@neta-art/cohub-cli 10.3.0 → 10.4.2

package/dist/runtime/native/ingest.js

@@ -4,6 +4,7 @@ import { NATIVE_INGEST_MAX_TURNS, SETTLED_TURN_STATUSES } from "@neta-art/cohub"
 import { acceptsDirectory, acceptsTranscript, readSessionHeader, readTranscript, transcriptRoots } from "./adapters.js";
 import { nativeTurnId } from "./identity.js";
 import { ensurePlainCodexRollout } from "./transcript.js";
+import { containsNativePath } from "./paths.js";
 const missing = (error) => error?.code === "ENOENT";
 /** Transcripts read in parallel per lane. The live lane never waits behind a backfill. */
 const LIVE_CONCURRENCY = 2;
@@ -39,9 +40,8 @@ const BOUNDARY_OVERLAP = Math.max(...Object.values(BOUNDARIES).flat().map((token
 const IMPORT_FAILURES_KEPT = 100;
 /** Headers are read this many at a time; each costs one small read. */
 const HEADER_CONCURRENCY = 16;
-const within = (root, cwd) => cwd === root || cwd.startsWith(`${root}/`);
 /** Whether a session in `cwd` belongs to the directory bound at `root`. */
-export const owns = (root, cwd, nested = []) => Boolean(cwd) && within(root, cwd) && !nested.some((inner) => within(inner, cwd));
+export const owns = (root, cwd, nested = []) => Boolean(cwd) && containsNativePath(root, cwd) && !nested.some((inner) => containsNativePath(inner, cwd));
 /** Every transcript of the bound directory and its subdirectories, newest first. */
 export async function discoverTranscripts(cwd, harnesses, options = {}) {
     const found = [];
@@ -144,7 +144,7 @@ export class NativeIngest {
         return owns(this.options.cwd, cwd, this.nested);
     }
     exclude(nested) {
-        this.nested = nested.filter((root) => root !== this.options.cwd && within(this.options.cwd, root));
+        this.nested = nested.filter((root) => !containsNativePath(root, this.options.cwd) && containsNativePath(this.options.cwd, root));
     }
     configure(harnesses, enabledAt) {
         const added = harnesses.filter((harness) => !this.harnesses.includes(harness));
@@ -560,7 +560,7 @@ export class NativeIngest {
     }
     harnessFor(path) {
         for (const harness of this.harnesses) {
-            if (transcriptRoots(harness).some((root) => path.startsWith(`${root}/`)) && acceptsTranscript(path, harness, this.options.cwd))
+            if (transcriptRoots(harness).some((root) => containsNativePath(root, path)) && acceptsTranscript(path, harness, this.options.cwd))
                 return harness;
         }
         return null;

package/dist/runtime/native/paths.d.ts

@@ -0,0 +1,2 @@
+/** Whether a native path is the root itself or one of its descendants. */
+export declare function containsNativePath(root: string, path: string, platform?: NodeJS.Platform): boolean;

package/dist/runtime/native/paths.js

@@ -0,0 +1,7 @@
+import { posix, win32 } from "node:path";
+/** Whether a native path is the root itself or one of its descendants. */
+export function containsNativePath(root, path, platform = process.platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    const relative = paths.relative(root, path);
+    return relative === "" || relative !== ".." && !relative.startsWith(`..${paths.sep}`) && !paths.isAbsolute(relative);
+}

package/dist/runtime/native/pi-extension.js

@@ -1,6 +1,6 @@
 // Cohub control bridge for Pi. Self-contained: Node built-ins only, so it installs as one file.
 import { createHash } from "node:crypto";
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { connect } from "node:net";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -103,7 +103,17 @@ export default function cohub(pi) {
         const path = locateSocket(ctx.cwd);
         if (!path)
             return;
-        const current = connect(path);
+        // On Windows the socket file names the Runtime's private named pipe.
+        let endpoint = path;
+        if (process.platform === "win32") {
+            try {
+                endpoint = readFileSync(path, "utf8").trim();
+            }
+            catch {
+                return;
+            }
+        }
+        const current = connect(endpoint);
         socket = current;
         buffer = "";
         current.on("connect", () => send({

