __toESM(require("fs"));
 var os72 = __toESM(require("os"));
 var path112 = __toESM(require("path"));
-
-// src/lib/updateNotifier.ts
-var fs99 = __toESM(require("fs"));
-var os71 = __toESM(require("os"));
-var path111 = __toESM(require("path"));
 var https8 = __toESM(require("https"));
 var import_node_child_process35 = require("child_process");
 var import_picocolors12 = __toESM(require("picocolors"));
@@ -52569,12 +52607,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path111.join(os71.homedir(), ".codeam");
-  return path111.join(dir, "update-check.json");
+  const dir = path112.join(os72.homedir(), ".codeam");
+  return path112.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs99.readFileSync(cachePath(), "utf8");
+    const raw = fs100.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -52585,10 +52623,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs99.mkdirSync(path111.dirname(file), { recursive: true });
+    fs100.mkdirSync(path112.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs99.writeFileSync(tmp, JSON.stringify(cache));
-    fs99.renameSync(tmp, file);
+    fs100.writeFileSync(tmp, JSON.stringify(cache));
+    fs100.renameSync(tmp, file);
   } catch {
   }
 }
@@ -52662,8 +52700,8 @@ function isLinkedInstall() {
       timeout: 2e3
     }).trim();
     if (!root) return false;
-    const pkgPath = path111.join(root, PKG_NAME);
-    return fs99.lstatSync(pkgPath).isSymbolicLink();
+    const pkgPath = path112.join(root, PKG_NAME);
+    return fs100.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -52699,7 +52737,7 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs99.unlinkSync(cachePath());
+    fs100.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors12.default.green("\u2713")} Updated. Resuming session...
@@ -52715,7 +52753,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.76.46" : null;
+  const current2 = true ? "2.76.47" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -52732,7 +52770,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.76.46" : null;
+  const current2 = true ? "2.76.47" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -52755,10 +52793,10 @@ function versionedModeSupported(platform3 = process.platform) {
   return platform3 !== "win32";
 }
 function cliVersionsRoot(env = process.env) {
-  return env.CODEAM_CLI_VERSIONS_DIR || path112.join(os72.homedir(), ".codeam", "cli");
+  return env.CODEAM_CLI_VERSIONS_DIR || path113.join(os73.homedir(), ".codeam", "cli");
 }
 function packageDirOf(versionDir) {
-  return path112.join(versionDir, "node_modules", CLI_PKG);
+  return path113.join(versionDir, "node_modules", CLI_PKG);
 }
 function isRecord7(v) {
   return typeof v === "object" && v !== null;
@@ -52766,7 +52804,7 @@ function isRecord7(v) {
 function readPkg2(versionDir) {
   try {
     const raw = JSON.parse(
-      fs100.readFileSync(path112.join(packageDirOf(versionDir), "package.json"), "utf8")
+      fs101.readFileSync(path113.join(packageDirOf(versionDir), "package.json"), "utf8")
     );
     return isRecord7(raw) ? raw : null;
   } catch {
@@ -52779,15 +52817,15 @@ function entryOf(versionDir) {
   const bin = pkg.bin;
   const named = isRecord7(bin) ? bin.codeam : void 0;
   const rel = typeof bin === "string" ? bin : typeof named === "string" ? named : "dist/index.js";
-  const entry = path112.join(packageDirOf(versionDir), rel);
-  return fs100.existsSync(entry) ? entry : null;
+  const entry = path113.join(packageDirOf(versionDir), rel);
+  return fs101.existsSync(entry) ? entry : null;
 }
 function launcherOf(versionDir) {
   const entry = entryOf(versionDir);
   if (!entry) return null;
-  const bin = path112.join(versionDir, "node_modules", ".bin", "codeam");
+  const bin = path113.join(versionDir, "node_modules", ".bin", "codeam");
   try {
