@corvio/cli 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   agentCredentialPath,
 } from "./core.js";
 
-const VERSION = "0.1.0-beta.16";
+const VERSION = "0.1.0-beta.17";
 const DEFAULT_API_BASE = "https://api.corvio.ai/v1";
 const DEFAULT_APP_BASE = "https://corvio.ai";
 const USER_AGENT = `corvio-cli/${VERSION}`;
@@ -72,6 +72,7 @@ const COMMAND_OPTIONS = Object.freeze({
   "ask:": [
     "prompt", "conversation-id", "sources", "allow-actions", "context-file", "idempotency-key",
     "processing-profile", "max-processing-profile", "scan-mode", "skills-extraction-mode", "caller-model",
+    "file", "asset-ids", "mime-type",
   ],
   "agents:list": ["include-revoked"],
   "agents:connect": [
@@ -140,7 +141,7 @@ Usage:
   corvio workspaces list|use|current|create [id]
   corvio capabilities
   corvio collaboration status [--project <path>] [--provider codex|claude_code|copilot]
-  corvio ask --prompt <text> [--conversation-id <id>] [--allow-actions] [--processing-profile auto|economy|standard|deep]
+  corvio ask --prompt <text> [--file <path>] [--asset-ids <id,id>] [--conversation-id <id>] [--allow-actions] [--processing-profile auto|economy|standard|deep]
   corvio agents list|connect|create|update|rotate [id]
   corvio agent claim|renew|complete|fail|comments|comment|reply|status|closeout|run [id]
   corvio questions list|get [id]
@@ -169,7 +170,7 @@ const COMMAND_HELP = Object.freeze({
   workspaces: `Usage:\n  corvio workspaces list\n  corvio workspaces use <workspace-id>\n  corvio workspaces current\n  corvio workspaces create --name <name> [--kind personal|team]\n\nWorkspace status and blocked capability reasons are returned with each item.`,
   capabilities: `Usage: corvio capabilities [--json]\n\nShow live API resources, principal scopes, selected Workspace status, and CLI compatibility.`,
   collaboration: `Usage:\n  corvio collaboration status [--project <path>] [--provider codex|claude_code|copilot]\n\nVerify that the current project has a bound Corvio Agent, the official collaboration Skill is discoverable at the live contract version, and the inbound listener state is reported separately. This is the foreground work-loop readiness check; a listening process alone is not enough.`,
-  ask: `Usage: corvio ask --prompt <text> [--conversation-id <id>] [--sources workspace,web,memory] [--allow-actions] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>] [--context-file <json>] [--idempotency-key <key>]\n\nSkill extraction mode always requires --allow-actions; answer-only questions may use auto or off.`,
+  ask: `Usage: corvio ask --prompt <text> [--file <path>] [--asset-ids <id,id>] [--conversation-id <id>] [--sources workspace,web,memory] [--allow-actions] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>] [--context-file <json>] [--idempotency-key <key>]\n\n--file retains the selected local file, verifies its hash, and attaches the finalized Asset to this exact question. --asset-ids attaches already-retained Corvio Assets. Skill extraction mode always requires --allow-actions; answer-only questions may use auto or off.`,
   agents: `Usage:\n  corvio agents list\n  corvio agents connect [--provider codex|claude_code|copilot] [--project <path>] [--permission-profile read_only|workspace_write|danger_full_access] [--trigger-policy owner_only|workspace_members] [--display-name <name>] [--recover-credential] [--no-listen]\n  corvio agents create --handle <handle> --display-name <name> [--provider codex|claude_code|copilot|custom] [--permissions read,comment,edit]\n  corvio agents update <id> [--display-name <name>] [--status active|paused|revoked] [--permissions <list>]\n  corvio agents rotate <id>\n\n'connect' binds the current Git project (or --project path) to one stable personal Agent. Repeating it is idempotent; another project creates another Agent. It reports provider/CLI, listener, and foreground Skill readiness separately; run corvio collaboration status after installing or refreshing the Skill. The default workspace_write profile is limited by the provider's native sandbox. owner_only is the safe trigger default. Secrets and absolute project paths stay local.`,
