@neta-art/cohub-cli 7.0.0 → 7.1.0

package/dist/commands/sandboxd-binary.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
-import { chmod, copyFile, mkdir, mkdtemp, rename, rm, stat } from "node:fs/promises";
+import { chmod, copyFile, mkdir, mkdtemp, rename, rm, stat, lstat } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -40,9 +40,13 @@ const cacheDir = (version) => join(homedir(), ".cache", "cohub", "sandboxd", ver
 const cachedBinaryPath = (version) => join(cacheDir(version), BINARY_NAME);
 const archiveName = (version, target) => `${BINARY_NAME}_${version}_${target.goos}_${target.goarch}.tar.gz`;
 const isExecutableFile = async (path) => {
-    const info = await stat(path).catch(() => null);
+    const info = await lstat(path).catch(() => null);
     return Boolean(info?.isFile());
 };
+const isSafeArchiveFile = async (path) => {
+    const info = await lstat(path).catch(() => null);
+    return Boolean(info?.isFile() && info.nlink === 1);
+};
 const sha256File = async (path) => {
     const hash = createHash("sha256");
     await pipeline(createReadStream(path), hash);
@@ -87,11 +91,18 @@ const fetchText = (url, accept) => withTimeout(`Download of ${url}`, async (sign
         throw new SandboxdDownloadError(`Download failed (${response.status}) for ${url}`);
     return (await response.text()).trim();
 });
-// List the entries of a `.tar.gz` without extracting, so we can reject archives
-// that contain anything other than the expected single binary (path traversal,
-// symlinks, extra entries) before touching the filesystem.
-const listTarGz = (archivePath) => new Promise((res, rej) => {
-    const child = spawn("tar", ["-tzf", archivePath], { stdio: ["ignore", "pipe", "pipe"] });
+// v1.82.4 is already public as a binary-only archive. The native watcher
+// release adds the two notices; the old shape is accepted only for this pin.
+const CURRENT_BINARY_ONLY_VERSION = "v1.82.4";
+export function validSandboxdArchiveEntries(entries, version = SANDBOXD_VERSION) {
+    const binaryOnly = version === CURRENT_BINARY_ONLY_VERSION && entries.length === 1 && entries[0] === BINARY_NAME;
+    const expected = [BINARY_NAME, "LICENSE", "NOTICE"];
+    const withNotices = entries.length === expected.length && expected.every((entry) => entries.includes(entry));
+    return binaryOnly || withNotices;
+}
+// Reject unexpected paths before extracting the checksum-verified release.
+const listTarGz = (archivePath, verbose = false) => new Promise((res, rej) => {
+    const child = spawn("tar", [verbose ? "-tvzf" : "-tzf", archivePath], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (chunk) => {
@@ -105,7 +116,18 @@ const listTarGz = (archivePath) => new Promise((res, rej) => {
         ? res(stdout.split("\n").map((line) => line.trim()).filter(Boolean))
         : rej(new SandboxdDownloadError(`tar listing failed: ${stderr.trim() || `exit ${code}`}`)));
 });
-// Extract a single-file `.tar.gz` using the system tar (universally present on
+export async function validateSandboxdArchive(archivePath, version = SANDBOXD_VERSION) {
+    const entries = await listTarGz(archivePath);
+    if (!validSandboxdArchiveEntries(entries, version)) {
+        throw new SandboxdDownloadError(`Unexpected sandbox archive contents: ${entries.join(", ") || "(empty)"}`);
+    }
+    const details = await listTarGz(archivePath, true);
+    if (details.length !== entries.length || details.some((line) => !line.startsWith("-") || /(?: link to | -> | == )/.test(line))) {
+        throw new SandboxdDownloadError("Sandbox archive must contain only regular files");
+    }
+    return entries;
+}
+// Extract the verified `.tar.gz` using the system tar (universally present on
 // macOS and Linux), keeping the CLI free of native archive dependencies.
 const extractTarGz = (archivePath, cwd) => new Promise((res, rej) => {
     const child = spawn("tar", ["-xzf", archivePath, "-C", cwd], { stdio: ["ignore", "ignore", "pipe"] });
@@ -163,16 +185,15 @@ const downloadAndVerify = async (version, target) => {
         if (actual !== expected) {
             throw new SandboxdDownloadError(`Checksum mismatch for ${name} (expected ${expected}, got ${actual})`);
         }
-        // Verify the archive contains exactly the expected binary before extracting,
-        // guarding against path traversal / unexpected entries from a tampered CDN.
-        const entries = await listTarGz(archivePath);
-        if (entries.length !== 1 || entries[0] !== BINARY_NAME) {
-            throw new SandboxdDownloadError(`Unexpected archive contents for ${name}: ${entries.join(", ") || "(empty)"}`);
-        }
-        // Extract the single binary from the archive.
+        const entries = await validateSandboxdArchive(archivePath, version);
         await extractTarGz(archivePath, tempDir);
+        for (const entry of entries) {
+            if (!(await isSafeArchiveFile(join(tempDir, entry)))) {
+                throw new SandboxdDownloadError(`Unsafe sandbox archive entry: ${entry}`);
+            }
+        }
         const extractedBinary = join(tempDir, BINARY_NAME);
-        if (!(await isExecutableFile(extractedBinary))) {
+        if (!(await isSafeArchiveFile(extractedBinary))) {
             throw new SandboxdDownloadError(`Archive ${name} did not contain ${BINARY_NAME}`);
         }
         // Atomically move into the version cache (fall back to copy across devices).

