@hachej/boring-agent 0.1.5 → 0.1.7

package/dist/server/index.js

@@ -725,6 +725,11 @@ function logSandboxStop(logger, metadata) {
     ...metadata
   });
 }
+function isSandboxAlreadyExistsError(error) {
+  const code = error?.json?.error?.code;
+  const message = error?.json?.error?.message;
+  return code === "bad_request" && typeof message === "string" && message.includes("already exists");
+}
 async function createFresh(workspaceId, snapshotId, tarballUrl, previous, store, vercel, logger) {
   let sandbox;
   let sourceType = "empty";
@@ -733,21 +738,25 @@ async function createFresh(workspaceId, snapshotId, tarballUrl, previous, store,
     persistent: true,
     snapshotExpiration: 0
   };
-  if (snapshotId) {
-    sourceType = "snapshot";
-    sandbox = await vercel.create({
-      ...base,
-      source: { type: "snapshot", snapshotId }
-    });
-  } else if (tarballUrl) {
-    sourceType = "tarball";
-    sandbox = await vercel.create({
-      ...base,
-      source: { type: "tarball", url: tarballUrl }
-    });
-  } else {
-    sandbox = await vercel.create(base);
-  }
+  const tryCreate = async () => {
+    try {
+      if (snapshotId) {
+        sourceType = "snapshot";
+        return await vercel.create({ ...base, source: { type: "snapshot", snapshotId } });
+      } else if (tarballUrl) {
+        sourceType = "tarball";
+        return await vercel.create({ ...base, source: { type: "tarball", url: tarballUrl } });
+      } else {
+        return await vercel.create(base);
+      }
+    } catch (error) {
+      if (isSandboxAlreadyExistsError(error)) {
+        return await vercel.get({ name: base.name, sandboxId: base.name, resume: true });
+      }
+      throw error;
+    }
+  };
+  sandbox = await tryCreate();
   logSandboxCreate(logger, {
     workspaceId,
     sandboxId: getSandboxIdentifier(sandbox),
@@ -1380,10 +1389,18 @@ function createNodeWorkspace(root) {
       const absPath = await ensureExistingWorkspacePath(root, relPath);
       return await readFile3(absPath, "utf-8");
     },
+    async readBinaryFile(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      return new Uint8Array(await readFile3(absPath));
+    },
     async writeFile(relPath, data) {
       const absPath = await ensureWritableWorkspacePath(root, relPath);
       await writeFile3(absPath, data, "utf-8");
     },
+    async writeBinaryFile(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile3(absPath, data);
+    },
     async readFileWithStat(relPath) {
       const absPath = await ensureExistingWorkspacePath(root, relPath);
       const [content, fileStat] = await Promise.all([
@@ -1409,6 +1426,16 @@ function createNodeWorkspace(root) {
         kind: fileStat.isDirectory() ? "dir" : "file"
       };
     },
+    async writeBinaryFileWithStat(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile3(absPath, data);
+      const fileStat = await stat2(absPath);
+      return {
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        kind: fileStat.isDirectory() ? "dir" : "file"
+      };
+    },
     async unlink(relPath) {
       const absPath = await ensureExistingWorkspacePath(root, relPath);
       const pathStat = await lstat2(absPath);
@@ -1819,6 +1846,20 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       }
       return Buffer.from(content).toString("utf-8");
     },
+    async readBinaryFile(relPath) {
+      const sandboxPath = toSandboxPath(relPath);
+      if (remote.fs?.readFile) {
+        const content2 = await remote.fs.readFile(sandboxPath);
+        return new Uint8Array(Buffer.from(content2));
+      }
+      const content = await remote.readFileToBuffer?.({ path: sandboxPath });
+      if (!content) {
+        const err = new Error(`ENOENT: file not found, open '${sandboxPath}'`);
+        err.code = "ENOENT";
+        throw err;
+      }
+      return new Uint8Array(Buffer.from(content));
+    },
     async writeFile(relPath, data) {
       const sandboxPath = toSandboxPath(relPath);
       await sandbox.writeFiles([
@@ -1831,6 +1872,18 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       workspaceOpts.onMutation?.();
       emitChange({ op: "write", path: relPath });
     },
+    async writeBinaryFile(relPath, data) {
+      const sandboxPath = toSandboxPath(relPath);
+      await sandbox.writeFiles([
+        {
+          path: sandboxPath,
+          content: Buffer.from(data)
+        }
+      ]);
+      invalidateMetadataCache();
+      workspaceOpts.onMutation?.();
+      emitChange({ op: "write", path: relPath });
+    },
     async readFileWithStat(relPath) {
       const sandboxPath = toSandboxPath(relPath);
       const cachedStat = statCache.get(sandboxPath);
@@ -1905,6 +1958,44 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       emitChange({ op: "write", path: relPath, mtimeMs: writtenStat.mtimeMs });
       return cloneStat(writtenStat);
     },
+    async writeBinaryFileWithStat(relPath, data) {
+      const sandboxPath = toSandboxPath(relPath);
+      const payload = Buffer.from(data);
+      if (payload.byteLength > MAX_INLINE_WRITE_BYTES) {
+        await sandbox.writeFiles([
+          {
+            path: sandboxPath,
+            content: payload
+          }
