@saadnvd1/agent-os 0.3.671 → 0.3.673

package/app/api/files/upload-temp/route.test.ts

@@ -0,0 +1,144 @@
+import fs from "fs";
+import path from "path";
+import { afterEach, describe, expect, it } from "vitest";
+import { ATTACHMENT_LIMITS } from "@/lib/attachments/policy";
+import { attachmentsRoot } from "@/lib/attachments/store";
+import { POST } from "./route";
+
+const PDF = Buffer.from("%PDF-1.4\n1 0 obj\n<<>>\nendobj\n");
+const ZIPPED = Buffer.concat([
+  Buffer.from([0x50, 0x4b, 0x03, 0x04]),
+  Buffer.alloc(32, 7),
+]);
+const PNG = Buffer.concat([
+  Buffer.from([0x89, 0x50, 0x4e, 0x47]),
+  Buffer.alloc(32, 1),
+]);
+
+const SESSION = "test-upload-session";
+
+const upload = (
+  filename: string,
+  data: Buffer | string,
+  extra: Record<string, unknown> = {}
+) =>
+  POST(
+    new Request("http://localhost/api/files/upload-temp", {
+      method: "POST",
+      body: JSON.stringify({
+        filename,
+        base64: Buffer.from(data).toString("base64"),
+        ...extra,
+      }),
+    })
+  );
+
+afterEach(() => {
+  fs.rmSync(path.join(attachmentsRoot(), SESSION), {
+    recursive: true,
+    force: true,
+  });
+});
+
+describe("POST /api/files/upload-temp", () => {
+  it.each([
+    ["report.pdf", PDF, "pdf"],
+    ["sheet.xlsx", ZIPPED, "sheet"],
+    ["letter.docx", ZIPPED, "doc"],
+    ["data.csv", "a,b\n1,2\n", "sheet"],
+    ["notes.md", "# hi\n", "text"],
+    ["app.ts", "export const a = 1;\n", "text"],
+    ["shot.png", PNG, "image"],
+  ])("takes %s", async (name, data, kind) => {
+    const res = await upload(name, data, { sessionId: SESSION });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.kind).toBe(kind);
+    expect(body.path).toBe(path.join(attachmentsRoot(), SESSION, name));
+    expect(fs.readFileSync(body.path)).toEqual(Buffer.from(data));
+  });
+
+  it("keeps the old shape: no session means temp storage and a path", async () => {
+    const res = await upload("old.csv", "a,b\n");
+    const body = await res.json();
+    expect(res.status).toBe(200);
+    expect(body.path).toContain("agent-os-screenshots");
+    expect(body.path).not.toContain(attachmentsRoot());
+    fs.rmSync(body.path);
+  });
+
+  it("refuses types it doesn't take, saying which", async () => {
+    for (const name of ["a.zip", "run.sh", "tool.exe", "noext"]) {
+      const res = await upload(name, "x", { sessionId: SESSION });
+      expect(res.status).toBe(415);
+      expect((await res.json()).error).toContain(`${name}: this file type`);
+    }
+    expect(fs.existsSync(path.join(attachmentsRoot(), SESSION))).toBe(false);
+  });
+
+  it("refuses a file that isn't what its name says", async () => {
+    for (const [name, data] of [
+      ["fake.xlsx", "plain text"],
+      ["fake.pdf", "plain text"],
+      ["fake.xls", ZIPPED],
+      ["fake.csv", Buffer.from([0, 1, 2, 0])],
+      ["fake.png", PDF],
+    ] as const) {
+      const res = await upload(name, data, { sessionId: SESSION });
+      expect(res.status, name).toBe(400);
+      expect((await res.json()).error).toContain("doesn't look like a real");
+    }
+  });
+
+  it("refuses an empty file and a missing body", async () => {
+    expect((await upload("a.txt", "", { sessionId: SESSION })).status).toBe(
+      400
+    );
+    const none = await POST(
+      new Request("http://localhost/x", {
+        method: "POST",
+        body: JSON.stringify({ filename: "a.txt" }),
+      })
+    );
+    expect(none.status).toBe(400);
+  });
+
+  it("refuses a file over the limit, and says what the limit is", async () => {
+    const big = Buffer.alloc(ATTACHMENT_LIMITS.maxBytes + 1, 97);
+    const res = await upload("big.txt", big, { sessionId: SESSION });
+    expect(res.status).toBe(413);
+    expect((await res.json()).error).toContain("the limit is 25.0 MB");
+  });
+
+  it("refuses an image over the image limit", async () => {
+    const big = Buffer.concat([
+      PNG,
+      Buffer.alloc(ATTACHMENT_LIMITS.maxImageBytes),
+    ]);
+    expect((await upload("big.png", big)).status).toBe(413);
+  });
+
+  it("refuses a body over the limit before reading it", async () => {
+    const res = await POST(
+      new Request("http://localhost/x", {
+        method: "POST",
+        headers: { "content-length": String(ATTACHMENT_LIMITS.maxBytes * 2) },
+        body: "{}",
+      })
+    );
+    expect(res.status).toBe(413);
+  });
+
+  it("keeps a hostile name inside the session's folder", async () => {
+    const res = await upload("../../escape.pdf", PDF, { sessionId: SESSION });
+    const { path: saved } = await res.json();
+    expect(path.dirname(saved)).toBe(path.join(attachmentsRoot(), SESSION));
+  });
+
+  it("never overwrites: a second file with the same name gets its own", async () => {
+    const a = await (await upload("x.csv", "1", { sessionId: SESSION })).json();
+    const b = await (await upload("x.csv", "2", { sessionId: SESSION })).json();
+    expect(a.path).not.toBe(b.path);
+    expect(fs.readFileSync(a.path, "utf8")).toBe("1");
+  });
+});

