@akshar5/cohall 0.4.7 → 0.4.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/CONTRIBUTING.md +49 -0
- package/README.md +112 -244
- package/bin/cohall.js +371 -121
- package/bin/cohall.js.map +13 -13
- package/docs/install.md +121 -44
- package/docs/integrations.md +21 -28
- package/docs/releasing.md +3 -3
- package/docs/services.md +13 -12
- package/package.json +10 -9
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.4.9](https://github.com/AksharP5/cohall/compare/v0.4.8...v0.4.9) (2026-08-09)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* harden cross-device runtime boundaries ([#40](https://github.com/AksharP5/cohall/issues/40)) ([8f0090d](https://github.com/AksharP5/cohall/commit/8f0090d42edc7067ad695eb378d2f8810ea126d7))
|
|
9
|
+
|
|
10
|
+
## [0.4.8](https://github.com/AksharP5/cohall/compare/v0.4.7...v0.4.8) (2026-08-09)
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
### Bug Fixes
|
|
14
|
+
|
|
15
|
+
* **docs:** make public onboarding concise and private-safe ([#38](https://github.com/AksharP5/cohall/issues/38)) ([d9bdd8a](https://github.com/AksharP5/cohall/commit/d9bdd8a6b866e3cc659a71c464b3c0580d272dec))
|
|
16
|
+
|
|
3
17
|
## [0.4.7](https://github.com/AksharP5/cohall/compare/v0.4.6...v0.4.7) (2026-08-09)
|
|
4
18
|
|
|
5
19
|
|
package/CONTRIBUTING.md
ADDED
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
# Contributing to Cohall
|
|
2
|
+
|
|
3
|
+
Issues and focused pull requests are welcome.
|
|
4
|
+
|
|
5
|
+
## Before opening an issue
|
|
6
|
+
|
|
7
|
+
- Search existing issues and confirm the problem still occurs on the latest
|
|
8
|
+
Cohall release.
|
|
9
|
+
- Include the operating system, Node.js version, Cohall version, relevant
|
|
10
|
+
command, expected behavior, and redacted output.
|
|
11
|
+
- Remove relay URLs, device names, workspace paths, tokens, provider session
|
|
12
|
+
IDs, and other private information.
|
|
13
|
+
- Report security vulnerabilities through [GitHub's private vulnerability
|
|
14
|
+
form](https://github.com/AksharP5/cohall/security/advisories/new), not a public
|
|
15
|
+
issue.
|
|
16
|
+
|
|
17
|
+
## Development
|
|
18
|
+
|
|
19
|
+
Requirements:
|
|
20
|
+
|
|
21
|
+
- Node.js 24 or newer
|
|
22
|
+
- [Bun](https://bun.sh/) 1.3.13
|
|
23
|
+
|
|
24
|
+
Install dependencies and run the full local validation suite:
|
|
25
|
+
|
|
26
|
+
```bash
|
|
27
|
+
bun install --frozen-lockfile
|
|
28
|
+
bun run check
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
`bun run check` type-checks, lints, builds the npm executable, runs the relay,
|
|
32
|
+
device, CLI, provider, and MCP tests, and validates the package contents.
|
|
33
|
+
|
|
34
|
+
Format changed files with `bunx oxfmt <files>` and verify the patch with `git
|
|
35
|
+
diff --check`. Do not hand-edit generated files in `bin/`.
|
|
36
|
+
|
|
37
|
+
## Pull requests
|
|
38
|
+
|
|
39
|
+
- Keep each pull request focused on one problem.
|
|
40
|
+
- Add high-signal tests for behavior changes and meaningful edge cases.
|
|
41
|
+
- Update relevant documentation when behavior or commands change.
|
|
42
|
+
- Do not include credentials, personal paths, service logs, or unrelated files.
|
|
43
|
+
- Use a Conventional Commit title such as `fix(device): reconnect after sleep`
|
|
44
|
+
or `feat(cli): add task filtering`.
|
|
45
|
+
- Explain the user problem first, then the solution and local validation.
|
|
46
|
+
|
|
47
|
+
Maintainers handle version bumps, changelog entries, tags, and npm publishing
|
|
48
|
+
through the Release Please pull request. Contributors should not edit them for a
|
|
49
|
+
normal change.
