@coreplane/switchboard 1.208.0 → 1.210.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -95,6 +95,15 @@ import {
   type ThreadDepsMechanism,
 } from "../../src/execution/residentDepCache.js";
 import { parseWorktreeCleanliness, worktreeCleanlinessScript } from "../../src/execution/residentCleanliness.js";
+import {
+  base64ByteLength,
+  MAX_READ_BASE64_CHARS,
+  MAX_READ_BYTES,
+  readCommandFor,
+  readEncodingOf,
+  type Base64ReadAnswer,
+  type ReadEncoding,
+} from "../../src/execution/binaryRead.js";
 import {
   capBytesFor,
   capWrappedCommand,
@@ -5170,36 +5179,53 @@ export class ResidentDO extends Sandbox<Env> {
   }
 
   /** POST /read: cat the file AS THE THREAD USER — the OS layer (not just
-   *  the prefix check) is what confines a symlink pointing outside. */
-  async readThreadFile(threadKey: string, path: string): Promise<{ content: string; truncated: boolean } | ThreadErr> {
-    return this.withThreadBusy(threadKey, () => this.readThreadFileImpl(threadKey, path));
+   *  the prefix check) is what confines a symlink pointing outside. A
+   *  `base64` read (src/execution/binaryRead.ts) runs `base64 -w0` instead,
+   *  under the binary cap; an overflow is the named refusal, never a slice
+   *  of the encoding. */
+  async readThreadFile(
+    threadKey: string,
+    path: string,
+    encoding: ReadEncoding = "utf8",
+  ): Promise<{ content: string; truncated: boolean } | Base64ReadAnswer | ThreadErr> {
+    return this.withThreadBusy(threadKey, () => this.readThreadFileImpl(threadKey, path, encoding));
   }
 
   private async readThreadFileImpl(
     threadKey: string,
     path: string,
-  ): Promise<{ content: string; truncated: boolean } | ThreadErr> {
+    encoding: ReadEncoding,
+  ): Promise<{ content: string; truncated: boolean } | Base64ReadAnswer | ThreadErr> {
     const pre = await this.threadPreflight(threadKey);
     if ("error" in pre) return pre;
     const resolved = confineThreadPath(pre.binding.worktreePath, path);
     if (!resolved)
       return { error: `path-escape: ${JSON.stringify(path)} does not stay inside the thread worktree`, status: 400 };
+    const cap = encoding === "base64" ? MAX_READ_BASE64_CHARS : READ_CONTENT_CAP;
     let r: Awaited<ReturnType<ResidentDO["threadRun"]>>;
     try {
       r = await this.threadRun(
         pre.binding.user,
         pre.binding.worktreePath,
-        `cat -- ${resolved}`,
+        readCommandFor(encoding, resolved),
         DEFAULT_EXEC_TIMEOUT_MS,
-        capBytesFor(READ_CONTENT_CAP),
+        capBytesFor(cap),
       );
     } catch (err) {
       if (err instanceof RuntimeReplacedError) return runtimeReplacedErr(err);
       throw err;
     }
     if (r.exitCode !== 0 || r.timedOut) return { error: `read-failed: ${describeStepFailure(r)}`, status: 404 };
-    const truncated = r.stdout.length > READ_CONTENT_CAP;
-    return { content: truncated ? r.stdout.slice(0, READ_CONTENT_CAP) : r.stdout, truncated };
+    const truncated = r.stdout.length > cap;
+    if (encoding === "base64") {
+      // Padding hides up to two bytes inside the cap's char count, so the
+      // decoded size is checked too — the cap is bytes, not characters.
+      const content = r.stdout.trimEnd();
+      return truncated || base64ByteLength(content) > MAX_READ_BYTES
+        ? { encoding, tooLarge: true }
+        : { encoding, content };
+    }
+    return { content: truncated ? r.stdout.slice(0, cap) : r.stdout, truncated };
   }
 
   /** POST /write: content travels via the SDK file API into the thread's
@@ -7186,7 +7212,9 @@ async function handleRead(env: Env, body: Record<string, unknown>): Promise<Resp
   if (ctx instanceof Response) return ctx;
   if (typeof body.path !== "string")
     return json({ error: "path must be a string relative to the thread worktree" }, 400);
-  const result = await ctx.stub.readThreadFile(ctx.threadKey, body.path);
+  const encoding = readEncodingOf(body);
+  if (typeof encoding !== "string") return json({ error: encoding.error }, 400);
+  const result = await ctx.stub.readThreadFile(ctx.threadKey, body.path, encoding);
   if ("error" in result) return threadErrResponse(result);
   return json(result);
 }

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -18,6 +18,12 @@
 // first deploy; the SDK is young and its surface may shift.
 import { getSandbox, Sandbox, type ExecOptions, type ExecResult } from "@cloudflare/sandbox";
 import { BASH_TIMEOUT_MAX_MS, clampBashTimeout } from "../../src/execution/bashTimeout.js";
+import {
+  base64ByteLength,
+  MAX_READ_BYTES,
+  readEncodingOf,
+  type Base64ReadAnswer,
+} from "../../src/execution/binaryRead.js";
 import {
   EXEC_KEEPALIVE_INTERVAL_MS,
   SANDBOX_SLEEP_AFTER,
@@ -265,7 +271,22 @@ export default {
           );
         }
         case "/read": {
-          const file = await withSessionRecovery(sandbox, () => sandbox.readFile(abs(String(body.path ?? ""))));
+          // `encoding: "base64"` is a binary read (src/execution/binaryRead.ts):
+          // the SDK encodes the bytes, and a file over the cap is refused by
+          // name inside a 200 — the client counts a non-2xx as a sick Worker.
