@cydm/happy-elves 0.1.0-beta.259 → 0.1.0-beta.267

package/apps/cli/dist/commands/lib/args.js

@@ -104,6 +104,7 @@ const booleanFlags = new Set([
     "summary",
     "verbose",
     "wait",
+    "hidden",
     "manual",
 ]);
 const knownFlags = new Set([...valueFlags, ...booleanFlags]);

package/apps/cli/dist/commands/lib/usage.js

@@ -46,7 +46,7 @@ Check local controller config, relay reachability, and daemon state.
   file preview is read-only and limited to files inside --root.
 `,
     session: `Usage:
-  happy-elves session create --machine <machineId> [--agent codex] [--cwd <path>] [--name <name>] [--permission-mode <mode>] --json
+  happy-elves session create --machine <machineId> [--agent codex] [--cwd <path>] [--name <name>] [--permission-mode <mode>] [--hidden] [--source dogfood] --json
   happy-elves session list [--machine <machineId>] [--agent <agent>] [--cwd <cwd>] [--name <name>] [--limit n] [--all] [--verbose] [--json]
   happy-elves session history --machine <machineId> [--cwd <path>] [--agent <agent>] [--include-archived] [--limit 20] --json
   happy-elves session continue <runtimeSessionId> --machine <machineId> [--name <name>] --json
@@ -206,7 +206,7 @@ Core commands:
   machine directory <machineId> [--path <path>] [--json]
 
   session list [--machine <machineId>] [--cwd <path>] [--limit 20] [--json]
-  session create --machine <machineId> [--agent codex] [--cwd <path>] [--name <name>] --json
+  session create --machine <machineId> [--agent codex] [--cwd <path>] [--name <name>] [--hidden] --json
   session history --machine <machineId> [--cwd <path>] [--limit 20] --json
   session continue <runtimeSessionId> --machine <machineId> --json
   session repair-binding <sessionId> [--runtime-session <runtimeSessionId>] --json

package/apps/cli/dist/commands/session.js

@@ -354,8 +354,19 @@ export async function handleSession({ domain, action, positional, flags }) {
         const name = "main";
         const permissionMode = parsePermissionMode(flags["permission-mode"] ?? flags.permission);
         const model = typeof flags.model === "string" && flags.model.trim() ? flags.model.trim() : undefined;
+        const source = typeof flags.source === "string" && flags.source.trim() ? flags.source.trim() : undefined;
         const client = await makeClient();
-        const result = await client.createSession({ machineId, agent, cwd, name, runtimeName: requestedRuntimeName, permissionMode, model });
+        const result = await client.createSession({
+            machineId,
+            agent,
+            cwd,
+            name,
+            runtimeName: requestedRuntimeName,
+            permissionMode,
+            model,
+            ...(flags.hidden === true ? { hiddenFromWorkspace: true } : {}),
+            ...(source ? { source } : {}),
+        });
         const session = result.sessionId ? await client.getSession(result.sessionId) : undefined;
         const projectedSession = session
             ? wantsVerbose(flags)

package/apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-cli",
-  "version": "0.1.0-beta.259",
+  "version": "0.1.0-beta.267",
   "private": true,
   "type": "module"
 }

package/apps/daemon/dist/relay/register.js

@@ -25,6 +25,7 @@ function agentProfileForRegister(agent) {
         ...(agent.defaultModel ? { defaultModel: agent.defaultModel } : {}),
         ...(agent.models && agent.models.length > 0 ? { models: agent.models } : {}),
         ...(agent.historyModel ? { historyModel: agent.historyModel } : {}),
+        ...(agent.attachmentSupport ? { attachmentSupport: agent.attachmentSupport } : {}),
         ...(agent.sessionPrimitives ? { sessionPrimitives: runtimeAgentPrimitives(agent.sessionPrimitives) } : {}),
     };
 }

package/apps/daemon/dist/runtime/external-provider.js

@@ -169,6 +169,10 @@ export function createExternalAgentRuntimeProvider(options) {
     const clients = options.providers.map((config) => new ExternalProviderClient(config));
     const clientsByAgent = new Map();
     async function initialize() {
+        const fallback = options.fallback;
+        if (typeof fallback.initialize === "function") {
+            await fallback.initialize().catch(() => undefined);
+        }
         await Promise.all(clients.map(async (client) => {
             await client.initialize().catch(() => undefined);
             for (const agent of client.listAgents())
@@ -273,7 +277,11 @@ export function createExternalAgentRuntimeProvider(options) {
     return {
         initialize,
         diagnostics() {
-            return clients.map((client) => client.diagnostics());
+            const fallback = options.fallback;
+            const fallbackDiagnostics = typeof fallback.diagnostics === "function"
+                ? fallback.diagnostics()
+                : [];
+            return [...fallbackDiagnostics, ...clients.map((client) => client.diagnostics())];
         },
         dispose() {
             for (const client of clients)
@@ -293,6 +301,7 @@ export function createExternalAgentRuntimeProvider(options) {
                     ...(defaultModel ? { defaultModel } : {}),
                     ...(models ? { models } : {}),
                     historyModel: normalizeHistoryModel(agent.historyModel),
+                    ...(agent.capabilities?.attachments ? { attachmentSupport: normalizeAttachmentSupport(agent.capabilities.attachments) } : {}),
                     sessionPrimitives: agent.capabilities?.sessionPrimitives
                         ? {
                             resume: fromSdkPrimitive(agent.capabilities.sessionPrimitives.resume),
@@ -557,6 +566,28 @@ function normalizeModelOptions(value) {
     });
     return models.length > 0 ? models : undefined;
 }
+function normalizeAttachmentSupport(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const support = {};
+    if (typeof record.text === "boolean")
+        support.text = record.text;
+    if (typeof record.image === "boolean")
+        support.image = record.image;
+    if (typeof record.binary === "boolean")
+        support.binary = record.binary;
+    if (typeof record.maxCount === "number" && Number.isInteger(record.maxCount) && record.maxCount > 0)
+        support.maxCount = record.maxCount;
+    if (typeof record.maxBytes === "number" && Number.isInteger(record.maxBytes) && record.maxBytes > 0)
+        support.maxBytes = record.maxBytes;
+    if (Array.isArray(record.mediaTypes)) {
+        const mediaTypes = record.mediaTypes.flatMap((item) => typeof item === "string" && item.trim() ? [item.trim()] : []);
+        if (mediaTypes.length > 0)
+            support.mediaTypes = [...new Set(mediaTypes)];
+    }
+    return Object.keys(support).length > 0 ? support : undefined;
+}
 class ExternalProviderClient {
     config;
     id;

