@poncho-ai/harness 0.11.2 → 0.13.0

package/dist/index.js

@@ -67,6 +67,59 @@ var matchesSlashPattern = (value, pattern) => {
 var FRONTMATTER_PATTERN = /^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/;
 var asRecord = (value) => typeof value === "object" && value !== null ? value : {};
 var asNumberOrUndefined = (value) => typeof value === "number" ? value : void 0;
+var CRON_EXPRESSION_PATTERN = /^(\S+\s+){4}\S+$/;
+var validateCronExpression = (expr, path) => {
+  if (!CRON_EXPRESSION_PATTERN.test(expr.trim())) {
+    throw new Error(
+      `Invalid cron expression at ${path}: "${expr}". Expected 5-field cron format (minute hour day month weekday).`
+    );
+  }
+};
+var KNOWN_TIMEZONES = (() => {
+  try {
+    return new Set(Intl.supportedValuesOf("timeZone"));
+  } catch {
+    return null;
+  }
+})();
+var validateTimezone = (tz, path) => {
+  if (KNOWN_TIMEZONES && !KNOWN_TIMEZONES.has(tz)) {
+    throw new Error(
+      `Invalid timezone at ${path}: "${tz}". Expected an IANA timezone string (e.g. "America/New_York", "UTC").`
+    );
+  }
+};
+var parseCronJobs = (value) => {
+  const raw = asRecord(value);
+  const keys = Object.keys(raw);
+  if (keys.length === 0) return void 0;
+  const jobs = {};
+  for (const jobName of keys) {
+    const jobValue = asRecord(raw[jobName]);
+    const path = `AGENT.md frontmatter cron.${jobName}`;
+    if (typeof jobValue.schedule !== "string" || jobValue.schedule.trim() === "") {
+      throw new Error(
+        `Invalid ${path}: "schedule" is required and must be a non-empty string.`
+      );
+    }
+    if (typeof jobValue.task !== "string" || jobValue.task.trim() === "") {
+      throw new Error(
+        `Invalid ${path}: "task" is required and must be a non-empty string.`
+      );
+    }
+    validateCronExpression(jobValue.schedule, path);
+    const timezone = typeof jobValue.timezone === "string" && jobValue.timezone.trim() ? jobValue.timezone.trim() : void 0;
+    if (timezone) {
+      validateTimezone(timezone, path);
+    }
+    jobs[jobName] = {
+      schedule: jobValue.schedule.trim(),
+      task: jobValue.task,
+      timezone
+    };
+  }
+  return jobs;
+};
 var parseAgentMarkdown = (content) => {
   const match = content.match(FRONTMATTER_PATTERN);
   if (!match) {
@@ -144,7 +197,8 @@ var parseAgentMarkdown = (content) => {
     approvalRequired: approvalRequired.mcp.length > 0 || approvalRequired.scripts.length > 0 ? {
       mcp: approvalRequired.mcp.length > 0 ? approvalRequired.mcp : void 0,
       scripts: approvalRequired.scripts.length > 0 ? approvalRequired.scripts : void 0
-    } : void 0
+    } : void 0,
+    cron: parseCronJobs(parsed.cron)
   };
   return {
     frontmatter,
@@ -412,10 +466,313 @@ var createWriteTool = (workingDir) => defineTool({
 
 // src/harness.ts
 import { randomUUID as randomUUID3 } from "crypto";
+import { getTextContent } from "@poncho-ai/sdk";
+
+// src/upload-store.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3, rm } from "fs/promises";
+import { createRequire } from "module";
+import { resolve as resolve5 } from "path";
+var tryImport = async (mod, workingDir) => {
+  try {
+    return await import(
+      /* webpackIgnore: true */
+      mod
+    );
+  } catch {
+    if (workingDir) {
+      const require2 = createRequire(resolve5(workingDir, "package.json"));
+      const resolved = require2.resolve(mod);
+      return await import(
+        /* webpackIgnore: true */
+        resolved
+      );
+    }
+    throw new Error(`Cannot find module "${mod}"`);
+  }
+};
+var PONCHO_UPLOAD_SCHEME = "poncho-upload://";
+var CachedUploadStore = class {
+  inner;
+  cache = /* @__PURE__ */ new Map();
+  maxEntries;
+  ttlMs;
+  constructor(inner, maxEntries = 64, ttlMs = 10 * 60 * 1e3) {
+    this.inner = inner;
+    this.maxEntries = maxEntries;
+    this.ttlMs = ttlMs;
+  }
+  async put(key, data, mediaType) {
+    const ref = `${PONCHO_UPLOAD_SCHEME}${key}`;
+    const now2 = Date.now();
+    this.cache.set(ref, { data, ts: now2 });
+    this.cache.set(key, { data, ts: now2 });
+    this.evict();
+    this.inner.put(key, data, mediaType).catch((err) => {
+      console.error("[poncho] background upload failed:", err instanceof Error ? err.message : err);
+    });
+    return ref;
+  }
+  async get(urlOrKey) {
+    const cached = this.cache.get(urlOrKey);
+    if (cached && Date.now() - cached.ts < this.ttlMs) {
+      return cached.data;
+    }
+    return this.inner.get(urlOrKey);
+  }
+  async delete(urlOrKey) {
+    this.cache.delete(urlOrKey);
+    return this.inner.delete(urlOrKey);
+  }
+  evict() {
+    if (this.cache.size <= this.maxEntries) return;
+    let oldest;
+    let oldestTs = Infinity;
+    for (const [k, v] of this.cache) {
+      if (v.ts < oldestTs) {
+        oldestTs = v.ts;
+        oldest = k;
+      }
+    }
+    if (oldest) this.cache.delete(oldest);
+  }
+};
+var deriveUploadKey = (data, mediaType) => {
