@hachej/boring-agent 0.1.48 → 0.1.50

package/dist/{chunk-HEEJSOFF.js → chunk-G6YPXDHR.js}

@@ -170,7 +170,8 @@ var BoringChatPartSchema = z2.discriminatedUnion("type", [
     id: z2.string().optional(),
     filename: z2.string().optional(),
     mediaType: z2.string().optional(),
-    url: z2.string().optional()
+    url: z2.string().optional(),
+    path: z2.string().optional()
   }),
   z2.object({
     type: z2.literal("notice"),

package/dist/front/index.d.ts

@@ -1,10 +1,10 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
-import { ReactNode, ComponentType, HTMLAttributes, ComponentProps, FormEvent } from 'react';
-import { FileUIPart, UIMessage, ChatStatus } from 'ai';
-import { T as ToolUiMetadata, B as BoringChatPart, d as BoringChatMessage, m as PiChatStatus, r as QueuedUserMessage, C as ChatError, P as PiChatEvent, o as PromptPayload, p as PromptReceipt, F as FollowUpPayload, i as FollowUpReceipt, Q as QueueClearPayload, q as QueueClearReceipt, I as InterruptPayload, e as CommandReceipt, S as StopPayload, s as StopReceipt } from '../piChatEvent-DNKo77Xw.js';
+import { ComponentProps, HTMLAttributes, FormEvent, ReactNode, ComponentType } from 'react';
+import { FileUIPart, ChatStatus, UIMessage } from 'ai';
+import { T as ToolUiMetadata, B as BoringChatPart, d as BoringChatMessage, m as PiChatStatus, r as QueuedUserMessage, C as ChatError, P as PiChatEvent, o as PromptPayload, p as PromptReceipt, F as FollowUpPayload, i as FollowUpReceipt, Q as QueueClearPayload, q as QueueClearReceipt, I as InterruptPayload, e as CommandReceipt, S as StopPayload, s as StopReceipt } from '../piChatEvent-B6GDifo2.js';
 import { e as SessionSummary } from '../chatSubmitPayload-DHqQL2wD.js';
-import { Button, Collapsible, CollapsibleContent, CollapsibleTrigger, InputGroupAddon, InputGroupButton, InputGroupTextarea } from '@hachej/boring-ui-kit';
+import { InputGroupAddon, InputGroupButton, InputGroupTextarea, Button, Collapsible, CollapsibleContent, CollapsibleTrigger } from '@hachej/boring-ui-kit';
 import { Streamdown } from 'streamdown';
 import { StickToBottom } from 'use-stick-to-bottom';
 import { ClassValue } from 'clsx';
@@ -15,6 +15,7 @@ interface UploadFileOptions {
     workspaceRequestId?: string | null;
     directory?: string;
     sourcePath?: string;
+    responseUrl?: 'markdown' | 'raw';
     fetch?: typeof globalThis.fetch;
 }
 interface UploadFileResult {
@@ -23,6 +24,45 @@ interface UploadFileResult {
 }
 declare function uploadFile(file: File, opts?: UploadFileOptions): Promise<UploadFileResult>;
 
+type PromptInputFilePart = FileUIPart & {
+    path?: string;
+};
+
+type PromptInputFooterProps = ComponentProps<typeof InputGroupAddon>;
+declare const PromptInputFooter: ({ align, className, ...props }: PromptInputFooterProps) => react_jsx_runtime.JSX.Element;
+
+interface PromptInputMessage {
+    text: string;
+    files: PromptInputFilePart[];
+}
+type PromptInputProps = Omit<HTMLAttributes<HTMLFormElement>, "onSubmit" | "onError"> & {
+    accept?: string;
+    multiple?: boolean;
+    globalDrop?: boolean;
+    syncHiddenInput?: boolean;
+    maxFiles?: number;
+    maxFileSize?: number;
+    onError?: (err: {
+        code: "max_files" | "max_file_size" | "accept";
+        message: string;
+    }) => void;
+    onSubmit: (message: PromptInputMessage, event: FormEvent<HTMLFormElement>) => false | void | Promise<false | void>;
+    /** When provided, files are uploaded to the server immediately on add and the
+     * attachment URL is replaced with the stable server path before submit. */
+    onUploadFile?: (file: File) => Promise<{
+        url: string;
+        path?: string;
+    }>;
+};
+declare const PromptInput: ({ className, accept, multiple, globalDrop, syncHiddenInput, maxFiles, maxFileSize, onError, onSubmit, onUploadFile, children, ...props }: PromptInputProps) => react_jsx_runtime.JSX.Element;
+type PromptInputTextareaProps = ComponentProps<typeof InputGroupTextarea>;
+declare const PromptInputTextarea: ({ onChange, onKeyDown, className, placeholder, ...props }: PromptInputTextareaProps) => react_jsx_runtime.JSX.Element;
+type PromptInputSubmitProps = ComponentProps<typeof InputGroupButton> & {
+    status?: ChatStatus;
+    onStop?: () => void;
+};
+declare const PromptInputSubmit: ({ className, variant, size, status, onStop, onClick, children, ...props }: PromptInputSubmitProps) => react_jsx_runtime.JSX.Element;
+
 /**
  * Extended-thinking budget. Sent through the agent runtime to providers that
  * support reasoning controls. 'off' means no reasoning chunks; the higher
@@ -499,7 +539,7 @@ interface ComposerBlocker {
 
 type ChatSubmitSource = 'composer' | 'suggestion' | 'auto-submit';
 interface ChatSubmitContext {
-    files: FileUIPart[];
+    files: PromptInputFilePart[];
     sessionId: string;
     source: ChatSubmitSource;
 }
@@ -674,41 +714,6 @@ type CodeBlockProps = HTMLAttributes<HTMLDivElement> & {
 };
 declare const CodeBlock: ({ code, language, showLineNumbers, className, children, ...props }: CodeBlockProps) => react_jsx_runtime.JSX.Element;
 