+          const encoding = readEncodingOf(body);
+          if (typeof encoding !== "string") return json({ error: encoding.error }, 400);
+          const path = abs(String(body.path ?? ""));
+          if (encoding === "base64") {
+            const file = await withSessionRecovery(sandbox, () => sandbox.readFile(path, { encoding: "base64" }));
+            const content = typeof file === "string" ? file : (file?.content ?? "");
+            const answer: Base64ReadAnswer =
+              base64ByteLength(content) > MAX_READ_BYTES
+                ? { encoding: "base64", tooLarge: true }
+                : { encoding: "base64", content };
+            return json(answer);
+          }
+          const file = await withSessionRecovery(sandbox, () => sandbox.readFile(path));
           return json({ content: typeof file === "string" ? file : (file?.content ?? "") });
         }
         case "/write": {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.208.0",
+  "version": "1.210.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.208.0",
+      "version": "1.210.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -18999,7 +18999,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.208.0",
+      "version": "1.210.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.208.0",
+  "version": "1.210.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.208.0",
-  "commit": "348d6f6ebbf7cf242f39951c0a81585527f49181",
-  "builtAt": "2026-09-14T03:37:32.458Z"
+  "version": "1.210.0",
+  "commit": "1c1f94ae5c58bff0f3734e2b522b2ab440baa89d",
+  "builtAt": "2026-09-14T05:52:14.303Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -1,8 +1,8 @@
-// Agent definitions. An agent is a system prompt + toolset + machine class + turn budget.
+// Agent definitions. An agent is a system prompt + toolset + machine class + wall-clock budget.
 import type { Effort } from "../effort.js";
 import type { CacheTtl } from "../providers/types.js";
 import { BASH_TIMEOUT_MAX_MS } from "../execution/bashTimeout.js";
-import { CONTRACT_HEADING, CONTRACT_SECTION_HEADINGS } from "../core/ship/contract.js";
+import { CONTRACT_HEADING, CONTRACT_SECTION_HEADINGS, PR_TITLE_GUARD } from "../core/ship/contract.js";
 // Which model runs it is resolved separately by the config layers, so any
 // agent can run on any configured provider/model.
 
@@ -42,13 +42,37 @@ export function machineNeedsRepo(machine: MachineClass): boolean {
 export const IDENTITIES = ["none", "read", "write"] as const;
 export type Identity = (typeof IDENTITIES)[number];
 
+/** The pace that marks a run as looping rather than working: a model turn
+ *  every ten seconds, sustained for the whole wall clock. A busy run takes
+ *  20–40 s a turn (a model think plus a tool call), so a run that averages six
+ *  a minute from start to end is re-issuing calls, not making progress — and
+ *  its turn cap ends it before the wall clock would, with a write-up that
+ *  says so (docs/reference/specs/run-loop.md item 1). */
+export const RUNAWAY_TURNS_PER_MINUTE = 6;
+
+/** The turn cap a wall clock implies: `maxMinutes × RUNAWAY_TURNS_PER_MINUTE`.
+ *  Every preset that runs the loop derives its `maxTurns` from this, so the
+ *  cap is never a number a good run reaches — the minutes are the budget. */
+export function runawayTurnCap(maxMinutes: number): number {
+  return maxMinutes * RUNAWAY_TURNS_PER_MINUTE;
+}
+
+/** A loop-running preset's budget as one fact: the wall clock, and the runaway
+ *  guard derived from it. */
+function loopBudget(maxMinutes: number): Pick<AgentDef, "maxMinutes" | "maxTurns"> {
+  return { maxMinutes, maxTurns: runawayTurnCap(maxMinutes) };
+}
+
 export interface AgentDef {
   name: string;
   description: string;
   system: string;
   /** key into TOOLSETS: "full" | "readonly" | "web" | "assistant" | "explore" | "conductor" | "none" */
   toolset: "full" | "readonly" | "web" | "assistant" | "explore" | "conductor" | "none";
-  /** backstop only — the wall clock below is the real budget */
+  /** The runaway guard, not a budget: `runawayTurnCap(maxMinutes)` for every
+   *  preset that runs the loop (`loopBudget`). The wall clock below is the
+   *  budget; a run that reaches this cap first was pacing like a loop, and its
+   *  write-up says so. The proxy refuses model calls past it too. */
   maxTurns: number;
   maxTokens: number;
   /** hard wall-clock budget for the tool loop; at the deadline the agent is
@@ -97,7 +121,7 @@ export interface AgentDef {
 // and rendered against the head sha at render time, so a repush is a
 // re-render by Switchboard — the agent only resubmits when the CONTENT (line
 // numbers included) changed.
-const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Content contract per field (each renders as its own section): prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. Keep each field concise, not padded.
+const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. Content contract per field (each renders as its own section): prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. Keep each field concise, not padded.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in whatWhy), add what you changed, and anchor the Tour at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title**: the PR title — one line naming the change, specific enough to pick out of a PR list.
 - **TL;DR** (\`tldr\`, rendered first): two sentences for a naive reader with zero context — what this PR does and why it matters.
@@ -146,6 +170,13 @@ const IMAGE_TOOLCHAIN = `Node 24 with npm and pnpm; python3, make and g++ (nativ
 const SANDBOX_TOOLCHAIN = `The sandbox image carries ${IMAGE_TOOLCHAIN}; and Docker (the engine starts on the first \`docker\` call).`;
 const RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun — and no Docker.`;
 
+// Both coding prompts carry this verbatim (docs/reference/specs/agent-coding.md
+// item 10): the one way a run's screenshot reaches the person. Said once so
+// the sandbox and resident variants cannot drift on it.
+const SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording — it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too — unless the request names one destination. Never attach a subset and link the rest.
