@bivy/bivy 0.18.4-staging.2 → 0.18.4-staging.4

package/bin/codex-app-server-shim.mjs

@@ -528,7 +528,12 @@ async function onBivyCommand(msg) {
         bivy({ replyTo: id, ok: true });
         asRequest("turn/start", {
           threadId,
-          input: [{ type: "text", text: String(msg.text ?? "") }],
+          input: [
+            { type: "text", text: String(msg.text ?? "") },
+            ...(msg.images ?? []).map((image) => ({
+              type: "image", url: `data:${image.mimeType || "image/png"};base64,${image.data}`,
+            })),
+          ],
           ...(selectedModel ? { model: selectedModel } : {}),
         })
           .catch((error) => bivy({ type: "session.error", error: error instanceof Error ? error.message : String(error) }));

package/dist/apps/preview-shell.js

@@ -50,8 +50,15 @@ nav .btn[aria-pressed="true"] { background:var(--accent-soft); color:var(--accen
 #mic[aria-pressed="true"] { background:var(--accent); border-color:var(--accent); color:var(--accent-contrast); }
 #voice-status { font-size:var(--text-xs); margin:var(--space-2) 0 0; }
 #voice-status:empty { display:none; }
-/* The panel scrolls on a phone; its actions stay in reach at the bottom. */
-#draft .panel-actions { position:sticky; bottom:calc(-1 * var(--space-3)); margin:var(--space-2) calc(-1 * var(--space-3)) calc(-1 * var(--space-3)); padding:var(--space-2) var(--space-3) var(--space-3); background:var(--surface); border-top:thin solid var(--line); }
+/* The note owns the dock while editing. Only its body scrolls; actions never
+   cover the text field, even when the keyboard leaves little vertical room. */
+#dock { max-height:calc(100% - var(--space-4)); }
+#dock:has(#draft:not([hidden])) nav, #dock:has(#draft:not([hidden])) #pointing { display:none; }
+#draft { display:flex; flex-direction:column; max-height:70dvh; overflow:hidden; padding:0; }
+#draft-body { min-height:0; overflow:auto; padding:var(--space-3); }
+#draft .panel-actions { flex-shrink:0; margin:0; padding:var(--space-2) var(--space-3); border-top:thin solid var(--line); }
+#draft details { margin-top:var(--space-2); }
+#draft summary { color:var(--muted); font-size:var(--text-sm); cursor:pointer; }
 #draft-hint { font-size:var(--text-xs); margin:var(--space-2) 0 var(--space-1); }
 #draft-context { margin:0; padding:var(--space-2); background:var(--surface-2); border-radius:var(--radius-md); font-family:var(--font-mono); font-size:var(--text-xs); white-space:pre-wrap; overflow-wrap:anywhere; color:var(--muted); }
 #show { position:fixed; right:var(--space-3); bottom:calc(var(--space-3) + env(safe-area-inset-bottom)); z-index:var(--z-sticky); border-radius:var(--radius-full); box-shadow:var(--shadow-lg); }
@@ -94,12 +101,14 @@ nav .btn[aria-pressed="true"] { background:var(--accent-soft); color:var(--accen
     <button class="btn sm" id="compare-draw" type="button" hidden>Draw on “now”</button>
   </section>
   <section class="panel" id="draft" hidden aria-labelledby="draft-title">
-    <h2 id="draft-title">Draft for the agent</h2>
+    <div id="draft-body">
+    <h2 id="draft-title">Note for the agent</h2>
     <div id="draft-row"><textarea class="field" id="draft-text" aria-label="What should change?" placeholder="What should change?"></textarea>
     <button class="btn" id="mic" type="button" hidden aria-pressed="false" aria-label="Speak" title="Hold to speak, or tap to start and stop"><svg viewBox="0 0 24 24" width="20" height="20" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 15.5a3 3 0 003-3V6a3 3 0 10-6 0v6.5a3 3 0 003 3z"/><path d="M6 11.5v1a6 6 0 0012 0v-1M12 18.5V21M9 21h6"/></svg></button></div>