-    return fs100.realpathSync(bin) === fs100.realpathSync(entry) ? bin : entry;
+    return fs101.realpathSync(bin) === fs101.realpathSync(entry) ? bin : entry;
   } catch {
     return entry;
   }
@@ -52800,16 +52838,16 @@ var BAD_MARKER_TTL_MS = 24 * 60 * 6e4;
 var PRE_READY_WINDOW_MS = 60 * 6e4;
 function isBad(versionDir, now = Date.now()) {
   try {
-    return now - fs100.statSync(path112.join(versionDir, ".bad")).mtimeMs < BAD_MARKER_TTL_MS;
+    return now - fs101.statSync(path113.join(versionDir, ".bad")).mtimeMs < BAD_MARKER_TTL_MS;
   } catch {
     return false;
   }
 }
 function recordPreReadyFailure(versionDir, now = Date.now()) {
-  const file = path112.join(versionDir, ".prefail");
+  const file = path113.join(versionDir, ".prefail");
   let count = 0;
   try {
-    const [n, at3] = fs100.readFileSync(file, "utf8").trim().split(" ").map(Number);
+    const [n, at3] = fs101.readFileSync(file, "utf8").trim().split(" ").map(Number);
     if (Number.isFinite(n) && Number.isFinite(at3) && now - at3 < PRE_READY_WINDOW_MS) {
       count = n;
     }
@@ -52817,45 +52855,45 @@ function recordPreReadyFailure(versionDir, now = Date.now()) {
   }
   count += 1;
   try {
-    fs100.writeFileSync(file, `${count} ${now}`);
+    fs101.writeFileSync(file, `${count} ${now}`);
   } catch {
   }
   return count;
 }
 function clearPreReadyFailures(versionDir) {
-  fs100.rmSync(path112.join(versionDir, ".prefail"), { force: true });
+  fs101.rmSync(path113.join(versionDir, ".prefail"), { force: true });
 }
 function markBad(versionDir, reason) {
   try {
-    fs100.writeFileSync(path112.join(versionDir, ".bad"), `${(/* @__PURE__ */ new Date()).toISOString()} ${reason}
+    fs101.writeFileSync(path113.join(versionDir, ".bad"), `${(/* @__PURE__ */ new Date()).toISOString()} ${reason}
 `);
   } catch {
   }
 }
 function pointerTarget(root, name) {
   try {
-    return fs100.realpathSync(path112.join(root, name));
+    return fs101.realpathSync(path113.join(root, name));
   } catch {
     return null;
   }
 }
 function atomicPoint(root, name, targetDir) {
-  const realRoot = fs100.realpathSync(root);
-  const tmp = path112.join(realRoot, `.${name}.tmp-${process.pid}-${Date.now()}`);
-  fs100.symlinkSync(path112.relative(realRoot, fs100.realpathSync(targetDir)), tmp, "dir");
+  const realRoot = fs101.realpathSync(root);
+  const tmp = path113.join(realRoot, `.${name}.tmp-${process.pid}-${Date.now()}`);
+  fs101.symlinkSync(path113.relative(realRoot, fs101.realpathSync(targetDir)), tmp, "dir");
   try {
-    fs100.renameSync(tmp, path112.join(realRoot, name));
+    fs101.renameSync(tmp, path113.join(realRoot, name));
   } catch (err) {
-    fs100.rmSync(tmp, { force: true });
+    fs101.rmSync(tmp, { force: true });
     throw err;
   }
 }
 function samePath(a, b) {
   const canon = (p2) => {
     try {
-      return fs100.realpathSync(p2);
+      return fs101.realpathSync(p2);
     } catch {
-      return path112.resolve(p2);
+      return path113.resolve(p2);
     }
   };
   return canon(a) === canon(b);
@@ -52890,15 +52928,15 @@ function versionDirContaining(root, file) {
   let real;
   let realRoot;
   try {
-    real = fs100.realpathSync(file);
-    realRoot = fs100.realpathSync(root);
+    real = fs101.realpathSync(file);
+    realRoot = fs101.realpathSync(root);
   } catch {
     return null;
   }
-  const rel = path112.relative(realRoot, real);
-  if (rel.startsWith("..") || path112.isAbsolute(rel)) return null;
-  const first = rel.split(path112.sep)[0];
-  return first && SEMVER_DIR.test(first) ? path112.join(realRoot, first) : null;
+  const rel = path113.relative(realRoot, real);
+  if (rel.startsWith("..") || path113.isAbsolute(rel)) return null;
+  const first = rel.split(path113.sep)[0];
+  return first && SEMVER_DIR.test(first) ? path113.join(realRoot, first) : null;