package/app/api/files/upload-temp/route.ts

@@ -2,38 +2,69 @@ import { NextResponse } from "next/server";
 import { mkdir, writeFile } from "fs/promises";
 import path from "path";
 import os from "os";
+import { checkUpload } from "@/lib/attachments/check";
+import { ATTACHMENT_LIMITS, tooBigMessage } from "@/lib/attachments/policy";
+import { saveAttachment } from "@/lib/attachments/store";
+import { peerChatLink } from "@/lib/chat/peer-relay";
 
+// Base64 is a third bigger than the bytes, and the JSON around it is small.
+const MAX_BODY = Math.ceil((ATTACHMENT_LIMITS.maxBytes * 4) / 3) + 64 * 1024;
+
+const fail = (error: string, status: number) =>
+  NextResponse.json({ error }, { status });
+
+// POST /api/files/upload-temp { filename, base64, mimeType?, sessionId? }
+// Without a sessionId the file goes to the shared temp folder (the terminal's
+// drop, the file picker). With one - a session's id, or "draft" for a chat
+// not started yet - it is checked against lib/attachments/policy and kept in
+// that session's attachments folder, outside any repo.
 export async function POST(request: Request) {
   try {
-    const { filename, base64, mimeType } = await request.json();
+    const length = Number(request.headers.get("content-length"));
+    if (length > MAX_BODY)
+      return fail(
+        tooBigMessage("That file", length, ATTACHMENT_LIMITS.maxBytes),
+        413
+      );
+    const { filename, base64, sessionId } = await request.json();
+
+    if (typeof base64 !== "string" || !base64) return fail("No file data", 400);
+    const name =
+      typeof filename === "string" && filename ? filename : "attachment";
+    const buffer = Buffer.from(base64, "base64");
+    const checked = checkUpload(name, buffer);
+    if (!checked.ok) return fail(checked.error, checked.status);
 
-    if (!base64) {
-      return NextResponse.json({ error: "No image data" }, { status: 400 });
+    if (typeof sessionId === "string" && sessionId) {
+      if (sessionId !== "draft" && peerChatLink(sessionId))
+        return fail(
+          "Files can't be attached to a session running on another machine yet. Images still work.",
+          409
+        );
+      const file = saveAttachment(
+        sessionId,
+        name,
+        buffer,
+        checked.type.mediaType
+      );
+      return NextResponse.json({ ...file, kind: checked.type.kind });
     }
 
