@aku11i/phantom 6.3.0-1 → 6.3.0-2

package/app/server/{app-xJWxEPI1.mjs → app-BLBOjh4e.mjs}

@@ -3,6 +3,7 @@ import { join } from "path";
 import { createReadStream, existsSync, statSync } from "fs";
 import fs, { copyFile, mkdir, mkdtemp, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import path, { basename, dirname, extname, isAbsolute, join as join$1, relative, resolve, sep } from "node:path";
+import { inflateSync } from "node:zlib";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { existsSync as existsSync$1 } from "node:fs";
@@ -24903,6 +24904,10 @@ function createUserInput(text, options = {}) {
 		name: file.name,
 		path: file.path
 	});
+	for (const attachment of options.attachments ?? []) input.push({
+		type: "localImage",
+		path: attachment.path
+	});
 	return input;
 }
 var CodexBridge = class {
@@ -25320,6 +25325,12 @@ const projectRecordBaseSchema = object({
 	updatedAt: string(),
 	lastOpenedAt: string()
 });
+const chatAttachmentRecordBaseSchema = object({
+	name: string(),
+	path: string(),
+	mimeType: string(),
+	size: number$1().int().nonnegative()
+});
 const chatMessageRecordBaseSchema = object({
 	id: string(),
 	chatId: string(),
@@ -25330,6 +25341,7 @@ const chatMessageRecordBaseSchema = object({
 		"error"
 	]),
 	text: string(),
+	attachments: array(chatAttachmentRecordBaseSchema).optional(),
 	eventType: string().optional(),
 	eventData: unknown().optional(),
 	itemId: string().optional(),
@@ -25344,6 +25356,7 @@ const queuedMessageRecordBaseSchema = object({
 	chatId: string(),
 	messageId: string(),
 	text: string(),
+	attachments: array(chatAttachmentRecordBaseSchema).optional(),
 	effort: string().optional(),
 	files: array(turnContextItemBaseSchema).optional(),
 	model: string().optional(),
@@ -25493,6 +25506,14 @@ function createTimestamp() {
 //#endregion
 //#region src/services.ts
 const worktreeNameInferenceModel = "gpt-5.4-mini";
+const maxAttachmentBytes = 10 * 1024 * 1024;
+const maxDecodedImageBytes = 64 * 1024 * 1024;
+var QueuedAttachmentValidationError = class extends Error {
+	constructor(error) {
+		super(toErrorMessage(error));
+		this.name = "QueuedAttachmentValidationError";
+	}
+};
 function createWorktreeNameInferencePrompt(message) {
 	return [
 		"Infer a concise Git worktree and branch name from this user request.",
@@ -25527,6 +25548,7 @@ var ServeServices = class {
 	eventHub;
 	store;
 	codex;
+	attachmentDir;
 	loadedThreadIds = /* @__PURE__ */ new Set();
 	approvalRequests = /* @__PURE__ */ new Map();
 	pendingTurnEvents = /* @__PURE__ */ new Map();
@@ -25544,6 +25566,7 @@ var ServeServices = class {
 		this.eventHub = options.eventHub ?? new EventHub();
 		this.store = options.store ?? new ServeStateStore();
 		this.codex = options.codex ?? new CodexBridge();
+		this.attachmentDir = options.attachmentDir ?? join$1(getServeDataDir(), "attachments");
 		this.codex.onNotification((message) => {
 			this.handleCodexNotification(message);
 		});
@@ -26046,6 +26069,27 @@ var ServeServices = class {
 		if (!isChatInActiveTurn(chat) && (isDrainingQueuedMessage || !this.pendingChatTurns.has(chatId) && state.queuedMessages.some((message) => message.chatId === chatId))) return this.queueMessage(chatId, input);
 		return this.submitMessage(chatId, input, { requireActiveTurn: false });
 	}
+	async uploadAttachment(chatId, input) {
+		const state = await this.store.load();
+		this.requireChat(state, chatId);
+		if (input.size <= 0 || input.bytes.byteLength <= 0) throw new Error("Attachment file is empty");
