@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.54

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/harness/codex-app-server-proxy.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -446,6 +447,7 @@ export function runCodexAppServerProxy() {
             });
         }
     };
+    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -456,6 +458,7 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
+        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -488,10 +491,11 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        writeToChild(rewritten);
+        if (!inventory || inventory.observeClientLine(rewritten))
+            writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && recovery.observeServerLine(line))
+        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex-file-inventory.d.ts

@@ -0,0 +1,15 @@
+export declare class CodexFileInventory {
+    private readonly sendToCodex;
+    private readonly emitToClient;
+    private checks;
+    private sequence;
+    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line: string): boolean;
+    observeServerLine(line: string): boolean;
+    close(): void;
+    private query;
+    private qualified;
+    private finish;
+    private reject;
+}

package/dist/harness/codex-file-inventory.js

@@ -0,0 +1,113 @@
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const parse = (line) => { try {
+    const v = JSON.parse(line);
+    return object(v) ? v : undefined;
+}
+catch {
+    return undefined;
+} };
+export class CodexFileInventory {
+    sendToCodex;
+    emitToClient;
+    checks = new Map();
+    sequence = 0;
+    constructor(sendToCodex, emitToClient) {
+        this.sendToCodex = sendToCodex;
+        this.emitToClient = emitToClient;
+    }
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line) {
+        const message = parse(line);
+        if (message?.method !== 'turn/start')
+            return true;
+        const threadId = object(message.params) ? message.params.threadId : undefined;
+        if (typeof threadId !== 'string' || !threadId || message.id === undefined || this.checks.size >= 8) {
+            this.reject(message);
+            return false;
+        }
+        const check = { request: message, threadId, servers: [], cursors: new Set(), timer: setTimeout(() => {
+                for (const [id, c] of this.checks)
+                    if (c === check)
+                        this.checks.delete(id);
+                this.reject(message);
+            }, 30_000) };
+        this.query(check);
+        return false;
+    }
+    observeServerLine(line) {
+        const message = parse(line), id = message?.id;
+        if (typeof id !== 'string')
+            return true;
+        const check = this.checks.get(id);
+        if (!check)
+            return true;
+        this.checks.delete(id);
+        const result = message?.result;
+        if (!object(result) || !Array.isArray(result.data) || result.data.some(s => !object(s)) || check.servers.length + result.data.length > 1000) {
+            this.finish(check, false);
+            return false;
+        }
+        check.servers.push(...result.data);
+        if (result.nextCursor !== null) {
+            const cursor = result.nextCursor;
+            if (typeof cursor !== 'string' || !cursor || check.cursors.has(cursor) || check.cursors.size >= 10)
+                this.finish(check, false);
+            else {
+                check.cursors.add(cursor);
+                this.query(check, cursor);
+            }
+            return false;
+        }
+        this.finish(check, this.qualified(check.servers));
+        return false;
+    }
+    close() { for (const c of this.checks.values())
+        clearTimeout(c.timer); this.checks.clear(); }
+    query(check, cursor) {
+        const id = `ours-fleet-file-inventory-${++this.sequence}`;
+        this.checks.set(id, check);
+        this.sendToCodex(JSON.stringify({ id, method: 'mcpServerStatus/list', params: { threadId: check.threadId, detail: 'full', limit: 100, ...(cursor ? { cursor } : {}) } }));
+    }
+    qualified(servers) {
+        let managed = 0;
+        for (const server of servers) {
+            // Unknown or failed discovery cannot establish absence of another connector.
+            if (server.toolsError !== null || !object(server.tools))
+                return false;
+            if (!object(server.serverInfo) || typeof server.serverInfo.name !== 'string')
+                return false;
+            const tools = Object.values(server.tools).filter(object);
+            const names = new Set(tools.map(t => t.name));
+            if (server.name !== 'ours') {
+                if (server.serverInfo.name === 'ours')
+                    return false;
+                if (tools.some(t => t.name === 'send_file' && object(t.inputSchema) && object(t.inputSchema.properties) && 'contact' in t.inputSchema.properties))
+                    return false;
+                if (names.has('current_identity') && names.has('send_file') && names.has('get_messages'))
+                    return false;
+                continue;
+            }
+            managed++;
+            if (server.serverInfo.name !== 'ours' || server.runtimeStatus !== 'connected')
+                return false;
+            const files = tools.filter(t => t.name === 'send_file');
+            if (files.length !== 1 || !object(files[0].inputSchema))
+                return false;
+            const schema = files[0].inputSchema;
+            if (!object(schema.properties) || !object(schema.properties.contact) || schema.additionalProperties !== false
+                || (Array.isArray(schema.required) && schema.required.includes('contact')))
+                return false;
+        }
+        return managed === 1;
+    }
+    finish(check, allowed) {
+        clearTimeout(check.timer);
+        if (allowed)
+            this.sendToCodex(JSON.stringify(check.request));
+        else
+            this.reject(check.request);
+    }
+    reject(request) {
+        this.emitToClient(JSON.stringify({ id: request.id, error: { code: -32000, message: 'CURRENT_CHAT_DELIVERY_UNAVAILABLE: unqualified MCP inventory' } }));
+    }
+}

