@kosuke-ai/kosuke 1.0.50 → 1.0.52

package/dist/generated/commands/integrations/browser-connections-create--personal-network-linkedin.js

@@ -13,7 +13,7 @@ export const operation = {
             "equals": "linkedin"
         }
     },
-    "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+    "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
     "pathParams": [],
     "query": [],
     "body": {

package/dist/generated/commands/integrations/browser-connections-create--personal-network-x.js

@@ -13,7 +13,7 @@ export const operation = {
             "equals": "x"
         }
     },
-    "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+    "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
     "pathParams": [],
     "query": [],
     "body": {

package/dist/generated/commands/mac/browser-login.js

@@ -6,7 +6,7 @@ export const operation = {
         "browser",
         "login"
     ],
-    "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
+    "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, DEVICE_CALL_INTERRUPTED, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
     "pathParams": [],
     "query": [],
     "body": {

package/dist/generated/commands/sessions/create.js

@@ -241,7 +241,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/prompt-update.js

@@ -75,7 +75,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/queue-update.js

@@ -50,7 +50,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/send.js

@@ -131,7 +131,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/tasks/create.js

@@ -285,7 +285,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{hintProjectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/runtime/attach.js

@@ -184,8 +184,22 @@ async function run(leaf, runtime, operation, input) {
         anonymous: operation.anonymous,
         answerTimeoutMs: operation.answerTimeoutMs,
     });
-    const outcome = await execute(client, request);
-    runtime.output(outcome);
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    // Stop in-flight staging and prevent the final send on a CLI interruption.
+    // Hard exits and lost responses are covered by the server's staging expiry.
+    if (request.deferredAttachments) {
+        process.once('SIGINT', cancel);
+        process.once('SIGTERM', cancel);
+    }
+    try {
+        const outcome = await execute(client, request, controller.signal);
+        runtime.output(outcome);
+    }
+    finally {
+        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGTERM', cancel);
+    }
 }
 /** `(personal only)`, `(workspace only)`, `(--provider claude_code, codex)`; empty for all. */
 function whoTakes(leafFlag, forms) {

package/dist/runtime/attachments.js

@@ -1,4 +1,4 @@
-import { readFileSync, statSync } from 'node:fs';
+import { openAsBlob, readFileSync, statSync } from 'node:fs';
 import { basename, extname } from 'node:path';
 /**
  * Files on a multipart request, the way the platform reads them.
@@ -46,18 +46,47 @@ function formatBytes(bytes) {
     const mib = bytes / (1024 * 1024);
     return Number.isInteger(mib) ? `${mib} MiB` : `${bytes}-byte`;
 }
-export function appendAttachments(form, paths, { maxFiles, maxBytes }) {
+/** Leave room for multipart overhead below the app proxy's body limit. */
+export const INLINE_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+/** Validate the entire batch before reading or uploading any file. */
+export function attachmentBytes(paths, { maxFiles, maxBytes }) {
     if (paths.length > maxFiles) {
         throw new Error(`At most ${maxFiles} attachments per request; ${paths.length} given.`);
     }
-    // Size from the inode before the read: a file past the cap must fail with
-    // this message, not with the runtime's own error once it has been loaded.
+    let total = 0;
     for (const path of paths) {
-        if (statSync(path).size > maxBytes) {
-            throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
-        }
+        const size = statSync(path).size;
+        checkSize(path, size, maxBytes);
+        total += size;
     }
-    const files = paths.map((path) => new File([readFileSync(path)], basename(path), { type: mediaTypeFor(path) }));
+    return total;
+}
+function checkSize(path, size, maxBytes) {
+    if (size > maxBytes) {
+        throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
+    }
+}
+export function appendAttachments(form, paths, limits) {
+    attachmentBytes(paths, limits);
+    const files = paths.map((path) => {
+        const bytes = readFileSync(path);
+        checkSize(path, bytes.length, limits.maxBytes);
+        return new File([bytes], basename(path), { type: mediaTypeFor(path) });
+    });
     form.set('attachmentCount', String(files.length));
     files.forEach((file, index) => form.set(`attachment_${index}`, file));
 }
+/** File-backed blobs stream on send and reject if the file changes during upload. */
+export async function appendStreamingAttachments(form, paths, limits, signal) {
+    attachmentBytes(paths, limits);
+    const files = [];
+    for (const path of paths) {
+        signal?.throwIfAborted();
+        const file = await openAsBlob(path, { type: mediaTypeFor(path) });
+        checkSize(path, file.size, limits.maxBytes);
+        files.push(file);
+    }
+    signal?.throwIfAborted();
+    form.set('attachmentCount', String(files.length));
+    files.forEach((file, index) => form.set(`attachment_${index}`, file, basename(paths[index])));
+}