 }
 function pidAlive3(pid) {
   try {
@@ -52911,9 +52949,9 @@ function pidAlive3(pid) {
 var CLK_TCK = 100;
 function processStartMs(pid) {
   try {
-    const stat3 = fs100.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const stat3 = fs101.readFileSync(`/proc/${pid}/stat`, "utf8");
     const ticks = Number(stat3.slice(stat3.lastIndexOf(")") + 2).split(" ")[19]);
-    const btime = /^btime (\d+)$/m.exec(fs100.readFileSync("/proc/stat", "utf8"))?.[1];
+    const btime = /^btime (\d+)$/m.exec(fs101.readFileSync("/proc/stat", "utf8"))?.[1];
     if (!Number.isFinite(ticks) || !btime) return null;
     return Number(btime) * 1e3 + ticks * 1e3 / CLK_TCK;
   } catch {
@@ -52922,10 +52960,10 @@ function processStartMs(pid) {
 }
 var PID_REUSE_SLACK_MS = 2e3;
 function livePids(versionDir) {
-  const dir = path112.join(versionDir, ".pids");
+  const dir = path113.join(versionDir, ".pids");
   let names;
   try {
-    names = fs100.readdirSync(dir);
+    names = fs101.readdirSync(dir);
   } catch {
     return [];
   }
@@ -52934,7 +52972,7 @@ function livePids(versionDir) {
     const started = processStartMs(pid);
     if (started === null) return true;
     try {
-      return started <= fs100.statSync(path112.join(dir, String(pid))).mtimeMs + PID_REUSE_SLACK_MS;
+      return started <= fs101.statSync(path113.join(dir, String(pid))).mtimeMs + PID_REUSE_SLACK_MS;
     } catch {
       return true;
     }
@@ -52943,11 +52981,11 @@ function livePids(versionDir) {
 function registerRunningVersion(root = cliVersionsRoot(), entry = process.argv[1]) {
   const dir = versionDirContaining(root, entry);
   if (!dir) return;
-  const file = path112.join(dir, ".pids", String(process.pid));
+  const file = path113.join(dir, ".pids", String(process.pid));
   try {
-    fs100.mkdirSync(path112.dirname(file), { recursive: true });
-    fs100.writeFileSync(file, "");
-    process.once("exit", () => fs100.rmSync(file, { force: true }));
+    fs101.mkdirSync(path113.dirname(file), { recursive: true });
+    fs101.writeFileSync(file, "");
+    process.once("exit", () => fs101.rmSync(file, { force: true }));
   } catch {
   }
 }
@@ -52955,7 +52993,7 @@ function gcVersions(root) {
   const removed = [];
   let names;
   try {
-    names = fs100.readdirSync(root).filter((n) => SEMVER_DIR.test(n));
+    names = fs101.readdirSync(root).filter((n) => SEMVER_DIR.test(n));
   } catch {
     return removed;
   }
@@ -52963,13 +53001,13 @@ function gcVersions(root) {
     [...names].sort((a, b) => compareSemver(b, a)).slice(0, GC_KEEP_NEWEST)
   );
   for (const p2 of [pointerTarget(root, "current"), pointerTarget(root, "previous")]) {
-    if (p2) keep.add(path112.basename(p2));
+    if (p2) keep.add(path113.basename(p2));
   }
   for (const name of names) {
-    const dir = path112.join(root, name);
+    const dir = path113.join(root, name);
     if (keep.has(name) || livePids(dir).length > 0) continue;
     try {
-      fs100.rmSync(dir, { recursive: true, force: true });
+      fs101.rmSync(dir, { recursive: true, force: true });
       removed.push(name);
     } catch {
     }
@@ -52977,25 +53015,25 @@ function gcVersions(root) {
   return removed;
 }
 function acquireInstallLock(root) {
-  const lock = path112.join(root, ".install.lock");
+  const lock = path113.join(root, ".install.lock");
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs100.openSync(lock, "wx");
-      fs100.writeSync(fd, String(process.pid));
-      fs100.closeSync(fd);
-      return () => fs100.rmSync(lock, { force: true });
+      const fd = fs101.openSync(lock, "wx");
+      fs101.writeSync(fd, String(process.pid));
+      fs101.closeSync(fd);
+      return () => fs101.rmSync(lock, { force: true });
     } catch (err) {
       if (err.code !== "EEXIST") return null;