package/apps/daemon/dist/session/lifecycle.js

@@ -5,7 +5,7 @@ import { sessions } from "../state.js";
 import { claimCommandRequest, sendCommandResponse } from "../relay/send.js";
 import { createSessionFailureAuditEvent, createSessionFailureResponse } from "./create-session.js";
 import { emitHistoricalEvents, emitRuntimeTailEvents, emitSessionHeadAdvanced, emitTranscriptPrepended, emitTranscriptReplacement, latestCompletedHistoricalHead, } from "./events.js";
-import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCommand } from "./metadata.js";
+import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCommand, workspaceVisibilityMetadata } from "./metadata.js";
 const historicalBackfillEventLimit = 200;
 export async function handleCreateSession(ws, config, command) {
     if (command.type !== "machine:createSession")
@@ -71,6 +71,7 @@ export async function handleCreateSession(ws, config, command) {
             sessionId: command.sessionId,
             ...(providerName ? { name: providerName } : {}),
             encryptedMetadata: await encryptedSessionMetadata(config, command.sessionId, state, {
+                ...workspaceVisibilityMetadata(metadata),
                 emptyRuntimeSession: true,
                 ...(providerName ? { providerName, renamedAt: new Date().toISOString() } : {}),
                 readyAt: new Date().toISOString(),
@@ -111,6 +112,7 @@ export async function handleImportHistoricalSession(ws, config, command) {
         sessions.set(command.sessionId, state);
         const importedAt = new Date().toISOString();
         const importedMetadataBase = {
+            ...workspaceVisibilityMetadata(importedMetadata),
             importedAt,
             importedFromRuntimeSessionId: importedMetadata?.importedFromRuntimeSessionId ?? command.runtimeSessionId,
             importedSummary: importedMetadata?.importedSummary,

package/apps/daemon/dist/session/metadata.d.ts

@@ -2,6 +2,7 @@ import { type EncryptedEnvelope, type MachineCommand } from "../../../../package
 import type { DaemonConfig, SessionFallback, SessionMetadata, SessionState } from "../types.js";
 export declare function encryptedSessionMetadata(config: DaemonConfig, sessionId: string, state: Pick<SessionState, "agent" | "cwd" | "name" | "handle" | "model">, extra: Record<string, unknown>): Promise<EncryptedEnvelope>;
 export declare function commandSessionMetadata(config: DaemonConfig, encryptedMetadata?: EncryptedEnvelope): Promise<SessionMetadata | undefined>;
+export declare function workspaceVisibilityMetadata(metadata: SessionMetadata | undefined): Record<string, unknown>;
 export declare function sessionFallbackFromCommand(config: DaemonConfig, command: Extract<MachineCommand, {
     type: "machine:prompt" | "machine:resume" | "machine:rewind" | "machine:fork" | "machine:renameSession" | "machine:close";
 }>): Promise<SessionFallback | undefined>;

package/apps/daemon/dist/session/metadata.js

@@ -27,6 +27,15 @@ export async function commandSessionMetadata(config, encryptedMetadata) {
         return undefined;
     }
 }
+export function workspaceVisibilityMetadata(metadata) {
+    if (!metadata)
+        return {};
+    return {
+        ...(metadata.hiddenFromWorkspace === true ? { hiddenFromWorkspace: true } : {}),
+        ...(metadata.visibility === "hidden" ? { visibility: "hidden" } : {}),
+        ...(typeof metadata.source === "string" && metadata.source.trim() ? { source: metadata.source.trim() } : {}),
+    };
+}
 export async function sessionFallbackFromCommand(config, command) {
     const encryptedMetadata = command.type === "machine:fork" ? command.sourceEncryptedMetadata : command.encryptedMetadata;
     if (!encryptedMetadata)

package/apps/daemon/dist/session/primitives.js

@@ -3,7 +3,7 @@ import { appendAudit } from "../audit.js";
 import { getRuntime } from "../runtime.js";
 import { sessions } from "../state.js";
 import { claimCommandRequest, sendCommandResponse } from "../relay/send.js";
-import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCommand } from "./metadata.js";
+import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCommand, workspaceVisibilityMetadata } from "./metadata.js";
 import { replaceAuthoritativeTranscript, resumeSession, usesAuthoritativeTranscript } from "./lifecycle.js";
 import { primitiveResultHandle, primitiveResultHead, primitiveResultSourceCheckpoint } from "./runtime-handle.js";
 async function emitCapabilityUnavailable(ws, config, command, capability, alreadyClaimed = false) {
@@ -150,6 +150,7 @@ export async function handleRewind(ws, config, command) {
         currentHead: head.currentHead,
         lastTurnId: head.lastTurnId,
         encryptedMetadata: await encryptedSessionMetadata(config, command.sessionId, nextSession, {
+            ...workspaceVisibilityMetadata(await commandSessionMetadata(config, command.encryptedMetadata)),
             rewoundAt: new Date().toISOString(),
             rewoundTo: command.to,
             currentHead: head.currentHead,
@@ -255,6 +256,7 @@ export async function handleFork(ws, config, command) {
         name: command.name,
         ...(authoritativeForkTranscript ? { transcriptPending: true } : {}),
         encryptedMetadata: await encryptedSessionMetadata(config, command.targetSessionId, forkState, {
+            ...workspaceVisibilityMetadata(sourceMetadata),
             forkedAt: new Date().toISOString(),
             importedFromRuntimeSessionId: sourceMetadata?.importedFromRuntimeSessionId,
             importedSummary: sourceMetadata?.importedSummary,
@@ -377,6 +379,7 @@ export async function handleRename(ws, config, command) {
         sessionId: command.sessionId,
         name: result.name,
         encryptedMetadata: await encryptedSessionMetadata(config, command.sessionId, renamed, {
+            ...workspaceVisibilityMetadata(await commandSessionMetadata(config, command.encryptedMetadata)),
             providerName: result.name,
             renamedAt: new Date().toISOString(),
         }),