+        ]);
+        invalidateMetadataCache();
+        workspaceOpts.onMutation?.();
+        const writtenStat2 = remote.fs?.stat ? await (async () => {
+          const fileStat = await remote.fs.stat(sandboxPath);
+          return {
+            size: fileStat.size,
+            mtimeMs: fileStat.mtimeMs,
+            kind: fileStat.isDirectory() ? "dir" : "file"
+          };
+        })() : await runJson(
+          remote,
+          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+        );
+        statCache.set(sandboxPath, writtenStat2);
+        emitChange({ op: "write", path: relPath, mtimeMs: writtenStat2.mtimeMs });
+        return cloneStat(writtenStat2);
+      }
+      const encoded = payload.toString("base64");
+      const writtenStat = await runJson(
+        remote,
+        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(encoded)}`
+      );
+      invalidateMetadataCache();
+      statCache.set(sandboxPath, writtenStat);
+      workspaceOpts.onMutation?.();
+      emitChange({ op: "write", path: relPath, mtimeMs: writtenStat.mtimeMs });
+      return cloneStat(writtenStat);
+    },
     async unlink(relPath) {
       const sandboxPath = toSandboxPath(relPath);
       if (remote.fs?.rm) await remote.fs.rm(sandboxPath, { recursive: false, force: false });
@@ -2410,6 +2501,39 @@ async function ensureVercelWorkspaceRoot(sandbox) {
     throw new Error(`failed to initialize ${VERCEL_SANDBOX_REMOTE_ROOT} (exit ${result.exitCode ?? "unknown"})`);
   }
 }
+async function seedTemplateIntoVercelWorkspace(workspace, templatePath, logger) {
+  const files = await collectFiles(templatePath);
+  const hash = computeTemplateHash(files);
+  const markerPath = `.boring-agent/templates/${hash}.json`;
+  try {
+    await workspace.stat(markerPath);
+    logger.info("[vercel-sandbox:mode] template already seeded", {
+      hash,
+      fileCount: files.length
+    });
+    return;
+  } catch {
+  }
+  for (const file of files) {
+    if (workspace.writeBinaryFile) {
+      await workspace.writeBinaryFile(file.rel, new Uint8Array(file.content));
+    } else {
+      await workspace.writeFile(file.rel, file.content.toString("utf-8"));
+    }
+  }
+  await workspace.writeFile(markerPath, JSON.stringify({ hash, seededAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+  logger.info("[vercel-sandbox:mode] template seeded into workspace", {
+    hash,
+    fileCount: files.length
+  });
+}
+async function ensureTemplateExecutables(sandbox) {
+  if (!sandbox.runCommand) return;
+  await sandbox.runCommand({
+    cmd: "sh",
+    args: ["-c", `chmod +x ${VERCEL_SANDBOX_REMOTE_ROOT}/.boring-agent/bin/* 2>/dev/null || true`]
+  });
+}
 var DEFAULT_MODE_LOGGER = {
   info(message, metadata) {
     process.stderr.write(`${message} ${JSON.stringify(metadata)}
@@ -2521,17 +2645,14 @@ function createVercelSandboxModeAdapter(opts = {}) {
         onMutation: markDirty
       });
       await ensureVercelWorkspaceRoot(sandboxHandle);
-      if (ctx.templatePath && !tarballUrl) {
-        logger.info("[vercel-sandbox:mode] falling back to writeFiles for template", {
-          templatePath: ctx.templatePath
-        });
-        const files = await collectFiles(ctx.templatePath);
-        for (const file of files) {
-          await workspace.writeFile(file.rel, file.content.toString("utf-8"));
+      if (ctx.templatePath) {
+        if (!tarballUrl) {
+          logger.info("[vercel-sandbox:mode] falling back to writeFiles for template", {
+            templatePath: ctx.templatePath
+          });
         }
-        logger.info("[vercel-sandbox:mode] writeFiles fallback complete", {
-          fileCount: files.length
-        });
+        await seedTemplateIntoVercelWorkspace(workspace, ctx.templatePath, logger);
+        await ensureTemplateExecutables(sandboxHandle);
       }
       const sandbox = createVercelSandboxExec(sandboxHandle, {
         onMutation: markDirty
@@ -2584,6 +2705,8 @@ import Fastify from "fastify";
 import { basename as basename2 } from "path";
 
 // src/server/harness/pi-coding-agent/createHarness.ts
+import { mkdir as mkdir9, writeFile as writeFile7 } from "fs/promises";
+import { extname, join as join6 } from "path";
 import {
   createAgentSession,
   SessionManager,
@@ -2595,6 +2718,86 @@ import {
   loadSkills
 } from "@mariozechner/pi-coding-agent";
 
+// src/server/logging.ts
+var SENSITIVE_KEYS = new Set([
+  "apiKey",
+  "api_key",
+  "token",
+  "secret",
+  "password",
+  "authorization",
+  "cookie",
+  "oidcToken",
+  "accessToken",
+  "refreshToken",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "VERCEL_OIDC_TOKEN",
+  "VERCEL_TEAM_ID"
+].map((key) => key.toLowerCase()));
+function isSensitiveKey(key) {
+  return SENSITIVE_KEYS.has(key.toLowerCase());
+}
+function redactValue(key, value, seen) {
+  if (key && isSensitiveKey(key) && value != null) return "***";
+  if (value == null || typeof value !== "object") return value;
+  if (value instanceof Date) return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const out2 = value.map((item) => redactValue(void 0, item, seen));
+    seen.delete(value);
+    return out2;
+  }
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactValue(childKey, childValue, seen);
