@kosuke-ai/kosuke 1.0.50 → 1.0.51

package/dist/generated/commands/sessions/create.js

@@ -241,7 +241,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/prompt-update.js

@@ -75,7 +75,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/queue-update.js

@@ -50,7 +50,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/sessions/send.js

@@ -131,7 +131,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{projectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/generated/commands/tasks/create.js

@@ -285,7 +285,8 @@ export const operation = {
     ],
     "attachments": {
         "maxFiles": 20,
-        "maxBytes": 10485760
+        "maxBytes": 10485760,
+        "uploadPath": "/api/projects/{hintProjectId}/attachments"
     },
     "anonymous": false,
     "agents": "all"

package/dist/runtime/attach.js

@@ -184,8 +184,22 @@ async function run(leaf, runtime, operation, input) {
         anonymous: operation.anonymous,
         answerTimeoutMs: operation.answerTimeoutMs,
     });
-    const outcome = await execute(client, request);
-    runtime.output(outcome);
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    // Stop in-flight staging and prevent the final send on a CLI interruption.
+    // Hard exits and lost responses are covered by the server's staging expiry.
+    if (request.deferredAttachments) {
+        process.once('SIGINT', cancel);
+        process.once('SIGTERM', cancel);
+    }
+    try {
+        const outcome = await execute(client, request, controller.signal);
+        runtime.output(outcome);
+    }
+    finally {
+        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGTERM', cancel);
+    }
 }
 /** `(personal only)`, `(workspace only)`, `(--provider claude_code, codex)`; empty for all. */
 function whoTakes(leafFlag, forms) {

package/dist/runtime/attachments.js

@@ -1,4 +1,4 @@
-import { readFileSync, statSync } from 'node:fs';
+import { openAsBlob, readFileSync, statSync } from 'node:fs';
 import { basename, extname } from 'node:path';
 /**
  * Files on a multipart request, the way the platform reads them.
@@ -46,18 +46,47 @@ function formatBytes(bytes) {
     const mib = bytes / (1024 * 1024);
     return Number.isInteger(mib) ? `${mib} MiB` : `${bytes}-byte`;
 }
-export function appendAttachments(form, paths, { maxFiles, maxBytes }) {
+/** Leave room for multipart overhead below the app proxy's body limit. */
+export const INLINE_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+/** Validate the entire batch before reading or uploading any file. */
+export function attachmentBytes(paths, { maxFiles, maxBytes }) {
     if (paths.length > maxFiles) {
         throw new Error(`At most ${maxFiles} attachments per request; ${paths.length} given.`);
     }
-    // Size from the inode before the read: a file past the cap must fail with
-    // this message, not with the runtime's own error once it has been loaded.
+    let total = 0;
     for (const path of paths) {
-        if (statSync(path).size > maxBytes) {
-            throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
-        }
+        const size = statSync(path).size;
+        checkSize(path, size, maxBytes);
+        total += size;
     }
-    const files = paths.map((path) => new File([readFileSync(path)], basename(path), { type: mediaTypeFor(path) }));
+    return total;
+}
+function checkSize(path, size, maxBytes) {
+    if (size > maxBytes) {
+        throw new Error(`${path} is larger than the ${formatBytes(maxBytes)} attachment limit.`);
+    }
+}
+export function appendAttachments(form, paths, limits) {
+    attachmentBytes(paths, limits);
+    const files = paths.map((path) => {
+        const bytes = readFileSync(path);
+        checkSize(path, bytes.length, limits.maxBytes);
+        return new File([bytes], basename(path), { type: mediaTypeFor(path) });
+    });
     form.set('attachmentCount', String(files.length));
     files.forEach((file, index) => form.set(`attachment_${index}`, file));
 }
+/** File-backed blobs stream on send and reject if the file changes during upload. */
+export async function appendStreamingAttachments(form, paths, limits, signal) {
+    attachmentBytes(paths, limits);
+    const files = [];
+    for (const path of paths) {
+        signal?.throwIfAborted();
+        const file = await openAsBlob(path, { type: mediaTypeFor(path) });
+        checkSize(path, file.size, limits.maxBytes);
+        files.push(file);
+    }
+    signal?.throwIfAborted();
+    form.set('attachmentCount', String(files.length));
+    files.forEach((file, index) => form.set(`attachment_${index}`, file, basename(paths[index])));
+}

