@poncho-ai/cli 0.10.2 → 0.11.1

package/dist/{chunk-COLXQM6J.js → chunk-T2F6ICXI.js}

@@ -13,11 +13,15 @@ import {
   LocalMcpBridge,
   TelemetryEmitter,
   createConversationStore,
+  createUploadStore,
+  deriveUploadKey,
   ensureAgentIdentity as ensureAgentIdentity2,
   generateAgentId,
   loadPonchoConfig,
   resolveStateConfig
 } from "@poncho-ai/harness";
+import { getTextContent } from "@poncho-ai/sdk";
+import Busboy from "busboy";
 import { Command } from "commander";
 import dotenv from "dotenv";
 import YAML from "yaml";
@@ -897,7 +901,7 @@ var renderWebUiHtml = (options) => {
       border-radius: 24px;
       display: flex;
       align-items: end;
-      padding: 4px 6px 4px 18px;
+      padding: 4px 6px 4px 6px;
       transition: border-color 0.15s;
     }
     .composer-shell:focus-within { border-color: rgba(255,255,255,0.2); }
@@ -910,7 +914,7 @@ var renderWebUiHtml = (options) => {
       min-height: 40px;
       max-height: 200px;
       resize: none;
-      padding: 10px 0 8px;
+      padding: 11px 0 8px;
       font-size: 14px;
       line-height: 1.5;
       margin-top: -4px;
@@ -938,6 +942,149 @@ var renderWebUiHtml = (options) => {
     .send-btn.stop-mode:hover { background: #565656; }
     .send-btn:disabled { opacity: 0.2; cursor: default; }
     .send-btn:disabled:hover { background: #ededed; }
+    .attach-btn {
+      width: 32px;
+      height: 32px;
+      background: rgba(255,255,255,0.08);
+      border: 0;
+      border-radius: 50%;
+      color: #999;
+      cursor: pointer;
+      display: grid;
+      place-items: center;
+      flex-shrink: 0;
+      margin-bottom: 2px;
+      margin-right: 8px;
+      transition: color 0.15s, background 0.15s;
+    }
+    .attach-btn:hover { color: #ededed; background: rgba(255,255,255,0.14); }
+    .attachment-preview {
+      display: flex;
+      gap: 8px;
+      padding: 8px 0;
+      flex-wrap: wrap;
+    }
+    .attachment-chip {
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      background: rgba(0, 0, 0, 0.6);
+      border: 1px solid rgba(255, 255, 255, 0.12);
+      border-radius: 9999px;
+      padding: 4px 10px 4px 6px;
+      font-size: 11px;
+      color: #777;
+      max-width: 200px;
+      cursor: pointer;
+      backdrop-filter: blur(6px);
+      -webkit-backdrop-filter: blur(6px);
+      transition: color 0.15s, border-color 0.15s, background 0.15s;
+    }
+    .attachment-chip:hover {
+      color: #ededed;
+      border-color: rgba(255, 255, 255, 0.25);
+      background: rgba(0, 0, 0, 0.75);
+    }
+    .attachment-chip img {
+      width: 20px;
+      height: 20px;
+      object-fit: cover;
+      border-radius: 50%;
+      flex-shrink: 0;
+      cursor: pointer;
+    }
+    .attachment-chip .file-icon {
+      width: 20px;
+      height: 20px;
+      border-radius: 50%;
+      background: rgba(255,255,255,0.1);
+      display: grid;
+      place-items: center;
+      font-size: 11px;
+      flex-shrink: 0;
+    }
+    .attachment-chip .remove-attachment {
+      cursor: pointer;
+      color: #555;
+      font-size: 14px;
+      margin-left: 2px;
+      line-height: 1;
+      transition: color 0.15s;
+    }
+    .attachment-chip .remove-attachment:hover { color: #fff; }
+    .attachment-chip .filename { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 100px; }
+    .user-bubble .user-file-attachments {
+      display: flex;
+      gap: 6px;
+      flex-wrap: wrap;
+      margin-top: 8px;
+    }
+    .user-file-attachments img {
+      max-width: 200px;
+      max-height: 160px;
+      border-radius: 8px;
+      object-fit: cover;
+      cursor: pointer;
+      transition: opacity 0.15s;
+    }
+    .user-file-attachments img:hover { opacity: 0.85; }
+    .lightbox {
+      position: fixed;
+      inset: 0;
+      z-index: 9999;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      background: rgba(0,0,0,0);
+      backdrop-filter: blur(0px);
+      cursor: zoom-out;
+      transition: background 0.25s ease, backdrop-filter 0.25s ease;
+    }
+    .lightbox.active {
+      background: rgba(0,0,0,0.85);
+      backdrop-filter: blur(8px);
+    }
+    .lightbox img {
+      max-width: 90vw;
+      max-height: 90vh;
+      border-radius: 8px;
+      object-fit: contain;
+      transform: scale(0.4);
+      opacity: 0;
+      transition: transform 0.3s cubic-bezier(0.25, 0.46, 0.45, 0.94), opacity 0.25s ease;
+    }
