@coreplane/switchboard 1.209.0 → 1.210.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -95,6 +95,15 @@ import {
   type ThreadDepsMechanism,
 } from "../../src/execution/residentDepCache.js";
 import { parseWorktreeCleanliness, worktreeCleanlinessScript } from "../../src/execution/residentCleanliness.js";
+import {
+  base64ByteLength,
+  MAX_READ_BASE64_CHARS,
+  MAX_READ_BYTES,
+  readCommandFor,
+  readEncodingOf,
+  type Base64ReadAnswer,
+  type ReadEncoding,
+} from "../../src/execution/binaryRead.js";
 import {
   capBytesFor,
   capWrappedCommand,
@@ -5170,36 +5179,53 @@ export class ResidentDO extends Sandbox<Env> {
   }
 
   /** POST /read: cat the file AS THE THREAD USER — the OS layer (not just
-   *  the prefix check) is what confines a symlink pointing outside. */
-  async readThreadFile(threadKey: string, path: string): Promise<{ content: string; truncated: boolean } | ThreadErr> {
-    return this.withThreadBusy(threadKey, () => this.readThreadFileImpl(threadKey, path));
+   *  the prefix check) is what confines a symlink pointing outside. A
+   *  `base64` read (src/execution/binaryRead.ts) runs `base64 -w0` instead,
+   *  under the binary cap; an overflow is the named refusal, never a slice
+   *  of the encoding. */
+  async readThreadFile(
+    threadKey: string,
+    path: string,
+    encoding: ReadEncoding = "utf8",
+  ): Promise<{ content: string; truncated: boolean } | Base64ReadAnswer | ThreadErr> {
+    return this.withThreadBusy(threadKey, () => this.readThreadFileImpl(threadKey, path, encoding));
   }
 
   private async readThreadFileImpl(
     threadKey: string,
     path: string,
-  ): Promise<{ content: string; truncated: boolean } | ThreadErr> {
+    encoding: ReadEncoding,
+  ): Promise<{ content: string; truncated: boolean } | Base64ReadAnswer | ThreadErr> {
     const pre = await this.threadPreflight(threadKey);
     if ("error" in pre) return pre;
     const resolved = confineThreadPath(pre.binding.worktreePath, path);
     if (!resolved)
       return { error: `path-escape: ${JSON.stringify(path)} does not stay inside the thread worktree`, status: 400 };
+    const cap = encoding === "base64" ? MAX_READ_BASE64_CHARS : READ_CONTENT_CAP;
     let r: Awaited<ReturnType<ResidentDO["threadRun"]>>;
     try {
       r = await this.threadRun(
         pre.binding.user,
         pre.binding.worktreePath,
-        `cat -- ${resolved}`,
+        readCommandFor(encoding, resolved),
         DEFAULT_EXEC_TIMEOUT_MS,
-        capBytesFor(READ_CONTENT_CAP),
+        capBytesFor(cap),
       );
     } catch (err) {
       if (err instanceof RuntimeReplacedError) return runtimeReplacedErr(err);
       throw err;
     }
     if (r.exitCode !== 0 || r.timedOut) return { error: `read-failed: ${describeStepFailure(r)}`, status: 404 };
-    const truncated = r.stdout.length > READ_CONTENT_CAP;
-    return { content: truncated ? r.stdout.slice(0, READ_CONTENT_CAP) : r.stdout, truncated };
+    const truncated = r.stdout.length > cap;
+    if (encoding === "base64") {
+      // Padding hides up to two bytes inside the cap's char count, so the
+      // decoded size is checked too — the cap is bytes, not characters.
+      const content = r.stdout.trimEnd();
+      return truncated || base64ByteLength(content) > MAX_READ_BYTES
+        ? { encoding, tooLarge: true }
+        : { encoding, content };
+    }
+    return { content: truncated ? r.stdout.slice(0, cap) : r.stdout, truncated };
   }
 