+Text stays in your message; do not attach what you can say.`;
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -173,6 +204,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
@@ -211,6 +244,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -401,9 +436,8 @@ export const AGENTS: Record<string, AgentDef> = {
     // and mints no credential of its own.
     machine: "none",
     identity: "none",
-    maxTurns: 8, // a repo read is 2-3 calls (repos → tree → file); an issue action 1-2; still fast
     maxTokens: 16000,
-    maxMinutes: 5,
+    ...loopBudget(5),
   },
   coding: {
     name: "coding",
@@ -411,9 +445,8 @@ export const AGENTS: Record<string, AgentDef> = {
     system: CODING_SYSTEM,
     residentSystem: CODING_SYSTEM_RESIDENT,
     toolset: "full",
-    maxTurns: 60, // scoping is capped at ~5 calls by the prompt; this is implementation room
     maxTokens: 64000,
-    maxMinutes: 45,
+    ...loopBudget(45),
     // Coding steps run long: a single model turn can take 5-6 minutes and
     // installs/tests add more — a 5m cache entry would expire between
     // requests, so the 2× write buys reads for the whole run.
@@ -431,9 +464,8 @@ export const AGENTS: Record<string, AgentDef> = {
     toolset: "readonly",
     machine: "repo-resident",
     identity: "read", // a read-scoped token and a read-only worktree: it cannot post or push from inside
-    maxTurns: 30, // backstop only; wall clock is the real budget (12 bound at ~4 min in practice)
     maxTokens: 64000,
-    maxMinutes: 25, // safety net, not the mechanism — typical reviews land in ~5
+    ...loopBudget(25), // a safety net — typical reviews land in ~5 minutes
     effort: "medium", // fast turns; one big-context pass does the deep work
   },
   ship: {
@@ -468,9 +500,8 @@ export const AGENTS: Record<string, AgentDef> = {
     toolset: "web",
     machine: "none", // web I/O only; no workspace is provisioned
     identity: "none",
-    maxTurns: 12,
     maxTokens: 24000,
-    maxMinutes: 8,
+    ...loopBudget(8),
     effort: "medium",
   },
   explore: {
@@ -483,9 +514,8 @@ export const AGENTS: Record<string, AgentDef> = {
     // review depends on: a two-hour job shares no container with anyone.
     machine: "repo-cold",
     identity: "read", // a read-scoped token: it can clone and read, never push — whatever the caller holds
-    maxTurns: 150, // a backstop for a two-hour loop of batched checks; the wall clock is the budget
     maxTokens: 64000,
-    maxMinutes: 120,
+    ...loopBudget(120),
     // A detached job polled across calls makes long steps: a 5m cache entry
     // would expire between them, so the 2× write buys reads for the whole run.
     cacheTtl: "1h",
@@ -501,9 +531,8 @@ export const AGENTS: Record<string, AgentDef> = {
     // dispatcher, the GitHub reads are REST in the bot process.
     machine: "none",
     identity: "none",
-    maxTurns: 40, // a spawn, then a poll per child every few minutes; the wall clock is the budget
     maxTokens: 32000,
-    maxMinutes: 120, // long enough to outlast a coding child; every child is capped by what remains of it
+    ...loopBudget(120), // long enough to outlast a coding child; every child is capped by what remains of it
     // No built-in effort: the deployment decides, as for coding.
   },
 };

package/dist/assets/src/execution/binaryRead.ts

@@ -0,0 +1,58 @@
+// A binary read on the Executor seam (docs/reference/specs/execution.md item 19):
+// the whole file as bytes, for a tool that hands a workspace artifact — a
+// screenshot, a PDF — to somewhere that needs the bytes, not a text view. Both
+// remote executors ask their Worker's `/read` route for `encoding: "base64"`;
+// the Worker answers `{ content, encoding: "base64" }`. This module is the
+// contract both ends share: the caps, the request/answer shape, the resident's
+// read command. It is bundled into the Workers too, so it stays free of Node
+// imports.
+
+/** The most bytes one `readBytes` hands over. A binary cannot be truncated
+ *  the way text output is, so a larger file is refused by name, never trimmed.
