@bridge4dev/runner 0.27.0 → 0.30.0

package/dist/adapters/codex.js

@@ -5,7 +5,7 @@ import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
 import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
 import { truncate } from './claude.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
 // contract is unchanged, so the dashboard renders Codex sessions with the same
@@ -135,10 +135,26 @@ class CodexSession {
     threadId = null;
     threadModel = null;
     activeTurnId = null;
+    /**
+     * Last turn this thread finished (ticket #126).
+     *
+     * `thread/fork { lastTurnId }` forks THROUGH this turn inclusive, dropping
+     * everything after it — which is exactly "rewind the conversation to here".
+     * Verified against the JSON schema the installed codex-cli 0.145.0 generates
+     * itself (`codex app-server generate-json-schema`): `lastTurnId` is part of
+     * the STABLE surface, not the experimental one.
+     *
+     * `thread/rollback` is deliberately not used: its own schema marks it
+     * "DEPRECATED: will be removed soon", it counts turns from the end rather
+     * than naming one, and it mutates the thread in place instead of forking.
+     */
+    lastCompletedTurnId = null;
     /** Plan card waiting for the user; approving it starts the real work. */
     heldPlan = null;
     lastCollabMode = null;
     mode;
+    /** A launch-time `full` this STRICT workspace does not allow (ticket #156). */
+    modeRefusedAtLaunch = false;
     model;
     effort;
     /** Last model catalogue from `model/list` — effort sets differ per model. */
@@ -150,7 +166,13 @@ class CodexSession {
     constructor(spec, home, deps) {
         this.spec = spec;
         this.home = home;
-        this.mode = spec.mode ?? 'ask';
+        // `full` on a STRICT workspace is refused, not honoured: Codex in that mode
+        // sends no approvals at all, so layer 1 never runs and the manager's shield
+        // would be spent from the chat (ticket #156).
+        const requestedMode = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requestedMode) ? requestedMode : 'ask';
+        if (this.mode !== requestedMode)
+            this.modeRefusedAtLaunch = true;
         this.model = spec.model;
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
@@ -169,6 +191,10 @@ class CodexSession {
                 cwd: spec.cwd,
                 ...wiring,
             });
+        if (this.modeRefusedAtLaunch) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         void this.boot();
     }
     // ─── Boot ──────────────────────────────────────────────────────────
@@ -256,6 +282,19 @@ class CodexSession {
      * second; losing the conversation costs the whole context.
      */
     static RESUME_RETRY_DELAY_MS = 1_500;
+    /** Branch the thread at `lastTurnId`, dropping every later turn. */
+    async forkThread(threadId, lastTurnId) {
+        const result = asRecord(await this.client.request('thread/fork', {
+            threadId,
+            lastTurnId,
+            ...this.threadParams(),
+        }));
+        const thread = asRecord(result['thread']);
+        const id = str(thread['id']);
+        if (!id)
+            throw new Error('thread/fork returned no thread id');
+        return { id, model: str(result['model']) ?? null };
+    }
     async resumeThread(resumeId) {
         // Resume takes the SAME overrides as start, and it must: the per-thread MCP
         // overlay lives only in memory, so resuming with just a thread id brings the
@@ -273,6 +312,34 @@ class CodexSession {
     }
     async openThread() {
         const resumeId = this.spec.resumeProviderSessionId;
+        // Ticket #126, conversation rewind. Forking rather than resuming: the
+        // thread the user rewound away from stays on disk untouched, and the fork
+        // carries the same overrides every other entry point passes (the per-thread
+        // MCP overlay lives only in memory, so a thread opened without it comes
+        // back with no DevBridge access at all).
+        if (resumeId && this.spec.resumeAtAnchor) {
+            try {
+                return await this.forkThread(resumeId, this.spec.resumeAtAnchor);
+            }
+            catch (error) {
+                log.warn('codex: thread/fork failed — resuming the whole conversation', {
+                    sessionId: this.spec.sessionId,
+                    error: describe(error),
+                });
+                // Reported through the SAME channel as Claude's refused resume, so the
+                // supervisor withdraws the pending feed cut here too. A notice alone
+                // left the page believing a rewind had happened: it had already thrown
+                // away messages this thread still holds.
+                this.emit({
+                    type: 'error',
+                    message: 'The conversation could not be rewound to that point — the agent still remembers everything after it',
+                    code: 'rewind_failed',
+                    // This thread carries on below with a plain resume — there is
+                    // nothing for the supervisor to relaunch.