+		if (input.size > 10485760 || input.bytes.byteLength > 10485760) throw new Error("Attachment file is too large");
+		const mimeType = detectSupportedImageMimeType(input.bytes);
+		if (!mimeType) throw new Error("Attachment file is not a supported image");
+		const safeName = sanitizeAttachmentName(input.name);
+		const extension = sanitizeAttachmentExtension(safeName, mimeType);
+		const attachmentId = createRecordId("att");
+		const chatAttachmentDir = join$1(this.attachmentDir, chatId);
+		const attachmentPath = join$1(chatAttachmentDir, `${attachmentId}${extension}`);
+		await mkdir(chatAttachmentDir, { recursive: true });
+		await writeFile(attachmentPath, input.bytes);
+		return {
+			name: safeName,
+			path: attachmentPath,
+			mimeType,
+			size: input.size
+		};
+	}
 	async steerMessage(chatId, input) {
 		return this.submitMessage(chatId, input, { requireActiveTurn: true });
 	}
@@ -26071,6 +26115,7 @@ var ServeServices = class {
 			shouldDrainQueuedMessages = !isQueueBlocked;
 			shouldRequestPendingDrain = isDrainingQueuedMessage;
 			const userMessage = createMessage(chat.id, "user", text, "chat.message.queued");
+			userMessage.attachments = cloneAttachmentRecords(input.attachments);
 			const queuedMessage = createQueuedMessage(chat.id, userMessage.id, input);
 			queuedUserMessage = userMessage;
 			return {
@@ -26171,7 +26216,7 @@ var ServeServices = class {
 			if (this.pendingChatTurns.has(chatId)) throw new Error("Chat already has an active Codex turn");
 			this.pendingChatTurns.add(chatId);
 		}
-		const turnOptions = await this.createCodexTurnOptions(input, chat).catch(async (error) => {
+		const turnOptions = options.prevalidatedTurnOptions ?? await this.createCodexTurnOptions(input, chat).catch(async (error) => {
 			clearPendingChatTurn();
 			if (options.queuedMessageId) await this.store.update((nextState) => ({
 				...nextState,
@@ -26187,7 +26232,10 @@ var ServeServices = class {
 		const userMessage = existingUserMessage ? {
 			...existingUserMessage,
 			eventType: void 0
-		} : createMessage(chat.id, "user", text, isSteeringActiveTurn ? "chat.message.steered" : void 0, isSteeringActiveTurn ? chat.activeTurnId ?? void 0 : void 0);
+		} : {
+			...createMessage(chat.id, "user", text, isSteeringActiveTurn ? "chat.message.steered" : void 0, isSteeringActiveTurn ? chat.activeTurnId ?? void 0 : void 0),
+			attachments: cloneAttachmentRecords(input.attachments)
+		};
 		let nextStatus = null;
 		let nextActiveTurnId;
 		let pendingTurnThreadId = null;
@@ -26316,10 +26364,12 @@ var ServeServices = class {
 		return normalizeFileRecords(await this.codex.searchFiles(trimmedQuery, [chat.worktreePath]));
 	}
 	async createCodexTurnOptions(input, chat) {
+		const attachments = await this.normalizeAttachmentItems(input.attachments, chat.id);
 		const files = await normalizeFileContextItems(input.files, chat.worktreePath);
 		const skills = await this.normalizeSkillContextItems(input.skills, chat.worktreePath);
-		if (!input.effort && !input.model && !input.serviceTier && files.length === 0 && skills.length === 0) return;
+		if (!input.effort && !input.model && !input.serviceTier && attachments.length === 0 && files.length === 0 && skills.length === 0) return;
 		const options = {};
+		if (attachments.length > 0) options.attachments = attachments;
 		if (input.effort) options.effort = input.effort;
 		if (files.length > 0) options.files = files;
 		if (input.model) options.model = input.model;
@@ -26327,6 +26377,39 @@ var ServeServices = class {
 		if (skills.length > 0) options.skills = skills;