package/dist/runtime/client.js

@@ -77,10 +77,29 @@ function isRetryable(error, repeatable) {
         return true;
     return repeatable && AMBIGUOUS_CODES.includes(code);
 }
+// Retrying a consumed multipart Request needs a fresh stream. Keep the original
+// FormData (whose large files are disk-backed), not a cloned/teed 200 MiB body.
+const multipartReplays = new WeakMap();
+class MultipartRequest extends Request {
+    constructor(input, init) {
+        super(input, init);
+        if (init?.body instanceof FormData) {
+            multipartReplays.set(this, () => {
+                const headers = new Headers(this.headers);
+                headers.delete('content-type'); // The fresh form serializer chooses its boundary.
+                return new Request(this.url, { ...init, headers, signal: this.signal });
+            });
+        }
+    }
+}
 function withTransportRetry(fetchImpl) {
     return async (...args) => {
+        const replay = args[0] instanceof Request ? multipartReplays.get(args[0]) : undefined;
         let attempt = 0;
         for (;;) {
+            signalOf(args)?.throwIfAborted();
+            if (attempt && replay)
+                args = [replay(), args[1]];
             attempt++;
             try {
                 return await fetchImpl(...args);
@@ -178,6 +197,7 @@ function withIntegrationCap(fetchImpl) {
 export function createApiClient({ apiUrl, apiKey, fetch, answerTimeoutMs, }) {
     const base = fetch ?? globalThis.fetch;
     return createClient({
+        Request: MultipartRequest,
         baseUrl: apiUrl,
         headers: {
             ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),