+  const hash = createHash2("sha256").update(data).digest("hex").slice(0, 24);
+  const ext = mimeToExt(mediaType);
+  return `${hash}${ext}`;
+};
+var MIME_EXT_MAP = {
+  "image/jpeg": ".jpg",
+  "image/png": ".png",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/svg+xml": ".svg",
+  "application/pdf": ".pdf",
+  "text/plain": ".txt",
+  "text/csv": ".csv",
+  "text/html": ".html",
+  "application/json": ".json",
+  "video/mp4": ".mp4",
+  "video/webm": ".webm",
+  "audio/mpeg": ".mp3",
+  "audio/wav": ".wav"
+};
+var mimeToExt = (mediaType) => MIME_EXT_MAP[mediaType] ?? `.${mediaType.split("/").pop() ?? "bin"}`;
+var LocalUploadStore = class {
+  uploadsDir;
+  constructor(workingDir) {
+    this.uploadsDir = resolve5(workingDir, ".poncho", "uploads");
+  }
+  async put(_key, data, mediaType) {
+    const key = deriveUploadKey(data, mediaType);
+    const filePath = resolve5(this.uploadsDir, key);
+    await mkdir2(this.uploadsDir, { recursive: true });
+    await writeFile3(filePath, data);
+    return `${PONCHO_UPLOAD_SCHEME}${key}`;
+  }
+  async get(urlOrKey) {
+    const key = urlOrKey.startsWith(PONCHO_UPLOAD_SCHEME) ? urlOrKey.slice(PONCHO_UPLOAD_SCHEME.length) : urlOrKey;
+    return readFile4(resolve5(this.uploadsDir, key));
+  }
+  async delete(urlOrKey) {
+    const key = urlOrKey.startsWith(PONCHO_UPLOAD_SCHEME) ? urlOrKey.slice(PONCHO_UPLOAD_SCHEME.length) : urlOrKey;
+    await rm(resolve5(this.uploadsDir, key), { force: true });
+  }
+};
+var VercelBlobUploadStore = class {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  sdk;
+  workingDir;
+  access;
+  constructor(workingDir, access3 = "public") {
+    this.workingDir = workingDir;
+    this.access = access3;
+  }
+  async loadSdk() {
+    if (this.sdk) return this.sdk;
+    try {
+      this.sdk = await tryImport("@vercel/blob", this.workingDir);
+      return this.sdk;
+    } catch {
+      throw new Error(
+        'uploads: vercel-blob provider requires the "@vercel/blob" package. Install it with: pnpm add @vercel/blob'
+      );
+    }
+  }
+  async put(key, data, mediaType) {
+    const sdk = await this.loadSdk();
+    await sdk.put(key, data, {
+      access: this.access,
+      contentType: mediaType,
+      addRandomSuffix: false,
+      allowOverwrite: true
+    });
+    return `${PONCHO_UPLOAD_SCHEME}${key}`;
+  }
+  async get(urlOrKey) {
+    let pathname = urlOrKey;
+    if (urlOrKey.startsWith(PONCHO_UPLOAD_SCHEME)) {
+      pathname = urlOrKey.slice(PONCHO_UPLOAD_SCHEME.length);
+    } else if (urlOrKey.startsWith("https://") || urlOrKey.startsWith("http://")) {
+      pathname = new URL(urlOrKey).pathname.slice(1);
+    }
+    if (this.access === "private") {
+      const sdk2 = await this.loadSdk();
+      const result = await sdk2.get(pathname, { access: "private" });
+      if (!result || result.statusCode !== 200) {
+        throw new Error(`uploads: failed to fetch private blob "${pathname}": ${result?.statusCode ?? "not found"}`);
+      }
+      const chunks = [];
+      const reader = result.stream.getReader();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return Buffer.concat(chunks);
+    }
+    const sdk = await this.loadSdk();
+    const blob = await sdk.head(pathname);
+    const response = await fetch(blob.url);
+    if (!response.ok) {
+      throw new Error(`uploads: failed to fetch blob "${pathname}": ${response.status}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+  }
+  async delete(urlOrKey) {
+    const sdk = await this.loadSdk();
+    await sdk.del(urlOrKey);
+  }
+};
+var S3UploadStore = class {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  s3Sdk;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  presignerSdk;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  client;
+  bucket;
+  region;
+  endpoint;
+  workingDir;
+  constructor(bucket, region, endpoint, workingDir) {
+    this.bucket = bucket;
+    this.region = region;
+    this.endpoint = endpoint;
+    this.workingDir = workingDir;
+  }
+  async ensureClient() {
+    if (this.client) return;
+    try {
+      this.s3Sdk = await tryImport("@aws-sdk/client-s3", this.workingDir);
+      this.presignerSdk = await tryImport("@aws-sdk/s3-request-presigner", this.workingDir);
+    } catch {
+      throw new Error(
+        'uploads: s3 provider requires "@aws-sdk/client-s3" and "@aws-sdk/s3-request-presigner". Install with: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner'
+      );
+    }
+    this.client = new this.s3Sdk.S3Client({
+      region: this.region ?? process.env.AWS_REGION ?? "us-east-1",
+      ...this.endpoint ? { endpoint: this.endpoint, forcePathStyle: true } : {}
+    });
+  }
+  async put(key, data, mediaType) {
+    await this.ensureClient();
+    await this.client.send(
+      new this.s3Sdk.PutObjectCommand({
+        Bucket: this.bucket,
+        Key: key,
+        Body: data,