   /** POST /write: content travels via the SDK file API into the thread's
@@ -7186,7 +7212,9 @@ async function handleRead(env: Env, body: Record<string, unknown>): Promise<Resp
   if (ctx instanceof Response) return ctx;
   if (typeof body.path !== "string")
     return json({ error: "path must be a string relative to the thread worktree" }, 400);
-  const result = await ctx.stub.readThreadFile(ctx.threadKey, body.path);
+  const encoding = readEncodingOf(body);
+  if (typeof encoding !== "string") return json({ error: encoding.error }, 400);
+  const result = await ctx.stub.readThreadFile(ctx.threadKey, body.path, encoding);
   if ("error" in result) return threadErrResponse(result);
   return json(result);
 }

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -18,6 +18,12 @@
 // first deploy; the SDK is young and its surface may shift.
 import { getSandbox, Sandbox, type ExecOptions, type ExecResult } from "@cloudflare/sandbox";
 import { BASH_TIMEOUT_MAX_MS, clampBashTimeout } from "../../src/execution/bashTimeout.js";
+import {
+  base64ByteLength,
+  MAX_READ_BYTES,
+  readEncodingOf,
+  type Base64ReadAnswer,
+} from "../../src/execution/binaryRead.js";
 import {
   EXEC_KEEPALIVE_INTERVAL_MS,
   SANDBOX_SLEEP_AFTER,
@@ -265,7 +271,22 @@ export default {
           );
         }
         case "/read": {
-          const file = await withSessionRecovery(sandbox, () => sandbox.readFile(abs(String(body.path ?? ""))));
+          // `encoding: "base64"` is a binary read (src/execution/binaryRead.ts):
+          // the SDK encodes the bytes, and a file over the cap is refused by
+          // name inside a 200 — the client counts a non-2xx as a sick Worker.
+          const encoding = readEncodingOf(body);
+          if (typeof encoding !== "string") return json({ error: encoding.error }, 400);
+          const path = abs(String(body.path ?? ""));
+          if (encoding === "base64") {
+            const file = await withSessionRecovery(sandbox, () => sandbox.readFile(path, { encoding: "base64" }));
+            const content = typeof file === "string" ? file : (file?.content ?? "");
+            const answer: Base64ReadAnswer =
+              base64ByteLength(content) > MAX_READ_BYTES
+                ? { encoding: "base64", tooLarge: true }
+                : { encoding: "base64", content };
+            return json(answer);
+          }
+          const file = await withSessionRecovery(sandbox, () => sandbox.readFile(path));
           return json({ content: typeof file === "string" ? file : (file?.content ?? "") });
         }
         case "/write": {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.209.0",
+  "version": "1.210.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.209.0",
+      "version": "1.210.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -18999,7 +18999,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.209.0",
+      "version": "1.210.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.209.0",
+  "version": "1.210.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.209.0",
-  "commit": "921bd6b7bd8c7cd979c68435a47bc7ad169a3893",
-  "builtAt": "2026-09-14T05:12:19.226Z"
+  "version": "1.210.0",
+  "commit": "1c1f94ae5c58bff0f3734e2b522b2ab440baa89d",
+  "builtAt": "2026-09-14T05:52:14.303Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -170,6 +170,13 @@ const IMAGE_TOOLCHAIN = `Node 24 with npm and pnpm; python3, make and g++ (nativ
 const SANDBOX_TOOLCHAIN = `The sandbox image carries ${IMAGE_TOOLCHAIN}; and Docker (the engine starts on the first \`docker\` call).`;
 const RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun — and no Docker.`;
 
+// Both coding prompts carry this verbatim (docs/reference/specs/agent-coding.md
+// item 10): the one way a run's screenshot reaches the person. Said once so
+// the sandbox and resident variants cannot drift on it.
+const SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording — it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too — unless the request names one destination. Never attach a subset and link the rest.
+Text stays in your message; do not attach what you can say.`;
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -197,6 +204,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
@@ -235,6 +244,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.

