@buildinternet/uploads 0.42.1 → 0.43.0

package/README.md

@@ -15,7 +15,7 @@ npx @buildinternet/uploads --help
 uploads setup
 uploads --version
 uploads attach ./before.png ./after.png
-uploads screenshot https://app.example --pr 123 --comment   # capture + host in one step
+uploads screenshot https://app.example --pr 123   # capture + host in one step
 uploads screenshot ./report.html --dark --selector "main"
 uploads screenshot http://localhost:3000 --via local --annotate ./callouts.json
 uploads annotate ./shot.png --spec ./callouts.json --out ./shot.marked.png
@@ -24,7 +24,7 @@ uploads put ./shot.png --destination screenshots
 uploads put ./shot.png --no-optimize
 uploads put ./mobile.png --frame phone
 uploads put ./ui.png --frame browser --frame-url "https://app.example"
-uploads put ./after.png --pr 123 --comment
+uploads put ./after.png --pr 123
 uploads put ./capture-2026-…Z.png --pr 123 --name hero.png   # clean leaf, stable path
 uploads put ./shot.png --pr 123 --name hero.png --dry-run --format url  # preview URL, no upload
 uploads gallery create --title "Release screenshots"
@@ -190,7 +190,7 @@ When adding several keys, `uploads gallery add` processes them sequentially and
 individual failures in `--json` output. Gallery item updates use the API's current version to
 avoid overwriting concurrent changes.
 
-Link a gallery to a GitHub issue or pull request with `gallery link --github`. Run `uploads comment --pr <number>` (or use `put --comment`) to refresh that target’s one managed comment with every linked gallery and loose attachment. Coordinates and strict `https://github.com/<owner>/<repo>/issues|pull/<number>` URLs are accepted; `gallery list --github` performs the authenticated reverse lookup. Links never change gallery identity, and GitHub repository visibility does not make the public gallery private.
+Link a gallery to a GitHub issue or pull request with `gallery link --github`. Run `uploads comment --pr <number>` to refresh that target’s one managed comment with every linked gallery and loose attachment. Coordinates and strict `https://github.com/<owner>/<repo>/issues|pull/<number>` URLs are accepted; `gallery list --github` performs the authenticated reverse lookup. Links never change gallery identity, and GitHub repository visibility does not make the public gallery private.
 
 Config layers (first match wins): CLI flags → env vars → `--env-file` → `~/.config/buildinternet/config`. See `config.example` for keys.
 

package/dist/cli-help.js

@@ -105,7 +105,7 @@ ${section(style, "Examples:")}
   ${style.command("uploads login")}
   ${style.command("uploads whoami")}
   ${style.command("uploads put")} ./shot.png --pr 123 --name hero.png
-  ${style.command("uploads put")} ./after.png --pr 123 --comment
+  ${style.command("uploads put")} ./after.png --pr 123
   ${style.command("uploads put")} ./bug.png --issue 45
   ${style.command("uploads put")} ./shot.png --meta path=/settings --state after
   ${style.command("uploads attach")} ./before.png ./after.png
@@ -131,7 +131,7 @@ ${section(style, "Config")} ${style.muted("(first match wins, per key):")}
 ${section(style, "Workspace")} ${style.muted("(within config layers):")}
   --workspace, -w     override — global (before command) or per-command (after)
   UPLOADS_WORKSPACE   env / config file
-  (else inferred from token up_<name>_…, else "default")
+  (else inferred from token up_<name>_…, or the API key's only workspace)
 
 ${section(style, "Other globals")} ${style.muted("(before command):")}
   --api-url <url>     default: https://api.uploads.sh
@@ -154,7 +154,7 @@ ${section(style, "Examples:")}
   ${style.command("uploads login")}
   ${style.command("uploads whoami")}
   ${style.command("uploads put")} ./shot.png --pr 123 --name hero.png
-  ${style.command("uploads put")} ./after.png --pr 123 --comment
+  ${style.command("uploads put")} ./after.png --pr 123
   ${style.command("uploads put")} ./bug.png --issue 45 --repo myorg/myapp
   ${style.command("uploads put")} ./shot.png --dry-run --format url
   ${style.command("uploads put")} ./shot.png --meta path=/settings --state after

package/dist/client.d.ts

@@ -565,7 +565,7 @@ export declare function mintWorkspaceToken(apiUrl: string, accessToken: string,
     workspace: string;
     scopes?: Array<TokenScope>;
     label?: string;
-    ttlSeconds?: number;
+    ttlSeconds?: number | null;
 }): Promise<MintTokenResult>;
 /**
  * Parse API error bodies. Prefers the nested envelope

