@akshar5/cohall 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.5.2](https://github.com/AksharP5/cohall/compare/v0.5.1...v0.5.2) (2026-08-10)
+
+
+### Bug Fixes
+
+* **device:** support confined and Homebrew upgrades ([#54](https://github.com/AksharP5/cohall/issues/54)) ([80759fd](https://github.com/AksharP5/cohall/commit/80759fdaefa03fd8f6c7b6fd0a3f72b09c3b3d39))
+
+## [0.5.1](https://github.com/AksharP5/cohall/compare/v0.5.0...v0.5.1) (2026-08-10)
+
+
+### Bug Fixes
+
+* **relay:** reject upgrades for legacy daemons ([#52](https://github.com/AksharP5/cohall/issues/52)) ([d4ab660](https://github.com/AksharP5/cohall/commit/d4ab660cce5489f6f572e221e71fc4ff6a412287))
+
 ## [0.5.0](https://github.com/AksharP5/cohall/compare/v0.4.10...v0.5.0) (2026-08-10)
 
 

package/README.md

@@ -219,6 +219,8 @@ cohall upgrades abandon <operation-id>
 
 Upgrade requests are durable for offline devices and run after active delegated
 work. This is a typed owner-only maintenance operation, not remote shell access.
+Every device must already run Cohall 0.5.0 or newer; upgrade older installations
+individually once before using all-device upgrades.
 Each target must use a global npm, Bun, or pnpm installation that can upgrade
 itself. Preview the targets with `cohall upgrade --all --dry-run`, or pin an
 exact release with `--to 1.2.3`. `cohall upgrades` returns the 50 newest results.

