@neta-art/cohub-cli 8.3.0 → 8.4.0

package/README.md

@@ -178,6 +178,7 @@ Scheduling rules:
 cohub -s <spaceId> spaces sessions ls --json
 cohub -s <spaceId> spaces sessions create "<title>" --json
 cohub -s <spaceId> spaces sessions get <sessionId> --json
+cohub -s <spaceId> spaces sessions files <sessionId> --json
 cohub -s <spaceId> spaces sessions rename <sessionId> "<new title>"
 ```
 

package/dist/commands/generations.js

@@ -1,6 +1,8 @@
+import { openAsBlob } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, join } from "node:path";
 import { GenerationPolicyError, assertGenerationRequestAllowedByPolicy, parseGenerationPolicyFromEnv, } from "@neta-art/cohub";
+import { probeMediaInfo } from "@neta-art/cohub/media";
 import { createClient } from "../client.js";
 import { resolveSpace } from "../space.js";
 import { json as outJson, jsonRequested, ok, error, handleHttp, spinner } from "../output.js";
@@ -59,36 +61,48 @@ async function pathExists(path) {
 async function parseMediaInput(type, rawValue) {
     const separator = rawValue.indexOf("=");
     if (separator <= 0)
-        return { value: rawValue };
+        return { type, value: rawValue };
     const role = rawValue.slice(0, separator).trim();
     if (!mediaRoles.has(role))
-        return { value: rawValue };
+        return { type, value: rawValue };
     if (await pathExists(rawValue))
-        return { value: rawValue };
+        return { type, value: rawValue };
     if (!rolesByMediaType[type].has(role)) {
         return error("Invalid media role", `${role} cannot be used with --${type}`);
     }
     const value = rawValue.slice(separator + 1).trim();
     if (!value)
         return error("Invalid media input", `--${type} ${role}= requires a path or URL`);
-    return { value, role };
+    return { type, value, role };
 }
-async function contentFromPathOrUrl(type, rawValue) {
-    const { value, role } = await parseMediaInput(type, rawValue);
-    const meta = role ? { role } : undefined;
-    if (/^https?:\/\//.test(value)) {
-        return { type, source: { type: "url", url: value }, ...(meta ? { meta } : {}) };
+/**
+ * Local inputs upload to an unlisted public URL so tasks store a reference, not
+ * megabytes of base64. Inline data remains for `--inline`, types the upload
+ * does not accept, and failed uploads.
+ */
+async function mediaContent({ type, value, role }, upload) {
+    const block = (source) => ({ type, source, ...(role ? { meta: { role } } : {}) });
+    if (/^https?:\/\//.test(value))
+        return block({ type: "url", url: value });
+    const mediaType = mimeByExt[extname(value).toLowerCase()];
+    if (mediaType && upload) {
+        try {
+            return block({ type: "url", url: await upload(value, mediaType) });
+        }
+        catch (uploadError) {
+            const reason = uploadError instanceof Error ? uploadError.message : String(uploadError);
+            process.stderr.write(`  Could not upload ${value} (${reason}); sending it inline.\n`);
+        }
     }
     const data = await readFile(value);
-    const mediaType = mimeByExt[extname(value).toLowerCase()] ?? "application/octet-stream";
-    return {
-        type,
-        source: { type: "base64", mediaType, data: data.toString("base64") },
-        ...(meta ? { meta } : {}),
-    };
+    return block({
+        type: "base64",
+        mediaType: mediaType ?? "application/octet-stream",
+        data: data.toString("base64"),
+    });
 }
-function validateMediaRoleModes(content) {
-    const roles = content.map(metaRole).filter((role) => Boolean(role));
+function validateMediaRoleModes(inputs) {
+    const roles = inputs.flatMap(({ role }) => (role ? [role] : []));
     const hasFrameRole = roles.some((role) => frameMediaRoles.has(role));
     const hasReferenceRole = roles.some((role) => referenceMediaRoles.has(role));
     if (hasFrameRole && hasReferenceRole) {
@@ -174,13 +188,37 @@ function formatOutputLabel(block) {
 function slugOutputLabel(block) {
     return slugify(metaRole(block) ?? block.type);
 }
-function printGeneration(output) {
-    for (const block of output) {
+const PROBE_TIMEOUT_MS = 3_000;
+/** Size, duration, and frames of URL outputs, probed in parallel; best effort. */
+async function probeOutputs(output) {
+    const signal = AbortSignal.timeout(PROBE_TIMEOUT_MS);
+    const probed = await Promise.all(output.map(async (block, index) => {
+        if (block.type === "text" || block.source.type !== "url")
+            return null;
+        const info = await probeMediaInfo(block.source.url, { type: block.type, signal });
+        return Object.keys(info).length > 0 ? { index, ...info } : null;
+    }));
+    return probed.filter((media) => media !== null);
+}
+function mediaSummary(info) {
+    const parts = [
+        info?.width && info.height ? `${info.width}×${info.height}` : null,
+        info?.durationMs ? `${(info.durationMs / 1000).toFixed(1)}s` : null,
+    ].filter(Boolean);
+    return parts.length > 0 ? ` ${parts.join(" · ")}` : "";
+}
+function printGeneration(output, media) {
+    const byIndex = new Map(media.map((info) => [info.index, info]));
+    for (const [index, block] of output.entries()) {
         if (block.type === "text") {
             console.log(block.text);
         }
         else if (block.source.type === "url") {
-            console.log(`${formatOutputLabel(block)}: ${block.source.url}`);
+            const info = byIndex.get(index);
+            console.log(`${formatOutputLabel(block)}${mediaSummary(info)}: ${block.source.url}`);
+            // The last frame chains into the next clip as its first_frame.