+  }
+  seen.delete(value);
+  return out;
+}
+function redact(fields) {
+  const out = {};
+  const seen = /* @__PURE__ */ new WeakSet();
+  for (const [k, v] of Object.entries(fields)) {
+    out[k] = redactValue(k, v, seen);
+  }
+  return out;
+}
+var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
+function createLogger(prefix) {
+  function emit(level, msg, fields) {
+    const entry = {
+      level,
+      prefix,
+      msg,
+      ...fields ? redact(fields) : {},
+      t: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (level === "error") {
+      console.error(JSON.stringify(entry));
+    } else if (level === "warn") {
+      console.warn(JSON.stringify(entry));
+    } else {
+      console.log(JSON.stringify(entry));
+    }
+  }
+  return {
+    debug(msg, fields) {
+      if (verbose) emit("debug", msg, fields);
+    },
+    info(msg, fields) {
+      emit("info", msg, fields);
+    },
+    warn(msg, fields) {
+      emit("warn", msg, fields);
+    },
+    error(msg, fields) {
+      emit("error", msg, fields);
+    }
+  };
+}
+
 // src/server/harness/pi-coding-agent/tool-adapter.ts
 function adaptToolForPi(tool) {
   return {
@@ -3159,86 +3362,6 @@ function piMessagesToUIMessages(messages) {
   return result;
 }
 
-// src/server/logging.ts
-var SENSITIVE_KEYS = new Set([
-  "apiKey",
-  "api_key",
-  "token",
-  "secret",
-  "password",
-  "authorization",
-  "cookie",
-  "oidcToken",
-  "accessToken",
-  "refreshToken",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-  "VERCEL_OIDC_TOKEN",
-  "VERCEL_TEAM_ID"
-].map((key) => key.toLowerCase()));
-function isSensitiveKey(key) {
-  return SENSITIVE_KEYS.has(key.toLowerCase());
-}
-function redactValue(key, value, seen) {
-  if (key && isSensitiveKey(key) && value != null) return "***";
-  if (value == null || typeof value !== "object") return value;
-  if (value instanceof Date) return value;
-  if (seen.has(value)) return "[Circular]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    const out2 = value.map((item) => redactValue(void 0, item, seen));
-    seen.delete(value);
-    return out2;
-  }
-  const out = {};
-  for (const [childKey, childValue] of Object.entries(value)) {
-    out[childKey] = redactValue(childKey, childValue, seen);
-  }
-  seen.delete(value);
-  return out;
-}
-function redact(fields) {
-  const out = {};
-  const seen = /* @__PURE__ */ new WeakSet();
-  for (const [k, v] of Object.entries(fields)) {
-    out[k] = redactValue(k, v, seen);
-  }
-  return out;
-}
-var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
-function createLogger(prefix) {
-  function emit(level, msg, fields) {
-    const entry = {
-      level,
-      prefix,
-      msg,
-      ...fields ? redact(fields) : {},
-      t: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (level === "error") {
-      console.error(JSON.stringify(entry));
-    } else if (level === "warn") {
-      console.warn(JSON.stringify(entry));
-    } else {
-      console.log(JSON.stringify(entry));
-    }
-  }
-  return {
-    debug(msg, fields) {
-      if (verbose) emit("debug", msg, fields);
-    },
-    info(msg, fields) {
-      emit("info", msg, fields);
-    },
-    warn(msg, fields) {
-      emit("warn", msg, fields);
-    },
-    error(msg, fields) {
-      emit("error", msg, fields);
-    }
-  };
-}
-
 // src/server/harness/pi-coding-agent/sessionTitle.ts
 var DEFAULT_SESSION_TITLE = "New session";
 var FALLBACK_PREFIX = "New chat";
@@ -3637,6 +3760,24 @@ async function applyRequestedSessionOptions(handle, input) {
     handle.piSession.setThinkingLevel(input.thinkingLevel);
   }
 }
+var log2 = createLogger("pi-harness");
+var DEFAULT_ATTACHMENT_DIR = "assets/images";
+function extForAttachment(filename, contentType) {
+  const fromName = extname(filename).toLowerCase().replace(/^\./, "");
+  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
+  if (contentType === "image/jpeg") return "jpg";
+  if (contentType === "image/png") return "png";
+  if (contentType === "image/gif") return "gif";
+  if (contentType === "image/webp") return "webp";
+  if (contentType === "image/svg+xml") return "svg";
+  return "bin";
+}
+function basenameForAttachment(filename) {
+  const base = filename.split("/").pop()?.split("\\").pop() ?? "image";
+  const withoutExt = base.replace(/\.[^.]*$/, "");
+  const safe = withoutExt.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return safe || "image";
+}
 function createPiCodingAgentHarness(opts) {
   const sessionStore = new PiSessionStore(opts.cwd);
   const piSessions = /* @__PURE__ */ new Map();
@@ -3733,10 +3874,17 @@ function createPiCodingAgentHarness(opts) {
     await originalDelete(ctx, sessionId);
     disposePiSession(sessionId);
   };
+  const harnessFollowUpQueues = /* @__PURE__ */ new Map();
   return {
     id: "pi-coding-agent",
     placement: "server",
     sessions: sessionStore,
+    followUp(sessionId, text, attachments) {
+      harnessFollowUpQueues.set(sessionId, { message: text, attachments });
+    },
+    clearFollowUp(sessionId) {
+      harnessFollowUpQueues.delete(sessionId);
+    },
     /**
      * Pi exposes the resolved system prompt as a getter on AgentSession.