+                    recovered: true,
+                });
+            }
+        }
         if (resumeId) {
             try {
                 return await this.resumeThread(resumeId);
@@ -535,10 +602,28 @@ class CodexSession {
      * tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // A manager tightened the project out from under a session that is running
+        // with nothing gated (QA-128). Codex carries `approvalPolicy` on the next
+        // `turn/start`, so recording the mode here IS the fix — the next turn is
+        // `on-request` and layer 1 sees every command again. Claude does the same
+        // thing through `setPermissionMode`; leaving this out of one adapter left
+        // the picker showing a mode that was no longer in its own list.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            this.notice('warn', MODE_WITHDRAWN_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+        }
+        // `full` leaves (or rejoins) the picker with the trust level — the list is
+        // computed from `spec` and only travels in a capabilities frame (#156).
+        this.refreshCapabilities();
+        this.releaseApprovalsAllowedNow();
     }
     async setEffort(effort) {
         if (effort)
@@ -548,9 +633,56 @@ class CodexSession {
         this.emit({ type: 'settings', effort });
         this.refreshCapabilities();
     }
+    /**
+     * Codex needs no new process for any mode: `approvalPolicy` and the sandbox
+     * policy travel with the next `turn/start`, so the change is in force from
+     * the next turn whatever it is (ticket #156).
+     */
+    modeSwitchNeedsRelaunch(_mode) {
+        return false;
+    }
     async setMode(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.notice('warn', MODE_REFUSED_TEXT);
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157 — the card the user is looking at is the reason they reached
+        // for the control; judging only the next one leaves it sitting there.
+        this.releaseApprovalsAllowedNow();
+    }
+    /**
+     * Re-judge every open approval under the rules in force NOW and accept the
+     * ones that no longer need a human (ticket #157). Permissive direction only:
+     * a card that would now be denied is left for the user, because taking a
+     * decision away from them is the mistake session 12 exists to undo.
+     */
+    releaseApprovalsAllowedNow() {
+        for (const [requestId, pending] of [...this.approvals]) {
+            if (!pending.policy)
+                continue;
+            const verdict = evaluateToolUse(pending.policy.tool, pending.policy.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.approvals.delete(requestId);
+            this.client.respond(pending.rpcId, { decision: 'accept' });
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+        }
     }
     async interrupt() {
         if (!this.threadId || !this.activeTurnId)
@@ -567,6 +699,33 @@ class CodexSession {
             log.warn('codex: interrupt failed', { error: describe(error) });
         }
     }
+    conversationAnchor() {
+        return this.lastCompletedTurnId;
+    }
+    /**
+     * `thread/compact/start` — a stable method of app-server 0.145.0, taking only
+     * the thread id and answering with an empty object; the summary itself
+     * arrives later as a `contextCompaction` item, which this adapter already
+     * turns into a notice.
+     *
+     * Until now compaction on this agent was entirely the agent's own business
+     * and the dashboard hid `/compact` from Codex sessions on the grounds that
+     * "that agent does not have it". It does.
+     */
+    async compact() {
+        if (!this.threadId || this.stopped)
+            return false;
+        if (this.activeTurnId)
+            return false;
+        try {
+            await this.client.request('thread/compact/start', { threadId: this.threadId });
+            return true;
+        }
+        catch (error) {
+            log.warn('codex: compaction refused', { error: describe(error) });
+            return false;
+        }
+    }
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -623,6 +782,9 @@ class CodexSession {
             ? { decision: 'ask', reason: 'details unavailable' }
             : evaluateToolUse(enriched.policyTool, enriched.policyInput, {
                 trustMode: this.spec.trustMode,
+                // Ticket #156, the same missing argument as in the Claude adapter —
+                // both bridges call one policy, so both have to hand it the mode.