     <p class="muted" id="voice-status" role="status"></p>
-    <p class="muted" id="draft-hint">Sent with this context from the preview. Nothing is sent until you send it in the chat.</p>
-    <pre id="draft-context"></pre>
+    <p class="muted" id="draft-hint">Review in chat before sending.</p>
+    <details id="draft-details"><summary>Preview context</summary><pre id="draft-context"></pre></details>
+    </div>
     <div class="panel-actions"><button class="btn sm ghost" id="draft-cancel">Cancel</button><button class="btn sm primary" id="draft-add">Add to chat</button></div>
   </section>
   <p class="banner inline" data-tone="accent" id="pointing" role="status" hidden>Tap anything in the app to point at it. <span id="pointing-voice" hidden>Hold to point and speak. </span>Press Escape or Point again to stop.</p>
@@ -191,6 +200,7 @@ function draft(context,listen){
   $('draft').hidden=false;
   $('draft-add').textContent=metadata.returnTo?'Add to chat':'Copy';
   $('draft-context').textContent=context;
+  $('draft-details').open=false;
   const box=$('draft-text');box.value='';
   // Speaking right away: don't raise the keyboard over the draft.
   if(listen)startListening();else box.focus();
@@ -227,13 +237,13 @@ function fromBivy(d){
   else if(d.type==='transcript'){setListening(false);if(typeof d.error==='string')sayVoice(d.error.slice(0,200));else addSpoken(d.text);}
   else if(d.type==='listening'&&d.on===false&&listening){setListening(false);if(voiceStatus.textContent.startsWith('Listening'))sayVoice('');}
 }
-$('draft-cancel').onclick=()=>{cancelListening();$('draft').hidden=true;endDraw();};
+$('draft-cancel').onclick=()=>{const target=marks?$('draw'):point;cancelListening();$('draft').hidden=true;endDraw();target.focus();};
 $('draft-add').onclick=async()=>{
   cancelListening();
   const note=$('draft-text').value.trim(),text=(note?note+'\\n\\n':'')+$('draft-context').textContent;
   // Marks go to the Bivy client, which adds a picture made on the machine.
-  if(marks){const mark=marks;endDraw();return toBivy({type:'annotation',text,mark});}
-  if(metadata.returnTo)return toChat(text);
+  if(marks){const mark=marks;$('draft').hidden=true;endDraw();return toBivy({type:'annotation',text,mark});}
+  if(metadata.returnTo){$('draft').hidden=true;return toChat(text);}
   try{await navigator.clipboard.writeText(text);$('draft-add').textContent='Copied';}catch{$('draft-text').select();}
 };
 // Console
@@ -443,7 +453,7 @@ addEventListener('message',e=>{
   }
 });
 ask.onclick=()=>toChat('The app preview "'+metadata.name+'" isn’t loading: nothing is answering on port '+downPort+'. Please find out why the server stopped, restart it, and tell me when it’s back.');
-addEventListener('keydown',e=>{if(e.key==='Escape'){if(listening)cancelListening();else if(draw&&!draw.done)endDraw();else if(point.getAttribute('aria-pressed')==='true')pointing(false);else panels(null);}});
+addEventListener('keydown',e=>{if(e.key==='Escape'){if(listening)cancelListening();else if(!$('draft').hidden)$('draft-cancel').click();else if(draw&&!draw.done)endDraw();else if(point.getAttribute('aria-pressed')==='true')pointing(false);else panels(null);}});
 back.onclick=()=>{if(metadata?.returnTo){window.close();setTimeout(()=>location.replace(metadata.returnTo),100);}else{window.close();status.hidden=false;status.textContent='You can close this tab to return to Bivy.';}};
 reload.onclick=()=>{if(metadata)open(currentPath,'Reloading app…');};
 (async()=>{