      * Sessions are created lazily on first sendMessage, so callers may see
@@ -3752,6 +3900,7 @@ function createPiCodingAgentHarness(opts) {
         input,
         ctx
       );
+      harnessFollowUpQueues.delete(input.sessionId);
       const chunks = [];
       let done = false;
       let streamError = null;
@@ -3800,6 +3949,20 @@ function createPiCodingAgentHarness(opts) {
         return out;
       }
       let sawTextChunk = false;
+      let inlineTurnIndex = 0;
+      function namespaceInlinePartIds(input2) {
+        if (inlineTurnIndex === 0) return input2;
+        return input2.map((chunk2) => {
+          const rec = chunk2;
+          if ((rec.type === "text-start" || rec.type === "text-delta" || rec.type === "text-end" || rec.type === "reasoning-start" || rec.type === "reasoning-delta" || rec.type === "reasoning-end") && typeof rec.id === "string") {
+            return { ...rec, id: `turn-${inlineTurnIndex}:${rec.id}` };
+          }
+          return chunk2;
+        });
+      }
+      let pendingFollowUp;
+      let promptSettled = false;
+      let promptPromise = Promise.resolve();
       const unsubscribe = piSession.subscribe((event) => {
         if (event.type === "message_update") {
           const ame = event.assistantMessageEvent;
@@ -3819,11 +3982,11 @@ function createPiCodingAgentHarness(opts) {
           activeTools.delete(event.toolCallId);
           if (activeTools.size === 0) stopHeartbeat();
         }
-        let converted = dedupStartChunks(piEventToChunks(event));
+        let converted = namespaceInlinePartIds(dedupStartChunks(piEventToChunks(event)));
         if (event.type === "message_update") {
           const ame = event.assistantMessageEvent;
           if (ame.type === "text_end" && typeof ame.content === "string" && ame.content.length > 0 && !textDeltaSeen.has(ame.contentIndex)) {
-            const id = String(ame.contentIndex);
+            const id = inlineTurnIndex === 0 ? String(ame.contentIndex) : `turn-${inlineTurnIndex}:${ame.contentIndex}`;
             converted = [
               ...textStartSeen.has(ame.contentIndex) ? [] : [{ type: "text-start", id }],
               { type: "text-delta", id, delta: ame.content },
@@ -3848,10 +4011,11 @@ function createPiCodingAgentHarness(opts) {
             chunks.push({ type: "error", errorText });
             sawTextChunk = true;
           } else if (role === "assistant" && text.length > 0) {
+            const id = inlineTurnIndex === 0 ? "0" : `turn-${inlineTurnIndex}:0`;
             chunks.push(
-              { type: "text-start", id: "0" },
-              { type: "text-delta", id: "0", delta: text },
-              { type: "text-end", id: "0" }
+              { type: "text-start", id },
+              { type: "text-delta", id, delta: text },
+              { type: "text-end", id }
             );
             sawTextChunk = true;
             assistantText += text;
@@ -3868,30 +4032,95 @@ function createPiCodingAgentHarness(opts) {
               chunks.push({ type: "error", errorText });
               sawTextChunk = true;
             } else if (role === "assistant" && text.length > 0) {
+              const id = inlineTurnIndex === 0 ? "0" : `turn-${inlineTurnIndex}:0`;
               chunks.push(
-                { type: "text-start", id: "0" },
-                { type: "text-delta", id: "0", delta: text },
-                { type: "text-end", id: "0" }
+                { type: "text-start", id },
+                { type: "text-delta", id, delta: text },
+                { type: "text-end", id }
               );
               sawTextChunk = true;
               assistantText += text;
             }
           }
-          done = true;
-          stopHeartbeat();
+          const followUp = harnessFollowUpQueues.get(input.sessionId);
+          if (followUp !== void 0 && !ctx.abortSignal.aborted) {
+            harnessFollowUpQueues.delete(input.sessionId);
+            chunks.push({ type: "data-followup-consumed" });
+            inlineTurnIndex += 1;
+            sawTextChunk = false;
+            textStartSeen.clear();
+            textDeltaSeen.clear();
+            assistantText = "";
+            pendingFollowUp = followUp;
+          } else {
+            done = true;
+            stopHeartbeat();
+          }
         }
         if (wake) wake();
       });
-      let promptSettled = false;
-      const promptPromise = piSession.prompt(input.message).then(() => {
-        promptSettled = true;
-      }).catch((err) => {
-        promptSettled = true;
-        streamError = err;
-        done = true;
-        stopHeartbeat();
-        if (wake) wake();
-      });
+      async function prepareTurn(message, attachments) {
+        const initialImages = [];
+        const savedPaths = [];
+        const writeErrors = [];
+        for (const a of attachments ?? []) {
+          const match = a.url.match(/^data:(image\/[^;]+);base64,(.+)$/);
+          if (!match) continue;
+          const [, contentType, b64] = match;
+          initialImages.push({ type: "image", mimeType: contentType, data: b64 });
+          if (!ctx.workdir) {
+            writeErrors.push(`${a.filename ?? "image"}: no workdir`);
+            continue;
+          }
+          try {
+            const bytes = Buffer.from(b64, "base64");
+            const ext = extForAttachment(a.filename ?? "image", contentType);
+            const base = basenameForAttachment(a.filename ?? "image");
+            const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+            const relPath = `${DEFAULT_ATTACHMENT_DIR}/${base}-${unique}.${ext}`;
+            await mkdir9(join6(ctx.workdir, DEFAULT_ATTACHMENT_DIR), { recursive: true });
+            await writeFile7(join6(ctx.workdir, relPath), bytes);
+            savedPaths.push(relPath);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log2.error("attachment write failed", { workdir: ctx.workdir, error: msg });
+            writeErrors.push(`${a.filename ?? "image"}: ${msg}`);
+          }
+        }
+        const attachmentNotes = [];
+        if (savedPaths.length > 0) {
+          attachmentNotes.push(`[Attached file(s) saved to workspace:
