@desplega.ai/agent-swarm 1.108.0 → 1.108.2

package/dist/{index-6sgpkhby.js → index-c9tx34ke.js}

@@ -3,14 +3,14 @@ import {
   extractArgsJsonSchema,
   extractScriptSignature,
   typecheckScript
-} from "./cli-xy83cmfc.js";
+} from "./cli-4wrdrmr3.js";
 import {
   getScript,
   upsertScriptByName,
   validateScriptImports
-} from "./cli-3cfvx630.js";
-import"./cli-cya9knf9.js";
-import"./cli-vhpa5j27.js";
+} from "./cli-b7ytq2z8.js";
+import"./cli-hc7hxy2m.js";
+import"./cli-5m4da9px.js";
 import"./cli-q25ejbyn.js";
 import {
   computeContentHash,
@@ -19,11 +19,11 @@ import {
   getSkillByName,
   init_db,
   updateSkill
-} from "./cli-9wv4e7qs.js";
+} from "./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{index-rys8ctm6.js → index-vgvvr6yk.js}

@@ -20,21 +20,21 @@ import {
   stopWaitPoller,
   subscribeWaitToBus,
   validateTemplateVariables
-} from "./cli-psz2xq0n.js";
+} from "./cli-er5kffrx.js";
 import"./cli-f14fvzag.js";
-import"./cli-3cfvx630.js";
-import"./cli-cya9knf9.js";
-import"./cli-vhpa5j27.js";
+import"./cli-b7ytq2z8.js";
+import"./cli-hc7hxy2m.js";
+import"./cli-5m4da9px.js";
 import"./cli-q25ejbyn.js";
-import"./cli-a0w6tqyc.js";
+import"./cli-3p0e74xv.js";
 import"./cli-dh55d5fg.js";
 import {
   interpolate
-} from "./cli-9wv4e7qs.js";
+} from "./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import {
   workflowEventBus

package/dist/{keepalive-b6eax0y0.js → keepalive-pjd1kjv7.js}

@@ -1,11 +1,11 @@
 import {
   ensureTokenOrThrow
-} from "./cli-tehpf2fm.js";
-import"./cli-9wv4e7qs.js";
+} from "./cli-cr2wze6h.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import {
   __require
@@ -54,7 +54,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-0mcf7mwz.js");
+    const { getSlackApp } = await import("./app-vn2sy15m.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[OAuth Keepalive] Slack not available, cannot send notification");

package/dist/{lead-v1g4j7he.js → lead-czd1xgxr.js}

@@ -1,6 +1,6 @@
 import {
   runAgent
-} from "./cli-a8gkr14c.js";
+} from "./cli-bz6qha8p.js";
 import"./cli-w6zp4qcx.js";
 import"./cli-m3enfr8q.js";
 import"./cli-amncg1dq.js";
@@ -15,7 +15,7 @@ import"./cli-d6n0thxw.js";
 import"./cli-hx1dcevq.js";
 import {
   getEnabledCapabilities
-} from "./cli-gx7gnvha.js";
+} from "./cli-xekgq1r8.js";
 import"./cli-1z7048dy.js";
 import"./cli-dcfyyh3t.js";
 import"./cli-gz9sbyk3.js";
@@ -25,32 +25,32 @@ import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
 import"./cli-tghre7g6.js";
 import"./cli-tkmm5nf9.js";
-import"./cli-tehpf2fm.js";
-import"./cli-75b0wmer.js";
-import"./cli-entbgsd5.js";
-import"./cli-h2qhdwhr.js";
+import"./cli-cr2wze6h.js";
+import"./cli-nt60dmfm.js";
+import"./cli-b4hwyzev.js";
+import"./cli-27pxayz8.js";
 import"./cli-fad8m16k.js";
-import"./cli-1zs2dm5w.js";
-import"./cli-psz2xq0n.js";
+import"./cli-6z0y1339.js";
+import"./cli-er5kffrx.js";
 import"./cli-f14fvzag.js";
-import"./cli-3cfvx630.js";
-import"./cli-cya9knf9.js";
-import"./cli-vhpa5j27.js";
+import"./cli-b7ytq2z8.js";
+import"./cli-hc7hxy2m.js";
+import"./cli-5m4da9px.js";
 import"./cli-q25ejbyn.js";
-import"./cli-nmt32dxp.js";
-import"./cli-kppbkzj4.js";
+import"./cli-9zz27c9g.js";
+import"./cli-gg6zxrx1.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-mmaz2btq.js";
+import"./cli-fxk0as0h.js";
 import"./cli-6xd0bvf8.js";
 import"./cli-wspgs9bt.js";
-import"./cli-a0w6tqyc.js";
+import"./cli-3p0e74xv.js";
 import"./cli-dh55d5fg.js";
-import"./cli-9wv4e7qs.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/dist/{maintenance-xwf1vf0v.js → maintenance-xjqt3ne7.js}