+ *  10 MiB covers a full-page 2× screenshot or a PDF several times over while
+ *  keeping one read well inside a Worker isolate's memory. */
+export const MAX_READ_BYTES = 10 * 1024 * 1024;
+
+/** The base64 length a `MAX_READ_BYTES` file encodes to (four chars per three
+ *  bytes, padded) — the Worker-side output cap for a base64 read. */
+export const MAX_READ_BASE64_CHARS = Math.ceil(MAX_READ_BYTES / 3) * 4;
+
+export type ReadEncoding = "utf8" | "base64";
+
+/** The encoding a `/read` body asks for. Absent is the body every pre-binary
+ *  client sends — a text read, exactly as before; `"base64"` asks for bytes;
+ *  anything else is refused by name rather than silently read as text. */
+export function readEncodingOf(body: Record<string, unknown>): ReadEncoding | { error: string } {
+  if (body.encoding === undefined) return "utf8";
+  if (body.encoding === "base64") return "base64";
+  return { error: `encoding must be "base64" or absent, got ${JSON.stringify(body.encoding)}` };
+}
+
+/** The command a resident runs for a read of an already-confined path: `cat`
+ *  for text; `base64 -w0` for bytes — one unwrapped line, so the Durable
+ *  Object's character cap slices a plain string and nothing else. */
+export function readCommandFor(encoding: ReadEncoding, resolvedPath: string): string {
+  return encoding === "base64" ? `base64 -w0 -- ${resolvedPath}` : `cat -- ${resolvedPath}`;
+}
+
+/** How many bytes a base64 string decodes to, padding discounted. */
+export function base64ByteLength(b64: string): number {
+  const trimmed = b64.replace(/\s+/g, "");
+  if (trimmed.length === 0) return 0;
+  const padding = trimmed.endsWith("==") ? 2 : trimmed.endsWith("=") ? 1 : 0;
+  return Math.floor((trimmed.length * 3) / 4) - padding;
+}
+
+/** A Worker's answer to a base64 read: the bytes, or the named refusal of a
+ *  file over the cap — HTTP 200 either way. The clients classify a non-2xx or
+ *  an in-body `error` as a sick Worker (fail-fast counts it); a large file is
+ *  the model's mistake, not infrastructure, so it travels as a plain field. */
+export type Base64ReadAnswer = { encoding: "base64"; content: string } | { encoding: "base64"; tooLarge: true };
+
+/** One message for a file over the cap, for every implementation. `bytes` is
+ *  the size when the reader could measure it; a resident sees only that its
+ *  capped base64 stream overflowed. */
+export function tooLargeMessage(path: string, bytes?: number): string {
+  const size = bytes === undefined ? "" : ` (${bytes} bytes)`;
+  return `${path}${size} is over the ${MAX_READ_BYTES}-byte cap of a binary read`;
+}

package/dist/cli.js

@@ -1560,6 +1560,12 @@ var init_contract = __esm({
 function machineNeedsRepo(machine) {
   return machine === "repo-cold" || machine === "repo-resident";
 }
+function runawayTurnCap(maxMinutes) {
+  return maxMinutes * RUNAWAY_TURNS_PER_MINUTE;
+}
+function loopBudget(maxMinutes) {
+  return { maxMinutes, maxTurns: runawayTurnCap(maxMinutes) };
+}
 function getAgent(name) {
   const a = AGENTS[name];
   if (!a) {
@@ -1567,7 +1573,7 @@ function getAgent(name) {
   }
   return a;
 }
-var MACHINE_CLASSES, IDENTITIES, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, CONDUCTOR_SYSTEM, AGENTS;
+var MACHINE_CLASSES, IDENTITIES, RUNAWAY_TURNS_PER_MINUTE, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, SHOW_FILES, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, CONDUCTOR_SYSTEM, AGENTS;
 var init_registry = __esm({
   "../../src/agents/registry.ts"() {
     "use strict";
@@ -1575,7 +1581,8 @@ var init_registry = __esm({
     init_contract();
     MACHINE_CLASSES = ["none", "blank", "repo-cold", "repo-resident"];
     IDENTITIES = ["none", "read", "write"];
-    PR_DESCRIPTION_TEMPLATE = `PR description \u2014 submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Content contract per field (each renders as its own section): prose is unwrapped \u2014 no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation \u2014 state exactly what you ran and the real result. Keep each field concise, not padded.
+    RUNAWAY_TURNS_PER_MINUTE = 6;
+    PR_DESCRIPTION_TEMPLATE = `PR description \u2014 submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate \u2014 \`npm run check:pr-title -- "<title>"\` \u2014 and submit only a title it accepts; the same gate refuses the PR in CI. Content contract per field (each renders as its own section): prose is unwrapped \u2014 no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation \u2014 state exactly what you ran and the real result. Keep each field concise, not padded.
 EVERY PR includes one that already exists when you push \u2014 opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW \u2014 carry forward what the existing body says that is still true (a dependency bump's release notes belong in whatWhy), add what you changed, and anchor the Tour at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title**: the PR title \u2014 one line naming the change, specific enough to pick out of a PR list.
 - **TL;DR** (\`tldr\`, rendered first): two sentences for a naive reader with zero context \u2014 what this PR does and why it matters.
@@ -1591,6 +1598,9 @@ EVERY PR includes one that already exists when you push \u2014 opened by a perso
     IMAGE_TOOLCHAIN = `Node 24 with npm and pnpm; python3, make and g++ (native modules build); ffmpeg (frames out of a video \u2014 \`ffmpeg -i in.mp4 -vf fps=1 f_%03d.png\` \u2014 and video out of frames or a recording); and a headless Chromium through Playwright \u2014 \`playwright screenshot <url> out.png\`, \`playwright pdf <url> out.pdf\`, or \`require('playwright')\` for a scripted page and \`recordVideo\``;
     SANDBOX_TOOLCHAIN = `The sandbox image carries ${IMAGE_TOOLCHAIN}; and Docker (the engine starts on the first \`docker\` call).`;
     RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun \u2014 and no Docker.`;
+    SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording \u2014 it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request \u2014 commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too \u2014 unless the request names one destination. Never attach a subset and link the rest.
+Text stays in your message; do not attach what you can say.`;
     CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -1618,6 +1628,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (\u25CB pending items), then update it whenever an item starts (\u2731) or finishes (\u2713). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item \u2713 only after it has actually happened \u2014 never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
@@ -1650,6 +1662,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (\u25CB pending items), then update it whenever an item starts (\u2731) or finishes (\u2713). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item \u2713 only after it has actually happened \u2014 never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -1766,10 +1780,8 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         // and mints no credential of its own.
         machine: "none",
         identity: "none",
-        maxTurns: 8,
-        // a repo read is 2-3 calls (repos → tree → file); an issue action 1-2; still fast
         maxTokens: 16e3,
-        maxMinutes: 5
+        ...loopBudget(5)
       },
       coding: {
         name: "coding",
@@ -1777,10 +1789,8 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         system: CODING_SYSTEM,
         residentSystem: CODING_SYSTEM_RESIDENT,
         toolset: "full",
-        maxTurns: 60,
-        // scoping is capped at ~5 calls by the prompt; this is implementation room
         maxTokens: 64e3,
-        maxMinutes: 45,
+        ...loopBudget(45),
         // Coding steps run long: a single model turn can take 5-6 minutes and
         // installs/tests add more — a 5m cache entry would expire between
         // requests, so the 2× write buys reads for the whole run.
