@kosuke-ai/kosuke 1.0.51 → 1.0.53

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.53
+
+- The CLI's build tooling now resolves minimatch 11.0.3 instead of 5.1.9, closing advisory GHSA-g3hv-75wg-m249. The installed client is unchanged: minimatch is a development dependency only.
+
+## 1.0.52
+
+- `kosuke mac browser login` help now says Kosuke gives the sign-in card back when a call is cut off with DEVICE_CALL_INTERRUPTED.
+
 ## 1.0.51
 
 - The CLI automatically stages message attachments larger than 20 MiB in total, supporting up to 20 files of 10 MiB each for sessions, Deploy Chat and tasks filed into a project. Uploads stream from disk with at most three concurrent requests, preserve file order and support cancellation, with inline fallback for older servers.

package/dist/generated/commands/integrations/browser-connections-create--personal-network-linkedin.js

@@ -13,7 +13,7 @@ export const operation = {
             "equals": "linkedin"
         }
     },
-    "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+    "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
     "pathParams": [],
     "query": [],
     "body": {

package/dist/generated/commands/integrations/browser-connections-create--personal-network-x.js

@@ -13,7 +13,7 @@ export const operation = {
             "equals": "x"
         }
     },
-    "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+    "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
     "pathParams": [],
     "query": [],
     "body": {

package/dist/generated/commands/mac/browser-login.js

@@ -6,7 +6,7 @@ export const operation = {
         "browser",
         "login"
     ],
-    "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
+    "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, DEVICE_CALL_INTERRUPTED, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
     "pathParams": [],
     "query": [],
     "body": {

package/openapi.json

@@ -1561,7 +1561,7 @@
     "/api/devices/mac/browser-sign-in": {
       "post": {
         "operationId": "macBrowserLogin",
-        "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
+        "summary": "Get a site signed in in this Sensei Thread's browser from the member's everyday Chrome: pass the browser call's profile and deviceId, and the site as a bare hostname (twitter.com is x.com; Google's sites are refused). --reuse picks up the sign-in that profile in their Chrome holds by itself, with no tap: once per site and profile in a Turn, with the profile's exact ID. It never opens Chrome or waits for anyone, and answers opened false and signedIn false with chrome none (their Chrome holds no sign-in for the site, so nothing changed), same (the one this thread's browser already holds) or different (taken into this thread's browser, taken true). Then, unless it answered none or same, open the site with browser and check the account. On SIGN_IN_NEEDS_TAP or UPDATE_REQUIRED, put the sign-in card: `kosuke sensei cards set` with --sign-in naming this site, profile and deviceId. A --reuse spends no tap, so it gives no card back. Every tapped mode (`sign-in`, `take`, `waitNew`) needs the member's tap on the sign-in card in this thread; `--forget` and `--reuse` need none. A sign-in takes the sign-in that profile in their Chrome holds when it differs from this thread's, without opening anything, and answers taken true, opened false and signedIn false, since the site has not confirmed it; or else it opens --url, or the site's page, in their Chrome and waits up to 8 minutes for the member to sign in. On LinkedIn and X it answers signedIn true and opened true. On any other site a change of the site's cookies is taken and answered taken true and signedIn false, since a change is not a sign-in, and an end with no change answers taken false; a desktop app too old to watch the site opens it and answers at once, with no taken. Every answer with taken true carries waitNewLeft: while it is above 0 and the site is still signed out, --wait-new (with the same --url), in the same Turn and with no new tap, waits for a newer sign-in, never taking the one taken already, and opens the site only when this Turn has not; once the tap's time has run out it fails with SIGN_IN_WINDOW_ENDED, and no card comes back. After the member's I'm signed in tap, --take takes that site's cookies, never Google's, and answers taken. --forget removes a sign-in this Turn took, a --reuse's included, for an account other than the one expected, and needs no tap. Each tap allows one call: a call without one, or a --wait-new that no take armed, fails with SIGN_IN_NEEDS_TAP. Then open the site with browser and check the account before account-specific work. On DEVICE_OFFLINE, DEVICE_CALL_INTERRUPTED, TIMEOUT, SIGN_IN_TIMEOUT and KEYCHAIN_UNAVAILABLE Kosuke gives the member's card back by itself. Fails with SIGN_IN_TIMEOUT when Kosuke saw no new sign-in to LinkedIn or X within 8 minutes, PROFILE_DISCONNECTED for a profile turned off in Settings → Devices, KEYCHAIN_UNAVAILABLE when macOS did not let Kosuke read Chrome's sign-ins, STALE_TURN when the Turn stopped, and UPDATE_REQUIRED on a desktop app too old for it. Only Sensei calls it.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser", "login"],
         "x-kosuke-answer-timeout-ms": 590000,
@@ -27229,7 +27229,7 @@
       },
       "post": {
         "operationId": "integrationsBrowserConnectionsCreatePersonalNetworkLinkedin",
-        "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+        "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["integrations"],
         "x-kosuke-command": ["integrations", "browser-connections", "create"],
         "x-kosuke-variant": {
@@ -27414,7 +27414,7 @@
       },
       "post": {
         "operationId": "integrationsBrowserConnectionsCreatePersonalNetworkX",
-        "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
+        "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, DEVICE_CALL_INTERRUPTED (the connection to the Mac dropped; try again), PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["integrations"],
         "x-kosuke-command": ["integrations", "browser-connections", "create"],
         "x-kosuke-variant": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosuke-ai/kosuke",
-  "version": "1.0.51",
+  "version": "1.0.53",
   "description": "Kosuke platform CLI. The client customers install to drive app.kosuke.ai from their own machine.",
   "license": "MIT",
   "repository": {
@@ -39,11 +39,14 @@
     "typescript": "^5.9.0",
     "vitest": "^4.1.12"
   },
+  "overrides": {
+    "minimatch": "^11.0.1"
+  },
   "kosukeRelease": {
-    "sourceCommit": "11e0393d7adbd35a8589bef145e005e29aa8d1a7",
-    "sourceIdentity": "39feb5bff790b571ed2317abfb3663d6bfac98ad68ff123b03e57b51389bddbc",
+    "sourceCommit": "76f405f21958ac7822785b786b2ff505078c6f6c",
+    "sourceIdentity": "52859ab4c18da4960ecabb6e6ac04959918b0bec2fdfe5ed87662baf2ff80839",
     "fragments": [
-      "cli-staged-attachments.json"
+      "cli-minimatch-override-r7n2kd.json"
     ]
   }
 }