package/dist/runtime/native/pi-link.js

@@ -1,5 +1,6 @@
+import { randomUUID } from "node:crypto";
 import { createServer } from "node:net";
-import { chmod, mkdir, rm } from "node:fs/promises";
+import { chmod, mkdir, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { COHUB_PI_PROTOCOL } from "./pi-extension.js";
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
@@ -68,17 +69,33 @@ export class PiLink {
     }
     async listen(signal) {
         const { socketPath } = this.options;
+        const windows = process.platform === "win32";
+        // Windows named pipes share one global namespace: listen on a random name and
+        // publish it at socketPath, so another account cannot pre-claim the endpoint.
+        const endpoint = windows ? `\\\\.\\pipe\\cohub-pi-${randomUUID()}` : socketPath;
         // The socket accepts commands that drive the user's agent: only this user may reach it.
         await mkdir(dirname(socketPath), { recursive: true, mode: 0o700 });
-        if (process.platform !== "win32")
+        if (!windows)
             await chmod(dirname(socketPath), 0o700);
         await rm(socketPath, { force: true });
         const server = createServer((socket) => this.accept(socket));
         await new Promise((resolve, reject) => {
             server.once("error", reject);
-            server.listen(socketPath, () => { server.removeListener("error", reject); resolve(); });
+            server.listen(endpoint, () => { server.removeListener("error", reject); resolve(); });
         });
-        if (process.platform !== "win32")
+        if (windows) {
+            const temporary = `${socketPath}.${randomUUID()}.tmp`;
+            try {
+                await writeFile(temporary, endpoint, { mode: 0o600 });
+                await rename(temporary, socketPath);
+            }
+            catch (error) {
+                server.close();
+                await rm(temporary, { force: true });
+                throw error;
+            }
+        }
+        else
             await chmod(socketPath, 0o600);
         this.server = server;
         signal.addEventListener("abort", () => {

package/dist/runtime/native/version.js

@@ -1,8 +1,11 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { harnessCommand } from "../harness.js";
 /** A harness binary's own version, or `null` when it cannot say. */
 export async function harnessVersion(binary) {
-    const { stdout } = await promisify(execFile)(binary, ["--version"], { encoding: "utf8", timeout: 15_000 }).catch(() => ({ stdout: "" }));
+    const { stdout } = await Promise.resolve()
+        .then(() => promisify(execFile)(...harnessCommand(binary, ["--version"], process.cwd()), { encoding: "utf8", timeout: 15_000, windowsHide: true }))
+        .catch(() => ({ stdout: "" }));
     const match = /(\d+)\.(\d+)\.(\d+)/.exec(stdout);
     return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
 }