-type PromptInputFooterProps = ComponentProps<typeof InputGroupAddon>;
-declare const PromptInputFooter: ({ align, className, ...props }: PromptInputFooterProps) => react_jsx_runtime.JSX.Element;
-
-interface PromptInputMessage {
-    text: string;
-    files: FileUIPart[];
-}
-type PromptInputProps = Omit<HTMLAttributes<HTMLFormElement>, "onSubmit" | "onError"> & {
-    accept?: string;
-    multiple?: boolean;
-    globalDrop?: boolean;
-    syncHiddenInput?: boolean;
-    maxFiles?: number;
-    maxFileSize?: number;
-    onError?: (err: {
-        code: "max_files" | "max_file_size" | "accept";
-        message: string;
-    }) => void;
-    onSubmit: (message: PromptInputMessage, event: FormEvent<HTMLFormElement>) => false | void | Promise<false | void>;
-    /** When provided, files are uploaded to the server immediately on add and the
-     * attachment URL is replaced with the stable server path before submit. */
-    onUploadFile?: (file: File) => Promise<{
-        url: string;
-        path?: string;
-    }>;
-};
-declare const PromptInput: ({ className, accept, multiple, globalDrop, syncHiddenInput, maxFiles, maxFileSize, onError, onSubmit, onUploadFile, children, ...props }: PromptInputProps) => react_jsx_runtime.JSX.Element;
-type PromptInputTextareaProps = ComponentProps<typeof InputGroupTextarea>;
-declare const PromptInputTextarea: ({ onChange, onKeyDown, className, placeholder, ...props }: PromptInputTextareaProps) => react_jsx_runtime.JSX.Element;
-type PromptInputSubmitProps = ComponentProps<typeof InputGroupButton> & {
-    status?: ChatStatus;
-    onStop?: () => void;
-};
-declare const PromptInputSubmit: ({ className, variant, size, status, onStop, onClick, children, ...props }: PromptInputSubmitProps) => react_jsx_runtime.JSX.Element;
-
 declare function cn(...inputs: ClassValue[]): string;
 
 export { type AgentCommandContribution, type AgentCommandOptions, ArtifactOpenProvider, ChatEmptyState, type ChatEmptyStateProps, PiChatPanel as ChatPanel, type PiChatPanelProps as ChatPanelProps, type ChatSuggestion, CodeBlock, type CommandRegistry, Conversation, ConversationContent, ConversationScrollButton, DebugDrawer, type GroupedToolEntry, Message, MessageAction, MessageActions, MessageContent, MessageResponse, type OpenArtifactHandler, type ParsedCommand, PiChatPanel, type PiChatPanelProps, SessionBrowser as PiSessionBrowser, type PiSessionCreateInit, SessionList as PiSessionList, PromptInput, PromptInputFooter, PromptInputSubmit, PromptInputTextarea, Reasoning, ReasoningContent, ReasoningTrigger, type SessionListProps, type SlashCommand, type SlashCommandContext, ToolCallGroup, type ToolPart, type ToolRenderer, type ToolRendererOverrides, type UploadFileOptions, type UploadFileResult, type UsePiSessionsOptions, type UsePiSessionsResult, activeSessionStorageKey, builtinCommands, clearActiveSessionId, cn, createCommandRegistry, defaultChatSuggestions, defaultToolRenderers, getAgentCommands, mergeShadcnToolRenderers, mergeToolRenderers, parseSlashCommand, readActiveSessionId, resolveToolRenderer, uploadFile, useOpenArtifact, usePiSessions, writeActiveSessionId };

package/dist/front/index.js

@@ -13,7 +13,7 @@ import {
   StopReceiptSchema,
   extractToolUiMetadata,
   sanitizeToolUiMetadata
-} from "../chunk-HEEJSOFF.js";
+} from "../chunk-G6YPXDHR.js";
 import {
   DebugDrawer,
   cn,
@@ -30,7 +30,7 @@ function readAsDataUrl(file) {
   });
 }
 async function uploadFile(file, opts = {}) {
-  const { apiBaseUrl = "", workspaceRequestId, directory, sourcePath, fetch: fetchImpl = globalThis.fetch } = opts;
+  const { apiBaseUrl = "", workspaceRequestId, directory, sourcePath, responseUrl = "markdown", fetch: fetchImpl = globalThis.fetch } = opts;
   const dataUrl = await readAsDataUrl(file);
   const comma = dataUrl.indexOf(",");
   const contentBase64 = comma >= 0 ? dataUrl.slice(comma + 1) : "";
@@ -51,9 +51,20 @@ async function uploadFile(file, opts = {}) {
   });
   if (!res.ok) throw new Error(`Upload failed: ${res.status}`);
   const body = await res.json();
-  const url = body.markdownUrl ?? body.path;
+  const path = body.path;
+  if (responseUrl === "raw") {
+    if (!path) throw new Error("Upload response missing path");
+    return { url: rawWorkspaceFileUrl(path, { apiBaseUrl, workspaceRequestId }), path };
+  }
+  const url = body.markdownUrl ?? path;
   if (!url) throw new Error("Upload response missing url");
-  return { url, path: body.path ?? url };
+  return { url, path: path ?? url };
+}
+function rawWorkspaceFileUrl(path, opts) {
+  const base = (opts.apiBaseUrl ?? "").replace(/\/$/, "");
+  const params = new URLSearchParams({ path });
+  if (opts.workspaceRequestId) params.set("workspaceId", opts.workspaceRequestId);
+  return `${base}/api/v1/files/raw?${params.toString()}`;
 }
 