package/dist/harness/codex.js

@@ -262,6 +262,7 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
+    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -482,7 +483,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);

package/dist/isolation/policy.js

@@ -1,3 +1,4 @@
+import { stateRoot } from '../paths.js';
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { BACKENDS, ON_UNAVAILABLE, NETWORK_MODES, } from './types.js';
@@ -57,7 +58,7 @@ const SYSTEM_RO = ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc'];
 /** Ephemeral scratch mounts. */
 const scratchTmpfs = (home) => ['/tmp', join(home, '.cache')];
 /** Home-relative sensitive paths never exposed (the blocklist's teeth). */
-const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', 'fleet.yaml', 'fleet.d'];
+const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', '.ours-fleet/private-ours', '.ours-fleet/private-file-delivery', 'fleet.yaml', 'fleet.d'];
 const ISOLATION_KEYS = ['backend', 'on_unavailable', 'fs', 'network', 'allow_hosts', 'resources', 'secrets'];
 const FS_KEYS = ['read', 'write'];
 const RESOURCE_KEYS = ['cpu', 'mem', 'pids'];
@@ -189,6 +190,8 @@ export function resolveIsolation(cfg, ctx) {
     const agentsRoot = dirname(stateDir);
     const blocklist = [
         ...SENSITIVE_HOME.map(p => join(home, p)),
+        join(stateRoot(), 'private-ours'),
+        join(stateRoot(), 'private-file-delivery'),
         agentsRoot, // sibling agents' state dirs (this agent's own is explicitly mounted)
     ];
     // ENFORCE the list, before anything builds a backend argv. Until now it was

package/dist/runner.js

@@ -675,6 +675,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 cwd: runCwd, stateDir: dir, mode, permissions: perms,
                 permissionMode: effectivePermissionMode(role), log: deps.log,
             }));
+            managedService.setFileDelivery?.(agentSession.sendFileToChat?.bind(agentSession));
             startupTelemetry.mark('harness_ready');
             pid = agentSession.pid;
             arbiter = new RoleTurnArbiter(agentSession);

package/dist/session/acp.d.ts

@@ -1,3 +1,4 @@
+import type { FileDeliveryInput, CopyChatFile, DeliveredFile } from '../file-delivery/types.js';
 import { type TaskNoticeBinding, type TaskCreatedNotice } from './task-notice.js';
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
@@ -176,6 +177,7 @@ export declare class AcpSession implements AgentSession {
     private stallTimer?;
     private stallAttempt?;
     private readonly toolBoundaryWaiters;
+    private fileExportBusy;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
@@ -303,6 +305,8 @@ export declare class AcpSession implements AgentSession {
      */
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    sendFileToChat(input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile, policy: CommonPermissions): Promise<DeliveredFile>;
     close(): Promise<void>;
     /** ACP requires the field. Bundled agents treat [] as no client-added servers. */
     private declaredMcpServers;