package/apps/daemon/dist/session/prompt.d.ts

@@ -3,7 +3,7 @@ import type { DaemonConfig } from "../types.js";
 type PromptCommand = Extract<MachineCommand, {
     type: "machine:prompt";
 }>;
-type PromptExecutionPhase = "decrypt-prompt" | "prepare-attachments" | "decrypt-memory-options" | "prepare-memory-context" | "emit-submitted" | "emit-memory-status" | "start-turn" | "attach-turn" | "audit-turn-start" | "stream-turn" | "await-turn-result" | "write-memory" | "refresh-runtime-metadata" | "emit-terminal" | "refresh-authoritative-transcript" | "send-turn-done" | "terminal-hooks";
+type PromptExecutionPhase = "decrypt-prompt" | "prepare-attachments" | "validate-attachments" | "decrypt-memory-options" | "prepare-memory-context" | "emit-submitted" | "emit-memory-status" | "start-turn" | "attach-turn" | "audit-turn-start" | "stream-turn" | "await-turn-result" | "write-memory" | "refresh-runtime-metadata" | "emit-terminal" | "refresh-authoritative-transcript" | "send-turn-done" | "terminal-hooks";
 export declare function handlePrompt(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;
 export declare function handleOptionResponse(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;
 export declare function promptFailureResponse(command: PromptCommand, phase: PromptExecutionPhase, error: unknown): {