 // src/front/chat/PiChatPanel.tsx
@@ -291,15 +302,6 @@ var builtinCommands = [
       if (ctx.openThinkingPicker?.() === false) return { preserveDraft: true };
     }
   },
-  {
-    name: "think",
-    description: "Alias for /thinking",
-    handler(args, ctx) {
-      const query = args.trim();
-      if (query) return ctx.selectComposerThinking?.(query);
-      if (ctx.openThinkingPicker?.() === false) return { preserveDraft: true };
-    }
-  },
   {
     name: "help",
     description: "Show available commands",
@@ -2231,7 +2233,7 @@ async function resolveAttachmentUrls(files) {
     filename: file.filename,
     mediaType: file.mediaType,
     url: file.url.startsWith("blob:") ? await convertBlobUrlToDataUrl(file.url) ?? file.url : file.url,
-    ...typeof file.path === "string" ? { path: file.path } : {}
+    ...file.path ? { path: file.path } : {}
   })));
 }
 async function readFileAsText(file) {
@@ -2247,6 +2249,9 @@ async function readFileAsText(file) {
 }
 
 // src/front/chatSubmit.ts
+function escapeAttachmentAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 async function createEnrichedSubmitPayload({
   text,
   files,
@@ -2256,18 +2261,23 @@ async function createEnrichedSubmitPayload({
   for (const file of files ?? []) {
     const label = file.filename ?? "attachment";
     const mime = file.mediaType ?? "application/octet-stream";
-    const workspacePath = typeof file.path === "string" ? file.path : void 0;
-    const pathNote = workspacePath ? `
-Saved in workspace at: ${workspacePath}
-Use the workspace file/read tools with this path if you need to inspect it.` : "";
+    const workspacePath = file.path;
+    const attrs = [
+      ["data-boring-agent", "composer-file"],
+      ["filename", label],
+      ["mime", mime]
+    ];
+    if (workspacePath) attrs.push(["path", workspacePath]);
+    const attrText = attrs.map(([name, value]) => `${name}="${escapeAttachmentAttr(value)}"`).join(" ");
     const content = await readFileAsText(file);
     if (content !== null) {
-      attachmentSummaries.push(`[attached: ${label} (${mime})${pathNote}]
+      attachmentSummaries.push(`<attachment ${attrText}>
 \`\`\`
 ${content}
-\`\`\``);
+\`\`\`
+</attachment>`);
     } else {
-      attachmentSummaries.push(`[attached: ${label} (${mime}, not inlined \u2014 binary)${pathNote}]`);
+      attachmentSummaries.push(`<attachment ${attrText} binary="true" />`);
     }
   }
   const mentionNote = mentionedFiles.length > 0 ? `@files: ${mentionedFiles.join(", ")}` : null;
@@ -2500,7 +2510,8 @@ var PiComposerPolicyController = class {
     return files.map((file) => ({
       filename: file.filename,
       mediaType: file.mediaType,
-      url: file.url
+      url: file.url,
+      ...file.path ? { path: file.path } : {}
     }));
   }
 };
@@ -4904,7 +4915,8 @@ function toOptimisticUserMessage(payload) {
         id: `optimistic:${payload.clientNonce}:file:${index}`,
         filename: attachment.filename,
         mediaType: attachment.mediaType,
-        url: attachment.url
+        url: attachment.url,
+        path: attachment.path
       }))
     ]
   };
@@ -6736,6 +6748,8 @@ function PiTimelineMessage({ message, isLast, isStreaming, showThoughts, toolRen
   const textParts = message.parts.filter((part) => part.type === "text");
   const fileParts = message.parts.filter((part) => part.type === "file");
   const finalParts = groupRenderableParts(message);
+  const attachmentSummaryPaths = role === "user" ? attachmentPathsFromTextParts(textParts) : [];
+  const openArtifact = useOpenArtifact();
   const shouldReserveStreamingActions = isStreaming && isAssistant && isLast;
   return /* @__PURE__ */ jsxs20(
     Message,
@@ -6767,17 +6781,39 @@ function PiTimelineMessage({ message, isLast, isStreaming, showThoughts, toolRen
                     role === "user" ? "mb-2 w-full gap-2" : "gap-1.5",
                     role === "user" ? "[&>div]:max-w-full [&>div]:border-input/60 [&>div]:bg-background/35 [&>div]:px-1.5 [&>div]:text-secondary-foreground [&>div:hover]:bg-background/45" : void 0
                   ),
-                  children: fileParts.map((file, index) => /* @__PURE__ */ jsxs20(
-                    Attachment,
-                    {
-                      data: toAttachmentData(file, `file-${message.id}-${index}`),
-                      children: [
-                        /* @__PURE__ */ jsx22(AttachmentPreview, { className: role === "user" ? "!size-5 shrink-0 rounded-[var(--radius-sm)]" : "size-10 shrink-0 rounded-[var(--radius-md)]" }),
-                        /* @__PURE__ */ jsx22(AttachmentInfo, { className: role === "user" ? "min-w-0 max-w-[220px] flex-1 text-[12px]" : "min-w-0 flex-1" })
-                      ]
-                    },
-                    `file-${message.id}-${index}`
-                  ))
+                  children: fileParts.map((file, index) => {
+                    const openPath = file.path ?? attachmentSummaryPaths[index];
+                    const canOpen = Boolean(openArtifact && openPath);
+                    const openAttachment = () => {
+                      if (!openPath) return;
+                      openArtifact?.(openPath);
+                    };
+                    const openAttachmentFromKeyboard = (event) => {
+                      if (event.key !== "Enter" && event.key !== " ") return;
+                      event.preventDefault();
+                      openAttachment();
+                    };
+                    return /* @__PURE__ */ jsxs20(
+                      Attachment,
+                      {
+                        data: toAttachmentData(file, `file-${message.id}-${index}`),
+                        ...canOpen ? {
+                          role: "button",
+                          tabIndex: 0,
+                          title: `Open ${openPath} in workspace`,
+                          "aria-label": `Open ${file.filename ?? openPath} in workspace`,
+                          "data-workspace-path": openPath,
+                          onClick: openAttachment,
+                          onKeyDown: openAttachmentFromKeyboard
+                        } : void 0,
+                        children: [
+                          /* @__PURE__ */ jsx22(AttachmentPreview, { className: role === "user" ? "!size-5 shrink-0 rounded-[var(--radius-sm)]" : "size-10 shrink-0 rounded-[var(--radius-md)]" }),
+                          /* @__PURE__ */ jsx22(AttachmentInfo, { className: role === "user" ? "min-w-0 max-w-[220px] flex-1 text-[12px]" : "min-w-0 flex-1" })
+                        ]
+                      },
+                      `file-${message.id}-${index}`
+                    );
+                  })
                 }
               ) : null,
               finalParts.map((item) => {
@@ -6951,7 +6987,27 @@ function stripAttachmentSummaryBlocks(text) {
   return lines.slice(0, firstSummaryIndex).join("\n").trim();
 }
 function isAttachmentSummaryLine(line) {
-  return /^\[attached: .+ \(.+\)\]$/.test(line.trim());
+  const trimmed = line.trim();
+  return trimmed.startsWith("[attached: ") || trimmed.startsWith("<attachment ") && trimmed.includes('data-boring-agent="composer-file"');
+}
+function attachmentPathsFromTextParts(parts) {
+  return parts.flatMap((part) => part.text.split("\n").flatMap((line) => {
+    const trimmed = line.trim();
+    const taggedPath = attachmentTagAttr(trimmed, "path");
+    if (taggedPath) return [taggedPath];
+    const oldInline = trimmed.match(/^\[attached: .+ Saved in workspace at: (.+?) Use the workspace file\/read tools/);
+    if (oldInline?.[1]) return [oldInline[1]];
+    const oldMultiline = trimmed.match(/^Saved in workspace at: (.+)$/);
+    return oldMultiline?.[1] ? [oldMultiline[1]] : [];
+  }));
+}
+function attachmentTagAttr(line, name) {
+  if (!line.startsWith("<attachment ") || !line.includes('data-boring-agent="composer-file"')) return void 0;
+  const match = line.match(new RegExp(`\\b${name}="([^"]*)"`));
+  return match?.[1] ? unescapeAttachmentAttr(match[1]) : void 0;
+}
+function unescapeAttachmentAttr(value) {
+  return value.replace(/&quot;/g, '"').replace(/&gt;/g, ">").replace(/&lt;/g, "<").replace(/&amp;/g, "&");
 }
 function MessageActionsBar({
   text,
@@ -8802,11 +8858,13 @@ function PiChatComposerSurface({
   onSubmitMessage,
   onStop
 }) {
+  const workspaceRequestId = getHeaderValue(requestHeaders, "x-boring-workspace-id");
   const uploadAttachment = useCallback16((file) => uploadFile(file, {
     apiBaseUrl,
-    workspaceRequestId: requestHeaders?.["x-boring-workspace-id"],
+    workspaceRequestId,
+    responseUrl: "raw",
     fetch: fetch2
-  }), [apiBaseUrl, fetch2, requestHeaders]);
+  }), [apiBaseUrl, fetch2, workspaceRequestId]);
   const resizeTextarea = useCallback16((node) => {
     if (!node) return;
     node.style.height = "auto";
@@ -9025,7 +9083,7 @@ function PiChatComposerSurface({
                             className: cn(
                               "h-8 w-8 shrink-0 rounded-full",
                               "bg-foreground",
-                              "!text-background",
+                              "text-background",
                               "transition-all duration-150 ease-[cubic-bezier(0.22,1,0.36,1)]",
                               "hover:bg-foreground/90 hover:shadow-[0_0_0_3px_oklch(from_var(--foreground)_l_c_h/0.12)] hover:scale-[1.04]",
                               "active:scale-[0.93] active:brightness-95",
@@ -9092,6 +9150,10 @@ function PiChatComposerSurface({
     )
   ] });
 }
+function getHeaderValue(headers, name) {
+  if (!headers) return void 0;
+  return headers[name] ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
+}
 
