@akshar5/cohall 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.6.1](https://github.com/AksharP5/cohall/compare/v0.6.0...v0.6.1) (2026-09-23)
+
+
+### Bug Fixes
+
+* **bot:** release rejected tasks without waiting six hours ([#67](https://github.com/AksharP5/cohall/issues/67)) ([e0d7a06](https://github.com/AksharP5/cohall/commit/e0d7a06545095c1fc52473b90cbff962dff2fd67))
+* **upgrade:** preserve recovery state and resolve trusted tools ([#66](https://github.com/AksharP5/cohall/issues/66)) ([bccfb18](https://github.com/AksharP5/cohall/commit/bccfb18ccc278fdbc1caede52bdeb70f56d16d81))
+
 ## [0.6.0](https://github.com/AksharP5/cohall/compare/v0.5.6...v0.6.0) (2026-09-23)
 
 

package/README.md

@@ -248,6 +248,11 @@ the Grok Bot chat alone does not complete it. If no callback arrives within six
 hours of the first dispatch, Cohall reports failure. That deadline does not
 stop the Bot's ongoing work.
 
+Pending or uncertain prompt acceptance is checked until the gateway confirms
+acceptance or rejection, including after a worker restart. A rejection fails
+the task promptly; gateway outages still allow the local callback to complete
+it. Cohall never resends an uncertain dispatch.
+
 Bots can delegate through the installed Cohall CLI, including to Codex on the
 same computer. Link child work to the parent task:
 

package/bin/cohall.js

@@ -17,7 +17,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Effect, Schema } from "effect";
-var version = "0.6.0", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.6.1", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
 })).pipe(Schema.brand(name)), BotId, Bot, DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, OperationId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, minimumDeviceOperationVersion = "0.5.0", parsedVersion = (value) => {
   const match = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
@@ -3785,15 +3785,10 @@ var discoverGrokBots = async (path) => {
     ...description === undefined ? {} : { description: description.slice(0, 512) }
   }));
 };
-var poll = async (pass, signal) => {
-  const result = await Effect6.runPromise(Effect6.tryPromise({ try: pass, catch: (cause) => cause }).pipe(Effect6.repeat({
-    schedule: Schedule2.spaced("1 second"),
-    until: (value) => value !== undefined
-  })), { signal });
-  if (result === undefined)
-    throw new Error("Grok Bot polling ended before a result");
-  return result;
-};
+var poll = (pass, intervalMs = 1000) => Effect6.tryPromise({ try: pass, catch: (cause) => cause }).pipe(Effect6.repeat({
+  schedule: Schedule2.spaced(intervalMs),
+  until: (value) => value !== undefined
+}));
 var timeoutMessage = "Timed out waiting for the bot to reply through Cohall; the bot may still be running.";
 var requireTime = (deadline) => {
   if (Date.now() >= deadline)
@@ -3827,22 +3822,41 @@ var runGrokBot = async (path, task, signal) => {
     return finishReply(existing);
   const { deadline, command, dispatched } = await prepareBotReply(task);
   requireTime(deadline);
-  const waitForReply = () => poll(async () => {
-    const receipt = await readBotReply(task.id);
-    if (receipt !== undefined)
-      return finishReply(receipt);
-    requireTime(deadline);
-    return;
-  }, signal);
-  if (dispatched)
-    return waitForReply();
-  if (path === undefined)
-    throw new Error("Configure this device's Grok Bot gateway discovery file first");
   const agentId = task.botId;
   if (agentId === undefined)
     throw new Error("Select a Grok Bot for this task");
+  const lookup = async (lookupSignal = signal) => {
+    if (path === undefined)
+      throw new Error("Configure this device's Grok Bot gateway discovery file first");
+    return rpc(await readConnection(path), "promptAcceptanceStatus", { accountSlot: "host", agentId, clientNonce: task.id }, Acceptance, lookupSignal);
+  };
+  const waitForReply = (reconcile = false) => {
+    const receipt = poll(async () => {
+      const receipt2 = await readBotReply(task.id);
+      if (receipt2 !== undefined)
+        return finishReply(receipt2);
+      requireTime(deadline);
+      return;
+    });
+    if (!reconcile || path === undefined)
+      return Effect6.runPromise(receipt, { signal });
+    const acceptance2 = poll(async (lookupSignal) => {
+      const current = await lookup(lookupSignal).catch(() => {
+        return;
+      });
+      if (current?.outcome !== "found")
+        return;
+      if (current.record.status === "rejected")
+        throw new Error("Grok Bot rejected this task; check its conversation");
+      return current.record.status === "accepted" ? true : undefined;
+    }, 5000).pipe(Effect6.andThen(Effect6.never));
+    return Effect6.runPromise(Effect6.raceFirst(receipt, acceptance2), { signal });
+  };
+  if (dispatched)
+    return waitForReply(true);
+  if (path === undefined)
+    throw new Error("Configure this device's Grok Bot gateway discovery file first");
   const connection = await readConnection(path);
-  const lookup = () => rpc(connection, "promptAcceptanceStatus", { accountSlot: "host", agentId, clientNonce: task.id }, Acceptance, signal);
   let acceptance = await lookup();
   if (acceptance.outcome === "unknown-durability")
     throw new Error("Grok Bot cannot confirm whether this task was accepted; check its conversation before retrying");
@@ -3860,7 +3874,7 @@ var runGrokBot = async (path, task, signal) => {
     if (acceptance.outcome === "not-found") {
       requireTime(deadline);
       if (!await claimBotDispatch(task.id)) {
-        return waitForReply();
+        return waitForReply(true);
       }
       try {
         await rpc(connection, "sendPrompt", {
@@ -3875,20 +3889,16 @@ var runGrokBot = async (path, task, signal) => {
         const receipt2 = await readBotReply(task.id);
         if (receipt2 !== undefined)
           return finishReply(receipt2);
-        const reconciled = await lookup().catch(() => {
-          return;
-        });
-        if (reconciled?.outcome === "found" && reconciled.record.status === "rejected")
-          throw new Error("Grok Bot rejected this task; check its conversation");
-        return waitForReply();
+        return waitForReply(true);
       }
+      return waitForReply();
     }
   }
   if (acceptance.outcome === "unknown-durability")
     throw new Error("Grok Bot cannot confirm task acceptance; the prompt was not resent");
   if (acceptance.outcome === "found" && acceptance.record.status === "rejected")
     throw new Error("Grok Bot rejected this task; check its conversation");
-  return waitForReply();
+  return waitForReply(acceptance.outcome === "found" && acceptance.record.status === "pending");
 };
 
