@rallycry/conveyor-agent 11.0.25 → 11.0.27

package/dist/{chunk-RLROQPPT.js → chunk-7HK6OIV4.js}

@@ -74,6 +74,7 @@ import {
   hasTaskPlan,
   hasUncommittedChanges,
   hasUnpushedCommits,
+  isCapabilityServableMime,
   isCodexReasoningEffort,
   isPlaceholderLocator,
   locatorMatchesContent,
@@ -91,7 +92,7 @@ import {
   statWorkspacePath,
   updateRemoteToken,
   verifyGitCredential
-} from "./chunk-BZZ4B37Q.js";
+} from "./chunk-PBSFLQA7.js";
 import {
   registerBootMilestoneSocketFallback,
   reportBootMilestone
@@ -5312,7 +5313,16 @@ function wrapBridgeWithDirectStream(inner, reporter, options = {}) {
 
 // src/execution/query-executor.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import { existsSync, readFileSync as readFileSync3, renameSync as renameSync2, truncateSync } from "fs";
+import {
+  closeSync,
+  existsSync,
+  openSync,
+  readFileSync as readFileSync3,
+  readSync,
+  renameSync as renameSync2,
+  statSync as statSync2,
+  truncateSync
+} from "fs";
 
 // src/execution/chat-instructions.ts
 function buildChatInstructions(context, scenario, newMessages) {
@@ -5431,6 +5441,20 @@ function formatChatFile(file) {
   }
   return [`[Attached: ${file.fileName} (${file.mimeType}${sizeStr})]`];
 }
+function formatParentTaskFiles(parent) {
+  const lines = [
+    `
+## Files on the parent card ${parent.slug}`,
+    `These are attached to the parent card "${parent.title}", not to this one. Read one with get_attachment(fileId, task_id: "${parent.slug}"); list_task_files(task_id: "${parent.slug}") shows the current set.`
+  ];
+  for (const file of parent.files) {
+    const size = formatFileSize(file.fileSize);
+    lines.push(
+      `- **${file.fileName}** (${file.mimeType}${size ? `, ${size}` : ""}) fileId: ${file.fileId}`
+    );
+  }
+  return lines;
+}
 function formatTaskFile(file) {
   if (file.content && file.contentEncoding === "utf-8") {
     return [`
@@ -5783,7 +5807,7 @@ var PACK_RUNNER_FOOTER = [
   ``,
   `Your turn output appears ONLY in the live agent terminal \u2014 it is NOT posted to the task chat. The team does NOT see your replies unless you post them.`,
   `Use post_to_chat (omit task_id \u2192 this task's chat) to report which child you are on, status as you work the pack, and any blocker or escalation the team needs to act on.`,
-  `Pass task_id only to message a DIFFERENT task's chat (e.g. a child task).`,
+  `Pass task_id only to reach a DIFFERENT card: a child task's chat on post_to_chat and read_task_chat, or a child's files on list_task_files and get_attachment.`,
   `Use read_task_chat only if you need to re-read earlier messages beyond the chat context above.`,
   ``,
   `If a Conveyor tool call fails or reports the MCP server is unavailable/disconnected, this is almost always a transient socket reconnect \u2014 RETRY the same call; it will succeed once the connection re-establishes. A tool error is NOT a reason to go idle or stop the pack. (When a turn may end is the pack path's call \u2014 see its goal and finish line.)`,
@@ -6386,7 +6410,7 @@ ${context.agentInstructions}`);
 Your turn output appears ONLY in the live agent terminal \u2014 it is NOT posted to the task chat. The team does NOT see your replies unless you post them.`,
     `Use post_to_chat (omit task_id \u2192 your own task's chat) to share meaningful status as you work, a summary when you finish, and any blocker or question you need a human to answer.`,
     `A question you need answered goes through AskUserQuestion \u2014 that is what pages a person. post_to_chat with milestone: "blocked" records that you are parked and does not page anyone.`,
-    `Pass task_id only to message a DIFFERENT task's chat (e.g. a parent task via get_task).`,