package/dist/index.js

@@ -37,7 +37,7 @@ program
     .summary("Work with Cohub from your terminal")
     .description("Send prompts, manage Space files, and publish public output.")
     .version(VERSION, "-v, --version", "Show version")
-    .option("-s, --space <id>", "Target Space ID (defaults to your Home space)")
+    .option("-s, --space <id>", "Target Space ID")
     .option("--json", "Print machine-readable JSON when supported")
     .helpOption("-h, --help", "Show help")
     .addHelpText("after", `
@@ -54,6 +54,7 @@ Common commands:
   cohub completion "Summarize AGENTS.md" --system-prompt AGENTS.md --stream
   cohub run -- git status
   cohub runtime up ./my-project
+  cohub runtime logs --follow
   cohub search "release notes"
   cohub -s <space-id> boards inspect <board-id>
   cohub -s <space-id> spaces turns ls --author others
@@ -68,13 +69,14 @@ Common commands:
   cohub generate "A calm lake at sunrise" --model <model> --output lake.png
 
 Target space:
-  -s <space-id>, then COHUB_SPACE_ID, then your Home space
+  -s <space-id>, then COHUB_SPACE_ID, then the current directory Runtime binding, then Home
 
 Environment:
   COHUB_SPACE_ID         Target Space ID when -s is omitted
   COHUB_EXECUTION_TOKEN  Use this token instead of the stored Logto session
   ENV=dev                Use the development Cohub environment
   HTTPS_PROXY            Honored for API and uploads (also HTTP_PROXY, NO_PROXY)
+  Runtime logs            ~/.local/state/cohub/runtime/<space-id>/diagnostics
 `);
 registerAuth(program);
 registerBoards(program);

package/dist/runtime/archive-store.d.ts

@@ -23,7 +23,9 @@ export declare class RuntimeArchiveStore {
     private readonly transport?;
     private flushing;
     private readonly capturing;
+    private errorReporter;
     constructor(root: string, transport?: ArchiveTransport | undefined);
+    setErrorReporter(reporter: ((error: unknown, index?: HarnessArchiveIndex) => void) | null): void;
     pendingCount(): Promise<number>;
     failedCaptureCount(): Promise<number>;
     hasCapture(turnId: string): Promise<boolean>;

