@kosuke-ai/kosuke 1.0.49 → 1.0.51

package/dist/generated/commands/sensei/device-requests-list.js

@@ -6,7 +6,7 @@ export const operation = {
         "device-requests",
         "list"
     ],
-    "summary": "List the Device Requests of a Chat Session, oldest first, as you would see them on its cards: id, device, kind, owner, reason, status (pending, approved, declined, expired, withdrawn or closed), who asked and who answered, when, canApprove, whether you may answer it, and occupiedBy, session or sensei when someone else uses the device while it is pending. A request past its 30 minutes reads expired.",
+    "summary": "List the Device Requests of a Chat Session, oldest first, as you would see them on its cards: id, device, kind, owner, reason, status (pending, approved, declined, expired, withdrawn or closed), who asked and who answered, when, canApprove, whether you may answer it, and occupiedBy, session or sensei when someone else uses the device while it is pending. A request past its 30 minutes reads expired, and so does a request or approval once the Turn that asked for it ended.",
     "pathParams": [],
     "query": [
         {

package/dist/generated/commands/sensei/device-requests-update.js

@@ -30,7 +30,7 @@ export const operation = {
                 "flag": "decision",
                 "kind": "string",
                 "required": true,
-                "description": "approve lets the session use the device until it ends; decline refuses it.",
+                "description": "approve lets the session use the device until the Turn that asked ends; decline refuses it.",
                 "choices": [
                     "approve",
                     "decline"

package/dist/generated/commands/sessions/create.js

@@ -241,7 +241,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/prompt-update.js

@@ -75,7 +75,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/queue-update.js

@@ -50,7 +50,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/send.js

@@ -131,7 +131,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/tasks/create.js

@@ -285,7 +285,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{hintProjectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/program.js

@@ -14,6 +14,7 @@ import { version } from './runtime/version.js';
  * The command tree: the commands `commands/hand-written.ts` lists by hand, everything else
  * from the generated descriptors, one leaf per command over its forms. Global flags are read
  * before any subcommand runs, so the runtime the subcommands share is built once, from them.
+ * @internal
  */
 export function createProgram(options = {}) {
     const program = new Command('kosuke')

package/dist/runtime/agent-tokens.js

@@ -5,6 +5,7 @@
  * decides which commands the tree shows.
  *
  * Imports nothing, so the generator can load it on plain node.
+ * @internal
  */
 export const AGENT_TOKENS = [
     // Wire contract with `src/lib/auth/sandbox-agent-token.ts`: a chat sandbox's own Turn.
@@ -21,7 +22,10 @@ export function agentTokenOf(key) {
     const found = AGENT_TOKENS.find(({ prefixes }) => prefixes.some((prefix) => key.startsWith(prefix)));
     return found?.token ?? null;
 }
-/** The descriptor value for the agent tokens the document grants an operation. */
+/**
+ * The descriptor value for the agent tokens the document grants an operation.
+ * @internal
+ */
 export function agentReach(granted) {
     const tokens = AGENT_TOKENS.map(({ token }) => token).filter((token) => granted.includes(token));
     if (tokens.length === 0)

package/dist/runtime/attach.js

@@ -184,8 +184,22 @@ async function run(leaf, runtime, operation, input) {
         anonymous: operation.anonymous,
         answerTimeoutMs: operation.answerTimeoutMs,
     });
-    const outcome = await execute(client, request);
-    runtime.output(outcome);
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    // Stop in-flight staging and prevent the final send on a CLI interruption.
+    // Hard exits and lost responses are covered by the server's staging expiry.
+    if (request.deferredAttachments) {
+        process.once('SIGINT', cancel);
+        process.once('SIGTERM', cancel);
+    }
+    try {
+        const outcome = await execute(client, request, controller.signal);
+        runtime.output(outcome);
+    }
+    finally {
+        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGTERM', cancel);
+    }
 }
 /** `(personal only)`, `(workspace only)`, `(--provider claude_code, codex)`; empty for all. */
 function whoTakes(leafFlag, forms) {
@@ -360,11 +374,17 @@ function jsonParser(raw) {
 function collect(value, previous) {
     return [...(previous ?? []), value];
 }
-/** commander stores `--exclude-archived` as `excludeArchived`. */
+/**
+ * commander stores `--exclude-archived` as `excludeArchived`.
+ * @internal
+ */
 export function optionKey(flag) {
     return flag.replace(/-([a-z0-9])/g, (_, letter) => letter.toUpperCase());
 }
-/** `projectId` reads as `Project id`; `env-vars` as `Env vars`. */
+/**
+ * `projectId` reads as `Project id`; `env-vars` as `Env vars`.
+ * @internal
+ */
 export function humanize(name) {
     const words = name
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')