       let stale = false;
       try {
-        const owner = Number(fs100.readFileSync(lock, "utf8"));
-        const age = Date.now() - fs100.statSync(lock).mtimeMs;
+        const owner = Number(fs101.readFileSync(lock, "utf8"));
+        const age = Date.now() - fs101.statSync(lock).mtimeMs;
         stale = !Number.isInteger(owner) || !pidAlive3(owner) || age > LOCK_STALE_MS;
       } catch {
         stale = true;
       }
       if (!stale) return null;
-      fs100.rmSync(lock, { force: true });
+      fs101.rmSync(lock, { force: true });
     }
   }
   return null;
@@ -53003,9 +53041,9 @@ function acquireInstallLock(root) {
 
 // src/commands/host/host-launch.ts
 var import_node_child_process37 = require("child_process");
-var fs102 = __toESM(require("fs"));
-var os73 = __toESM(require("os"));
-var path114 = __toESM(require("path"));
+var fs103 = __toESM(require("fs"));
+var os74 = __toESM(require("os"));
+var path115 = __toESM(require("path"));
 
 // src/exit-codes.ts
 var EXIT_OK = 0;
@@ -53027,8 +53065,8 @@ var EXIT_CODE_NAMES = {
 
 // src/commands/host/self-update.ts
 var import_node_child_process36 = require("child_process");
-var fs101 = __toESM(require("fs"));
-var path113 = __toESM(require("path"));
+var fs102 = __toESM(require("fs"));
+var path114 = __toESM(require("path"));
 var SELF_UPDATE_PKG = "codeam-cli";
 var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_STARTUP_DELAY_MS = 5e3;
@@ -53038,7 +53076,7 @@ var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 function currentCliVersion() {
-  return true ? "2.76.46" : null;
+  return true ? "2.76.47" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -53154,9 +53192,9 @@ function collectOldVersions(root) {
 var VERIFY_TIMEOUT_MS = 3e4;
 async function installVersioned(deps, root, latest, running2) {
   const node = deps.nodePath ?? process.execPath;
-  const target = path113.join(root, latest);
+  const target = path114.join(root, latest);
   try {
-    fs101.mkdirSync(root, { recursive: true });
+    fs102.mkdirSync(root, { recursive: true });
   } catch {
     return { status: "skipped" };
   }
@@ -53180,7 +53218,7 @@ async function installVersioned(deps, root, latest, running2) {
     }
     const reusable = entryOf(target) && versionOf(target) === latest;
     if (!reusable) {
-      fs101.rmSync(target, { recursive: true, force: true });
+      fs102.rmSync(target, { recursive: true, force: true });
       const install = await deps.run(
         "npm",
         [
@@ -53195,7 +53233,7 @@ async function installVersioned(deps, root, latest, running2) {
         SELF_UPDATE_INSTALL_TIMEOUT_MS
       );
       if (install.code !== 0) {
-        fs101.rmSync(target, { recursive: true, force: true });
+        fs102.rmSync(target, { recursive: true, force: true });
         log.warn(
           "host-agent",
           `self-update: versioned install exited ${String(install.code)} \u2014 staying on ${running2}: ` + install.stderr.slice(-300)
@@ -53206,7 +53244,7 @@ async function installVersioned(deps, root, latest, running2) {
     const entry = entryOf(target);
     const check = entry ? await deps.run(node, [entry, "--version"], VERIFY_TIMEOUT_MS) : { code: null, stdout: "", stderr: "no entry point" };
     if (check.code !== 0 || !check.stdout.includes(latest)) {
-      fs101.rmSync(target, { recursive: true, force: true });
+      fs102.rmSync(target, { recursive: true, force: true });
       log.warn(
         "host-agent",
         `self-update: ${latest} failed verification (exit ${String(check.code)}: ${(check.stdout + check.stderr).trim().slice(-200)}) \u2014 staying on ${running2}`
@@ -53222,7 +53260,7 @@ async function installVersioned(deps, root, latest, running2) {
     return { status: "updated", version: latest };
   } catch (err) {