+        ContentType: mediaType
+      })
+    );
+    const url = await this.presignerSdk.getSignedUrl(
+      this.client,
+      new this.s3Sdk.GetObjectCommand({ Bucket: this.bucket, Key: key }),
+      { expiresIn: 7 * 24 * 60 * 60 }
+    );
+    return url;
+  }
+  async get(urlOrKey) {
+    if (urlOrKey.startsWith("https://") || urlOrKey.startsWith("http://")) {
+      const response = await fetch(urlOrKey);
+      if (!response.ok) {
+        throw new Error(`uploads: failed to fetch S3 object at ${urlOrKey}: ${response.status}`);
+      }
+      return Buffer.from(await response.arrayBuffer());
+    }
+    await this.ensureClient();
+    const result = await this.client.send(
+      new this.s3Sdk.GetObjectCommand({ Bucket: this.bucket, Key: urlOrKey })
+    );
+    if (!result.Body) throw new Error(`uploads: empty body for S3 key ${urlOrKey}`);
+    return Buffer.from(await result.Body.transformToByteArray());
+  }
+  async delete(urlOrKey) {
+    await this.ensureClient();
+    const key = urlOrKey.startsWith("https://") ? new URL(urlOrKey).pathname.slice(1) : urlOrKey;
+    await this.client.send(
+      new this.s3Sdk.DeleteObjectCommand({ Bucket: this.bucket, Key: key })
+    );
+  }
+};
+var warn = (msg) => {
+  console.warn(`[poncho] \u26A0 ${msg}`);
+};
+var createUploadStore = async (config, workingDir) => {
+  const provider = config?.provider ?? "local";
+  if (provider === "vercel-blob") {
+    if (!process.env.BLOB_READ_WRITE_TOKEN) {
+      warn(
+        "uploads: vercel-blob configured but BLOB_READ_WRITE_TOKEN not found in environment. Falling back to local filesystem.\n         Make sure BLOB_READ_WRITE_TOKEN is set in your .env file or environment."
+      );
+      return new LocalUploadStore(workingDir);
+    }
+    const store = new VercelBlobUploadStore(workingDir, config?.access ?? "public");
+    try {
+      await store.loadSdk();
+      console.log("[poncho] uploads: using vercel-blob store");
+      return new CachedUploadStore(store);
+    } catch {
+      warn(
+        'uploads: vercel-blob configured but "@vercel/blob" package is not installed. Falling back to local filesystem.\n         Run `poncho build <target>` to auto-add it, or install manually: pnpm add @vercel/blob'
+      );
+      return new LocalUploadStore(workingDir);
+    }
+  }
+  if (provider === "s3") {
+    const bucket = config?.bucket ?? process.env.PONCHO_UPLOADS_BUCKET;
+    if (!process.env.AWS_ACCESS_KEY_ID || !bucket) {
+      const missing = !process.env.AWS_ACCESS_KEY_ID ? "AWS_ACCESS_KEY_ID" : "bucket (config.uploads.bucket or PONCHO_UPLOADS_BUCKET)";
+      warn(
+        `uploads: s3 configured but ${missing} not found in environment. Falling back to local filesystem.`
+      );
+      return new LocalUploadStore(workingDir);
+    }
+    const store = new S3UploadStore(
+      bucket,
+      config?.region ?? process.env.AWS_REGION,
+      config?.endpoint ?? process.env.PONCHO_UPLOADS_ENDPOINT,
+      workingDir
+    );
+    try {
+      await store.ensureClient();
+      console.log(`[poncho] uploads: using s3 store (bucket: ${bucket})`);
+      return new CachedUploadStore(store);
+    } catch {
+      warn(
+        "uploads: s3 configured but AWS SDK packages are not installed. Falling back to local filesystem.\n         Run `poncho build <target>` to auto-add them, or install manually: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner"
+      );
+      return new LocalUploadStore(workingDir);
+    }
+  }
+  return new LocalUploadStore(workingDir);
+};
 
 // src/memory.ts
-import { mkdir as mkdir2, readFile as readFile4, rename, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2, resolve as resolve5 } from "path";
+import { mkdir as mkdir3, readFile as readFile5, rename, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname2, resolve as resolve6 } from "path";
 import { defineTool as defineTool2 } from "@poncho-ai/sdk";
 var DEFAULT_MAIN_MEMORY = {
   content: "",
@@ -423,9 +780,9 @@ var DEFAULT_MAIN_MEMORY = {
 };
 var LOCAL_MEMORY_FILE = "memory.json";
 var writeJsonAtomic = async (filePath, payload) => {
-  await mkdir2(dirname2(filePath), { recursive: true });
+  await mkdir3(dirname2(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  await writeFile3(tmpPath, JSON.stringify(payload, null, 2), "utf8");
+  await writeFile4(tmpPath, JSON.stringify(payload, null, 2), "utf8");
   await rename(tmpPath, filePath);
 };
 var scoreText = (text, query) => {
@@ -487,7 +844,7 @@ var FileMainMemoryStore = class {
       return;
     }
     const identity = await ensureAgentIdentity(this.workingDir);
-    this.filePath = resolve5(getAgentStoreDirectory(identity), LOCAL_MEMORY_FILE);
+    this.filePath = resolve6(getAgentStoreDirectory(identity), LOCAL_MEMORY_FILE);
   }
   isExpired(updatedAt) {
     return typeof this.ttlMs === "number" && Date.now() - updatedAt > this.ttlMs;
@@ -499,7 +856,7 @@ var FileMainMemoryStore = class {