package/dist/client.js

@@ -179,7 +179,7 @@ export function mintWorkspaceToken(apiUrl, accessToken, input) {
         body: JSON.stringify({
             grants: [{ workspace: input.workspace, ...(input.scopes ? { scopes: input.scopes } : {}) }],
             ...(input.label ? { label: input.label } : {}),
-            ...(input.ttlSeconds ? { ttlSeconds: input.ttlSeconds } : {}),
+            ...(input.ttlSeconds !== undefined ? { ttlSeconds: input.ttlSeconds } : {}),
         }),
     });
 }

package/dist/commands/config.js

@@ -18,7 +18,7 @@ Subcommands:
 Keys:
   UPLOADS_API_URL           API base URL (default: ${DEFAULT_API_URL})
   UPLOADS_WORKSPACE         Workspace / bucket tenant (default: ${DEFAULT_WORKSPACE})
-  UPLOADS_TOKEN             Bearer token for the workspace
+  UPLOADS_TOKEN             Bearer token (up_<workspace>_…)
   UPLOADS_SESSION_TOKEN     Device-flow session (CLI version on account sessions)
   UPLOADS_DEFAULT_PREFIX    Default key prefix for put/list
   UPLOADS_DEFAULT_REPO      Default repo segment for put

package/dist/commands/hook.js

@@ -19,6 +19,7 @@ Usage:
   uploads hook pre-pr-screenshot
 
 Invoked by Claude Code / Codex / Grok / Cursor hooks. Never blocks.
+Harness manifests no-op (exit 0, no output) when this binary is not on PATH.
 
   pre-pr-screenshot
     If the shell command is \`gh pr create\`, the branch touches UI files, and

package/dist/commands/install.js

@@ -2,7 +2,7 @@ import { flagBool, flagString, parseCommandArgs, UsageError, } from "../cli-args
 import { resolveConfig } from "../config.js";
 import { execRunner } from "../github-gh.js";
 import { writeCommandHelp } from "../cli-style.js";
-import { HOOK_COMMAND, installHookManifests } from "../hooks-install.js";
+import { HOOK_COMMAND, HOOK_INVOCATION, installHookManifests, } from "../hooks-install.js";
 export const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
 const SKILL_SOURCE = "buildinternet/uploads";
 const SKILL_NAMES = ["uploads-cli", "github-screenshots", "annotate-screenshots"];
@@ -15,7 +15,7 @@ hook for Grok / Cursor when those tools are present. The remote MCP endpoint
 infers your workspace from the bearer token, so only the token is needed.
 
 Claude Code and Codex ship the same reminder via their plugins (same command:
-\`${HOOK_COMMAND}\`) — install those plugins instead of relying on this step.
+\`${HOOK_INVOCATION}\`) — install those plugins instead of relying on this step.
 
 Safe to re-run. An MCP server already registered under this name is reported
 as \`already configured\` and left as-is — including the token it was created

package/dist/commands/screenshot.js

@@ -8,6 +8,7 @@ import { loadDefaultsRaw, resolveScreenshotDefaults } from "../config-file.js";
 import { resolvePutPrefix } from "../destinations.js";
 import { execRunner, ghMetadataFromTargetWithTitle, resolveRepo, } from "../github-gh.js";
 import { deriveRepoSlugFromGit } from "../keys.js";
+import { noProjectContextNudge } from "../project-context-nudge.js";
 import { safeCaptureFacts } from "../capture-facts.js";
 import { parseMetaFlags, validateMetaMap } from "../metadata.js";
 import { mergeDerivedMeta } from "../metadata-vocab.js";
@@ -388,6 +389,9 @@ loadAnnotateModule = () => import("../annotate/index.js")) {
     else if (Object.keys(withFacts).length > 0) {
         validateMetaMap(withFacts);
     }
+    // #692 follow-up: same advisory as put — a capture with no repo/app context
+    // and only a local origin lands in the screenshots page's fallback buckets.
+    const contextNudge = !ctx.quiet && !putDefaults.noNudge && !noGit ? noProjectContextNudge(metadata) : undefined;
     const logHuman = !ctx.quiet && format === "human";
     if (logHuman)
         process.stderr.write(`>> capturing ${target}\n`);
@@ -562,6 +566,8 @@ loadAnnotateModule = () => import("../annotate/index.js")) {
         }
         if (bindingWarning)
             process.stderr.write(`${bindingWarning}\n`);
+        if (contextNudge)
+            process.stderr.write(`${contextNudge}\n`);
         process.stderr.write("\n");
     }
     // One JSON `hint` slot (mirrors bare put): the clip note (issue #652) wins
@@ -576,7 +582,7 @@ loadAnnotateModule = () => import("../annotate/index.js")) {
     const replacedHint = result.replaced && explicitMeta.state
         ? `re-capture replaced the previous state=${explicitMeta.state} object at ${result.key} — expected for repeat captures of the same URL + state`
         : undefined;
-    const jsonHint = clipHint ?? bindingWarning ?? stagingNote ?? replacedHint;
+    const jsonHint = clipHint ?? bindingWarning ?? stagingNote ?? replacedHint ?? contextNudge;
     switch (format) {
         case "json":
             await writeJson({

