@saadnvd1/agent-os 0.3.672 → 0.3.678

package/README.md

@@ -22,6 +22,7 @@ and check on all of it from your phone.
 - **Agents that talk to each other.** Sessions message each other with `aos`, and you see every conversation in Messages. [More](docs/guides/agent-network.md)
 - **Chat or terminal, same conversation.** Streaming replies, steps and diffs, plan mode, slash commands, `@file`, undo. [More](docs/guides/chat.md)
 - **Bookmarks.** Star any message, tool call or turn, then find it again from the chat or across every chat, with a search. [More](docs/guides/chat.md)
+- **Search every conversation.** ⌘K (Ctrl+K off a Mac), then Tab: what you and your agents said in any chat, found as you type from a full-text index (a word's start matches, quotes match a phrase), with the message and its neighbours shown beside the results and a jump to it in the chat. Done, dropped and archived chats are included. [More](docs/reference/conversation-search.md)
 - **Every artifact in one place.** A session's plan, PR, files, pages, images and job logs in one list, with a preview, kept after its worktree is removed. [More](docs/guides/sessions.md#artifacts)
 - **Share a chat or a page.** A read-only snapshot link with secrets, home paths and machine names masked, a preview before anything leaves your machine, and a Markdown copy to hand to an agent. [More](docs/guides/sharing.md)
 - **Project config.** `agentos.json` gives each session its own ports, environment, files and a private Postgres copy. [More](docs/reference/project-config.md)
@@ -33,7 +34,7 @@ and check on all of it from your phone.
 - **LumifyHub (optional).** Boards, cards and docs for a workspace, if you want them. [More](docs/lumifyhub.md)
 - **No approvals mode.** One switch in Settings that approves every ask, lets brakes and plan-only tasks through, and starts every agent with its permission prompts off; each approval it makes is logged. Off by default. [More](docs/reference/orchestrator.md#no-approvals-mode)
 - **Experiments.** Settings → Experiments lists features still being tried, each off until you turn it on, with what it has cost and how often its suggestions were taken. The first is Learning cards: when a session ends it can offer to save the work as a recipe or keep a lesson where it belongs. [More](docs/decisions/2026-10-13-experiments.md)
-- **Also:** a ⌘K palette, code search, a file picker, a git panel, dev servers, up to four panes, and dictation.
+- **Also:** a ⌘K palette (actions, sessions, conversations), code search, a file picker, a git panel, dev servers, up to four panes, and dictation.
 
 ## Documentation
 

package/app/api/bus/read/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { ReadError, readPeer } from "@/lib/bus/read";
+
+// `aos read <session>`: a peer's conversation in the caller's workspace,
+// condensed. Read-only: nothing about the target changes.
+export async function GET(request: NextRequest) {
+  const q = request.nextUrl.searchParams;
+  const count = (k: string) => {
+    const raw = q.get(k);
+    if (raw === null) return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1 || n > 5000)
+      throw new ReadError(`${k} must be a whole number from 1 to 5000`, 400);
+    return n;
+  };
+  try {
+    const from = q.get("from");
+    if (!from)
+      throw new ReadError("aos read runs from inside an AgentOS session", 400);
+    const result = await readPeer(from, q.get("ref") ?? "", {
+      turns: count("turns"),
+      lines: count("lines"),
+      all: q.get("all") === "1",
+      grep: q.get("grep") || undefined,
+    });
+    return NextResponse.json(result);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return NextResponse.json(
+      { error: message },
+      { status: error instanceof ReadError ? error.status : 500 }
+    );
+  }
+}