+    .lightbox.active img {
+      transform: scale(1);
+      opacity: 1;
+    }
+    .user-file-badge {
+      display: inline-flex;
+      align-items: center;
+      gap: 4px;
+      background: rgba(0,0,0,0.2);
+      border-radius: 6px;
+      padding: 4px 8px;
+      font-size: 12px;
+      color: rgba(255,255,255,0.8);
+    }
+    .drag-overlay {
+      position: fixed;
+      inset: 0;
+      background: rgba(0,0,0,0.6);
+      z-index: 9999;
+      display: none;
+      align-items: center;
+      justify-content: center;
+      pointer-events: none;
+    }
+    .drag-overlay.active { display: flex; }
+    .drag-overlay-inner {
+      border: 2px dashed rgba(255,255,255,0.4);
+      border-radius: 16px;
+      padding: 40px 60px;
+      color: #fff;
+      font-size: 16px;
+    }
     .disclaimer {
       text-align: center;
       color: #333;
@@ -1081,7 +1228,12 @@ var renderWebUiHtml = (options) => {
       </div>
       <form id="composer" class="composer">
         <div class="composer-inner">
+          <div id="attachment-preview" class="attachment-preview" style="display:none"></div>
           <div class="composer-shell">
+            <button id="attach-btn" class="attach-btn" type="button" title="Attach files">
+              <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M8 3v10M3 8h10" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg>
+            </button>
+            <input id="file-input" type="file" multiple accept="image/*,video/*,application/pdf,.txt,.csv,.json,.html" style="display:none" />
             <textarea id="prompt" class="composer-input" placeholder="Send a message..." rows="1"></textarea>
             <button id="send" class="send-btn" type="submit">
               <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M8 12V4M4 7l4-4 4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>
@@ -1091,6 +1243,8 @@ var renderWebUiHtml = (options) => {
       </form>
     </main>
   </div>
+  <div id="drag-overlay" class="drag-overlay"><div class="drag-overlay-inner">Drop files to attach</div></div>
+  <div id="lightbox" class="lightbox" style="display:none"><img /></div>
 
     <script>
       // Marked library (inlined)
@@ -1113,7 +1267,8 @@ var renderWebUiHtml = (options) => {
         activeStreamRunId: null,
         isMessagesPinnedToBottom: true,
         confirmDeleteId: null,
-        approvalRequestsInFlight: {}
+        approvalRequestsInFlight: {},
+        pendingFiles: [],
       };
 
       const agentInitial = document.body.dataset.agentInitial || "A";
@@ -1135,7 +1290,12 @@ var renderWebUiHtml = (options) => {
         send: $("send"),
         shell: $("app"),
         sidebarToggle: $("sidebar-toggle"),
-        sidebarBackdrop: $("sidebar-backdrop")
+        sidebarBackdrop: $("sidebar-backdrop"),
+        attachBtn: $("attach-btn"),
+        fileInput: $("file-input"),
+        attachmentPreview: $("attachment-preview"),
+        dragOverlay: $("drag-overlay"),
+        lightbox: $("lightbox"),
       };
       const sendIconMarkup =
         '<svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M8 12V4M4 7l4-4 4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>';
@@ -1631,7 +1791,47 @@ var renderWebUiHtml = (options) => {
             wrap.appendChild(content);
             row.appendChild(wrap);
           } else {
-            row.innerHTML = '<div class="user-bubble">' + escapeHtml(m.content) + '</div>';
+            const bubble = document.createElement("div");
+            bubble.className = "user-bubble";
+            if (typeof m.content === "string") {
+              bubble.textContent = m.content;
+            } else if (Array.isArray(m.content)) {
+              const textParts = m.content.filter(p => p.type === "text").map(p => p.text).join("");
+              if (textParts) {
+                const textEl = document.createElement("div");
+                textEl.textContent = textParts;
+                bubble.appendChild(textEl);
+              }
+              const fileParts = m.content.filter(p => p.type === "file");
+              if (fileParts.length > 0) {
+                const filesEl = document.createElement("div");
+                filesEl.className = "user-file-attachments";
+                fileParts.forEach(fp => {
+                  if (fp.mediaType && fp.mediaType.startsWith("image/")) {
+                    const img = document.createElement("img");