+                mode: this.mode,
                 ...(this.spec.agentAutoCommit === undefined
                     ? {}
                     : { agentAutoCommit: this.spec.agentAutoCommit }),
@@ -643,7 +805,11 @@ class CodexSession {
             });
             return;
         }
-        this.approvals.set(requestId, { rpcId: request.id, toolName: enriched.toolName });
+        this.approvals.set(requestId, {
+            rpcId: request.id,
+            toolName: enriched.toolName,
+            policy: enriched.forceAsk ? null : { tool: enriched.policyTool, input: enriched.policyInput },
+        });
         this.emit({
             type: 'permission',
             requestId,
@@ -1140,6 +1306,12 @@ class CodexSession {
     onTurnCompleted(params) {
         const turn = asRecord(params['turn']);
         const status = str(turn['status']);
+        // Ticket #126: the anchor a conversation rewind is measured from. Only a
+        // COMPLETED turn may be one — `thread/fork` refuses a turn that is still in
+        // progress, and the id is taken from the notification rather than from
+        // `activeTurnId` so a steered turn anchors on what the thread actually
+        // recorded.
+        this.lastCompletedTurnId = str(turn['id']) ?? this.activeTurnId ?? this.lastCompletedTurnId;
         this.activeTurnId = null;
         // A held plan means the turn ended by proposing, not by finishing the work.
         if (this.heldPlan)
@@ -1153,8 +1325,14 @@ class CodexSession {
             });
             return;
         }
-        // `interrupted` is a user-initiated Stop: the session stays usable.
-        this.emit({ type: 'turn_end', ok: true });
+        // `interrupted` is a user-initiated Stop: the session stays usable. Named
+        // rather than merely tolerated, so the feed can tell "stopped" from
+        // "finished" — the same distinction the Claude adapter now draws.
+        this.emit({
+            type: 'turn_end',
+            ok: true,
+            ...(status === 'interrupted' ? { aborted: true } : {}),
+        });
         this.flushQueued();
     }
     onStderr(text) {
@@ -1201,7 +1379,10 @@ class CodexSession {
         const currentEffort = this.effort ?? models.find((m) => m.id === currentModel)?.defaultEffort ?? undefined;
         const capabilities = {
             models,
-            modes: [...AGENT_MODES],
+            // Recomputed on every publication rather than captured: the workspace's
+            // trust level changes under a running session, and `full` has to leave
+            // the picker with it (ticket #156).
+            modes: availableModes(this.spec.trustMode),
             commands,
             currentMode: this.mode,
             ...(currentModel ? { currentModel } : {}),

package/dist/adapters/types.d.ts

@@ -5,14 +5,48 @@ export interface McpConfig {
 }
 /**
  * Agent-agnostic interaction mode (session-5 plan §2).
- *  ask  — ask before acting               (Claude `default`,  Codex `on-request`)
- *  plan — plan first, act after approval  (Claude `plan`,     Codex on-request + plan)
- *  auto — apply edits silently            (Claude `acceptEdits`, Codex `on-failure`)
+ *  ask  — ask before acting               (Claude `default`, Codex `on-request`)
+ *  plan — plan first, act after approval  (Claude `plan`,    Codex on-request + plan)
+ *  auto — work on its own, hard limits only (Claude `auto`,  Codex on-request + workspace-write)
  *  full — never ask                       (Claude `bypassPermissions`, Codex `never`)
+ *
+ * The mode is BOTH halves of the decision, and that took a bug to learn
+ * (ticket #156): it sets the agent CLI's own permission mode, AND it reaches
+ * `evaluateToolUse` as `PolicyContext.mode`. For four sessions it did only the
+ * first, so «Auto» moved a dial the layer that raises the cards never read.
  */
 export type AgentMode = 'ask' | 'plan' | 'auto' | 'full';
 export declare const AGENT_MODES: readonly AgentMode[];
 export declare function isAgentMode(value: unknown): value is AgentMode;
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export declare const MODE_REFUSED_TEXT = "\u00ABUnrestricted\u00BB is not available on this project. Its trust level is Strict, and \u00ABUnrestricted\u00BB is the one mode in which DevBridge checks nothing \u2014 the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.";
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export declare const MODE_WITHDRAWN_TEXT = "This project was just set to Strict trust, so \u00ABUnrestricted\u00BB is no longer available and this session now asks about every command. Nothing you did caused this \u2014 a project manager changed it in the server panel.";
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export declare function availableModes(trustMode: TrustMode): AgentMode[];
 /**
  * A reasoning-effort level a model supports. Codex advertises these per model
  * (`supportedReasoningEfforts`) and the set differs between models — the new
@@ -146,6 +180,21 @@ export interface SessionSpec {
     model?: string;
     effort?: string;
     resumeProviderSessionId?: string;
+    /**
+     * Resume the conversation only up to this anchor, dropping everything after
+     * it (ticket #126, conversation rewind).