package/dist/runtime/attachments.js

@@ -1,4 +1,4 @@
-import { readFileSync, statSync } from 'node:fs';
+import { openAsBlob, readFileSync, statSync } from 'node:fs';
 import { basename, extname } from 'node:path';
 /**
  * Files on a multipart request, the way the platform reads them.
@@ -46,18 +46,47 @@ function formatBytes(bytes) {
     const mib = bytes / (1024 * 1024);
     return Number.isInteger(mib) ? `${mib} MiB` : `${bytes}-byte`;
 }
-export function appendAttachments(form, paths, { maxFiles, maxBytes }) {
+/** Leave room for multipart overhead below the app proxy's body limit. */
+export const INLINE_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+/** Validate the entire batch before reading or uploading any file. */
+export function attachmentBytes(paths, { maxFiles, maxBytes }) {
     if (paths.length > maxFiles) {
         throw new Error(`At most ${maxFiles} attachments per request; ${paths.length} given.`);
     }
-    // Size from the inode before the read: a file past the cap must fail with
-    // this message, not with the runtime's own error once it has been loaded.
+    let total = 0;
     for (const path of paths) {
-        if (statSync(path).size > maxBytes) {
-            throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
-        }
+        const size = statSync(path).size;
+        checkSize(path, size, maxBytes);
+        total += size;
     }
-    const files = paths.map((path) => new File([readFileSync(path)], basename(path), { type: mediaTypeFor(path) }));
+    return total;
+}
+function checkSize(path, size, maxBytes) {
+    if (size > maxBytes) {
+        throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
+    }
+}
+export function appendAttachments(form, paths, limits) {
+    attachmentBytes(paths, limits);
+    const files = paths.map((path) => {
+        const bytes = readFileSync(path);
+        checkSize(path, bytes.length, limits.maxBytes);
+        return new File([bytes], basename(path), { type: mediaTypeFor(path) });
+    });
     form.set('attachmentCount', String(files.length));
     files.forEach((file, index) => form.set(`attachment_${index}`, file));
 }
+/** File-backed blobs stream on send and reject if the file changes during upload. */
+export async function appendStreamingAttachments(form, paths, limits, signal) {
+    attachmentBytes(paths, limits);
+    const files = [];
+    for (const path of paths) {
+        signal?.throwIfAborted();
+        const file = await openAsBlob(path, { type: mediaTypeFor(path) });
+        checkSize(path, file.size, limits.maxBytes);
+        files.push(file);
+    }
+    signal?.throwIfAborted();
+    form.set('attachmentCount', String(files.length));
+    files.forEach((file, index) => form.set(`attachment_${index}`, file, basename(paths[index])));
+}

package/dist/runtime/client.js

@@ -77,10 +77,29 @@ function isRetryable(error, repeatable) {
         return true;
     return repeatable && AMBIGUOUS_CODES.includes(code);
 }
+// Retrying a consumed multipart Request needs a fresh stream. Keep the original
+// FormData (whose large files are disk-backed), not a cloned/teed 200 MiB body.
+const multipartReplays = new WeakMap();
+class MultipartRequest extends Request {
+    constructor(input, init) {
+        super(input, init);
+        if (init?.body instanceof FormData) {
+            multipartReplays.set(this, () => {
+                const headers = new Headers(this.headers);
+                headers.delete('content-type'); // The fresh form serializer chooses its boundary.
+                return new Request(this.url, { ...init, headers, signal: this.signal });
+            });
+        }
+    }
+}
 function withTransportRetry(fetchImpl) {
     return async (...args) => {
+        const replay = args[0] instanceof Request ? multipartReplays.get(args[0]) : undefined;
         let attempt = 0;
         for (;;) {
+            signalOf(args)?.throwIfAborted();
+            if (attempt && replay)
+                args = [replay(), args[1]];
             attempt++;
             try {
                 return await fetchImpl(...args);
@@ -178,6 +197,7 @@ function withIntegrationCap(fetchImpl) {
 export function createApiClient({ apiUrl, apiKey, fetch, answerTimeoutMs, }) {
     const base = fetch ?? globalThis.fetch;
     return createClient({
+        Request: MultipartRequest,
         baseUrl: apiUrl,
         headers: {
             ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),