+                    if (fp._localBlob) {
+                      if (!fp._cachedUrl) fp._cachedUrl = URL.createObjectURL(fp._localBlob);
+                      img.src = fp._cachedUrl;
+                    } else if (fp.data && fp.data.startsWith("poncho-upload://")) {
+                      img.src = "/api/uploads/" + encodeURIComponent(fp.data.replace("poncho-upload://", ""));
+                    } else if (fp.data && (fp.data.startsWith("http://") || fp.data.startsWith("https://"))) {
+                      img.src = fp.data;
+                    } else if (fp.data) {
+                      img.src = "data:" + fp.mediaType + ";base64," + fp.data;
+                    }
+                    img.alt = fp.filename || "image";
+                    filesEl.appendChild(img);
+                  } else {
+                    const badge = document.createElement("span");
+                    badge.className = "user-file-badge";
+                    badge.textContent = "\u{1F4CE} " + (fp.filename || "file");
+                    filesEl.appendChild(badge);
+                  }
+                });
+                bubble.appendChild(filesEl);
+              }
+            }
+            row.appendChild(bubble);
           }
           col.appendChild(row);
         });
@@ -2137,12 +2337,62 @@ var renderWebUiHtml = (options) => {
         }
       };
 
+      const renderAttachmentPreview = () => {
+        const el = elements.attachmentPreview;
+        if (state.pendingFiles.length === 0) {
+          el.style.display = "none";
+          el.innerHTML = "";
+          return;
+        }
+        el.style.display = "flex";
+        el.innerHTML = state.pendingFiles.map((f, i) => {
+          const isImage = f.type.startsWith("image/");
+          const thumbHtml = isImage
+            ? '<img src="' + URL.createObjectURL(f) + '" alt="" />'
+            : '<span class="file-icon">\u{1F4CE}</span>';
+          return '<div class="attachment-chip" data-idx="' + i + '">'
+            + thumbHtml
+            + '<span class="filename">' + escapeHtml(f.name) + '</span>'
+            + '<span class="remove-attachment" data-idx="' + i + '">&times;</span>'
+            + '</div>';
+        }).join("");
+      };
+
+      const addFiles = (fileList) => {
+        for (const f of fileList) {
+          if (f.size > 25 * 1024 * 1024) {
+            alert("File too large: " + f.name + " (max 25MB)");
+            continue;
+          }
+          state.pendingFiles.push(f);
+        }
+        renderAttachmentPreview();
+      };
+
       const sendMessage = async (text) => {
         const messageText = (text || "").trim();
         if (!messageText || state.isStreaming) {
           return;
         }
-        const localMessages = [...(state.activeMessages || []), { role: "user", content: messageText }];
+        const filesToSend = [...state.pendingFiles];
+        state.pendingFiles = [];
+        renderAttachmentPreview();
+        let userContent;
+        if (filesToSend.length > 0) {
+          userContent = [{ type: "text", text: messageText }];
+          for (const f of filesToSend) {
+            userContent.push({
+              type: "file",
+              data: URL.createObjectURL(f),
+              mediaType: f.type,
+              filename: f.name,
+              _localBlob: f,
+            });
+          }
+        } else {
+          userContent = messageText;
+        }
+        const localMessages = [...(state.activeMessages || []), { role: "user", content: userContent }];
         let assistantMessage = {
           role: "assistant",
           content: "",
@@ -2185,13 +2435,38 @@ var renderWebUiHtml = (options) => {
               assistantMessage._currentText = "";
             }
           };
-          const response = await fetch("/api/conversations/" + encodeURIComponent(conversationId) + "/messages", {
-            method: "POST",
-            credentials: "include",
-            headers: { "Content-Type": "application/json", "x-csrf-token": state.csrfToken },
-            body: JSON.stringify({ message: messageText }),
-            signal: streamAbortController.signal,
-          });
+          let _continuationMessage = messageText;
+          let _totalSteps = 0;
+          let _maxSteps = 0;
+          while (_continuationMessage) {
+          let _shouldContinue = false;
+          let fetchOpts;