+    `Pass task_id only to reach a DIFFERENT card: a child task's chat on post_to_chat and read_task_chat, or any card in this project's files on list_task_files and get_attachment (a pack parent's source documents, for example). Omit it for your own card.`,
     `Use read_task_chat only if you need to re-read earlier messages beyond the chat context above.`,
     `
 If a Conveyor tool call fails or reports the MCP server is unavailable/disconnected, this is almost always a transient socket reconnect \u2014 simply RETRY the same call and it will succeed once the connection re-establishes. Do NOT stop work, go idle, or treat a tool error as a reason to end your turn. Keep making progress on the code; only post_to_chat to ask for a human if a tool keeps failing across several retries over a sustained period.`,
@@ -6561,6 +6585,9 @@ ${truncatePlanForPrompt(context.plan)}`);
       parts.push(...formatTaskFile(file));
     }
   }
+  if (context.parentTaskFiles && context.parentTaskFiles.files.length > 0) {
+    parts.push(...formatParentTaskFiles(context.parentTaskFiles));
+  }
   if (context.repoRefs && context.repoRefs.length > 0) {
     parts.push(...formatRepoRefs(context.repoRefs));
   }
@@ -7454,11 +7481,18 @@ var subtasksContracts = [
   setTaskParentContract
 ];
 var mcpTaskIdOrSlug = f.string({ desc: "The task ID or slug" });
+var agentTaskIdOrSlug = f.optional(
+  f.string({
+    desc: "Omit for the current card; pass a parent, sibling, or any other card in this project (id or slug) to read its files instead."
+  })
+);
 var listTaskFilesContract = defineToolContract({
   name: "list_task_files",
   agent: {
-    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
-    fields: {}
+    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment. Pass task_id to list another card's files in this project, for example the pack parent's source documents.",
+    fields: {
+      task_id: agentTaskIdOrSlug
+    }
   },
   mcp: {
     description: "List all files attached to a task with metadata (no contents \u2014 fast and small). Pass projectId to target a specific project; otherwise the configured default project is used. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
@@ -7471,13 +7505,14 @@ var listTaskFilesContract = defineToolContract({
 var getAttachmentContract = defineToolContract({
   name: "get_attachment",
   agent: {
-    description: "Fetch one task file's content plus metadata by file ID. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit.",
+    description: "Fetch one task file's content plus metadata by file ID. This is the way to read attachment bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 without a signed-in project member's session, so do not curl or WebFetch it from the pod. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit. Pass task_id when the file is attached to another card in this project, such as the pack parent.",
     fields: {
-      fileId: f.string({ desc: "The file ID to retrieve" })
+      fileId: f.string({ desc: "The file ID to retrieve" }),
+      task_id: agentTaskIdOrSlug
     }
   },
   mcp: {
-    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more, or fetch `downloadUrl` for the whole file. Call list_task_files first to discover IDs and sizes.",
+    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more. This tool is the way to read bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 unless the request carries a signed-in project member's session, so do not curl or fetch it. Call list_task_files first to discover IDs and sizes.",
     fields: {
       projectId: mcpProjectId,
       taskId: mcpTaskIdOrSlug,
@@ -7544,10 +7579,29 @@ var uploadAttachmentContract = defineToolContract({
     }
   }
 });
+var DELETE_ATTACHMENT_WARNING = "Permanent, with no trash and no undo (unlike drive_delete_file): the file and its bytes are gone, and the chat message that announced it keeps its text but loses the attachment. Use it to remove a superseded upload once its replacement is attached. `fileId` comes from list_task_files.";