   agent: `Usage:\n  corvio agent claim [--worker-id <id>] [--wait-seconds <0-30>]\n  corvio agent renew <event-id> --lease-token <token> [--lease-seconds <30-900>]\n  corvio agent complete <event-id> --lease-token <token> [--result-file <json>]\n  corvio agent fail <event-id> --lease-token <token> --error <message>\n  corvio agent mentions --document-id <id> [--query <name>]\n  corvio agent comments --document-id <id>\n  corvio agent comment --document-id <id> --body <text> [--selection-file <json>] [--start-new-chain] [--idempotency-key <key>]\n  corvio agent reply <thread-id> --document-id <id> --body <text> [--source-event-id <id> --source-event-lease-token <token>|--start-new-chain] [--idempotency-key <key>]\n  corvio agent status <thread-id> --document-id <id> --status open|resolved\n  corvio agent closeout --document-id <id> [--thread-id <id>] --body <verified-result> [--status open|resolved] [--idempotency-key <key>]\n  corvio agent run [--provider codex|claude_code|copilot|custom] [--handler <executable>] [--agent <id>] [--once] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>]\n\nUse mentions before commenting when the target is uncertain; aliases resolve to stable user or Agent IDs and ambiguity fails closed. Use closeout when a Corvio document or comment owned the task: it returns the verified result to that surface and reads document/comments back. Agent-to-Agent comments require either a claimed source event or explicit --start-new-chain. The runner iteratively exchanges origin-scoped evidence with Corvio Query/Writer, then invokes the bound provider inside its local project. Local code changes use the recorded provider permission profile; complex Corvio document changes belong to Query/Writer. Provider children never receive Corvio credentials.`,
   questions: `Usage:\n  corvio questions list [--limit <n>] [--cursor <cursor>] [--conversation-id <id>]\n  corvio questions get <question-id>`,
@@ -906,25 +907,52 @@ async function ask(options, positionals) {
       code: "skills_extraction_requires_actions",
     });
   }
-  const result = await api.request("/questions", {
-    method: "POST",
-    headers: {
-      "idempotency-key": idempotencyKey(options),
-      ...(options["caller-model"] ? { "x-corvio-caller-model": String(options["caller-model"]) } : {}),
-    },
-    body: {
-      prompt,
-      conversation_id: options["conversation-id"] || null,
-      mode: options["allow-actions"] ? "allow_actions" : "answer_only",
-      sources: listOption(options, "sources", ["workspace", "web", "memory"]),
-      processing_profile: processingProfile,
-      max_processing_profile: maxProcessingProfile,
-      scan_mode: scanMode,
-      skills_extraction_mode: skillsExtractionMode,
-      context,
-    },
-    timeoutMs: 330_000,
-  });
+  const attachedAssets = [];
+  if (options.file) {
+    attachedAssets.push(await uploadWorkspaceFile(api, options.file, options["mime-type"]));
+  }
+  const assetIds = listOption(options, "asset-ids", []);
+  for (const asset of attachedAssets) assetIds.push(String(asset.id));
+  const uniqueAssetIds = [...new Set(assetIds.map((value) => String(value).trim()).filter(Boolean))];
+  let result;
+  try {
+    result = await api.request("/questions", {
+      method: "POST",
+      headers: {
+        "idempotency-key": idempotencyKey(options),
+        ...(options["caller-model"] ? { "x-corvio-caller-model": String(options["caller-model"]) } : {}),
+      },
+      body: {
+        prompt,
+        conversation_id: options["conversation-id"] || null,
+        asset_ids: uniqueAssetIds,
+        mode: options["allow-actions"] ? "allow_actions" : "answer_only",
+        sources: listOption(options, "sources", ["workspace", "web", "memory"]),
+        processing_profile: processingProfile,
+        max_processing_profile: maxProcessingProfile,
+        scan_mode: scanMode,
+        skills_extraction_mode: skillsExtractionMode,
+        context,
+      },
+      timeoutMs: 330_000,
+    });
+  } catch (error) {
+    if (attachedAssets.length > 0) {
+      throw new CliError(
+        `The selected file was retained as Corvio Asset ${attachedAssets[0].id}, but the question did not complete. Retry with --asset-ids ${attachedAssets.map((asset) => asset.id).join(",")}.`,
+        {
+          code: "question_failed_after_file_retention",
+          exitCode: error instanceof CliError ? error.exitCode : EXIT.REMOTE,
+          status: error instanceof CliError ? error.status : null,
+          details: {
+            asset_ids: attachedAssets.map((asset) => asset.id),
+            cause: error instanceof Error ? error.message : String(error),
+          },
+        },
+      );
+    }
+    throw error;
+  }
   const conversationId = String(result?.conversation_id || result?.data?.conversation_id || "").trim();
   if (conversationId && execution.selection?.workspaceId) {
     await storeConversationRoutingReceipt({
@@ -934,7 +962,14 @@ async function ask(options, positionals) {
       apiBase: baseUrl(options),
     });
   }
-  writeResult({ ...result, routing: execution.routing }, { json: options.json });
+  writeResult(
+    {
+      ...result,
+      ...(attachedAssets.length > 0 ? { attached_assets: attachedAssets } : {}),