package/dist/runtime/invoke.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs';
-import { appendAttachments } from './attachments.js';
+import { defaultPathSerializer } from 'openapi-fetch';
+import { appendAttachments, appendStreamingAttachments, attachmentBytes, INLINE_ATTACHMENT_BYTES, } from './attachments.js';
 export class UsageError extends Error {
 }
 export function buildRequest(operation, input) {
@@ -16,12 +17,18 @@ export function buildRequest(operation, input) {
         }
     }
     const bodyFields = Object.fromEntries(Object.entries(input.fields).filter(([name, value]) => !queryNames.has(name) && value !== undefined));
+    const deferredAttachments = operation.attachments &&
+        input.attachments.length &&
+        attachmentBytes(input.attachments, operation.attachments) > INLINE_ATTACHMENT_BYTES
+        ? { paths: [...input.attachments], limits: operation.attachments }
+        : undefined;
     return {
+        ...(deferredAttachments ? { deferredAttachments } : {}),
         method: operation.method,
         path: operation.path,
         pathParams: input.pathParams,
         query,
-        body: buildBody(operation, bodyFields, input),
+        body: buildBody(operation, bodyFields, input, !!deferredAttachments),
     };
 }
 /**
@@ -30,7 +37,7 @@ export function buildRequest(operation, input) {
  * JSON otherwise, including an empty `{}` for a body-taking operation given
  * nothing, which is how the deploy route reads "start a deploy".
  */
-function buildBody(operation, fields, input) {
+function buildBody(operation, fields, input, deferAttachments = false) {
     const takesJson = operation.body !== null;
     const takesMultipart = operation.multipart !== null;
     if (!takesJson && !takesMultipart) {
@@ -75,7 +82,7 @@ function buildBody(operation, fields, input) {
                 throw new UsageError(`--${field.flag} is required.`);
             }
         }
-        if (input.attachments.length && operation.attachments)
+        if (input.attachments.length && operation.attachments && !deferAttachments)
             appendAttachments(form, input.attachments, operation.attachments);
         return { kind: 'multipart', value: form };
     }
@@ -139,9 +146,22 @@ export function readWholeBody(options, readStdin = () => readFileSync(0, 'utf8')
         throw new UsageError('The body is not valid JSON.');
     }
 }
-export async function execute(client, request) {
+export async function execute(client, request, signal) {
+    signal?.throwIfAborted();
+    if (request.deferredAttachments && request.body?.kind === 'multipart') {
+        // Build a fresh form per execution. Retrying never reuses partially staged slots.
+        const form = new FormData();
+        for (const [key, value] of request.body.value)
+            form.append(key, value);
+        const failure = await prepareAttachments(client, request, form, signal);
+        if (failure)
+            return failure;
+        request = { ...request, body: { kind: 'multipart', value: form } };
+    }
+    signal?.throwIfAborted();
     const init = {
         params: { path: request.pathParams, query: request.query },
+        ...(signal ? { signal } : {}),
     };
     if (request.body)
         init.body = request.body.value;
@@ -150,3 +170,98 @@ export async function execute(client, request) {
     const { data, error, response } = await client.request(request.method, request.path, init);
     return { ok: response.ok, status: response.status, body: response.ok ? data : error };
 }
+/**
+ * Staging uses the same client/auth/retry policy as the message. A first API
+ * catch-all 404 or 405 permits the legacy inline form. No fallback on an auth,
+ * validation or transport failure, or after any upload has succeeded.