+var deleteAttachmentContract = defineToolContract({
+  name: "delete_attachment",
+  agent: {
+    description: `Delete one attachment from this task. ${DELETE_ATTACHMENT_WARNING} A pod can only delete files on its own card.`,
+    fields: {
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  },
+  mcp: {
+    description: `Delete one attachment from a task (accepts task id or slug). ${DELETE_ATTACHMENT_WARNING} Requires Moderate on the project, the same bar as the web Files delete button. Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      taskId: mcpTaskIdOrSlug,
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  }
+});
 var attachmentsContracts = [
   listTaskFilesContract,
   getAttachmentContract,
-  uploadAttachmentContract
+  uploadAttachmentContract,
+  deleteAttachmentContract
 ];
 var createSuggestionContract = defineToolContract({
   name: "create_suggestion",
@@ -7870,7 +7924,7 @@ var createPullRequestContract = defineToolContract({
     fields: {
       title: f.string({ desc: "The PR title" }),
       body: f.string({
-        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
+        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Only image and video URLs belong in a PR body: a document downloadUrl (csv, pdf, md, \u2026) needs a signed-in project member and shows 404 to a reviewer on GitHub, so point at the card instead. Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
       }),
       branch: f.optional(
         f.string({
@@ -8727,17 +8781,20 @@ function buildGetExecutionLogsTool(connection) {
 function buildListTaskFilesTool(connection) {
   return defineContractTool(
     listTaskFilesContract,
-    async () => {
+    async ({ task_id }) => {
       try {
         const files = await connection.call("getTaskFiles", {
-          sessionId: connection.sessionId
+          sessionId: connection.sessionId,
+          ...task_id ? { taskId: task_id } : {}
         });
         const metadata = files.map((file) => {
           const { content: _c, ...rest } = file;
           return rest;
         });
+        const heading = task_id ? `Files on card ${task_id}:
+` : "";
         const content = [
-          { type: "text", text: JSON.stringify(metadata, null, 2) }
+          { type: "text", text: heading + JSON.stringify(metadata, null, 2) }
         ];
         for (const file of files) {
           if (file.content && file.contentEncoding === "base64" && isImageMimeType(file.mimeType)) {
@@ -8755,11 +8812,12 @@ function buildListTaskFilesTool(connection) {
 function buildGetAttachmentTool(connection) {
   return defineContractTool(
     getAttachmentContract,
-    async ({ fileId }) => {
+    async ({ fileId, task_id }) => {
       try {
         const file = await connection.call("getTaskFile", {
           sessionId: connection.sessionId,
-          fileId
+          fileId,
+          ...task_id ? { taskId: task_id } : {}
         });
         const { content: rawContent, ...metadata } = file;
         const content = [
@@ -9346,6 +9404,9 @@ var MIME_BY_EXT = {
   ".yaml": "application/yaml",
   ".yml": "application/yaml",
   ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
   ".zip": "application/zip",
   ".gz": "application/gzip",
   ".mp4": "video/mp4",
@@ -9368,11 +9429,21 @@ var EMBEDDABLE_IN_MARKDOWN = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", "
 function describeEmbed(fileName, downloadUrl) {
   if (!downloadUrl) return "";
   const isImage = EMBEDDABLE_IN_MARKDOWN.has(extname(fileName).toLowerCase());
-  const snippet = isImage ? `![${fileName}](${downloadUrl})` : `[${fileName}](${downloadUrl})`;
-  return `
+  if (isImage) {
+    return `
 