package/dist/apps/styles.css

@@ -3371,3 +3371,9 @@ p.setup-note .btn.link { min-height: 44px; margin-block: calc((1lh - 44px) / 2);
    the composer itself, with one line of another device's draft. */
 .handoff-banner { border-radius: var(--radius-md); }
 .handoff-preview { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Keep editorial type on the wordmark; session titles retain the app's sans. */
+.brand {
+  font-family: var(--font-serif);
+  font-weight: var(--weight-medium);
+}

package/dist/apps/tokens.css

@@ -30,37 +30,37 @@
   /* ---- Core surfaces & text (neutral) ---- */
   --bg: #ffffff;
   --surface: #ffffff;
-  --surface-2: #f3f5f7;
-  --surface-3: #e8ecef;
-  --ink: #0f1215;
-  --muted: #5f6a73;
-  --line: #e3e7ea;
-  --line-strong: #cdd4d9;
+  --surface-2: #f5f5f5;
+  --surface-3: #ebebeb;
+  --ink: #222222;
+  --muted: #666666;
+  --line: #e5e5e5;
+  --line-strong: #c5c5c5;
   --overlay: rgba(0, 0, 0, 0.46);
   --overlay-strong: rgba(0, 0, 0, 0.8);
 
   /* ---- Accent (reserved for primary actions and active status) ---- */
-  --accent: #3f6377;
+  --accent: #ac4b24;
   --accent-contrast: #ffffff;
-  --accent-hover: #324f60;
+  --accent-hover: #873b1c;
   --accent-active: color-mix(in srgb, var(--accent), #000 22%);
-  --accent-soft: color-mix(in srgb, var(--accent) 16%, var(--surface));
+  --accent-soft: #f5e5d9;
 