+            if (info?.lastFrameUrl)
+                console.log(`  last frame: ${info.lastFrameUrl}`);
         }
         else {
             console.log(`${formatOutputLabel(block)}: base64 ${block.source.mediaType} (${block.source.data.length} chars)`);
@@ -242,11 +280,15 @@ export function registerGenerations(program) {
         .option("--parameters <json>", "Generation parameters as a JSON object")
         .option("--meta <json>", "Meta as a JSON object")
         .option("-o, --output <path>", "Save generated output to a file or directory")
+        .option("--inline", "Send local input files inline instead of uploading them to an unlisted public URL")
         .option("--async", "Queue the generation task and return immediately")
         .option("--timeout-ms <ms>", "Maximum time to wait in synchronous mode")
         .option("--json", "Output as JSON")
         .addHelpText("after", `
 
+Local input files upload to an unlisted public URL before the task is created;
+pass --inline to keep them inside the task instead.
+
 Examples:
   cohub models ls --model-type multimodal
   cohub -s <space-id> generate "A calm lake at sunrise" -m <model> -o lake.png
@@ -259,11 +301,18 @@ Examples:
         .action(async (prompt, opts) => {
         try {
             const spaceId = await resolveSpace(program);
-            const content = [{ type: "text", text: prompt }];
-            content.push(...await Promise.all(opts.image.map((value) => contentFromPathOrUrl("image", value))));
-            content.push(...await Promise.all(opts.video.map((value) => contentFromPathOrUrl("video", value))));
-            content.push(...await Promise.all(opts.audio.map((value) => contentFromPathOrUrl("audio", value))));
-            validateMediaRoleModes(content);
+            const sessionId = envValue("COHUB_SESSION_ID");
+            const inputs = await Promise.all([
+                ...opts.image.map((value) => parseMediaInput("image", value)),
+                ...opts.video.map((value) => parseMediaInput("video", value)),
+                ...opts.audio.map((value) => parseMediaInput("audio", value)),
+            ]);
+            validateMediaRoleModes(inputs);
+            for (const { value } of inputs) {
+                if (!/^https?:\/\//.test(value) && !(await pathExists(value))) {
+                    return error("Input not found", value);
+                }
+            }
             const parameters = parseParams(opts.param, opts.parameters);
             try {
                 assertGenerationRequestAllowedByPolicy({
@@ -279,9 +328,25 @@ Examples:
             }
             const meta = parseMeta(opts.meta);
             const client = createClient();
+            // Validate everything first, so rejected requests never upload files.
+            const upload = opts.inline ? null : async (path, mimeType) => {
+                const asset = await client.publicAssets.uploadGenerationInput({
+                    spaceId,
+                    sessionId,
+                    file: await openAsBlob(path, { type: mimeType }),
+                    mimeType,
+                    filename: basename(path),
+                });
+                process.stderr.write(`  Uploaded ${path} to an unlisted public URL; use --inline to keep inputs private.\n`);
+                return asset.publicUrl;
+            };
+            const content = [
+                { type: "text", text: prompt },
+                ...await Promise.all(inputs.map((input) => mediaContent(input, upload))),
+            ];
             const created = await client.generations.create({
                 spaceId,
-                sessionId: envValue("COHUB_SESSION_ID"),
+                sessionId,
                 turnId: envValue("COHUB_TURN_ID"),
                 model: opts.model,
                 content,
@@ -310,10 +375,19 @@ Examples:
             });
             if (!jsonRequested(opts))
                 spin.stop(`Generation completed — task ID: ${created.taskRunId}, ${formatElapsed(Date.now() - waitStartedAt)}, ${pollCount} polls`);
-            const savedPaths = opts.output ? await saveOutputs(result.output, opts.output) : [];
-            if (jsonRequested(opts))
-                return outJson(savedPaths.length > 0 ? { ...result, taskRunId: created.taskRunId, savedPaths } : { ...result, taskRunId: created.taskRunId });
-            printGeneration(result.output);
+            const [savedPaths, outputMedia] = await Promise.all([
+                opts.output ? saveOutputs(result.output, opts.output) : Promise.resolve([]),
+                probeOutputs(result.output),
+            ]);
+            if (jsonRequested(opts)) {
+                return outJson({
+                    ...result,
+                    taskRunId: created.taskRunId,
+                    ...(outputMedia.length > 0 ? { outputMedia } : {}),
+                    ...(savedPaths.length > 0 ? { savedPaths } : {}),
+                });
+            }
+            printGeneration(result.output, outputMedia);
             if (result.requestId || result.cost !== undefined || result.billing) {
                 const details = [
                     result.requestId ? `request ID: ${result.requestId}` : null,

package/dist/commands/spaces.js

@@ -1354,6 +1354,44 @@ function registerSessions(spacesCmd) {
             handleHttp(e);
         }
     });
+    sessionsCmd
+        .command("files <id>")
+        .description("List Space files changed by a session")
+        .option("--limit <n>", "Maximum files to list; the server caps it", "200")