-    // Create temp directory for screenshots if it doesn't exist
     const tempDir = path.join(os.tmpdir(), "agent-os-screenshots");
     await mkdir(tempDir, { recursive: true });
-
-    // Generate unique filename
-    const ext = mimeType?.split("/")[1] || "png";
-    const safeName = filename?.replace(/[^a-zA-Z0-9.-]/g, "_") || "screenshot";
-    const uniqueName = `${Date.now()}-${safeName}`;
-    const finalName = uniqueName.endsWith(`.${ext}`)
-      ? uniqueName
-      : `${uniqueName}.${ext}`;
-    const filePath = path.join(tempDir, finalName);
-
-    // Decode base64 and write file
-    const buffer = Buffer.from(base64, "base64");
+    const safeName = name.replace(/[^a-zA-Z0-9.-]/g, "_");
+    const filePath = path.join(tempDir, `${Date.now()}-${safeName}`);
     await writeFile(filePath, buffer);
 
-    return NextResponse.json({ path: filePath });
+    return NextResponse.json({
+      path: filePath,
+      name: safeName,
+      size: buffer.length,
+      mediaType: checked.type.mediaType,
+      kind: checked.type.kind,
+    });
   } catch (error) {
     console.error("Upload error:", error);
-    return NextResponse.json(
-      { error: "Failed to save image" },
-      { status: 500 }
-    );
+    return fail("Failed to save the file", 500);
   }
 }

package/app/api/projects/[id]/route.ts

@@ -1,5 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
 import { setProjectWorkspace } from "@/lib/workspaces";
+import { PROJECT_TIERS, setProjectTier } from "@/lib/project-tier";
 import {
   getProjectWithDevServers,
   updateProject,
@@ -7,6 +9,8 @@ import {
   toggleProjectExpanded,
 } from "@/lib/projects";
 
+const tierSchema = z.enum(PROJECT_TIERS);
+
 interface RouteParams {
   params: Promise<{ id: string }>;
 }
@@ -46,6 +50,17 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
       workspaceId,
     } = body;
 
+    let tier: z.infer<typeof tierSchema> | undefined;
+    if (body.tier !== undefined) {
+      const parsed = tierSchema.safeParse(body.tier);
+      if (!parsed.success)
+        return NextResponse.json(
+          { error: "tier must be production or fast" },
+          { status: 400 }
+        );
+      tier = parsed.data;
+    }
+
     // Handle expanded toggle separately
     if (typeof expanded === "boolean") {
       toggleProjectExpanded(id, expanded);
@@ -56,6 +71,17 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
       setProjectWorkspace(id, workspaceId);
     }
 
+    if (tier) {
+      try {
+        setProjectTier(id, tier);
+      } catch {
+        return NextResponse.json(
+          { error: "Project not found or cannot be modified" },
+          { status: 404 }
+        );
+      }
+    }
+
     // Update other fields if provided
     if (
       name ||

package/app/api/sessions/[id]/route.ts

@@ -1,3 +1,4 @@
+import { removeSessionAttachments } from "@/lib/attachments/store";
 import { NextRequest, NextResponse } from "next/server";
 import { deletionRefusal } from "@/lib/orchestrator/home";
 import { getDb, queries, type Session } from "@/lib/db";
@@ -281,6 +282,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
     );
     deleteItems(id);
     clearQueue(id);
+    void removeSessionAttachments(id).catch(() => {});
     queries.deleteSession(db).run(id);
 