     }
     this.loaded = true;
     try {
-      const raw = await readFile4(this.filePath, "utf8");
+      const raw = await readFile5(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const content = typeof parsed.main?.content === "string" ? parsed.main.content : "";
       const updatedAt = typeof parsed.main?.updatedAt === "number" ? parsed.main.updatedAt : 0;
@@ -1385,8 +1742,8 @@ var createModelProvider = (provider) => {
 };
 
 // src/skill-context.ts
-import { readFile as readFile5, readdir as readdir2, stat } from "fs/promises";
-import { dirname as dirname3, resolve as resolve6, normalize } from "path";
+import { readFile as readFile6, readdir as readdir2, stat } from "fs/promises";
+import { dirname as dirname3, resolve as resolve7, normalize } from "path";
 import YAML3 from "yaml";
 var DEFAULT_SKILL_DIRS = ["skills"];
 var resolveSkillDirs = (workingDir, extraPaths) => {
@@ -1398,7 +1755,7 @@ var resolveSkillDirs = (workingDir, extraPaths) => {
       }
     }
   }
-  return dirs.map((d) => resolve6(workingDir, d));
+  return dirs.map((d) => resolve7(workingDir, d));
 };
 var FRONTMATTER_PATTERN3 = /^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/;
 var asRecord2 = (value) => typeof value === "object" && value !== null ? value : {};
@@ -1467,7 +1824,7 @@ var collectSkillManifests = async (directory) => {
   const entries = await readdir2(directory, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = resolve6(directory, entry.name);
+    const fullPath = resolve7(directory, entry.name);
     let isDir = entry.isDirectory();
     let isFile = entry.isFile();
     if (entry.isSymbolicLink()) {
@@ -1502,7 +1859,7 @@ var loadSkillMetadata = async (workingDir, extraSkillPaths) => {
   const seen = /* @__PURE__ */ new Set();
   for (const manifest of allManifests) {
     try {
-      const content = await readFile5(manifest, "utf8");
+      const content = await readFile6(manifest, "utf8");
       const parsed = parseSkillFrontmatter(content);
       if (parsed && !seen.has(parsed.name)) {
         seen.add(parsed.name);
@@ -1547,7 +1904,7 @@ ${xmlSkills}
 };
 var escapeXml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 var loadSkillInstructions = async (skill) => {
-  const content = await readFile5(skill.skillPath, "utf8");
+  const content = await readFile6(skill.skillPath, "utf8");
   const match = content.match(FRONTMATTER_PATTERN3);
   return match ? match[2].trim() : content.trim();
 };
@@ -1556,11 +1913,11 @@ var readSkillResource = async (skill, relativePath) => {
   if (normalized.startsWith("..") || normalized.startsWith("/")) {
     throw new Error("Path must be relative and within the skill directory");
   }
-  const fullPath = resolve6(skill.skillDir, normalized);
+  const fullPath = resolve7(skill.skillDir, normalized);
   if (!fullPath.startsWith(skill.skillDir)) {
     throw new Error("Path escapes the skill directory");
   }
-  return await readFile5(fullPath, "utf8");
+  return await readFile6(fullPath, "utf8");
 };
 var MAX_INSTRUCTIONS_PER_SKILL = 1200;
 var loadSkillContext = async (workingDir) => {
@@ -1651,7 +2008,7 @@ function convertSchema(schema) {
 // src/skill-tools.ts
 import { defineTool as defineTool3 } from "@poncho-ai/sdk";
 import { access as access2, readdir as readdir3, stat as stat2 } from "fs/promises";
-import { extname, normalize as normalize2, resolve as resolve7, sep as sep2 } from "path";
+import { extname, normalize as normalize2, resolve as resolve8, sep as sep2 } from "path";
 import { pathToFileURL } from "url";
 import { createJiti as createJiti2 } from "jiti";
 var createSkillTools = (skills, options) => {
@@ -1908,7 +2265,7 @@ var collectScriptFiles = async (directory) => {
     if (entry.name === "node_modules") {
       continue;
     }
-    const fullPath = resolve7(directory, entry.name);
+    const fullPath = resolve8(directory, entry.name);
     let isDir = entry.isDirectory();
     let isFile = entry.isFile();
     if (entry.isSymbolicLink()) {
@@ -1947,8 +2304,8 @@ var normalizeScriptPolicyPath = (relativePath) => {
 };
 var resolveScriptPath = (baseDir, relativePath) => {
   const normalized = normalizeScriptPolicyPath(relativePath);
-  const fullPath = resolve7(baseDir, normalized);
-  if (!fullPath.startsWith(`${resolve7(baseDir)}${sep2}`) && fullPath !== resolve7(baseDir)) {
+  const fullPath = resolve8(baseDir, normalized);
+  if (!fullPath.startsWith(`${resolve8(baseDir)}${sep2}`) && fullPath !== resolve8(baseDir)) {
     throw new Error("Script path must stay inside the allowed directory");
   }
   const extension = extname(fullPath).toLowerCase();
@@ -2256,6 +2613,25 @@ You can extend your own capabilities by creating custom JavaScript/TypeScript sc
   - Script entries outside \`./scripts/\` must also appear in \`allowed-tools\`.
 - Keep MCP server connection details (\`url\`, auth env vars) in \`poncho.config.js\` only.