 // src/front/chat/piChatPanelHooks.ts
 import { useCallback as useCallback17, useEffect as useEffect20, useState as useState19, useSyncExternalStore } from "react";
@@ -9828,10 +9890,11 @@ function PiChatPanel({
   }, [addLocalNotice, policy]);
   const stop = useCallback18(() => {
     onComposerStop?.();
+    clearLocalSubmitted(activeChatSessionId);
     void policy?.stop().catch((error) => {
       addLocalNotice({ id: "stop-error", level: "error", text: errorMessage2(error, "Could not stop the chat session."), dismissible: true });
     });
-  }, [addLocalNotice, onComposerStop, policy]);
+  }, [activeChatSessionId, addLocalNotice, clearLocalSubmitted, onComposerStop, policy]);
   const interrupt = useCallback18(() => {
     void policy?.interrupt().catch((error) => {
       addLocalNotice({ id: "interrupt-error", level: "error", text: errorMessage2(error, "Could not interrupt the chat session."), dismissible: true });

package/dist/front/styles.css

@@ -1494,9 +1494,6 @@
   .whitespace-pre-wrap {
     white-space: pre-wrap;
   }
-  .\!text-background {
-    color: var(--background) !important;
-  }
   .\!text-muted-foreground\/75 {
     color: var(--muted-foreground) !important;
     @supports (color: color-mix(in lab, red, red)) {
@@ -1578,6 +1575,9 @@
   .text-amber-600 {
     color: var(--color-amber-600);
   }
+  .text-background {
+    color: var(--background);
+  }
   .text-destructive {
     color: var(--destructive);
   }

package/dist/{piChatEvent-DNKo77Xw.d.ts → piChatEvent-B6GDifo2.d.ts}

@@ -111,6 +111,7 @@ type BoringChatPart = {
     filename?: string;
     mediaType?: string;
     url?: string;
+    path?: string;
 } | {
     type: 'notice';
     id?: string;

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   StopPayloadSchema,
   extractToolUiMetadata,
   sanitizeToolUiMetadata2 as sanitizeToolUiMetadata
-} from "../chunk-HEEJSOFF.js";
+} from "../chunk-G6YPXDHR.js";
 