package/apps/daemon/dist/session/prompt.js

@@ -8,7 +8,7 @@ import { attachClaimedTurn, claimSessionTurn, releaseSessionTurn, sendCommandRes
 import { settleScheduleTurnTerminal } from "../schedule/runner.js";
 import { emitEvent, runtimeEventToPayload } from "./events.js";
 import { replaceAuthoritativeTranscript, resumeSession, usesAuthoritativeTranscript } from "./lifecycle.js";
-import { encryptedSessionMetadata, sessionFallbackFromCommand } from "./metadata.js";
+import { commandSessionMetadata, encryptedSessionMetadata, sessionFallbackFromCommand, workspaceVisibilityMetadata } from "./metadata.js";
 export async function handlePrompt(ws, config, command) {
     if (command.type !== "machine:prompt")
         return;
@@ -54,11 +54,15 @@ export async function handlePrompt(ws, config, command) {
     };
     let phase = "decrypt-prompt";
     try {
+        const sessionMetadata = await commandSessionMetadata(config, command.encryptedMetadata);
         const prompt = await decryptJson(config.accountSecret, command.encryptedPrompt);
         const rawText = prompt.type === "user_prompt" ? prompt.text : JSON.stringify(prompt);
         const promptAttachments = prompt.type === "user_prompt" ? normalizePromptAttachments(prompt.attachments) : [];
         phase = "prepare-attachments";
         const preparedPrompt = preparePromptAttachments(rawText, promptAttachments);
+        const runtime = getRuntime(session.cwd);
+        phase = "validate-attachments";
+        assertRuntimeAttachmentSupport(session, runtime, preparedPrompt.runtimeAttachments);
         phase = "decrypt-memory-options";
         const memoryOptions = await decryptMemoryOptions(config, command);
         phase = "prepare-memory-context";
@@ -100,7 +104,7 @@ export async function handlePrompt(ws, config, command) {
         const previousBackendSessionId = session.handle.backendSessionId;
         const model = modelFromCommand(command.model) ?? session.model ?? session.handle.model;
         phase = "start-turn";
-        const turn = getRuntime(session.cwd).startTurn({
+        const turn = runtime.startTurn({
             handle: session.handle,
             text,
             mode: "prompt",
@@ -167,6 +171,7 @@ export async function handlePrompt(ws, config, command) {
         phase = "refresh-runtime-metadata";
         const refreshedMetadata = session.handle.backendSessionId
             ? await encryptedSessionMetadata(config, command.sessionId, session, {
+                ...workspaceVisibilityMetadata(sessionMetadata),
                 currentHead: result.currentHead,
                 emptyRuntimeSession: result.status === "failed" && !result.currentHead && !result.lastTurnId,
                 runtimeMetadataRefreshedAt: new Date().toISOString(),
@@ -261,6 +266,9 @@ export async function handlePrompt(ws, config, command) {
         await appendAudit(promptFailureAuditEvent(config, command, phase, error)).catch((auditError) => {
             console.error(`Prompt failure audit failed for ${command.turnId}: ${auditError instanceof Error ? auditError.message : String(auditError)}`);
         });
+        await finalizePromptFailure(ws, config, command, response.message).catch((terminalError) => {
+            console.error(`Prompt failure terminalization failed for ${command.turnId}: ${terminalError instanceof Error ? terminalError.message : String(terminalError)}`);
+        });
         await sendCommandResponse(ws, response);
     }
     finally {
@@ -341,11 +349,52 @@ export function promptFailureAuditEvent(config, command, phase, error) {
         },
     };
 }
+async function finalizePromptFailure(ws, config, command, message) {
+    await emitEvent(ws, config, command.sessionId, command.turnId, {
+        type: "done",
+        status: "failed",
+        error: message,
+        lastTurnId: command.turnId,
+    });
+    await sendReliable({
+        type: "machine:turnDone",
+        sessionId: command.sessionId,
+        turnId: command.turnId,
+        status: "failed",
+        lastTurnId: command.turnId,
+        error: message,
+    }, ws);
+    completedPromptRequests.set(command.requestId, {
+        sessionId: command.sessionId,
+        turnId: command.turnId,
+        status: "failed",
+        error: message,
+    });
+    await handleGatewayTurnTerminal(config, {
+        sessionId: command.sessionId,
+        requestId: command.requestId,
+        turnId: command.turnId,
+        status: "failed",
+        error: message,
+    }).catch((error) => {
+        console.error(`Gateway failure hook failed for ${command.turnId}: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    await settleScheduleTurnTerminal({
+        requestId: command.requestId,
+        turnId: command.turnId,
+        status: "failed",
+        error: message,
+    }).catch((error) => {
+        console.error(`Schedule failure hook failed for ${command.turnId}: ${error instanceof Error ? error.message : String(error)}`);
+    });
+}
 function promptFailureCode(phase, error) {
     if (phase === "decrypt-prompt" && isCryptoOperationFailure(error))
         return "PROMPT_DECRYPT_FAILED";
     if (phase === "decrypt-memory-options" && isCryptoOperationFailure(error))
         return "MEMORY_OPTIONS_DECRYPT_FAILED";
+    if (phase === "validate-attachments")
+        return "UNSUPPORTED_ATTACHMENTS";
     if (phase === "start-turn" || phase === "attach-turn")
         return "TURN_START_FAILED";
     if (phase === "stream-turn" || phase === "await-turn-result")
@@ -536,6 +585,39 @@ function preparePromptAttachments(text, attachments) {
         runtimeAttachments,
     };
 }
+function assertRuntimeAttachmentSupport(session, runtime, attachments) {
+    if (attachments.length === 0)
+        return;
+    if (typeof runtime.listAgents !== "function")
+        return;
+    const profile = runtime.listAgents().find((agent) => agent.id === session.agent || agent.id === session.handle.runtimeSessionName);
+    const support = profile?.attachmentSupport;
+    const firstUnsupported = attachments.find((attachment) => !runtimeAttachmentSupported(attachment, support));
+    if (!firstUnsupported) {
+        if (support?.maxCount !== undefined && attachments.length > support.maxCount) {
+            throw new Error(`${agentLabel(profile, session)} supports at most ${support.maxCount} runtime attachments; this turn has ${attachments.length}.`);
+        }
+        return;
+    }
+    const kind = firstUnsupported.mediaType.toLowerCase().startsWith("image/") ? "image" : "binary";
+    throw new Error(`${agentLabel(profile, session)} does not support ${kind} prompt attachments yet. Text files are supported and inlined before runtime start.`);
+}
+function runtimeAttachmentSupported(attachment, support) {
+    if (!support)
+        return false;
+    const mediaType = attachment.mediaType.toLowerCase();
+    if (support.mediaTypes && support.mediaTypes.length > 0 && !support.mediaTypes.some((item) => item.toLowerCase() === mediaType)) {
+        return false;
+    }
+    if (support.maxBytes !== undefined && attachment.sizeBytes !== undefined && attachment.sizeBytes > support.maxBytes)
+        return false;
+    if (mediaType.startsWith("image/"))
+        return support.image === true;
+    return support.binary === true;
+}
+function agentLabel(profile, session) {
+    return profile?.label || session.agent || session.handle.runtimeSessionName || "This runtime";
+}
 function decodeTextAttachment(attachment) {
     const mediaType = attachment.mediaType.toLowerCase();
     const textLike = mediaType.startsWith("text/") ||

package/apps/daemon/dist/types.d.ts

@@ -56,6 +56,9 @@ export type SessionMetadata = {
     providerName?: string;
     model?: string;
     requestedRuntimeName?: string;
+    hiddenFromWorkspace?: boolean;
+    visibility?: "hidden";
+    source?: string;
     permissionMode?: PermissionMode;
     importedFromRuntimeSessionId?: string;
     importedSummary?: string;

package/apps/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-daemon",
-  "version": "0.1.0-beta.259",
+  "version": "0.1.0-beta.267",
   "private": true,
   "type": "module"
 }