package/dist/assets/src/execution/binaryRead.ts

@@ -0,0 +1,58 @@
+// A binary read on the Executor seam (docs/reference/specs/execution.md item 19):
+// the whole file as bytes, for a tool that hands a workspace artifact — a
+// screenshot, a PDF — to somewhere that needs the bytes, not a text view. Both
+// remote executors ask their Worker's `/read` route for `encoding: "base64"`;
+// the Worker answers `{ content, encoding: "base64" }`. This module is the
+// contract both ends share: the caps, the request/answer shape, the resident's
+// read command. It is bundled into the Workers too, so it stays free of Node
+// imports.
+
+/** The most bytes one `readBytes` hands over. A binary cannot be truncated
+ *  the way text output is, so a larger file is refused by name, never trimmed.
+ *  10 MiB covers a full-page 2× screenshot or a PDF several times over while
+ *  keeping one read well inside a Worker isolate's memory. */
+export const MAX_READ_BYTES = 10 * 1024 * 1024;
+
+/** The base64 length a `MAX_READ_BYTES` file encodes to (four chars per three
+ *  bytes, padded) — the Worker-side output cap for a base64 read. */
+export const MAX_READ_BASE64_CHARS = Math.ceil(MAX_READ_BYTES / 3) * 4;
+
+export type ReadEncoding = "utf8" | "base64";
+
+/** The encoding a `/read` body asks for. Absent is the body every pre-binary
+ *  client sends — a text read, exactly as before; `"base64"` asks for bytes;
+ *  anything else is refused by name rather than silently read as text. */
+export function readEncodingOf(body: Record<string, unknown>): ReadEncoding | { error: string } {
+  if (body.encoding === undefined) return "utf8";
+  if (body.encoding === "base64") return "base64";
+  return { error: `encoding must be "base64" or absent, got ${JSON.stringify(body.encoding)}` };
+}
+
+/** The command a resident runs for a read of an already-confined path: `cat`
+ *  for text; `base64 -w0` for bytes — one unwrapped line, so the Durable
+ *  Object's character cap slices a plain string and nothing else. */
+export function readCommandFor(encoding: ReadEncoding, resolvedPath: string): string {
+  return encoding === "base64" ? `base64 -w0 -- ${resolvedPath}` : `cat -- ${resolvedPath}`;
+}
+
+/** How many bytes a base64 string decodes to, padding discounted. */
+export function base64ByteLength(b64: string): number {
+  const trimmed = b64.replace(/\s+/g, "");
+  if (trimmed.length === 0) return 0;
+  const padding = trimmed.endsWith("==") ? 2 : trimmed.endsWith("=") ? 1 : 0;
+  return Math.floor((trimmed.length * 3) / 4) - padding;
+}
+
+/** A Worker's answer to a base64 read: the bytes, or the named refusal of a
+ *  file over the cap — HTTP 200 either way. The clients classify a non-2xx or
+ *  an in-body `error` as a sick Worker (fail-fast counts it); a large file is
+ *  the model's mistake, not infrastructure, so it travels as a plain field. */
+export type Base64ReadAnswer = { encoding: "base64"; content: string } | { encoding: "base64"; tooLarge: true };
+
+/** One message for a file over the cap, for every implementation. `bytes` is
+ *  the size when the reader could measure it; a resident sees only that its
+ *  capped base64 stream overflowed. */
+export function tooLargeMessage(path: string, bytes?: number): string {
+  const size = bytes === undefined ? "" : ` (${bytes} bytes)`;
+  return `${path}${size} is over the ${MAX_READ_BYTES}-byte cap of a binary read`;
+}