     const cur = pointerTarget(root, "current");
-    if (!cur || path113.basename(cur) !== latest) fs101.rmSync(target, { recursive: true, force: true });
+    if (!cur || path114.basename(cur) !== latest) fs102.rmSync(target, { recursive: true, force: true });
     log.warn(
       "host-agent",
       `self-update: versioned install failed: ${err instanceof Error ? err.message : String(err)}`
@@ -53261,7 +53299,7 @@ function signalHostReady(send = process.send?.bind(process)) {
 }
 function defaultDeps() {
   return {
-    ownVersion: true ? "2.76.46" : null,
+    ownVersion: true ? "2.76.47" : null,
     root: cliVersionsRoot(),
     args: process.argv.slice(3),
     execPath: process.execPath,
@@ -53358,13 +53396,13 @@ function needsSelfRelaunch(env = process.env, pid = process.pid, ctx = {}) {
 }
 function readPid1Cmdline() {
   try {
-    return fs102.readFileSync("/proc/1/cmdline", "utf8").split("\0").filter(Boolean);
+    return fs103.readFileSync("/proc/1/cmdline", "utf8").split("\0").filter(Boolean);
   } catch {
     return [];
   }
 }
 function isOurTiniEntrypoint(argv) {
-  return argv.some((a) => path114.basename(a) === "tini") && argv.includes("host-agent");
+  return argv.some((a) => path115.basename(a) === "tini") && argv.includes("host-agent");
 }
 function relaunchArgv(execPath, argv) {
   return ["-c", 'sleep 2; exec "$0" "$@"', execPath, ...argv.slice(1)];
@@ -53406,7 +53444,7 @@ function defaultRestartForUpdate(version3, supervised, io = {}) {
   }
   exit(0);
 }
-function isContainerEnvironment(existsSyncFn = fs102.existsSync, readFileSyncFn = (p2) => fs102.readFileSync(p2, "utf8")) {
+function isContainerEnvironment(existsSyncFn = fs103.existsSync, readFileSyncFn = (p2) => fs103.readFileSync(p2, "utf8")) {
   try {
     if (existsSyncFn("/.dockerenv")) return true;
   } catch {
@@ -53418,16 +53456,16 @@ function isContainerEnvironment(existsSyncFn = fs102.existsSync, readFileSyncFn
   }
   return false;
 }
-function hostAgentPidFile(home = os73.homedir()) {
-  return path114.join(home, ".codeam", "host-agent.pid");
+function hostAgentPidFile(home = os74.homedir()) {
+  return path115.join(home, ".codeam", "host-agent.pid");
 }
 function writeHostAgentPidFile(file = hostAgentPidFile(), pid = process.pid) {
   try {
-    fs102.mkdirSync(path114.dirname(file), { recursive: true });
-    fs102.writeFileSync(file, String(pid));
+    fs103.mkdirSync(path115.dirname(file), { recursive: true });
+    fs103.writeFileSync(file, String(pid));
     process.once("exit", () => {
       try {
-        if (fs102.readFileSync(file, "utf8").trim() === String(pid)) fs102.rmSync(file, { force: true });
+        if (fs103.readFileSync(file, "utf8").trim() === String(pid)) fs103.rmSync(file, { force: true });
       } catch {
       }
     });
@@ -54280,13 +54318,13 @@ var HostAgentSupervisor = class {
     const relay = this.relay;
     if (!relay) return;
     const raw = cmd.payload?.path;
-    const target = typeof raw === "string" && raw.trim() ? path115.resolve(raw.trim()) : os74.homedir();
+    const target = typeof raw === "string" && raw.trim() ? path116.resolve(raw.trim()) : os75.homedir();
     try {
-      const dirents = await fs103.promises.readdir(target, { withFileTypes: true });
+      const dirents = await fs104.promises.readdir(target, { withFileTypes: true });
       const entries2 = dirents.filter((d3) => !d3.name.startsWith(".")).map((d3) => ({ name: d3.name, isDir: d3.isDirectory() })).sort(
         (a, b) => a.isDir === b.isDir ? a.name.localeCompare(b.name) : a.isDir ? -1 : 1
       );
-      const parent = path115.dirname(target);
+      const parent = path116.dirname(target);
       await relay.sendResult(cmd.id, "completed", {
         path: target,
         // null at the filesystem root so the UI can hide the ".." affordance.