package/apps/relay/dist/http-routes.js

@@ -114,16 +114,18 @@ function canonicalHistoricalEventKey(row) {
 }
 function workspaceSyncState(context, accountId) {
     const stars = context.db
-        .prepare(`SELECT session_id, starred_at
+        .prepare(`SELECT session_stars.session_id, session_stars.starred_at
        FROM session_stars
-       WHERE account_id = ?
-       ORDER BY starred_at DESC, session_id ASC`)
+       JOIN sessions ON sessions.account_id = session_stars.account_id AND sessions.id = session_stars.session_id
+       WHERE session_stars.account_id = ? AND sessions.status != 'closed'
+       ORDER BY session_stars.starred_at DESC, session_stars.session_id ASC`)
         .all(accountId);
     const recentSessions = context.db
-        .prepare(`SELECT session_id, last_selected_at
+        .prepare(`SELECT account_recent_sessions.session_id, account_recent_sessions.last_selected_at
        FROM account_recent_sessions
-       WHERE account_id = ?
-       ORDER BY last_selected_at DESC, session_id ASC`)
+       JOIN sessions ON sessions.account_id = account_recent_sessions.account_id AND sessions.id = account_recent_sessions.session_id
+       WHERE account_recent_sessions.account_id = ? AND sessions.status != 'closed'
+       ORDER BY account_recent_sessions.last_selected_at DESC, account_recent_sessions.session_id ASC`)
         .all(accountId);
     const cwdPins = context.db
         .prepare(`SELECT machine_id, cwd, label, pinned_at
@@ -159,12 +161,15 @@ function workspaceSyncState(context, accountId) {
 function isMemoryMode(value) {
     return value === "off" || value === "readonly" || value === "readwrite";
 }
-function assertWorkspaceSession(context, accountId, sessionId) {
+function assertWorkspaceSession(context, accountId, sessionId, options = {}) {
     const row = context.db
-        .prepare("SELECT id FROM sessions WHERE account_id = ? AND id = ?")
+        .prepare("SELECT id, status FROM sessions WHERE account_id = ? AND id = ?")
         .get(accountId, sessionId);
     if (!row)
         throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+    if (row.status === "closed" && options.allowClosed !== true) {
+        throw new HttpError(409, "SESSION_CLOSED", "Closed sessions are not part of the active workspace");
+    }
 }
 export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
     app.get("/health", async () => ({ ok: true, service: "happy-elves-relay" }));
@@ -540,7 +545,7 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
     app.post("/api/workspace-sync/session-star", async (request) => {
         const token = context.requireFullControllerToken(request.headers.authorization);
         const body = workspaceSessionStarSchema.parse(request.body);
-        assertWorkspaceSession(context, token.account_id, body.sessionId);
+        assertWorkspaceSession(context, token.account_id, body.sessionId, { allowClosed: !body.starred });
         const ts = context.now();
         if (body.starred) {
             context.db

package/apps/relay/dist/projections.js

@@ -46,6 +46,32 @@ function agentModelOptions(value) {
     });
     return models.length > 0 ? models : undefined;
 }
+function positiveInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}
+function attachmentSupport(value) {
+    if (!isRecord(value))
+        return undefined;
+    const mediaTypes = Array.isArray(value.mediaTypes)
+        ? value.mediaTypes.flatMap((item) => typeof item === "string" && item.trim() ? [item.trim()] : [])
+        : undefined;
+    const support = {};
+    if (typeof value.text === "boolean")
+        support.text = value.text;
+    if (typeof value.image === "boolean")
+        support.image = value.image;
+    if (typeof value.binary === "boolean")
+        support.binary = value.binary;
+    const maxCount = positiveInteger(value.maxCount);
+    const maxBytes = positiveInteger(value.maxBytes);
+    if (maxCount !== undefined)
+        support.maxCount = maxCount;
+    if (maxBytes !== undefined)
+        support.maxBytes = maxBytes;
+    if (mediaTypes && mediaTypes.length > 0)
+        support.mediaTypes = [...new Set(mediaTypes)];
+    return Object.keys(support).length > 0 ? support : undefined;
+}
 export function normalizeMachineCapabilities(value) {
     const record = isRecord(value) ? value : {};
     const agents = Array.isArray(record.agents)
@@ -55,6 +81,7 @@ export function normalizeMachineCapabilities(value) {
             const agentHistoryModel = historyModel(agent.historyModel);
             const defaultModel = stringField(agent.defaultModel);
             const models = agentModelOptions(agent.models);
+            const support = attachmentSupport(agent.attachmentSupport);
             return [{
                     id: agent.id,
                     label: agent.label,
@@ -62,6 +89,7 @@ export function normalizeMachineCapabilities(value) {
                     ...(agentHistoryModel ? { historyModel: agentHistoryModel } : {}),
                     ...(defaultModel ? { defaultModel } : {}),
                     ...(models ? { models } : {}),
+                    ...(support ? { attachmentSupport: support } : {}),
                     ...(isRecord(agent.sessionPrimitives)
                         ? {
                             sessionPrimitives: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves",
-  "version": "0.1.0-beta.259",
+  "version": "0.1.0-beta.267",
   "description": "Remote controller for local coding agents with hosted or self-hosted relay support.",
   "type": "module",
   "bin": {

package/packages/agent-sdk/dist/index.d.ts

@@ -10,9 +10,18 @@ export type AgentCapability = {
         fork: PrimitiveSupport;
         rename?: PrimitiveSupport;
     };
+    attachments?: AttachmentSupport;
     permissionModes?: PermissionMode[];
     history?: boolean;
 };
+export type AttachmentSupport = {
+    text?: boolean;
+    image?: boolean;
+    binary?: boolean;
+    maxCount?: number;
+    maxBytes?: number;
+    mediaTypes?: string[];
+};
 export type AgentProfile = {
     id: string;
     label: string;

package/packages/client/dist/client.js

@@ -199,7 +199,9 @@ export class ControllerClient {
                 ...(requestedRuntimeName ? { requestedRuntimeName } : {}),
                 createdFrom: input.createdFrom ?? "cli",
                 createRequestId: requestId,
+                ...(input.hiddenFromWorkspace ? { hiddenFromWorkspace: true, visibility: "hidden" } : {}),
                 permissionMode: input.permissionMode,
+                ...(input.source ? { source: input.source } : {}),
             }),
         });
         return { ...result, requestId };

package/packages/client/dist/types.d.ts

@@ -242,8 +242,10 @@ export type CreateSessionInput = {
     name: string;
     runtimeName?: string;
     createdFrom?: string;
+    hiddenFromWorkspace?: boolean;
     permissionMode?: PermissionMode;
     model?: string;
+    source?: string;
 };
 export type RunOptions = {
     wait?: boolean;

package/packages/runtime/dist/index.d.ts

@@ -21,6 +21,14 @@ export type RuntimeTurnAttachment = {
     sizeBytes?: number;
     data: string;
 };
+export type RuntimeAttachmentSupport = {
+    text?: boolean;
+    image?: boolean;
+    binary?: boolean;
+    maxCount?: number;
+    maxBytes?: number;
+    mediaTypes?: string[];
+};
 export type RuntimeModelOption = {
     id: string;
     label?: string;
@@ -137,6 +145,7 @@ export type RuntimeAgentProfile = {
     historyModel?: RuntimeHistoryModel;
     defaultModel?: string;
     models?: RuntimeModelOption[];
+    attachmentSupport?: RuntimeAttachmentSupport;
     sessionPrimitives?: RuntimeCapabilities["sessionPrimitives"];
 };
 export type RuntimeHistoricalSession = {