 // apps/device/src/setup.ts
@@ -4116,31 +4126,18 @@ var linuxSystemExecutableRoots = [
 ];
 var macosHomebrewRoots = ["/opt/homebrew", "/usr/local"];
 var macosAdminGroup = 80;
-var isTrustedSystemExecutablePath = (platform4, canonical) => platform4 === "linux" && linuxSystemExecutableRoots.some((root) => containsPath(root, canonical));
+var isTrustedSystemPath = (platform4, path) => platform4 === "linux" && (path === "/home" || linuxSystemExecutableRoots.some((root) => containsPath(root, path) || containsPath(path, root)));
 var isTrustedGroupWritablePath = (options) => {
   const writableRoot = options.writableRoot;
   return options.platform === "darwin" && writableRoot !== undefined && options.uid !== undefined && options.ownerUid === options.uid && options.ownerGid === macosAdminGroup && macosHomebrewRoots.some((root) => containsPath(root, writableRoot)) && containsPath(writableRoot, options.canonical) && containsPath(writableRoot, options.path);
 };
-var trustedExecutable = async (command, options = {}) => {
-  const candidates = isAbsolute2(command) ? [command] : (process.env.PATH ?? "").split(delimiter2).filter(Boolean).flatMap((directory) => executableNames(command).map((name) => join4(directory, name)));
-  let selected;
-  for (const path of candidates) {
-    const available2 = await access2(path, operatingSystem() === "win32" ? constants2.F_OK : constants2.X_OK).then(() => true).catch(() => false);
-    if (available2) {
-      selected = path;
-      break;
-    }
-  }
-  if (selected === undefined) {
-    throw new Error(`Could not find ${command} on PATH`);
-  }
-  const canonical = await realpath2(selected);
+var validateExecutable = async (candidate, installationRoot) => {
+  const canonical = await realpath2(candidate);
   if (operatingSystem() === "win32") {
     return canonical;
   }
   const uid = process.getuid?.();
-  const writableRoot = options.writableRoot === undefined ? undefined : await realpath2(options.writableRoot);
-  const systemExecutable = isTrustedSystemExecutablePath(operatingSystem(), canonical);
+  const writableRoot = installationRoot === undefined ? undefined : await realpath2(installationRoot);
   for (let path = canonical;; path = dirname3(path)) {
     const metadata = await stat(path);
     const trustedGroupWritablePath = isTrustedGroupWritablePath({
@@ -4155,7 +4152,7 @@ var trustedExecutable = async (command, options = {}) => {
     if ((metadata.mode & 2) !== 0 || (metadata.mode & 16) !== 0 && !trustedGroupWritablePath) {
       throw new Error(`Refusing executable beneath group- or world-writable path ${path}`);
     }
-    if (uid !== undefined && metadata.uid !== 0 && metadata.uid !== uid && !systemExecutable) {
+    if (uid !== undefined && metadata.uid !== 0 && metadata.uid !== uid && !isTrustedSystemPath(operatingSystem(), path)) {
       throw new Error(`Refusing executable owned by another user at ${path}`);
     }
     const parent = dirname3(path);
@@ -4165,6 +4162,21 @@ var trustedExecutable = async (command, options = {}) => {
   }
   return canonical;
 };
+var trustedExecutable = async (command, options = {}) => {
+  const candidates = isAbsolute2(command) ? [command] : (process.env.PATH ?? "").split(delimiter2).filter(Boolean).flatMap((directory) => executableNames(command).map((name) => join4(directory, name)));
+  let failure;
+  for (const path of candidates) {
+    const available2 = await access2(path, operatingSystem() === "win32" ? constants2.F_OK : constants2.X_OK).then(() => true).catch(() => false);
+    if (!available2)
+      continue;
+    try {
+      return await validateExecutable(path, options.writableRoot);
+    } catch (cause) {
+      failure ??= cause;
+    }
+  }
+  throw failure ?? new Error(`Could not find ${command} on PATH`);