   /* ---- Status ---- */
-  --danger: #b0473d;   --danger-soft: #f3e3df;   --danger-contrast: #ffffff;
-  --ok: #4f7a5c;
-  --merged: #7a6a9e;
+  --danger: #a63d35;   --danger-soft: #f4e3dd;   --danger-contrast: #ffffff;
+  --ok: #506d43;
+  --merged: #796188;
   /* A run that finished while you weren't looking — its own signal, deliberately
      not accent (working) / danger (needs input) / ok / merged, so
      "something's ready" reads at a glance. */
-  --unseen: #a8823f;
+  --unseen: #967021;
   --unseen-contrast: #111111;
 
   /* ---- Per-source hues for session/run marks (see packages/web sessionSource).
      Kept clear of the status palette above so a source is never mistaken for an
      outcome; app/cli stay quiet so hand-opened sessions don't shout. ---- */
   --s-github: #24292f; --s-slack: #7c2d92; --s-linear: #5e6ad2; --s-schedule: #0e7490;
-  --s-webhook: #6d28d9; --s-manual: #b45309; --s-cli: #3f6212; --s-app: #64748b;
+  --s-webhook: #6d28d9; --s-manual: #b45309; --s-cli: #526d3b; --s-app: #6a785a;
 
   /* ---- Annotation: marks drawn over an app preview. The same in both themes
      (the app underneath has its own), vivid and rare in real UIs, with a white
@@ -69,8 +69,8 @@
   --annotate-halo: #ffffff;
 
   /* ---- Terminal text selection ---- */
-  --term-selection: rgba(63, 99, 119, 0.30);
-  --term-selection-inactive: rgba(63, 99, 119, 0.20);
+  --term-selection: rgba(119, 141, 91, 0.30);
+  --term-selection-inactive: rgba(119, 141, 91, 0.18);
 
   /* ---- Syntax highlighting ---- */
   --syntax-comment: #6a737d; --syntax-keyword: #d73a49; --syntax-string: #032f62;
@@ -106,18 +106,18 @@
   --space-5: 24px; --space-6: 32px; --space-7: 48px; --space-8: 64px;
 
   /* ---- Radius ---- */
-  --radius: 12px;        /* app default — same value as --radius-md */
-  --radius-sm: 8px;
-  --radius-md: 12px;
-  --radius-lg: 16px;
-  --radius-xl: 20px;
+  --radius: 8px;        /* app default — same value as --radius-md */
+  --radius-sm: 6px;
+  --radius-md: 8px;
+  --radius-lg: 12px;
+  --radius-xl: 16px;
   --radius-full: 999px;
 
   /* ---- Elevation ---- */
-  --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.06), 0 1px 3px rgba(0, 0, 0, 0.08);
-  --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.08);
-  --shadow-lg: 0 12px 32px rgba(0, 0, 0, 0.12);
-  --shadow-xl: 0 24px 70px rgba(0, 0, 0, 0.16);
+  --shadow-sm: 0 1px 3px rgba(40, 45, 36, 0.06);
+  --shadow-md: 0 4px 16px rgba(40, 45, 36, 0.08);
+  --shadow-lg: 0 12px 32px rgba(40, 45, 36, 0.12);
+  --shadow-xl: 0 24px 70px rgba(40, 45, 36, 0.16);
 
   /* ---- Motion ---- */
   --dur-fast: 120ms;
@@ -150,59 +150,66 @@
      definition (they only "worked" via an inline var(--x, #fallback)). Defined
      here so the fallback is never load-bearing and the value is consistent
      everywhere the name appears. Prefer the canonical name on the right. ==== */
-  --warn: #b8862f;            --warn-soft: color-mix(in srgb, #b8862f 16%, var(--surface));
+  --warn: #967021;            --warn-soft: #f0e8cf;
   --err: var(--danger);
   --add: var(--ok);           /* diff addition */
   --del: var(--danger);       /* diff deletion */
   --fg: var(--ink);
   --surface-1: var(--surface);
   --mono: var(--font-mono);
+
 }
 