package/app/api/files/upload-temp/route.test.ts

@@ -0,0 +1,144 @@
+import fs from "fs";
+import path from "path";
+import { afterEach, describe, expect, it } from "vitest";
+import { ATTACHMENT_LIMITS } from "@/lib/attachments/policy";
+import { attachmentsRoot } from "@/lib/attachments/store";
+import { POST } from "./route";
+
+const PDF = Buffer.from("%PDF-1.4\n1 0 obj\n<<>>\nendobj\n");
+const ZIPPED = Buffer.concat([
+  Buffer.from([0x50, 0x4b, 0x03, 0x04]),
+  Buffer.alloc(32, 7),
+]);
+const PNG = Buffer.concat([
+  Buffer.from([0x89, 0x50, 0x4e, 0x47]),
+  Buffer.alloc(32, 1),
+]);
+
+const SESSION = "test-upload-session";
+
+const upload = (
+  filename: string,
+  data: Buffer | string,
+  extra: Record<string, unknown> = {}
+) =>
+  POST(
+    new Request("http://localhost/api/files/upload-temp", {
+      method: "POST",
+      body: JSON.stringify({
+        filename,
+        base64: Buffer.from(data).toString("base64"),
+        ...extra,
+      }),
+    })
+  );
+
+afterEach(() => {
+  fs.rmSync(path.join(attachmentsRoot(), SESSION), {
+    recursive: true,
+    force: true,
+  });
+});
+
+describe("POST /api/files/upload-temp", () => {
+  it.each([
+    ["report.pdf", PDF, "pdf"],
+    ["sheet.xlsx", ZIPPED, "sheet"],
+    ["letter.docx", ZIPPED, "doc"],
+    ["data.csv", "a,b\n1,2\n", "sheet"],
+    ["notes.md", "# hi\n", "text"],
+    ["app.ts", "export const a = 1;\n", "text"],
+    ["shot.png", PNG, "image"],
+  ])("takes %s", async (name, data, kind) => {
+    const res = await upload(name, data, { sessionId: SESSION });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.kind).toBe(kind);
+    expect(body.path).toBe(path.join(attachmentsRoot(), SESSION, name));
+    expect(fs.readFileSync(body.path)).toEqual(Buffer.from(data));
+  });
+
+  it("keeps the old shape: no session means temp storage and a path", async () => {
+    const res = await upload("old.csv", "a,b\n");
+    const body = await res.json();
+    expect(res.status).toBe(200);
+    expect(body.path).toContain("agent-os-screenshots");
+    expect(body.path).not.toContain(attachmentsRoot());
+    fs.rmSync(body.path);
+  });
+
+  it("refuses types it doesn't take, saying which", async () => {
+    for (const name of ["a.zip", "run.sh", "tool.exe", "noext"]) {
+      const res = await upload(name, "x", { sessionId: SESSION });
+      expect(res.status).toBe(415);
+      expect((await res.json()).error).toContain(`${name}: this file type`);
+    }
+    expect(fs.existsSync(path.join(attachmentsRoot(), SESSION))).toBe(false);
+  });
+
+  it("refuses a file that isn't what its name says", async () => {
+    for (const [name, data] of [
+      ["fake.xlsx", "plain text"],
+      ["fake.pdf", "plain text"],
+      ["fake.xls", ZIPPED],
+      ["fake.csv", Buffer.from([0, 1, 2, 0])],
+      ["fake.png", PDF],
+    ] as const) {
+      const res = await upload(name, data, { sessionId: SESSION });
+      expect(res.status, name).toBe(400);
+      expect((await res.json()).error).toContain("doesn't look like a real");
+    }
+  });
+
+  it("refuses an empty file and a missing body", async () => {
+    expect((await upload("a.txt", "", { sessionId: SESSION })).status).toBe(
+      400
+    );
+    const none = await POST(
+      new Request("http://localhost/x", {
+        method: "POST",
+        body: JSON.stringify({ filename: "a.txt" }),
+      })
+    );
+    expect(none.status).toBe(400);
+  });
+
+  it("refuses a file over the limit, and says what the limit is", async () => {
+    const big = Buffer.alloc(ATTACHMENT_LIMITS.maxBytes + 1, 97);
+    const res = await upload("big.txt", big, { sessionId: SESSION });
+    expect(res.status).toBe(413);
+    expect((await res.json()).error).toContain("the limit is 25.0 MB");
+  });
+
+  it("refuses an image over the image limit", async () => {
+    const big = Buffer.concat([
+      PNG,
+      Buffer.alloc(ATTACHMENT_LIMITS.maxImageBytes),
+    ]);
+    expect((await upload("big.png", big)).status).toBe(413);
+  });
+
+  it("refuses a body over the limit before reading it", async () => {
+    const res = await POST(
+      new Request("http://localhost/x", {
+        method: "POST",
+        headers: { "content-length": String(ATTACHMENT_LIMITS.maxBytes * 2) },
+        body: "{}",
+      })
+    );
+    expect(res.status).toBe(413);
+  });
+
+  it("keeps a hostile name inside the session's folder", async () => {
+    const res = await upload("../../escape.pdf", PDF, { sessionId: SESSION });
+    const { path: saved } = await res.json();
+    expect(path.dirname(saved)).toBe(path.join(attachmentsRoot(), SESSION));
+  });
+
+  it("never overwrites: a second file with the same name gets its own", async () => {
+    const a = await (await upload("x.csv", "1", { sessionId: SESSION })).json();
+    const b = await (await upload("x.csv", "2", { sessionId: SESSION })).json();
+    expect(a.path).not.toBe(b.path);
+    expect(fs.readFileSync(a.path, "utf8")).toBe("1");
+  });
+});