package/dist/commands.js

@@ -16,6 +16,7 @@ import { mergeSidecarMeta } from "./sidecar.js";
 import { ghAttachmentKeyForMode, ghBranchAttachmentKeyForMode, ghBranchKeyPrefix, ghKeyPrefix, ghPrivateKeyPrefix, ghPrivateBranchKeyPrefix, ghMetadataFromTarget, parseGhKey, parseGhPrivateKey, ghMetadataForBranch, attachmentsCommentBody, attachmentsMarker, AUTO_RENDER_OPTIONS, GH_FALLBACK_AUTHOR_NOTE, normalizeGithubCoordinate, } from "./github.js";
 import { resolveRepo, resolveCurrentPullRequest, resolveCurrentBranch, resolveDefaultBranch, classifyGhNumber, execRunner, timedExecRunner, ghMetadataFromTargetWithTitle, upsertAttachmentsComment, } from "./github-gh.js";
 import { deriveRepoFromGit, deriveRepoSlugFromGit } from "./keys.js";
+import { noProjectContextNudge } from "./project-context-nudge.js";
 import { resolvePutPrefix } from "./destinations.js";
 import { optimizeImageForUpload, rewriteKeyExtension, } from "./optimize.js";
 import { applyFrame, resolveFrameId } from "./frame.js";
@@ -1812,6 +1813,11 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         if (slug)
             metadata = mergeDerivedMeta(metadata, { repo: slug });
     }
+    // #692 follow-up: a path-tagged upload with no repo/gh.repo/app context and
+    // no real (non-local) origin lands in the screenshots page's fallback
+    // buckets — one advisory line at the moment the context went missing.
+    // --no-git is an explicit choice, so it suppresses the nudge too.
+    const contextNudge = !ctx.quiet && !defaults.noNudge && !noGit ? noProjectContextNudge(metadata) : undefined;
     // Bare-put nudge (issue #393): only relevant when staging didn't take over
     // — once `stagingTarget` resolves, staging IS the upgrade the nudge used to
     // point at, so this is skipped entirely rather than firing redundantly.
@@ -1894,7 +1900,7 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
     // warning); stderr prints the nudge/staging-note and binding-warning lines
     // independently, below. pathHint only ever fires on the ghTarget path, so
     // it never competes with the other three.
-    const jsonHint = nudge ?? bindingWarning ?? stagingNote ?? pathHint;
+    const jsonHint = nudge ?? bindingWarning ?? stagingNote ?? pathHint ?? contextNudge;
     const galleriesByKey = new Map();
     let galleryHadError = false;
     if (galleryId && uploads.length > 0) {
@@ -1979,6 +1985,8 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
                 process.stderr.write(`${bindingWarning}\n`);
             if (pathHint)
                 process.stderr.write(`${pathHint}\n`);
+            if (contextNudge)
+                process.stderr.write(`${contextNudge}\n`);
         }
         return failures.length === 0 && !galleryHadError ? 0 : 1;
     }
@@ -2040,6 +2048,8 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         process.stderr.write(`${bindingWarning}\n`);
     if (pathHint && format !== "json")
         process.stderr.write(`${pathHint}\n`);
+    if (contextNudge && format !== "json")
+        process.stderr.write(`${contextNudge}\n`);
     return gallery?.error ? 1 : 0;
 }
 // --- galleries ---
@@ -2726,7 +2736,9 @@ Scans the PR/issue description and comments for github.com/user-attachments
 media, mirrors new ones into the workspace (indexed, not added to the managed
 comment), and detaches ones no longer referenced. Works on any repo linked to
 the workspace; the .uploads.yml ingestGithubAttachments knob only gates the
-automatic webhook path.
+automatic webhook path. Bot-authored attachments and images under 200px on
+either side are always skipped (the .uploads.yml ingestBotAttachments knob
+re-admits bot media on the webhook path only).
 