package/dist/runtime/invoke.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs';
-import { appendAttachments } from './attachments.js';
+import { defaultPathSerializer } from 'openapi-fetch';
+import { appendAttachments, appendStreamingAttachments, attachmentBytes, INLINE_ATTACHMENT_BYTES, } from './attachments.js';
 export class UsageError extends Error {
 }
 export function buildRequest(operation, input) {
@@ -16,12 +17,18 @@ export function buildRequest(operation, input) {
         }
     }
     const bodyFields = Object.fromEntries(Object.entries(input.fields).filter(([name, value]) => !queryNames.has(name) && value !== undefined));
+    const deferredAttachments = operation.attachments &&
+        input.attachments.length &&
+        attachmentBytes(input.attachments, operation.attachments) > INLINE_ATTACHMENT_BYTES
+        ? { paths: [...input.attachments], limits: operation.attachments }
+        : undefined;
     return {
+        ...(deferredAttachments ? { deferredAttachments } : {}),
         method: operation.method,
         path: operation.path,
         pathParams: input.pathParams,
         query,
-        body: buildBody(operation, bodyFields, input),
+        body: buildBody(operation, bodyFields, input, !!deferredAttachments),
     };
 }
 /**
@@ -30,7 +37,7 @@ export function buildRequest(operation, input) {
  * JSON otherwise, including an empty `{}` for a body-taking operation given
  * nothing, which is how the deploy route reads "start a deploy".
  */
-function buildBody(operation, fields, input) {
+function buildBody(operation, fields, input, deferAttachments = false) {
     const takesJson = operation.body !== null;
     const takesMultipart = operation.multipart !== null;
     if (!takesJson && !takesMultipart) {
@@ -75,7 +82,7 @@ function buildBody(operation, fields, input) {
                 throw new UsageError(`--${field.flag} is required.`);
             }
         }
-        if (input.attachments.length && operation.attachments)
+        if (input.attachments.length && operation.attachments && !deferAttachments)
             appendAttachments(form, input.attachments, operation.attachments);
         return { kind: 'multipart', value: form };
     }
@@ -139,9 +146,22 @@ export function readWholeBody(options, readStdin = () => readFileSync(0, 'utf8')
         throw new UsageError('The body is not valid JSON.');
     }
 }
-export async function execute(client, request) {
+export async function execute(client, request, signal) {
+    signal?.throwIfAborted();
+    if (request.deferredAttachments && request.body?.kind === 'multipart') {
+        // Build a fresh form per execution. Retrying never reuses partially staged slots.
+        const form = new FormData();
+        for (const [key, value] of request.body.value)
+            form.append(key, value);
+        const failure = await prepareAttachments(client, request, form, signal);
+        if (failure)
+            return failure;
+        request = { ...request, body: { kind: 'multipart', value: form } };
+    }
+    signal?.throwIfAborted();
     const init = {
         params: { path: request.pathParams, query: request.query },
+        ...(signal ? { signal } : {}),
     };
     if (request.body)
         init.body = request.body.value;
@@ -150,3 +170,98 @@ export async function execute(client, request) {
     const { data, error, response } = await client.request(request.method, request.path, init);
     return { ok: response.ok, status: response.status, body: response.ok ? data : error };
 }
+/**
+ * Staging uses the same client/auth/retry policy as the message. A first API
+ * catch-all 404 or 405 permits the legacy inline form. No fallback on an auth,
+ * validation or transport failure, or after any upload has succeeded.
+ * Unconsumed staging is reclaimed by the server's bounded expiry sweep; never
+ * delete a reference after a message failure, whose commit may have succeeded.
+ */
+async function prepareAttachments(client, request, form, signal) {
+    const { paths, limits } = request.deferredAttachments;
+    attachmentBytes(paths, limits);
+    const uploadPath = limits.uploadPath;
+    if (!uploadPath) {
+        await appendStreamingAttachments(form, paths, limits, signal);
+        return;
+    }
+    const uploadParams = {};
+    for (const match of uploadPath.matchAll(/\{([^}]+)\}/g)) {
+        const name = match[1];
+        const value = request.pathParams[name] ?? form.get(name);
+        if (typeof value !== 'string' || !value) {
+            throw new UsageError(`Missing attachment upload parameter "${name}".`);
+        }
+        uploadParams[name] = value;
+    }
+    const controller = new AbortController();
+    const uploadSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+    const references = new Array(paths.length);
+    let failure;
+    let next = 0;
+    const upload = async (index) => {
+        uploadSignal.throwIfAborted();
+        const body = new FormData();
+        await appendStreamingAttachments(body, [paths[index]], limits, uploadSignal);
+        const outcome = await execute(client, {
+            method: 'post',
+            path: uploadPath,
+            pathParams: uploadParams,
+            query: {},
+            body: { kind: 'multipart', value: body },
+        }, uploadSignal);
+        uploadSignal.throwIfAborted();
+        if (outcome.ok) {
+            const reference = stagedReference(outcome.body);
+            if (!reference)
+                throw new Error('Invalid attachment upload response.');
+            references[index] = reference;
+        }
+        return outcome;
+    };
+    // Discover legacy support before starting the other requests.
+    const first = await upload(next++);
+    if (!first.ok) {
+        const error = asRecordOrEmpty(first.body);
+        const missingRoute = first.status === 404 &&
+            error.code === 'NOT_FOUND' &&
+            error.error === `No API route at ${defaultPathSerializer(uploadPath, uploadParams)}`;
+        if (missingRoute || first.status === 405) {
+            await appendStreamingAttachments(form, paths, limits, signal);
+            return;
+        }
+        return first;
+    }
+    const worker = async () => {
+        try {
+            while (next < paths.length) {
+                uploadSignal.throwIfAborted();
+                const outcome = await upload(next++);
+                if (!outcome.ok) {
+                    failure ??= outcome;
+                    controller.abort();
+                    return;
+                }
+            }
+        }
+        catch (error) {
+            controller.abort(error);
+            throw error;
+        }
+    };
+    // Drain all requests after abort: nothing continues in the background on return.
+    const workers = await Promise.allSettled(Array.from({ length: Math.min(3, paths.length - next) }, worker));
+    signal?.throwIfAborted();
+    if (failure)
+        return failure;
+    const rejected = workers.find((result) => result.status === 'rejected');
+    if (rejected?.status === 'rejected')
+        throw controller.signal.reason;
+    form.set('attachmentCount', String(references.length));
+    references.forEach((reference, index) => form.set(`attachment_${index}`, reference));
+}
+function stagedReference(body) {
+    const data = asRecordOrEmpty(body).data;
+    const reference = asRecordOrEmpty(data).reference;
+    return typeof reference === 'string' && reference.length > 0 ? reference : undefined;
+}