@@ -1800,11 +1810,9 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         machine: "repo-resident",
         identity: "read",
         // a read-scoped token and a read-only worktree: it cannot post or push from inside
-        maxTurns: 30,
-        // backstop only; wall clock is the real budget (12 bound at ~4 min in practice)
         maxTokens: 64e3,
-        maxMinutes: 25,
-        // safety net, not the mechanism — typical reviews land in ~5
+        ...loopBudget(25),
+        // a safety net — typical reviews land in ~5 minutes
         effort: "medium"
         // fast turns; one big-context pass does the deep work
       },
@@ -1838,9 +1846,8 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         machine: "none",
         // web I/O only; no workspace is provisioned
         identity: "none",
-        maxTurns: 12,
         maxTokens: 24e3,
-        maxMinutes: 8,
+        ...loopBudget(8),
         effort: "medium"
       },
       explore: {
@@ -1853,10 +1860,8 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         machine: "repo-cold",
         identity: "read",
         // a read-scoped token: it can clone and read, never push — whatever the caller holds
-        maxTurns: 150,
-        // a backstop for a two-hour loop of batched checks; the wall clock is the budget
         maxTokens: 64e3,
-        maxMinutes: 120,
+        ...loopBudget(120),
         // A detached job polled across calls makes long steps: a 5m cache entry
         // would expire between them, so the 2× write buys reads for the whole run.
         cacheTtl: "1h"
@@ -1871,10 +1876,8 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         // dispatcher, the GitHub reads are REST in the bot process.
         machine: "none",
         identity: "none",
-        maxTurns: 40,
-        // a spawn, then a poll per child every few minutes; the wall clock is the budget
         maxTokens: 32e3,
-        maxMinutes: 120
+        ...loopBudget(120)
         // long enough to outlast a coding child; every child is capped by what remains of it
         // No built-in effort: the deployment decides, as for coding.
       }
@@ -7853,9 +7856,23 @@ var init_host3 = __esm({
   }
 });
 
+// ../../src/execution/binaryRead.ts
+function tooLargeMessage(path, bytes) {
+  const size = bytes === void 0 ? "" : ` (${bytes} bytes)`;
+  return `${path}${size} is over the ${MAX_READ_BYTES}-byte cap of a binary read`;
+}
+var MAX_READ_BYTES, MAX_READ_BASE64_CHARS;
+var init_binaryRead = __esm({
+  "../../src/execution/binaryRead.ts"() {
+    "use strict";
+    MAX_READ_BYTES = 10 * 1024 * 1024;
+    MAX_READ_BASE64_CHARS = Math.ceil(MAX_READ_BYTES / 3) * 4;
+  }
+});
+
 // ../../src/execution/executor.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { closeSync, existsSync as existsSync8, fstatSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname6, resolve as resolve6 } from "node:path";
 function execDeadline(timeoutMs, signal) {
   const deadline = new AbortController();
@@ -7873,6 +7890,15 @@ function truncate(s) {
   return s.length > MAX_OUTPUT ? s.slice(0, MAX_OUTPUT) + `
 ...[truncated ${s.length - MAX_OUTPUT} chars]` : s;
 }
+function decodeBase64Read(answer, at) {
+  if (answer.encoding !== "base64") {
+    throw new Error(
+      `${at.where}: the Worker answered a text read to a request for bytes \u2014 it predates binary reads; redeploy it`
+    );
+  }
+  if (answer.tooLarge === true) throw new Error(tooLargeMessage(at.path));
+  return new Uint8Array(Buffer.from(typeof answer.content === "string" ? answer.content : "", "base64"));
+}
 async function runLocalCommand(command2, cwd) {
   const r = await runBash(command2, cwd);
   const output = [r.stdout, r.stderr].filter(Boolean).join("\n--- stderr ---\n");
@@ -7906,6 +7932,7 @@ var init_executor = __esm({
   "../../src/execution/executor.ts"() {
     "use strict";
     init_bashTimeout();
+    init_binaryRead();
     init_clock();
     init_bashTimeout();
     ExecInfraError = class extends Error {
@@ -7925,6 +7952,8 @@ var init_executor = __esm({
     ExecHealthTracker = class {
       constructor(inner) {
         this.inner = inner;
+        const innerReadBytes = inner.readBytes?.bind(inner);
+        if (innerReadBytes) this.readBytes = (path, opts) => this.track(() => innerReadBytes(path, opts));
       }
       inner;
       consecutiveInfraFailures = 0;
@@ -7932,6 +7961,9 @@ var init_executor = __esm({
        *  evidence the runner's abort diagnosis quotes instead of guessing a cause.