 :root[data-theme="light"] { color-scheme: light; }
 
 :root[data-theme="dark"] {
   color-scheme: dark;
-  --bg: #000000; --surface: #000000; --surface-2: #15181b; --surface-3: #22272b;
-  --ink: #f3f5f7; --muted: #99a2aa; --line: #1f2327; --line-strong: #353b41;
+  --bg: #000000; --surface: #080808; --surface-2: #141414; --surface-3: #202020;
+  --ink: #f3f3f3; --muted: #aaaaaa; --line: #262626; --line-strong: #484848;
   --overlay: rgba(0, 0, 0, 0.7); --overlay-strong: rgba(0, 0, 0, 0.8);
-  --accent: #8fb6cd; --accent-contrast: #0a0a0a; --accent-hover: #a7cadd;
-  --danger: #c08a83; --danger-soft: #3a2420; --danger-contrast: #0a0a0a; --ok: #86a99f; --merged: #a99bc4;
-  --unseen: #cba96a; --unseen-contrast: #0a0a0a;
-  --warn: #d9a441;
+  --accent: #edab7e; --accent-contrast: #271c12; --accent-hover: #f6c29f;
+  --danger: #f0a497; --danger-soft: #4a3029; --danger-contrast: #0a0a0a; --ok: #b3ce96; --merged: #cab4d4;
+  --unseen: #ddc181; --unseen-contrast: #0a0a0a;
+  --warn: #ddc181;
   --s-github: #d7dde3; --s-slack: #d68ce6; --s-linear: #a5adf5; --s-schedule: #4bc4de;
-  --s-webhook: #b79bf7; --s-manual: #f0a45a; --s-cli: #a3c987; --s-app: #9aa4b2;
-  --term-selection: rgba(143, 182, 205, 0.36); --term-selection-inactive: rgba(143, 182, 205, 0.24);
+  --s-webhook: #b79bf7; --s-manual: #f0a45a; --s-cli: #adc58f; --s-app: #b2c69a;
+  --term-selection: rgba(178, 198, 154, 0.30); --term-selection-inactive: rgba(178, 198, 154, 0.18);
   --syntax-comment: #8b949e; --syntax-keyword: #ff7b72; --syntax-string: #a5d6ff;
   --syntax-number: #79c0ff; --syntax-title: #d2a8ff; --syntax-type: #ffa657;
   --syntax-name: #7ee787; --syntax-deletion: #ffdcd7; --syntax-addition: #85e89d;
-  --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.4);
-  --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.45);
-  --shadow-lg: 0 12px 32px rgba(0, 0, 0, 0.5);
-  --shadow-xl: 0 24px 70px rgba(0, 0, 0, 0.6);
+  --shadow-sm: 0 1px 3px rgba(0, 0, 0, 0.20);
+  --shadow-md: 0 4px 16px rgba(0, 0, 0, 0.24);
+  --shadow-lg: 0 12px 32px rgba(0, 0, 0, 0.28);
+  --shadow-xl: 0 24px 70px rgba(0, 0, 0, 0.32);
+
+  --accent-soft: #493c2c;
+  --warn-soft: #49432b;
 }
 
 @media (prefers-color-scheme: dark) {
   :root:not([data-theme]) {
     color-scheme: dark;
-    --bg: #000000; --surface: #000000; --surface-2: #15181b; --surface-3: #22272b;
-    --ink: #f3f5f7; --muted: #99a2aa; --line: #1f2327; --line-strong: #353b41;
+    --bg: #000000; --surface: #080808; --surface-2: #141414; --surface-3: #202020;
+    --ink: #f3f3f3; --muted: #aaaaaa; --line: #262626; --line-strong: #484848;
     --overlay: rgba(0, 0, 0, 0.7); --overlay-strong: rgba(0, 0, 0, 0.8);
-    --accent: #8fb6cd; --accent-contrast: #0a0a0a; --accent-hover: #a7cadd;
-    --danger: #c08a83; --danger-soft: #3a2420; --danger-contrast: #0a0a0a; --ok: #86a99f; --merged: #a99bc4;
-    --unseen: #cba96a; --unseen-contrast: #0a0a0a;
-    --warn: #d9a441;
+    --accent: #edab7e; --accent-contrast: #271c12; --accent-hover: #f6c29f;
+    --danger: #f0a497; --danger-soft: #4a3029; --danger-contrast: #0a0a0a; --ok: #b3ce96; --merged: #cab4d4;
+    --unseen: #ddc181; --unseen-contrast: #0a0a0a;
+    --warn: #ddc181;
     --s-github: #d7dde3; --s-slack: #d68ce6; --s-linear: #a5adf5; --s-schedule: #4bc4de;
-    --s-webhook: #b79bf7; --s-manual: #f0a45a; --s-cli: #a3c987; --s-app: #9aa4b2;
-    --term-selection: rgba(143, 182, 205, 0.36); --term-selection-inactive: rgba(143, 182, 205, 0.24);
+    --s-webhook: #b79bf7; --s-manual: #f0a45a; --s-cli: #adc58f; --s-app: #b2c69a;
+    --term-selection: rgba(178, 198, 154, 0.30); --term-selection-inactive: rgba(178, 198, 154, 0.18);
   --syntax-comment: #8b949e; --syntax-keyword: #ff7b72; --syntax-string: #a5d6ff;
   --syntax-number: #79c0ff; --syntax-title: #d2a8ff; --syntax-type: #ffa657;
   --syntax-name: #7ee787; --syntax-deletion: #ffdcd7; --syntax-addition: #85e89d;
-    --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.4);
-    --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.45);
-    --shadow-lg: 0 12px 32px rgba(0, 0, 0, 0.5);
-    --shadow-xl: 0 24px 70px rgba(0, 0, 0, 0.6);
-  }
+    --shadow-sm: 0 1px 3px rgba(0, 0, 0, 0.20);
+    --shadow-md: 0 4px 16px rgba(0, 0, 0, 0.24);
+    --shadow-lg: 0 12px 32px rgba(0, 0, 0, 0.28);
+    --shadow-xl: 0 24px 70px rgba(0, 0, 0, 0.32);
+
+  --accent-soft: #493c2c;
+  --warn-soft: #49432b;
+}
 }
 