|
package/README.md
CHANGED
|
@@ -1,93 +1,104 @@
|
|
|
1
1
|
# Cohall
|
|
2
2
|
|
|
3
3
|
Cohall lets agents on your own devices delegate work to each other. It is a
|
|
4
|
-
headless
|
|
5
|
-
|
|
6
|
-
connect to a stdio MCP server.
|
|
4
|
+
headless bridge, not another agent app: keep using any harness that can run a
|
|
5
|
+
command or connect to a stdio MCP server.
|
|
7
6
|
|
|
8
|
-
One npm package provides
|
|
7
|
+
One npm package provides a durable self-hosted relay, outbound-only device
|
|
8
|
+
workers, a CLI, an installable agent skill, an optional MCP server, and local
|
|
9
|
+
Codex, Claude Code, and OpenCode adapters.
|
|
9
10
|
|
|
10
|
-
|
|
11
|
-
- an outbound-only device daemon;
|
|
12
|
-
- a human and agent-friendly CLI;
|
|
13
|
-
- one embedded, installable agent skill;
|
|
14
|
-
- an optional stdio MCP server;
|
|
15
|
-
- local Codex, Claude Code, and OpenCode execution adapters.
|
|
16
|
-
|
|
17
|
-
There is no Cohall desktop or web app. Your existing harness remains the UI.
|
|
18
|
-
|
|
19
|
-
## Architecture
|
|
11
|
+
## How it works
|
|
20
12
|
|
|
21
13
|
```text
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
14
|
+
Current agent
|
|
15
|
+
CLI + skill or MCP
|
|
16
|
+
|
|
|
17
|
+
HTTP(S) / WS(S)
|
|
18
|
+
|
|
|
19
|
+
Cohall relay + SQLite
|
|
20
|
+
/ \
|
|
21
|
+
Mac agent Linux agent
|
|
22
|
+
Xcode Docker
|
|
23
|
+
browser repositories
|
|
32
24
|
```
|
|
33
25
|
|
|
34
|
-
The relay stores
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
26
|
+
The relay stores tasks, results, thread history, and provider session IDs. Each
|
|
27
|
+
device uses its own files, provider login, tools, skills, permissions, and
|
|
28
|
+
signed-in services. Cohall does not expose a raw remote shell or copy
|
|
29
|
+
credentials between devices.
|
|
30
|
+
|
|
31
|
+
## What you can do
|
|
38
32
|
|
|
39
|
-
|
|
33
|
+
After installing the skill, ask naturally:
|
|
40
34
|
|
|
41
|
-
|
|
42
|
-
|
|
35
|
+
- “Ask `@macbook` to build the iOS app and diagnose the signing error.”
|
|
36
|
+
- “Have `@server` reproduce this failure against its Docker services.”
|
|
37
|
+
- “Use `@linux`'s signed-in browser to investigate this deployment.”
|
|
38
|
+
- “Queue the full test suite on `@server`; keep working here and report back.”
|
|
43
39
|
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
40
|
+
When a request depends on your current conversation, the sending agent
|
|
41
|
+
automatically includes a concise brief explaining why you are asking, relevant
|
|
42
|
+
facts and prior findings, constraints, and the decision you need. It does not
|
|
43
|
+
forward the raw transcript or unrelated private material.
|
|
48
44
|
|
|
49
|
-
|
|
50
|
-
the result when it returns. `@macbook` is a device selector understood through
|
|
51
|
-
the installed skill, not special chat syntax built into your harness. When the
|
|
52
|
-
request depends on the current conversation, the sending agent automatically
|
|
53
|
-
distills why you are asking, relevant facts and prior findings, constraints, and
|
|
54
|
-
the decision you need into the task's context. Cohall does not copy the raw chat
|
|
55
|
-
or unrelated private material.
|
|
45
|
+
## Get started with your agent
|
|
56
46
|
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
47
|
+
Paste this into an agent on the device you want to configure:
|
|
48
|
+
|
|
49
|
+
```text
|
|
50
|
+
Set up Cohall on this device using https://github.com/AksharP5/cohall. Read the current README and installation/service docs first. Detect this OS, package manager, installed provider CLIs, and suitable workspace roots. If no Cohall relay is configured, ask whether this device should host one or join an existing relay; do not guess a relay URL or token. Keep the relay private through Tailscale or HTTPS, never expose plain HTTP publicly, and keep every token out of command arguments, shell history, and logs. Install Cohall, pair or join this device, install its skill for the detected agent harnesses, configure autostart if this device should remain available, run cohall doctor, and report exactly what is working. Ask before making system-wide changes.