 		return options;
 	}
+	async normalizeAttachmentItems(items, chatId) {
+		const normalized = normalizeAttachmentRecords(items);
+		if (normalized.length === 0) return [];
+		const chatAttachmentDir = join$1(this.attachmentDir, chatId);
+		return await Promise.all(normalized.map(async (item) => {
+			const resolvedPath = resolve(item.path);
+			if (!isPathInside(chatAttachmentDir, resolvedPath)) throw new Error(`Attachment path must be within this chat's attachment storage: ${item.path}`);
+			let realChatAttachmentDir;
+			try {
+				realChatAttachmentDir = await realpath(chatAttachmentDir);
+			} catch {
+				throw new Error(`Attachment path is not an existing file: ${item.path}`);
+			}
+			let realAttachmentPath;
+			try {
+				realAttachmentPath = await realpath(resolvedPath);
+			} catch {
+				throw new Error(`Attachment path is not an existing file: ${item.path}`);
+			}
+			if (!isPathInside(realChatAttachmentDir, realAttachmentPath)) throw new Error(`Attachment path must resolve within this chat's attachment storage: ${item.path}`);
+			const attachmentStat = await stat(realAttachmentPath);
+			if (!attachmentStat.isFile()) throw new Error(`Attachment path is not a file: ${item.path}`);
+			if (attachmentStat.size <= 0 || attachmentStat.size > 10485760) throw new Error("Attachment file is too large");
+			const mimeType = detectSupportedImageMimeType(await readFile(realAttachmentPath));
+			if (!mimeType) throw new Error("Attachment file is not a supported image");
+			return {
+				name: item.name,
+				path: realAttachmentPath,
+				mimeType,
+				size: attachmentStat.size
+			};
+		}));
+	}
 	async normalizeSkillContextItems(items, worktreePath) {
 		const normalized = normalizeTurnContextItems(items);
 		if (normalized.length === 0) return [];
@@ -26478,6 +26561,12 @@ var ServeServices = class {
 		if (isChatInActiveTurn(chat) || this.pendingChatTurns.has(chatId)) return;
 		const queuedMessage = state.queuedMessages.find((message) => message.chatId === chatId);
 		if (!queuedMessage) return;
+		let prevalidatedTurnOptions;
+		if ((queuedMessage.attachments ?? []).length > 0) try {
+			prevalidatedTurnOptions = await this.createCodexTurnOptions(queuedMessageToSendInput(queuedMessage), chat);
+		} catch (error) {
+			throw new QueuedAttachmentValidationError(error);
+		}
 		const claimedQueuedMessageRef = { current: null };
 		let queuedUserMessageMissing = false;
 		await this.store.update((nextState) => {
@@ -26512,6 +26601,7 @@ var ServeServices = class {
 		}
 		await this.submitMessage(chatId, queuedMessageToSendInput(claimedQueuedMessage), {
 			existingUserMessageId: claimedQueuedMessage.messageId,
+			prevalidatedTurnOptions,
 			requireActiveTurn: false
 		});
 	}
@@ -26529,7 +26619,8 @@ var ServeServices = class {
 				} catch (error) {
 					const wasReported = this.isAgentErrorReported(error);
 					await this.addAgentErrorMessage(chatId, error);
-					if ((await this.store.load()).queuedMessages.some((message) => message.chatId === chatId)) this.pendingQueuedMessageDrainChatIds.add(chatId);
+					const state = await this.store.load();
+					if (!(error instanceof QueuedAttachmentValidationError) && state.queuedMessages.some((message) => message.chatId === chatId)) this.pendingQueuedMessageDrainChatIds.add(chatId);
 					if (!wasReported) this.emitAgentError(chatId, error);
 				}
 			} while (this.pendingQueuedMessageDrainChatIds.has(chatId));
@@ -26838,7 +26929,7 @@ var ServeServices = class {
 			const delta = typeof paramObject.delta === "string" ? paramObject.delta : "";