+        .option("--json", "Output as JSON")
+        .action(async (id, opts) => {
+        const spaceId = await resolveSpace(spacesCmd);
+        const limit = Number.parseInt(opts.limit, 10);
+        if (!Number.isInteger(limit) || limit < 1) {
+            return error("Invalid limit", "--limit must be a positive integer");
+        }
+        const client = createClient();
+        try {
+            const result = await client.space(spaceId).session(id).files({ limit });
+            if (jsonRequested(opts))
+                return outJson(result);
+            if (result.files.length === 0) {
+                console.log("  (empty)");
+                return;
+            }
+            table(result.files.map((file) => ({
+                path: file.path,
+                change: file.lastKind,
+                count: file.changeCount,
+                turn: file.lastTurnSequence,
+                changedAt: file.lastChangedAt,
+            })), [
+                { key: "path", label: "Path" },
+                { key: "change", label: "Change" },
+                { key: "count", label: "Count" },
+                { key: "turn", label: "Turn" },
+                { key: "changedAt", label: "Changed" },
+            ]);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
     sessionsCmd
         .command("rename <id> <name>")
         .description("Rename a session")

package/dist/runtime/connection.js

@@ -50,18 +50,18 @@ export async function serveRuntime(options) {
                 if (options.signal.aborted)
                     return;
                 log("warn", "runtime.connection_failed", { error: serializeDiagnosticError(error) });
-                outcome = "retry";
+                outcome = { kind: "retry" };
             }
             options.onDisconnected?.();
             if (options.signal.aborted)
                 return;
-            if (outcome === "fatal")
-                throw new Error("Runtime connection rejected; check permissions or upgrade the CLI");
+            if (outcome.kind === "fatal")
+                throw new Error(`Runtime connection rejected (${[outcome.code, outcome.reason].filter(Boolean).join(" ")}); ${outcome.code === 4403 ? "check Space permissions" : "upgrade the CLI"}`);
             if (readyAt && Date.now() - readyAt >= 60_000) {
                 backoff = 500;
                 attempt = 0;
             }
-            if (outcome === "conflict") {
+            if (outcome.kind === "conflict") {
                 conflictSince ??= Date.now();
                 if (Date.now() - conflictSince >= (options.leaseConflictTimeoutMs ?? 90_000)) {
                     throw new Error("Space is already connected to another Runtime");
@@ -70,7 +70,7 @@ export async function serveRuntime(options) {
             log("debug", "runtime.reconnect_scheduled", {
                 attempt: attempt || 1,
                 delayMs: backoff,
-                outcome,
+                outcome: outcome.kind,
             });
             await delay(backoff / 2 + Math.random() * backoff / 2, undefined, { signal: options.signal }).catch(() => undefined);
             backoff = Math.min(30_000, backoff * 2);
@@ -118,6 +118,8 @@ async function connect(options) {
     let lastHeartbeat = Date.now();
     let connectionId = null;
     let fatal = false;
+    let fatalCode = 0;
+    let fatalReason = "";
     let conflict = false;
     let unauthorized = false;
     let readyTimer;
@@ -207,9 +209,13 @@ async function connect(options) {
         socket.addEventListener("close", (event) => {
             unauthorized = event.code === 4401;
             fatal = [4400, 4403].includes(event.code);
+            if (fatal) {
+                fatalCode = event.code;
+                fatalReason = event.reason;
+            }
             conflict = event.code === 4409;
             disconnected.abort();
-            log(options.signal.aborted ? "debug" : fatal || conflict ? "error" : "warn", "runtime.websocket.closed", {
+            log(options.signal.aborted ? "debug" : fatal || conflict ? "error" : "warn", fatal ? "runtime.websocket.rejected" : "runtime.websocket.closed", {
                 code: event.code,
                 reason: event.reason,
                 durationMs: Date.now() - connectedAt,
@@ -603,5 +609,5 @@ async function connect(options) {
     }
     if (unauthorized && !options.signal.aborted)
         await options.token(true);
-    return fatal ? "fatal" : conflict ? "conflict" : "retry";
+    return fatal ? { kind: "fatal", code: fatalCode, reason: fatalReason } : conflict ? { kind: "conflict" } : { kind: "retry" };
 }

package/dist/runtime/harness.d.ts

@@ -7,6 +7,8 @@ export type HarnessOptions = {
 export declare function harnessExecutableCandidates(binary: string, cwd: string, path: string, platform?: NodeJS.Platform, pathExt?: string | undefined): string[];
 /** Discover installed executables only; authentication/capability errors stay explicit. */
 export declare function installedHarnesses(cwd: string, options: HarnessOptions, path?: string): Promise<("pi" | "codex")[]>;
+/** Aborted streams leave tool calls with an empty id or name. */
+export declare const identifiable: (value: unknown) => value is string;
 export declare function piContent(value: unknown): ContentBlock[];
 export declare function imageForPi(block: Extract<ContentBlock, {
     type: "image";

package/dist/runtime/harness.js

@@ -35,6 +35,8 @@ export async function installedHarnesses(cwd, options, path = process.env.PATH ?