+          if (filesToSend.length > 0 && _continuationMessage === messageText) {
+            const formData = new FormData();
+            formData.append("message", _continuationMessage);
+            for (const f of filesToSend) {
+              formData.append("files", f, f.name);
+            }
+            fetchOpts = {
+              method: "POST",
+              credentials: "include",
+              headers: { "x-csrf-token": state.csrfToken },
+              body: formData,
+              signal: streamAbortController.signal,
+            };
+          } else {
+            fetchOpts = {
+              method: "POST",
+              credentials: "include",
+              headers: { "Content-Type": "application/json", "x-csrf-token": state.csrfToken },
+              body: JSON.stringify({ message: _continuationMessage }),
+              signal: streamAbortController.signal,
+            };
+          }
+          const response = await fetch(
+            "/api/conversations/" + encodeURIComponent(conversationId) + "/messages",
+            fetchOpts,
+          );
           if (!response.ok || !response.body) {
             throw new Error("Failed to stream response");
           }
@@ -2366,11 +2641,17 @@ var renderWebUiHtml = (options) => {
                   renderIfActiveConversation(true);
                 }
                 if (eventName === "run:completed") {
-                  finalizeAssistantMessage();
-                  if (!assistantMessage.content || assistantMessage.content.length === 0) {
-                    assistantMessage.content = String(payload.result?.response || "");
+                  _totalSteps += typeof payload.result?.steps === "number" ? payload.result.steps : 0;
+                  if (typeof payload.result?.maxSteps === "number") _maxSteps = payload.result.maxSteps;
+                  if (payload.result?.continuation === true && (_maxSteps <= 0 || _totalSteps < _maxSteps)) {
+                    _shouldContinue = true;
+                  } else {
+                    finalizeAssistantMessage();
+                    if (!assistantMessage.content || assistantMessage.content.length === 0) {
+                      assistantMessage.content = String(payload.result?.response || "");
+                    }
+                    renderIfActiveConversation(false);
                   }
-                  renderIfActiveConversation(false);
                 }
                 if (eventName === "run:cancelled") {
                   finalizeAssistantMessage();
@@ -2388,6 +2669,9 @@ var renderWebUiHtml = (options) => {
               }
             });
           }
+          if (!_shouldContinue) break;
+          _continuationMessage = "Continue";
+          }
           // Update active state only if user is still on this conversation.
           if (state.activeConversationId === streamConversationId) {
             state.activeMessages = localMessages;
@@ -2534,6 +2818,100 @@ var renderWebUiHtml = (options) => {
         await sendMessage(value);
       });
 
+      elements.attachBtn.addEventListener("click", () => elements.fileInput.click());
+      elements.fileInput.addEventListener("change", () => {
+        if (elements.fileInput.files && elements.fileInput.files.length > 0) {
+          addFiles(elements.fileInput.files);
+          elements.fileInput.value = "";
+        }
+      });
+      elements.attachmentPreview.addEventListener("click", (e) => {
+        const rm = e.target.closest(".remove-attachment");
+        if (rm) {
+          const idx = parseInt(rm.dataset.idx, 10);
+          state.pendingFiles.splice(idx, 1);
+          renderAttachmentPreview();
+        }
+      });
+
+      let dragCounter = 0;
+      document.addEventListener("dragenter", (e) => {
+        e.preventDefault();
+        dragCounter++;
+        if (dragCounter === 1) elements.dragOverlay.classList.add("active");
+      });
+      document.addEventListener("dragleave", (e) => {
+        e.preventDefault();
+        dragCounter--;
+        if (dragCounter <= 0) { dragCounter = 0; elements.dragOverlay.classList.remove("active"); }
+      });
+      document.addEventListener("dragover", (e) => e.preventDefault());
+      document.addEventListener("drop", (e) => {
+        e.preventDefault();
+        dragCounter = 0;
+        elements.dragOverlay.classList.remove("active");