     // Clean up worktree in background (non-blocking)

package/app/api/sessions/route.ts

@@ -50,8 +50,12 @@ export async function POST(request: NextRequest) {
   }
   const str = (v: unknown) => (typeof v === "string" ? v : null);
   const firstMessage = (b: Record<string, unknown>) => {
-    const { text, images } = clientSend({ text: b.prompt, images: b.images });
-    return { prompt: text, images };
+    const { text, images, files } = clientSend({
+      text: b.prompt,
+      images: b.images,
+      files: b.files,
+    });
+    return { prompt: text, images, files };
   };
   try {
     const { session, initialPrompt, repeat } = await launchSession({

package/components/Chat/ChatPanel.tsx

@@ -694,6 +694,7 @@ export function ChatPanel({
                           kind: "user",
                           text: p.text,
                           images: p.images,
+                          files: p.files,
                           createdAt: p.at,
                         }}
                         pending={{
@@ -820,6 +821,7 @@ export function ChatPanel({
         <LearningCardsHost sessionId={sessionId} />
         <Composer
           draftKey={sessionId}
+          attachScope={sessionId}
           suggestion={shownSuggestion}
           onDismissSuggestion={dismissSuggestion}
           history={history}
@@ -828,7 +830,7 @@ export function ChatPanel({
           running={running}
           disabled={!connected}
           placeholder={connected ? `Message ${sessionName}` : "Reconnecting…"}
-          onSend={(text, images) => {
+          onSend={(text, images, files) => {
             if (freshStart && isFreshCommand(text)) {
               startFresh.mutate(sessionId);
               return;
@@ -840,7 +842,12 @@ export function ChatPanel({
               asIs,
             });
             setAsIs(false);
-            send(text, images.length ? images : undefined, compact);
+            send(
+              text,
+              images.length ? images : undefined,
+              compact,
+              files.length ? files : undefined
+            );
             if (replyTo) {
               resolveQuestion.mutate(replyTo.id);
               setReplyTo(null);

package/components/Chat/FileChip.tsx

@@ -0,0 +1,67 @@
+import {
+  FileCode,
+  FileSpreadsheet,
+  FileText,
+  Loader2,
+  X,
+  type LucideIcon,
+} from "lucide-react";
+import {
+  formatBytes,
+  typeFor,
+  type AttachmentKind,
+} from "@/lib/attachments/policy";
+import { cn } from "@/lib/utils";
+
+const ICONS: Record<AttachmentKind, LucideIcon> = {
+  image: FileText,
+  pdf: FileText,
+  sheet: FileSpreadsheet,
+  doc: FileText,
+  text: FileCode,
+};
+
+// A file attached to a message: in the composer (with a way to remove it,
+// and a spinner while it uploads) and in the sent message.
+export function FileChip({
+  file,
+  uploading,
+  onRemove,
+}: {
+  file: { name: string; size: number };
+  uploading?: boolean;
+  onRemove?: () => void;
+}) {
+  const Icon = ICONS[typeFor(file.name)?.kind ?? "text"];
+  return (
+    <div
+      className={cn(
+        "bg-foreground/[0.05] flex h-14 max-w-56 min-w-0 items-center gap-2 rounded-lg pl-3",
+        onRemove ? "pr-1" : "pr-3"
+      )}
+      title={file.name}
+    >
+      {uploading ? (
+        <Loader2 className="text-muted-foreground h-4 w-4 shrink-0 animate-spin" />
+      ) : (
+        <Icon className="text-muted-foreground h-4 w-4 shrink-0" />
+      )}
+      <span className="min-w-0">
+        <span className="block truncate text-sm">{file.name}</span>
+        <span className="text-muted-foreground block text-xs">
+          {uploading ? "Uploading…" : formatBytes(file.size)}
+        </span>
+      </span>
+      {onRemove && (
+        <button
+          type="button"
+          aria-label={`Remove ${file.name}`}
+          onClick={onRemove}
+          className="text-muted-foreground hover:text-foreground flex h-11 w-11 shrink-0 items-center justify-center"
+        >
+          <X className="h-4 w-4" />
+        </button>
+      )}
+    </div>
+  );
+}

package/components/Chat/Messages.tsx

@@ -18,6 +18,7 @@ import { splitProse, splitUserText } from "@/lib/chat/user-text";
 import { inAppSessionId } from "@/lib/session-url";
 import { CodeBlock } from "./Code";
 import { CopyButton } from "./CopyButton";
+import { FileChip } from "./FileChip";
 import { ImageThumb } from "./ImageThumb";
 import { Markdown } from "./Markdown";
 import { openSessionLink } from "./session-link";
@@ -178,6 +179,13 @@ export function UserMessage({
           ))}
         </div>
       ) : null}
+      {item.files?.length ? (
+        <div data-copy-skip className="flex flex-wrap justify-end gap-1.5">
+          {item.files.map((f) => (
+            <FileChip key={f.path} file={f} />
+          ))}
+        </div>
+      ) : null}
       {item.text && (
         <div
           className={cn(