+ * Unconsumed staging is reclaimed by the server's bounded expiry sweep; never
+ * delete a reference after a message failure, whose commit may have succeeded.
+ */
+async function prepareAttachments(client, request, form, signal) {
+    const { paths, limits } = request.deferredAttachments;
+    attachmentBytes(paths, limits);
+    const uploadPath = limits.uploadPath;
+    if (!uploadPath) {
+        await appendStreamingAttachments(form, paths, limits, signal);
+        return;
+    }
+    const uploadParams = {};
+    for (const match of uploadPath.matchAll(/\{([^}]+)\}/g)) {
+        const name = match[1];
+        const value = request.pathParams[name] ?? form.get(name);
+        if (typeof value !== 'string' || !value) {
+            throw new UsageError(`Missing attachment upload parameter "${name}".`);
+        }
+        uploadParams[name] = value;
+    }
+    const controller = new AbortController();
+    const uploadSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+    const references = new Array(paths.length);
+    let failure;
+    let next = 0;
+    const upload = async (index) => {
+        uploadSignal.throwIfAborted();
+        const body = new FormData();
+        await appendStreamingAttachments(body, [paths[index]], limits, uploadSignal);
+        const outcome = await execute(client, {
+            method: 'post',
+            path: uploadPath,
+            pathParams: uploadParams,
+            query: {},
+            body: { kind: 'multipart', value: body },
+        }, uploadSignal);
+        uploadSignal.throwIfAborted();
+        if (outcome.ok) {
+            const reference = stagedReference(outcome.body);
+            if (!reference)
+                throw new Error('Invalid attachment upload response.');
+            references[index] = reference;
+        }
+        return outcome;
+    };
+    // Discover legacy support before starting the other requests.
+    const first = await upload(next++);
+    if (!first.ok) {
+        const error = asRecordOrEmpty(first.body);
+        const missingRoute = first.status === 404 &&
+            error.code === 'NOT_FOUND' &&
+            error.error === `No API route at ${defaultPathSerializer(uploadPath, uploadParams)}`;
+        if (missingRoute || first.status === 405) {
+            await appendStreamingAttachments(form, paths, limits, signal);
+            return;
+        }
+        return first;
+    }
+    const worker = async () => {
+        try {
+            while (next < paths.length) {
+                uploadSignal.throwIfAborted();
+                const outcome = await upload(next++);
+                if (!outcome.ok) {
+                    failure ??= outcome;
+                    controller.abort();
+                    return;
+                }
+            }
+        }
+        catch (error) {
+            controller.abort(error);
+            throw error;
+        }
+    };
+    // Drain all requests after abort: nothing continues in the background on return.
+    const workers = await Promise.allSettled(Array.from({ length: Math.min(3, paths.length - next) }, worker));
+    signal?.throwIfAborted();
+    if (failure)
+        return failure;
+    const rejected = workers.find((result) => result.status === 'rejected');
+    if (rejected?.status === 'rejected')
+        throw controller.signal.reason;
+    form.set('attachmentCount', String(references.length));
+    references.forEach((reference, index) => form.set(`attachment_${index}`, reference));
+}
+function stagedReference(body) {
+    const data = asRecordOrEmpty(body).data;
+    const reference = asRecordOrEmpty(data).reference;
+    return typeof reference === 'string' && reference.length > 0 ? reference : undefined;
+}