@@ -1,13 +1,13 @@
 import {
   reembedAllScripts
-} from "./cli-cya9knf9.js";
-import"./cli-vhpa5j27.js";
+} from "./cli-hc7hxy2m.js";
+import"./cli-5m4da9px.js";
 import"./cli-q25ejbyn.js";
-import"./cli-9wv4e7qs.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{onboard-vy0z8b11.js → onboard-whf6w0mr.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-mkn2ryba.js";
+} from "./cli-8gtrpqcw.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-apdrt1ch.js";
+} from "./cli-tc19ec02.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-94sm94jm.js → otel-impl-9n4p19tt.js}

@@ -6,7 +6,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-apdrt1ch.js";
+} from "./cli-tc19ec02.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{pricing-refresh-an9bxjcd.js → pricing-refresh-wg80me14.js}

@@ -2,13 +2,13 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-75b0wmer.js";
-import"./cli-entbgsd5.js";
-import"./cli-9wv4e7qs.js";
+} from "./cli-nt60dmfm.js";
+import"./cli-b4hwyzev.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{seed-pricing-3t22x5ax.js → seed-pricing-garwba27.js}

@@ -1,12 +1,12 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-entbgsd5.js";
-import"./cli-9wv4e7qs.js";
+} from "./cli-b4hwyzev.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{setup-8hd3jk8s.js → setup-dktff2q2.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-mkn2ryba.js";
+} from "./cli-8gtrpqcw.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-s0xm8naj.js → worker-t26gwn0n.js}

@@ -1,6 +1,6 @@
 import {
   runAgent
-} from "./cli-a8gkr14c.js";
+} from "./cli-bz6qha8p.js";
 import"./cli-w6zp4qcx.js";
 import"./cli-m3enfr8q.js";
 import"./cli-amncg1dq.js";
@@ -15,7 +15,7 @@ import"./cli-d6n0thxw.js";
 import"./cli-hx1dcevq.js";
 import {
   getEnabledCapabilities
-} from "./cli-gx7gnvha.js";
+} from "./cli-xekgq1r8.js";
 import"./cli-1z7048dy.js";
 import"./cli-dcfyyh3t.js";
 import"./cli-gz9sbyk3.js";
@@ -25,32 +25,32 @@ import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
 import"./cli-tghre7g6.js";
 import"./cli-tkmm5nf9.js";
-import"./cli-tehpf2fm.js";
-import"./cli-75b0wmer.js";
-import"./cli-entbgsd5.js";
-import"./cli-h2qhdwhr.js";
+import"./cli-cr2wze6h.js";
+import"./cli-nt60dmfm.js";
+import"./cli-b4hwyzev.js";
+import"./cli-27pxayz8.js";
 import"./cli-fad8m16k.js";
-import"./cli-1zs2dm5w.js";
-import"./cli-psz2xq0n.js";
+import"./cli-6z0y1339.js";
+import"./cli-er5kffrx.js";
 import"./cli-f14fvzag.js";
-import"./cli-3cfvx630.js";
-import"./cli-cya9knf9.js";
-import"./cli-vhpa5j27.js";
+import"./cli-b7ytq2z8.js";
+import"./cli-hc7hxy2m.js";
+import"./cli-5m4da9px.js";
 import"./cli-q25ejbyn.js";
-import"./cli-nmt32dxp.js";
-import"./cli-kppbkzj4.js";
+import"./cli-9zz27c9g.js";
+import"./cli-gg6zxrx1.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-mmaz2btq.js";
+import"./cli-fxk0as0h.js";
 import"./cli-6xd0bvf8.js";
 import"./cli-wspgs9bt.js";
-import"./cli-a0w6tqyc.js";
+import"./cli-3p0e74xv.js";
 import"./cli-dh55d5fg.js";
-import"./cli-9wv4e7qs.js";
+import"./cli-6jf8xfnt.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-apdrt1ch.js";
+import"./cli-tc19ec02.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.108.0",
+    "version": "1.108.2",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.108.0",
+  "version": "1.108.2",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",