 }
 const array = (value) => Array.isArray(value) ? value : [];
 const text = (value) => typeof value === "string" ? value : "";
+/** Aborted streams leave tool calls with an empty id or name. */
+export const identifiable = (value) => typeof value === "string" && value.length > 0;
 export function piContent(value) {
     return array(value).flatMap((entry) => {
         const block = record(entry);
@@ -43,7 +45,7 @@ export function piContent(value) {
         if (block.type === "thinking")
             return [{ type: "thinking", thinking: text(block.thinking), ...(typeof (block.thinkingSignature ?? block.signature) === "string" ? { signature: String(block.thinkingSignature ?? block.signature) } : {}) }];
         if (block.type === "toolCall")
-            return [{ type: "tool_use", id: text(block.id), name: text(block.name), input: record(block.arguments) }];
+            return identifiable(block.id) && identifiable(block.name) ? [{ type: "tool_use", id: block.id, name: block.name, input: record(block.arguments) }] : [];
         if (block.type === "image")
             return [{ type: "image", source: { type: "base64", data: text(block.data), media_type: text(block.mimeType) } }];
         return [{ type: "text", text: JSON.stringify(block) }];
@@ -105,7 +107,9 @@ export function codexItemContent(item) {
         return [];
     if (item.type === "contextCompaction")
         return [{ type: "system_note", note_type: "compacted", text: "Context compacted" }];
-    const id = text(item.id);
+    const id = item.id;
+    if (!identifiable(id))
+        return [];
     const name = item.type === "commandExecution" ? "bash" : item.type === "fileChange" ? "apply_patch" : text(item.tool) || text(item.type);
     const input = item.type === "commandExecution" ? { command: item.command, cwd: item.cwd } : item.type === "fileChange" ? { changes: item.changes } : record(item.arguments);
     return [

package/dist/runtime/json-rpc.d.ts

@@ -13,6 +13,10 @@ export declare class JsonLineDecoder {
     push(chunk: Buffer): void;
     end(): void;
 }
+/** Anything surfacing while the host closes the process; not a failure. */
+export declare class RpcProcessClosedError extends Error {
+    constructor();
+}
 export declare function harnessEnvironment(): NodeJS.ProcessEnv;
 export declare class JsonRpcProcess {
     private mode;

package/dist/runtime/json-rpc.js

@@ -44,6 +44,10 @@ export class JsonLineDecoder {
     }
     end() { this.append(this.decoder.end()); this.emit(); }
 }
+/** Anything surfacing while the host closes the process; not a failure. */
+export class RpcProcessClosedError extends Error {
+    constructor() { super("RPC process closed"); this.name = "RpcProcessClosedError"; }
+}
 export function harnessEnvironment() {
     return Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("COHUB_") && !["WORKER_SECRET", "DATABASE_URL", "REDIS_URL"].includes(key)));
 }
@@ -81,12 +85,12 @@ export class JsonRpcProcess {
         this.child.stderr.on("data", (chunk) => { this.stderr = (this.stderr + chunk.toString()).slice(-8192); });
         this.child.on("error", (error) => this.fail(error));
         this.child.stdin.on("error", (error) => this.fail(error));
-        this.child.once("close", (code) => this.fail(new Error(`${binary} exited (${code}): ${this.stderr}`)));
+        this.child.once("close", (code, signal) => this.fail(new Error(signal ? `${binary} terminated by ${signal}: ${this.stderr}` : `${binary} exited (${code}): ${this.stderr}`)));
     }
     fail(value) {
         if (this.failure)
             return;
-        this.failure = value instanceof Error ? value : new Error(String(value));