 
+## Cron Jobs
+
+Users can define scheduled tasks in \`AGENT.md\` frontmatter:
+
+\`\`\`yaml
+cron:
+  daily-report:
+    schedule: "0 9 * * *"        # Standard 5-field cron expression
+    timezone: "America/New_York" # Optional IANA timezone (default: UTC)
+    task: "Generate the daily sales report"
+\`\`\`
+
+- Each cron job triggers an autonomous agent run with the specified task, creating a fresh conversation.
+- In \`poncho dev\`, jobs run via an in-process scheduler and appear in the web UI sidebar (prefixed with \`[cron]\`).
+- For Vercel: \`poncho build vercel\` generates \`vercel.json\` cron entries. Set \`CRON_SECRET\` = \`PONCHO_AUTH_TOKEN\`.
+- Jobs can also be triggered manually: \`GET /api/cron/<jobName>\`.
+- To carry context across cron runs, enable memory.
+- **IMPORTANT**: When adding a new cron job, always PRESERVE all existing cron jobs. Never remove or overwrite existing jobs unless the user explicitly asks you to replace or delete them. Read the full current \`cron:\` block before editing, and append the new job alongside the existing ones.
+
 ## When users ask about customization:
 
 - Explain and edit \`poncho.config.js\` for model/provider, storage+memory, auth, telemetry, and MCP settings.
@@ -2283,6 +2659,7 @@ var AgentHarness = class {
   modelProviderInjected;
   dispatcher = new ToolDispatcher();
   approvalHandler;
+  uploadStore;
   skillContextWindow = "";
   memoryStore;
   loadedConfig;
@@ -2345,10 +2722,14 @@ var AgentHarness = class {
     this.modelProviderInjected = !!options.modelProvider;
     this.modelProvider = options.modelProvider ?? createModelProvider("anthropic");
     this.approvalHandler = options.approvalHandler;
+    this.uploadStore = options.uploadStore;
     if (options.toolDefinitions?.length) {
       this.dispatcher.registerMany(options.toolDefinitions);
     }
   }
+  get frontmatter() {
+    return this.parsedAgent?.frontmatter;
+  }
   listActiveSkills() {
     return [...this.activeSkillNames].sort();
   }
@@ -2626,9 +3007,9 @@ var AgentHarness = class {
           for await (const event of this.run(input)) {
             eventQueue.push(event);
             if (queueResolve) {
-              const resolve9 = queueResolve;
+              const resolve10 = queueResolve;
               queueResolve = null;
-              resolve9();
+              resolve10();
             }
           }
         } catch (error) {
@@ -2646,8 +3027,8 @@ var AgentHarness = class {
           if (eventQueue.length > 0) {
             yield eventQueue.shift();
           } else if (!generatorDone) {
-            await new Promise((resolve9) => {
-              queueResolve = resolve9;
+            await new Promise((resolve10) => {
+              queueResolve = resolve10;
             });
           }
         }
@@ -2671,6 +3052,8 @@ var AgentHarness = class {
     const start = now();
     const maxSteps = agent.frontmatter.limits?.maxSteps ?? 50;
     const timeoutMs = (agent.frontmatter.limits?.timeout ?? 300) * 1e3;
+    const platformMaxDurationSec = Number(process.env.PONCHO_MAX_DURATION) || 0;
+    const softDeadlineMs = platformMaxDurationSec > 0 ? platformMaxDurationSec * 800 : 0;
     const messages = [...input.messages ?? []];
     const events = [];
     const systemPrompt = renderAgentPrompt(agent, {
@@ -2718,11 +3101,42 @@ ${boundedMainMemory.trim()}` : "";
       runId,
       agentId: agent.frontmatter.id ?? agent.frontmatter.name
     });
-    messages.push({
-      role: "user",
-      content: input.task,
-      metadata: { timestamp: now(), id: randomUUID3() }
-    });
+    if (input.files && input.files.length > 0) {
+      const parts = [
+        { type: "text", text: input.task }
+      ];
+      for (const file of input.files) {
+        if (this.uploadStore) {
+          const buf = Buffer.from(file.data, "base64");
+          const key = deriveUploadKey(buf, file.mediaType);
+          const ref = await this.uploadStore.put(key, buf, file.mediaType);
+          parts.push({
+            type: "file",
+            data: ref,
+            mediaType: file.mediaType,
+            filename: file.filename
+          });
+        } else {
+          parts.push({
+            type: "file",
+            data: file.data,
+            mediaType: file.mediaType,
+            filename: file.filename
+          });
+        }
+      }
+      messages.push({
+        role: "user",
+        content: parts,
+        metadata: { timestamp: now(), id: randomUUID3() }
+      });
+    } else {
+      messages.push({
+        role: "user",
+        content: input.task,
+        metadata: { timestamp: now(), id: randomUUID3() }
+      });
+    }
     let responseText = "";
     let totalInputTokens = 0;
     let totalOutputTokens = 0;
@@ -2744,6 +3158,19 @@ ${boundedMainMemory.trim()}` : "";
           });
           return;
         }
+        if (softDeadlineMs > 0 && now() - start > softDeadlineMs) {
+          const result2 = {
+            status: "completed",
+            response: responseText,
+            steps: step - 1,
+            tokens: { input: totalInputTokens, output: totalOutputTokens, cached: 0 },
+            duration: now() - start,
+            continuation: true,
+            maxSteps
+          };
+          yield pushEvent({ type: "run:completed", runId, result: result2 });
+          return;
+        }
         const stepStart = now();
         yield pushEvent({ type: "step:started", step });
         yield pushEvent({ type: "model:request", tokens: 0 });
@@ -2765,102 +3192,182 @@ ${boundedMainMemory.trim()}` : "";
             inputSchema: jsonSchemaToZod(tool.inputSchema)
           };
         }
-        const coreMessages = trimMessageWindow(messages).flatMap(
-          (msg) => {
-            if (msg.role === "tool") {
-              try {
-                const parsed = JSON.parse(msg.content);
-                if (!Array.isArray(parsed)) {
-                  return [];