@@ -54764,14 +54802,14 @@ var HostAgentSupervisor = class {
           }),
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        const houseConfigDir = path115.join(
-          os74.homedir(),
+        const houseConfigDir = path116.join(
+          os75.homedir(),
           ".codeam",
           "house-claude",
           payload.deployId
         );
         try {
-          fs103.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
+          fs104.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
         } catch {
         }
         childEnv.CLAUDE_CONFIG_DIR = houseConfigDir;
@@ -54788,6 +54826,7 @@ var HostAgentSupervisor = class {
         const credEnv = provisionAgentCredentials(payload.agentId, auth, void 0);
         if (Object.keys(credEnv).length > 0) this.credentialEnvByDeploy.set(payload.deployId, credEnv);
         else this.credentialEnvByDeploy.delete(payload.deployId);
+        persistCredentialEnv(payload.deployId, credEnv);
         childEnv = {
           ...credEnv,
           CODEAM_AUTO_TOKEN: payload.autoPairToken
@@ -54800,7 +54839,7 @@ var HostAgentSupervisor = class {
         report("installing", "installing agent CLI");
         await this.runAgentInstall(payload.agentInstallScript);
       }
-      const home = process.env.HOME || os74.homedir();
+      const home = process.env.HOME || os75.homedir();
       childEnv.PATH = `${home}/.local/bin:${process.env.PATH ?? ""}`;
       if (payload.cloneToken) {
         try {
@@ -54808,13 +54847,13 @@ var HostAgentSupervisor = class {
           if ((payload.repoProvider ?? "github") === "gitlab") {
             const glabCmd = await ensureGlabCli(defaultGitToolingRunner);
             if (glabCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path115.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path116.delimiter}${childEnv.PATH}`;
               await ensureGlabAuth(defaultGitToolingRunner, glabCmd, payload.cloneToken);
             }
           } else {
             const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
             if (ghCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path115.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path116.delimiter}${childEnv.PATH}`;
               await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
             }
           }
@@ -54842,9 +54881,9 @@ var HostAgentSupervisor = class {
       );
       if (!payload.suppressOnboardingWelcome) {
         try {
-          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path115.join(os74.homedir(), ".claude");
-          const projectDir = path115.join(cfgDir, "projects", encodeCwd(cwd));
-          const hasPriorConversation = fs103.existsSync(projectDir) && fs103.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
+          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path116.join(os75.homedir(), ".claude");
+          const projectDir = path116.join(cfgDir, "projects", encodeCwd(cwd));
+          const hasPriorConversation = fs104.existsSync(projectDir) && fs104.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
           if (hasPriorConversation) {
             childEnv.CODEAM_RESUME_LATEST = "1";
             log.info(
@@ -54998,7 +55037,7 @@ var HostAgentSupervisor = class {
   fallbackResumeTarget() {
     const session = getActiveSession();
     if (!session || !session.pluginId || !session.pollSecret || !session.agent) return null;
-    const cwd = session.cwd && fs103.existsSync(session.cwd) ? session.cwd : process.cwd();
+    const cwd = session.cwd && fs104.existsSync(session.cwd) ? session.cwd : process.cwd();
     if (isFilesystemRoot(cwd)) {
       log.warn(
         "host-agent",
@@ -55045,7 +55084,7 @@ var HostAgentSupervisor = class {
       log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: no saved pairing on this box`);
       return;
     }
-    if (!session.cwd || !fs103.existsSync(session.cwd)) {