+        this.failure = this.closing ? new RpcProcessClosedError() : value instanceof Error ? value : new Error(String(value));
         for (const pending of this.pending.values()) {
             clearTimeout(pending.timer);
             pending.reject(this.failure);
@@ -168,7 +172,7 @@ export class JsonRpcProcess {
             this.child.stdin.destroy();
             this.child.stdout.destroy();
             this.child.stderr.destroy();
-            this.fail(new Error("RPC process closed"));
+            this.fail(new RpcProcessClosedError());
             this.listeners.clear();
             this.failureListeners.clear();
             this.timeoutListeners.clear();

package/dist/runtime/launch.js

@@ -10,7 +10,7 @@ import { createClient } from "../client.js";
 import { currentIdentityKey, explicitSpace } from "../space.js";
 import { canonicalRuntimeRoot, getRuntimeSpaceBinding, resolveRuntimeSpace } from "./space-binding.js";
 import { controlRuntimeInstance, requestRuntimeInstance, runtimeInstanceDirectory } from "./instance.js";
-import { ensureNativeSync } from "./native/attach.js";
+import { ensureNativeSync, repairIntegrations } from "./native/attach.js";
 import { createDiagnosticConsole, printRuntimeSummary, runtimeWebUrl } from "./presentation.js";
 import { runRuntime } from "./supervisor.js";
 export const resolveLocalSpaceName = (root, name) => name?.trim() || basename(root) || "local-space";
@@ -144,6 +144,7 @@ export async function runtimeUp(program, dir, options) {
     if (createNew && binding && await requestRuntimeInstance(runtimeInstanceDirectory(identity, binding.spaceId))) {
         throw new Error("Stop the existing Runtime before rebinding this directory");
     }
+    await repairIntegrations(options.pi);
     // Fail local preflight before creating remote state; the worker reuses this catalog.
     const capabilities = await discoverHarnesses(harnesses, options, root);
     const client = createClient();

package/dist/runtime/native/attach.d.ts

@@ -30,4 +30,9 @@ export declare function nativeSyncSatisfied(config: NativeConfig | null, input:
  * the user agrees; a failure here never blocks the Runtime, it only leaves sessions read-only.
  */
 export declare function ensureNativeSync(input: Input, log?: (line: string) => void, ask?: Ask): Promise<NativeSyncReport>;
+/**
+ * Before any harness starts, repair what earlier releases installed: an outdated Pi extension can keep
+ * Pi from starting, and legacy Codex hooks run a script that is gone. Both had consent back then.
+ */
+export declare function repairIntegrations(piBinary: string | undefined, log?: (line: string) => void): Promise<void>;
 export {};

package/dist/runtime/native/attach.js

@@ -75,12 +75,22 @@ export async function ensureNativeSync(input, log = (line) => process.stderr.wri
     }
     return { enabled: true, harnesses, codexShared, importHistory };
 }
-/** Keep integrations current on every `up`. Pi without the extension still syncs, read-only. */
+/** Keep integrations current on every `up`. */
 async function maintain(config, log, piBinary, announce = false) {
-    if (config.harnesses.includes("codex"))
-        await removeLegacyCodexHooks().catch(() => undefined);
-    if (!config.harnesses.includes("pi"))
-        return;
+    if (config.harnesses.includes("pi"))
+        await maintainPiExtension(piBinary, log, announce);
+}
+/**
+ * Before any harness starts, repair what earlier releases installed: an outdated Pi extension can keep
+ * Pi from starting, and legacy Codex hooks run a script that is gone. Both had consent back then.