package/dist/cli.js

@@ -1573,7 +1573,7 @@ function getAgent(name) {
   }
   return a;
 }
-var MACHINE_CLASSES, IDENTITIES, RUNAWAY_TURNS_PER_MINUTE, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, CONDUCTOR_SYSTEM, AGENTS;
+var MACHINE_CLASSES, IDENTITIES, RUNAWAY_TURNS_PER_MINUTE, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, SHOW_FILES, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, CONDUCTOR_SYSTEM, AGENTS;
 var init_registry = __esm({
   "../../src/agents/registry.ts"() {
     "use strict";
@@ -1598,6 +1598,9 @@ EVERY PR includes one that already exists when you push \u2014 opened by a perso
     IMAGE_TOOLCHAIN = `Node 24 with npm and pnpm; python3, make and g++ (native modules build); ffmpeg (frames out of a video \u2014 \`ffmpeg -i in.mp4 -vf fps=1 f_%03d.png\` \u2014 and video out of frames or a recording); and a headless Chromium through Playwright \u2014 \`playwright screenshot <url> out.png\`, \`playwright pdf <url> out.pdf\`, or \`require('playwright')\` for a scripted page and \`recordVideo\``;
     SANDBOX_TOOLCHAIN = `The sandbox image carries ${IMAGE_TOOLCHAIN}; and Docker (the engine starts on the first \`docker\` call).`;
     RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun \u2014 and no Docker.`;
+    SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording \u2014 it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request \u2014 commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too \u2014 unless the request names one destination. Never attach a subset and link the rest.
+Text stays in your message; do not attach what you can say.`;
     CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -1625,6 +1628,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (\u25CB pending items), then update it whenever an item starts (\u2731) or finishes (\u2713). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item \u2713 only after it has actually happened \u2014 never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
@@ -1657,6 +1662,8 @@ ${UNIT_HANDOFF}
 
 ${PR_DESCRIPTION_TEMPLATE}
 
+${SHOW_FILES}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (\u25CB pending items), then update it whenever an item starts (\u2731) or finishes (\u2713). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item \u2713 only after it has actually happened \u2014 never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -7849,9 +7856,23 @@ var init_host3 = __esm({
   }
 });
 