+${savedPaths.map((p) => `- ${p}`).join("\n")}]`);
+        }
+        if (writeErrors.length > 0) {
+          attachmentNotes.push(`[Warning: failed to save attachment(s) to workspace \u2014 ${writeErrors.join("; ")}. The image is available via vision only.]`);
+        }
+        return {
+          message: attachmentNotes.length > 0 ? `${message}
+
+${attachmentNotes.join("\n")}` : message,
+          promptOpts: initialImages.length > 0 ? { images: initialImages } : void 0
+        };
+      }
+      async function startTurn(message, attachments) {
+        promptSettled = false;
+        const prepared = await prepareTurn(message, attachments);
+        return piSession.prompt(prepared.message, prepared.promptOpts).then(() => {
+          promptSettled = true;
+          if (pendingFollowUp !== void 0 && !ctx.abortSignal.aborted) {
+            const next = pendingFollowUp;
+            pendingFollowUp = void 0;
+            promptPromise = startTurn(next.message, next.attachments);
+          }
+        }).catch((err) => {
+          promptSettled = true;
+          streamError = err;
+          done = true;
+          stopHeartbeat();
+          if (wake) wake();
+        });
+      }
+      promptPromise = startTurn(input.message, input.attachments);
       const onAbort = () => {
         if (promptSettled) {
           streamError = new Error("Aborted");
@@ -3939,11 +4168,11 @@ function createPiCodingAgentHarness(opts) {
 
 // src/server/harness/pi-coding-agent/pluginLoader.ts
 import { readdir as readdir5, stat as stat5, readFile as readFile7 } from "fs/promises";
-import { join as join6, extname, resolve as resolve4, sep as sep3 } from "path";
+import { join as join7, extname as extname2, resolve as resolve4, sep as sep3 } from "path";
 import { homedir as homedir4 } from "os";
 import { pathToFileURL } from "url";
 var VALID_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs"]);
-var GLOBAL_DIR = join6(homedir4(), ".pi", "agent", "extensions");
+var GLOBAL_DIR = join7(homedir4(), ".pi", "agent", "extensions");
 var LOCAL_DIR = ".pi/extensions";
 var EXTENSIONS_JSON = ".pi/extensions.json";
 async function dirExists(path4) {
@@ -3965,7 +4194,7 @@ async function fileExists2(path4) {
 async function discoverFromDir(dir, source) {
   if (!await dirExists(dir)) return [];
   const entries = await readdir5(dir);
-  return entries.filter((e) => VALID_EXTENSIONS.has(extname(e))).map((e) => ({ path: join6(dir, e), source }));
+  return entries.filter((e) => VALID_EXTENSIONS.has(extname2(e))).map((e) => ({ path: join7(dir, e), source }));
 }
 function extractTools(mod) {
   const tools = [];
@@ -3995,17 +4224,17 @@ async function loadModule(filePath, importFn) {
   return extractTools(mod);
 }
 async function discoverNpmPlugins(cwd) {
-  const nodeModulesDir = join6(cwd, "node_modules");
+  const nodeModulesDir = join7(cwd, "node_modules");
   if (!await dirExists(nodeModulesDir)) return [];
   try {
     const entries = await readdir5(nodeModulesDir);
-    return entries.filter((e) => e.startsWith("pi-plugin-")).map((e) => join6(nodeModulesDir, e));
+    return entries.filter((e) => e.startsWith("pi-plugin-")).map((e) => join7(nodeModulesDir, e));
   } catch {
     return [];
   }
 }
 async function loadNpmPlugin(pkgDir, importFn) {
-  const pkgJsonPath = join6(pkgDir, "package.json");
+  const pkgJsonPath = join7(pkgDir, "package.json");
   if (!await fileExists2(pkgJsonPath)) return [];
   const pkgJson = JSON.parse(await readFile7(pkgJsonPath, "utf-8"));
   const main = pkgJson.main ?? "index.js";
@@ -4017,7 +4246,7 @@ async function loadNpmPlugin(pkgDir, importFn) {
   return loadModule(resolvedMain, importFn);
 }
 async function loadExtensionsJson(cwd) {
-  const configPath = join6(cwd, EXTENSIONS_JSON);
+  const configPath = join7(cwd, EXTENSIONS_JSON);
   if (!await fileExists2(configPath)) return null;
   try {
     const raw = await readFile7(configPath, "utf-8");
@@ -4035,7 +4264,7 @@ async function loadPlugins(options) {
     const globals = await discoverFromDir(GLOBAL_DIR, "global");
     candidates.push(...globals);
   }
-  const localDir = join6(options.cwd, LOCAL_DIR);
+  const localDir = join7(options.cwd, LOCAL_DIR);
   const locals = await discoverFromDir(localDir, "local");
   candidates.push(...locals);
   const npmDirs = await discoverNpmPlugins(options.cwd);
@@ -4045,7 +4274,7 @@ async function loadPlugins(options) {
   const config = await loadExtensionsJson(options.cwd);
   if (config?.npm) {
     for (const pkg of config.npm) {
-      const pkgDir = join6(options.cwd, "node_modules", pkg);
+      const pkgDir = join7(options.cwd, "node_modules", pkg);
       if (await dirExists(pkgDir)) {
         const already = candidates.some((c) => c.path === pkgDir);
         if (!already) {
@@ -4094,7 +4323,7 @@ import {
 
 // src/server/tools/operations/bound.ts
 import { constants as constants3 } from "fs";
-import { access as access3, lstat as lstat3, mkdir as mkdir9, readFile as readFile8, readdir as readdir6, readlink, realpath as realpath2, stat as stat6, writeFile as writeFile7 } from "fs/promises";
+import { access as access3, lstat as lstat3, mkdir as mkdir10, readFile as readFile8, readdir as readdir6, readlink, realpath as realpath2, stat as stat6, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname6, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "path";
 function toPosixPath(value) {
   return value.split("\\").join("/");
@@ -4232,12 +4461,12 @@ function boundFs(workspaceRoot) {
   const write = {
     async writeFile(absolutePath, content) {
       await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await mkdir9(dirname6(absolutePath), { recursive: true });
-      await writeFile7(absolutePath, content);
+      await mkdir10(dirname6(absolutePath), { recursive: true });
+      await writeFile8(absolutePath, content);
     },
     async mkdir(dir) {
       await assertWithinWorkspace(workspaceRoot, dir);
-      await mkdir9(dir, { recursive: true });
+      await mkdir10(dir, { recursive: true });
     }
   };
   const edit = {
@@ -4247,7 +4476,7 @@ function boundFs(workspaceRoot) {
     },
     async writeFile(absolutePath, content) {