 			if (!itemId || !delta) return;
 			await this.store.update((state) => {
-				const existingMessage = state.messages.find((message) => message.chatId === chatId && message.itemId === itemId);
+				const existingMessage = state.messages.find((message) => message.chatId === chatId && message.role === "assistant" && message.eventType === method && message.itemId === itemId);
 				if (!existingMessage) return {
 					...state,
 					messages: [...state.messages, createMessage(chatId, "assistant", delta, method, itemId)]
@@ -27118,6 +27209,7 @@ function createQueuedMessage(chatId, messageId, input) {
 		chatId,
 		messageId,
 		text: input.text.trim(),
+		attachments: cloneAttachmentRecords(input.attachments),
 		effort: input.effort,
 		files: cloneContextItems(input.files),
 		model: input.model,
@@ -27128,6 +27220,7 @@ function createQueuedMessage(chatId, messageId, input) {
 }
 function queuedMessageToSendInput(message) {
 	return {
+		attachments: cloneAttachmentRecords(message.attachments),
 		effort: message.effort,
 		files: cloneContextItems(message.files),
 		model: message.model,
@@ -27143,6 +27236,10 @@ function cloneContextItems(items) {
 		path: item.path
 	}));
 }
+function cloneAttachmentRecords(items) {
+	const normalized = normalizeAttachmentRecords(items);
+	return normalized.length > 0 ? normalized : void 0;
+}
 function isChatInActiveTurn(chat) {
 	return Boolean(chat.activeTurnId && (chat.status === "running" || chat.status === "waitingForApproval"));
 }
@@ -27382,7 +27479,10 @@ function mergeCodexAndLocalMessages(codexMessages, localMessages, activeTurnId,
 		const fallbackTranscriptCodexIndex = fallbackTranscriptLocalMessageMatches.get(message.id);
 		if (fallbackTranscriptCodexIndex !== void 0 && unmatchedCodexMessageIndexes.includes(fallbackTranscriptCodexIndex)) {
 			const fallbackCodexMessage = mergedCodexMessages[fallbackTranscriptCodexIndex];
-			if (fallbackCodexMessage) localMessageCodexOrderMatches.set(message.id, fallbackCodexMessage.codexOrder ?? fallbackTranscriptCodexIndex);
+			if (fallbackCodexMessage) {
+				localMessageCodexOrderMatches.set(message.id, fallbackCodexMessage.codexOrder ?? fallbackTranscriptCodexIndex);
+				mergedCodexMessages[fallbackTranscriptCodexIndex] = mergeLocalMessageMetadataIntoCodexMessage(fallbackCodexMessage, message);
+			}
 			unmatchedCodexMessageIndexes.splice(unmatchedCodexMessageIndexes.indexOf(fallbackTranscriptCodexIndex), 1);
 			return false;
 		}
@@ -27403,15 +27503,25 @@ function mergeCodexAndLocalMessages(codexMessages, localMessages, activeTurnId,
 		const matchedCodexIndex = findDeduplicatedCodexMessageIndex(unmatchedCodexMessageIndexes, mergedCodexMessages, message, steeredLocalMessageCounts, liveAssistantDeltaCodexOrderLimits, activeTurnId);
 		if (matchedCodexIndex === void 0) return true;
 		const matchedCodexMessage = mergedCodexMessages[matchedCodexIndex];
-		if (matchedCodexMessage) localMessageCodexOrderMatches.set(message.id, matchedCodexMessage.codexOrder ?? matchedCodexIndex);
+		if (matchedCodexMessage) {
+			localMessageCodexOrderMatches.set(message.id, matchedCodexMessage.codexOrder ?? matchedCodexIndex);
+			mergedCodexMessages[matchedCodexIndex] = mergeLocalMessageMetadataIntoCodexMessage(matchedCodexMessage, message);
+		}
 		if (message.eventType === "chat.message.steered" && matchedCodexMessage) mergedCodexMessages[matchedCodexIndex] = {
-			...matchedCodexMessage,
+			...mergedCodexMessages[matchedCodexIndex],
 			createdAt: message.createdAt
 		};