package/dist/runtime/client.js

@@ -77,10 +77,29 @@ function isRetryable(error, repeatable) {
         return true;
     return repeatable && AMBIGUOUS_CODES.includes(code);
 }
+// Retrying a consumed multipart Request needs a fresh stream. Keep the original
+// FormData (whose large files are disk-backed), not a cloned/teed 200 MiB body.
+const multipartReplays = new WeakMap();
+class MultipartRequest extends Request {
+    constructor(input, init) {
+        super(input, init);
+        if (init?.body instanceof FormData) {
+            multipartReplays.set(this, () => {
+                const headers = new Headers(this.headers);
+                headers.delete('content-type'); // The fresh form serializer chooses its boundary.
+                return new Request(this.url, { ...init, headers, signal: this.signal });
+            });
+        }
+    }
+}
 function withTransportRetry(fetchImpl) {
     return async (...args) => {
+        const replay = args[0] instanceof Request ? multipartReplays.get(args[0]) : undefined;
         let attempt = 0;
         for (;;) {
+            signalOf(args)?.throwIfAborted();
+            if (attempt && replay)
+                args = [replay(), args[1]];
             attempt++;
             try {
                 return await fetchImpl(...args);
@@ -178,6 +197,7 @@ function withIntegrationCap(fetchImpl) {
 export function createApiClient({ apiUrl, apiKey, fetch, answerTimeoutMs, }) {
     const base = fetch ?? globalThis.fetch;
     return createClient({
+        Request: MultipartRequest,
         baseUrl: apiUrl,
         headers: {
             ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),

package/dist/runtime/invoke.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs';
-import { appendAttachments } from './attachments.js';
+import { defaultPathSerializer } from 'openapi-fetch';
+import { appendAttachments, appendStreamingAttachments, attachmentBytes, INLINE_ATTACHMENT_BYTES, } from './attachments.js';
 export class UsageError extends Error {
 }
 export function buildRequest(operation, input) {
@@ -16,12 +17,18 @@ export function buildRequest(operation, input) {
         }
     }
     const bodyFields = Object.fromEntries(Object.entries(input.fields).filter(([name, value]) => !queryNames.has(name) && value !== undefined));
+    const deferredAttachments = operation.attachments &&
+        input.attachments.length &&
+        attachmentBytes(input.attachments, operation.attachments) > INLINE_ATTACHMENT_BYTES
+        ? { paths: [...input.attachments], limits: operation.attachments }
+        : undefined;
     return {
+        ...(deferredAttachments ? { deferredAttachments } : {}),
         method: operation.method,
         path: operation.path,
         pathParams: input.pathParams,
         query,
-        body: buildBody(operation, bodyFields, input),
+        body: buildBody(operation, bodyFields, input, !!deferredAttachments),
     };
 }
 /**
@@ -30,7 +37,7 @@ export function buildRequest(operation, input) {
  * JSON otherwise, including an empty `{}` for a body-taking operation given
  * nothing, which is how the deploy route reads "start a deploy".
  */
-function buildBody(operation, fields, input) {
+function buildBody(operation, fields, input, deferAttachments = false) {
     const takesJson = operation.body !== null;
     const takesMultipart = operation.multipart !== null;
     if (!takesJson && !takesMultipart) {
@@ -75,7 +82,7 @@ function buildBody(operation, fields, input) {
                 throw new UsageError(`--${field.flag} is required.`);
             }
         }
-        if (input.attachments.length && operation.attachments)
+        if (input.attachments.length && operation.attachments && !deferAttachments)
             appendAttachments(form, input.attachments, operation.attachments);
         return { kind: 'multipart', value: form };
     }
@@ -139,9 +146,22 @@ export function readWholeBody(options, readStdin = () => readFileSync(0, 'utf8')
         throw new UsageError('The body is not valid JSON.');
     }
 }
-export async function execute(client, request) {
+export async function execute(client, request, signal) {
+    signal?.throwIfAborted();
+    if (request.deferredAttachments && request.body?.kind === 'multipart') {
+        // Build a fresh form per execution. Retrying never reuses partially staged slots.
+        const form = new FormData();
+        for (const [key, value] of request.body.value)
+            form.append(key, value);
+        const failure = await prepareAttachments(client, request, form, signal);
+        if (failure)
+            return failure;
+        request = { ...request, body: { kind: 'multipart', value: form } };
+    }
+    signal?.throwIfAborted();
     const init = {
         params: { path: request.pathParams, query: request.query },
+        ...(signal ? { signal } : {}),
     };
     if (request.body)
         init.body = request.body.value;
@@ -150,3 +170,98 @@ export async function execute(client, request) {
     const { data, error, response } = await client.request(request.method, request.path, init);
     return { ok: response.ok, status: response.status, body: response.ok ? data : error };
 }
+/**
+ * Staging uses the same client/auth/retry policy as the message. A first API
+ * catch-all 404 or 405 permits the legacy inline form. No fallback on an auth,
+ * validation or transport failure, or after any upload has succeeded.
+ * Unconsumed staging is reclaimed by the server's bounded expiry sweep; never
+ * delete a reference after a message failure, whose commit may have succeeded.
+ */
+async function prepareAttachments(client, request, form, signal) {
+    const { paths, limits } = request.deferredAttachments;
+    attachmentBytes(paths, limits);
+    const uploadPath = limits.uploadPath;
+    if (!uploadPath) {
+        await appendStreamingAttachments(form, paths, limits, signal);
+        return;
+    }
+    const uploadParams = {};
+    for (const match of uploadPath.matchAll(/\{([^}]+)\}/g)) {
+        const name = match[1];
+        const value = request.pathParams[name] ?? form.get(name);
+        if (typeof value !== 'string' || !value) {
+            throw new UsageError(`Missing attachment upload parameter "${name}".`);
+        }
+        uploadParams[name] = value;
+    }
+    const controller = new AbortController();
+    const uploadSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+    const references = new Array(paths.length);
+    let failure;
+    let next = 0;
+    const upload = async (index) => {
+        uploadSignal.throwIfAborted();
+        const body = new FormData();
+        await appendStreamingAttachments(body, [paths[index]], limits, uploadSignal);
+        const outcome = await execute(client, {
+            method: 'post',
+            path: uploadPath,
+            pathParams: uploadParams,
+            query: {},
+            body: { kind: 'multipart', value: body },
+        }, uploadSignal);
+        uploadSignal.throwIfAborted();
+        if (outcome.ok) {
+            const reference = stagedReference(outcome.body);
+            if (!reference)
+                throw new Error('Invalid attachment upload response.');
+            references[index] = reference;
+        }
+        return outcome;
+    };
+    // Discover legacy support before starting the other requests.
+    const first = await upload(next++);
+    if (!first.ok) {
+        const error = asRecordOrEmpty(first.body);
+        const missingRoute = first.status === 404 &&
+            error.code === 'NOT_FOUND' &&
+            error.error === `No API route at ${defaultPathSerializer(uploadPath, uploadParams)}`;
+        if (missingRoute || first.status === 405) {
+            await appendStreamingAttachments(form, paths, limits, signal);
+            return;
+        }
+        return first;
+    }
+    const worker = async () => {
+        try {
+            while (next < paths.length) {
+                uploadSignal.throwIfAborted();
+                const outcome = await upload(next++);
+                if (!outcome.ok) {
+                    failure ??= outcome;
+                    controller.abort();
+                    return;
+                }
+            }
+        }
+        catch (error) {
+            controller.abort(error);
+            throw error;
+        }
+    };
+    // Drain all requests after abort: nothing continues in the background on return.
+    const workers = await Promise.allSettled(Array.from({ length: Math.min(3, paths.length - next) }, worker));
+    signal?.throwIfAborted();
+    if (failure)
+        return failure;
+    const rejected = workers.find((result) => result.status === 'rejected');
+    if (rejected?.status === 'rejected')
+        throw controller.signal.reason;
+    form.set('attachmentCount', String(references.length));
+    references.forEach((reference, index) => form.set(`attachment_${index}`, reference));
+}
+function stagedReference(body) {
+    const data = asRecordOrEmpty(body).data;
+    const reference = asRecordOrEmpty(data).reference;
+    return typeof reference === 'string' && reference.length > 0 ? reference : undefined;
+}