+        const convertMessage = async (msg) => {
+          if (msg.role === "tool") {
+            const textContent = typeof msg.content === "string" ? msg.content : getTextContent(msg);
+            try {
+              const parsed = JSON.parse(textContent);
+              if (!Array.isArray(parsed)) {
+                return [];
+              }
+              const toolResults = parsed.filter((item) => {
+                if (typeof item !== "object" || item === null) {
+                  return false;
                 }
-                const toolResults = parsed.filter((item) => {
-                  if (typeof item !== "object" || item === null) {
+                const row = item;
+                return typeof row.tool_use_id === "string" && typeof row.tool_name === "string" && typeof row.content === "string";
+              });
+              if (toolResults.length === 0) {
+                return [];
+              }
+              return [{
+                role: "tool",
+                content: toolResults.map((tr) => {
+                  if (tr.content.startsWith("Tool error:")) {
+                    return {
+                      type: "tool-result",
+                      toolCallId: tr.tool_use_id,
+                      toolName: tr.tool_name,
+                      output: { type: "text", value: tr.content }
+                    };
+                  }
+                  try {
+                    const resultValue = JSON.parse(tr.content);
+                    return {
+                      type: "tool-result",
+                      toolCallId: tr.tool_use_id,
+                      toolName: tr.tool_name,
+                      output: { type: "json", value: resultValue }
+                    };
+                  } catch {
+                    return {
+                      type: "tool-result",
+                      toolCallId: tr.tool_use_id,
+                      toolName: tr.tool_name,
+                      output: { type: "text", value: tr.content }
+                    };
+                  }
+                })
+              }];
+            } catch {
+              return [];
+            }
+          }
+          if (msg.role === "assistant") {
+            const assistantText = typeof msg.content === "string" ? msg.content : getTextContent(msg);
+            try {
+              const parsed = JSON.parse(assistantText);
+              if (typeof parsed === "object" && parsed !== null) {
+                const parsedRecord = parsed;
+                if (!Array.isArray(parsedRecord.tool_calls)) {
+                  return [{ role: "assistant", content: assistantText }];
+                }
+                const textPart = typeof parsedRecord.text === "string" ? parsedRecord.text : "";
+                const validToolCalls = parsedRecord.tool_calls.filter((tc) => {
+                  if (typeof tc !== "object" || tc === null) {
                     return false;
                   }
-                  const row = item;
-                  return typeof row.tool_use_id === "string" && typeof row.tool_name === "string" && typeof row.content === "string";
-                });
-                if (toolResults.length === 0) {
+                  const toolCall = tc;
+                  return typeof toolCall.id === "string" && typeof toolCall.name === "string" && toolCall.input !== null && typeof toolCall.input === "object";
+                }).map((tc) => ({
+                  type: "tool-call",
+                  toolCallId: tc.id,
+                  toolName: tc.name,
+                  input: tc.input
+                }));
+                if (textPart.length === 0 && validToolCalls.length === 0) {
                   return [];
                 }
                 return [{
-                  role: "tool",
-                  content: toolResults.map((tr) => {
-                    if (tr.content.startsWith("Tool error:")) {
-                      return {
-                        type: "tool-result",
-                        toolCallId: tr.tool_use_id,
-                        toolName: tr.tool_name,
-                        output: { type: "text", value: tr.content }
-                      };
-                    }
-                    try {
-                      const resultValue = JSON.parse(tr.content);
-                      return {
-                        type: "tool-result",
-                        toolCallId: tr.tool_use_id,
-                        toolName: tr.tool_name,
-                        output: { type: "json", value: resultValue }
-                      };
-                    } catch {
-                      return {
-                        type: "tool-result",
-                        toolCallId: tr.tool_use_id,
-                        toolName: tr.tool_name,
-                        output: { type: "text", value: tr.content }
-                      };
-                    }
-                  })
+                  role: "assistant",
+                  content: [
+                    ...textPart.length > 0 ? [{ type: "text", text: textPart }] : [],
+                    ...validToolCalls
+                  ]
                 }];
-              } catch {
-                return [];
               }
+            } catch {
             }
-            if (msg.role === "assistant") {
-              try {
-                const parsed = JSON.parse(msg.content);
-                if (typeof parsed === "object" && parsed !== null) {
-                  const parsedRecord = parsed;
-                  if (!Array.isArray(parsedRecord.tool_calls)) {
-                    return [{ role: "assistant", content: msg.content }];
-                  }
-                  const textPart = typeof parsedRecord.text === "string" ? parsedRecord.text : "";
-                  const validToolCalls = parsedRecord.tool_calls.filter((tc) => {
-                    if (typeof tc !== "object" || tc === null) {
-                      return false;