+     *
+     * The value is whatever `AgentSession.conversationAnchor()` returned earlier
+     * in this session's life — a Claude message uuid or a Codex turn id. It is
+     * opaque to everything above the adapter, and it is only ever meaningful
+     * together with `resumeProviderSessionId`.
+     *
+     * Both agents answer this by FORKING rather than by truncating in place, so
+     * the original conversation is never destroyed: the adapter reports the new
+     * provider session id through `provider_session`, and the old one stays on
+     * disk exactly as it was.
+     */
+    resumeAtAnchor?: string;
     mcp?: McpConfig;
     maxBudgetUsd?: number;
 }
@@ -313,6 +362,14 @@ export type AgentEvent = {
     type: 'turn_end';
     ok: boolean;
     errorMessage?: string;
+    /**
+     * The turn ended because the user pressed Stop, not because it finished.
+     *
+     * Reported `ok: true` — a stop is not a failure — but named, so the feed
+     * can say «stopped» rather than «done» and so a stopped turn never reads
+     * as work the agent completed.
+     */
+    aborted?: boolean;
 } | {
     type: 'error';
     message: string;
@@ -323,7 +380,23 @@ export type AgentEvent = {
      * never signed in "expired" sent people looking for a problem that did
      * not exist.
      */
-    code?: 'resume_failed' | 'auth_expired' | 'auth_missing';
+    /**
+     * `rewind_failed` — the CLI refused the point we asked it to resume at
+     * (ticket #126). Recoverable and NOT a failed session: the conversation
+     * is intact, only the rewind did not happen, and the caller must say so
+     * rather than pretending it did.
+     */
+    code?: 'resume_failed' | 'auth_expired' | 'auth_missing' | 'rewind_failed';
+    /**
+     * The adapter has already dealt with it and the session is still running.
+     *
+     * Only meaningful with `rewind_failed`, and it is the difference between
+     * the two agents: Claude's refused resume kills the query, so the
+     * supervisor must bring the process back without the anchor; Codex falls
+     * back to a plain resume inside `openThread` and needs no relaunch at
+     * all. Both still have to withdraw the feed cut and say what happened.
+     */
+    recovered?: boolean;
 };
 export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
@@ -349,6 +422,24 @@ export interface AgentSession {
     setEffort(effort: string | null): Promise<void>;
     /** Switch interaction mode mid-session. */
     setMode(mode: AgentMode): Promise<void>;
+    /**
+     * Can this session reach `mode` without a new agent process? (ticket #156)
+     *
+     * Claude answers `false` for any move across the `full` boundary, and that is
+     * the CLI's rule rather than ours: `bypassPermissions` may only be entered by
+     * a process LAUNCHED with the dangerous flag, and the control request is
+     * refused outright otherwise —
+     *
+     *   Cannot set permission mode to bypassPermissions because the session was
+     *   not launched with --dangerously-skip-permissions
+     *
+     * (verified live against the bundled CLI 2.1.218). Until this existed the
+     * supervisor caught that error, turned it into a `notice`, and left the user
+     * with a picker reading «Unrestricted» over a session that was still asking.
+     *
+     * Codex answers `true` always: its policy travels with the next `turn/start`.
+     */
+    modeSwitchNeedsRelaunch(mode: AgentMode): boolean;
     /**
      * Project-level policy changed while this session is running (session 15).
      *
@@ -365,6 +456,26 @@ export interface AgentSession {
     }): void;
     /** Interrupt the current turn (session stays resumable). */
     interrupt(): Promise<void>;
+    /**
+     * An opaque id naming the conversation as it stands RIGHT NOW (ticket #126).
+     *
+     * Handed back later as `SessionSpec.resumeAtAnchor` to rewind the agent's
+     * memory to this exact point. `null` means the agent has nothing to anchor to
+     * yet — a session whose first turn has not finished — and the caller must
+     * then treat "rewind to here" as "start the conversation over".
+     *
+     * Claude: the uuid of the last message in its transcript.
+     * Codex:  the id of the last completed turn.
+     */
+    conversationAnchor(): string | null;
+    /**
+     * Ask the agent to summarise the conversation so far and continue from the
+     * summary — `/compact` in either CLI.
+     *
+     * Returns false when the agent is in no state to do it (mid-turn, or the
+     * call was refused); the caller says so rather than pretending it happened.