package/dist/runtime/archive-store.js

@@ -44,10 +44,14 @@ export class RuntimeArchiveStore {
     transport;
     flushing = null;
     capturing = new Map();
+    errorReporter = null;
     constructor(root, transport) {
         this.root = root;
         this.transport = transport;
     }
+    setErrorReporter(reporter) {
+        this.errorReporter = reporter;
+    }
     async pendingCount() {
         const pending = new Set();
         for (const directory of ["pending", "captures"]) {
@@ -110,7 +114,7 @@ export class RuntimeArchiveStore {
         const saved = await this.readIndex(this.version(turnId));
         if (saved) {
             if (saved.sessionId !== state.sessionId || saved.harness !== state.harness)
-                throw new Error("Archive identity mismatch / 归档身份不匹配");
+                throw new Error("Archive identity mismatch");
             const committed = await stat(join(this.root, "ready", `${turnId}.json`)).catch((error) => { if (missing(error))
                 return null; throw error; });
             if (!committed)
@@ -125,7 +129,7 @@ export class RuntimeArchiveStore {
         try {
             const before = await file.stat();
             if (!before.isFile() || !before.size)
-                throw new Error("Native archive is empty / 原生归档为空");
+                throw new Error("Native archive is empty");
             const buffer = Buffer.alloc(RUNTIME_ARCHIVE_SEGMENT_BYTES);
             let offset = 0;
             let digest = createHash("sha256");
@@ -135,7 +139,7 @@ export class RuntimeArchiveStore {
                 while (offset < previous.sizeBytes) {
                     const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, previous.sizeBytes - offset), offset);
                     if (!bytesRead)
-                        throw new Error("Native file changed during capture / 归档时文件发生变化");
+                        throw new Error("Native file changed during capture");
                     digest.update(buffer.subarray(0, bytesRead));
                     offset += bytesRead;
                 }
@@ -151,7 +155,7 @@ export class RuntimeArchiveStore {
             while (offset < before.size) {
                 const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, before.size - offset), offset);
                 if (!bytesRead)
-                    throw new Error("Native file changed during capture / 归档时文件发生变化");
+                    throw new Error("Native file changed during capture");
                 const bytes = buffer.subarray(0, bytesRead);
                 digest.update(bytes);
                 const segment = { offset, sizeBytes: bytesRead, sha256: hash(bytes), md5: hash(bytes, "md5") };
@@ -161,7 +165,7 @@ export class RuntimeArchiveStore {
             }
             const after = await stat(state.path);
             if (before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs)
-                throw new Error("Native file changed during capture / 归档时文件发生变化");
+                throw new Error("Native file changed during capture");
             if (process.platform !== "win32") {
                 const directory = await open(join(this.root, "objects"), "r");
                 try {
@@ -219,7 +223,7 @@ export class RuntimeArchiveStore {
                 queue.push(index);
         }
         if (pending.size && !queue.length)
-            throw new Error("Cyclic archive outbox / 归档队列引用循环");
+            throw new Error("Cyclic archive outbox");
         for (let cursor = 0; cursor < queue.length; cursor++) {
             signal.throwIfAborted();
             const index = queue[cursor];
@@ -228,19 +232,19 @@ export class RuntimeArchiveStore {
             try {
                 const { uploads } = await transport.prepareRuntimeArchive(index, { signal: AbortSignal.any([signal, AbortSignal.timeout(30_000)]) });
                 if (uploads.length > index.segments.length)
-                    throw new Error("Upload plan mismatch / 上传计划不匹配");
+                    throw new Error("Upload plan mismatch");
                 const expected = new Set(index.segments.map((segment) => JSON.stringify(segment)));
                 for (const { segment, uploadUrl, headers } of uploads) {
                     if (!expected.has(JSON.stringify(segment)))
-                        throw new Error("Upload segment mismatch / 上传分段不匹配");
+                        throw new Error("Upload segment mismatch");
                     signal.throwIfAborted();
                     const bytes = await readFile(this.blob(segment.sha256));
                     if (bytes.length !== segment.sizeBytes || hash(bytes) !== segment.sha256)
-                        throw new Error("Local archive segment is corrupt / 本地归档分段已损坏");
+                        throw new Error("Local archive segment is corrupt");
                     const response = await (transport.fetchObject ?? fetch)(uploadUrl, { method: "PUT", headers, body: bytes, redirect: "error", signal: AbortSignal.any([signal, AbortSignal.timeout(60_000)]) });
                     // An immutable segment may already exist after a lost acknowledgement. Commit verifies it.
                     if (!response.ok && ![409, 412].includes(response.status))
-                        throw new Error(`Archive upload failed / 归档上传失败: ${response.status}`);
+                        throw new Error(`Archive upload failed: ${response.status}`);
                 }
                 await transport.commitRuntimeArchive(index, { signal: AbortSignal.any([signal, AbortSignal.timeout(30_000)]) });
                 await atomicRuntimeJson(join(this.root, "ready", `${index.turnId}.json`), { turnId: index.turnId, sha256: index.sha256 });
@@ -248,14 +252,16 @@ export class RuntimeArchiveStore {
                 queue.push(...children.get(index.turnId) ?? []);
             }
             catch (error) {
-                if (!signal.aborted)
-                    console.error("Archive pending; native segments retained / 归档待重试，原始分段已保留:", error);
+                if (!signal.aborted) {
+                    this.errorReporter?.(error, index);
+                    console.error("Archive pending; native segments retained:", error);
+                }
             }
         }
     }
     async restore(reference, target, signal) {
         if (!this.transport)
-            throw new Error("Archive transport unavailable / 归档传输不可用");