package/dist/runtime/supervisor.js

@@ -1,7 +1,9 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { createServer } from "node:net";
 import { createInterface } from "node:readline";
 import { setTimeout as delay } from "node:timers/promises";
+import { PassThrough } from "node:stream";
 import { resolveWebsocketUrl } from "@neta-art/cohub";
 import { AuthRequiredError, resolveAccessToken } from "../auth.js";
 import { createClient } from "../client.js";
@@ -22,6 +24,24 @@ export function sandboxOutputLevel(value, stream) {
         return level;
     return stream === "stderr" ? "warn" : "debug";
 }
+/**
+ * Windows cannot hand sandboxd an extra inherited pipe, so control frames use a
+ * named pipe instead. Only the first client is accepted; the name is unguessable.
+ */
+async function listenWindowsControlPipe() {
+    const path = `\\\\.\\pipe\\cohub-sandboxd-${randomUUID()}`;
+    const stream = new PassThrough();
+    const server = createServer((socket) => {
+        server.close();
+        socket.on("error", () => stream.end());
+        socket.pipe(stream);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(path, () => { server.removeListener("error", reject); resolve(); });
+    });
+    return { path, stream, close: () => { server.close(); stream.end(); } };
+}
 export async function runRuntime(config, onState, externalSignal, onDiagnostic) {
     const controller = new AbortController();
     const signal = externalSignal ? AbortSignal.any([externalSignal, controller.signal]) : controller.signal;
@@ -119,12 +139,16 @@ export async function runRuntime(config, onState, externalSignal, onDiagnostic)
                 let probeTimer;
                 let managed = false;
                 let childStopped = false;
+                let controlPipe = null;
                 try {
                     const initialToken = await token();
                     signal.throwIfAborted();
+                    if (process.platform === "win32")
+                        controlPipe = await listenWindowsControlPipe();
                     const bridge = spawn(binary, ["--local", "--space", config.spaceId, "--root", config.root, "--relay", process.env.COHUB_RELAY_URL?.trim() || relay.toString()], {
-                        stdio: ["pipe", "pipe", "pipe", "pipe"],
-                        env: { ...process.env, COHUB_RELAY_TOKEN: initialToken, COHUB_RUNTIME_ID: status.runtimeId, COHUB_LOG_FORMAT: "json", COHUB_RUNTIME_MANAGED: "1", COHUB_DISPLAY: config.display ?? "" },
+                        stdio: controlPipe ? ["pipe", "pipe", "pipe"] : ["pipe", "pipe", "pipe", "pipe"],
+                        windowsHide: true,
+                        env: { ...process.env, COHUB_RELAY_TOKEN: initialToken, COHUB_RUNTIME_ID: status.runtimeId, COHUB_LOG_FORMAT: "json", COHUB_RUNTIME_MANAGED: "1", COHUB_DISPLAY: config.display ?? "", ...(controlPipe ? { COHUB_RUNTIME_CONTROL_PIPE: controlPipe.path } : {}) },
                     });
                     bridge.stdin?.on("error", () => undefined);
                     const closed = new Promise((resolve) => {
@@ -153,7 +177,7 @@ export async function runRuntime(config, onState, externalSignal, onDiagnostic)
                             diagnostics.log(sandboxOutputLevel(parsed?.level, streamName), "sandboxd.log", { ...data, message: parsed?.msg ?? line }, { component: "sandboxd" });
                         });
                     }
-                    const control = bridge.stdio[3];
+                    const control = controlPipe ? controlPipe.stream : bridge.stdio[3];
                     const events = createInterface({ input: control });
                     events.on("line", (line) => {
                         try {
@@ -202,7 +226,11 @@ export async function runRuntime(config, onState, externalSignal, onDiagnostic)
                     };
                     probeTimer = setTimeout(() => void probe(), 1000);
                     const terminate = () => {
-                        bridge.kill("SIGTERM");
+                        // Windows has no SIGTERM; closing the managed stdin lets sandboxd stop gracefully.
+                        if (process.platform === "win32")
+                            bridge.stdin?.end();
+                        else
+                            bridge.kill("SIGTERM");
                         const timeout = setTimeout(() => bridge.kill("SIGKILL"), 3000);
                         void closed.finally(() => clearTimeout(timeout));
                     };
@@ -218,6 +246,7 @@ export async function runRuntime(config, onState, externalSignal, onDiagnostic)
                 }
                 finally {
                     childStopped = true;
+                    controlPipe?.close();
                     clearTimeout(refreshTimer);
                     clearTimeout(probeTimer);
                     update({ workspaceConnected: false });

package/dist/space-files/upload.js

@@ -1,30 +1,13 @@
 import { randomUUID } from "node:crypto";
-import { UPLOAD_MAX_BATCH_BYTES, UPLOAD_MAX_BATCH_FILES, } from "@neta-art/cohub";
+import { batchUploadEntries } from "@neta-art/cohub";
 import { putLocalFile } from "../http-put.js";
 import { createLimiter } from "./limit.js";
 const PUT_CONCURRENCY = 4;
-function batches(entries) {
-    const result = [];
-    let batch = [];
-    let bytes = 0;
-    for (const entry of entries) {
-        if (batch.length > 0 && (batch.length >= UPLOAD_MAX_BATCH_FILES || bytes + entry.size > UPLOAD_MAX_BATCH_BYTES)) {
-            result.push(batch);
-            batch = [];
-            bytes = 0;
-        }
-        batch.push(entry);
-        bytes += entry.size;
-    }
-    if (batch.length > 0)
-        result.push(batch);
-    return result;
-}
 export async function uploadLocalFiles(files, entries, options = {}) {
     const uploaded = [];
     const uploadIds = [];
     const limit = createLimiter(PUT_CONCURRENCY);
-    for (const batch of batches(entries)) {
+    for (const batch of batchUploadEntries(entries, (entry) => entry.size)) {
         const byId = new Map(batch.map((entry) => [randomUUID(), entry]));
         const plan = await files.createUpload({
             destination: { kind: "workspace", targetDir: options.targetDir },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "10.3.0",
+  "version": "10.4.2",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "engines": {
@@ -18,8 +18,8 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@neta-art/cohub": "11.3.0",
-    "@neta-art/generation": "^0.1.35",
+    "@neta-art/cohub": "11.3.2",
+    "@neta-art/generation": "^0.1.38",
     "commander": "^15.0.0",
     "sharp": "^0.35.4",
     "ws": "^8.21.3"