+// ../../src/execution/binaryRead.ts
+function tooLargeMessage(path, bytes) {
+  const size = bytes === void 0 ? "" : ` (${bytes} bytes)`;
+  return `${path}${size} is over the ${MAX_READ_BYTES}-byte cap of a binary read`;
+}
+var MAX_READ_BYTES, MAX_READ_BASE64_CHARS;
+var init_binaryRead = __esm({
+  "../../src/execution/binaryRead.ts"() {
+    "use strict";
+    MAX_READ_BYTES = 10 * 1024 * 1024;
+    MAX_READ_BASE64_CHARS = Math.ceil(MAX_READ_BYTES / 3) * 4;
+  }
+});
+
 // ../../src/execution/executor.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { closeSync, existsSync as existsSync8, fstatSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname6, resolve as resolve6 } from "node:path";
 function execDeadline(timeoutMs, signal) {
   const deadline = new AbortController();
@@ -7869,6 +7890,15 @@ function truncate(s) {
   return s.length > MAX_OUTPUT ? s.slice(0, MAX_OUTPUT) + `
 ...[truncated ${s.length - MAX_OUTPUT} chars]` : s;
 }
+function decodeBase64Read(answer, at) {
+  if (answer.encoding !== "base64") {
+    throw new Error(
+      `${at.where}: the Worker answered a text read to a request for bytes \u2014 it predates binary reads; redeploy it`
+    );
+  }
+  if (answer.tooLarge === true) throw new Error(tooLargeMessage(at.path));
+  return new Uint8Array(Buffer.from(typeof answer.content === "string" ? answer.content : "", "base64"));
+}
 async function runLocalCommand(command2, cwd) {
   const r = await runBash(command2, cwd);
   const output = [r.stdout, r.stderr].filter(Boolean).join("\n--- stderr ---\n");
@@ -7902,6 +7932,7 @@ var init_executor = __esm({
   "../../src/execution/executor.ts"() {
     "use strict";
     init_bashTimeout();
+    init_binaryRead();
     init_clock();
     init_bashTimeout();
     ExecInfraError = class extends Error {
@@ -7921,6 +7952,8 @@ var init_executor = __esm({
     ExecHealthTracker = class {
       constructor(inner) {
         this.inner = inner;
+        const innerReadBytes = inner.readBytes?.bind(inner);
+        if (innerReadBytes) this.readBytes = (path, opts) => this.track(() => innerReadBytes(path, opts));
       }
       inner;
       consecutiveInfraFailures = 0;
@@ -7928,6 +7961,9 @@ var init_executor = __esm({
        *  evidence the runner's abort diagnosis quotes instead of guessing a cause.
        *  Cleared by a successful op along with the count. */
       lastInfraError;
+      /** Present exactly when the inner executor reads bytes — a decorator that
+       *  always offered it would promise what the transport cannot do. */
+      readBytes;
       async track(op) {
         try {
           const out = await op();
@@ -7982,6 +8018,18 @@ ${parts}`);
       async readFile(path) {
         return truncate(readFileSync9(this.confine(path), "utf8"));
       }
+      /** The size is checked on the open handle and the bytes read from the same
+       *  handle, so a file that grows between the two calls cannot slip past the cap. */
+      async readBytes(path) {
+        const fd = openSync(this.confine(path), "r");
+        try {
+          const size = fstatSync(fd).size;
+          if (size > MAX_READ_BYTES) throw new Error(tooLargeMessage(path, size));
+          return new Uint8Array(readFileSync9(fd));
+        } finally {
+          closeSync(fd);
+        }
+      }
       async writeFile(path, content) {
         const abs = this.confine(path);
         mkdirSync5(dirname6(abs), { recursive: true });
@@ -8476,6 +8524,13 @@ ${parts}`);
         const r = await this.call("/read", { path }, void 0, void 0, opts?.span);
         return truncate(String(r.content ?? ""));
       }
+      /** The same `/read` route asked for `encoding: "base64"` (src/execution/binaryRead.ts);
+       *  the Worker refuses an over-cap file by name, and one that predates
+       *  binary reads answers text, which `decodeBase64Read` names instead of decoding. */
+      async readBytes(path, opts) {
+        const r = await this.call("/read", { path, encoding: "base64" }, void 0, void 0, opts?.span);
+        return decodeBase64Read(r, { where: "sandbox worker /read", path });
+      }
       async writeFile(path, content, opts) {
         await this.call("/write", { path, content }, void 0, void 0, opts?.span);
         return `Wrote ${path}`;
@@ -9045,6 +9100,26 @@ ${parts}`);
         }
         return truncate(String(data.content ?? ""));
       }
+      /** The same `/read` route asked for `encoding: "base64"` (src/execution/binaryRead.ts),
+       *  with the same re-attach on an evicted worktree; a missing file is the
+       *  route's 404 as for `readFile`, an over-cap file and a Worker that predates
+       *  binary reads are `decodeBase64Read`'s plain errors. */
+      async readBytes(path, opts) {
+        const { status: status3, data } = await this.opWithReattach(
+          "/read",
+          { path, encoding: "base64" },
+          void 0,
+          void 0,
+          opts?.span
+        );
+        if (status3 !== 200) {
+          throw classifyError(new ExecInfraError(`resident /read: ${String(data.error ?? `HTTP ${status3}`)}`), {
+            kind: "http",
+            code: String(status3)
+          });
+        }
+        return decodeBase64Read(data, { where: "resident /read", path });
+      }
       async writeFile(path, content, opts) {
         const { status: status3, data } = await this.opWithReattach("/write", { path, content }, void 0, void 0, opts?.span);
         if (status3 !== 200) {
@@ -23791,12 +23866,16 @@ var init_tracingExecutor = __esm({
         if (innerRelease) this.release = (mode) => this.timed("exec.release", (s) => innerRelease(mode, { span: s }));
         const innerMoveTo = inner.moveTo?.bind(inner);
         if (innerMoveTo) this.moveTo = (sha) => this.timed("exec.move_to", (s) => innerMoveTo(sha, { span: s }));
+        const innerReadBytes = inner.readBytes?.bind(inner);
+        if (innerReadBytes)
+          this.readBytes = (path) => this.timed("exec.read_bytes", (s) => innerReadBytes(path, { span: s }));
       }
       inner;
       span;
       backend;
       release;
       moveTo;
+      readBytes;
       /** Each op under its own `exec.*` span, handed to the inner executor as
        *  `opts.span` so its HTTP calls become `http.client` children (item 21). */
       timed(name, fn, extra = {}) {
@@ -24796,6 +24875,60 @@ ${skill.body}${footer}`;
   }
 });
 