+            throw new Error("Archive transport unavailable");
         const timeout = (ms) => signal ? AbortSignal.any([signal, AbortSignal.timeout(ms)]) : AbortSignal.timeout(ms);
         const pages = [];
         const visited = new Set();
@@ -263,18 +269,18 @@ export class RuntimeArchiveStore {
         while (turnId) {
             signal?.throwIfAborted();
             if (visited.has(turnId))
-                throw new Error("Cyclic archive / 归档引用循环");
+                throw new Error("Cyclic archive");
             visited.add(turnId);
             const page = await this.transport.getRuntimeArchive(reference.sessionId, turnId, { signal: timeout(30_000) });
             const index = harnessArchiveIndexSchema.parse(page.index);
             if (index.turnId !== turnId || index.sessionId !== reference.sessionId || index.harness !== reference.harness)
-                throw new Error("Archive identity mismatch / 归档身份不匹配");
+                throw new Error("Archive identity mismatch");
             pages.push({ ...page, index });
             turnId = index.parentTurnId;
         }
         const head = pages[0]?.index;
         if (!head)
-            throw new Error("Archive missing / 归档不存在");
+            throw new Error("Archive missing");
         await mkdir(dirname(target), { recursive: true, mode: 0o700 });
         const temporary = `${target}.${randomUUID()}.restoring`;
         const file = await open(temporary, "wx", 0o600);
@@ -284,53 +290,53 @@ export class RuntimeArchiveStore {
             for (const page of pages.reverse()) {
                 validateArchiveBoundary(page.index, parent);
                 if (page.segments.length !== page.index.segments.length)
-                    throw new Error("Missing archive segments / 归档分段缺失");
+                    throw new Error("Missing archive segments");
                 for (const [ordinal, expected] of page.index.segments.entries()) {
                     signal?.throwIfAborted();
                     const cached = await readFile(this.blob(expected.sha256)).catch((error) => { if (missing(error))
                         return null; throw error; });
                     if (cached) {
                         if (cached.length !== expected.sizeBytes || hash(cached) !== expected.sha256)
-                            throw new Error("Cached archive segment is corrupt / 缓存归档分段已损坏");
+                            throw new Error("Cached archive segment is corrupt");
                         digest.update(cached);
                         await file.writeFile(cached);
                         continue;
                     }
                     let link = page.segments[ordinal];
                     if (!link || JSON.stringify(link.segment) !== JSON.stringify(expected))
-                        throw new Error("Archive segment identity mismatch / 归档分段标识不匹配");
+                        throw new Error("Archive segment identity mismatch");
                     let response = await (this.transport.fetchObject ?? fetch)(link.downloadUrl, { redirect: "error", signal: timeout(60_000) });
                     if ([401, 403].includes(response.status)) {
                         const refreshed = await this.transport.getRuntimeArchive(reference.sessionId, page.index.turnId, { signal: timeout(30_000) });
                         link = refreshed.segments[ordinal];
                         if (!link || JSON.stringify(link.segment) !== JSON.stringify(expected))
-                            throw new Error("Archive segment missing / 归档分段缺失");
+                            throw new Error("Archive segment missing");
                         response = await (this.transport.fetchObject ?? fetch)(link.downloadUrl, { redirect: "error", signal: timeout(60_000) });
                     }
                     if (!response.ok || !response.body)
-                        throw new Error(`Archive download failed / 归档下载失败: ${response.status}`);
+                        throw new Error(`Archive download failed: ${response.status}`);
                     const segmentHash = createHash("sha256");
                     let size = 0;
                     const chunks = [];
                     for await (const chunk of response.body) {
                         size += chunk.length;
                         if (size > expected.sizeBytes)
-                            throw new Error("Archive size mismatch / 归档大小不匹配");
+                            throw new Error("Archive size mismatch");
                         chunks.push(chunk);
                         segmentHash.update(chunk);
                         digest.update(chunk);
                         await file.writeFile(chunk);
                     }
                     if (size !== expected.sizeBytes || segmentHash.digest("hex") !== expected.sha256)
-                        throw new Error("Archive checksum mismatch / 归档校验失败");
+                        throw new Error("Archive checksum mismatch");
                     await this.saveBlob(expected.sha256, Buffer.concat(chunks));
                 }
                 if (digest.copy().digest("hex") !== page.index.sha256)
-                    throw new Error("Archive version checksum mismatch / 归档版本校验失败");
+                    throw new Error("Archive version checksum mismatch");
                 parent = page.index;
             }
             if ((await file.stat()).size !== head.sizeBytes)
-                throw new Error("Archive length mismatch / 归档长度不匹配");
+                throw new Error("Archive length mismatch");
             await file.sync();
             await file.close();
             await link(temporary, target);

package/dist/runtime/connection.d.ts

@@ -1,6 +1,7 @@
 import { type RuntimeCapabilities } from "@neta-art/cohub";
 import { type HarnessOptions } from "./harness.js";
 import { type RuntimeSessionStore } from "./session-store.js";
+import { type RuntimeDiagnostics } from "./diagnostics.js";
 export type RuntimeConnectionOptions = {
     spaceId: string;
     cwd: string;
@@ -11,6 +12,8 @@ export type RuntimeConnectionOptions = {
     signal: AbortSignal;
     store: RuntimeSessionStore;
     onReady: () => void;
+    runtimeId?: string;
+    diagnostics?: RuntimeDiagnostics;
     leaseConflictTimeoutMs?: number;
 };
 export declare function serveRuntime(options: RuntimeConnectionOptions): Promise<void>;