 // src/server/sandbox/direct/createDirectSandbox.ts
 import { spawn } from "child_process";
@@ -2621,7 +2621,31 @@ function buildFileRecordsResult(args) {
 var log2 = createLogger("boring/workspace-settings");
 var BORING_SETTINGS_PATH = ".boring/settings";
 var DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR = "assets/images";
+var DEFAULT_FILE_UPLOAD_DIR = "assets/uploads";
 var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+var IMAGE_UPLOAD_EXTENSIONS = /* @__PURE__ */ new Set(["avif", "gif", "jpg", "jpeg", "png", "webp"]);
+var SAFE_UNKNOWN_FILE_EXTENSIONS = /* @__PURE__ */ new Set(["csv", "doc", "docx", "json", "md", "pdf", "ppt", "pptx", "rtf", "txt", "xls", "xlsx", "zip"]);
+var MIME_UPLOAD_EXTENSIONS = {
+  "application/json": ["json"],
+  "application/msword": ["doc"],
+  "application/pdf": ["pdf"],
+  "application/rtf": ["rtf"],
+  "application/vnd.ms-excel": ["xls"],
+  "application/vnd.ms-powerpoint": ["ppt"],
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation": ["pptx"],
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": ["xlsx"],
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document": ["docx"],
+  "application/zip": ["zip"],
+  "image/avif": ["avif"],
+  "image/gif": ["gif"],
+  "image/jpeg": ["jpg", "jpeg"],
+  "image/png": ["png"],
+  "image/svg+xml": ["bin"],
+  "image/webp": ["webp"],
+  "text/csv": ["csv"],
+  "text/markdown": ["md"],
+  "text/plain": ["txt"]
+};
 function defaultWorkspaceSettings() {
   return { markdown: { imageUploadDir: DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR } };
 }
@@ -2716,12 +2740,11 @@ function normalizeUploadDir(value) {
 }
 function extForUpload(filename, contentType) {
   const fromName = extname2(filename).toLowerCase().replace(/^\./, "");
-  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
-  if (contentType === "image/jpeg") return "jpg";
-  if (contentType === "image/png") return "png";
-  if (contentType === "image/gif") return "gif";
-  if (contentType === "image/webp") return "webp";
-  if (contentType === "image/svg+xml") return "svg";
+  const safeFromName = /^[a-z0-9]{1,12}$/.test(fromName) ? fromName : "";
+  const allowed = MIME_UPLOAD_EXTENSIONS[contentType];
+  if (allowed) return safeFromName && allowed.includes(safeFromName) ? safeFromName : allowed[0] ?? "bin";
+  if (contentType.startsWith("image/")) return safeFromName && IMAGE_UPLOAD_EXTENSIONS.has(safeFromName) ? safeFromName : "bin";
+  if (contentType === "application/octet-stream" && safeFromName && SAFE_UNKNOWN_FILE_EXTENSIONS.has(safeFromName)) return safeFromName;
   return "bin";
 }
 function basenameForUpload(filename) {
@@ -2751,17 +2774,32 @@ function contentTypeForPath(path4) {
       return "image/svg+xml";
     case ".webp":
       return "image/webp";
-    case ".css":
-      return "text/css; charset=utf-8";
-    case ".html":
-    case ".htm":
-      return "text/html; charset=utf-8";
-    case ".js":
-      return "text/javascript; charset=utf-8";
-    case ".mjs":
-      return "text/javascript; charset=utf-8";
+    case ".txt":
+      return "text/plain; charset=utf-8";
+    case ".md":
+      return "text/markdown; charset=utf-8";
+    case ".json":
+      return "application/json; charset=utf-8";
+    case ".csv":
+      return "text/csv; charset=utf-8";
     case ".pdf":
       return "application/pdf";
+    case ".doc":
+      return "application/msword";
+    case ".docx":
+      return "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+    case ".xls":
+      return "application/vnd.ms-excel";
+    case ".xlsx":
+      return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+    case ".ppt":
+      return "application/vnd.ms-powerpoint";
+    case ".pptx":
+      return "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+    case ".rtf":
+      return "application/rtf";
+    case ".zip":
+      return "application/zip";
     default:
       return "application/octet-stream";
   }
@@ -2795,7 +2833,7 @@ function fileRoutes(app, opts, done) {
         });
       }
       const bytes = await workspace.readBinaryFile(path4);
-      return reply.header("content-type", contentTypeForPath(path4)).header("content-length", String(bytes.byteLength)).header("cache-control", "no-store").send(Buffer.from(bytes));
+      return reply.header("content-type", contentTypeForPath(path4)).header("content-length", String(bytes.byteLength)).header("cache-control", "no-store").header("x-content-type-options", "nosniff").send(Buffer.from(bytes));
     } catch (err) {
       return classifyError(err, reply, "file");
     }
@@ -2911,16 +2949,12 @@ function fileRoutes(app, opts, done) {
     if (filename === null) return;
     const contentBase64 = requireStringParam(body?.contentBase64, "contentBase64", reply);
     if (contentBase64 === null) return;
-    const contentType = typeof body.contentType === "string" ? body.contentType.trim().toLowerCase() : "";
-    if (!contentType.startsWith("image/")) {
-      return reply.code(400).send({
-        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "contentType must be an image/* MIME type", field: "contentType" }
-      });
-    }
+    const contentType = typeof body.contentType === "string" && body.contentType.trim() ? body.contentType.trim().toLowerCase() : "application/octet-stream";
     try {
       const workspace = await resolveWorkspace(request);
       const settings = await readWorkspaceSettings(workspace);
-      const dir = normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR;
+      const isImage = contentType.startsWith("image/");
+      const dir = isImage ? normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR : DEFAULT_FILE_UPLOAD_DIR;
       const ext = extForUpload(filename, contentType);
       const base = basenameForUpload(filename);
       const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -5006,7 +5040,7 @@ function createVercelSandboxExec(sandbox, execOpts = {}) {
         };
       } catch (error) {
         if (timedOut) {
-          return timeoutResult(Date.now() - start);
+          return timeoutResult(Math.max(Date.now() - start, timeoutMs));
         }
         throw error;