       await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await writeFile7(absolutePath, content);
+      await writeFile8(absolutePath, content);
     },
     async access(absolutePath) {
       await assertWithinWorkspace(workspaceRoot, absolutePath);
@@ -4920,6 +5149,13 @@ function healthRoutes(app, opts, done) {
 }
 
 // src/server/http/routes/file.ts
+import { dirname as dirname7, extname as extname3, relative as relative7 } from "path/posix";
+var BORING_SETTINGS_PATH = ".boring/settings";
+var DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR = "assets/images";
+var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+function defaultWorkspaceSettings() {
+  return { markdown: { imageUploadDir: DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR } };
+}
 function isPathValidationError(err) {
   return err instanceof Error && typeof err.reason === "string";
 }
@@ -4965,12 +5201,108 @@ function requireStringParam(value, field, reply) {
   }
   return value;
 }
+function parseWorkspaceSettings(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const dir = parsed?.markdown?.imageUploadDir;
+    return {
+      ...parsed,
+      markdown: {
+        ...parsed.markdown ?? {},
+        imageUploadDir: typeof dir === "string" && dir.trim() ? dir.trim() : DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR
+      }
+    };
+  } catch {
+    return defaultWorkspaceSettings();
+  }
+}
+async function readWorkspaceSettings(workspace) {
+  try {
+    return parseWorkspaceSettings(await workspace.readFile(BORING_SETTINGS_PATH));
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT") return defaultWorkspaceSettings();
+    throw error;
+  }
+}
+function normalizeUploadDir(value) {
+  if (typeof value !== "string") return null;
+  const dir = value.trim().replace(/^\.\/+/, "").replace(/\/+/g, "/");
+  if (!dir || dir.includes("\0") || dir.startsWith("/") || dir.split("/").includes("..")) return null;
+  return dir.replace(/\/+$/, "");
+}
+function extForUpload(filename, contentType) {
+  const fromName = extname3(filename).toLowerCase().replace(/^\./, "");
+  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
+  if (contentType === "image/jpeg") return "jpg";
+  if (contentType === "image/png") return "png";
+  if (contentType === "image/gif") return "gif";
+  if (contentType === "image/webp") return "webp";
+  if (contentType === "image/svg+xml") return "svg";
+  return "bin";
+}
+function basenameForUpload(filename) {
+  const base = filename.split("/").pop()?.split("\\").pop() ?? "image";
+  const withoutExt = base.replace(/\.[^.]*$/, "");
+  const safe = withoutExt.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return safe || "image";
+}
+function markdownUrlFor(sourcePath, assetPath) {
+  if (!sourcePath) return assetPath;
+  const fromDir = dirname7(sourcePath.replace(/\\/g, "/"));
+  const rel = relative7(fromDir === "." ? "" : fromDir, assetPath);
+  return rel && !rel.startsWith(".") ? rel : rel || assetPath;
+}
+function contentTypeForPath(path4) {
+  switch (extname3(path4).toLowerCase()) {
+    case ".avif":
+      return "image/avif";
+    case ".gif":
+      return "image/gif";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".png":
+      return "image/png";
+    case ".svg":
+      return "image/svg+xml";
+    case ".webp":
+      return "image/webp";
+    case ".pdf":
+      return "application/pdf";
+    default:
+      return "application/octet-stream";
+  }
+}
 function fileRoutes(app, opts, done) {
   async function resolveWorkspace(request) {
     if (opts.getWorkspace) return await opts.getWorkspace(request);
     if (opts.workspace) return opts.workspace;
     throw new Error("file route requires workspace or getWorkspace");
   }
+  app.get("/api/v1/files/raw", async (request, reply) => {
+    const query = request.query;
+    const path4 = requireStringParam(query.path, "path", reply);
+    if (path4 === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      if (!workspace.readBinaryFile) {
+        return reply.code(501).send({
+          error: { code: ERROR_CODE_INTERNAL, message: "workspace does not support binary reads" }
+        });
+      }
+      const stat7 = await workspace.stat(path4);
+      if (stat7.kind !== "file") {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: "path is not a file", field: "path" }
+        });
+      }
+      const bytes = await workspace.readBinaryFile(path4);
+      return reply.header("content-type", contentTypeForPath(path4)).header("content-length", String(bytes.byteLength)).header("cache-control", "no-store").send(Buffer.from(bytes));
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
   app.get("/api/v1/files", async (request, reply) => {
     const query = request.query;
     const path4 = requireStringParam(query.path, "path", reply);
@@ -5041,6 +5373,87 @@ function fileRoutes(app, opts, done) {
       return classifyError(err, reply, "file");
     }
   });
+  app.post("/api/v1/files/upload", async (request, reply) => {
+    const body = request.body;
+    const filename = requireStringParam(body?.filename, "filename", reply);
+    if (filename === null) return;
+    const contentBase64 = requireStringParam(body?.contentBase64, "contentBase64", reply);
+    if (contentBase64 === null) return;
+    const contentType = typeof body.contentType === "string" ? body.contentType.trim().toLowerCase() : "";
+    if (!contentType.startsWith("image/")) {
+      return reply.code(400).send({
+        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "contentType must be an image/* MIME type", field: "contentType" }
+      });
+    }
+    try {
+      const workspace = await resolveWorkspace(request);
+      const settings = await readWorkspaceSettings(workspace);
+      const dir = normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR;
+      const ext = extForUpload(filename, contentType);
+      const base = basenameForUpload(filename);
+      const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+      const path4 = `${dir}/${base}-${unique}.${ext}`;
+      const bytes = Buffer.from(contentBase64, "base64");
+      if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES) {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: `upload must be 1 byte to ${MAX_UPLOAD_BYTES} bytes`, field: "contentBase64" }