package/openapi.json

@@ -961,7 +961,7 @@
     "/api/devices/{deviceId}/requests": {
       "post": {
         "operationId": "devicesRequestsCreate",
-        "summary": "From a Chat Session: ask to use a personal Mac from devices list, with the reason its owner reads on a card in this session's chat. A workspace device needs no request: it answers approved at once with grantId null, and no one is asked. The owner approves a personal Mac once per session: after that, asking again answers approved at once. Answers status pending or approved. Check devices list again for the answer; it expires after 30 minutes without an answer. While it is pending, go on with other work; when it is declined or expires, go on without it and say so. Once approved it stays approved for the rest of the session: pass --device-id on every mac command. One session at a time uses the device: on MAC_BUSY, wait with devices locks create, and run devices locks delete once done.",
+        "summary": "From a Chat Session: ask to use a personal Mac from devices list, with the reason its owner reads on a card in this session's chat. A workspace device needs no request: it answers approved at once with grantId null, and no one is asked. The owner approves a personal Mac for the Turn that asked: asking again in that Turn answers approved at once, and a later Turn asks again, with a new card for the owner. Answers status pending or approved. Check devices list again for the answer; it expires after 30 minutes without an answer, or when this Turn ends. While it is pending, go on with other work; when it is declined or expires, go on without it and say so. Once approved it lasts until this Turn ends: pass --device-id on every mac command; after that, mac commands on it are refused. One session at a time uses the device: on MAC_BUSY, wait with devices locks create, and run devices locks delete once done.",
         "tags": ["devices"],
         "x-kosuke-command": ["devices", "requests", "create"],
         "x-kosuke-sandbox-token": true,
@@ -8360,6 +8360,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{hintProjectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -10252,6 +10253,75 @@
         }
       }
     },
+    "/api/projects/{projectId}/attachments": {
+      "post": {
+        "operationId": "attachmentsCreate",
+        "summary": "Stage one private message attachment. Returns data.reference for an attachment slot in a subsequent message to this project, using the same credential, within one hour.",
+        "tags": ["attachments"],
+        "x-kosuke-command": ["attachments", "create"],
+        "x-kosuke-attachments": true,
+        "x-kosuke-attachment-max-files": 1,
+        "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
+        "parameters": [
+          {
+            "name": "projectId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/projects/{projectId}/backlog-items": {
       "get": {
         "operationId": "projectsBacklogItemsList",
@@ -11316,6 +11386,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -12641,6 +12712,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -14432,6 +14504,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -15648,6 +15721,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18454,6 +18528,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18741,6 +18816,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -23314,7 +23390,7 @@
     "/api/sensei/device-requests": {
       "get": {
         "operationId": "senseiDeviceRequestsList",
-        "summary": "List the Device Requests of a Chat Session, oldest first, as you would see them on its cards: id, device, kind, owner, reason, status (pending, approved, declined, expired, withdrawn or closed), who asked and who answered, when, canApprove, whether you may answer it, and occupiedBy, session or sensei when someone else uses the device while it is pending. A request past its 30 minutes reads expired.",
+        "summary": "List the Device Requests of a Chat Session, oldest first, as you would see them on its cards: id, device, kind, owner, reason, status (pending, approved, declined, expired, withdrawn or closed), who asked and who answered, when, canApprove, whether you may answer it, and occupiedBy, session or sensei when someone else uses the device while it is pending. A request past its 30 minutes reads expired, and so does a request or approval once the Turn that asked for it ended.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "device-requests", "list"],
         "x-kosuke-sandbox-token": true,
@@ -23397,7 +23473,7 @@
                   "decision": {
                     "type": "string",
                     "enum": ["approve", "decline"],
-                    "description": "approve lets the session use the device until it ends; decline refuses it."
+                    "description": "approve lets the session use the device until the Turn that asked ends; decline refuses it."
                   }
                 },
                 "required": ["sessionId", "requestId", "decision"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosuke-ai/kosuke",
-  "version": "1.0.49",
+  "version": "1.0.51",
   "description": "Kosuke platform CLI. The client customers install to drive app.kosuke.ai from their own machine.",
   "license": "MIT",
   "repository": {
@@ -40,10 +40,10 @@
     "vitest": "^4.1.12"
   },
   "kosukeRelease": {
-    "sourceCommit": "2fece35c238337316974c0ce32615f1fbe682fd9",
-    "sourceIdentity": "c8c7c09262763d928f5e07b05b602a9a543c07b30c74e04325e18080ab6e3716",
+    "sourceCommit": "11e0393d7adbd35a8589bef145e005e29aa8d1a7",
+    "sourceIdentity": "39feb5bff790b571ed2317abfb3663d6bfac98ad68ff123b03e57b51389bddbc",
     "fragments": [
-      "twenty-files-per-message-r7k2qd.json"
+      "cli-staged-attachments.json"
     ]
   }
 }