 @media (prefers-reduced-motion: reduce) {

package/dist/server.js

@@ -132,6 +132,7 @@ import { EventLog } from "./session/event-log.js";
 import { SessionEventSequencer } from "./session/event-sequencer.js";
 import { revertFile } from "./session/revert-file.js";
 import { buildDiagnosticsReport, activationRecord } from "./diagnostics.js";
+import { attachmentsFrom, materializeAttachments, sanitizeAttachmentFilename } from "./session/prompt-attachments.js";
 import { AttachmentStore, isValidAttachmentHash } from "./session/attachment-store.js";
 import { planAttachment, isAttachPlanError, MAX_AGENT_ATTACHMENT_BYTES } from "./session/attach-to-chat.js";
 import { ReplicationService } from "./session/replication-service.js";
@@ -1007,6 +1008,7 @@ async function setDefaultRuntime(id) {
     broadcast({ type: "runtime.updated", current: runtimeSummary(rt), runtimes: runtimeList(rt.id) });
     return rt;
 }
+// StreamingBehavior + PromptImage moved to ./session/record.ts (step 2a).
 function streamingBehaviorFrom(value) {
     return value === "steer" || value === "followUp" ? value : undefined;
 }
@@ -1029,151 +1031,6 @@ function promptForAgent(_record, promptText) {
     // remote PWA when history arrives.
     return promptText;
 }
-function safeAttachmentName(value) {
-    return String(value || "attachment").replace(/[\r\n]/g, " ").slice(0, 180);
-}
-/**
- * Split composer attachments into channels:
- *   - `images`     — base64 blobs passed to the model as vision.
- *   - `imageNotes` — one prose line per image for the persisted transcript.
- *   - `imageRefs`  — durable AttachmentStore references for the images, persisted
- *                    in the event log so they rehydrate after a reload / on
- *                    another device (images used to be vision-only, then lost).
- *   - `files`      — decoded file attachments (bytes or text) to be written to
- *                    disk by materializeAttachments so the agent can open them
- *                    with its normal file tools. Any file type is supported;
- *                    binary files arrive as base64 `data`.
- */
-const MAX_PROMPT_ATTACHMENT_BYTES = 10 * 1024 * 1024;
-const MAX_PROMPT_ATTACHMENTS_BYTES = 40 * 1024 * 1024;
-function attachmentsFrom(value) {
-    if (!Array.isArray(value))
-        return { images: [], imageNotes: [], imageRefs: [], files: [] };
-    const images = [];
-    const imageNotes = [];
-    const imageRefs = [];
-    const files = [];
-    let totalBytes = 0;
-    if (value.length > 12)
-        throw new Error("A message can include at most 12 attachments");
-    for (const raw of value) {
-        if (!raw || typeof raw !== "object")
-            continue;
-        const attachment = raw;
-        const name = safeAttachmentName(attachment.name);
-        const size = Number(attachment.size || 0);
-        const mimeType = typeof attachment.mimeType === "string" && attachment.mimeType ? attachment.mimeType : undefined;
-        const encodedBytes = typeof attachment.data === "string" ? Math.floor(attachment.data.length * 3 / 4) : 0;
-        const textBytes = attachment.kind === "file" && typeof attachment.text === "string" ? Buffer.byteLength(attachment.text) : 0;
-        const actualBytes = encodedBytes || textBytes;
-        if (actualBytes > MAX_PROMPT_ATTACHMENT_BYTES)
-            throw new Error(`${name} exceeds the 10 MiB attachment limit`);
-        totalBytes += actualBytes;
-        if (totalBytes > MAX_PROMPT_ATTACHMENTS_BYTES)
-            throw new Error("Attachments exceed the 40 MiB per-message limit");
-        if (attachment.kind === "image" && typeof attachment.data === "string") {
-            const imgMime = mimeType ?? "image/png";
-            images.push({ type: "image", data: attachment.data, mimeType: imgMime });
-            imageNotes.push(`[Image attachment: ${name}${size ? ` (${size} bytes)` : ""}]`);
-            // Persist the image bytes durably (dedup by hash). Best-effort: a store
-            // failure must not break vision for the turn, so it only costs the ref.
-            try {
-                imageRefs.push(attachmentStore.put(Buffer.from(attachment.data, "base64"), { name, mimeType: imgMime, kind: "image" }));
-            }
-            catch (error) {
-                console.warn("[attachments] failed to store image:", error instanceof Error ? error.message : String(error));
-            }
-        }
-        else if (attachment.kind === "file") {
-            if (typeof attachment.data === "string" && attachment.data) {
-                files.push({ name, mimeType: mimeType ?? "application/octet-stream", size, bytes: Buffer.from(attachment.data, "base64"), truncated: !!attachment.truncated });
-            }
-            else if (typeof attachment.text === "string" && attachment.text) {
-                files.push({ name, mimeType: mimeType ?? "text/plain", size, text: attachment.text, truncated: !!attachment.truncated });
-            }
-            // A file with neither bytes nor text (e.g. omitted/unreadable) carries
-            // nothing to write, so there is nothing to hand the agent — skip it.
-        }
-    }
-    return { images, imageNotes, imageRefs, files };
-}
-/** Strip a user-supplied filename to a safe basename — no path traversal, no
- * characters that would break the placeholder note or the filesystem. */
-function sanitizeAttachmentFilename(name) {
-    const base = path
-        .basename(String(name || ""))
-        .replace(/[/\\\r\n\t[\]]/g, "_")
-        .replace(/^\.+/, "")
-        .trim()
-        .slice(0, 180);
-    return base || "attachment";
-}
-/**
- * Write decoded file attachments into `<workdir>/.bivy-attachments/` and return
- * one prose note per file (carrying the relative path) to append to the prompt.
- * This is what makes an uploaded file of ANY type — binary included — readable
- * by the agent's file tools. Filenames are sanitized and de-duplicated so two
- * `report.pdf`s don't clobber. Best-effort: a failure degrades to a note rather
- * than throwing, so a bad attachment never sinks the whole turn.
- */
-function materializeAttachments(record, files) {
-    if (!files.length)
-        return { note: "", refs: [] };
-    const refs = [];