+      routing: execution.routing,
+    },
+    { json: options.json },
+  );
 }
 
 function enumOption(options, name, allowed, fallback) {
@@ -2839,6 +2874,51 @@ function mimeTypeFor(path) {
   })[extension] || "application/octet-stream";
 }
 
+async function uploadWorkspaceFile(api, inputPath, mimeTypeOverride) {
+  const input = resolve(String(inputPath));
+  const info = await stat(input);
+  if (!info.isFile()) throw new CliError("--file must point to a regular file.", { code: "upload_file_invalid" });
+  if (info.size < 1 || info.size > MAX_UPLOAD_BYTES) {
+    throw new CliError(`--file must be between 1 byte and ${MAX_UPLOAD_BYTES} bytes.`, {
+      code: "upload_file_size_invalid",
+    });
+  }
+  const bytes = await readFile(input);
+  if (bytes.length < 1 || bytes.length > MAX_UPLOAD_BYTES) {
+    throw new CliError(`--file must be between 1 byte and ${MAX_UPLOAD_BYTES} bytes.`, {
+      code: "upload_file_size_invalid",
+    });
+  }
+  const fileName = basename(input);
+  const mimeType = String(mimeTypeOverride || mimeTypeFor(input));
+  const initialized = await api.request("/files/uploads", {
+    method: "POST",
+    body: { file_name: fileName, mime_type: mimeType, size_bytes: bytes.length },
+  });
+  await api.putUrl(initialized.upload_url, bytes, {
+    headers: initialized.upload_headers || {},
+    timeoutMs: 5 * 60_000,
+  });
+  const result = await api.request("/files/uploads:finalize", {
+    method: "POST",
+    retrySafe: true,
+    body: {
+      upload_id: initialized.upload_id,
+      blob_name: initialized.blob_name,
+      file_name: fileName,
+      mime_type: mimeType,
+      size_bytes: bytes.length,
+    },
+  });
+  if (result.content_sha256 && result.content_sha256 !== sha256(bytes)) {
+    throw new CliError("Uploaded file content did not match Corvio's SHA-256 receipt.", {
+      code: "upload_integrity_mismatch",
+      exitCode: EXIT.REMOTE,
+    });
+  }
+  return result;
+}
+
 async function files(options, action, id) {
   const { api } = await executionClient(options);
   const assetId = id || options.id;
@@ -2861,47 +2941,11 @@ async function files(options, action, id) {
     const written = await writeBinaryFile(output, bytes);
     result = { ...metadata, output: written };
   } else if (action === "upload") {
-    const input = resolve(String(option(options, "file", { required: true })));
-    const info = await stat(input);
-    if (!info.isFile()) throw new CliError("--file must point to a regular file.", { code: "upload_file_invalid" });
-    if (info.size < 1 || info.size > MAX_UPLOAD_BYTES) {
-      throw new CliError(`--file must be between 1 byte and ${MAX_UPLOAD_BYTES} bytes.`, {
-        code: "upload_file_size_invalid",
-      });
-    }
-    const bytes = await readFile(input);
-    if (bytes.length < 1 || bytes.length > MAX_UPLOAD_BYTES) {
-      throw new CliError(`--file must be between 1 byte and ${MAX_UPLOAD_BYTES} bytes.`, {
-        code: "upload_file_size_invalid",
-      });
-    }
-    const fileName = basename(input);
-    const mimeType = String(options["mime-type"] || mimeTypeFor(input));
-    const initialized = await api.request("/files/uploads", {
-      method: "POST",
-      body: { file_name: fileName, mime_type: mimeType, size_bytes: bytes.length },
-    });
-    await api.putUrl(initialized.upload_url, bytes, {
-      headers: initialized.upload_headers || {},
-      timeoutMs: 5 * 60_000,
-    });
-    result = await api.request("/files/uploads:finalize", {
-      method: "POST",
-      retrySafe: true,
-      body: {
-        upload_id: initialized.upload_id,
-        blob_name: initialized.blob_name,
-        file_name: fileName,
-        mime_type: mimeType,
-        size_bytes: bytes.length,
-      },
-    });
-    if (result.content_sha256 && result.content_sha256 !== sha256(bytes)) {
-      throw new CliError("Uploaded file content did not match Corvio's SHA-256 receipt.", {
-        code: "upload_integrity_mismatch",
-        exitCode: EXIT.REMOTE,
-      });
-    }
+    result = await uploadWorkspaceFile(
+      api,
+      option(options, "file", { required: true }),
+      options["mime-type"],
+    );
     if (options.organize) {
       requireConfirmation(options, "Starting semantic organization for the uploaded file");
       const organization = await api.request(`/files/${resourcePath(result.id)}:organize`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corvio/cli",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.17",
   "description": "Official Corvio Workspace CLI for questions, knowledge search, documents, and Agent workflows.",
   "type": "module",
   "bin": {