+// ../../src/tools/attach.ts
+function fileNameOf2(path) {
+  const segments2 = path.split("/").filter(Boolean);
+  return segments2[segments2.length - 1] ?? path;
+}
+var attachFileTool;
+var init_attach = __esm({
+  "../../src/tools/attach.ts"() {
+    "use strict";
+    init_binaryRead();
+    attachFileTool = {
+      name: "attach_file",
+      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only, up to ${MAX_READ_BYTES} bytes.`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Relative path of the file in the workspace" },
+          comment: {
+            type: "string",
+            description: "One line posted with the file saying what it shows (default: the file name)"
+          }
+        },
+        required: ["path"]
+      },
+      async run(input, ctx) {
+        const path = String(input.path ?? "").trim();
+        if (!path) return "error: path is required";
+        const name = fileNameOf2(path);
+        const lead = typeof input.comment === "string" && input.comment.trim() ? input.comment.trim() : name;
+        if (!ctx.attach) {
+          return "attach_file is not available here: this conversation's channel takes no file uploads \u2014 link to the file instead";
+        }
+        const readBytes = ctx.executor.readBytes?.bind(ctx.executor);
+        if (!readBytes) {
+          return "attach_file is not available here: this workspace cannot hand files over \u2014 link to the file instead";
+        }
+        let bytes;
+        try {
+          bytes = await readBytes(path);
+        } catch (err2) {
+          return `error: could not read ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+        }
+        if (bytes.byteLength === 0) return `error: ${path} is empty \u2014 nothing to attach`;
+        try {
+          await ctx.attach({ name, bytes, lead });
+        } catch (err2) {
+          return `error: the channel refused the upload of ${name}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+        }
+        return `attached ${name} (${bytes.byteLength} bytes) to the conversation`;
+      }
+    };
+  }
+});
+
 // ../../src/core/dispatch/awaitChildren.ts
 function decideWait(inputs) {
   const { children, now, budgetEndsAt, timeoutAt, stop, followUpPending } = inputs;
@@ -24904,6 +25037,7 @@ function watchedChild(io, on) {
     }
   };
   if (io.attach) watched2.attach = (file) => io.attach(file);
+  if (io.attachFile) watched2.attachFile = (file) => io.attachFile(file);
   if (io.runFinished) watched2.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) watched2.openThread = (lead) => io.openThread(lead);
   return watched2;
@@ -25433,6 +25567,7 @@ var init_workspace = __esm({
     init_web();
     init_github();
     init_skills();
+    init_attach();
     init_runs2();
     bashTool = {
       name: "bash",
@@ -25801,6 +25936,7 @@ ${raw.trim()}`;
         bashTool,
         readFileTool,
         writeFileTool,
+        attachFileTool,
         updateStatusTool,
         submitPrDescriptionTool,
         submitHandoffTool,
@@ -28893,9 +29029,11 @@ async function runLoop2(deps, ctx) {
   let runFailed = false;
   let runDiagnosis;
   const releaseWorkspace = (span) => round2.release({ hardStopped: run2.control.requested === "hard", ...span ? { span } : {} });
+  const attachFile = io.attachFile?.bind(io);
   const toolContext = {
     executor,
     reportProgress,
+    ...attachFile ? { attach: attachFile } : {},
     web: webCapability(),
     skills: deps.skills,
     github: githubCapabilityFor(deps, msg.userId),
@@ -33616,6 +33754,20 @@ var init_slack = __esm({
 ${file.text}`));
         }