package/packages/runtime-cli/dist/codex-app-server.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimeModelOption, RuntimePromptMode, RuntimeTurn } from "../../runtime/dist/index.js";
+import type { RuntimeModelOption, RuntimePromptMode, RuntimeTurn, RuntimeTurnAttachment } from "../../runtime/dist/index.js";
 import type { RuntimePermissionMode } from "./permissions.js";
 export declare class CodexAppServerSession {
     private readonly command;
@@ -32,6 +32,7 @@ export declare class CodexAppServerSession {
     private restartEmptyThread;
     startTurn(input: {
         text: string;
+        attachments?: RuntimeTurnAttachment[];
         requestId: string;
         timeoutMs?: number;
         mode: RuntimePromptMode;

package/packages/runtime-cli/dist/codex-app-server.js

@@ -1,3 +1,6 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, extname, join } from "node:path";
 import { AsyncQueue } from "./async-queue.js";
 import { codexServerRequestResponse } from "./codex-approvals.js";
 import { codexToolEventFromItem } from "./codex-history.js";
@@ -142,7 +145,7 @@ export class CodexAppServerSession {
             queue.close();
             resolveResult(value);
         };
-        this.sendTurn(input.text, input.timeoutMs, input.permissionMode, input.model).catch((error) => {
+        this.sendTurn(input.text, input.attachments ?? [], input.timeoutMs, input.permissionMode, input.model).catch((error) => {
             queue.push({ type: "error", message: error instanceof Error ? error.message : String(error) });
             this.turnResolve?.({ status: "failed", error: { message: error instanceof Error ? error.message : String(error) } });
         });
@@ -239,8 +242,9 @@ export class CodexAppServerSession {
             throw error;
         }
     }
-    async sendTurn(text, inactivityTimeoutMs, permissionMode, model) {
+    async sendTurn(text, attachments, inactivityTimeoutMs, permissionMode, model) {
         const threadId = await this.ensure(permissionMode, model);
+        const localImages = await writeCodexLocalImageAttachments(attachments);
         const completion = new Promise((resolve) => {
             this.activeCompletionResolve = resolve;
         });
@@ -267,7 +271,7 @@ export class CodexAppServerSession {
         this.activeTurnActivity = refreshInactivityTimer;
         refreshInactivityTimer();
         try {
-            const result = (await this.request("turn/start", codexTurnStartParams(threadId, this.cwd, text, normalizeCodexPermissionMode(permissionMode))));
+            const result = (await this.request("turn/start", codexTurnStartParams(threadId, this.cwd, text, normalizeCodexPermissionMode(permissionMode), localImages.images)));
             this.activeTurnId = result.turn?.id ?? null;
             const finalResult = await completion;
             this.turnResolve?.(finalResult);
@@ -276,6 +280,7 @@ export class CodexAppServerSession {
             clearInactivityTimer();
             this.activeTurnActivity = null;
             this.activeCompletionResolve = null;
+            await localImages.cleanup();
         }
     }
     async interrupt() {
@@ -383,9 +388,68 @@ export class CodexAppServerSession {
         return `Codex turn completed without assistant output after runtime errors${detail ? `: ${detail}` : ""}`;
     }
 }
+async function writeCodexLocalImageAttachments(attachments) {
+    if (attachments.length === 0)
+        return { images: [], cleanup: async () => undefined };
+    const unsupported = attachments.filter((attachment) => !attachment.mediaType.toLowerCase().startsWith("image/"));
+    if (unsupported.length > 0) {
+        throw new Error(`Codex app-server only supports image attachments. Unsupported attachment: ${attachmentLabel(unsupported[0])}`);
+    }
+    const unsupportedImage = attachments.find((attachment) => safeImageExtension(attachment) === undefined);
+    if (unsupportedImage) {
+        throw new Error(`Codex app-server does not support this image attachment type yet: ${attachmentLabel(unsupportedImage)}`);
+    }
+    const dir = await mkdtemp(join(tmpdir(), "happy-elves-codex-attachments-"));
+    const images = [];
+    try {
+        for (const [index, attachment] of attachments.entries()) {
+            const extension = safeImageExtension(attachment) ?? ".png";
+            const stem = safeAttachmentStem(attachment.name) || `image-${index + 1}`;
+            const path = join(dir, `${String(index + 1).padStart(2, "0")}-${stem}${extension}`);
+            await writeFile(path, Buffer.from(attachment.data, "base64"));
+            images.push({ path });
+        }
+    }
+    catch (error) {
+        await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+    return {
+        images,
+        cleanup: async () => {
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        },
+    };
+}
+function attachmentLabel(attachment) {
+    return `${attachment.name || "attachment"} (${attachment.mediaType || "unknown"})`;
+}
+function safeAttachmentStem(name) {
+    const base = basename(name || "").replace(/\.[^.]+$/u, "");
+    return base.replace(/[^a-z0-9._-]+/giu, "-").replace(/^-+|-+$/gu, "").slice(0, 64);
+}
+function safeImageExtension(attachment) {
+    const fromName = extname(attachment.name || "").toLowerCase();
+    if (/^\.(png|jpe?g|gif|webp|bmp|tiff?)$/u.test(fromName))
+        return fromName;
+    const mediaType = attachment.mediaType.toLowerCase();
+    if (mediaType.includes("png"))
+        return ".png";
+    if (mediaType.includes("jpeg") || mediaType.includes("jpg"))
+        return ".jpg";
+    if (mediaType.includes("gif"))
+        return ".gif";
+    if (mediaType.includes("webp"))
+        return ".webp";
+    if (mediaType.includes("bmp"))
+        return ".bmp";
+    if (mediaType.includes("tiff"))
+        return ".tiff";
+    return undefined;
+}
 const CODEX_MODEL_LIST_PAGE_LIMIT = 100;
 const CODEX_MODEL_LIST_PAGE_SAFETY_LIMIT = 100;
-const CODEX_PROVIDER_DISCOVERY_TIMEOUT_MS = 5_000;
+const CODEX_PROVIDER_DISCOVERY_TIMEOUT_MS = 20_000;
 export async function discoverCodexRuntimeOptions(input) {
     const discovery = new CodexAppServerSession(input.command, input.cwd);
     const timeoutMs = Math.max(1, input.timeoutMs ?? CODEX_PROVIDER_DISCOVERY_TIMEOUT_MS);

