@neta-art/cohub-cli 7.1.0 → 7.1.2

package/dist/commands/sandboxd-binary.d.ts

@@ -1,9 +1,9 @@
-export declare const SANDBOXD_VERSION = "v1.82.4";
+export declare const SANDBOXD_VERSION = "v2.53.1";
 export declare class SandboxdDownloadError extends Error {
     name: string;
 }
-export declare function validSandboxdArchiveEntries(entries: string[], version?: string): boolean;
-export declare function validateSandboxdArchive(archivePath: string, version?: string): Promise<string[]>;
+export declare function validSandboxdArchiveEntries(entries: string[]): boolean;
+export declare function validateSandboxdArchive(archivePath: string): Promise<string[]>;
 export type EnsureSandboxdOptions = {
     version?: string;
     onStatus?: (message: string) => void;

package/dist/commands/sandboxd-binary.js

@@ -14,7 +14,12 @@ import { Readable } from "node:stream";
 // published by .github/workflows/sandbox-binaries-build.yml. Only bump it AFTER
 // that tag's publish-cdn job has succeeded, otherwise `runtime up` 404s on the
 // default download.
-export const SANDBOXD_VERSION = "v1.82.4";
+//
+// v2.53.1 is the first published tag with the native FSEvents file-monitoring
+// backends and the `runtimeId` control frame (earlier `v2.52.0` predates them,
+// and the old sandbox-only `v1.x` line stopped at `v1.82.4`). Running anything
+// older keeps exhausting file descriptors on macOS.
+export const SANDBOXD_VERSION = "v2.53.1";
 const BINARY_NAME = "cohub-sandboxd";
 // Public CDN prefix hosting the release archives (the repo is private, so the
 // GitHub Release assets are not publicly downloadable). Overridable for staging
@@ -91,14 +96,11 @@ const fetchText = (url, accept) => withTimeout(`Download of ${url}`, async (sign
         throw new SandboxdDownloadError(`Download failed (${response.status}) for ${url}`);
     return (await response.text()).trim();
 });
-// v1.82.4 is already public as a binary-only archive. The native watcher
-// release adds the two notices; the old shape is accepted only for this pin.
-const CURRENT_BINARY_ONLY_VERSION = "v1.82.4";
-export function validSandboxdArchiveEntries(entries, version = SANDBOXD_VERSION) {
-    const binaryOnly = version === CURRENT_BINARY_ONLY_VERSION && entries.length === 1 && entries[0] === BINARY_NAME;
-    const expected = [BINARY_NAME, "LICENSE", "NOTICE"];
-    const withNotices = entries.length === expected.length && expected.every((entry) => entries.includes(entry));
-    return binaryOnly || withNotices;
+// Every published release ships the binary alongside its LICENSE and NOTICE.
+const EXPECTED_ARCHIVE_ENTRIES = [BINARY_NAME, "LICENSE", "NOTICE"];
+export function validSandboxdArchiveEntries(entries) {
+    return (entries.length === EXPECTED_ARCHIVE_ENTRIES.length &&
+        EXPECTED_ARCHIVE_ENTRIES.every((entry) => entries.includes(entry)));
 }
 // Reject unexpected paths before extracting the checksum-verified release.
 const listTarGz = (archivePath, verbose = false) => new Promise((res, rej) => {
@@ -116,9 +118,9 @@ const listTarGz = (archivePath, verbose = false) => new Promise((res, rej) => {
         ? res(stdout.split("\n").map((line) => line.trim()).filter(Boolean))
         : rej(new SandboxdDownloadError(`tar listing failed: ${stderr.trim() || `exit ${code}`}`)));
 });
-export async function validateSandboxdArchive(archivePath, version = SANDBOXD_VERSION) {
+export async function validateSandboxdArchive(archivePath) {
     const entries = await listTarGz(archivePath);
-    if (!validSandboxdArchiveEntries(entries, version)) {
+    if (!validSandboxdArchiveEntries(entries)) {
         throw new SandboxdDownloadError(`Unexpected sandbox archive contents: ${entries.join(", ") || "(empty)"}`);
     }
     const details = await listTarGz(archivePath, true);
@@ -185,7 +187,7 @@ const downloadAndVerify = async (version, target) => {
         if (actual !== expected) {
             throw new SandboxdDownloadError(`Checksum mismatch for ${name} (expected ${expected}, got ${actual})`);
         }
-        const entries = await validateSandboxdArchive(archivePath, version);
+        const entries = await validateSandboxdArchive(archivePath);
         await extractTarGz(archivePath, tempDir);
         for (const entry of entries) {
             if (!(await isSafeArchiveFile(join(tempDir, entry)))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "7.1.0",
+  "version": "7.1.2",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "engines": {
@@ -22,7 +22,7 @@
     "commander": "^15.0.0",
     "pixi.js": "^8.20.1",
     "sharp": "^0.35.4",
-    "@neta-art/cohub": "8.20.0"
+    "@neta-art/cohub": "8.20.1"
   },
   "publishConfig": {
     "access": "public"