 Paste this into the PR description to show it inline:
-${snippet}`;
+![${fileName}](${downloadUrl})`;
+  }
+  if (isCapabilityServableMime(inferMimeType(fileName))) {
+    return `
+
+Paste this into the PR description to link it:
+[${fileName}](${downloadUrl})`;
+  }
+  return `
+
+downloadUrl (signed-in project members only; agents read it with get_attachment): ${downloadUrl}`;
 }
 function buildUploadAttachmentTool(connection, config) {
   return defineContractTool(uploadAttachmentContract, async ({ path, title, comment, tags }) => {
@@ -9425,6 +9496,23 @@ function buildUploadAttachmentTool(connection, config) {
     }
   });
 }
+function buildDeleteAttachmentTool(connection) {
+  return defineContractTool(deleteAttachmentContract, async ({ fileId }) => {
+    try {
+      const result = await connection.call("deleteTaskFile", {
+        sessionId: connection.sessionId,
+        fileId
+      });
+      return textResult(
+        `Deleted ${result.fileName} (${result.id}) permanently. Any chat message that announced it keeps its text without the attachment.`
+      );
+    } catch (error) {
+      return textResult(
+        `Failed to delete attachment: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  });
+}
 
 // src/tools/checklist-tools.ts
 function buildListManualTestsTool(connection) {
@@ -9621,7 +9709,8 @@ function buildCommonTools(connection, config) {
     buildApproveManualTestTool(connection),
     buildRejectManualTestTool(connection),
     ...buildMutationTools(connection, config),
-    buildUploadAttachmentTool(connection, config)
+    buildUploadAttachmentTool(connection, config),
+    buildDeleteAttachmentTool(connection)
   ];
 }
 
@@ -12325,7 +12414,15 @@ function hasExistingSessionFile(taskId, cwd, lineage) {
   if (process.env.CONVEYOR_TUI === "codex") {
     return !!readCodexLineage(taskIdToSessionUuid(key), cwd);
   }
-  return sessionFileExists(taskIdToSessionUuid(key), cwd);
+  const uuid = taskIdToSessionUuid(key);
+  return sessionFileExists(uuid, cwd) && isResumableTranscript(sessionTranscriptPath(cwd, uuid));
+}
+var spawnedTranscripts = /* @__PURE__ */ new Set();
+function markSpawnedTranscript(cwd, sessionUuid) {
+  spawnedTranscripts.add(sessionTranscriptPath(cwd, sessionUuid));
+}
+function isResumableTranscript(path) {
+  return spawnedTranscripts.has(path) || transcriptHasConversation(path);
 }
 function resolveSessionStart(lineageKey, cwd, tui = process.env.CONVEYOR_TUI) {
   const sessionUuid = taskIdToSessionUuid(lineageKey);
@@ -12334,11 +12431,46 @@ function resolveSessionStart(lineageKey, cwd, tui = process.env.CONVEYOR_TUI) {
     return { sessionId: sessionUuid, ...resume ? { resume } : {} };
   }
   if (sessionFileExists(sessionUuid, cwd)) {
-    repairTornSessionFile(sessionTranscriptPath(cwd, sessionUuid));
-    return { resume: sessionUuid };
+    const path = sessionTranscriptPath(cwd, sessionUuid);
+    repairTornSessionFile(path);
+    if (isResumableTranscript(path)) return { resume: sessionUuid };
+    rotateSessionFile(cwd, sessionUuid);
+    logger5.warn("Rotated a transcript with no conversation aside before resume", { path });