        *  Cleared by a successful op along with the count. */
       lastInfraError;
+      /** Present exactly when the inner executor reads bytes — a decorator that
+       *  always offered it would promise what the transport cannot do. */
+      readBytes;
       async track(op) {
         try {
           const out = await op();
@@ -7986,6 +8018,18 @@ ${parts}`);
       async readFile(path) {
         return truncate(readFileSync9(this.confine(path), "utf8"));
       }
+      /** The size is checked on the open handle and the bytes read from the same
+       *  handle, so a file that grows between the two calls cannot slip past the cap. */
+      async readBytes(path) {
+        const fd = openSync(this.confine(path), "r");
+        try {
+          const size = fstatSync(fd).size;
+          if (size > MAX_READ_BYTES) throw new Error(tooLargeMessage(path, size));
+          return new Uint8Array(readFileSync9(fd));
+        } finally {
+          closeSync(fd);
+        }
+      }
       async writeFile(path, content) {
         const abs = this.confine(path);
         mkdirSync5(dirname6(abs), { recursive: true });
@@ -8480,6 +8524,13 @@ ${parts}`);
         const r = await this.call("/read", { path }, void 0, void 0, opts?.span);
         return truncate(String(r.content ?? ""));
       }
+      /** The same `/read` route asked for `encoding: "base64"` (src/execution/binaryRead.ts);
+       *  the Worker refuses an over-cap file by name, and one that predates
+       *  binary reads answers text, which `decodeBase64Read` names instead of decoding. */
+      async readBytes(path, opts) {
+        const r = await this.call("/read", { path, encoding: "base64" }, void 0, void 0, opts?.span);
+        return decodeBase64Read(r, { where: "sandbox worker /read", path });
+      }
       async writeFile(path, content, opts) {
         await this.call("/write", { path, content }, void 0, void 0, opts?.span);
         return `Wrote ${path}`;
@@ -9049,6 +9100,26 @@ ${parts}`);
         }
         return truncate(String(data.content ?? ""));
       }
+      /** The same `/read` route asked for `encoding: "base64"` (src/execution/binaryRead.ts),
+       *  with the same re-attach on an evicted worktree; a missing file is the
+       *  route's 404 as for `readFile`, an over-cap file and a Worker that predates
+       *  binary reads are `decodeBase64Read`'s plain errors. */
+      async readBytes(path, opts) {
+        const { status: status3, data } = await this.opWithReattach(
+          "/read",
+          { path, encoding: "base64" },
+          void 0,
+          void 0,
+          opts?.span
+        );
+        if (status3 !== 200) {
+          throw classifyError(new ExecInfraError(`resident /read: ${String(data.error ?? `HTTP ${status3}`)}`), {
+            kind: "http",
+            code: String(status3)
+          });
+        }
+        return decodeBase64Read(data, { where: "resident /read", path });
+      }
       async writeFile(path, content, opts) {
         const { status: status3, data } = await this.opWithReattach("/write", { path, content }, void 0, void 0, opts?.span);
         if (status3 !== 200) {
@@ -14526,7 +14597,7 @@ ${evidence}`);
     case "wrap_up":
       return `Runs keep reaching the wrap-up warning (${p.runIds.length} runs; ${formatDuration(p.durationMs, "report")} spent winding down). Either the affected agent's \`maxMinutes\` (\`src/agents/registry.ts\`) is too tight for this shape of work, or the prompt should push batching (fewer, larger tool calls) \u2014 the evidence rows say which agent and how close to the deadline each run got.`;
     case "budget_hit":
-      return p.signature === "turns" ? `Runs exhaust the TURN budget. Raise \`maxTurns\` for the affected agent (\`src/agents/registry.ts\`) or have its prompt batch tool calls (several commands per \`bash\` call) so the same work takes fewer turns.` : `Runs exhaust the TIME budget and are cut off mid-work. Raise \`maxMinutes\` for the affected agent (\`src/agents/registry.ts\`), or split the task shape that triggers it \u2014 a run that is forced to write up findings is a run whose work was wasted.`;
+      return p.signature === "turns" ? `Runs outpace the runaway guard: the turn cap is \`RUNAWAY_TURNS_PER_MINUTE\` (${RUNAWAY_TURNS_PER_MINUTE} turns a minute) over the affected agent's wall clock, a pace a working run does not sustain \u2014 so a run that reaches it is looping, not working. Read the evidence rows for a retry loop (the same call re-issued turn after turn) and fix its cause where the agent reads before acting (the target repo's AGENTS.md, the resident command table), or have the prompt batch tool calls (several commands per \`bash\` call). The cap is derived from \`maxMinutes\` (\`src/agents/registry.ts\`), not a knob to turn.` : `Runs exhaust the TIME budget and are cut off mid-work. Raise \`maxMinutes\` for the affected agent (\`src/agents/registry.ts\`), or split the task shape that triggers it \u2014 a run that is forced to write up findings is a run whose work was wasted.`;
     case "infra_failure":
       if (p.signature === "sandbox_dead") {
         return `The sandbox died mid-run in ${p.runIds.length} runs. Check container sizing first (the \`deploy/cloudflare-*/wrangler.template.jsonc\` comments: the 1 GiB \`basic\` tier died running vitest; thread sandboxes are \`standard-4\` \u2014 4 vCPU / 12 GiB / 20 GB, the platform's largest \u2014 and residents a custom type of the same size), then the memory footprint of the failing command, then the sandbox/resident Worker logs (\`deploy/bin/cf-logs\`) around the affected runs.`;