+        });
+      }
+      await workspace.mkdir(dir, { recursive: true });
+      const stat7 = workspace.writeBinaryFileWithStat ? await workspace.writeBinaryFileWithStat(path4, bytes) : await (async () => {
+        if (!workspace.writeBinaryFile) {
+          throw new Error("workspace does not support binary uploads");
+        }
+        await workspace.writeBinaryFile(path4, bytes);
+        return await workspace.stat(path4);
+      })();
+      const sourcePath = typeof body.sourcePath === "string" && !body.sourcePath.includes("\0") ? body.sourcePath : null;
+      return {
+        ok: true,
+        path: path4,
+        markdownUrl: markdownUrlFor(sourcePath, path4),
+        mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0
+      };
+    } catch (err) {
+      return classifyError(err, reply, "upload");
+    }
+  });
+  app.get("/api/v1/workspace-settings", async (request, reply) => {
+    try {
+      const workspace = await resolveWorkspace(request);
+      return { settings: await readWorkspaceSettings(workspace) };
+    } catch (err) {
+      return classifyError(err, reply, "settings");
+    }
+  });
+  app.put("/api/v1/workspace-settings", async (request, reply) => {
+    const body = request.body;
+    const incoming = body?.settings ?? body;
+    const markdown = incoming.markdown ?? {};
+    const imageUploadDir = normalizeUploadDir(markdown.imageUploadDir);
+    if (!imageUploadDir) {
+      return reply.code(400).send({
+        error: { code: ERROR_CODE_INVALID_PATH, message: "markdown.imageUploadDir must be a relative workspace path", field: "markdown.imageUploadDir" }
+      });
+    }
+    try {
+      const workspace = await resolveWorkspace(request);
+      const current = await readWorkspaceSettings(workspace);
+      const next = {
+        ...current,
+        markdown: {
+          ...current.markdown ?? {},
+          imageUploadDir
+        }
+      };
+      await workspace.mkdir(".boring", { recursive: true });
+      await workspace.writeFile(BORING_SETTINGS_PATH, `${JSON.stringify(next, null, 2)}
+`);
+      return { settings: next };
+    } catch (err) {
+      return classifyError(err, reply, "settings");
+    }
+  });
   app.delete("/api/v1/files", async (request, reply) => {
     const query = request.query;
     const path4 = requireStringParam(query.path, "path", reply);
@@ -5568,7 +5981,7 @@ function chatRoutes(app, opts, done) {
     "/api/v1/agent/chat",
     { preHandler: validateBody },
     async (request, reply) => {
-      const { sessionId, message, model, thinkingLevel } = request.body;
+      const { sessionId, message, model, thinkingLevel, attachments } = request.body;
       const turnId = randomUUID3();
       request.log.info({ sessionId, turnId, model, thinkingLevel }, "[chat] start");
       const runtime = await resolveRuntime(request);
@@ -5587,7 +6000,7 @@ function chatRoutes(app, opts, done) {
       const buf = buffers.create(sessionId, turnId);
       try {
         const chunks = runtime.harness.sendMessage(
-          { sessionId, message, model, thinkingLevel },
+          { sessionId, message, model, thinkingLevel, attachments },
           ctx
         );
         const stream = createUIMessageStream({
@@ -5719,6 +6132,36 @@ function chatRoutes(app, opts, done) {
       }
     }
   );
+  app.post(
+    "/api/v1/agent/chat/:sessionId/followup",
+    async (request, reply) => {
+      const { sessionId } = request.params;
+      const body = request.body;
+      if (typeof body?.message !== "string" || body.message.length === 0) {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: "message is required" }
+        });
+      }
+      const parsedAttachments = chatBodySchema.shape.attachments.safeParse(body.attachments);
+      if (!parsedAttachments.success) {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: "attachments is invalid" }
+        });
+      }
+      const runtime = await resolveRuntime(request);
+      runtime.harness.followUp?.(sessionId, body.message, parsedAttachments.data);
+      return reply.code(202).send({ queued: true });
+    }
+  );
+  app.delete(
+    "/api/v1/agent/chat/:sessionId/followup",
+    async (request, reply) => {
+      const { sessionId } = request.params;
+      const runtime = await resolveRuntime(request);
+      runtime.harness.clearFollowUp?.(sessionId);
+      return reply.code(204).send();
+    }
+  );
   app.put(
     "/api/v1/agent/chat/:sessionId/messages",
     async (request, reply) => {
@@ -5806,7 +6249,11 @@ function skillsRoutes(app, opts, done) {
       return reply.code(200).send({ skills: cached.skills });
     }
     try {
-      const result = loadSkills2({ cwd: opts.workspaceRoot, includeDefaults: true });
+      const result = loadSkills2({
+        cwd: opts.workspaceRoot,
+        skillPaths: opts.additionalSkillPaths ?? [],
+        includeDefaults: true
+      });
       const skills = result.skills.map((s) => ({
         name: s.name,
         description: s.description
@@ -6221,7 +6668,7 @@ async function createAgentApp(opts = {}) {
   const workspaceRoot = opts.workspaceRoot ?? process.cwd();
   const sessionId = opts.sessionId ?? DEFAULT_SESSION_ID;
   const templatePath = opts.templatePath ?? getEnv("BORING_AGENT_TEMPLATE_PATH");
-  const app = Fastify({ logger: opts.logger ?? true });
+  const app = Fastify({ logger: opts.logger ?? true, bodyLimit: 16 * 1024 * 1024 });
   const resolvedMode = opts.mode ?? autoDetectMode();
   const runtimeBundle = await resolveMode(resolvedMode).create({
     workspaceRoot,
@@ -6289,7 +6736,10 @@ async function createAgentApp(opts = {}) {
   });
   await app.register(systemPromptRoutes, { harness });
   await app.register(modelsRoutes);
-  await app.register(skillsRoutes, { workspaceRoot });
+  await app.register(skillsRoutes, {
+    workspaceRoot,
+    additionalSkillPaths: opts.resourceLoaderOptions?.additionalSkillPaths
+  });
   await app.register(sessionChangesRoutes, { tracker: sessionChangesTracker });
   await app.register(catalogRoutes, { tools });
   await app.register(readyStatusRoutes, { tracker: readyTracker });