package/app/api/files/upload-temp/route.ts

@@ -2,38 +2,69 @@ import { NextResponse } from "next/server";
 import { mkdir, writeFile } from "fs/promises";
 import path from "path";
 import os from "os";
+import { checkUpload } from "@/lib/attachments/check";
+import { ATTACHMENT_LIMITS, tooBigMessage } from "@/lib/attachments/policy";
+import { saveAttachment } from "@/lib/attachments/store";
+import { peerChatLink } from "@/lib/chat/peer-relay";
 
+// Base64 is a third bigger than the bytes, and the JSON around it is small.
+const MAX_BODY = Math.ceil((ATTACHMENT_LIMITS.maxBytes * 4) / 3) + 64 * 1024;
+
+const fail = (error: string, status: number) =>
+  NextResponse.json({ error }, { status });
+
+// POST /api/files/upload-temp { filename, base64, mimeType?, sessionId? }
+// Without a sessionId the file goes to the shared temp folder (the terminal's
+// drop, the file picker). With one - a session's id, or "draft" for a chat
+// not started yet - it is checked against lib/attachments/policy and kept in
+// that session's attachments folder, outside any repo.
 export async function POST(request: Request) {
   try {
-    const { filename, base64, mimeType } = await request.json();
+    const length = Number(request.headers.get("content-length"));
+    if (length > MAX_BODY)
+      return fail(
+        tooBigMessage("That file", length, ATTACHMENT_LIMITS.maxBytes),
+        413
+      );
+    const { filename, base64, sessionId } = await request.json();
+
+    if (typeof base64 !== "string" || !base64) return fail("No file data", 400);
+    const name =
+      typeof filename === "string" && filename ? filename : "attachment";
+    const buffer = Buffer.from(base64, "base64");
+    const checked = checkUpload(name, buffer);
+    if (!checked.ok) return fail(checked.error, checked.status);
 
-    if (!base64) {
-      return NextResponse.json({ error: "No image data" }, { status: 400 });
+    if (typeof sessionId === "string" && sessionId) {
+      if (sessionId !== "draft" && peerChatLink(sessionId))
+        return fail(
+          "Files can't be attached to a session running on another machine yet. Images still work.",
+          409
+        );
+      const file = saveAttachment(
+        sessionId,
+        name,
+        buffer,
+        checked.type.mediaType
+      );
+      return NextResponse.json({ ...file, kind: checked.type.kind });
     }
 
-    // Create temp directory for screenshots if it doesn't exist
     const tempDir = path.join(os.tmpdir(), "agent-os-screenshots");
     await mkdir(tempDir, { recursive: true });
-
-    // Generate unique filename
-    const ext = mimeType?.split("/")[1] || "png";
-    const safeName = filename?.replace(/[^a-zA-Z0-9.-]/g, "_") || "screenshot";
-    const uniqueName = `${Date.now()}-${safeName}`;
-    const finalName = uniqueName.endsWith(`.${ext}`)
-      ? uniqueName
-      : `${uniqueName}.${ext}`;
-    const filePath = path.join(tempDir, finalName);
-
-    // Decode base64 and write file
-    const buffer = Buffer.from(base64, "base64");
+    const safeName = name.replace(/[^a-zA-Z0-9.-]/g, "_");
+    const filePath = path.join(tempDir, `${Date.now()}-${safeName}`);
     await writeFile(filePath, buffer);
 