@@ -14559,6 +14630,7 @@ var init_frictionProposals = __esm({
   "../../src/core/frictionProposals.ts"() {
     "use strict";
     init_runFriction();
+    init_registry();
     init_formatDuration();
     DEFAULT_MIN_RUNS = 2;
     MAX_EXAMPLES = 5;
@@ -23794,12 +23866,16 @@ var init_tracingExecutor = __esm({
         if (innerRelease) this.release = (mode) => this.timed("exec.release", (s) => innerRelease(mode, { span: s }));
         const innerMoveTo = inner.moveTo?.bind(inner);
         if (innerMoveTo) this.moveTo = (sha) => this.timed("exec.move_to", (s) => innerMoveTo(sha, { span: s }));
+        const innerReadBytes = inner.readBytes?.bind(inner);
+        if (innerReadBytes)
+          this.readBytes = (path) => this.timed("exec.read_bytes", (s) => innerReadBytes(path, { span: s }));
       }
       inner;
       span;
       backend;
       release;
       moveTo;
+      readBytes;
       /** Each op under its own `exec.*` span, handed to the inner executor as
        *  `opts.span` so its HTTP calls become `http.client` children (item 21). */
       timed(name, fn, extra = {}) {
@@ -24799,6 +24875,60 @@ ${skill.body}${footer}`;
   }
 });
 
+// ../../src/tools/attach.ts
+function fileNameOf2(path) {
+  const segments2 = path.split("/").filter(Boolean);
+  return segments2[segments2.length - 1] ?? path;
+}
+var attachFileTool;
+var init_attach = __esm({
+  "../../src/tools/attach.ts"() {
+    "use strict";
+    init_binaryRead();
+    attachFileTool = {
+      name: "attach_file",
+      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only, up to ${MAX_READ_BYTES} bytes.`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Relative path of the file in the workspace" },
+          comment: {
+            type: "string",
+            description: "One line posted with the file saying what it shows (default: the file name)"
+          }
+        },
+        required: ["path"]
+      },
+      async run(input, ctx) {
+        const path = String(input.path ?? "").trim();
+        if (!path) return "error: path is required";
+        const name = fileNameOf2(path);
+        const lead = typeof input.comment === "string" && input.comment.trim() ? input.comment.trim() : name;
+        if (!ctx.attach) {
+          return "attach_file is not available here: this conversation's channel takes no file uploads \u2014 link to the file instead";
+        }
+        const readBytes = ctx.executor.readBytes?.bind(ctx.executor);
+        if (!readBytes) {
+          return "attach_file is not available here: this workspace cannot hand files over \u2014 link to the file instead";
+        }
+        let bytes;
+        try {
+          bytes = await readBytes(path);
+        } catch (err2) {
+          return `error: could not read ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+        }
+        if (bytes.byteLength === 0) return `error: ${path} is empty \u2014 nothing to attach`;
+        try {
+          await ctx.attach({ name, bytes, lead });
+        } catch (err2) {
+          return `error: the channel refused the upload of ${name}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+        }
+        return `attached ${name} (${bytes.byteLength} bytes) to the conversation`;
+      }
+    };
+  }
+});
+
 // ../../src/core/dispatch/awaitChildren.ts
 function decideWait(inputs) {
   const { children, now, budgetEndsAt, timeoutAt, stop, followUpPending } = inputs;
@@ -24907,6 +25037,7 @@ function watchedChild(io, on) {
     }
   };
   if (io.attach) watched2.attach = (file) => io.attach(file);
+  if (io.attachFile) watched2.attachFile = (file) => io.attachFile(file);
   if (io.runFinished) watched2.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) watched2.openThread = (lead) => io.openThread(lead);
   return watched2;
@@ -25436,6 +25567,7 @@ var init_workspace = __esm({
     init_web();
     init_github();
     init_skills();
+    init_attach();
     init_runs2();
     bashTool = {
       name: "bash",
@@ -25804,6 +25936,7 @@ ${raw.trim()}`;
         bashTool,
         readFileTool,
         writeFileTool,
+        attachFileTool,
         updateStatusTool,
         submitPrDescriptionTool,
         submitHandoffTool,
@@ -26248,21 +26381,33 @@ async function runLoop(opts, now, note, emit, agentSpan) {
     return await finishSandboxDead(complete2, opts, messages, system, diagnosis);
   }
   const wasTimeout = now() >= deadline;
+  const elapsedMs = opts.agent.maxMinutes * 6e4 - (deadline - now());
+  const pace = `${turn} model turn${turn === 1 ? "" : "s"} in ${elapsedMinutes(elapsedMs)}`;
   note(
     wasTimeout ? "time_budget_exhausted" : "turn_budget_exhausted",
-    `${wasTimeout ? "time" : "turn"} budget exhausted \u2014 writing up findings so far`
+    wasTimeout ? "time budget exhausted \u2014 writing up findings so far" : `turn guard fired: ${pace}, a pace that looks like a loop \u2014 writing up findings so far`
   );
+  const writeUp = "Write your final answer now from what you have learned so far: report your findings/results to date, then state plainly which parts of the task you did not get to and what a follow-up (in this thread, to reuse this workspace) should focus on.";
   const text = await runFinale(
     complete2,
     opts,
     messages,
     system,
-    "You have reached the turn budget and can make no more tool calls. Write your final answer now from what you have learned so far: report your findings/results to date, then state plainly which parts of the task you did not get to and what a follow-up (in this thread, to reuse this workspace) should focus on."