package/openapi.json

@@ -1561,7 +1561,7 @@
     "/api/devices/mac/browser-sign-in": {
       "post": {
         "operationId": "macBrowserLogin",
-        "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
+        "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, DEVICE_CALL_INTERRUPTED, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser", "login"],
         "x-kosuke-answer-timeout-ms": 590000,
@@ -8360,6 +8360,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{hintProjectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -10252,6 +10253,75 @@
         }
       }
     },
+    "/api/projects/{projectId}/attachments": {
+      "post": {
+        "operationId": "attachmentsCreate",
+        "summary": "Stage one private message attachment. Returns data.reference for an attachment slot in a subsequent message to this project, using the same credential, within one hour.",
+        "tags": ["attachments"],
+        "x-kosuke-command": ["attachments", "create"],
+        "x-kosuke-attachments": true,
+        "x-kosuke-attachment-max-files": 1,
+        "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
+        "parameters": [
+          {
+            "name": "projectId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/projects/{projectId}/backlog-items": {
       "get": {
         "operationId": "projectsBacklogItemsList",
@@ -11316,6 +11386,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -12641,6 +12712,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -14432,6 +14504,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -15648,6 +15721,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18454,6 +18528,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18741,6 +18816,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -27153,7 +27229,7 @@
       },
       "post": {
         "operationId": "integrationsBrowserConnectionsCreatePersonalNetworkLinkedin",
-        "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+        "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["integrations"],
         "x-kosuke-command": ["integrations", "browser-connections", "create"],
         "x-kosuke-variant": {
@@ -27338,7 +27414,7 @@
       },
       "post": {
         "operationId": "integrationsBrowserConnectionsCreatePersonalNetworkX",
-        "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+        "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["integrations"],
         "x-kosuke-command": ["integrations", "browser-connections", "create"],
         "x-kosuke-variant": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosuke-ai/kosuke",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "Kosuke platform CLI. The client customers install to drive app.kosuke.ai from their own machine.",
   "license": "MIT",
   "repository": {
@@ -40,11 +40,10 @@
     "vitest": "^4.1.12"
   },
   "kosukeRelease": {
-    "sourceCommit": "783c56f80b3c75df5f129ad9ef32d5f2cf0e7a92",
-    "sourceIdentity": "97a8761f0d47f9900bc37d7da2fb71dd14fc32222a97ec5d248c32986cd63bcd",
+    "sourceCommit": "3e2d836467c2180a7b9431f6bb3ec79b2cc0ae92",
+    "sourceIdentity": "5b0f74d867dc999558409d71533fae41b6be0d6c45ae4814eed97fd10d066704",
     "fragments": [
-      "cli-internal-marks-3q4y00.json",
-      "device-approval-per-turn-23f44b.json"
+      "device-call-interrupted-u4gfnl.json"
     ]
   }
 }