package/openapi.json

@@ -8360,6 +8360,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{hintProjectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -10252,6 +10253,75 @@
         }
       }
     },
+    "/api/projects/{projectId}/attachments": {
+      "post": {
+        "operationId": "attachmentsCreate",
+        "summary": "Stage one private message attachment. Returns data.reference for an attachment slot in a subsequent message to this project, using the same credential, within one hour.",
+        "tags": ["attachments"],
+        "x-kosuke-command": ["attachments", "create"],
+        "x-kosuke-attachments": true,
+        "x-kosuke-attachment-max-files": 1,
+        "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
+        "parameters": [
+          {
+            "name": "projectId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/projects/{projectId}/backlog-items": {
       "get": {
         "operationId": "projectsBacklogItemsList",
@@ -11316,6 +11386,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -12641,6 +12712,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -14432,6 +14504,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -15648,6 +15721,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18454,6 +18528,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
@@ -18741,6 +18816,7 @@
         "x-kosuke-attachments": true,
         "x-kosuke-attachment-max-files": 20,
         "x-kosuke-attachment-max-bytes": 10485760,
+        "x-kosuke-attachment-upload-path": "/api/projects/{projectId}/attachments",
         "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosuke-ai/kosuke",
-  "version": "1.0.50",
+  "version": "1.0.51",
   "description": "Kosuke platform CLI. The client customers install to drive app.kosuke.ai from their own machine.",
   "license": "MIT",
   "repository": {
@@ -40,11 +40,10 @@
     "vitest": "^4.1.12"
   },
   "kosukeRelease": {
-    "sourceCommit": "783c56f80b3c75df5f129ad9ef32d5f2cf0e7a92",
-    "sourceIdentity": "97a8761f0d47f9900bc37d7da2fb71dd14fc32222a97ec5d248c32986cd63bcd",
+    "sourceCommit": "11e0393d7adbd35a8589bef145e005e29aa8d1a7",
+    "sourceIdentity": "39feb5bff790b571ed2317abfb3663d6bfac98ad68ff123b03e57b51389bddbc",
     "fragments": [
-      "cli-internal-marks-3q4y00.json",
-      "device-approval-per-turn-23f44b.json"
+      "cli-staged-attachments.json"
     ]
   }
 }