+        if (e.dataTransfer && e.dataTransfer.files.length > 0) {
+          addFiles(e.dataTransfer.files);
+        }
+      });
+
+      // Paste files/images from clipboard
+      elements.prompt.addEventListener("paste", (e) => {
+        const items = e.clipboardData && e.clipboardData.items;
+        if (!items) return;
+        const files = [];
+        for (let i = 0; i < items.length; i++) {
+          if (items[i].kind === "file") {
+            const f = items[i].getAsFile();
+            if (f) files.push(f);
+          }
+        }
+        if (files.length > 0) {
+          e.preventDefault();
+          addFiles(files);
+        }
+      });
+
+      // Lightbox: open/close helpers
+      const lightboxImg = elements.lightbox.querySelector("img");
+      const openLightbox = (src) => {
+        lightboxImg.src = src;
+        elements.lightbox.style.display = "flex";
+        requestAnimationFrame(() => {
+          requestAnimationFrame(() => elements.lightbox.classList.add("active"));
+        });
+      };
+      const closeLightbox = () => {
+        elements.lightbox.classList.remove("active");
+        elements.lightbox.addEventListener("transitionend", function handler() {
+          elements.lightbox.removeEventListener("transitionend", handler);
+          elements.lightbox.style.display = "none";
+          lightboxImg.src = "";
+        });
+      };
+      elements.lightbox.addEventListener("click", closeLightbox);
+      document.addEventListener("keydown", (e) => {
+        if (e.key === "Escape" && elements.lightbox.style.display !== "none") closeLightbox();
+      });
+
+      // Lightbox from message images
+      elements.messages.addEventListener("click", (e) => {
+        const img = e.target;
+        if (!(img instanceof HTMLImageElement) || !img.closest(".user-file-attachments")) return;
+        openLightbox(img.src);
+      });
+
+      // Lightbox from attachment preview chips
+      elements.attachmentPreview.addEventListener("click", (e) => {
+        if (e.target.closest(".remove-attachment")) return;
+        const chip = e.target.closest(".attachment-chip");
+        if (!chip) return;
+        const img = chip.querySelector("img");
+        if (!img) return;
+        e.stopPropagation();
+        openLightbox(img.src);
+      });
+
       elements.messages.addEventListener("click", async (event) => {
         const target = event.target;
         if (!(target instanceof Element)) {
@@ -3374,6 +3752,24 @@ var writeHtml = (response, statusCode, payload) => {
   response.writeHead(statusCode, { "Content-Type": "text/html; charset=utf-8" });
   response.end(payload);
 };
+var EXT_MIME_MAP = {
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  png: "image/png",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  txt: "text/plain",
+  json: "application/json",
+  csv: "text/csv",
+  html: "text/html"
+};
+var extToMime = (ext) => EXT_MIME_MAP[ext] ?? "application/octet-stream";
 var readRequestBody = async (request) => {
   const chunks = [];
   for await (const chunk of request) {
@@ -3382,6 +3778,38 @@ var readRequestBody = async (request) => {
   const body = Buffer.concat(chunks).toString("utf8");
   return body.length > 0 ? JSON.parse(body) : {};
 };
+var MAX_UPLOAD_SIZE = 25 * 1024 * 1024;
+var parseMultipartRequest = (request) => new Promise((resolve4, reject) => {
+  const result = { message: "", files: [] };
+  const bb = Busboy({
+    headers: request.headers,
+    limits: { fileSize: MAX_UPLOAD_SIZE }
+  });
+  bb.on("field", (name, value) => {
+    if (name === "message") result.message = value;
+    if (name === "parameters") {
+      try {
+        result.parameters = JSON.parse(value);
+      } catch {
+      }
+    }
+  });
+  bb.on("file", (_name, stream, info) => {
+    const chunks = [];
+    stream.on("data", (chunk) => chunks.push(chunk));
+    stream.on("end", () => {
+      const buf = Buffer.concat(chunks);
+      result.files.push({
+        data: buf.toString("base64"),
+        mediaType: info.mimeType,
+        filename: info.filename
+      });
+    });
+  });
+  bb.on("finish", () => resolve4(result));
+  bb.on("error", (err) => reject(err));
+  request.pipe(bb);
+});
 var resolveHarnessEnvironment = () => {
   if (process.env.PONCHO_ENV) {
     const value = process.env.PONCHO_ENV.toLowerCase();
@@ -3903,7 +4331,14 @@ var writeScaffoldFile = async (filePath, content, options) => {