 Examples:
   uploads ingest --pr 123

package/dist/comment-config.d.ts

@@ -1,59 +1,12 @@
 /**
- * Published-CLI COPY of the workspace parser/resolver (issue #307)
- * (packages/comment-config/src/index.ts). The published CLI imports no
- * @uploads/* package, so that private package cannot be shared here — its
- * parser/resolver is copied verbatim below. Kept in sync by
- * test/fixtures/comment-config-golden.json, asserted from both sides (this
- * package's comment-config.test.ts and the canonical package's
- * index.test.ts) — change both copies together. `readLocalRepoCommentConfig`
- * below is CLI-only: it reads the six candidate config paths off the working
- * tree (the server instead fetches them from GitHub's contents API —
- * apps/api/src/repo-comment-config.ts).
+ * CLI comment-config: shared parser from the generated copy of
+ * `@uploads/comment-config`, plus the local working-tree reader.
+ * `readLocalRepoCommentConfig` is CLI-only — it reads the six candidate
+ * config paths off the working tree (the server instead fetches them from
+ * GitHub's contents API — apps/api/src/repo-comment-config.ts).
  */
-export interface RepoCommentConfig {
-    imageWidth?: "auto" | "full" | number;
-    maxInlineImages?: number;
-    metaPath?: boolean;
-    metaState?: boolean;
-    linkToFilePage?: boolean;
-    note?: string;
-    ingestGithubAttachments?: boolean;
-}
-export interface WorkspaceCommentDefaults {
-    imageWidth?: "full" | number;
-    maxInlineImages?: number;
-    showMetadata?: boolean;
-    linkToFilePage?: boolean;
-    note?: string;
-    ingestGithubAttachments?: boolean;
-}
-export interface ResolvedCommentOptions {
-    imageWidth: "auto" | "full" | number;
-    maxInlineImages: number;
-    metaPath: boolean;
-    metaState: boolean;
-    linkToFilePage: boolean;
-    note: string | null;
-    ingestGithubAttachments: boolean;
-}
-export type OptionSource = "repo" | "workspace" | "auto";
-export declare const AUTO_COMMENT_OPTIONS: ResolvedCommentOptions;
-export declare const NOTE_MAX_CHARS = 500;
-export declare function parseRepoCommentConfig(text: string, format: "yaml" | "json"): {
-    config: RepoCommentConfig | null;
-    warnings: string[];
-};
-export declare function resolveCommentOptions(repo: RepoCommentConfig | null, ws: WorkspaceCommentDefaults | null): {
-    options: ResolvedCommentOptions;
-    source: Record<keyof ResolvedCommentOptions, OptionSource>;
-};
-/**
- * Candidate paths, checked in this order — the first hit wins. Must match
- * the server's REPO_CONFIG_PATHS exactly (apps/api/src/repo-comment-config.ts)
- * so a committed config resolves identically whether the bot or the local
- * gh fallback renders the comment.
- */
-export declare const REPO_CONFIG_PATHS: readonly [".uploads.yml", ".uploads.yaml", ".uploads.json", ".github/uploads.yml", ".github/uploads.yaml", ".github/uploads.json"];
+import { type RepoCommentConfig } from "./comment-config.generated.js";
+export { AUTO_COMMENT_OPTIONS, NOTE_MAX_CHARS, REPO_CONFIG_PATHS, parseRepoCommentConfig, resolveCommentOptions, type OptionSource, type RepoCommentConfig, type ResolvedCommentOptions, type WorkspaceCommentDefaults, } from "./comment-config.generated.js";
 /**
  * Read the repo's comment config off the local working tree — the CLI has no
  * GitHub App installation token to fetch via the contents API, so this reads