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
The agent will ask for the relay address and one-time pairing token only when it
|
|
54
|
+
needs them.
|
|
63
55
|
|
|
64
56
|
## Quick start
|
|
65
57
|
|
|
66
|
-
|
|
67
|
-
|
|
58
|
+
Cohall requires Node.js 24 or newer. Try it with your preferred package runner.
|
|
59
|
+
Each block is independently copyable.
|
|
60
|
+
|
|
61
|
+
**npm**
|
|
68
62
|
|
|
69
63
|
```bash
|
|
70
64
|
npx -y @akshar5/cohall --version
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
**Bun**
|
|
68
|
+
|
|
69
|
+
```bash
|
|
71
70
|
bunx @akshar5/cohall --version
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
**pnpm**
|
|
74
|
+
|
|
75
|
+
```bash
|
|
72
76
|
pnpm dlx @akshar5/cohall --version
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
**Yarn**
|
|
80
|
+
|
|
81
|
+
```bash
|
|
73
82
|
yarn dlx @akshar5/cohall --version
|
|
74
83
|
```
|
|
75
84
|
|
|
76
|
-
The examples
|
|
85
|
+
The remaining examples use `npx`.
|
|
77
86
|
|
|
78
|
-
Start a
|
|
87
|
+
### 1. Start a relay
|
|
79
88
|
|
|
80
89
|
```bash
|
|
81
90
|
export COHALL_TOKEN="$(openssl rand -hex 32)"
|
|
82
91
|
npx -y @akshar5/cohall relay
|
|
83
92
|
```
|
|
84
93
|
|
|
85
|
-
The relay binds
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
94
|
+
The relay binds to `127.0.0.1` by default. For multiple devices, run it on an
|
|
95
|
+
always-on machine and expose it only through a private network such as Tailscale
|
|
96
|
+
or an HTTPS reverse proxy. See [service setup](docs/services.md).
|
|
97
|
+
|
|
98
|
+
### 2. Pair a device
|
|
89
99
|
|
|
90
|
-
|
|
100
|
+
On an owner-authenticated machine, create a token that expires after ten minutes
|
|
101
|
+
and one exchange:
|
|
91
102
|
|
|
92
103
|
```bash
|
|
93
104
|
COHALL_RELAY_URL=https://cohall.example.com \
|
|
@@ -95,8 +106,7 @@ COHALL_TOKEN="$COHALL_TOKEN" \
|
|
|
95
106
|
npx -y @akshar5/cohall pair --label "MacBook"
|
|
96
107
|
```
|
|
97
108
|
|
|
98
|
-
Transfer the token
|
|
99
|
-
provide it on stdin so it never appears in process arguments or shell history:
|
|
109
|
+
Transfer the token privately. On the device being added:
|
|
100
110
|
|
|
101
111
|
```bash
|
|
102
112
|
read -rsp 'Pairing token: ' pairing_token; printf '\n'
|
|
@@ -104,80 +114,46 @@ printf '%s' "$pairing_token" | npx -y @akshar5/cohall join \
|
|
|
104
114
|
--relay https://cohall.example.com \
|
|
105
115
|
--name macbook \
|
|
106
116
|
--providers codex \
|
|
107
|
-
--workspace "$HOME/dev"
|
|
108
|
-
--workspace "$HOME/.skillsync/repo"
|
|
117
|
+
--workspace "$HOME/dev"
|
|
109
118
|
unset pairing_token
|
|
110
|
-
|
|
111
|
-
npx -y @akshar5/cohall doctor
|
|
112
|
-
npx -y @akshar5/cohall device
|
|
113
119
|
```
|
|
114
120
|
|
|
115
|
-
|
|
116
|
-
then writes a per-user configuration file with Unix mode `0600`. Workspace roots
|
|
117
|
-
must already exist and are resolved to canonical paths.
|
|
118
|
-
|
|
119
|
-
## Availability and restarts
|
|
120
|
-
|
|
121
|
-
The relay must be reachable to accept new tasks or return status. Once accepted,
|
|
122
|
-
a task is stored in SQLite and survives relay or target-device restarts. Work for
|
|
123
|
-
an offline target waits on the relay and starts when that device reconnects.