-    // Store every file durably in the global content-addressed store first (for
-    // re-findability), independent of the per-workdir copy below. Best-effort per
-    // file so one bad blob doesn't lose the others.
-    for (const file of files) {
-        const bytes = file.bytes ?? (typeof file.text === "string" ? Buffer.from(file.text, "utf8") : undefined);
-        if (!bytes)
-            continue;
-        try {
-            refs.push(attachmentStore.put(bytes, { name: sanitizeAttachmentFilename(file.name), mimeType: file.mimeType, kind: "file" }));
-        }
-        catch (error) {
-            console.warn("[attachments] failed to store file:", error instanceof Error ? error.message : String(error));
-        }
-    }
-    const workdir = harnessDirFor(record);
-    const dir = path.join(workdir, ".bivy-attachments");
-    try {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        return { note: files.map((f) => `[File attachment: ${sanitizeAttachmentFilename(f.name)} could not be saved: ${why}]`).join("\n"), refs };
-    }
-    const notes = [];
-    const used = new Set();
-    for (const file of files) {
-        const safeBase = sanitizeAttachmentFilename(file.name);
-        const ext = path.extname(safeBase);
-        const stem = safeBase.slice(0, safeBase.length - ext.length) || safeBase;
-        let safe = safeBase;
-        let n = 1;
-        while (used.has(safe) || fs.existsSync(path.join(dir, safe))) {
-            safe = `${stem}-${n}${ext}`;
-            n += 1;
-        }
-        used.add(safe);
-        const dest = path.join(dir, safe);
-        const label = `${safe} (${file.size ? `${file.size} bytes, ` : ""}${file.mimeType}${file.truncated ? ", truncated" : ""})`;
-        try {
-            if (file.bytes)
-                fs.writeFileSync(dest, file.bytes);
-            else if (typeof file.text === "string")
-                fs.writeFileSync(dest, file.text, "utf8");
-            else
-                continue;
-            const rel = path.relative(workdir, dest) || safe;
-            notes.push(`[File attachment: ${label} saved to ${rel} - read it with your file tools]`);
-        }
-        catch (error) {
-            notes.push(`[File attachment: ${label} could not be saved: ${error instanceof Error ? error.message : String(error)}]`);
-        }
-    }
-    return { note: notes.join("\n"), refs };
-}
 /**
  * Store attachment bytes, persist a durable outbound reference anchored at the
  * current transcript position (so a reload or another device shows it), and
@@ -3000,7 +2857,7 @@ const RELAY_COMMANDS = {
     },
     async prompt(msg, ctx) {
         const text = String(msg.text ?? "").trim();
-        const { images, imageNotes, imageRefs, files } = attachmentsFrom(msg.attachments);
+        const { images, imageNotes, files } = attachmentsFrom(msg.attachments);
         if (!text && !images.length && !files.length)
             return;
         // Title/naming can only see what we have before the session exists; the file
@@ -3043,12 +2900,12 @@ const RELAY_COMMANDS = {
         touchSession(record);
         // Now that the session (and its workdir) exists, write file attachments to
         // disk and fold their path notes into the prompt the agent actually sees.
-        const { note: fileNote, refs: fileRefs } = materializeAttachments(record, files);
-        const promptText = [text, imageNotes.join("\n"), fileNote].filter(Boolean).join("\n\n") ||
+        const { note: fileNote, refs: fileRefs } = materializeAttachments(harnessDirFor(record), files, attachmentStore);
+        const promptText = [text, fileNote].filter(Boolean).join("\n\n") ||
             (images.length ? "Please review the attached image(s)." : files.length ? "Please review the attached file(s)." : "");
         // Persist durable attachment refs keyed by the exact text the transcript
         // stores for this user message, so history rehydrates thumbnails by hash.
-        eventLog.appendAttachments(record.id, promptText, [...imageRefs, ...fileRefs]);
+        eventLog.appendAttachments(record.id, promptText, fileRefs);
         const agentPrompt = promptForAgent(record, promptText);
         const cmid = typeof msg.clientMessageId === "string" && msg.clientMessageId ? msg.clientMessageId : undefined;
         // A retry of a prompt we already took: the caller missed our echo (that is
@@ -11257,7 +11114,7 @@ app.post("/api/session/prompt", async (req, res, next) => {
         if (text === "/login" || text.startsWith("/login ")) {
             return res.status(400).json({ error: "Use the Login / API tokens dialog from the phone UI. If it is not visible, refresh this page after updating Bivy." });
         }
-        const { images, imageNotes, imageRefs, files } = attachmentsFrom(req.body?.attachments);
+        const { images, imageNotes, files } = attachmentsFrom(req.body?.attachments);
         if (!text && !images.length && !files.length)
             return res.status(400).json({ error: "Missing text" });
         // File notes (with on-disk paths) are folded in once the workdir exists; the
@@ -11285,10 +11142,10 @@ app.post("/api/session/prompt", async (req, res, next) => {
         }
         notePresence(record.id, deviceFrom(req.body?.device), "chat");
         const session = record.session;
-        const { note: fileNote, refs: fileRefs } = materializeAttachments(record, files);
-        const promptText = [text, imageNotes.join("\n"), fileNote].filter(Boolean).join("\n\n") ||
+        const { note: fileNote, refs: fileRefs } = materializeAttachments(harnessDirFor(record), files, attachmentStore);
+        const promptText = [text, fileNote].filter(Boolean).join("\n\n") ||
             (images.length ? "Please review the attached image(s)." : files.length ? "Please review the attached file(s)." : "");
-        eventLog.appendAttachments(record.id, promptText, [...imageRefs, ...fileRefs]);
+        eventLog.appendAttachments(record.id, promptText, fileRefs);
         const agentPrompt = promptForAgent(record, promptText);
         const cmid = typeof req.body?.clientMessageId === "string" && req.body.clientMessageId ? req.body.clientMessageId : undefined;
         markSessionWorking(record, { type: "agent_start" });