 		unmatchedCodexMessageIndexes.splice(unmatchedCodexMessageIndexes.indexOf(matchedCodexIndex), 1);
 		return false;
 	}), localMessages, localMessageCodexOrderMatches, liveAssistantDeltaCodexOrderLimits, steeredLocalMessageCounts, activeTurnId).sort(compareMergedMessages).map(stripInternalCodexMessageMetadata);
 }
+function mergeLocalMessageMetadataIntoCodexMessage(codexMessage, localMessage) {
+	const attachments = cloneAttachmentRecords(localMessage.attachments);
+	return attachments ? {
+		...codexMessage,
+		attachments
+	} : codexMessage;
+}
 function localMessagesWithoutStaleSteeredState(chat, localMessages) {
 	if (isChatInActiveTurn(chat)) return localMessages;
 	return localMessages.map((message) => message.eventType === "chat.message.steered" ? {
@@ -27775,6 +27885,243 @@ function normalizeTurnContextItems(items) {
 		path: item.path.trim()
 	})).filter((item) => item.name && item.path);
 }
+function normalizeAttachmentRecords(items) {
+	return (items ?? []).map((item) => ({
+		name: item.name.trim(),
+		path: item.path.trim(),
+		mimeType: item.mimeType.trim().toLowerCase(),
+		size: item.size
+	})).filter((item) => item.name && item.path && item.mimeType.startsWith("image/") && Number.isInteger(item.size) && item.size > 0 && item.size <= 10485760);
+}
+function sanitizeAttachmentName(name) {
+	return basename(name.trim()).replace(/[^\w .-]+/g, "_").trim() || "attachment";
+}
+function sanitizeAttachmentExtension(name, mimeType) {
+	const currentExtension = extname(name).toLowerCase();
+	if (mimeType === "image/png" && currentExtension === ".png") return currentExtension;
+	return ".png";
+}
+function detectSupportedImageMimeType(bytes) {
+	if (isValidPng(bytes)) return "image/png";
+	return null;
+}
+function isValidPng(bytes) {
+	if (bytes.length < 33 || bytes[0] !== 137 || bytes[1] !== 80 || bytes[2] !== 78 || bytes[3] !== 71 || bytes[4] !== 13 || bytes[5] !== 10 || bytes[6] !== 26 || bytes[7] !== 10) return false;
+	let offset = 8;
+	let sawIhdr = false;
+	const idatChunks = [];
+	let pngHeader = null;
+	let finishedIdat = false;
+	let sawIdat = false;
+	let sawPlte = false;
+	while (offset + 12 <= bytes.length) {
+		const chunkLength = readUint32(bytes, offset);
+		const chunkTypeOffset = offset + 4;
+		const chunkDataOffset = offset + 8;
+		const nextOffset = chunkDataOffset + chunkLength + 4;
+		if (nextOffset > bytes.length) return false;
+		const chunkType = readAscii(bytes, chunkTypeOffset, 4);
+		if (!sawIhdr) {
+			const header = parsePngHeader(bytes.subarray(chunkDataOffset, chunkDataOffset + 13));
+			if (chunkType !== "IHDR" || chunkLength !== 13 || !header) return false;
+			pngHeader = header;
+			sawIhdr = true;
+		} else if (chunkType === "IHDR") return false;
+		if (crc32(bytes.subarray(chunkTypeOffset, chunkDataOffset + chunkLength)) !== readUint32(bytes, chunkDataOffset + chunkLength)) return false;
+		if (chunkType === "IEND") return chunkLength === 0 && sawIdat && isValidPngPaletteState(pngHeader, sawPlte) && pngHeader != null && nextOffset === bytes.length && isValidPngImageData(idatChunks, pngHeader);
+		if (sawIdat && chunkType !== "IDAT") finishedIdat = true;
+		if (chunkType === "PLTE") {
+			if (!pngHeader || sawIdat || sawPlte || !isValidPngPaletteChunk(chunkLength, pngHeader)) return false;
+			sawPlte = true;
+		}
+		if (chunkType === "IDAT") {
+			if (chunkLength === 0 || finishedIdat || !isValidPngPaletteState(pngHeader, sawPlte)) return false;
+			idatChunks.push(bytes.subarray(chunkDataOffset, chunkDataOffset + chunkLength));
+			sawIdat = true;
+		}
+		offset = nextOffset;
+	}