   }
+  markSpawnedTranscript(cwd, sessionUuid);
   return { sessionId: sessionUuid };
 }
+var CONVERSATION_PROBE_BYTES = 256 * 1024;
+function transcriptHasConversation(path) {
+  let fd;
+  try {
+    const size = statSync2(path).size;
+    const length = Math.min(size, CONVERSATION_PROBE_BYTES);
+    const buffer = Buffer.alloc(length);
+    fd = openSync(path, "r");
+    const read = readSync(fd, buffer, 0, length, 0);
+    const text = buffer.subarray(0, read).toString("utf8");
+    const complete = text.slice(0, text.lastIndexOf("\n") + 1);
+    for (const line of complete.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const type = JSON.parse(line).type;
+        if (type === "user" || type === "assistant") return true;
+      } catch {
+      }
+    }
+    return size > CONVERSATION_PROBE_BYTES;
+  } catch {
+    return true;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
 function repairTornSessionFile(path) {
   try {
     if (!existsSync(path)) return false;
@@ -12867,6 +12999,7 @@ function freshSessionOptions(host, context, options) {
     sessionLineageKey(context.taskId, host.agentMode, host.config.mode)
   );
   if (rotateSessionFile(host.config.workspaceDir, lineageUuid)) {
+    markSpawnedTranscript(host.config.workspaceDir, lineageUuid);
     return { ...options, sessionId: lineageUuid };
   }
   return { ...options, sessionId: randomUUID2() };
@@ -12918,6 +13051,11 @@ async function handleAuthError(context, host, options) {
 async function handleStaleSession(context, host, options) {
   context.claudeSessionId = null;
   host.connection.storeSessionId("");
+  logger5.warn("Resume target had no resumable conversation; rotating it aside and starting fresh", {
+    taskId: context.taskId,
+    runnerMode: host.config.mode,
+    agentMode: host.agentMode
+  });
   const freshPrompt = buildMultimodalPrompt(
     await buildInitialPrompt(host.config.mode, context, host.isAuto, host.agentMode),
     context,
@@ -13025,7 +13163,7 @@ async function handleUsageCapRejection(context, host, options, rateLimitType, re
   return runWithRetry(freshQuery, context, host, options);
 }
 function handleRetryError(error, context, host, options, prevImageError) {
-  if (isStaleOrExitedSession(error, context) && context.claudeSessionId) {
+  if (isStaleOrExitedSession(error, context)) {
     return handleStaleSession(context, host, options);
   }
   if (isAuthError(getErrorMessage(error))) {
@@ -13051,7 +13189,7 @@ function handleProcessResult(result, context, host, options) {
       )
     };
   }
-  if (result.staleSession && context.claudeSessionId) {
+  if (result.staleSession) {
     return {
       action: "return_promise",
       promise: handleStaleSession(context, host, options)
@@ -15234,6 +15372,7 @@ var SessionRunner = class _SessionRunner {
       claudeSessionId: ctx.claudeSessionId ?? null,
       lastSeenMessageId: ctx.lastSeenMessageId ?? null,
       isParentTask: ctx.isParentTask ?? false,
+      parentTaskFiles: ctx.parentTaskFiles ?? null,
       storyPoints: ctx.storyPoints ?? void 0,
       agents: ctx.agents ?? void 0,
       projectTags: ctx.projectTags ?? void 0,