package/plugin/skills/download-task-attachment/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: download-task-attachment
+description: Fetch a file attached to your current task in ONE call. Use whenever a task carries an attachment (an image, PDF, or other file the requester uploaded) and you need its bytes on disk — the dispatch prompt lists attachments with a ready-to-run curl command, but if you're improvising (resumed session, follow-up task, or the recipe scrolled out of context) use this skill instead of reaching for the `agent-fs` CLI directly.
+---
+
+# Download a Task Attachment
+
+Task attachments (files uploaded via the UI or API onto a task) are served
+through a single **provider-agnostic** REST route — regardless of whether the
+backing storage is `local-fs` or `agent-fs`. You do not need to know or care
+which provider is active, and you do not need `agent-fs org`/`agent-fs drive`
+discovery.
+
+## The one-call recipe
+
+```bash
+curl "$MCP_BASE_URL/api/fs/tasks/$AGENT_SWARM_TASK_ID/files/<attachmentId>/raw" \
+  -H "X-Agent-ID: $AGENT_ID" \
+  -H "Authorization: Bearer ${AGENT_SWARM_API_KEY:-$API_KEY}" \
+  -o /tmp/<name>
+```
+
+- `$MCP_BASE_URL`, `$AGENT_ID`, `$AGENT_SWARM_TASK_ID` (or `$AGENT_SWARM_AGENT_ID`/`TASK_FILE`-derived taskId), and `$AGENT_SWARM_API_KEY`/`$API_KEY` are already present in every worker container's env — no new plumbing needed.
+- `<attachmentId>` and `<name>`/`mimeType` come from the task's attachment list (see below).
+- The route resolves the active file-storage provider (`local-fs` in dev, `agent-fs` in prod) server-side and streams the raw bytes back with the correct `Content-Type` — you get one call no matter which provider is behind it.
+
+## Finding the attachment ID
+
+If the dispatch prompt already injected an `## Attachments` section with the
+curl command pre-filled, just run it — that's the fast path (see
+`buildAttachmentsSection()` in `src/commands/runner.ts`).
+
+Otherwise, pull it from the task:
+
+```
+get-task-details taskId=<your task id>
+```
+
+The response includes an `attachments` array: `{id, name, mimeType, sizeBytes}`.
+Use `id` as `<attachmentId>` in the curl above.
+
+## Why not the `agent-fs` CLI directly?
+
+`agent-fs` is a general-purpose CLI for the swarm's own agent-fs filesystem —
+it requires you to already know the org/drive a file lives in, and task
+attachments don't always carry that (older rows, or attachments stored via
+`local-fs` in dev have no org/drive at all). Reaching for `agent-fs cat` /
+`agent-fs download` on a task attachment means guessing subcommand names,
+discovering the right org via `agent-fs org list`, and re-trying — several
+tool calls where one `curl` suffices. This was root-caused from a real
+session that burned 7 tool calls (~64s) doing exactly that detour before
+succeeding; see `runbooks/harness-providers.md` and PR that added
+`buildAttachmentsSection()` for the full trace.
+
+## Gotchas
+
+- The route requires `X-Agent-ID` + bearer auth like any other swarm API call — same headers you'd use for any MCP-adjacent REST call.
+- `mimeType` on the attachment record reflects the real upload `Content-Type` (not a filename-extension guess) — trust it when deciding how to handle the downloaded bytes (image vs PDF vs text).
+- If you get a 404, double-check you're using the **attachment ID** (from `attachments[].id`), not the display `name`.