   await writeFile3(filePath, content, "utf8");
   options.writtenPaths.push(relative(options.baseDir, filePath));
 };
-var ensureRuntimeCliDependency = async (projectDir, cliVersion) => {
+var UPLOAD_PROVIDER_DEPS = {
+  "vercel-blob": [{ name: "@vercel/blob", fallback: "^2.3.0" }],
+  s3: [
+    { name: "@aws-sdk/client-s3", fallback: "^3.700.0" },
+    { name: "@aws-sdk/s3-request-presigner", fallback: "^3.700.0" }
+  ]
+};
+var ensureRuntimeCliDependency = async (projectDir, cliVersion, config) => {
   const packageJsonPath = resolve3(projectDir, "package.json");
   const content = await readFile3(packageJsonPath, "utf8");
   const parsed = JSON.parse(content);
@@ -3917,10 +4352,20 @@ var ensureRuntimeCliDependency = async (projectDir, cliVersion) => {
   }
   dependencies.marked = await readCliDependencyVersion("marked", "^17.0.2");
   dependencies["@poncho-ai/cli"] = `^${cliVersion}`;
+  const addedDeps = [];
+  const uploadsProvider = config?.uploads?.provider;
+  if (uploadsProvider && UPLOAD_PROVIDER_DEPS[uploadsProvider]) {
+    for (const dep of UPLOAD_PROVIDER_DEPS[uploadsProvider]) {
+      if (!dependencies[dep.name]) {
+        dependencies[dep.name] = dep.fallback;
+        addedDeps.push(dep.name);
+      }
+    }
+  }
   parsed.dependencies = dependencies;
   await writeFile3(packageJsonPath, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
-  return [relative(projectDir, packageJsonPath)];
+  return { paths: [relative(projectDir, packageJsonPath)], addedDeps };
 };
 var scaffoldDeployTarget = async (projectDir, target, options) => {
   const writtenPaths = [];
@@ -4053,10 +4498,16 @@ CMD ["node","server.js"]
       baseDir: projectDir
     });
   }
-  const packagePaths = await ensureRuntimeCliDependency(projectDir, cliVersion);
-  for (const path of packagePaths) {
-    if (!writtenPaths.includes(path)) {
-      writtenPaths.push(path);
+  const config = await loadPonchoConfig(projectDir);
+  const { paths: packagePaths, addedDeps } = await ensureRuntimeCliDependency(
+    projectDir,
+    cliVersion,
+    config
+  );
+  const depNote = addedDeps.length > 0 ? ` (added ${addedDeps.join(", ")})` : "";
+  for (const p of packagePaths) {
+    if (!writtenPaths.includes(p)) {
+      writtenPaths.push(depNote ? `${p}${depNote}` : p);
     }
   }
   return writtenPaths;
@@ -4312,9 +4763,11 @@ var createRequestHandler = async (options) => {
     }
     await persistConversationPendingApprovals(conversationId);
   };
+  const uploadStore = await createUploadStore(config?.uploads, workingDir);
   const harness = new AgentHarness({
     workingDir,
     environment: resolveHarnessEnvironment(),
+    uploadStore,
     approvalHandler: async (request) => new Promise((resolveApproval) => {
       const ownerIdForRun = runOwners.get(request.runId) ?? "local-owner";
       const conversationIdForRun = runConversations.get(request.runId) ?? null;
@@ -4712,6 +5165,40 @@ var createRequestHandler = async (options) => {
       });
       return;
     }
+    const uploadMatch = pathname.match(/^\/api\/uploads\/(.+)$/);
+    if (uploadMatch && request.method === "GET") {
+      const key = decodeURIComponent(uploadMatch[1] ?? "");
+      try {
+        const data = await uploadStore.get(key);
+        const ext = key.split(".").pop() ?? "";
+        const mimeMap = {
+          jpg: "image/jpeg",
+          jpeg: "image/jpeg",
+          png: "image/png",
+          gif: "image/gif",
+          webp: "image/webp",
+          svg: "image/svg+xml",
+          pdf: "application/pdf",
+          mp4: "video/mp4",
+          webm: "video/webm",
+          mp3: "audio/mpeg",
+          wav: "audio/wav",
+          txt: "text/plain",
+          json: "application/json",
+          csv: "text/csv",
+          html: "text/html"
+        };
+        response.writeHead(200, {
+          "Content-Type": mimeMap[ext] ?? "application/octet-stream",
+          "Content-Length": data.length,
+          "Cache-Control": "public, max-age=86400"
+        });
+        response.end(data);
+      } catch {
+        writeJson(response, 404, { code: "NOT_FOUND", message: "Upload not found" });
+      }
+      return;
+    }
     const conversationMessageMatch = pathname.match(/^\/api\/conversations\/([^/]+)\/messages$/);
     if (conversationMessageMatch && request.method === "POST") {
       const conversationId = decodeURIComponent(conversationMessageMatch[1] ?? "");