@@ -6350,6 +6800,113 @@ function mergeTools(options) {
   return [...merged.values()];
 }
 
+// src/server/tools/upload/index.ts
+import { readFile as readFile9 } from "fs/promises";
+import { extname as extname4, join as join8 } from "path";
+var DEFAULT_UPLOAD_DIR = "assets/images";
+var MAX_UPLOAD_BYTES2 = 10 * 1024 * 1024;
+function contentTypeFromExt(path4) {
+  switch (extname4(path4).toLowerCase()) {
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".png":
+      return "image/png";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".svg":
+      return "image/svg+xml";
+    case ".avif":
+      return "image/avif";
+    default:
+      return "application/octet-stream";
+  }
+}
+function extForUpload2(filename, contentType) {
+  const fromName = extname4(filename).toLowerCase().replace(/^\./, "");
+  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
+  if (contentType === "image/jpeg") return "jpg";
+  if (contentType === "image/png") return "png";
+  if (contentType === "image/gif") return "gif";
+  if (contentType === "image/webp") return "webp";
+  if (contentType === "image/svg+xml") return "svg";
+  return "bin";
+}
+function basenameForUpload2(filename) {
+  const base = filename.split("/").pop()?.split("\\").pop() ?? "image";
+  const withoutExt = base.replace(/\.[^.]*$/, "");
+  const safe = withoutExt.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return safe || "image";
+}
+function buildUploadAgentTools(bundle) {
+  const { workspace } = bundle;
+  const cwd = workspace.root;
+  return [
+    {
+      name: "upload_file",
+      description: "Copy a workspace file into artifact storage (assets/images by default) and return its workspace-relative path. Use this when you want to embed an image in markdown or make a generated file accessible as a stable artifact. The returned path can be used directly in markdown image syntax: ![](returned-path)",
+      parameters: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description: 'Workspace-relative path of the source file (e.g. "chart.png" or "output/plot.png")'
+          },
+          directory: {
+            type: "string",
+            description: `Destination directory inside the workspace. Defaults to "${DEFAULT_UPLOAD_DIR}".`
+          }
+        },
+        required: ["path"],
+        additionalProperties: false
+      },
+      async execute(input) {
+        const filePath = typeof input.path === "string" ? input.path.trim() : "";
+        if (!filePath || filePath.includes("\0") || filePath.startsWith("/") || filePath.split("/").includes("..")) {
+          return { content: [{ type: "text", text: "invalid path" }], isError: true };
+        }
+        const rawDir = typeof input.directory === "string" ? input.directory.trim() : "";
+        const dir = rawDir ? rawDir.replace(/^\.\/+/, "").replace(/\/+$/, "") : DEFAULT_UPLOAD_DIR;
+        try {
+          const bytes = await readFile9(join8(cwd, filePath));
+          if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES2) {
+            return {
+              content: [{ type: "text", text: `file must be between 1 byte and ${MAX_UPLOAD_BYTES2} bytes` }],
+              isError: true
+            };
+          }
+          const contentType = contentTypeFromExt(filePath);
+          const ext = extForUpload2(filePath, contentType);
+          const base = basenameForUpload2(filePath);
+          const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+          const destPath = `${dir}/${base}-${unique}.${ext}`;
+          await workspace.mkdir(dir, { recursive: true });
+          if (workspace.writeBinaryFile) {
+            await workspace.writeBinaryFile(destPath, bytes);
+          } else {
+            return {
+              content: [{ type: "text", text: "workspace does not support binary file writes" }],
+              isError: true
+            };
+          }
+          return {
+            content: [{ type: "text", text: `Uploaded to ${destPath}` }],
+            isError: false,
+            details: { path: destPath }
+          };
+        } catch (err) {
+          return {
+            content: [{ type: "text", text: err instanceof Error ? err.message : "upload failed" }],
+            isError: true
+          };
+        }
+      }
+    }
+  ];
+}
+
 // src/server/registerAgentRoutes.ts
 var DEFAULT_VERSION2 = "0.1.0-dev";
 var DEFAULT_WORKSPACE_ID3 = "default";
@@ -6420,16 +6977,18 @@ var registerAgentRoutes = async (app, opts) => {
       key: `${resolvedMode}:${workspaceId}:${root}`
     };
   }
-  async function createRuntimeBinding(workspaceId, root) {
+  async function createRuntimeBinding(workspaceId, root, request) {
+    const scopedTemplatePath = opts.getTemplatePath ? await opts.getTemplatePath({ workspaceId, workspaceRoot: root, request }) : templatePath;
     const runtimeBundle = await modeAdapter.create({
       workspaceRoot: root,
       sessionId: workspaceId,
       workspaceId,
-      templatePath
+      templatePath: scopedTemplatePath
     });
     const standardTools = [
       ...buildHarnessAgentTools(runtimeBundle),
-      ...buildFilesystemAgentTools(runtimeBundle)
+      ...buildFilesystemAgentTools(runtimeBundle),
+      ...buildUploadAgentTools(runtimeBundle)
     ];
     const pluginTools = [];
     if (resolvedMode !== "vercel-sandbox") {
@@ -6494,7 +7053,7 @@ var registerAgentRoutes = async (app, opts) => {
         await existing
       );
     }
-    const created = createRuntimeBinding(workspaceId, scope.root);
+    const created = createRuntimeBinding(workspaceId, scope.root, request);
     runtimeBindings.set(scope.key, created);
     try {
       return await ensureRuntimeBindingReady(
@@ -6631,7 +7190,10 @@ var registerAgentRoutes = async (app, opts) => {
     getHarness: async (request) => (await getBindingForRequest(request)).harness
   });
   await app.register(modelsRoutes);
-  await app.register(skillsRoutes, { workspaceRoot });
+  await app.register(skillsRoutes, {
+    workspaceRoot,
+    additionalSkillPaths: opts.resourceLoaderOptions?.additionalSkillPaths
+  });
   await app.register(sessionChangesRoutes, { tracker: sessionChangesTracker });
   await app.register(
     catalogRoutes,