|
|
124
|
-
Interrupted running work is re-queued with at-least-once delivery, so prompts
|
|
125
|
-
that cause external changes should be safe to retry.
|
|
126
|
-
|
|
127
|
-
The packaged service definitions reconnect automatically:
|
|
128
|
-
|
|
129
|
-
- the Linux relay starts at boot through systemd socket and service units;
|
|
130
|
-
- a Linux device starts with its user service, or at boot when user lingering is
|
|
131
|
-
enabled;
|
|
132
|
-
- a macOS device starts when that user logs in through its LaunchAgent;
|
|
133
|
-
- a Windows device starts at user logon through Task Scheduler.
|
|
134
|
-
|
|
135
|
-
Powered-off devices do not run work. A powered-off relay cannot accept new work,
|
|
136
|
-
but tasks already written to its persistent data directory remain there for its
|
|
137
|
-
next start. See [service setup](docs/services.md) for installation and checks.
|
|
138
|
-
|
|
139
|
-
## Use from an agent
|
|
140
|
-
|
|
141
|
-
Install the same embedded skill for Codex, Claude Code, and OpenCode:
|
|
121
|
+
### 3. Install the skill and connect
|
|
142
122
|
|
|
143
123
|
```bash
|
|
144
124
|
npx -y @akshar5/cohall skill install all
|
|
125
|
+
npx -y @akshar5/cohall doctor
|
|
126
|
+
npx -y @akshar5/cohall device
|
|
145
127
|
```
|
|
146
128
|
|
|
147
|
-
|
|
129
|
+
Use an operating-system service for an unattended relay or device worker. See
|
|
130
|
+
[service setup](docs/services.md).
|
|
131
|
+
|
|
132
|
+
## Delegate work
|
|
148
133
|
|
|
149
134
|
```bash
|
|
150
|
-
npx -y @akshar5/cohall devices
|
|
151
135
|
npx -y @akshar5/cohall delegate \
|
|
152
136
|
--target @macbook \
|
|
153
|
-
--
|
|
154
|
-
--workspace /Users/me/dev/project \
|
|
137
|
+
--workspace "$HOME/dev/project" \
|
|
155
138
|
--prompt 'Inspect the signed-in dashboard and identify why deployment 184 failed.' \
|
|
156
|
-
--context '
|
|
139
|
+
--context 'Why: the deployment failed after local checks passed. Need: root cause, evidence, and recommended next step.'
|
|
157
140
|
```
|
|
158
141
|
|
|
159
|
-
The command waits
|
|
142
|
+
The command waits for a result by default. Queue longer work with `--no-wait`,
|
|
143
|
+
then inspect it later:
|
|
160
144
|
|
|
161
145
|
```bash
|
|
162
|
-
npx -y @akshar5/cohall delegate --target @linux --no-wait \
|
|
163
|
-
--prompt 'Run the test suite and report failures.'
|
|
164
146
|
npx -y @akshar5/cohall wait <task-id> --timeout 1800
|
|
165
|
-
npx -y @akshar5/cohall cancel <task-id>
|
|
166
147
|
npx -y @akshar5/cohall trace <task-id> --follow
|
|
167
|
-
npx -y @akshar5/cohall thread <thread-id>
|
|
168
148
|
```
|
|
169
149
|
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
that its local process stopped. `trace` reports the durable relay and device
|
|
173
|
-
lifecycle without prompts, results, credentials, or provider session IDs.
|
|
174
|
-
`--follow` emits changed snapshots as newline-delimited JSON until the task is
|
|
175
|
-
terminal.
|
|
150
|
+
Reuse the returned `thread_id` for follow-ups so the target resumes its provider
|
|
151
|
+
session.
|
|
176
152
|
|
|
177
153
|
## Optional MCP
|
|
178
154
|
|
|
179
|
-
|
|
180
|
-
|
|
155
|
+
CLI plus skill is the recommended integration. For a client that accepts the
|
|
156
|
+
common `mcpServers` format, paste:
|
|
181
157
|
|
|
182
158
|
```json
|
|
183
159
|
{
|
|
@@ -190,138 +166,30 @@ For clients that accept the common `mcpServers` JSON shape, paste:
|
|
|
190
166
|
}
|
|
191
167
|
```
|
|
192
168
|
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
Run `npx -y @akshar5/cohall integrations` to print these command components.