+	return false;
+}
+function isValidPngPaletteState(header, sawPlte) {
+	if (!header) return false;
+	if (header.colorType === 3) return sawPlte;
+	return header.colorType === 2 || header.colorType === 6 ? true : !sawPlte;
+}
+function isValidPngPaletteChunk(chunkLength, header) {
+	if (header.colorType !== 3 && header.colorType !== 2 && header.colorType !== 6) return false;
+	const paletteEntries = chunkLength / 3;
+	return Number.isInteger(paletteEntries) && paletteEntries >= 1 && paletteEntries <= 256 && (header.colorType !== 3 || paletteEntries <= 2 ** header.bitDepth);
+}
+function isValidPngImageData(chunks, header) {
+	const expectedByteLength = getExpectedPngImageDataByteLength(header);
+	if (expectedByteLength == null || expectedByteLength <= 0 || expectedByteLength > maxDecodedImageBytes) return false;
+	const totalLength = chunks.reduce((total, chunk) => total + chunk.length, 0);
+	const bytes = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	try {
+		const inflated = inflateSync(bytes, { maxOutputLength: expectedByteLength + 1 });
+		return inflated.byteLength === expectedByteLength && hasValidPngScanlineFilters(inflated, header);
+	} catch {
+		return false;
+	}
+}
+function hasValidPngScanlineFilters(bytes, header) {
+	const rowLengths = getPngImageDataRowLengths(header);
+	if (!rowLengths) return false;
+	let offset = 0;
+	for (const rowLength of rowLengths) {
+		const filterType = bytes[offset];
+		if (filterType == null || filterType > 4) return false;
+		offset += rowLength;
+	}
+	return offset === bytes.length;
+}
+function parsePngHeader(bytes) {
+	const width = readUint32(bytes, 0);
+	const height = readUint32(bytes, 4);
+	const bitDepth = bytes[8];
+	const colorType = bytes[9];
+	const compressionMethod = bytes[10];
+	const filterMethod = bytes[11];
+	const interlaceMethod = bytes[12];
+	if (bytes.length === 13 && width > 0 && height > 0 && isValidPngColorTypeAndBitDepth(colorType, bitDepth) && compressionMethod === 0 && filterMethod === 0 && (interlaceMethod === 0 || interlaceMethod === 1)) return {
+		bitDepth: bitDepth ?? 0,
+		colorType: colorType ?? 0,
+		height,
+		interlaceMethod,
+		width
+	};
+	return null;
+}
+function getExpectedPngImageDataByteLength(header) {
+	const rowLengths = getPngImageDataRowLengths(header);
+	if (!rowLengths) return null;
+	const totalByteLength = rowLengths.reduce((total, rowLength) => total + rowLength, 0);
+	return Number.isSafeInteger(totalByteLength) ? totalByteLength : null;
+}
+function getPngImageDataRowLengths(header) {
+	const samplesPerPixel = getPngSamplesPerPixel(header.colorType);
+	if (samplesPerPixel == null) return null;
+	if (header.interlaceMethod === 0) {
+		const rowLength = getPngRowLength(header.width, samplesPerPixel, header);
+		return rowLength == null ? null : Array(header.height).fill(rowLength);
+	}
+	if (header.interlaceMethod !== 1) return null;
+	const rowLengths = [];
+	for (const pass of adam7Passes) {
+		const passWidth = getAdam7PassSize(header.width, pass.xStart, pass.xStep);
+		const passHeight = getAdam7PassSize(header.height, pass.yStart, pass.yStep);
+		if (passWidth === 0 || passHeight === 0) continue;
+		const rowLength = getPngRowLength(passWidth, samplesPerPixel, header);
+		if (rowLength == null) return null;
+		rowLengths.push(...Array(passHeight).fill(rowLength));
+	}
+	return rowLengths.length > 0 ? rowLengths : null;
+}
+const adam7Passes = [
+	{
+		xStart: 0,
+		xStep: 8,
+		yStart: 0,
+		yStep: 8
+	},
+	{
+		xStart: 4,
+		xStep: 8,
+		yStart: 0,
+		yStep: 8
+	},
+	{
+		xStart: 0,