package/bin/cohall.js

@@ -17,9 +17,40 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Schema } from "effect";
-var version = "0.5.0", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.5.2", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
-})).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, OperationId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, Thread, Message, Task, upgradeVersion, CreateUpgradeOperationsInput, DeviceOperation, TaskStatusCounts, ProviderUsage, DeviceUsage, UsageSummary, TaskTraceEvent, TaskTrace, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), makeOperationId = () => OperationId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeCreateUpgradeOperationsInput, decodeDevice, decodeSocketEvent;
+})).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, OperationId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, minimumDeviceOperationVersion = "0.5.0", parsedVersion = (value) => {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) {
+    return;
+  }
+  const core = match.slice(1, 4).map(Number);
+  if (core.length !== 3 || core.some((part) => !Number.isSafeInteger(part))) {
+    return;
+  }
+  return [core[0] ?? 0, core[1] ?? 0, core[2] ?? 0, match[4] !== undefined];
+}, supportsDeviceOperations = (candidate) => {
+  if (candidate === "0.0.0-development") {
+    return true;
+  }
+  const current = parsedVersion(candidate);
+  const minimum = parsedVersion(minimumDeviceOperationVersion);
+  if (current === undefined || minimum === undefined) {
+    return false;
+  }
+  for (let index = 0;index < 3; index += 1) {
+    if (current[index] !== minimum[index]) {
+      return (current[index] ?? 0) > (minimum[index] ?? 0);
+    }
+  }
+  return !current[3];
+}, assertDeviceOperationSupport = (devices) => {
+  const unsupported = devices.filter((device) => !supportsDeviceOperations(device.version));
+  if (unsupported.length === 0) {
+    return;
+  }
+  throw new Error(`All-device upgrades require Cohall ${minimumDeviceOperationVersion} or newer on every device. Upgrade individually first: ${unsupported.map((device) => `${device.name} (${device.version})`).join(", ")}`);
+}, Thread, Message, Task, upgradeVersion, CreateUpgradeOperationsInput, DeviceOperation, TaskStatusCounts, ProviderUsage, DeviceUsage, UsageSummary, TaskTraceEvent, TaskTrace, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), makeOperationId = () => OperationId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeCreateUpgradeOperationsInput, decodeDevice, decodeSocketEvent;
 var init_src = __esm(() => {
   maxSocketPayloadBytes = 1024 * 1024;
   count = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));
@@ -820,6 +851,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
         if (devices.length > 256) {
           throw new Error("All-device operations support at most 256 registered devices");
         }
+        assertDeviceOperationSupport(devices);
         for (const device of devices) {
           const outstanding = db.query(`SELECT COUNT(*) AS count FROM device_operations
                  WHERE target_device_id = ? AND status IN ('queued', 'assigned', 'running')`).get(device.id);
@@ -3378,7 +3410,7 @@ import {
   stat,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { delimiter as delimiter2, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join3 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute2, join as join3, relative } from "node:path";
 import { platform as operatingSystem } from "node:os";
 var packageName = "@akshar5/cohall";
 var semanticVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -3448,7 +3480,19 @@ var executableNames = (command) => {
   }
   return (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((extension) => `${command}${extension.toLowerCase()}`);
 };
-var trustedExecutable = async (command) => {
+var containsPath = (root, path) => {
+  const child = relative(root, path);
+  return child === "" || !child.startsWith("..") && !isAbsolute2(child);
+};
+var linuxSystemExecutableRoots = ["/bin", "/sbin", "/usr/bin", "/usr/sbin", "/nix/store"];
+var macosHomebrewRoots = ["/opt/homebrew", "/usr/local"];
+var macosAdminGroup = 80;
+var isTrustedSystemExecutablePath = (platform3, canonical) => platform3 === "linux" && linuxSystemExecutableRoots.some((root) => containsPath(root, canonical));
+var isTrustedGroupWritablePath = (options) => {
+  const writableRoot = options.writableRoot;
+  return options.platform === "darwin" && writableRoot !== undefined && options.uid !== undefined && options.ownerUid === options.uid && options.ownerGid === macosAdminGroup && macosHomebrewRoots.some((root) => containsPath(root, writableRoot)) && containsPath(writableRoot, options.canonical) && containsPath(writableRoot, options.path);
+};
+var trustedExecutable = async (command, options = {}) => {
   const candidates = isAbsolute2(command) ? [command] : (process.env.PATH ?? "").split(delimiter2).filter(Boolean).flatMap((directory) => executableNames(command).map((name) => join3(directory, name)));
   let selected;
   for (const path of candidates) {
@@ -3466,12 +3510,23 @@ var trustedExecutable = async (command) => {
     return canonical;
   }
   const uid = process.getuid?.();
+  const writableRoot = options.writableRoot === undefined ? undefined : await realpath2(options.writableRoot);
+  const systemExecutable = isTrustedSystemExecutablePath(operatingSystem(), canonical);
   for (let path = canonical;; path = dirname2(path)) {
     const metadata = await stat(path);
-    if ((metadata.mode & 18) !== 0) {
+    const trustedGroupWritablePath = isTrustedGroupWritablePath({
+      platform: operatingSystem(),
+      canonical,
+      writableRoot,
+      path,
+      uid,
+      ownerUid: metadata.uid,
+      ownerGid: metadata.gid
+    });
+    if ((metadata.mode & 2) !== 0 || (metadata.mode & 16) !== 0 && !trustedGroupWritablePath) {
       throw new Error(`Refusing executable beneath group- or world-writable path ${path}`);
     }
-    if (uid !== undefined && metadata.uid !== 0 && metadata.uid !== uid) {
+    if (uid !== undefined && metadata.uid !== 0 && metadata.uid !== uid && !systemExecutable) {
       throw new Error(`Refusing executable owned by another user at ${path}`);
     }
     const parent = dirname2(path);
@@ -3782,7 +3837,8 @@ var upgrade = async (options) => {
       dry_run: true
     };
   }
-  await checked(runner, { ...install, command: await resolveExecutable(install.command) });
+  const installExecutable = options.resolveExecutable === undefined ? await trustedExecutable(install.command, installation.prefix === undefined ? {} : { writableRoot: installation.prefix }) : await resolveExecutable(install.command);
+  await checked(runner, { ...install, command: installExecutable });
   const nextVersion = await installedVersion(entrypoint);
   if (target !== "latest" && nextVersion !== target) {
     throw new Error(`Installed Cohall ${nextVersion}, expected ${target}`);
@@ -4658,6 +4714,7 @@ var runCli = async (command, raw) => {
       const restart = !arguments_.options.has("no-restart");
       if (arguments_.options.has("dry-run")) {
         const devices = await Effect7.runPromise(relay2.devices());
+        assertDeviceOperationSupport(devices);
         print({
           dry_run: true,
           requested_version: normalizedTarget,
@@ -5010,7 +5067,7 @@ import { Effect as Effect8, Schedule as Schedule2, Schema as Schema9 } from "eff
 import { constants as constants3 } from "node:fs";
 import { open, realpath as realpath5, stat as stat4 } from "node:fs/promises";
 import { arch, hostname as hostname3, platform as platform3 } from "node:os";
-import { basename as basename2, isAbsolute as isAbsolute3, relative } from "node:path";
+import { basename as basename2, isAbsolute as isAbsolute3, relative as relative2 } from "node:path";
 import { WebSocket as WebSocket2 } from "ws";
 var maxQueuedRelayMessages = 8;
 
@@ -5079,7 +5136,7 @@ var allowedWorkspace = async (configuration, requested) => {
   }
   const candidate = await realpath5(selected);
   const allowed = configuration.workspaces.some((root) => {
-    const child = relative(root, candidate);
+    const child = relative2(root, candidate);
     return child === "" || !child.startsWith("..") && !isAbsolute3(child);
   });
   if (!allowed) {
@@ -5557,4 +5614,4 @@ await main().catch((cause) => {
   process.exitCode = 1;
 });
 
-//# debugId=42161A8EF448D66964756E2164756E21
+//# debugId=450AEED33D42A83A64756E2164756E21