package/dist/session/acp.js

@@ -278,6 +278,7 @@ export class AcpSession {
     stallTimer;
     stallAttempt;
     toolBoundaryWaiters = new Set();
+    fileExportBusy = false;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -823,6 +824,8 @@ export class AcpSession {
         if (!this.sessionId)
             return;
         const active = this.activeTurn;
+        if (active)
+            active.fileDeliveryRevoked = true;
         const previousSource = active?.cancellationSource;
         if (active && (source === 'owner' || source === 'local-console' || !previousSource))
             active.cancellationSource = source;
@@ -1026,6 +1029,54 @@ export class AcpSession {
     exitResult() {
         return this.exit;
     }
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    async sendFileToChat(input, signal, copy, policy) {
+        const active = this.activeTurn, sessionId = this.sessionId;
+        const check = () => {
+            signal.throwIfAborted();
+            if (!active || !sessionId || this.activeTurn !== active || this.sessionId !== sessionId || active.fileDeliveryRevoked
+                || active.cancellationSource || this.closing || !this.isAlive() || this.replaying || this.steeringOccupied
+                || active.origin?.kind === 'scheduled-loop' || policy.approval === 'deny')
+                throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+        };
+        check();
+        if (this.fileExportBusy)
+            throw Error('FILE_DELIVERY_BUSY');
+        this.fileExportBusy = true;
+        const toolCallId = 'fleet-file-export-' + randomUUID();
+        try {
+            const onAbort = () => {
+                for (const [id, pending] of this.pendingPermissions)
+                    if (pending.toolCallId === toolCallId)
+                        this.settlePendingAutomatically(id, pending, 'cancelled', undefined, 'File send cancelled');
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            let answer;
+            try {
+                answer = await this.requestPermission({ sessionId: sessionId, toolCall: {
+                        toolCallId, title: 'Send file to this ACP chat: ' + (input.filename ?? input.path), kind: 'read', status: 'pending',
+                        locations: [{ path: resolve(this.options.cwd, input.path) }],
+                    }, options: [{ optionId: 'send', name: 'Send file', kind: 'allow_once' }, { optionId: 'deny', name: 'Do not send', kind: 'reject_once' }] }, policy);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            check();
+            if (answer.outcome.outcome !== 'selected' || answer.outcome.optionId !== 'send')
+                throw Error('FILE_SEND_DENIED');
+            const attachment = await copy({ sessionGeneration: this.sessionGeneration, acpSessionId: sessionId, turnId: active.id });
+            // Synchronous check + durable append establishes order with cancellation/stop.
+            // No await, pending-send journal, replay or recovery exists after this point.
+            check();
+            this.conversation.append({ kind: 'file.attached', source: 'agent', sessionGeneration: this.sessionGeneration,
+                acpSessionId: sessionId, promptId: active.id, turnId: active.id, payload: { attachment } });
+            return attachment;
+        }
+        finally {
+            this.releaseTool(toolCallId);
+            this.fileExportBusy = false;
+        }
+    }
     async close() {
         this.closing = true;
         if (this.stallTimer)
@@ -1414,6 +1465,8 @@ export class AcpSession {
     }
     async steerPrompt(text) {
         this.steeringWasUsed = true;
+        if (this.activeTurn)
+            this.activeTurn.fileDeliveryRevoked = true;
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.steeringRequests++;
@@ -1445,7 +1498,7 @@ export class AcpSession {
             this.steeringRequests--;
         }
     }
-    requestPermission(params) {
+    requestPermission(params, neutralPolicy) {
         // `kinds` is a PRIORITY order. Scanning the agent's option array instead
         // (`options.find(o => kinds.includes(o.kind))`) hands the choice to whatever
         // order the agent happened to list, which is exactly how an automatic denial
@@ -1463,7 +1516,7 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+        if (!neutralPolicy && this.isEffectiveCodexProtectedMcpApproval(params)) {
             // Protected MCP approval is already the tool's narrow gate. Never turn
             // this one decision into an adapter-wide standing grant.
             const option = choose(['allow_once']);
@@ -1474,9 +1527,9 @@ export class AcpSession {
                 this.releasePermission(toolCallId, permissionId);
             return Promise.resolve(response);
         }
-        if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
+        if ((neutralPolicy ?? this.options.permissions).approval === 'allow' && this.withinAutomaticBoundary(params, neutralPolicy)) {
             const option = choose(['allow_always', 'allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${(neutralPolicy ?? this.options.permissions).filesystem} boundary`);
             if (option)
                 this.allowPermission(toolCallId, permissionId);
             else
@@ -1486,8 +1539,8 @@ export class AcpSession {
         // A live grace window still counts as attended: the controller may be
         // mid-reconnect, and denying instantly is exactly what the grace prevents.
         const unattended = this.controllerCount === 0 && !this.controllerGrace
-            && this.options.permissions.unattended === 'deny';
-        if (this.options.permissions.approval === 'deny' || unattended) {
+            && (neutralPolicy ?? this.options.permissions).unattended === 'deny';
+        if ((neutralPolicy ?? this.options.permissions).approval === 'deny' || unattended) {
             // reject_once FIRST: `reject_always` teaches the agent a standing rule from
             // a decision no human made, so one unattended denial would silently disable
             // the tool for the rest of the session.
@@ -1588,8 +1641,8 @@ export class AcpSession {
             ? { outcome: { outcome: 'selected', optionId: option.optionId } }
             : { outcome: { outcome: 'cancelled' } };
     }
-    withinAutomaticBoundary(params) {
-        const filesystem = this.options.permissions.filesystem;
+    withinAutomaticBoundary(params, policy) {
+        const filesystem = (policy ?? this.options.permissions).filesystem;
         if (filesystem === 'unrestricted')
             return true;
         if (filesystem === 'read-only' && params.toolCall.kind !== 'read')