-    return NextResponse.json({ path: filePath });
+    return NextResponse.json({
+      path: filePath,
+      name: safeName,
+      size: buffer.length,
+      mediaType: checked.type.mediaType,
+      kind: checked.type.kind,
+    });
   } catch (error) {
     console.error("Upload error:", error);
-    return NextResponse.json(
-      { error: "Failed to save image" },
-      { status: 500 }
-    );
+    return fail("Failed to save the file", 500);
   }
 }

package/app/api/search/conversations/context/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getMessageContext } from "@/lib/search/conversations";
+
+const Query = z.object({
+  session: z.string().min(1).max(100),
+  item: z.string().min(1).max(200),
+  around: z.coerce.number().int().min(0).max(6).default(3),
+});
+
+// GET /api/search/conversations/context?session=&item=&around= - a message and
+// the ones around it, for the preview. Read-only.
+export async function GET(request: Request) {
+  const parsed = Query.safeParse(
+    Object.fromEntries(new URL(request.url).searchParams)
+  );
+  if (!parsed.success)
+    return NextResponse.json({ error: "Bad request" }, { status: 400 });
+  const { session, item, around } = parsed.data;
+  const items = getMessageContext(session, item, around);
+  if (!items) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(
+    { items },
+    { headers: { "Cache-Control": "no-store" } }
+  );
+}