+            return [{ role: "assistant", content: assistantText }];
+          }
+          if (msg.role === "system") {
+            return [{
+              role: "system",
+              content: typeof msg.content === "string" ? msg.content : getTextContent(msg)
+            }];
+          }
+          if (msg.role === "user") {
+            if (typeof msg.content === "string") {
+              return [{ role: "user", content: msg.content }];
+            }
+            const MODEL_IMAGE_TYPES = /* @__PURE__ */ new Set([
+              "image/jpeg",
+              "image/png",
+              "image/gif",
+              "image/webp"
+            ]);
+            const MODEL_FILE_TYPES = /* @__PURE__ */ new Set([
+              "application/pdf"
+            ]);
+            const isTextBasedMime = (mt) => mt.startsWith("text/") || mt === "application/json" || mt === "application/xml" || mt === "application/x-yaml" || mt.endsWith("+json") || mt.endsWith("+xml");
+            const userContent = await Promise.all(
+              msg.content.map(async (part) => {
+                if (part.type === "text") {
+                  return { type: "text", text: part.text };
+                }
+                const isSupportedImage = MODEL_IMAGE_TYPES.has(part.mediaType);
+                const isSupportedFile = MODEL_FILE_TYPES.has(part.mediaType);
+                if (!isSupportedImage && !isSupportedFile && isTextBasedMime(part.mediaType)) {
+                  let textContent;
+                  try {
+                    if (part.data.startsWith(PONCHO_UPLOAD_SCHEME) && this.uploadStore) {
+                      const buf = await this.uploadStore.get(part.data);
+                      textContent = buf.toString("utf8");
+                    } else if (part.data.startsWith("https://") || part.data.startsWith("http://")) {
+                      const resp = await fetch(part.data);
+                      textContent = await resp.text();
+                    } else {
+                      textContent = Buffer.from(part.data, "base64").toString("utf8");
                     }
-                    const toolCall = tc;
-                    return typeof toolCall.id === "string" && typeof toolCall.name === "string" && toolCall.input !== null && typeof toolCall.input === "object";
-                  }).map((tc) => ({
-                    type: "tool-call",
-                    toolCallId: tc.id,
-                    toolName: tc.name,
-                    input: tc.input
-                  }));
-                  if (textPart.length === 0 && validToolCalls.length === 0) {
-                    return [];
+                  } catch {
+                    textContent = "(could not read file)";
                   }
-                  return [{
-                    role: "assistant",
-                    content: [
-                      ...textPart.length > 0 ? [{ type: "text", text: textPart }] : [],
-                      ...validToolCalls
-                    ]
-                  }];
+                  const label = part.filename ?? part.mediaType;
+                  return { type: "text", text: `[File: ${label}]
+${textContent}` };
                 }
-              } catch {
-              }
-              return [{ role: "assistant", content: msg.content }];
-            }
-            if (msg.role === "user" || msg.role === "system") {
-              return [{
-                role: msg.role,
-                content: msg.content
-              }];
-            }
-            return [];
+                if (!isSupportedImage && !isSupportedFile) {
+                  const label = part.filename ?? part.mediaType;
+                  return {
+                    type: "text",
+                    text: `[Attached file: ${label} (${part.mediaType}) \u2014 this format is not supported by the model and was skipped]`
+                  };
+                }
+                let resolvedData;
+                if (part.data.startsWith(PONCHO_UPLOAD_SCHEME) && this.uploadStore) {
+                  const buf = await this.uploadStore.get(part.data);
+                  resolvedData = buf.toString("base64");
+                } else if (part.data.startsWith("https://") || part.data.startsWith("http://")) {
+                  if (this.uploadStore) {
+                    const buf = await this.uploadStore.get(part.data);
+                    resolvedData = buf.toString("base64");
+                  } else {
+                    const resp = await fetch(part.data);
+                    resolvedData = Buffer.from(await resp.arrayBuffer()).toString("base64");
+                  }
+                } else {
+                  resolvedData = part.data;
+                }
+                if (isSupportedImage) {
+                  return {
+                    type: "image",
+                    image: resolvedData,
+                    mediaType: part.mediaType
+                  };
+                }
+                return {
+                  type: "file",
+                  data: resolvedData,
+                  mediaType: part.mediaType,
+                  filename: part.filename
+                };
+              })
+            );
+            return [{ role: "user", content: userContent }];
           }
-        );
+          return [];
+        };
+        const coreMessages = (await Promise.all(trimMessageWindow(messages).map(convertMessage))).flat();
         const modelName = agent.frontmatter.model?.name ?? "claude-opus-4-5";
         const temperature = agent.frontmatter.model?.temperature ?? 0.2;
         const maxTokens = agent.frontmatter.model?.maxTokens;
@@ -2907,8 +3414,8 @@ ${boundedMainMemory.trim()}` : "";
             let timer;
             const nextChunk = await Promise.race([
               textIterator.next(),
-              new Promise((resolve9) => {
-                timer = setTimeout(() => resolve9(null), timeout);
+              new Promise((resolve10) => {