@@ -4723,8 +5210,25 @@ var createRequestHandler = async (options) => {
         });
         return;
       }
-      const body = await readRequestBody(request);
-      const messageText = body.message?.trim() ?? "";
+      let messageText = "";
+      let bodyParameters;
+      let files = [];
+      const contentType = request.headers["content-type"] ?? "";
+      if (contentType.includes("multipart/form-data")) {
+        const parsed = await parseMultipartRequest(request);
+        messageText = parsed.message.trim();
+        bodyParameters = parsed.parameters;
+        files = parsed.files;
+      } else {
+        const body = await readRequestBody(request);
+        messageText = body.message?.trim() ?? "";
+        bodyParameters = body.parameters;
+        if (Array.isArray(body.files)) {
+          files = body.files.filter(
+            (f) => typeof f.data === "string" && typeof f.mediaType === "string"
+          );
+        }
+      }
       if (!messageText) {
         writeJson(response, 400, {
           code: "VALIDATION_ERROR",
@@ -4766,8 +5270,43 @@ var createRequestHandler = async (options) => {
       let currentText = "";
       let currentTools = [];
       let runCancelled = false;
+      let userContent = messageText;
+      if (files.length > 0) {
+        try {
+          const uploadedParts = await Promise.all(
+            files.map(async (f) => {
+              const buf = Buffer.from(f.data, "base64");
+              const key = deriveUploadKey(buf, f.mediaType);
+              const ref = await uploadStore.put(key, buf, f.mediaType);
+              return {
+                type: "file",
+                data: ref,
+                mediaType: f.mediaType,
+                filename: f.filename
+              };
+            })
+          );
+          userContent = [
+            { type: "text", text: messageText },
+            ...uploadedParts
+          ];
+        } catch (uploadErr) {
+          const errMsg = uploadErr instanceof Error ? uploadErr.message : String(uploadErr);
+          console.error("[poncho] File upload failed:", errMsg);
+          const errorEvent = {
+            type: "run:error",
+            runId: "",
+            error: { code: "UPLOAD_ERROR", message: `File upload failed: ${errMsg}` }
+          };
+          broadcastEvent(conversationId, errorEvent);
+          finishConversationStream(conversationId);
+          activeConversationRuns.delete(conversationId);
+          response.end();
+          return;
+        }
+      }
       try {
-        conversation.messages = [...historyMessages, { role: "user", content: messageText }];
+        conversation.messages = [...historyMessages, { role: "user", content: userContent }];
         conversation.updatedAt = Date.now();
         await conversationStore.update(conversation);
         const persistDraftAssistantTurn = async () => {
@@ -4789,7 +5328,7 @@ var createRequestHandler = async (options) => {
           }
           conversation.messages = [
             ...historyMessages,
-            { role: "user", content: messageText },
+            { role: "user", content: userContent },
             {
               role: "assistant",
               content: assistantResponse,
@@ -4806,16 +5345,17 @@ var createRequestHandler = async (options) => {
           conversationId: item.conversationId,
           title: item.title,
           updatedAt: item.updatedAt,
-          content: item.messages.slice(-6).map((message) => `${message.role}: ${message.content}`).join("\n").slice(0, 2e3)
+          content: item.messages.slice(-6).map((message) => `${message.role}: ${typeof message.content === "string" ? message.content : getTextContent(message)}`).join("\n").slice(0, 2e3)
         })).filter((item) => item.content.length > 0);
         for await (const event of harness.runWithTelemetry({
           task: messageText,
           parameters: {
-            ...body.parameters ?? {},
+            ...bodyParameters ?? {},
             __conversationRecallCorpus: recallCorpus,
             __activeConversationId: conversationId
           },
           messages: historyMessages,
+          files: files.length > 0 ? files : void 0,
           abortSignal: abortController.signal
         })) {
           if (event.type === "run:started") {
@@ -4857,6 +5397,9 @@ var createRequestHandler = async (options) => {