       } finally {
@@ -9832,7 +9866,8 @@ function filePartsFromContent(content, messageId) {
         id: `${messageId}:file:${index}`,
         ...optionalString(part.filename) ? { filename: optionalString(part.filename) } : {},
         ...mediaType ? { mediaType } : {},
-        ...imagePartUrl(part, mediaType) ? { url: imagePartUrl(part, mediaType) } : {}
+        ...imagePartUrl(part, mediaType) ? { url: imagePartUrl(part, mediaType) } : {},
+        ...optionalString(part.path) ? { path: optionalString(part.path) } : {}
       }
     ];
   });
@@ -10396,7 +10431,8 @@ function filePartsFromContent2(content, messageId) {
       id: `${messageId}:file:${index}`,
       ...optionalString2(part.filename) ? { filename: optionalString2(part.filename) } : {},
       ...mediaType ? { mediaType } : {},
-      ...url ? { url } : {}
+      ...url ? { url } : {},
+      ...optionalString2(part.path) ? { path: optionalString2(part.path) } : {}
     }];
   });
 }
@@ -10490,11 +10526,13 @@ var PiChatMessageMetadataReconciler = class {
   recordPrompt(sessionId, payload) {
     const metadata = this.promptMetadata.get(sessionId) ?? [];
     const displayText = payload.displayMessage ?? payload.message;
+    const files = filePartsFromPromptPayload(payload);
     metadata.push({
       displayText,
       ...displayText !== payload.message ? { serverText: payload.message } : {},
       clientNonce: payload.clientNonce,
-      recordedAt: Date.now()
+      recordedAt: Date.now(),
+      ...files ? { files } : {}
     });
     this.promptMetadata.set(sessionId, metadata);
   }
@@ -10561,9 +10599,16 @@ var PiChatMessageMetadataReconciler = class {
     }
     if (event.type === "message-start" && event.role === "user" && !hasFollowUpSelector2(event)) {
       const promptMetadata = this.findPrompt(sessionId, event.text);
-      if (promptMetadata) return { ...event, text: promptMetadata.displayText, clientNonce: promptMetadata.clientNonce };
+      if (promptMetadata) return withMessageStartMetadata(event, promptMetadata);
       const metadata = this.findFollowUp(sessionId, event.text);
-      if (metadata) return { ...event, text: metadata.displayText, clientNonce: metadata.clientNonce, clientSeq: metadata.clientSeq };
+      if (metadata) return withMessageStartMetadata(event, metadata);
+    }
+    if (event.type === "message-end" && event.final.role === "user" && !hasMessageSelector(event.final)) {
+      const text = messageText2(event.final);
+      const promptMetadata = this.findPrompt(sessionId, text);
+      if (promptMetadata) return { ...event, final: withMessageSelector(event.final, promptMetadata) };
+      const metadata = this.findFollowUp(sessionId, text);
+      if (metadata) return { ...event, final: withMessageSelector(event.final, metadata) };
     }
     return event;
   }
@@ -10642,13 +10687,24 @@ var PiChatMessageMetadataReconciler = class {
     return this.promptMetadata.get(sessionId)?.find((entry) => matchesMetadataText(entry, text));
   }
   consumePromptFromEvent(sessionId, event) {
-    if (event.type !== "message-start" || event.role !== "user") return;
-    if (event.clientSeq !== void 0) return;
-    if (event.clientNonce) {
-      this.removePrompt(sessionId, { clientNonce: event.clientNonce });
+    if (event.type === "message-start" && event.role === "user") {
+      if (event.clientSeq !== void 0) return;
+      const prompt = event.clientNonce ? this.promptMetadata.get(sessionId)?.find((entry) => entry.clientNonce === event.clientNonce) : this.findPrompt(sessionId, event.text);
+      if (prompt?.serverText) return;
+      if (event.clientNonce) {
+        this.removePrompt(sessionId, { clientNonce: event.clientNonce });
+        return;
+      }
+      this.removePrompt(sessionId, { displayText: event.text });
       return;
     }
-    this.removePrompt(sessionId, { displayText: event.text });
+    if (event.type !== "message-end" || event.final.role !== "user") return;
+    if (event.final.clientSeq !== void 0) return;
+    if (event.final.clientNonce) {
+      this.removePrompt(sessionId, { clientNonce: event.final.clientNonce });
+      return;
+    }
+    this.removePrompt(sessionId, { displayText: messageText2(event.final) });
   }
   removeFirstFollowUpByText(sessionId, text) {
     if (!text) return;
@@ -10702,9 +10758,18 @@ function matchesMetadataText(entry, text) {
   if (!entry || !text) return false;
   return entry.displayText === text || entry.serverText === text;
 }
+function withMessageStartMetadata(event, metadata) {
+  return {
+    ...event,
+    text: metadata.displayText,
+    ...metadata.clientNonce ? { clientNonce: metadata.clientNonce } : {},
+    ...metadata.clientSeq !== void 0 ? { clientSeq: metadata.clientSeq } : {},
+    ...metadata.files && metadata.files.length > 0 ? { files: metadata.files } : {}
+  };
+}
 function withMessageSelector(message, metadata) {
   return {
-    ...withMessageDisplayText(message, metadata.displayText),
+    ...withMessageFiles(withMessageDisplayText(message, metadata.displayText), metadata.files),
     ...metadata.clientNonce ? { clientNonce: metadata.clientNonce } : {},
     ...metadata.clientSeq !== void 0 ? { clientSeq: metadata.clientSeq } : {}
   };
@@ -10719,6 +10784,22 @@ function withMessageDisplayText(message, displayText) {
   });
   return { ...message, parts };
 }
+function withMessageFiles(message, files) {
+  if (!files || files.length === 0) return message;
+  const nonFileParts = message.parts.filter((part) => part.type !== "file");
+  return { ...message, parts: [...nonFileParts, ...files] };
+}
+function filePartsFromPromptPayload(payload) {
+  if (!payload.attachments || payload.attachments.length === 0) return void 0;
+  return payload.attachments.map((attachment, index) => ({
+    type: "file",
+    id: `prompt:${payload.clientNonce}:file:${index}`,
+    filename: attachment.filename,
+    mediaType: attachment.mediaType,
+    url: attachment.url,
+    path: attachment.path
+  }));
+}
 function withQueuedSelector(followUp, metadata) {
   return {
     ...followUp,
@@ -11216,10 +11297,13 @@ var PiChatMeteringCoordinator = class {
 };
 