package/packages/runtime-cli/dist/codex-protocol.d.ts

@@ -1,6 +1,9 @@
 import { type RuntimePermissionMode } from "./permissions.js";
+export type CodexTurnLocalImage = {
+    path: string;
+};
 export declare function normalizeCodexPermissionMode(mode?: RuntimePermissionMode): RuntimePermissionMode;
 export declare function codexThreadStartParams(cwd: string, permissionMode: RuntimePermissionMode, model?: string): Record<string, unknown>;
 export declare function codexThreadResumeParams(threadId: string, cwd: string, permissionMode: RuntimePermissionMode, model?: string): Record<string, unknown>;
-export declare function codexTurnStartParams(threadId: string, cwd: string, text: string, permissionMode: RuntimePermissionMode): Record<string, unknown>;
+export declare function codexTurnStartParams(threadId: string, cwd: string, text: string, permissionMode: RuntimePermissionMode, localImages?: CodexTurnLocalImage[]): Record<string, unknown>;
 //# sourceMappingURL=codex-protocol.d.ts.map

package/packages/runtime-cli/dist/codex-protocol.js

@@ -33,11 +33,16 @@ export function codexThreadResumeParams(threadId, cwd, permissionMode, model) {
         persistExtendedHistory: true,
     };
 }
-export function codexTurnStartParams(threadId, cwd, text, permissionMode) {
+export function codexTurnStartParams(threadId, cwd, text, permissionMode, localImages = []) {
+    const input = [];
+    if (text.length > 0 || localImages.length === 0)
+        input.push({ type: "text", text });
+    for (const image of localImages)
+        input.push({ type: "localImage", path: image.path });
     return {
         threadId,
         cwd,
-        input: [{ type: "text", text }],
+        input,
         approvalPolicy: codexApprovalPolicy(permissionMode),
         sandboxPolicy: codexTurnSandboxPolicy(permissionMode),
     };

package/packages/runtime-cli/dist/index.d.ts

@@ -11,5 +11,6 @@ export type CliRuntimeProviderOptions = {
 };
 export declare function createCliRuntimeProvider(options: CliRuntimeProviderOptions): HappyElvesRuntime & {
     initialize(): Promise<void>;
+    diagnostics(): Array<Record<string, unknown>>;
 };
 //# sourceMappingURL=index.d.ts.map