+};
 var trustedServices = async (services, resolveExecutable) => {
   const resolved = new Map;
   const invocation = async (value) => {
@@ -4382,6 +4394,7 @@ var restartServices = async (runner, services, statePath, state, preserveDeviceR
 };
 var reportedRestartServices = (receipt) => receipt.restartingService === undefined || receipt.restartedServices.includes(receipt.restartingService) ? receipt.restartedServices : [...receipt.restartedServices, receipt.restartingService];
 var upgrade = async (options) => {
+  const target = normalizeUpgradeTarget(options.target);
   const runner = options.runner ?? defaultRunner;
   const resolveExecutable = options.resolveExecutable ?? trustedExecutable;
   const runtimePlatform = options.platform ?? process.platform;
@@ -4389,7 +4402,7 @@ var upgrade = async (options) => {
   const candidates = await trustedServices(serviceCandidates(runtimePlatform, uid), resolveExecutable);
   const statePath = options.statePath ?? restartReceiptPath();
   const previous = await readReceipt(statePath);
-  if (previous?.version === options.currentVersion) {
+  if (previous?.version === options.currentVersion && (target === "latest" || target === previous.version)) {
     const byId = new Map(candidates.map((service) => [service.id, service]));
     const pending = previous.pendingServices.flatMap((id) => {
       const service = byId.get(id);
@@ -4442,15 +4455,12 @@ var upgrade = async (options) => {
       dry_run: false
     };
   }
-  await rm2(statePath, { force: true });
-  const target = normalizeUpgradeTarget(options.target);
   const entrypoint = options.entrypoint ?? process.argv[1];
   if (entrypoint === undefined) {
     throw new Error("Could not resolve the Cohall executable path");
   }
   const canonicalEntrypoint = await realpath2(entrypoint);
   const installation = packageInstallation(canonicalEntrypoint, entrypoint);
-  const install = packageInstallCommand(installation, target);
   const services = await activeServices(runner, candidates);
   await assertServiceInstallations(runner, services, canonicalEntrypoint, entrypoint);
   if (options.dryRun) {
@@ -4466,14 +4476,21 @@ var upgrade = async (options) => {
       dry_run: true
     };
   }
-  const installExecutable = options.resolveExecutable === undefined ? await trustedExecutable(install.command, installation.prefix === undefined ? {} : { writableRoot: installation.prefix }) : await resolveExecutable(install.command);
-  await checked(runner, { ...install, command: installExecutable });
-  const nextVersion = await installedVersion(entrypoint);
+  let nextVersion = await installedVersion(entrypoint).catch(() => {
+    return;
+  });
+  if (nextVersion === undefined || target !== nextVersion) {
+    const install = packageInstallCommand(installation, target);
+    const installExecutable = options.resolveExecutable === undefined ? await trustedExecutable(install.command, installation.prefix === undefined ? {} : { writableRoot: installation.prefix }) : await resolveExecutable(install.command);
+    await checked(runner, { ...install, command: installExecutable });
+    nextVersion = await installedVersion(entrypoint);
+  }
   if (target !== "latest" && nextVersion !== target) {
     throw new Error(`Installed Cohall ${nextVersion}, expected ${target}`);
   }
   const upgraded = nextVersion !== options.currentVersion;
   if (!options.restart || services.length === 0) {
+    await rm2(statePath, { force: true });
     return {
       upgraded,
       from_version: options.currentVersion,
@@ -6373,4 +6390,4 @@ await main().catch((cause) => {
   process.exitCode = 1;
 });
 
-//# debugId=F147BDC9F8E0C7EE64756E2164756E21
+//# debugId=78963F23872A4D6564756E2164756E21