package/components/Chat/Queue.tsx

@@ -90,6 +90,12 @@ export function Queue({
                     · {m.imageCount} image{m.imageCount > 1 ? "s" : ""}
                   </span>
                 ) : null}
+                {m.fileCount ? (
+                  <span className="text-muted-foreground text-xs">
+                    {" "}
+                    · {m.fileCount} file{m.fileCount > 1 ? "s" : ""}
+                  </span>
+                ) : null}
               </button>
             )}
             <div className="flex shrink-0 items-center">

package/components/Chat/composer/Attachments.tsx

@@ -2,6 +2,8 @@
 
 import { FileText, X } from "lucide-react";
 import type { ChatImage } from "@/lib/chat/events";
+import { FileChip } from "../FileChip";
+import type { Upload } from "./useAttachFiles";
 import { byteLength, type TextAttachment } from "@/lib/chat/paste";
 
 const size = (text: string) => {
@@ -24,19 +26,23 @@ function Remove({ label, onClick }: { label: string; onClick: () => void }) {
   );
 }
 
-// Images and long pastes waiting to go with the message.
+// Images, files and long pastes waiting to go with the message.
 export function Attachments({
   images,
   files,
+  uploads,
   onRemoveImage,
   onRemoveFile,
+  onRemoveUpload,
 }: {
   images: ChatImage[];
   files: TextAttachment[];
+  uploads: Upload[];
   onRemoveImage: (index: number) => void;
   onRemoveFile: (index: number) => void;
+  onRemoveUpload: (key: string) => void;
 }) {
-  if (!images.length && !files.length) return null;
+  if (!images.length && !files.length && !uploads.length) return null;
   return (
     <div className="flex flex-wrap gap-2 px-1 pb-2">
       {images.map((img, i) => (
@@ -50,6 +56,14 @@ export function Attachments({
           <Remove label="Remove image" onClick={() => onRemoveImage(i)} />
         </div>
       ))}
+      {uploads.map((u) => (
+        <FileChip
+          key={u.key}
+          file={u.file}
+          uploading={u.uploading}
+          onRemove={() => onRemoveUpload(u.key)}
+        />
+      ))}
       {files.map((file, i) => (
         <div
           key={`file-${i}`}

package/components/Chat/composer/ComposerBody.tsx

@@ -6,6 +6,7 @@ import { CornerDownRight, File, Folder } from "lucide-react";
 import type {
   ChatAccess,
   ChatCommand,
+  ChatFile,
   ChatImage,
   ChatModel,
   FileSuggestion,
@@ -28,7 +29,7 @@ import { useCoarsePointer } from "./useCoarsePointer";
 import { useMentions } from "./useMentions";
 import { Attachments } from "./Attachments";
 import { Toolbar } from "./Toolbar";
-import { useImageDrop } from "./useImageDrop";
+import { useAttachFiles } from "./useAttachFiles";
 import type { MenuKey } from "./keys";
 import { useComposerEditor, type ComposerHandlers } from "./useComposerEditor";
 import { useFocusOnShow } from "./autofocus";
@@ -44,7 +45,9 @@ export interface ComposerProps {
   running: boolean;
   disabled?: boolean;
   placeholder: string;
-  onSend: (text: string, images: ChatImage[]) => void;
+  onSend: (text: string, images: ChatImage[], files: ChatFile[]) => void;
+  // Where attached files are kept: the session's id, or "draft" before one exists.
+  attachScope: string;
   onStop: () => void;
   commands?: ChatCommand[];
   // Reloads the commands past the cache (a skill just added), from the menu.
@@ -99,6 +102,7 @@ export function ComposerBody({
   accessory,
   prefill,
   draftKey,
+  attachScope,
   suggestion = null,
   onDismissSuggestion,
   history = [],
@@ -132,7 +136,19 @@ export function ComposerBody({
     if (text && suggestion) onDismissSuggestion?.(suggestion);
   }, [text, suggestion, onDismissSuggestion]);
 