package/app/api/search/conversations/route.test.ts

@@ -0,0 +1,139 @@
+import { randomUUID } from "crypto";
+import { describe, expect, it } from "vitest";
+import { getDb } from "@/lib/db";
+import type { ChatItem } from "@/lib/chat/events";
+import { saveItem } from "@/lib/chat/store";
+import * as route from "./route";
+import * as contextRoute from "./context/route";
+
+const get = (qs: Record<string, string>) =>
+  route.GET(
+    new Request(
+      `http://localhost/api/search/conversations?${new URLSearchParams(qs)}`
+    )
+  );
+
+function setup() {
+  const db = getDb();
+  const tag = randomUUID().slice(0, 6);
+  const ws = (n: string) => {
+    const id = `ws-${tag}-${n}`;
+    db.prepare(`INSERT INTO workspaces (id, name) VALUES (?, ?)`).run(
+      id,
+      `Space ${n}`
+    );
+    return id;
+  };
+  const a = ws("a");
+  const b = ws("b");
+  const proj = (n: string, w: string) => {
+    const id = `p-${tag}-${n}`;
+    db.prepare(
+      `INSERT INTO projects (id, name, working_directory, workspace_id) VALUES (?, ?, '/tmp/x', ?)`
+    ).run(id, `Proj ${n}`, w);
+    return id;
+  };
+  const pa = proj("a", a);
+  const pb = proj("b", b);
+  const chat = (
+    name: string,
+    project: string | null,
+    ws: string | null,
+    text: string,
+    archived = false
+  ) => {
+    const sid = randomUUID();
+    db.prepare(
+      `INSERT INTO sessions (id, name, tmux_name, working_directory, project_id, workspace_id, archived_at)
+       VALUES (?, ?, ?, '/tmp', ?, ?, ?)`
+    ).run(
+      sid,
+      name,
+      `claude-${sid}`,
+      project,
+      ws,
+      archived ? "2026-01-01" : null
+    );
+    for (let i = 0; i < 5; i++)
+      saveItem(sid, {
+        id: `${sid}-${i}`,
+        kind: i % 2 ? "assistant" : "user",
+        text: `${text} ${i}`,
+        createdAt: 1,
+      } as ChatItem);
+    return sid;
+  };
+  return { a, b, pa, pb, chat, word: `lynx${tag}` };
+}
+
+describe("GET /api/search/conversations", () => {
+  it("scopes to a workspace, all of them, or a project", async () => {
+    const { a, b, pa, chat, word } = setup();
+    const inA = chat("in a", pa, null, word);
+    const direct = chat("direct", null, a, word);
+    chat("in b", `p-${word.slice(4)}-b`, null, word);
+    const only = async (qs: Record<string, string>) =>
+      (
+        (await (await get({ q: word, ...qs })).json()).groups as {
+          sessionId: string;
+        }[]
+      )
+        .map((g) => g.sessionId)
+        .sort();
+    expect(await only({ workspace: a })).toEqual([inA, direct].sort());
+    expect((await only({ workspace: "all" })).length).toBe(3);
+    expect(await only({ workspace: "all", project: pa })).toEqual([inA]);
+    expect(await only({ workspace: b })).toHaveLength(1);
+  });
+
+  it("includes archived conversations and labels them, with the match marked", async () => {
+    const { chat, word } = setup();
+    chat("old", null, null, `${word} cleanup`, true);
+    const body = await (await get({ q: word.slice(0, -1) })).json();
+    expect(body.groups).toHaveLength(1);
+    const g = body.groups[0];
+    expect(g.status).toBe("archived");
+    expect(g.hits.length).toBeLessThanOrEqual(3);
+    expect(g.hits[0].snippet.some((s: { hit: boolean }) => s.hit)).toBe(true);
+    expect(body.terms).toEqual([word.slice(0, -1)]);
+  });
+
+  it("rejects bad input and treats short queries as empty", async () => {
+    expect((await get({ q: "x", limit: "999" })).status).toBe(400);
+    expect((await get({ q: "x".repeat(300) })).status).toBe(400);
+    const r = await get({ q: "a" });
+    expect((await r.json()).groups).toEqual([]);
+  });
+
+  it("answers hostile query text with results, not an error", async () => {
+    const r = await get({ q: '"AND" OR NEAR( * ^ col: "' });
+    expect(r.status).toBe(200);
+  });
+
+  it("only reads", () => {
+    expect(Object.keys(route).sort()).toEqual(["GET"]);
+    expect(Object.keys(contextRoute).sort()).toEqual(["GET"]);
+  });
+
+  it("serves a message with its neighbours, and 404s a missing one", async () => {
+    const { chat, word } = setup();
+    const sid = chat("ctx", null, null, word);
+    const ok = await contextRoute.GET(
+      new Request(
+        `http://localhost/x?${new URLSearchParams({ session: sid, item: `${sid}-2`, around: "1" })}`
+      )
+    );
+    const items = (await ok.json()).items as { id: string; hit: boolean }[];
+    expect(items.map((i) => i.id)).toEqual([
+      `${sid}-1`,
+      `${sid}-2`,
+      `${sid}-3`,
+    ]);
+    const missing = await contextRoute.GET(
+      new Request(
+        `http://localhost/x?${new URLSearchParams({ session: sid, item: "nope" })}`
+      )
+    );
+    expect(missing.status).toBe(404);
+  });
+});

package/app/api/search/conversations/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { searchConversations } from "@/lib/search/conversations";
+
+const Query = z.object({
+  q: z.string().max(200).default(""),
+  workspace: z.string().min(1).max(100).default("all"),
+  project: z.string().min(1).max(100).optional(),
+  offset: z.coerce.number().int().min(0).max(200).default(0),
+  limit: z.coerce.number().int().min(1).max(30).default(20),
+});
+
+// GET /api/search/conversations?q=&workspace=<id|all>&project=&offset=&limit=
+// - what was said in chats, grouped by conversation. Read-only.
+export async function GET(request: Request) {
+  const params = Object.fromEntries(new URL(request.url).searchParams);
+  const parsed = Query.safeParse(params);
+  if (!parsed.success)
+    return NextResponse.json({ error: "Bad search" }, { status: 400 });
+  const { q, workspace, project, offset, limit } = parsed.data;
+  return NextResponse.json(
+    searchConversations(q, { workspace, project }, { offset, limit }),
+    { headers: { "Cache-Control": "no-store" } }
+  );
+}

package/app/api/sessions/[id]/route.ts

@@ -1,3 +1,4 @@
+import { removeSessionAttachments } from "@/lib/attachments/store";
 import { NextRequest, NextResponse } from "next/server";
 import { deletionRefusal } from "@/lib/orchestrator/home";
 import { getDb, queries, type Session } from "@/lib/db";
@@ -281,6 +282,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
     );
     deleteItems(id);
     clearQueue(id);
+    void removeSessionAttachments(id).catch(() => {});
     queries.deleteSession(db).run(id);
 