package/packages/runtime-cli/dist/index.js

@@ -15,6 +15,14 @@ export function createCliRuntimeProvider(options) {
     const codexCommand = options.codexCommand ?? process.env.HAPPY_ELVES_CODEX_COMMAND ?? "codex";
     const claudeCommand = options.claudeCommand ?? process.env.HAPPY_ELVES_CLAUDE_COMMAND ?? "claude";
     let codexOptions = codexAgentModels();
+    let codexModelDiscovery = {
+        provider: "cli",
+        component: "codex-model-discovery",
+        status: "not-run",
+        source: codexOptions.models && codexOptions.models.length > 0 ? "fallback" : undefined,
+        modelCount: codexOptions.models?.length ?? 0,
+        ...(codexOptions.defaultModel ? { defaultModel: codexOptions.defaultModel } : {}),
+    };
     const sessions = new CliSessionStore({ cwd: options.cwd, codexCommand });
     const historySnapshotDir = path.join(options.stateDir, "history-snapshots");
     async function listHistoricalSessionPage(input) {
@@ -72,19 +80,70 @@ export function createCliRuntimeProvider(options) {
             const configured = agentModelsFromEnv("HAPPY_ELVES_CODEX");
             if (configured.models && configured.models.length > 0) {
                 codexOptions = configured;
+                codexModelDiscovery = {
+                    provider: "cli",
+                    component: "codex-model-discovery",
+                    status: "configured",
+                    source: "env",
+                    modelCount: configured.models.length,
+                    ...(configured.defaultModel ? { defaultModel: configured.defaultModel } : {}),
+                };
                 return;
             }
+            const startedAt = Date.now();
             const discovered = await discoverCodexRuntimeOptions({
                 command: codexCommand,
                 cwd: options.cwd,
                 timeoutMs: options.codexDiscoveryTimeoutMs,
-            }).catch(() => undefined);
-            codexOptions = discovered?.models && discovered.models.length > 0
-                ? {
+            }).catch((error) => {
+                codexModelDiscovery = {
+                    provider: "cli",
+                    component: "codex-model-discovery",
+                    status: "failed",
+                    source: "provider",
+                    elapsedMs: Date.now() - startedAt,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+                return undefined;
+            });
+            if (discovered?.models && discovered.models.length > 0) {
+                codexOptions = {
                     ...(configured.defaultModel ? { defaultModel: configured.defaultModel } : discovered.defaultModel ? { defaultModel: discovered.defaultModel } : {}),
                     models: discovered.models,
-                }
-                : codexAgentModels();
+                };
+                codexModelDiscovery = {
+                    provider: "cli",
+                    component: "codex-model-discovery",
+                    status: "ok",
+                    source: "provider",
+                    elapsedMs: Date.now() - startedAt,
+                    modelCount: discovered.models.length,
+                    ...(codexOptions.defaultModel ? { defaultModel: codexOptions.defaultModel } : {}),
+                };
+                return;
+            }
+            codexOptions = codexAgentModels();
+            if (codexModelDiscovery.status !== "failed") {
+                codexModelDiscovery = {
+                    provider: "cli",
+                    component: "codex-model-discovery",
+                    status: "failed",
+                    source: "provider",
+                    elapsedMs: Date.now() - startedAt,
+                    error: "Codex provider model/list returned no models",
+                };
+            }
+            if (codexOptions.models && codexOptions.models.length > 0) {
+                codexModelDiscovery = {
+                    ...codexModelDiscovery,
+                    source: "fallback",
+                    modelCount: codexOptions.models.length,
+                    ...(codexOptions.defaultModel ? { defaultModel: codexOptions.defaultModel } : {}),
+                };
+            }
+        },
+        diagnostics() {
+            return [codexModelDiscovery];
         },
         getCapabilities() {
             return {
@@ -95,8 +154,18 @@ export function createCliRuntimeProvider(options) {
         },
         listAgents() {
             return [
-                { id: "codex", label: "Codex", ...codexOptions },
-                { id: "claude", label: "Claude Code", ...agentModelsFromEnv("HAPPY_ELVES_CLAUDE") },
+                {
+                    id: "codex",
+                    label: "Codex",
+                    attachmentSupport: {
+                        text: true,
+                        image: true,
+                        binary: false,
+                        mediaTypes: ["image/png", "image/jpeg", "image/gif", "image/webp", "image/bmp", "image/tiff"],
+                    },
+                    ...codexOptions,
+                },
+                { id: "claude", label: "Claude Code", attachmentSupport: { text: true, image: false, binary: false }, ...agentModelsFromEnv("HAPPY_ELVES_CLAUDE") },
             ];
         },
         async ensureSession(input) {
@@ -157,9 +226,6 @@ export function createCliRuntimeProvider(options) {
         },
         startTurn(input) {
             assertNotExternalProviderHandle(input.handle);
-            if (input.attachments && input.attachments.length > 0) {
-                throw new Error("CLI runtime does not support binary prompt attachments yet. Text attachments are inlined before runtime start; use an external provider with attachment support for images or binary files.");
-            }
             const session = sessions.get(input.handle.sessionKey);
             if (!session)
                 throw new Error(`Runtime session is not loaded: ${input.handle.sessionKey}`);
@@ -173,8 +239,12 @@ export function createCliRuntimeProvider(options) {
                     mode: input.mode,
                     permissionMode: input.permissionMode,
                     model: input.model ?? input.handle.model,
+                    attachments: input.attachments,
                 });
             }
+            if (input.attachments && input.attachments.length > 0) {
+                throw new Error("Claude CLI runtime does not support image or binary prompt attachments yet. Text attachments are inlined before runtime start.");
+            }
             const turn = startClaudeTurn({
                 command: claudeCommand,
                 handle: input.handle,

package/packages/shared/dist/protocol-schemas.d.ts

@@ -28,6 +28,14 @@ export declare const capabilitiesSchema: z.ZodObject<{
             unavailable: z.ZodOptional<z.ZodBoolean>;
             reason: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
+        attachmentSupport: z.ZodOptional<z.ZodObject<{
+            text: z.ZodOptional<z.ZodBoolean>;
+            image: z.ZodOptional<z.ZodBoolean>;
+            binary: z.ZodOptional<z.ZodBoolean>;
+            maxCount: z.ZodOptional<z.ZodNumber>;
+            maxBytes: z.ZodOptional<z.ZodNumber>;
+            mediaTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
         sessionPrimitives: z.ZodOptional<z.ZodObject<{
             resume: z.ZodEnum<{
                 acpx: "acpx";
@@ -108,6 +116,14 @@ export declare const machineSnapshotSchema: z.ZodObject<{
                 unavailable: z.ZodOptional<z.ZodBoolean>;
                 reason: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>>;
+            attachmentSupport: z.ZodOptional<z.ZodObject<{
+                text: z.ZodOptional<z.ZodBoolean>;
+                image: z.ZodOptional<z.ZodBoolean>;
+                binary: z.ZodOptional<z.ZodBoolean>;
+                maxCount: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                mediaTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
             sessionPrimitives: z.ZodOptional<z.ZodObject<{
                 resume: z.ZodEnum<{
                     acpx: "acpx";

package/packages/shared/dist/protocol-schemas.js

@@ -24,6 +24,14 @@ const agentProfileSchema = z.object({
         unavailable: z.boolean().optional(),
         reason: z.string().min(1).optional(),
     })).optional(),
+    attachmentSupport: z.object({
+        text: z.boolean().optional(),
+        image: z.boolean().optional(),
+        binary: z.boolean().optional(),
+        maxCount: z.number().int().positive().optional(),
+        maxBytes: z.number().int().positive().optional(),
+        mediaTypes: z.array(z.string().min(1)).optional(),
+    }).optional(),
     sessionPrimitives: z.object({
         resume: z.enum(["acpx", "native", "checkpoint", "unsupported"]),
         rewind: z.enum(["acpx", "native", "checkpoint", "unsupported"]),

package/packages/shared/dist/protocol-types.d.ts

@@ -11,6 +11,14 @@ export type AgentProfile = {
         unavailable?: boolean;
         reason?: string;
     }>;
+    attachmentSupport?: {
+        text?: boolean;
+        image?: boolean;
+        binary?: boolean;
+        maxCount?: number;
+        maxBytes?: number;
+        mediaTypes?: string[];
+    };
     sessionPrimitives?: {
         resume: "acpx" | "native" | "checkpoint" | "unsupported";
         rewind: "acpx" | "native" | "checkpoint" | "unsupported";