       }
+      /** A run's binary artifact in the thread — a screenshot renders inline, a
+       *  PDF as a preview — through the same `files.uploadV2` with the bytes as
+       *  the file. No fallback: a text reply cannot carry bytes, so a failed upload
+       *  propagates for the caller to report. */
+      async attachFile(file) {
+        await this.client.files.uploadV2({
+          channel_id: this.ev.channel,
+          thread_ts: this.ev.threadTs,
+          filename: file.name,
+          title: file.name,
+          file: Buffer.from(file.bytes),
+          initial_comment: mdToMrkdwn(file.lead)
+        });
+      }
       async post(mrkdwn) {
         for (const chunk of chunkText(mrkdwn, SLACK_MSG_LIMIT)) {
           await this.client.chat.postMessage({
@@ -37667,6 +37819,7 @@ function watched(io, on) {
     }
   };
   if (io.attach) out.attach = (file) => io.attach(file);
+  if (io.attachFile) out.attachFile = (file) => io.attachFile(file);
   if (io.runFinished) out.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) out.openThread = (lead) => io.openThread(lead);
   return out;
@@ -39383,8 +39536,9 @@ init_source();
 init_invokedAsScript();
 init_secrets2();
 import { Console } from "node:console";
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync14, mkdtempSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename as basename3, join as join15 } from "node:path";
 var CONFIG_PATH3 = process.env.SWITCHBOARD_CONFIG ?? installationPath(OPERATOR_ROOT, "config/config.yaml");
 var DATA_DIR2 = installationPath(OPERATOR_ROOT, "data");
 var CLI_CALLER = { kind: "cli", id: CLI_ACTOR.id, actor: CLI_ACTOR };
@@ -39536,14 +39690,16 @@ ${cliCatalogue(commands)}`, stderr: "" };
   }
 }
 var ConsoleIO = class _ConsoleIO {
-  constructor(out = process.stdout, threadKey = "cli", prefix = "") {
+  constructor(out = process.stdout, threadKey = "cli", prefix = "", attachments = {}) {
     this.out = out;
     this.threadKey = threadKey;
     this.prefix = prefix;
+    this.attachments = attachments;
   }
   out;
   threadKey;
   prefix;
+  attachments;
   /** The receipt of the run this request started, once it finished — undefined
    *  before that, and forever when no run was started (a config reply such as
    *  `help`, a refusal before a run existed). */
@@ -39553,6 +39709,15 @@ var ConsoleIO = class _ConsoleIO {
   async reply(text) {
     this.out.write("\n" + this.prefix + text + "\n");
   }
+  /** The harness's file upload: the bytes written under the attachments dir,
+   *  the lead printed like a reply with the path a person can open. */
+  async attachFile(file) {
+    this.attachments.dir ??= mkdtempSync(join15(tmpdir(), "switchboard-attachments-"));
+    const path = join15(this.attachments.dir, basename3(file.name));
+    writeFileSync9(path, file.bytes);
+    await this.reply(`${file.lead}
+\u{1F4CE} ${file.name} (${file.bytes.byteLength} bytes) \u2192 ${path}`);
+  }
   runFinished(receipt) {
     this.finished = receipt;
   }
@@ -39575,7 +39740,10 @@ var ConsoleIO = class _ConsoleIO {
     const n2 = ++this.children;
     await this.reply(lead);
     const threadKey = `${this.threadKey}/child-${n2}`;
-    return { thread: { threadKey }, io: new _ConsoleIO(this.out, threadKey, `${this.prefix}[child-${n2}] `) };
+    return {
+      thread: { threadKey },
+      io: new _ConsoleIO(this.out, threadKey, `${this.prefix}[child-${n2}] `, this.attachments)
+    };
   }
 };
 function askExitCode(finished) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.209.0",
+  "version": "1.210.0",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",