package/dist/comment-config.generated.d.ts

@@ -0,0 +1,48 @@
+/**
+ * GENERATED by packages/uploads/scripts/inline-shared.mjs — do not edit.
+ * Canonical source: packages/comment-config/src/index.ts
+ * The published CLI cannot import private @uploads/* packages, so this file
+ * is inlined into the tarball. Re-run the script after changing the source.
+ */
+export interface RepoCommentConfig {
+    imageWidth?: "auto" | "full" | number;
+    maxInlineImages?: number;
+    metaPath?: boolean;
+    metaState?: boolean;
+    linkToFilePage?: boolean;
+    note?: string;
+    ingestGithubAttachments?: boolean;
+    ingestBotAttachments?: boolean;
+}
+export interface WorkspaceCommentDefaults {
+    imageWidth?: "full" | number;
+    maxInlineImages?: number;
+    showMetadata?: boolean;
+    linkToFilePage?: boolean;
+    note?: string;
+    ingestGithubAttachments?: boolean;
+    ingestBotAttachments?: boolean;
+}
+export interface ResolvedCommentOptions {
+    imageWidth: "auto" | "full" | number;
+    maxInlineImages: number;
+    metaPath: boolean;
+    metaState: boolean;
+    linkToFilePage: boolean;
+    note: string | null;
+    ingestGithubAttachments: boolean;
+    ingestBotAttachments: boolean;
+}
+export type OptionSource = "repo" | "workspace" | "auto";
+export declare const AUTO_COMMENT_OPTIONS: ResolvedCommentOptions;
+export declare const NOTE_MAX_CHARS = 500;
+export declare function parseRepoCommentConfig(text: string, format: "yaml" | "json"): {
+    config: RepoCommentConfig | null;
+    warnings: string[];
+};
+export declare function resolveCommentOptions(repo: RepoCommentConfig | null, ws: WorkspaceCommentDefaults | null): {
+    options: ResolvedCommentOptions;
+    source: Record<keyof ResolvedCommentOptions, OptionSource>;
+};
+/** Candidate paths, checked in this order — the first hit wins. */
+export declare const REPO_CONFIG_PATHS: readonly [".uploads.yml", ".uploads.yaml", ".uploads.json", ".github/uploads.yml", ".github/uploads.yaml", ".github/uploads.json"];