package/src/be/seed/agent-fs-provision.ts

@@ -32,6 +32,12 @@ type InviteTarget = {
   role: Role;
 };
 
+type OrgMember = {
+  email?: string | null;
+  role?: string | null;
+  user?: { email?: string | null } | null;
+};
+
 type FetchLike = typeof fetch;
 
 // The provision seeder runs synchronously before the HTTP server binds its port.
@@ -92,8 +98,15 @@ async function provisionAgentFs(item: AgentFsSeedItem): Promise<void> {
     apiUrl: item.apiUrl,
     registerEmail: item.registerEmail,
   });
+  const currentRoles = await getCurrentOrgMemberRoles(
+    item.apiUrl,
+    shared.authHeaders,
+    shared.orgId,
+  );
 
   for (const invite of item.invites) {
+    const currentRole = currentRoles.get(invite.email.toLowerCase());
+    if (currentRole && roleRank(currentRole) >= roleRank(invite.role)) continue;
     await inviteToSharedOrg(item.apiUrl, shared.authHeaders, shared.orgId, invite);
   }
 
@@ -212,7 +225,11 @@ export async function ensureAgentFsCredentialsForAgent(agentId: string): Promise
   const apiKey = registered.apiKey ?? "";
   if (!apiKey) throw new Error(`agent-fs registration did not return an apiKey for ${agentId}`);
 
-  await inviteToSharedOrg(apiUrl, shared.authHeaders, shared.orgId, { email, role: "editor" });
+  const currentRoles = await getCurrentOrgMemberRoles(apiUrl, shared.authHeaders, shared.orgId);
+  const currentRole = currentRoles.get(email.toLowerCase());
+  if (!currentRole || roleRank(currentRole) < roleRank("editor")) {
+    await inviteToSharedOrg(apiUrl, shared.authHeaders, shared.orgId, { email, role: "editor" });
+  }
 
   upsertSwarmConfig({
     scope: "agent",
@@ -309,6 +326,36 @@ async function inviteToSharedOrg(
   }
 }
 
+async function getCurrentOrgMemberRoles(
+  apiUrl: string,
+  headers: Record<string, string>,
+  orgId: string,
+): Promise<Map<string, Role>> {
+  const response = await agentFsRequest<{ members?: OrgMember[] }>(
+    apiUrl,
+    `/orgs/${encodeURIComponent(orgId)}/members`,
+    { headers },
+  );
+  const roles = new Map<string, Role>();
+
+  for (const member of response.members ?? []) {
+    const email = (member.email ?? member.user?.email ?? "").trim().toLowerCase();
+    const role = normalizeRole(member.role);
+    if (email && role) roles.set(email, role);
+  }
+
+  return roles;
+}
+
+function normalizeRole(role: string | null | undefined): Role | null {
+  if (role === "viewer" || role === "editor" || role === "admin") return role;
+  return null;
+}
+
+function roleRank(role: Role): number {
+  return { viewer: 0, editor: 1, admin: 2 }[role];
+}
+
 async function agentFsRequest<T = unknown>(
   apiUrl: string,
   path: string,
@@ -363,15 +410,15 @@ function resolveInviteTargets(): InviteTarget[] {
 