+                timer = setTimeout(() => resolve10(null), timeout);
               })
             ]);
             clearTimeout(timer);
@@ -3183,14 +3690,27 @@ ${boundedMainMemory.trim()}` : "";
         return;
       }
     }
-    yield {
-      type: "run:error",
-      runId,
-      error: {
-        code: "MAX_STEPS_EXCEEDED",
-        message: `Run reached maximum of ${maxSteps} steps`
-      }
-    };
+    if (softDeadlineMs > 0) {
+      const result = {
+        status: "completed",
+        response: responseText,
+        steps: maxSteps,
+        tokens: { input: totalInputTokens, output: totalOutputTokens, cached: 0 },
+        duration: now() - start,
+        continuation: true,
+        maxSteps
+      };
+      yield pushEvent({ type: "run:completed", runId, result });
+    } else {
+      yield pushEvent({
+        type: "run:error",
+        runId,
+        error: {
+          code: "MAX_STEPS_EXCEEDED",
+          message: `Run reached maximum of ${maxSteps} steps`
+        }
+      });
+    }
   }
   async runToCompletion(input) {
     const events = [];
@@ -3270,8 +3790,8 @@ var LatitudeCapture = class {
 
 // src/state.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir3, readFile as readFile6, readdir as readdir4, rename as rename2, rm, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, resolve as resolve8 } from "path";
+import { mkdir as mkdir4, readFile as readFile7, readdir as readdir4, rename as rename2, rm as rm2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname4, resolve as resolve9 } from "path";
 var DEFAULT_OWNER = "local-owner";
 var LOCAL_STATE_FILE = "state.json";
 var CONVERSATIONS_DIRECTORY = "conversations";
@@ -3287,9 +3807,9 @@ var toStoreIdentity = async ({
   return { name: ensured.name, id: agentId };
 };
 var writeJsonAtomic2 = async (filePath, payload) => {
-  await mkdir3(dirname4(filePath), { recursive: true });
+  await mkdir4(dirname4(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  await writeFile4(tmpPath, JSON.stringify(payload, null, 2), "utf8");
+  await writeFile5(tmpPath, JSON.stringify(payload, null, 2), "utf8");
   await rename2(tmpPath, filePath);
 };
 var formatUtcTimestamp = (value) => new Date(value).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
@@ -3450,8 +3970,8 @@ var FileConversationStore = class {
       agentId: this.agentId
     });
     const agentDir = getAgentStoreDirectory(identity);
-    const conversationsDir = resolve8(agentDir, CONVERSATIONS_DIRECTORY);
-    const indexPath = resolve8(conversationsDir, LOCAL_CONVERSATION_INDEX_FILE);
+    const conversationsDir = resolve9(agentDir, CONVERSATIONS_DIRECTORY);
+    const indexPath = resolve9(conversationsDir, LOCAL_CONVERSATION_INDEX_FILE);
     this.paths = { conversationsDir, indexPath };
     return this.paths;
   }
@@ -3465,9 +3985,9 @@ var FileConversationStore = class {
   }
   async readConversationFile(fileName) {
     const { conversationsDir } = await this.resolvePaths();
-    const filePath = resolve8(conversationsDir, fileName);
+    const filePath = resolve9(conversationsDir, fileName);
     try {
-      const raw = await readFile6(filePath, "utf8");
+      const raw = await readFile7(filePath, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -3509,7 +4029,7 @@ var FileConversationStore = class {
     this.loaded = true;
     const { indexPath } = await this.resolvePaths();
     try {
-      const raw = await readFile6(indexPath, "utf8");
+      const raw = await readFile7(indexPath, "utf8");
       const parsed = JSON.parse(raw);
       for (const conversation of parsed.conversations ?? []) {
         this.conversations.set(conversation.conversationId, conversation);
@@ -3522,7 +4042,7 @@ var FileConversationStore = class {
     const { conversationsDir } = await this.resolvePaths();
     const existing = this.conversations.get(conversation.conversationId);
     const fileName = existing?.fileName ?? this.resolveConversationFileName(conversation);
-    const filePath = resolve8(conversationsDir, fileName);
+    const filePath = resolve9(conversationsDir, fileName);
     this.writing = this.writing.then(async () => {
       await writeJsonAtomic2(filePath, conversation);
       this.conversations.set(conversation.conversationId, {
@@ -3601,7 +4121,7 @@ var FileConversationStore = class {
     if (removed) {
       this.writing = this.writing.then(async () => {
         if (existing) {
-          await rm(resolve8(conversationsDir, existing.fileName), { force: true });
+          await rm2(resolve9(conversationsDir, existing.fileName), { force: true });
         }
         await this.writeIndex();
       });
@@ -3631,7 +4151,7 @@ var FileStateStore = class {
       workingDir: this.workingDir,
       agentId: this.agentId
     });
-    this.filePath = resolve8(getAgentStoreDirectory(identity), LOCAL_STATE_FILE);
+    this.filePath = resolve9(getAgentStoreDirectory(identity), LOCAL_STATE_FILE);
   }
   isExpired(state) {
     return typeof this.ttlMs === "number" && Date.now() - state.updatedAt > this.ttlMs;
@@ -3643,7 +4163,7 @@ var FileStateStore = class {
     }
     this.loaded = true;
     try {
-      const raw = await readFile6(this.filePath, "utf8");
+      const raw = await readFile7(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       for (const state of parsed.states ?? []) {
         this.states.set(state.runId, state);
@@ -4319,9 +4839,13 @@ export {
   InMemoryStateStore,
   LatitudeCapture,
   LocalMcpBridge,
+  LocalUploadStore,
+  PONCHO_UPLOAD_SCHEME,
+  S3UploadStore,
   STORAGE_SCHEMA_VERSION,
   TelemetryEmitter,
   ToolDispatcher,
+  VercelBlobUploadStore,
   buildAgentDirectoryName,
   buildSkillContextWindow,
   createConversationStore,
@@ -4331,8 +4855,10 @@ export {
   createModelProvider,
   createSkillTools,
   createStateStore,
+  createUploadStore,
   createWriteTool,
   defineTool4 as defineTool,
+  deriveUploadKey,
   ensureAgentIdentity,
   generateAgentId,
   getAgentStoreDirectory,