+    if (!session.cwd || !fs104.existsSync(session.cwd)) {
       log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: workspace is gone`);
       return;
     }
@@ -55087,7 +55126,7 @@ var HostAgentSupervisor = class {
       const persisted = new Map((this.sessionStore.load() ?? []).map((r) => [r.deployId, r.agent]));
       for (const c2 of this.children.values()) persisted.set(c2.deployId, c2.agent);
       return this.listSavedSessions().map((s) => ({ s, deployId: deployIdFromWorkspace(s.cwd) })).filter(
-        (x) => x.deployId !== null && !!x.s.cwd && fs103.existsSync(x.s.cwd)
+        (x) => x.deployId !== null && !!x.s.cwd && fs104.existsSync(x.s.cwd)
       ).map(({ s, deployId }) => {
         const agent = persisted.get(deployId);
         return { deployId, sessionId: s.id, ...agent ? { agent } : {} };
@@ -55172,7 +55211,7 @@ var HostAgentSupervisor = class {
     if (this.children.has(deployId)) return;
     const st3 = this.resumeStateFor(target);
     try {
-      const cwd = fs103.existsSync(target.cwd) ? target.cwd : process.cwd();
+      const cwd = fs104.existsSync(target.cwd) ? target.cwd : process.cwd();
       if (isWrapperCheckout(cwd)) {
         log.warn(
           "host-agent",
@@ -55187,7 +55226,7 @@ var HostAgentSupervisor = class {
       const proc = this.resumeSpawner(
         {
           ...readHouseProxyChildEnv(deployId),
-          ...this.credentialEnvByDeploy.get(deployId) ?? {},
+          ...this.credentialEnvFor(deployId),
           CODEAM_RESUME_SESSION_ID: session.id
         },
         cwd
@@ -55214,7 +55253,7 @@ var HostAgentSupervisor = class {
           return;
         }
         if (tracked && signal) {
-          this.onResumeChildExit(target, 128 + (os74.constants.signals[signal] ?? 9), `signal ${signal}`);
+          this.onResumeChildExit(target, 128 + (os75.constants.signals[signal] ?? 9), `signal ${signal}`);
           return;
         }
         log.warn(
@@ -55257,7 +55296,7 @@ var HostAgentSupervisor = class {
     if (Date.now() - child.startedAt < CRASH_RESPAWN_MIN_UPTIME_MS) return false;
     const session = pickSavedSessionForWorkspace(this.listSavedSessions(), child.cwd);
     if (!session) return false;
-    const exitCode = typeof code === "number" ? code : 128 + (signal ? os74.constants.signals[signal] ?? 9 : 9);
+    const exitCode = typeof code === "number" ? code : 128 + (signal ? os75.constants.signals[signal] ?? 9 : 9);
     log.warn(
       "host-agent",
       `session deploy=${child.deployId.slice(0, 8)} died (${signal ?? code}) after ${Math.round((Date.now() - child.startedAt) / 1e3)}s \u2014 respawning it (resume)`
@@ -55398,6 +55437,7 @@ var HostAgentSupervisor = class {
   cleanupWorkspace(deployId) {
     const short = deployId.slice(0, 8);
     this.credentialEnvByDeploy.delete(deployId);
+    clearCredentialEnv(deployId);
     const child = this.children.get(deployId);
     if (child) {
       try {
@@ -55407,12 +55447,12 @@ var HostAgentSupervisor = class {
       this.untrackChild(deployId);
     }
     const dirs = [
-      path115.join(selfHostedWorkspaceRoot(), deployId),
-      path115.join(os74.homedir(), ".codeam", "house-claude", deployId)
+      path116.join(selfHostedWorkspaceRoot(), deployId),
+      path116.join(os75.homedir(), ".codeam", "house-claude", deployId)
     ];
     for (const dir of dirs) {
       try {
-        fs103.rmSync(dir, { recursive: true, force: true });
+        fs104.rmSync(dir, { recursive: true, force: true });
       } catch (err) {
         log.warn(
           "host-agent",
@@ -55449,6 +55489,7 @@ var HostAgentSupervisor = class {
       if (Object.keys(credEnv).length === 0 && AUTH_FILE_CACHED_IN_MEMORY.has(payload.agentId)) {
         for (const child of affected) {
           this.credentialEnvByDeploy.delete(child.deployId);
+          clearCredentialEnv(child.deployId);
           this.restartWithFreshCredentials(child);
         }
         log.info(