   for (const user of getAllUsers()) {
     if (!user.email) continue;
-    const role = isOperatorRole(user.role) ? "editor" : "viewer";
+    const role = isExplicitViewerRole(user.role) ? "viewer" : "editor";
     targets.set(user.email.toLowerCase(), { email: user.email, role });
   }
 
   return [...targets.values()].sort((a, b) => a.email.localeCompare(b.email));
 }
 
-function isOperatorRole(role: string | undefined): boolean {
-  return /\b(admin|operator|owner|lead)\b/i.test(role ?? "");
+function isExplicitViewerRole(role: string | undefined): boolean {
+  return /\b(viewer|read[-\s]?only|guest)\b/i.test(role ?? "");
 }
 
 function provisionHashFromCurrentState(): string {

package/src/commands/runner.ts

@@ -2289,6 +2289,43 @@ async function pollForTriggerOnce(opts: PollOptions): Promise<Trigger | null> {
   return null; // Timeout reached, no trigger found
 }
 
+/**
+ * Build a ready-to-run fetch recipe for each task attachment, so the agent
+ * can download the bytes in one call via the provider-agnostic
+ * `/api/fs/tasks/{taskId}/files/{attachmentId}/raw` route — instead of having
+ * to discover the file's storage provider/org/drive itself (e.g. guessing at
+ * the `agent-fs` CLI with no org context). MCP_BASE_URL/API_KEY/AGENT_ID are
+ * already present in every worker container's env.
+ */
+export function buildAttachmentsSection(
+  taskId: string | undefined,
+  attachmentsRaw: unknown,
+): string {
+  if (!taskId || !Array.isArray(attachmentsRaw) || attachmentsRaw.length === 0) return "";
+
+  const lines = attachmentsRaw
+    .filter((a): a is Record<string, unknown> => !!a && typeof a === "object")
+    .map((a) => {
+      const id = typeof a.id === "string" ? a.id : undefined;
+      const name = typeof a.name === "string" ? a.name : id;
+      if (!id || !name) return null;
+      const details = [
+        typeof a.mimeType === "string" ? a.mimeType : null,
+        typeof a.sizeBytes === "number" ? `${a.sizeBytes} bytes` : null,
+      ]
+        .filter(Boolean)
+        .join(", ");
+      const url = `$MCP_BASE_URL/api/fs/tasks/${taskId}/files/${id}/raw`;
+      const cmd = `curl -s -H "Authorization: Bearer \${AGENT_SWARM_API_KEY:-$API_KEY}" -H "X-Agent-ID: $AGENT_ID" "${url}" -o /tmp/${name}`;
+      return `- ${name}${details ? ` (${details})` : ""}: \`${cmd}\``;
+    })
+    .filter((line): line is string => line !== null);
+
+  if (lines.length === 0) return "";
+
+  return `\n\n📎 Attachment(s) — fetch directly, no need to discover the storage path yourself:\n${lines.join("\n")}`;
+}
+
 /** Build prompt based on trigger type */
 async function buildPromptForTrigger(
   trigger: Trigger,
@@ -2325,10 +2362,13 @@ async function buildPromptForTrigger(
         ? `\n\nRequested by: ${requestedBy.name}${requestedBy.email ? ` (${requestedBy.email})` : ""}`
         : "";
 
+      const attachmentsSection = buildAttachmentsSection(trigger.taskId, taskObj?.attachments);
+
       const result = await resolveTemplateAsync("task.trigger.assigned", {
         work_on_task_cmd: hasMcp ? fmt("work-on-task") : "",
         task_id: hasMcp ? trigger.taskId : "",
         task_desc_section: taskDescSection + requestedBySection,
+        attachments_section: attachmentsSection,
         output_instructions: outputInstructions,
       });
       return result.text;