|
|
222
|
-
The MCP server exposes:
|
|
223
|
-
|
|
224
|
-
- `list_devices`
|
|
225
|
-
- `delegate`
|
|
226
|
-
- `task_status`
|
|
227
|
-
- `task_trace`
|
|
228
|
-
- `wait_task`
|
|
229
|
-
- `cancel_task`
|
|
230
|
-
- `thread_context`
|
|
231
|
-
|
|
232
|
-
CLI plus skill and MCP create the same tasks. Configure one or the other in a
|
|
233
|
-
given harness; do not submit the same work through both.
|
|
234
|
-
|
|
235
|
-
See [integration examples](docs/integrations.md), [installation](docs/install.md),
|
|
236
|
-
and [service setup](docs/services.md).
|
|
237
|
-
|
|
238
|
-
## Provider behavior
|
|
239
|
-
|
|
240
|
-
Target devices advertise provider executables they actually have. Authentication
|
|
241
|
-
is checked when delegated work starts. Restrict a device to providers you have
|
|
242
|
-
configured locally:
|
|
243
|
-
|
|
244
|
-
```bash
|
|
245
|
-
cohall configure --providers codex,claude-code
|
|
246
|
-
cohall configure --providers auto
|
|
247
|
-
```
|
|
248
|
-
|
|
249
|
-
| Provider | Required command | Session continuation |
|
|
250
|
-
| ----------- | ---------------- | ------------------------ |
|
|
251
|
-
| Codex | `codex` | `codex exec resume` |
|
|
252
|
-
| Claude Code | `claude` | `claude --resume` |
|
|
253
|
-
| OpenCode | `opencode` | `opencode run --session` |
|
|
254
|
-
|
|
255
|
-
Cohall does not bypass provider permissions. A paired client is authorized to
|
|
256
|
-
ask the local provider to act with that user account's normal authority, so do
|
|
257
|
-
not pair mutually untrusted users. Provider output and task backlogs are
|
|
258
|
-
bounded, one task runs at a time per device, and configured workspace roots are
|
|
259
|
-
enforced after resolving symlinks.
|
|
260
|
-
|
|
261
|
-
## Configuration
|
|
262
|
-
|
|
263
|
-
`npx -y @akshar5/cohall config` shows the active stored configuration without
|
|
264
|
-
printing tokens. `npx -y @akshar5/cohall configure` changes relay, name,
|
|
265
|
-
workspaces, enabled providers, model, or Codex sandbox.
|
|
266
|
-
`npx -y @akshar5/cohall doctor` checks relay reachability, this device's relay
|
|
267
|
-
status, provider selection, executable paths, and version information.
|
|
268
|
-
|
|
269
|
-
For a global installation used by services, `cohall upgrade` updates through
|
|
270
|
-
the same npm, Bun, or pnpm installation and restarts only active Cohall relay
|
|
271
|
-
and device jobs. Active jobs restart even when the installed files are already
|
|
272
|
-
current, ensuring an older loaded process is replaced. Cohall refuses to restart
|
|
273
|
-
a service configured to use a different global installation; run that service's
|
|
274
|
-
executable directly or update its service definition first.
|
|
275
|
-
|
|
276
|
-
- `cohall upgrade --dry-run` previews the plan.
|
|
277
|
-
- `cohall upgrade --no-restart` updates files without restarting services.
|
|
278
|
-
|
|
279
|
-
Linux relays can use the packaged systemd socket unit so new connections remain
|
|
280
|
-
available while the relay process is replaced; see [service setup](docs/services.md).