package/dist/session/prompt-attachments.js

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import fs from "node:fs";
+import path from "node:path";
+function safeAttachmentName(value) {
+    return String(value || "attachment").replace(/[\r\n]/g, " ").slice(0, 180);
+}
+/**
+ * Split composer attachments into channels:
+ *   - `images`     — base64 blobs passed to the model as vision.
+ *   - `imageNotes` — short image labels for naming a new session.
+ *   - `files`      — all decoded attachments (including images) to be written to
+ *                    disk by materializeAttachments so the agent can open them
+ *                    with its normal file tools. Any file type is supported;
+ *                    binary files arrive as base64 `data`.
+ */
+const MAX_PROMPT_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+const MAX_PROMPT_ATTACHMENTS_BYTES = 40 * 1024 * 1024;
+export function attachmentsFrom(value) {
+    if (!Array.isArray(value))
+        return { images: [], imageNotes: [], files: [] };
+    const images = [];
+    const imageNotes = [];
+    const files = [];
+    let totalBytes = 0;
+    if (value.length > 12)
+        throw new Error("A message can include at most 12 attachments");
+    for (const raw of value) {
+        if (!raw || typeof raw !== "object")
+            continue;
+        const attachment = raw;
+        const name = safeAttachmentName(attachment.name);
+        const size = Number(attachment.size || 0);
+        const mimeType = typeof attachment.mimeType === "string" && attachment.mimeType ? attachment.mimeType : undefined;
+        const encodedBytes = typeof attachment.data === "string" ? Math.floor(attachment.data.length * 3 / 4) : 0;
+        const textBytes = attachment.kind === "file" && typeof attachment.text === "string" ? Buffer.byteLength(attachment.text) : 0;
+        const actualBytes = encodedBytes || textBytes;
+        if (actualBytes > MAX_PROMPT_ATTACHMENT_BYTES)
+            throw new Error(`${name} exceeds the 10 MiB attachment limit`);
+        totalBytes += actualBytes;
+        if (totalBytes > MAX_PROMPT_ATTACHMENTS_BYTES)
+            throw new Error("Attachments exceed the 40 MiB per-message limit");
+        if (attachment.kind === "image" && typeof attachment.data === "string") {
+            const imgMime = mimeType ?? "image/png";
+            images.push({ type: "image", data: attachment.data, mimeType: imgMime });
+            imageNotes.push(`[Image attachment: ${name}${size ? ` (${size} bytes)` : ""}]`);
+            files.push({ kind: "image", name, mimeType: imgMime, size, bytes: Buffer.from(attachment.data, "base64") });
+        }
+        else if (attachment.kind === "file") {
+            if (typeof attachment.data === "string" && attachment.data) {
+                files.push({ kind: "file", name, mimeType: mimeType ?? "application/octet-stream", size, bytes: Buffer.from(attachment.data, "base64"), truncated: !!attachment.truncated });
+            }
+            else if (typeof attachment.text === "string" && attachment.text) {
+                files.push({ kind: "file", name, mimeType: mimeType ?? "text/plain", size, text: attachment.text, truncated: !!attachment.truncated });
+            }
+            // A file with neither bytes nor text (e.g. omitted/unreadable) carries
+            // nothing to write, so there is nothing to hand the agent — skip it.
+        }
+    }
+    return { images, imageNotes, files };
+}
+/** Strip a user-supplied filename to a safe basename — no path traversal, no
+ * characters that would break the placeholder note or the filesystem. */
+export function sanitizeAttachmentFilename(name) {
+    const base = path
+        .basename(String(name || ""))
+        .replace(/[/\\\r\n\t[\]]/g, "_")
+        .replace(/^\.+/, "")
+        .trim()
+        .slice(0, 180);
+    return base || "attachment";
+}
+/**
+ * Write decoded attachments into `<workdir>/.bivy-attachments/` and return
+ * one prose note per file (carrying the absolute path) to append to the prompt.
+ * This is what makes an uploaded file of ANY type — binary included — readable
+ * by the agent's file tools. Filenames are sanitized and de-duplicated so two
+ * `report.pdf`s don't clobber. Best-effort: a failure degrades to a note rather
+ * than throwing, so a bad attachment never sinks the whole turn.
+ */
+export function materializeAttachments(workdir, files, attachmentStore) {
+    if (!files.length)
+        return { note: "", refs: [] };
+    const refs = [];
+    // Store every file durably in the global content-addressed store first (for
+    // re-findability), independent of the per-workdir copy below. Best-effort per
+    // file so one bad blob doesn't lose the others.
+    for (const file of files) {
+        const bytes = file.bytes ?? (typeof file.text === "string" ? Buffer.from(file.text, "utf8") : undefined);
+        if (!bytes)
+            continue;
+        try {
+            refs.push(attachmentStore.put(bytes, { name: sanitizeAttachmentFilename(file.name), mimeType: file.mimeType, kind: file.kind }));
+        }
+        catch (error) {
+            console.warn("[attachments] failed to store file:", error instanceof Error ? error.message : String(error));
+        }
+    }
+    const dir = path.join(workdir, ".bivy-attachments");
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        return { note: files.map((f) => `[${f.kind === "image" ? "Image" : "File"} attachment: ${sanitizeAttachmentFilename(f.name)} could not be saved: ${why}]`).join("\n"), refs };
+    }
+    const notes = [];
+    const used = new Set();
+    for (const file of files) {
+        const safeBase = sanitizeAttachmentFilename(file.name);
+        const ext = path.extname(safeBase);
+        const stem = safeBase.slice(0, safeBase.length - ext.length) || safeBase;
+        let safe = safeBase;
+        let n = 1;
+        while (used.has(safe) || fs.existsSync(path.join(dir, safe))) {
+            safe = `${stem}-${n}${ext}`;
+            n += 1;
+        }
+        used.add(safe);
+        const dest = path.join(dir, safe);
+        const label = `${safe} (${file.size ? `${file.size} bytes, ` : ""}${file.mimeType}${file.truncated ? ", truncated" : ""})`;
+        try {
+            if (file.bytes)
+                fs.writeFileSync(dest, file.bytes);
+            else if (typeof file.text === "string")
+                fs.writeFileSync(dest, file.text, "utf8");
+            else
+                continue;
+            notes.push(`[${file.kind === "image" ? "Image" : "File"} attachment: ${label} saved to ${dest} - read it with your file tools]`);
+        }
+        catch (error) {
+            notes.push(`[${file.kind === "image" ? "Image" : "File"} attachment: ${label} could not be saved: ${error instanceof Error ? error.message : String(error)}]`);
+        }
+    }
+    return { note: notes.join("\n"), refs };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.18.4-staging.2",
+  "version": "0.18.4-staging.4",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",