 // src/server/pi-chat/harnessPiChatService.ts
+var MAX_PROMPT_IMAGE_BYTES = 10 * 1024 * 1024;
+var PROMPT_IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".avif", ".gif", ".jpg", ".jpeg", ".png", ".webp"]);
 var HarnessPiChatService = class {
   harness;
   sessionStore;
   workdir;
+  workspace;
   channels = /* @__PURE__ */ new Map();
   // Single-flight guard so concurrent cold callers (e.g. two browser tabs each
   // opening /events while the session is still being created) converge on one
@@ -11235,6 +11319,7 @@ var HarnessPiChatService = class {
     this.harness = options.harness;
     this.sessionStore = options.sessionStore;
     this.workdir = options.workdir;
+    this.workspace = options.workspace;
     this.metering = options.metering ? new PiChatMeteringCoordinator(options.metering, options.meteringLogger) : void 0;
   }
   /** Test/diagnostic hook: resolves once queued metering sink calls settle. */
@@ -11328,7 +11413,8 @@ var HarnessPiChatService = class {
     const channel = this.channels.get(sessionId);
     const receiptCursor = nextPromptReceiptCursor(channel);
     try {
-      const run2 = this.trackActiveRun(sessionId, adapter.prompt(toPiPromptInput(payload)));
+      const input = await toPiPromptInput(payload, this.workspace);
+      const run2 = this.trackActiveRun(sessionId, adapter.prompt(input));
       run2.catch((error) => {
         this.metering?.failPromptRun(sessionId, payload.clientNonce);
         if (!this.messageMetadata.hasPrompt(sessionId, { clientNonce: payload.clientNonce, displayText: payload.displayMessage ?? payload.message })) return;
@@ -11628,7 +11714,8 @@ function promptPayloadFileParts(payload, messageId) {
     id: `${messageId}:file:${index}`,
     filename: attachment.filename,
     mediaType: attachment.mediaType,
-    url: attachment.url
+    url: attachment.url,
+    path: attachment.path
   }));
 }
 function promptPayloadMessage(payload, messageId, createdAt, turnId) {
@@ -11666,21 +11753,64 @@ function messageTime(message) {
   const timestamp = Date.parse(message.createdAt);
   return Number.isFinite(timestamp) ? timestamp : void 0;
 }
-function toPiPromptInput(payload) {
-  const images = promptImagesFromAttachments(payload.attachments);
+async function toPiPromptInput(payload, workspace) {
+  const images = await promptImagesFromAttachments(payload.attachments, workspace);
   if (images.length === 0) return payload.message;
   return { text: payload.message, options: { images } };
 }
-function promptImagesFromAttachments(attachments) {
+async function promptImagesFromAttachments(attachments, workspace) {
   const images = [];
   for (const attachment of attachments ?? []) {
     const match = attachment.url.match(/^data:(image\/[^;]+);base64,(.+)$/);
-    if (!match) continue;
-    const [, mimeType, data] = match;
-    images.push({ type: "image", mimeType, data });
+    if (match) {
+      const [, mimeType, data] = match;
+      images.push({ type: "image", mimeType, data });
+      continue;
+    }
+    if (!workspace?.readBinaryFile || !isWorkspaceImageAttachment(attachment)) continue;
+    try {
+      const stat11 = await workspace.stat(attachment.path);
+      if (stat11.kind !== "file" || stat11.size <= 0 || stat11.size > MAX_PROMPT_IMAGE_BYTES) continue;
+      const bytes = await workspace.readBinaryFile(attachment.path);
+      if (bytes.byteLength <= 0 || bytes.byteLength > MAX_PROMPT_IMAGE_BYTES) continue;
+      const detectedMimeType = detectPromptImageMimeType(bytes);
+      if (!detectedMimeType) continue;
+      images.push({
+        type: "image",
+        mimeType: detectedMimeType,
+        data: Buffer.from(bytes).toString("base64")
+      });
+    } catch {
+    }
   }
   return images;
 }
+function isWorkspaceImageAttachment(attachment) {
+  if (!attachment.mediaType?.startsWith("image/") || !attachment.path) return false;
+  const lowerPath = attachment.path.toLowerCase();
+  return [...PROMPT_IMAGE_EXTENSIONS].some((ext) => lowerPath.endsWith(ext));
+}
+function detectPromptImageMimeType(bytes) {
+  const buffer = Buffer.from(bytes);
+  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+    return "image/png";
+  }
+  if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
+    return "image/jpeg";
+  }
+  if (buffer.length >= 6) {
+    const gif = buffer.subarray(0, 6).toString("ascii");
+    if (gif === "GIF87a" || gif === "GIF89a") return "image/gif";
+  }
+  if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") {
+    return "image/webp";
+  }
+  if (buffer.length >= 12 && buffer.subarray(4, 8).toString("ascii") === "ftyp") {
+    const brand = buffer.subarray(8, 12).toString("ascii");
+    if (brand === "avif" || brand === "avis") return "image/avif";
+  }
+  return null;
+}
 function removedFollowUps(before, after) {
   const afterCounts = /* @__PURE__ */ new Map();
   for (const text of after) afterCounts.set(text, (afterCounts.get(text) ?? 0) + 1);
@@ -11837,6 +11967,7 @@ async function createAgentApp(opts = {}) {
     harness,
     sessionStore: harness.sessions,
     workdir: runtimeBundle.workspace.root,
+    workspace: runtimeBundle.workspace,
     metering: opts.metering
   });
   await app.register(piChatRoutes, { service: piChatService });
@@ -12074,6 +12205,17 @@ function selectRuntimeModeAdapter(mode, sandboxHandleStore) {
 function getRequestWorkspaceId(request) {
   return request.workspaceContext?.workspaceId ?? DEFAULT_WORKSPACE_ID3;
 }
+function promoteRawFileWorkspaceQueryToHeader(request) {
+  const pathname = request.url.split("?")[0] ?? request.url;
+  if (pathname !== "/api/v1/files/raw") return;
+  const hasWorkspaceHeader = Object.keys(request.headers).some((key) => key.toLowerCase() === "x-boring-workspace-id");
+  if (hasWorkspaceHeader) return;
+  const queryIndex = request.url.indexOf("?");
+  if (queryIndex < 0) return;
+  const workspaceId = new URLSearchParams(request.url.slice(queryIndex + 1)).get("workspaceId")?.trim();
+  if (!workspaceId) return;
+  request.headers["x-boring-workspace-id"] = workspaceId;
+}
 function isWorkspaceAgnosticAgentRequest(request, options) {
   const pathname = request.url.split("?")[0] ?? request.url;
   if (pathname === "/api/v1/ready-status") return !options?.readyStatusWorkspaceScoped;
@@ -12566,6 +12708,7 @@ var registerAgentRoutes = async (app, opts) => {
   app.addHook("onRequest", async (request, reply) => {
     const user = request.user;
     let workspaceId = DEFAULT_WORKSPACE_ID3;
+    promoteRawFileWorkspaceQueryToHeader(request);
     if (opts.getWorkspaceId && !isWorkspaceAgnosticAgentRequest(request, { readyStatusWorkspaceScoped: requestScopedRuntime })) {
       try {
         workspaceId = (await opts.getWorkspaceId(request)).trim();
@@ -12626,6 +12769,7 @@ var registerAgentRoutes = async (app, opts) => {
         harness: binding.harness,
         sessionStore: binding.harness.sessions,
         workdir: binding.runtimeBundle.workspace.root,
+        workspace: binding.runtimeBundle.workspace,
         metering: opts.metering
       });
       return binding.piChatService;