package/dist/{chunk-BZZ4B37Q.js → chunk-PBSFLQA7.js}

@@ -1785,8 +1785,41 @@ var IDENTIFIED_WORK_STATUSES = ["Open", ...ACTIVE_WORK_STATUSES];
 var DEFAULT_TASK_STATUS_COLOR = "#a8a29e";
 var DEFAULT_TASK_STATUS_COLOR_INT = Number.parseInt(DEFAULT_TASK_STATUS_COLOR.slice(1), 16);
 var MAX_FILE_SIZE_BYTES = 25 * 1024 * 1024;
+function isCapabilityServableMime(mimeType) {
+  const base = mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
+  return base.startsWith("image/") || base.startsWith("video/");
+}
 var MAX_FILE_TAGS = 5;
 var MAX_FILE_TAG_LENGTH = 100;
+var ALLOWED_FILE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "application/json",
+  "text/csv",
+  "text/plain",
+  "text/markdown",
+  "text/vnd.mermaid",
+  "application/pdf",
+  // Reports (conveyor-consensus and friends) are single-file, no-JS HTML. Safe
+  // to store because the DOWNLOAD route serves these under a sandbox CSP with
+  // an opaque origin — see SANDBOXED_MIME in services/file/routes.ts.
+  "text/html",
+  // Office documents: the OOXML trio only (legacy .doc/.xls/.ppt stay out).
+  // Served inline like PDFs; browsers download them and nothing renders
+  // in-origin, so they need no SANDBOXED_MIME entry.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+];
+var ALLOWED_FILE_ACCEPT = [
+  ...ALLOWED_FILE_MIME_TYPES,
+  // Extensions too: a mime-only `accept` filters the OS picker by its own mime
+  // registry, which greys out .md/.mmd (and Office files on a machine without
+  // Office) even though the upload would succeed.
+  ".png,.jpg,.jpeg,.gif,.webp,.json,.csv,.txt,.md,.mmd,.pdf,.html,.docx,.xlsx,.pptx"
+].join(",");
 var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
 var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
 var IDLE_HEARTBEAT_MS = 90 * 1e3;
@@ -1992,9 +2025,15 @@ var GetChatMessagesRequestSchema = z3.object({
   taskId: z3.string().optional()
 });
 var GetTaskFilesRequestSchema = z3.object({
-  sessionId: z3.string()
+  sessionId: z3.string(),
+  taskId: z3.string().optional()
 });
 var GetTaskFileRequestSchema = z3.object({
+  sessionId: z3.string(),
+  fileId: z3.string(),
+  taskId: z3.string().optional()
+});
+var DeleteTaskFileRequestSchema = z3.object({
   sessionId: z3.string(),
   fileId: z3.string()
 });
@@ -2924,6 +2963,12 @@ var GetProjectAttachmentRequestSchema = z5.object({
   /** Max bytes of text content to return from `offset`. Server default applies. */
   maxBytes: z5.number().int().positive().optional()
 });
+var DeleteProjectTaskFileRequestSchema = z5.object({
+  projectId: z5.string(),
+  taskId: z5.string(),
+  fileId: z5.string(),
+  requestingUserId: z5.string().optional()
+});
 var RequestProjectFileUploadRequestSchema = z5.object({
   projectId: z5.string(),
   taskId: z5.string(),
@@ -5061,6 +5106,7 @@ export {
   EXTERNAL_AGENT_MESSAGE_SOURCE,
   TUI_KINDS,
   MAX_FILE_SIZE_BYTES,
+  isCapabilityServableMime,
   RUNNER_MODES,
   ReviewGuideContentSchema,
   CONTEXT_LINK_LOCATOR_MAX,

package/dist/{chunk-7WO6NTOS.js → chunk-SI7WNWZZ.js}

@@ -8,7 +8,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-BZZ4B37Q.js";
+} from "./chunk-PBSFLQA7.js";
 import {
   reportBootMilestone
 } from "./chunk-Q4FQOJ7D.js";

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   WorkspaceCommandSupervisor,
   startWorkspaceCommandsAfterConnect,
   stopWorkspaceCommands
-} from "./chunk-7WO6NTOS.js";
+} from "./chunk-SI7WNWZZ.js";
 import {
   PtyHarness,
   SessionRunner,
@@ -25,7 +25,7 @@ import {
   runUsageProbe,
   sampleKeyUsage,
   usesNativeUsageReporting
-} from "./chunk-RLROQPPT.js";
+} from "./chunk-7HK6OIV4.js";
 import "./chunk-37J5MMQT.js";
 import {
   inheritedEnv,
@@ -44,7 +44,7 @@ import {
   createServiceLogger,
   fetchBootstrap,
   loadConveyorConfig
-} from "./chunk-BZZ4B37Q.js";
+} from "./chunk-PBSFLQA7.js";
 import "./chunk-Q4FQOJ7D.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-372R6E4C.js";
@@ -1458,7 +1458,7 @@ if (!RUNNER_MODES.includes(CONVEYOR_MODE)) {
   process.exit(1);
 }
 if (CONVEYOR_MODE === "serving") {
-  const { runServingSession } = await import("./serve-boot-T7MNWASE.js");
+  const { runServingSession } = await import("./serve-boot-WGUFEWYJ.js");
   exitContext.runnerMode = "serving";
   exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? exitContext.sessionId;
   const outcome = await runServingSession({