+		xStep: 4,
+		yStart: 4,
+		yStep: 8
+	},
+	{
+		xStart: 2,
+		xStep: 4,
+		yStart: 0,
+		yStep: 4
+	},
+	{
+		xStart: 0,
+		xStep: 2,
+		yStart: 2,
+		yStep: 4
+	},
+	{
+		xStart: 1,
+		xStep: 2,
+		yStart: 0,
+		yStep: 2
+	},
+	{
+		xStart: 0,
+		xStep: 1,
+		yStart: 1,
+		yStep: 2
+	}
+];
+function getAdam7PassSize(imageSize, passStart, passStep) {
+	return imageSize > passStart ? Math.floor((imageSize - passStart + passStep - 1) / passStep) : 0;
+}
+function getPngRowLength(width, samplesPerPixel, header) {
+	const bitsPerScanline = width * samplesPerPixel * header.bitDepth;
+	const rowLength = Math.ceil(bitsPerScanline / 8) + 1;
+	return Number.isSafeInteger(rowLength) ? rowLength : null;
+}
+function getPngSamplesPerPixel(colorType) {
+	switch (colorType) {
+		case 0:
+		case 3: return 1;
+		case 2: return 3;
+		case 4: return 2;
+		case 6: return 4;
+		default: return null;
+	}
+}
+function isValidPngColorTypeAndBitDepth(colorType, bitDepth) {
+	switch (colorType) {
+		case 0: return [
+			1,
+			2,
+			4,
+			8,
+			16
+		].includes(bitDepth ?? 0);
+		case 2:
+		case 4:
+		case 6: return bitDepth === 8 || bitDepth === 16;
+		case 3: return [
+			1,
+			2,
+			4,
+			8
+		].includes(bitDepth ?? 0);
+		default: return false;
+	}
+}
+function readUint32(bytes, offset) {
+	return (bytes[offset] ?? 0) * 16777216 + ((bytes[offset + 1] ?? 0) << 16) + ((bytes[offset + 2] ?? 0) << 8) + (bytes[offset + 3] ?? 0) >>> 0;
+}
+function readAscii(bytes, offset, length) {
+	let value = "";
+	for (let index = 0; index < length; index += 1) value += String.fromCharCode(bytes[offset + index] ?? 0);
+	return value;
+}
+function crc32(bytes) {
+	let crc = 4294967295;
+	for (const byte of bytes) {
+		crc ^= byte;
+		for (let bit = 0; bit < 8; bit += 1) crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+	}
+	return (crc ^ 4294967295) >>> 0;
+}
 async function normalizeFileContextItems(items, worktreePath) {
 	const normalized = normalizeTurnContextItems(items);
 	if (normalized.length === 0) return [];
@@ -28161,6 +28508,12 @@ const contextItemSchema = object({
 	name: string().min(1),
 	path: string().min(1)
 });
+const attachmentSchema = object({
+	name: string().min(1),
+	path: string().min(1),
+	mimeType: string().min(1),
+	size: number$1().int().nonnegative()
+});
 const createProjectSchema = object({ path: string().min(1, "Project path is required") });
 const createChatSchema = object({
 	name: string().optional(),
@@ -28197,6 +28550,7 @@ const deleteWorktreeSchema = worktreeSchema.extend({
 });
 const sendMessageSchema = object({
 	text: string().min(1, "Message text is required"),
+	attachments: array(attachmentSchema).optional(),
 	effort: string().nullable().optional(),
 	model: string().nullable().optional(),
 	serviceTier: _enum(["fast", "flex"]).nullable().optional(),
@@ -28208,6 +28562,7 @@ const chatMessageSchema = object({
 	chatId: string().min(1),
 	role: _enum(["user"]),
 	text: string(),
+	attachments: array(attachmentSchema).optional(),
 	eventType: literal("chat.message.queued"),
 	itemId: string().optional(),
 	createdAt: string().min(1)
@@ -28217,6 +28572,7 @@ const queuedMessageSchema = object({
 	chatId: string().min(1),
 	messageId: string().min(1),
 	text: string().min(1),
+	attachments: array(attachmentSchema).optional(),
 	effort: string().optional(),
 	files: array(contextItemSchema).optional(),
 	model: string().optional(),
@@ -28243,6 +28599,7 @@ const chatQuerySchema = object({
 	context: string().optional(),
 	fileQuery: string().optional()
 });