package/dist/shared/index.d.ts

@@ -1,7 +1,7 @@
 import { W as Workspace, S as Sandbox, F as FileSearch, A as AgentTool } from '../agentPluginEvents-Dgm57gEU.js';
 export { a as AgentHarness, C as CommandNotifyPayload, E as Entry, b as ExecOptions, c as ExecResult, I as IsolatedCodeInput, d as IsolatedCodeOutput, J as JSONSchema, R as RunContext, e as SandboxCapability, f as SandboxHandleRecord, g as SandboxHandleStore, h as SendMessageInput, i as Stat, T as TelemetryEvent, j as TelemetrySink, k as ToolExecContext, l as ToolResult, m as WORKSPACE_AGENT_PLUGINS_RELOADED_EVENT, n as WORKSPACE_COMMAND_NOTIFY_EVENT, o as WorkspaceRuntimeContext, p as noopTelemetry, s as safeCapture } from '../agentPluginEvents-Dgm57gEU.js';
-import { B as BoringChatPart, T as ToolUiMetadata } from '../piChatEvent-DNKo77Xw.js';
-export { A as ApiErrorPayload, a as ApiErrorPayloadSchema, b as ApiErrorResponse, c as ApiErrorResponseSchema, d as BoringChatMessage, C as ChatError, e as CommandReceipt, E as ERROR_CODES, f as ErrorCode, g as ErrorLogFields, h as ErrorLogFieldsSchema, F as FollowUpPayload, i as FollowUpReceipt, I as InterruptPayload, j as InterruptReceipt, P as PiChatEvent, k as PiChatHeartbeatFrame, l as PiChatSnapshot, m as PiChatStatus, n as PiChatStreamFrame, o as PromptPayload, p as PromptReceipt, Q as QueueClearPayload, q as QueueClearReceipt, r as QueuedUserMessage, S as StopPayload, s as StopReceipt, t as extractToolUiMetadata, u as isToolUiMetadata } from '../piChatEvent-DNKo77Xw.js';
+import { B as BoringChatPart, T as ToolUiMetadata } from '../piChatEvent-B6GDifo2.js';
+export { A as ApiErrorPayload, a as ApiErrorPayloadSchema, b as ApiErrorResponse, c as ApiErrorResponseSchema, d as BoringChatMessage, C as ChatError, e as CommandReceipt, E as ERROR_CODES, f as ErrorCode, g as ErrorLogFields, h as ErrorLogFieldsSchema, F as FollowUpPayload, i as FollowUpReceipt, I as InterruptPayload, j as InterruptReceipt, P as PiChatEvent, k as PiChatHeartbeatFrame, l as PiChatSnapshot, m as PiChatStatus, n as PiChatStreamFrame, o as PromptPayload, p as PromptReceipt, Q as QueueClearPayload, q as QueueClearReceipt, r as QueuedUserMessage, S as StopPayload, s as StopReceipt, t as extractToolUiMetadata, u as isToolUiMetadata } from '../piChatEvent-B6GDifo2.js';
 export { C as ChatAttachmentPayload, a as ChatModelSelection, b as ChatSubmitPayload, S as SessionCtx, c as SessionDetail, d as SessionStore, e as SessionSummary, T as ThinkingLevel } from '../chatSubmitPayload-DHqQL2wD.js';
 import { z } from 'zod';
 

package/dist/shared/index.js

@@ -39,7 +39,7 @@ import {
   extractToolUiMetadata,
   isToolUiMetadata,
   sanitizeToolUiMetadata2 as sanitizeToolUiMetadata
-} from "../chunk-HEEJSOFF.js";
+} from "../chunk-G6YPXDHR.js";
 
 // src/shared/config-schema.ts
 import { z } from "zod";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "type": "module",
   "license": "MIT",
   "description": "Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.",
@@ -74,7 +74,7 @@
     "use-stick-to-bottom": "^1.1.3",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@hachej/boring-ui-kit": "0.1.48"
+    "@hachej/boring-ui-kit": "0.1.50"
   },
   "devDependencies": {
     "@antithesishq/bombadil": "0.5.0",