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   SessionRunner,
   unshallowRepo
-} from "./chunk-RLROQPPT.js";
+} from "./chunk-7HK6OIV4.js";
 import "./chunk-37J5MMQT.js";
 import "./chunk-WCJ6HRVU.js";
 import {
@@ -17,7 +17,7 @@ import {
   stageAndCommit,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-BZZ4B37Q.js";
+} from "./chunk-PBSFLQA7.js";
 import "./chunk-Q4FQOJ7D.js";
 import {
   runAuthTokenCommand,

package/dist/{serve-boot-T7MNWASE.js → serve-boot-WGUFEWYJ.js}

@@ -1,6 +1,6 @@
 import {
   WorkspaceCommandSupervisor
-} from "./chunk-7WO6NTOS.js";
+} from "./chunk-SI7WNWZZ.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -11,7 +11,7 @@ import {
   createServiceLogger,
   ensureOnTaskBranch,
   loadConveyorConfig
-} from "./chunk-BZZ4B37Q.js";
+} from "./chunk-PBSFLQA7.js";
 import "./chunk-Q4FQOJ7D.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-IA45XHOA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "11.0.25",
+  "version": "11.0.27",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",

package/skills/conveyor-build/SKILL.md

@@ -111,7 +111,11 @@ task binding and no user account.
 1. Resolve the card from the argument — slug, id, or URL. **None given → ask
    which card.** Never infer one from the branch you happen to be on.
 2. `mcp__conveyor__get_task` for the full plan and
-   `mcp__conveyor__read_task_chat` for addenda and user answers. Consult
+   `mcp__conveyor__read_task_chat` for addenda and user answers. On a pack
+   child the source documents usually sit on the parent card:
+   `mcp__conveyor__list_task_files` with `task_id` set to the parent (in a pod;
+   the local surface spells it `taskId`) lists them, and
+   `mcp__conveyor__get_attachment` with the same `task_id` reads one. Consult
    `mcp__conveyor__get_tag` on the card's tags before diving in — a tag's
    overview and linked files are the fast path into the subsystem.
 3. Route on the card's shape:
@@ -249,7 +253,10 @@ Instead: post the answer, config, or findings with
 `mcp__conveyor__upload_attachment` (any file type, up to 25MB), and complete
 the card directly with `force_update_task_status("Complete")` — there is no PR
 or review step for a no-code task. Never publish a deliverable as an off-card
-link; the card is where it belongs.
+link; the card is where it belongs. When a revision supersedes an earlier
+upload, remove the old copy with `mcp__conveyor__delete_attachment` (permanent,
+`fileId` from `list_task_files`) so the Files list shows one current version
+of each deliverable.
 
 When unsure, check the diff: a real diff means open a PR, no diff means finish
 in chat and mark it Complete.

package/skills/conveyor-plan/SKILL.md

@@ -100,6 +100,10 @@ Scale to the idea's size; a one-file tweak needs minutes, not a survey.
   already in your context. **Stop when you can cite a specific `file.ts:line`
   and a symbol name for every step your plan will contain** — that is the
   threshold, and more reading past it buys nothing.
+- **Attachments**: `mcp__conveyor__list_task_files` on the card, and on its
+  parent when the card is a pack child (in a pod pass `task_id`; the local
+  surface takes `taskId`). Source documents, screenshots and worksheets usually
+  live there, and a plan written without reading them plans the wrong work.
 - **Prior art**: `mcp__conveyor__search_tasks` on 2-3 keyword variants
   (`typeFilters` to include incidents/suggestions when relevant), then
   `mcp__conveyor__get_task` on the closest hits. You're looking for duplicates

package/skills/conveyor-triage/SKILL.md

@@ -80,7 +80,9 @@ Find the code path the report implicates and, where you can, reproduce it. A
 diagnosis grounded only in reading is a hypothesis; a reproduction makes it a
 finding. Attach evidence to the card with `mcp__conveyor__upload_attachment` —
 a screenshot, a log excerpt, a short recording — so the Builder inherits proof
-rather than your assertion.
+rather than your assertion. A re-captured version replaces the old one:
+`mcp__conveyor__delete_attachment` (permanent, `fileId` from
+`list_task_files`) keeps the card's Files list to what is current.
 
 ## 5. Decide