package/dist/comment-config.generated.js

@@ -0,0 +1,178 @@
+/**
+ * GENERATED by packages/uploads/scripts/inline-shared.mjs — do not edit.
+ * Canonical source: packages/comment-config/src/index.ts
+ * The published CLI cannot import private @uploads/* packages, so this file
+ * is inlined into the tarball. Re-run the script after changing the source.
+ */
+import { parse as parseYaml } from "yaml";
+export const AUTO_COMMENT_OPTIONS = {
+    imageWidth: "auto",
+    maxInlineImages: 16, // MAX_INLINE_ATTACHMENT_IMAGES — renderer copies own the constant
+    metaPath: true,
+    metaState: true,
+    linkToFilePage: true,
+    note: null,
+    ingestGithubAttachments: true,
+    ingestBotAttachments: false,
+};
+export const NOTE_MAX_CHARS = 500;
+const WIDTH_MIN = 160;
+const WIDTH_MAX = 1000;
+const MAX_INLINE_MIN = 1;
+const MAX_INLINE_MAX = 48;
+const clamp = (n, lo, hi) => Math.min(hi, Math.max(lo, Math.round(n)));
+export function parseRepoCommentConfig(text, format) {
+    const warnings = [];
+    let root;
+    try {
+        root = format === "json" ? JSON.parse(text) : parseYaml(text);
+    }
+    catch {
+        return { config: null, warnings: ["config file could not be parsed; ignoring it"] };
+    }
+    if (typeof root !== "object" || root === null || Array.isArray(root)) {
+        return { config: null, warnings };
+    }
+    const comment = root.comment;
+    if (typeof comment !== "object" || comment === null || Array.isArray(comment)) {
+        return { config: null, warnings };
+    }
+    const c = comment;
+    const config = {};
+    // imageWidth: "auto" | "full" | finite number (clamped)
+    if ("imageWidth" in c) {
+        const v = c.imageWidth;
+        if (v === "auto" || v === "full")
+            config.imageWidth = v;
+        else if (typeof v === "number" && Number.isFinite(v))
+            config.imageWidth = clamp(v, WIDTH_MIN, WIDTH_MAX);
+        else
+            warnings.push(`imageWidth: expected "auto", "full", or a number; dropped`);
+    }
+    // maxInlineImages: finite number (clamped)
+    if ("maxInlineImages" in c) {
+        const v = c.maxInlineImages;
+        if (typeof v === "number" && Number.isFinite(v))
+            config.maxInlineImages = clamp(v, MAX_INLINE_MIN, MAX_INLINE_MAX);
+        else
+            warnings.push(`maxInlineImages: expected a number; dropped`);
+    }
+    // linkToFilePage: boolean
+    if ("linkToFilePage" in c) {
+        const v = c.linkToFilePage;
+        if (typeof v === "boolean")
+            config.linkToFilePage = v;
+        else
+            warnings.push(`linkToFilePage: expected a boolean; dropped`);
+    }
+    // ingestGithubAttachments: boolean
+    if ("ingestGithubAttachments" in c) {
+        const v = c.ingestGithubAttachments;
+        if (typeof v === "boolean")
+            config.ingestGithubAttachments = v;
+        else
+            warnings.push(`ingestGithubAttachments: expected a boolean; dropped`);
+    }
+    // ingestBotAttachments: boolean
+    if ("ingestBotAttachments" in c) {
+        const v = c.ingestBotAttachments;
+        if (typeof v === "boolean")
+            config.ingestBotAttachments = v;
+        else
+            warnings.push(`ingestBotAttachments: expected a boolean; dropped`);
+    }
+    // meta.path / meta.state: booleans nested under `meta`
+    if ("meta" in c) {
+        const v = c.meta;
+        if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+            const meta = v;
+            if ("path" in meta) {
+                if (typeof meta.path === "boolean")
+                    config.metaPath = meta.path;
+                else
+                    warnings.push(`meta.path: expected a boolean; dropped`);
+            }
+            if ("state" in meta) {
+                if (typeof meta.state === "boolean")
+                    config.metaState = meta.state;
+                else
+                    warnings.push(`meta.state: expected a boolean; dropped`);
+            }
+        }
+        else {
+            warnings.push(`meta: expected an object; dropped`);
+        }
+    }
+    // note: non-empty trimmed string, max NOTE_MAX_CHARS (never truncated)
+    if ("note" in c) {
+        const v = c.note;
+        if (typeof v === "string") {
+            const trimmed = v.trim();
+            if (trimmed.length === 0) {
+                // empty/whitespace note is treated as absent
+            }
+            else if (trimmed.length > NOTE_MAX_CHARS) {
+                warnings.push(`note: longer than ${NOTE_MAX_CHARS} characters; dropped (not truncated)`);
+            }
+            else {
+                config.note = trimmed;
+            }
+        }
+        else {
+            warnings.push(`note: expected a string; dropped`);
+        }
+    }
+    return { config, warnings };
+}
+export function resolveCommentOptions(repo, ws) {
+    const wsAsRepo = {
+        ...(ws?.imageWidth !== undefined ? { imageWidth: ws.imageWidth } : {}),
+        ...(ws?.maxInlineImages !== undefined ? { maxInlineImages: ws.maxInlineImages } : {}),
+        ...(ws?.showMetadata !== undefined
+            ? { metaPath: ws.showMetadata, metaState: ws.showMetadata }
+            : {}),
+        ...(ws?.linkToFilePage !== undefined ? { linkToFilePage: ws.linkToFilePage } : {}),
+        ...(ws?.note ? { note: ws.note } : {}),
+        ...(ws?.ingestGithubAttachments !== undefined
+            ? { ingestGithubAttachments: ws.ingestGithubAttachments }
+            : {}),
+        ...(ws?.ingestBotAttachments !== undefined
+            ? { ingestBotAttachments: ws.ingestBotAttachments }
+            : {}),
+    };
+    const options = { ...AUTO_COMMENT_OPTIONS };
+    const source = Object.fromEntries(Object.keys(AUTO_COMMENT_OPTIONS).map((k) => [k, "auto"]));
+    const apply = (cfg, from) => {
+        for (const key of [
+            "imageWidth",
+            "maxInlineImages",
+            "metaPath",
+            "metaState",
+            "linkToFilePage",
+            "ingestGithubAttachments",
+            "ingestBotAttachments",
+        ]) {
+            if (cfg[key] !== undefined && source[key] === "auto") {
+                options[key] = cfg[key];
+                source[key] = from;
+            }
+        }
+        if (cfg.note !== undefined && source.note === "auto") {
+            options.note = cfg.note;
+            source.note = from;
+        }
+    };
+    if (repo)
+        apply(repo, "repo");
+    apply(wsAsRepo, "workspace");
+    return { options, source };
+}
+/** Candidate paths, checked in this order — the first hit wins. */
+export const REPO_CONFIG_PATHS = [
+    ".uploads.yml",
+    ".uploads.yaml",
+    ".uploads.json",
+    ".github/uploads.yml",
+    ".github/uploads.yaml",
+    ".github/uploads.json",
+];