+    wasTimeout ? `You have reached the time budget and can make no more tool calls. ${writeUp}` : `You have hit the run's turn guard \u2014 ${pace}, a pace that looks like a loop \u2014 and can make no more tool calls. ${writeUp}`
   );
-  const budgetLabel = wasTimeout ? `${opts.agent.maxMinutes}-minute` : `${opts.agent.maxTurns}-turn`;
-  return text ? `\u26A0\uFE0F _Hit the ${budgetLabel} budget before finishing \u2014 findings so far:_
+  if (wasTimeout) {
+    return text ? `\u26A0\uFE0F _Hit the ${opts.agent.maxMinutes}-minute budget before finishing \u2014 findings so far:_
+
+${text}` : `Stopped at the ${opts.agent.maxMinutes}-minute budget without finishing. Partial work may exist in the workspace \u2014 narrow the task and try again.`;
+  }
+  return text ? `\u26A0\uFE0F _Stopped after ${pace} \u2014 that pace looks like a loop; findings so far:_
 
-${text}` : `Stopped at the ${budgetLabel} budget without finishing. Partial work may exist in the workspace \u2014 narrow the task and try again.`;
+${text}` : `Stopped after ${pace} \u2014 that pace looks like a loop \u2014 without finishing. Partial work may exist in the workspace \u2014 look for a retry loop in the run's events before trying again.`;
+}
+function elapsedMinutes(ms) {
+  const minutes = Math.round(ms / 6e4);
+  if (minutes < 1) return "under a minute";
+  return `${minutes} minute${minutes === 1 ? "" : "s"}`;
 }
 async function runFinale(complete2, opts, messages, system, instruction) {
   messages.push({ role: "user", content: [{ type: "text", text: instruction }] });
@@ -28884,9 +29029,11 @@ async function runLoop2(deps, ctx) {
   let runFailed = false;
   let runDiagnosis;
   const releaseWorkspace = (span) => round2.release({ hardStopped: run2.control.requested === "hard", ...span ? { span } : {} });
+  const attachFile = io.attachFile?.bind(io);
   const toolContext = {
     executor,
     reportProgress,
+    ...attachFile ? { attach: attachFile } : {},
     web: webCapability(),
     skills: deps.skills,
     github: githubCapabilityFor(deps, msg.userId),
@@ -33607,6 +33754,20 @@ var init_slack = __esm({
 ${file.text}`));
         }
       }
+      /** A run's binary artifact in the thread — a screenshot renders inline, a
+       *  PDF as a preview — through the same `files.uploadV2` with the bytes as
+       *  the file. No fallback: a text reply cannot carry bytes, so a failed upload
+       *  propagates for the caller to report. */
+      async attachFile(file) {
+        await this.client.files.uploadV2({
+          channel_id: this.ev.channel,
+          thread_ts: this.ev.threadTs,
+          filename: file.name,
+          title: file.name,
+          file: Buffer.from(file.bytes),
+          initial_comment: mdToMrkdwn(file.lead)
+        });
+      }
       async post(mrkdwn) {
         for (const chunk of chunkText(mrkdwn, SLACK_MSG_LIMIT)) {
           await this.client.chat.postMessage({
@@ -37004,7 +37165,7 @@ async function handleAdmitted(door, req, deps) {
     grant2.publish({
       type: "run_note",
       kind: "turn_budget_exhausted",
-      summary: `model proxy refused a call past the ${turn.maxTurns}-turn budget (${used})`,
+      summary: `model proxy refused a call past the run's ${turn.maxTurns}-turn guard (${used})`,
       at: deps.clock()
     });
     log(`[model-proxy] 403 turn_budget_exhausted run=${grant2.runId} turns=${turn.turns}/${turn.maxTurns}`);
@@ -37012,7 +37173,7 @@ async function handleAdmitted(door, req, deps) {
       shape,
       403,
       "turn_budget_exhausted",
-      `the run's ${turn.maxTurns}-turn budget is spent (${used})`
+      `the run is past its ${turn.maxTurns}-turn guard (${used})`
     );
   }
   const payload = JSON.stringify(pinRequest(shape, body, grant2));
@@ -37658,6 +37819,7 @@ function watched(io, on) {
     }
   };
   if (io.attach) out.attach = (file) => io.attach(file);
+  if (io.attachFile) out.attachFile = (file) => io.attachFile(file);
   if (io.runFinished) out.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) out.openThread = (lead) => io.openThread(lead);
   return out;
@@ -39374,8 +39536,9 @@ init_source();
 init_invokedAsScript();
 init_secrets2();
 import { Console } from "node:console";
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync14, mkdtempSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename as basename3, join as join15 } from "node:path";
 var CONFIG_PATH3 = process.env.SWITCHBOARD_CONFIG ?? installationPath(OPERATOR_ROOT, "config/config.yaml");
 var DATA_DIR2 = installationPath(OPERATOR_ROOT, "data");
 var CLI_CALLER = { kind: "cli", id: CLI_ACTOR.id, actor: CLI_ACTOR };
@@ -39527,14 +39690,16 @@ ${cliCatalogue(commands)}`, stderr: "" };
   }
 }
 var ConsoleIO = class _ConsoleIO {
-  constructor(out = process.stdout, threadKey = "cli", prefix = "") {
+  constructor(out = process.stdout, threadKey = "cli", prefix = "", attachments = {}) {
     this.out = out;
     this.threadKey = threadKey;
     this.prefix = prefix;
+    this.attachments = attachments;
   }
   out;
   threadKey;
   prefix;
+  attachments;
   /** The receipt of the run this request started, once it finished — undefined
    *  before that, and forever when no run was started (a config reply such as
    *  `help`, a refusal before a run existed). */
@@ -39544,6 +39709,15 @@ var ConsoleIO = class _ConsoleIO {
   async reply(text) {
     this.out.write("\n" + this.prefix + text + "\n");
   }
+  /** The harness's file upload: the bytes written under the attachments dir,
+   *  the lead printed like a reply with the path a person can open. */
+  async attachFile(file) {
+    this.attachments.dir ??= mkdtempSync(join15(tmpdir(), "switchboard-attachments-"));
+    const path = join15(this.attachments.dir, basename3(file.name));
+    writeFileSync9(path, file.bytes);
+    await this.reply(`${file.lead}
+\u{1F4CE} ${file.name} (${file.bytes.byteLength} bytes) \u2192 ${path}`);
+  }
   runFinished(receipt) {
     this.finished = receipt;
   }
@@ -39566,7 +39740,10 @@ var ConsoleIO = class _ConsoleIO {
     const n2 = ++this.children;
     await this.reply(lead);
     const threadKey = `${this.threadKey}/child-${n2}`;
-    return { thread: { threadKey }, io: new _ConsoleIO(this.out, threadKey, `${this.prefix}[child-${n2}] `) };
+    return {
+      thread: { threadKey },
+      io: new _ConsoleIO(this.out, threadKey, `${this.prefix}[child-${n2}] `, this.attachments)
+    };
   }
 };
 function askExitCode(finished) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.208.0",
+  "version": "1.210.0",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",