package/src/commands/templates.ts

@@ -17,11 +17,16 @@ import { registerTemplate } from "../prompts/registry";
 registerTemplate({
   eventType: "task.trigger.assigned",
   header: "",
-  defaultBody: `{{work_on_task_cmd}} {{task_id}}{{task_desc_section}}{{output_instructions}}`,
+  defaultBody: `{{work_on_task_cmd}} {{task_id}}{{task_desc_section}}{{attachments_section}}{{output_instructions}}`,
   variables: [
     { name: "work_on_task_cmd", description: "Formatted /work-on-task command" },
     { name: "task_id", description: "Task ID" },
     { name: "task_desc_section", description: "Task description section or empty string" },
+    {
+      name: "attachments_section",
+      description:
+        "Ready-to-run fetch recipe per task attachment (or empty string if none) — lets the agent download an attachment in one call instead of discovering the path/provider itself",
+    },
     {
       name: "output_instructions",
       description:

package/src/fs/local-fs-provider.ts

@@ -37,6 +37,12 @@ export class LocalFsProvider implements FileStorageProvider {
     }
 
     await Bun.write(target, await new Response(body).arrayBuffer());
+    // Persist the real upload Content-Type alongside the blob — `Bun.file(target).type`
+    // only guesses from the storage path's extension, which is wrong whenever the
+    // stored key doesn't carry the original filename's extension (see head()).
+    if (options.contentType) {
+      await Bun.write(this.metaPath(target), JSON.stringify({ contentType: options.contentType }));
+    }
     return this.head(scope);
   }
 
@@ -52,12 +58,16 @@ export class LocalFsProvider implements FileStorageProvider {
     const target = this.localPath(scope);
     try {
       const info = await stat(target);
+      const storedContentType = await this.readStoredContentType(target);
       return {
         providerId: this.id,
         key: providerPath(scope),
         taskId: scope.taskId,
         name: scope.name,
-        contentType: Bun.file(target).type || undefined,
+        // Prefer the Content-Type recorded at upload time; fall back to
+        // extension-based sniffing only for files that predate the sidecar
+        // metadata (or were written directly on disk without going through upload()).
+        contentType: storedContentType ?? Bun.file(target).type ?? undefined,
         sizeBytes: info.size,
         updatedAt: info.mtime.toISOString(),
       };
@@ -82,12 +92,17 @@ export class LocalFsProvider implements FileStorageProvider {
   }
 
   async delete(scope: FileScope): Promise<void> {
-    await rm(this.localPath(scope), { force: true });
+    const target = this.localPath(scope);
+    await rm(target, { force: true });
+    await rm(this.metaPath(target), { force: true });
   }
 
   async copy(source: FileScope, destination: FileScope): Promise<FileObject> {
+    const sourceHead = await this.head(source);
     const response = await this.download(source);
-    await this.upload(destination, await response.arrayBuffer());
+    await this.upload(destination, await response.arrayBuffer(), {
+      contentType: sourceHead.contentType,
+    });
     return this.head(destination);
   }
 
@@ -133,6 +148,23 @@ export class LocalFsProvider implements FileStorageProvider {
     return join(this.rootDir, providerPath(scope));
   }
 
+  private metaPath(target: string): string {
+    return `${target}.meta.json`;
+  }
+
+  private async readStoredContentType(target: string): Promise<string | undefined> {
+    try {
+      const metaFile = Bun.file(this.metaPath(target));
+      if (!(await metaFile.exists())) {
+        return undefined;
+      }
+      const meta = await metaFile.json();
+      return typeof meta?.contentType === "string" ? meta.contentType : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
   private async walk(dir: string, visit: (path: string) => Promise<void>): Promise<void> {
     let entries: import("node:fs").Dirent<string>[];
     try {
@@ -148,7 +180,7 @@ export class LocalFsProvider implements FileStorageProvider {
       const path = join(dir, entry.name);
       if (entry.isDirectory()) {
         await this.walk(path, visit);
-      } else if (entry.isFile()) {
+      } else if (entry.isFile() && !entry.name.endsWith(".meta.json")) {
         await visit(path);
       }
     }