+     */
+    compact(): Promise<boolean>;
     /**
      * Tear the session down (kills the agent process). The reason travels so
      * anything the user was still being asked is withdrawn with a cause they can

package/dist/adapters/types.js

@@ -2,4 +2,35 @@ export const AGENT_MODES = ['ask', 'plan', 'auto', 'full'];
 export function isAgentMode(value) {
     return typeof value === 'string' && AGENT_MODES.includes(value);
 }
+/**
+ * Said in the feed whenever `full` is asked for on a STRICT workspace — at
+ * launch and on a live switch. One string, because it is one refusal, and the
+ * user should not have to notice that they arrived at it two different ways.
+ */
+export const MODE_REFUSED_TEXT = '«Unrestricted» is not available on this project. Its trust level is Strict, and «Unrestricted» is the one mode in which DevBridge checks nothing — the two cannot both be true. This session asks about every command instead. Only a project manager can change the trust level, in the server panel.';
+/**
+ * The other half of the same rule, and a different sentence on purpose
+ * (QA-128): this one is shown when the mode was taken AWAY from a running
+ * session because a manager tightened the project, not because the user asked
+ * for something they may not have. Telling somebody off for a decision that was
+ * not theirs is how a correct refusal still reads as a bug.
+ */
+export const MODE_WITHDRAWN_TEXT = 'This project was just set to Strict trust, so «Unrestricted» is no longer available and this session now asks about every command. Nothing you did caused this — a project manager changed it in the server panel.';
+/**
+ * The modes a session on THIS workspace may actually be put into (ticket #156).
+ *
+ * One entry differs from `AGENT_MODES`, and it is load-bearing: on a `STRICT`
+ * workspace `full` is not offered at all.
+ *
+ * `full` is the one mode in which layer 1 does not run — the agent CLI stops
+ * asking, so `evaluateToolUse` is never called and there is nothing left to
+ * enforce. On every other workspace that is the owner's explicit choice
+ * (2026-07-24: «full restricts nothing»). On a `STRICT` one it would be the
+ * opposite: a shield the manager set, spent from the chat by whoever opened the
+ * session. So the mode is removed from the list the dashboard draws its picker
+ * from, and refused if it arrives anyway.
+ */
+export function availableModes(trustMode) {
+    return trustMode === 'STRICT' ? AGENT_MODES.filter((mode) => mode !== 'full') : [...AGENT_MODES];
+}
 //# sourceMappingURL=types.js.map

package/dist/attachments.d.ts

@@ -67,6 +67,17 @@ export declare function saveAttachments(input: {
     saved: SavedAttachment[];
     failed: string[];
 }>;
+/**
+ * Delete old attachments from a session worktree.
+ *
+ * These files are invisible to git by design, which also means nothing else
+ * will ever clean them up: a long-lived workspace would accumulate every
+ * screenshot and archive anyone attached to it, on the owner's own disk. Age
+ * first, then a size budget for the case where age alone is not enough.
+ *
+ * Best effort — a folder we cannot prune is not a reason to lose the message.
+ */
+export declare function pruneAttachmentDir(dir: string, now?: number): void;
 /**
  * Turn the user's message plus the files into one prompt.
  *
@@ -74,6 +85,22 @@ export declare function saveAttachments(input: {
  * files with their own tools, and an agent-specific encoding (image blocks for
  * Claude, `localImage` items for Codex) would be two code paths that drift.
  * The user's own words stay first — the files are context, not the request.
+ *
+ * Each line NAMES the file and stops there (#128). The old version ended every
+ * list with «Open them before answering — images included», which was false for
+ * a `.zip` — there is nothing to look at — and false for a `.docx`. An
+ * instruction that is wrong for the file in front of the agent is worse than no
+ * instruction: it produces a confident answer about a document nobody opened.
+ *
+ * What we deliberately do NOT do is decide for the agent. Unpacking an archive,
+ * or extracting a document's text and handing over our version of it, would put
+ * DevBridge in charge of a job the agent does better with the whole file in
+ * front of it — and would mean the agent answers about what WE chose to show,
+ * not about what the person actually attached.
+ *
+ * The closing line is a trust frame, not decoration. These files come from a
+ * person through a web form; anything inside one that reads like an order to
+ * the agent is data, not authority (react-security-standards AI.2/AI.3).
  */
 export declare function composeMessageWithAttachments(text: string, saved: SavedAttachment[]): string;
 //# sourceMappingURL=attachments.d.ts.map