|
|
281
|
-
Environment variables override stored values:
|
|
282
|
-
|
|
283
|
-
| Variable | Purpose |
|
|
284
|
-
| ----------------------------------------- | ---------------------------------------------- |
|
|
285
|
-
| `COHALL_CONFIG` | Configuration file override |
|
|
286
|
-
| `COHALL_RELAY_URL` | Relay URL for CLI, MCP, and device |
|
|
287
|
-
| `COHALL_CLIENT_TOKEN` | Client credential override |
|
|
288
|
-
| `COHALL_DEVICE_TOKEN` | Device credential override |
|
|
289
|
-
| `COHALL_TOKEN` | Relay owner credential |
|
|
290
|
-
| `COHALL_DEVICE_ID` | Stable device ID override |
|
|
291
|
-
| `COHALL_DEVICE_NAME` | Advertised device name |
|
|
292
|
-
| `COHALL_DEVICE_PROVIDERS` | Provider allowlist or `auto` |
|
|
293
|
-
| `COHALL_DEVICE_WORKSPACES` | Comma-separated workspace roots |
|
|
294
|
-
| `COHALL_DEVICE_WORKSPACES_JSON` | JSON workspace roots; supports commas in paths |
|
|
295
|
-
| `COHALL_MODEL` | Target provider model override |
|
|
296
|
-
| `COHALL_SANDBOX` | Codex sandbox override |
|
|
297
|
-
| `COHALL_THREAD_ID` | Inherited Cohall thread for nested delegation |
|
|
298
|
-
| `COHALL_DATA_DIR` | Relay database and owner-token directory |
|
|
299
|
-
| `COHALL_RELAY_HOST` / `COHALL_RELAY_PORT` | Relay listener |
|
|
300
|
-
| `COHALL_RELAY_ALLOW_REMOTE` | Explicit non-loopback binding opt-in |
|
|
301
|
-
|
|
302
|
-
The owner token can create pairing credentials, list sessions, and revoke them.
|
|
303
|
-
`cohall forget <device-id>` removes an offline device from discovery after
|
|
304
|
-
confirming it has no outstanding tasks, revokes its device credential, and
|
|
305
|
-
preserves its completed task history. On the relay host, owner commands read the
|
|
306
|
-
protected local owner-token file automatically; remote owner commands require
|
|
307
|
-
`COHALL_TOKEN`.
|
|
308
|
-
Ordinary client and device credentials are role-separated, device-bound where
|
|
309
|
-
applicable, expiring, and stored only as SHA-256 hashes by the relay.
|
|
310
|
-
|
|
311
|
-
## Development
|
|
312
|
-
|
|
313
|
-
```bash
|
|
314
|
-
bun install
|
|
315
|
-
bun run check
|
|
316
|
-
```
|
|
317
|
-
|
|
318
|
-
`bun run check` type-checks, lints, builds the npm executable, and tests the full
|
|
319
|
-
relay/device/CLI/MCP path with fake provider executables. GitHub Actions is
|
|
320
|
-
deliberately low-frequency because this is a private repository. See [release
|
|
321
|
-
operations](docs/releasing.md).
|
|
322
|
-
|
|
323
|
-
The relay guarantees durable at-least-once task delivery. Task assignment and
|
|
324
|
-
terminal events are idempotent; interrupted running tasks are re-queued after a
|
|
325
|
-
device or relay restart. A device accepts at most 100 outstanding tasks and
|
|
326
|
-
executes them one at a time. Thread context returns a byte-bounded recent window
|
|
327
|
-
and sets `truncated` when older content exists.
|
|
169
|
+
CLI and MCP create the same tasks; use one entry point per task. See
|
|
170
|
+
[agent integrations](docs/integrations.md) for Codex, Claude Code, and OpenCode
|
|
171
|
+
configuration.
|
|
172
|
+
|
|
173
|
+
## Reliability and security
|
|
174
|
+
|
|
175
|
+
- Accepted tasks persist in SQLite while a target is offline.
|
|
176
|
+
- Interrupted work is re-queued with at-least-once delivery; consequential work
|
|
177
|
+
should be safe to retry.
|
|
178
|
+
- The relay must be reachable to submit new work, but persisted tasks survive a
|
|
179
|
+
relay restart.
|
|
180
|
+
- The relay retains the newest 1,000 terminal tasks by default so history cannot
|
|
181
|
+
grow without bound.
|
|
182
|
+
- Paired clients can ask a device's local provider to act with that user's normal
|
|
183
|
+
authority. Pair only devices and users you trust.
|
|
184
|
+
- Workspace roots are enforced after resolving symlinks, credentials are
|
|
185
|
+
role-separated, and task traces omit prompts, results, tokens, and provider
|
|
186
|
+
session IDs.
|
|
187
|
+
|
|
188
|
+
## Documentation
|
|
189
|
+
|
|
190
|
+
- [Installation, pairing, providers, and upgrades](docs/install.md)
|
|
191
|
+
- [Agent skill and MCP integrations](docs/integrations.md)
|
|
192
|
+
- [Linux, macOS, and Windows services](docs/services.md)
|
|
193
|
+
- [Contributing](CONTRIBUTING.md)
|
|
194
|
+
|
|
195
|
+
Cohall is licensed under the [MIT License](LICENSE).
|