+const maxAttachmentMultipartBytes = maxAttachmentBytes + 64 * 1024;
 function jsonError(c, message, status = 400) {
 	return c.json({ error: { message } }, status);
 }
@@ -28276,6 +28633,52 @@ function contextItems(value) {
 		path: item.path
 	}));
 }
+async function parseAttachmentUpload(c) {
+	const file = (await parseLimitedFormData(c.req.raw, maxAttachmentMultipartBytes)).get("file");
+	if (!(file instanceof File)) throw new Error("Attachment file is required");
+	return {
+		bytes: new Uint8Array(await file.arrayBuffer()),
+		mimeType: file.type,
+		name: file.name,
+		size: file.size
+	};
+}
+async function parseLimitedFormData(request, maxBytes) {
+	const bytes = await readRequestBodyWithLimit(request, maxBytes);
+	const body = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(body).set(bytes);
+	return await new Request(request.url, {
+		body,
+		headers: request.headers,
+		method: request.method
+	}).formData();
+}
+async function readRequestBodyWithLimit(request, maxBytes) {
+	const contentLength = Number(request.headers.get("content-length") ?? "");
+	if (Number.isFinite(contentLength) && contentLength > maxBytes) throw new Error("Attachment file is too large");
+	const body = request.body;
+	if (!body) return new Uint8Array();
+	const reader = body.getReader();
+	const chunks = [];
+	let totalBytes = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		totalBytes += value.byteLength;
+		if (totalBytes > maxBytes) {
+			await reader.cancel();
+			throw new Error("Attachment file is too large");
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(totalBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
 const rpcRoutes = new Hono().get("/health", async (c) => {
 	try {
 		return c.json(await getServeServices().getHealth(), 200);
@@ -28418,10 +28821,18 @@ const rpcRoutes = new Hono().get("/health", async (c) => {
 	} catch (error) {
 		return handleApiError(c, error);
 	}
+}).post("/chats/:chatId/attachments", async (c) => {
+	try {
+		const attachment = await getServeServices().uploadAttachment(c.req.param("chatId"), await parseAttachmentUpload(c));
+		return c.json({ attachment }, 201);
+	} catch (error) {
+		return handleApiError(c, error);
+	}
 }).post("/chats/:chatId/messages", jsonBody(sendMessageSchema), async (c) => {
 	try {
 		const body = c.req.valid("json");
 		const chat = await getServeServices().sendMessage(c.req.param("chatId"), {
+			attachments: body.attachments,
 			effort: optionalString(body.effort),
 			files: contextItems(body.files),
 			model: optionalString(body.model),
@@ -28459,6 +28870,7 @@ const rpcRoutes = new Hono().get("/health", async (c) => {
 	try {
 		const body = c.req.valid("json");
 		const chat = await getServeServices().steerMessage(c.req.param("chatId"), {
+			attachments: body.attachments,
 			effort: optionalString(body.effort),
 			files: contextItems(body.files),
 			model: optionalString(body.model),
@@ -28474,6 +28886,7 @@ const rpcRoutes = new Hono().get("/health", async (c) => {
 	try {
 		const body = c.req.valid("json");
 		const chat = await getServeServices().queueMessage(c.req.param("chatId"), {
+			attachments: body.attachments,
 			effort: optionalString(body.effort),
 			files: contextItems(body.files),
 			model: optionalString(body.model),
@@ -28731,4 +29144,4 @@ function createApp() {
 //#endregion
 export { EventHub as a, getServeServices as i, rpcRoutes as n, createSseResponse as o, ServeServices as r, parseLastEventId as s, createApp as t };
 
-//# sourceMappingURL=app-xJWxEPI1.mjs.map
+//# sourceMappingURL=app-BLBOjh4e.mjs.map