+ */
+export async function repairIntegrations(piBinary, log = (line) => process.stderr.write(line)) {
+    await removeLegacyCodexHooks().catch(() => undefined);
+    if (await piExtensionState().catch(() => null) === "outdated")
+        await maintainPiExtension(piBinary, log);
+}
+/** Pi without the extension still syncs, read-only. */
+async function maintainPiExtension(piBinary, log, announce = false) {
     const version = await harnessVersion(piBinary || "pi");
     if (!atLeast(version, PI_MIN_VERSION)) {
         log(`Pi ${formatVersion(version)} predates the Cohub extension (${PI_MIN_VERSION.join(".")}+); Pi chats sync read-only\n`);

package/dist/runtime/native/execution.js

@@ -1,5 +1,5 @@
 import { imageForPi } from "../harness.js";
-import { JsonRpcProcess, record } from "../json-rpc.js";
+import { JsonRpcProcess, record, RpcProcessClosedError } from "../json-rpc.js";
 import { ProcessCleanupUncertainError } from "../process-group.js";
 import { serializeDiagnosticError } from "../diagnostics.js";
 import { openPrivateServer } from "./codex-link.js";
@@ -322,7 +322,10 @@ async function codexPrompt(input) {
 function watchHost(host, diagnostics, context) {
     if (!diagnostics)
         return;
-    host.onFailure((error) => diagnostics.log("error", "harness.rpc_process_failed", { error: serializeDiagnosticError(error) }, { ...context, component: "harness" }));
+    host.onFailure((error) => {
+        if (!(error instanceof RpcProcessClosedError))
+            diagnostics.log("error", "harness.rpc_process_failed", { error: serializeDiagnosticError(error) }, { ...context, component: "harness" });
+    });
     host.onTimeout((method, timeoutMs) => diagnostics.log("error", "harness.rpc_timeout", { method, timeoutMs }, { ...context, component: "harness" }));
 }
 /** Close a harness process Cohub started. An unconfirmable cleanup marks the result uncertain; it never masks it. */

package/dist/runtime/native/install.js

@@ -7,19 +7,23 @@ import { withRuntimeSpaceBindingsLock } from "../space-binding.js";
 const missing = (error) => error.code === "ENOENT";
 /** First line of the installed extension; a file without it belongs to someone else. */
 const PI_EXTENSION_HEADER = "// Cohub control extension for Pi. Managed by `cohub runtime`; local edits are replaced on upgrade.\n";
-/** Earlier releases installed a re-export under this name; it points at a module that no longer exists. */
-const LEGACY_PI_EXTENSION_HEADER = "// Cohub native Turn sync\n";
+/** CLI 8.0–8.2 installed a re-export under this comment; its module is gone, so Pi fails to start while it remains. */
+const LEGACY_PI_EXTENSION_HEADER = "// Cohub native Turn sync";
 /** Earlier releases installed Codex hooks; they are removed on upgrade. */
 const LEGACY_CODEX_HOOKS = /\n*# BEGIN COHUB NATIVE SYNC\n[\s\S]*?# END COHUB NATIVE SYNC\n?/;
 export const piAgentDirectory = () => process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent");
 const codexConfigPath = () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "config.toml");
 /** The extension shipped with this CLI: one self-contained module, loadable by Pi as is. */
 export const piExtensionSource = () => fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "./pi-extension.ts" : "./pi-extension.js", import.meta.url));
-const piExtensionTarget = (source) => join(piAgentDirectory(), "extensions", `cohub${extname(source)}`);
+const piExtensionPath = (extension) => join(piAgentDirectory(), "extensions", `cohub${extension}`);
+const readOptional = (path) => readFile(path, "utf8").catch((error) => { if (missing(error))
+    return null; throw error; });
+const isLegacy = (text) => Boolean(text?.startsWith(LEGACY_PI_EXTENSION_HEADER));
 export async function piExtensionState() {
     const source = piExtensionSource();
-    const [expected, current] = await Promise.all([readFile(source, "utf8"), readFile(piExtensionTarget(source), "utf8").catch((error) => { if (missing(error))
-            return null; throw error; })]);
+    const [expected, current, legacy] = await Promise.all([readFile(source, "utf8"), readOptional(piExtensionPath(extname(source))), readOptional(piExtensionPath(".ts"))]);
+    if (isLegacy(legacy))
+        return "outdated";
     if (current === null)
         return "missing";
     if (current === PI_EXTENSION_HEADER + expected)
@@ -30,22 +34,26 @@ export async function piExtensionState() {
 export async function installPiExtension() {
     const source = piExtensionSource();
     const content = PI_EXTENSION_HEADER + await readFile(source, "utf8");
-    const target = piExtensionTarget(source);
+    const target = piExtensionPath(extname(source));
     await writeManaged(target, (existing) => {
-        if (existing !== null && !existing.startsWith(PI_EXTENSION_HEADER))
+        if (existing !== null && !existing.startsWith(PI_EXTENSION_HEADER) && !isLegacy(existing))
             throw new Error(`${target} exists and is not managed by Cohub; move it aside, then retry`);
         return content;
     }, { backup: false });
-    for (const legacy of ["cohub.ts", "cohub.js"].map((name) => join(dirname(target), name)).filter((path) => path !== target)) {
-        const text = await readFile(legacy, "utf8").catch(() => null);
-        if (text?.startsWith(LEGACY_PI_EXTENSION_HEADER) || text?.startsWith(PI_EXTENSION_HEADER))
-            await rm(legacy, { force: true });
+    // Pi loads every file here: drop a legacy or managed copy under the other extension.
+    for (const other of [".ts", ".js"].map(piExtensionPath).filter((path) => path !== target)) {
+        const text = await readOptional(other).catch(() => null);
+        if (isLegacy(text) || text?.startsWith(PI_EXTENSION_HEADER))
+            await rm(other, { force: true });
     }
     return "installed";
 }
 /** Remove the Codex hooks earlier releases installed; Cohub now reads Codex's own files instead. */
 export async function removeLegacyCodexHooks() {
     const path = codexConfigPath();
+    // Read first: the lock would create `~/.codex` for someone who never used Codex.