@@ -55458,7 +55499,10 @@ var HostAgentSupervisor = class {
         return;
       }
       if (Object.keys(credEnv).length === 0) {
-        for (const c2 of affected) this.credentialEnvByDeploy.delete(c2.deployId);
+        for (const c2 of affected) {
+          this.credentialEnvByDeploy.delete(c2.deployId);
+          clearCredentialEnv(c2.deployId);
+        }
         log.info(
           "host-agent",
           `refreshed credentials in place for agent=${payload.agentId} (${this.children.size} active child(ren))`
@@ -55467,6 +55511,7 @@ var HostAgentSupervisor = class {
       }
       for (const child of affected) {
         this.credentialEnvByDeploy.set(child.deployId, credEnv);
+        persistCredentialEnv(child.deployId, credEnv);
         this.restartWithFreshCredentials(child);
       }
       log.info(
@@ -55486,6 +55531,17 @@ var HostAgentSupervisor = class {
    * reports `ended` nor crash-respawns), then resume the same conversation;
    * `resumeOne` waits out the dying daemon if it still holds the session.
    */
+  /**
+   * The env credential of a deploy for a (re)spawn: memory first, else what an earlier host-agent
+   * process persisted (a Box rebuilt on its volume, a wake, a self-update restart).
+   */
+  credentialEnvFor(deployId) {
+    const inMemory = this.credentialEnvByDeploy.get(deployId);
+    if (inMemory) return inMemory;
+    const persisted = readCredentialEnv(deployId);
+    if (Object.keys(persisted).length > 0) this.credentialEnvByDeploy.set(deployId, persisted);
+    return persisted;
+  }
   restartWithFreshCredentials(child) {
     const session = pickSavedSessionForWorkspace(this.listSavedSessions(), child.cwd, child.deployId);
     if (!session) {
@@ -55642,8 +55698,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util11 = require("util");
 var import_node_crypto17 = require("crypto");
-var fs104 = __toESM(require("fs"));
-var path116 = __toESM(require("path"));
+var fs105 = __toESM(require("fs"));
+var path117 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util11.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -55699,13 +55755,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path116.join(require("os").homedir(), ".codeam");
+  const dir = path117.join(require("os").homedir(), ".codeam");
   try {
-    fs104.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path116.join(dir, ".doctor-probe");
-    fs104.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs104.readFileSync(probe, "utf8");
-    fs104.unlinkSync(probe);
+    fs105.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path117.join(dir, ".doctor-probe");
+    fs105.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs105.readFileSync(probe, "utf8");
+    fs105.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -55745,9 +55801,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os77 = createOsStrategy();
+  const os78 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os77.findInPath(meta.binaryName);
+    const found = os78.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -55769,7 +55825,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path116.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path117.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -55811,7 +55867,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.76.46" : "0.0.0-dev";
+  const cliVersion = true ? "2.76.47" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto17.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -56347,7 +56403,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.76.46" : "unknown";
+  const v = true ? "2.76.47" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -56480,10 +56536,10 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/index.ts
-var os76 = __toESM(require("os"));
+var os77 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os76.homedir();
+    const home = os77.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }