@akshar5/cohall 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.10.2](https://github.com/AksharP5/cohall/compare/v0.10.1...v0.10.2) (2026-10-04)
+
+
+### Bug Fixes
+
+* **client:** cancel pairing response body reads ([#165](https://github.com/AksharP5/cohall/issues/165)) ([92702ee](https://github.com/AksharP5/cohall/commit/92702eed5ce582f7086fa12f45bd5acb1cc80a24))
+* **device:** allow workspace names beginning with two dots ([#163](https://github.com/AksharP5/cohall/issues/163)) ([5764e37](https://github.com/AksharP5/cohall/commit/5764e37935502e861316c46b36b0e0db868a66c4))
+* **device:** reject attachment FIFOs without blocking ([#162](https://github.com/AksharP5/cohall/issues/162)) ([7eae2ca](https://github.com/AksharP5/cohall/commit/7eae2ca46d1dfbbb6fa91a0236d137b52dc0f9c3))
+* **mcp:** stop cancelled attachment downloads before writing ([#164](https://github.com/AksharP5/cohall/issues/164)) ([1b91dc4](https://github.com/AksharP5/cohall/commit/1b91dc453e44f72051729fe32787d33b1d275b4e))
+* **relay:** change addresses while workers are connected ([#166](https://github.com/AksharP5/cohall/issues/166)) ([87c3baa](https://github.com/AksharP5/cohall/commit/87c3baa886bd887bb7aaf00d76bcea44e8cbe000))
+
 ## [0.10.1](https://github.com/AksharP5/cohall/compare/v0.10.0...v0.10.1) (2026-10-04)
 
 

package/bin/cohall.js

@@ -17,7 +17,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Effect, Schema } from "effect";
-var version = "0.10.1", maxSocketPayloadBytes, maxAttachmentBytes, maxTaskAttachments = 2, maxProgressNoteBytes = 1024, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.10.2", maxSocketPayloadBytes, maxAttachmentBytes, maxTaskAttachments = 2, maxProgressNoteBytes = 1024, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
 })).pipe(Schema.brand(name)), BotId, Bot, DeviceId, ThreadId, MessageId, TaskId, TaskRequestId, TaskRunId, ClarificationId, AuthSessionId, OperationId, Timestamp, TaskDeadline, taskDeadlineError = "Task deadline exceeded", taskDeadlinePassed = (task, time = Date.now()) => task.expiresAt !== undefined && Date.parse(task.expiresAt) <= time, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, maxDevicePageDevices = 16, maxDevicePageResponseBytes, DevicePage, minimumDeviceOperationVersion = "0.5.0", parsedVersion = (value) => {
   const match = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
@@ -2713,6 +2713,14 @@ Content-Length: 0\r
         return yield* store.exchangePairing(input.token);
       })).then((value) => json(value, 201)).catch(() => json({ error: "Pairing credential is invalid, expired, or already used" }, 401));
     }
+    if (url.pathname === "/api/device/credential" && request.method === "GET") {
+      const authorization = request.headers.get("authorization");
+      const token = authorization?.startsWith("Bearer ") === true ? authorization.slice("Bearer ".length) : undefined;
+      if (token === undefined || await authenticate(token, "device") === undefined) {
+        return json({ error: "Unauthorized" }, 401);
+      }
+      return json({ ok: true });
+    }
     const attachmentRoute = request.method === "GET" && /^\/api\/tasks\/[^/]+\/attachments(?:\/[^/]+)?$/.test(url.pathname);
     const progressRoute = request.method === "POST" && /^\/api\/tasks\/[^/]+\/progress$/.test(url.pathname);
     const inputRoute = request.method === "POST" && /^\/api\/tasks\/[^/]+\/input$/.test(url.pathname);
@@ -3174,6 +3182,7 @@ var make = (options) => {
   });
   const devicePage = (after) => request("RelayClient.devices", `/api/devices/page${after === undefined ? "" : `?after=${encodeURIComponent(after)}`}`, DevicePage, undefined, maxDevicePageResponseBytes);
   return Service.of({
+    verifyDeviceCredential: () => request("RelayClient.verifyDeviceCredential", "/api/device/credential", Schema2.Struct({ ok: Schema2.Literal(true) })).pipe(Effect2.asVoid),
     devices: () => Effect2.gen(function* () {
       const first = yield* devicePage().pipe(Effect2.catch((cause) => cause instanceof RelayRequestError && cause.status === 404 ? request("RelayClient.devices", "/api/devices", Schema2.Array(Device)) : Effect2.fail(cause)));
       if (!("devices" in first))
@@ -3317,29 +3326,30 @@ var make = (options) => {
 };
 var exchangePairing = (baseUrl, input) => Effect2.gen(function* () {
   const operation = "RelayClient.exchangePairing";
-  const response = yield* Effect2.tryPromise({
-    try: (signal) => fetch(`${normalizeBaseUrl(baseUrl)}/api/auth/pair`, {
-      method: "POST",
-      signal: AbortSignal.any([signal, AbortSignal.timeout(30000)]),
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(input)
-    }),
-    catch: (cause) => new RelayRequestError({
+  const json = yield* Effect2.tryPromise({
+    try: async (signal) => {
+      const response = await fetch(`${normalizeBaseUrl(baseUrl)}/api/auth/pair`, {
+        method: "POST",
+        signal: AbortSignal.any([signal, AbortSignal.timeout(30000)]),
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      if (!response.ok) {
+        throw new RelayRequestError({
+          operation,
+          message: await responseMessage(response, operation),
+          status: response.status
+        });
+      }
+      return jsonBody(response, operation).catch((cause) => {
+        throw cause instanceof RelayDecodeError ? cause : new RelayDecodeError({ operation, message: String(cause) });
+      });
+    },
+    catch: (cause) => cause instanceof RelayRequestError || cause instanceof RelayDecodeError ? cause : new RelayRequestError({
       operation,
       message: cause instanceof Error ? cause.message : String(cause)
     })
   });
-  if (!response.ok) {
-    return yield* Effect2.fail(new RelayRequestError({
-      operation,
-      message: yield* Effect2.promise(() => responseMessage(response, operation)),
-      status: response.status
-    }));
-  }
-  const json = yield* Effect2.tryPromise({
-    try: () => jsonBody(response, operation),
-    catch: (cause) => cause instanceof RelayDecodeError ? cause : new RelayDecodeError({ operation, message: String(cause) })
-  });
   return yield* Schema2.decodeUnknownEffect(PairingResult)(json).pipe(Effect2.mapError((cause) => new RelayDecodeError({ operation, message: String(cause) })));
 });
 var layer = (options) => Layer.succeed(Service, make(options));
@@ -6489,7 +6499,7 @@ var isLoopback = (url) => url.hostname === "localhost" || url.hostname === "[::1
 var verifyClientCredential = async (relayUrl, token) => {
   await Effect8.runPromise(exports_src.make({ baseUrl: relayUrl, token }).devices());
 };
-var verifyDeviceCredential = (relayUrl, token) => new Promise((resolvePromise, reject) => {
+var verifyLegacyDeviceCredential = (relayUrl, token) => new Promise((resolvePromise, reject) => {
   const socket = new WebSocket(websocketUrl(relayUrl), {
     handshakeTimeout: 1e4,
     maxPayload: 1024 * 1024,
@@ -6528,6 +6538,12 @@ var verifyDeviceCredential = (relayUrl, token) => new Promise((resolvePromise, r
   socket.once("error", (cause) => finish(cause));
   socket.once("close", () => finish(new Error("New relay rejected the stored device credential")));
 });
+var verifyDeviceCredential = (relayUrl, token) => Effect8.runPromise(exports_src.make({ baseUrl: relayUrl, token }).verifyDeviceCredential()).catch((cause) => {
+  if (cause instanceof RelayRequestError && (cause.status === 401 || cause.status === 404)) {
+    return verifyLegacyDeviceCredential(relayUrl, token);
+  }
+  throw cause;
+});
 var switchRelay = async (options) => {
   if (process.env.COHALL_RELAY_URL !== undefined) {
     throw new Error("Unset COHALL_RELAY_URL before changing the stored relay URL");
@@ -6623,7 +6639,7 @@ var readInputAttachments = async (paths2) => {
     if (!source.isFile()) {
       throw new Error(`Attachment ${name} must be a regular file`);
     }
-    const handle = await open3(path, constants3.O_RDONLY | (process.platform === "win32" ? 0 : constants3.O_NOFOLLOW));
+    const handle = await open3(path, constants3.O_RDONLY | (process.platform === "win32" ? 0 : constants3.O_NOFOLLOW | constants3.O_NONBLOCK));
     try {
       const metadata = await handle.stat();
       if (!metadata.isFile() || metadata.dev !== source.dev || metadata.ino !== source.ino || metadata.size < 1 || metadata.size > maxAttachmentBytes) {
@@ -6680,7 +6696,7 @@ var collectOutputs = async (directory) => {
       throw new Error(`Output ${name} repeats another file name`);
     }
     names.add(key);
-    const handle = await open3(join7(directory, name), constants3.O_RDONLY | (process.platform === "win32" ? 0 : constants3.O_NOFOLLOW));
+    const handle = await open3(join7(directory, name), constants3.O_RDONLY | (process.platform === "win32" ? 0 : constants3.O_NOFOLLOW | constants3.O_NONBLOCK));
     try {
       const metadata = await handle.stat();
       const pathMetadata = await lstat2(join7(directory, name));
@@ -7643,7 +7659,7 @@ import { Effect as Effect11, Schedule as Schedule3, Schema as Schema12 } from "e
 import { constants as constants4 } from "node:fs";
 import { open as open5, realpath as realpath4, stat as stat5 } from "node:fs/promises";
 import { arch, hostname as hostname3, platform as platform4 } from "node:os";
-import { basename as basename3, isAbsolute as isAbsolute5, relative as relative2 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute5, relative as relative2, sep } from "node:path";
 import { WebSocket as WebSocket2 } from "ws";
 var maxQueuedRelayMessages = 8;
 
@@ -7724,7 +7740,7 @@ var allowedWorkspace = async (configuration, requested) => {
   const candidate = await realpath4(selected);
   const allowed = configuration.workspaces.some((root) => {
     const child = relative2(root, candidate);
-    return child === "" || !child.startsWith("..") && !isAbsolute5(child);
+    return child !== ".." && !child.startsWith(`..${sep}`) && !isAbsolute5(child);
   });
   if (!allowed) {
     throw new Error(`Workspace ${candidate} is outside this device's configured workspace roots`);
@@ -8446,11 +8462,12 @@ var runMcp = async (configuration) => {
       output_path: z.string(),
       direction: z.enum(["input", "output"]).optional()
     }
-  }, async ({ task_id, name, output_path, direction }) => {
+  }, async ({ task_id, name, output_path, direction }, { signal }) => {
     const safeName = Schema13.decodeUnknownSync(AttachmentName)(name);
     const safeDirection = direction === undefined ? undefined : Schema13.decodeUnknownSync(AttachmentDirection)(direction);
-    const data = await Effect12.runPromise(client2.readAttachment(TaskId.make(task_id), safeName, safeDirection));
-    await writeFile8(output_path, data, { flag: "wx", mode: 384 });
+    const data = await Effect12.runPromise(client2.readAttachment(TaskId.make(task_id), safeName, safeDirection), { signal });
+    signal.throwIfAborted();
+    await writeFile8(output_path, data, { flag: "wx", mode: 384, signal });
     return output({ task_id, name: safeName, output_path, bytes: data.length });
   });
   server.registerTool("task_trace", {
@@ -8536,4 +8553,4 @@ await main().catch((cause) => {
   process.exitCode = 1;
 });
 
-//# debugId=10C40468ADA26DC864756E2164756E21
+//# debugId=49CCA945DC24F88C64756E2164756E21