-  const draft = useMemo(() => ({ text, images, files }), [text, images, files]);
+  const attach = useAttachFiles({
+    scope: attachScope,
+    imageCount: images.length,
+    onImages: (read) => setImages((prev) => [...prev, ...read]),
+  });
+  const attached = useMemo(
+    () => attach.uploads.filter((u) => !u.uploading).map((u) => u.file),
+    [attach.uploads]
+  );
+  const draft = useMemo(
+    () => ({ text, images, files, uploads: attached }),
+    [text, images, files, attached]
+  );
   useSaveDraft(draftKey, draft);
 
   // Restored once the editor exists (the server render has no access to this
@@ -145,7 +161,8 @@ export function ComposerBody({
     setText(saved?.text ?? "");
     setImages(saved?.images ?? []);
     setFiles(saved?.files ?? []);
-  }, [draftKey, editor, setText]);
+    attach.restore(saved?.uploads ?? []);
+  }, [draftKey, editor, setText]); // eslint-disable-line react-hooks/exhaustive-deps
   useFocusOnShow(editor, focusKey, phone, disabled);
 
   const prefilled = useRef<number | null>(null);
@@ -228,16 +245,16 @@ export function ComposerBody({
     if (offered) setText(offered, true);
   };
 
-  const { dragging, dropProps, addFiles } = useImageDrop((read) =>
-    setImages((prev) => [...prev, ...read])
-  );
+  const { dragging, dropProps, addFiles } = attach;
 
-  const empty = !text.trim() && !images.length && !files.length;
+  const empty =
+    !text.trim() && !images.length && !files.length && !attach.uploads.length;
   const submit = () => {
-    if (empty || disabled) return;
-    onSend(composeMessage(text, files), images);
+    if (empty || disabled || attach.uploading) return;
+    onSend(composeMessage(text, files), images, attached);
     setImages([]);
     setFiles([]);
+    attach.clear();
     setText("");
     setHistoryIndex(-1);
   };
@@ -261,7 +278,8 @@ export function ComposerBody({
       suggestion: ghost !== null,
       onAcceptSuggestion: acceptSuggestion,
       onHistory: (dir, at) => {
-        if (images.length || files.length) return false;
+        if (images.length || files.length || attach.uploads.length)
+          return false;
         const step = historyStep(
           { history, index: historyIndex, text, ...at },
           dir
@@ -271,7 +289,7 @@ export function ComposerBody({
         setText(step.text, true);
         return true;
       },
-      onImages: (picked) => void addFiles(picked),
+      onFiles: (picked) => void addFiles(picked),
       onLongPaste: (pasted, language) => {
         const next = nextAttachment(files, lastPaste.current);
         lastPaste.current = next.number;
@@ -320,6 +338,8 @@ export function ComposerBody({
         <Attachments
           images={images}
           files={files}
+          uploads={attach.uploads}
+          onRemoveUpload={attach.remove}
           onRemoveImage={(i) => setImages(images.filter((_, j) => j !== i))}
           onRemoveFile={(i) => setFiles(files.filter((_, j) => j !== i))}
         />
@@ -329,7 +349,8 @@ export function ComposerBody({
         <Toolbar
           plain={plain}
           onTogglePlain={() => setPlain(!plain)}
-          onAddImages={(picked) => void addFiles(picked)}
+          onAddFiles={(picked) => void addFiles(picked)}
+          accept={attach.accept}
           plan={plan}
           onTogglePlan={onTogglePlan}
           accessory={accessory}
@@ -343,7 +364,7 @@ export function ComposerBody({
           onModelOpenChange={setModelOpen}
           stop={running && empty}
           onStop={onStop}
-          canSend={!disabled && !empty}
+          canSend={!disabled && !empty && !attach.uploading}
           onSend={submit}
         />
       </div>