+    if (!LEGACY_CODEX_HOOKS.test(await readOptional(path) ?? ""))
+        return false;
     let removed = false;
     await writeManaged(path, (existing) => {
         if (existing === null || !LEGACY_CODEX_HOOKS.test(existing))

package/dist/runtime/native/transcript.js

@@ -6,7 +6,7 @@ import { homedir } from "node:os";
 import { basename, join } from "node:path";
 import { createZstdDecompress } from "node:zlib";
 import { pipeline } from "node:stream/promises";
-import { piContent } from "../harness.js";
+import { identifiable, piContent } from "../harness.js";
 import { codexTokenTotals, codexUsage } from "../codex-usage.js";
 import { record } from "../json-rpc.js";
 const text = (value) => typeof value === "string" ? value : "";
@@ -265,6 +265,7 @@ function parsePiTranscript(lines, options) {
     let cloudSessionId = text(record(header.cohub).sessionId) || text(record(header.affinity).sessionId);
     let current = null;
     let messages = [];
+    const calls = new Map(); // tool call id → owning message
     let pendingMarker = null;
     let completedAt = iso(header.timestamp);
     const finish = (settled) => {
@@ -310,16 +311,19 @@ function parsePiTranscript(lines, options) {
                 cloudSessionId = text(record(message.meta).sourceSessionId) || cloudSessionId;
             current = { key: text(entry.id), parentKey: turns.at(-1)?.key ?? null, ...(cloudTurnId ? { cloudTurnId } : {}), userContent: typeof message.content === "string" ? [{ type: "text", text: message.content }] : piContent(message.content), messages: [], startedAt: completedAt, startBytes: line.startBytes, endBytes: line.endBytes, contentEndBytes: line.endBytes, boundaries: {}, sha256: line.sha256, result: null };
             messages = current.messages;
+            calls.clear();
         }
         else if (current && message.role === "assistant") {
-            messages.push({ content: piContent(message.content), provider: text(message.provider) || null, model: text(message.model) || null,
-                usage: record(message.usage), stopReason: text(message.stopReason) || null, errorMessage: text(message.errorMessage) || null });
+            const assistant = { content: piContent(message.content), provider: text(message.provider) || null, model: text(message.model) || null,
+                usage: record(message.usage), stopReason: text(message.stopReason) || null, errorMessage: text(message.errorMessage) || null };
+            messages.push(assistant);
+            for (const block of assistant.content)
+                if (block.type === "tool_use")
+                    calls.set(block.id, assistant);
         }
         else if (current && message.role === "toolResult") {
-            const assistant = messages.at(-1);
-            if (!assistant)
-                throw new Error("Pi tool result has no assistant Turn");
-            assistant.content.push({ type: "tool_result", tool_use_id: text(message.toolCallId), content: typeof message.content === "string" ? message.content : piContent(message.content), is_error: Boolean(message.isError) });
+            const id = text(message.toolCallId);
+            calls.get(id)?.content.push({ type: "tool_result", tool_use_id: id, content: typeof message.content === "string" ? message.content : piContent(message.content), is_error: Boolean(message.isError) });
         }
         if (current) {
             current.endBytes = line.endBytes;
@@ -390,6 +394,7 @@ function parseCodexLines(lines, segment) {
     const turns = [];
     let current = null;
     let messages = [];
+    const calls = new Map(); // tool call id → owning message
     let model = null;
     let cloudSessionId = text(record(metadata.cohub).sessionId);
     let provider = text(metadata.model_provider) || null;
@@ -417,6 +422,7 @@ function parseCodexLines(lines, segment) {
                 throw new Error("Codex Turn identity is missing");
             messages = current.messages;
             userFromResponse = false;
+            calls.clear();
         }
         if (entry.type === "token_usage_record") {
             const usage = record(payload.turn_token_usage);
@@ -469,10 +475,15 @@ function parseCodexLines(lines, segment) {
                 catch {
                     input = { raw: payload.arguments };
                 }
-                assistant().content.push({ type: "tool_use", id: text(payload.call_id), name: text(payload.name), input });
+                if (identifiable(payload.call_id) && identifiable(payload.name)) {
+                    const owner = assistant();
+                    owner.content.push({ type: "tool_use", id: payload.call_id, name: payload.name, input });
+                    calls.set(payload.call_id, owner);
+                }
             }
             else if (["function_call_output", "custom_tool_call_output"].includes(text(payload.type))) {
-                assistant().content.push({ type: "tool_result", tool_use_id: text(payload.call_id), content: typeof payload.output === "string" ? payload.output : JSON.stringify(payload.output ?? null) });
+                const id = text(payload.call_id);
+                calls.get(id)?.content.push({ type: "tool_result", tool_use_id: id, content: typeof payload.output === "string" ? payload.output : JSON.stringify(payload.output ?? null) });
             }
         }
         if (entry.type === "event_msg" && payload.type === "item_completed") {