package/dist/session/conversation-types.d.ts

@@ -8,7 +8,7 @@ import type { PromptOrigin, TurnCancellationSource, TurnOutcome } from './types.
  * file touches the wire: transport updates are reduced into these shapes by a
  * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
-export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
+export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
 /** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
@@ -228,7 +228,9 @@ export interface BoundedJson {
     digest?: string;
     redacted?: true;
 }
-export type ConversationPayload = MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
+export type ConversationPayload = {
+    attachment: import('../file-delivery/types.js').DeliveredFile;
+} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
 export interface ConversationEventV1 {
     schemaVersion: 1;
     roleId: string;

package/dist/session/types.d.ts

@@ -284,6 +284,7 @@ export interface ConversationHandlePage {
  * on any concrete transport which implements it.
  */
 export interface AgentSession {
+    sendFileToChat?: (input: import('../file-delivery/types.js').FileDeliveryInput, signal: AbortSignal, copy: import('../file-delivery/types.js').CopyChatFile, policy: import('../config.js').CommonPermissions) => Promise<import('../file-delivery/types.js').DeliveredFile>;
     readonly backend: SessionBackendId;
     readonly pid: number;
     /** Live capabilities; optional only for source compatibility with external adapters. */

package/dist/web/server.js

@@ -1,3 +1,5 @@
+import { conversationHasAttachment } from '../application/conversation-history.js';
+import { readDeliveredFile } from '../file-delivery/store.js';
 import { WorkspaceDeviceAuthError } from './workspace-devices.js';
 import { readFileSync } from 'node:fs';
 import { packagedPresetRoot } from '../preset-bootstrap.js';
@@ -756,6 +758,28 @@ export async function buildWebServer(services, boundary, options = {}) {
         const page = await control.conversationPage({ after: request.query.after, limit });
         return { ...page, events: page.events.map(present) };
     });
+    app.get('/api/v1/roles/:id/artifacts/:artifactId', async (request, reply) => {
+        auth.authenticate(request);
+        const role = await services.repository.get(request.params.id);
+        if (!role)
+            throw new FleetError('role_not_found', 'Agent not found');
+        const stateDir = services.repository.stateDir(role);
+        if (!stateDir)
+            throw new FleetError('resource_not_found', 'Agent file not found');
+        try {
+            const { record, bytes } = await readDeliveredFile(stateDir, request.params.artifactId);
+            if (!await conversationHasAttachment(stateDir, record))
+                throw Error('ARTIFACT_NOT_PUBLISHED');
+            reply.header('Cache-Control', 'private, no-store');
+            reply.header('X-Content-Type-Options', 'nosniff');
+            reply.header('Content-Security-Policy', "default-src 'none'; sandbox");
+            reply.header('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(record.name).replace(/'/g, '%27')}`);
+            return reply.type('application/octet-stream').send(bytes);
+        }
+        catch {
+            throw new FleetError('resource_not_found', 'Agent file unavailable');
+        }
+    });
     app.get('/api/v1/roles/:id/attachments/:attachmentId', async (request, reply) => {
         auth.authenticate(request);
         const role = await services.repository.get(request.params.id);