             toolTimeline.push(toolText);
             currentTools.push(toolText);
           }
+          if (event.type === "step:completed") {
+            await persistDraftAssistantTurn();
+          }
           if (event.type === "tool:approval:required") {
             const toolText = `- approval required \`${event.tool}\``;
             toolTimeline.push(toolText);
@@ -4894,7 +5437,7 @@ var createRequestHandler = async (options) => {
         const hasAssistantContent = assistantResponse.length > 0 || toolTimeline.length > 0 || sections.length > 0;
         conversation.messages = hasAssistantContent ? [
           ...historyMessages,
-          { role: "user", content: messageText },
+          { role: "user", content: userContent },
           {
             role: "assistant",
             content: assistantResponse,
@@ -4903,7 +5446,7 @@ var createRequestHandler = async (options) => {
               sections: sections.length > 0 ? sections : void 0
             } : void 0
           }
-        ] : [...historyMessages, { role: "user", content: messageText }];
+        ] : [...historyMessages, { role: "user", content: userContent }];
         conversation.runtimeRunId = latestRunId || conversation.runtimeRunId;
         conversation.pendingApprovals = [];
         conversation.updatedAt = Date.now();
@@ -4920,7 +5463,7 @@ var createRequestHandler = async (options) => {
           if (assistantResponse.length > 0 || toolTimeline.length > 0 || fallbackSections.length > 0) {
             conversation.messages = [
               ...historyMessages,
-              { role: "user", content: messageText },
+              { role: "user", content: userContent },
               {
                 role: "assistant",
                 content: assistantResponse,
@@ -4958,7 +5501,7 @@ var createRequestHandler = async (options) => {
           if (assistantResponse.length > 0 || toolTimeline.length > 0 || fallbackSections.length > 0) {
             conversation.messages = [
               ...historyMessages,
-              { role: "user", content: messageText },
+              { role: "user", content: userContent },
               {
                 role: "assistant",
                 content: assistantResponse,
@@ -5016,21 +5559,26 @@ var runOnce = async (task, options) => {
   const workingDir = options.workingDir ?? process.cwd();
   dotenv.config({ path: resolve3(workingDir, ".env") });
   const config = await loadPonchoConfig(workingDir);
-  const harness = new AgentHarness({ workingDir });
+  const uploadStore = await createUploadStore(config?.uploads, workingDir);
+  const harness = new AgentHarness({ workingDir, uploadStore });
   const telemetry = new TelemetryEmitter(config?.telemetry);
   await harness.initialize();
-  const fileBlobs = await Promise.all(
-    options.filePaths.map(async (path) => {
-      const content = await readFile3(resolve3(workingDir, path), "utf8");
-      return `# File: ${path}
-${content}`;
+  const fileInputs = await Promise.all(
+    options.filePaths.map(async (filePath) => {
+      const absPath = resolve3(workingDir, filePath);
+      const buf = await readFile3(absPath);
+      const ext = absPath.split(".").pop()?.toLowerCase() ?? "";
+      return {
+        data: buf.toString("base64"),
+        mediaType: extToMime(ext),
+        filename: basename2(filePath)
+      };
     })
   );
   const input2 = {
-    task: fileBlobs.length > 0 ? `${task}
-
-${fileBlobs.join("\n\n")}` : task,
-    parameters: options.params
+    task,
+    parameters: options.params,
+    files: fileInputs.length > 0 ? fileInputs : void 0
   };
   if (options.json) {
     const output = await harness.runToCompletion(input2);
@@ -5079,15 +5627,17 @@ var runInteractive = async (workingDir, params) => {
       }
     });
   };
+  const uploadStore = await createUploadStore(config?.uploads, workingDir);
   const harness = new AgentHarness({
     workingDir,
     environment: resolveHarnessEnvironment(),
-    approvalHandler
+    approvalHandler,
+    uploadStore
   });
   await harness.initialize();
   const identity = await ensureAgentIdentity2(workingDir);
   try {
-    const { runInteractiveInk } = await import("./run-interactive-ink-Z3U5SV4C.js");
+    const { runInteractiveInk } = await import("./run-interactive-ink-7FP5PT7Q.js");
     await runInteractiveInk({
       harness,
       params,