package/dist/runtime/native/translate.js

@@ -1,8 +1,9 @@
-import { codexItemContent, piContent } from "../harness.js";
+import { codexItemContent, identifiable, piContent } from "../harness.js";
 import { codexTokenTotals, codexUsage, subtractCodexTokens } from "../codex-usage.js";
 import { record } from "../json-rpc.js";
 const text = (value) => typeof value === "string" ? value : "";
 const list = (value) => Array.isArray(value) ? value : [];
+const hasToolCall = (content, id) => content.some((block) => block.type === "tool_use" && block.id === id);
 /** Pi emits the same event shapes to its extensions as over RPC. */
 export function piTranslator(emit) {
     let ordinal = -1;
@@ -22,18 +23,18 @@ export function piTranslator(emit) {
                 current = piContent(message.content);
                 emit({ type: "content.replace", ordinal, content: current });
             }
+            const toolCallId = text(event.toolCallId);
             if (type === "tool_execution_start") {
-                const id = text(event.toolCallId);
-                if (!current.some((block) => block.type === "tool_use" && block.id === id))
-                    current.push({ type: "tool_use", id, name: text(event.toolName), input: record(event.args), _meta: { toolStatus: "running" } });
-                emit({ type: "content.replace", ordinal, content: [...current] });
+                if (identifiable(toolCallId) && identifiable(event.toolName) && !hasToolCall(current, toolCallId)) {
+                    current.push({ type: "tool_use", id: toolCallId, name: event.toolName, input: record(event.args), _meta: { toolStatus: "running" } });
+                    emit({ type: "content.replace", ordinal, content: [...current] });
+                }
             }
-            if (type === "tool_execution_update" || type === "tool_execution_end") {
-                const id = text(event.toolCallId);
+            if ((type === "tool_execution_update" || type === "tool_execution_end") && hasToolCall(current, toolCallId)) {
                 const raw = type === "tool_execution_end" ? event.result : event.partialResult;
                 const resultContent = typeof raw === "string" ? raw : piContent(record(raw).content);
-                current = current.filter((block) => block.type !== "tool_result" || block.tool_use_id !== id);
-                current.push({ type: "tool_result", tool_use_id: id, content: resultContent, is_error: Boolean(event.isError), _meta: { toolStatus: type === "tool_execution_end" ? "done" : "running" } });
+                current = current.filter((block) => block.type !== "tool_result" || block.tool_use_id !== toolCallId);
+                current.push({ type: "tool_result", tool_use_id: toolCallId, content: resultContent, is_error: Boolean(event.isError), _meta: { toolStatus: type === "tool_execution_end" ? "done" : "running" } });
                 emit({ type: "content.replace", ordinal, content: [...current] });
             }
             if (type === "message_update") {
@@ -45,7 +46,9 @@ export function piTranslator(emit) {
                 const content = piContent(message.content);
                 for (const value of list(event.toolResults)) {
                     const result = record(value);
-                    content.push({ type: "tool_result", tool_use_id: text(result.toolCallId), content: typeof result.content === "string" ? result.content : piContent(result.content), is_error: Boolean(result.isError) });
+                    const id = text(result.toolCallId);
+                    if (hasToolCall(content, id))
+                        content.push({ type: "tool_result", tool_use_id: id, content: typeof result.content === "string" ? result.content : piContent(result.content), is_error: Boolean(result.isError) });
                 }
                 const stopReason = text(message.stopReason);
                 last = { ordinal: Math.max(0, ordinal), content, provider: text(message.provider) || null, model: text(message.model) || null, usage: message.usage, stopReason: stopReason === "toolUse" ? "tool_use" : stopReason || "stop", errorMessage: text(message.errorMessage) || null };

package/dist/runtime/presentation.js

@@ -6,6 +6,7 @@ const messages = {
     "runtime.ready": "Harness connected",
     "runtime.available": "Runtime ready",
     "runtime.websocket.closed": "Connection lost; reconnecting",
+    "runtime.websocket.rejected": "Connection rejected; not reconnecting",
     "runtime.heartbeat_timeout": "Connection timed out; reconnecting",
     "runtime.auth_token_failed": "Cannot obtain credentials; retrying",
     "runtime.auth_required": "Sign in with cohub auth login",

package/dist/runtime/process-group.js

@@ -19,8 +19,8 @@ async function probeLinux(pid) {
                 members.push({ pid: Number(entry), state: state ?? "U" });
         }
         catch (error) {
-            // The member exited between readdir and read; it cannot execute anymore.
-            if (error.code !== "ENOENT")
+            // Exited between readdir and read.
+            if (!["ENOENT", "ESRCH"].includes(error.code ?? ""))
                 throw error;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "engines": {
@@ -23,7 +23,7 @@
     "pixi.js": "^8.20.1",
     "sharp": "^0.35.4",
     "ws": "^8.21.3",
-    "@neta-art/cohub": "8.22.0"
+    "@neta-art/cohub": "8.23.0"
   },
   "publishConfig": {
     "access": "public"