     // Clean up worktree in background (non-blocking)

package/app/api/sessions/route.ts

@@ -50,8 +50,12 @@ export async function POST(request: NextRequest) {
   }
   const str = (v: unknown) => (typeof v === "string" ? v : null);
   const firstMessage = (b: Record<string, unknown>) => {
-    const { text, images } = clientSend({ text: b.prompt, images: b.images });
-    return { prompt: text, images };
+    const { text, images, files } = clientSend({
+      text: b.prompt,
+      images: b.images,
+      files: b.files,
+    });
+    return { prompt: text, images, files };
   };
   try {
     const { session, initialPrompt, repeat } = await launchSession({

package/app/globals.css

@@ -309,3 +309,28 @@ body {
   background-color: hsl(var(--find-current));
   color: hsl(var(--find-current-foreground));
 }
+
+/* A message just jumped to (components/Chat/useGoToItem). */
+@keyframes jump-flash {
+  from {
+    background-color: hsl(var(--primary) / 0.22);
+  }
+  to {
+    background-color: transparent;
+  }
+}
+[data-block][data-flash] {
+  animation: jump-flash 1.8s ease-out;
+  border-radius: 0.75rem;
+}
+@media (prefers-reduced-motion: reduce) {
+  [data-block][data-flash] {
+    animation: none;
+    background-color: hsl(var(--primary) / 0.12);
+  }
+}
+
+/* Matches in the search preview (components/CommandPalette/conversations). */
+::highlight(conv-search) {
+  background-color: hsl(var(--find-match));
+}

package/components/Bookmarks/BookmarksDialog.tsx

@@ -15,7 +15,7 @@ import { useBookmarks, type Bookmark } from "@/data/bookmarks";
 import { useWorkspacesQuery } from "@/data/workspaces";
 import { useUnarchiveSession } from "@/data/done";
 import { toast } from "sonner";
-import { hrefWithSession } from "@/lib/session-url";
+import { openChatAt } from "@/stores/chatJump";
 import { bookmarksUi, bookmarksUiActions } from "@/stores/bookmarksUi";
 import { BookmarkRow } from "./BookmarkRow";
 import { EmptyBookmarks } from "./EmptyBookmarks";
@@ -24,13 +24,7 @@ import { groupByDay } from "./helpers";
 // Opens the chat by its address, then takes it to the message.
 function openChat(b: Bookmark) {
   bookmarksUiActions.setOpen(false);
-  window.history.pushState(
-    null,
-    "",
-    hrefWithSession(location.href, b.sessionId)
-  );
-  window.dispatchEvent(new PopStateEvent("popstate"));
-  bookmarksUiActions.jump(b.sessionId, b.itemId);
+  openChatAt(b.sessionId, b.itemId);
 }
 
 // Every bookmark: one workspace's or all of them, searched on the server.

package/components/Chat/ChatPanel.tsx

@@ -694,6 +694,7 @@ export function ChatPanel({
                           kind: "user",
                           text: p.text,
                           images: p.images,
+                          files: p.files,
                           createdAt: p.at,
                         }}
                         pending={{
@@ -820,6 +821,7 @@ export function ChatPanel({
         <LearningCardsHost sessionId={sessionId} />
         <Composer
           draftKey={sessionId}
+          attachScope={sessionId}
           suggestion={shownSuggestion}
           onDismissSuggestion={dismissSuggestion}
           history={history}
@@ -828,7 +830,7 @@ export function ChatPanel({
           running={running}
           disabled={!connected}
           placeholder={connected ? `Message ${sessionName}` : "Reconnecting…"}
-          onSend={(text, images) => {
+          onSend={(text, images, files) => {
             if (freshStart && isFreshCommand(text)) {
               startFresh.mutate(sessionId);
               return;
@@ -840,7 +842,12 @@ export function ChatPanel({
               asIs,
             });
             setAsIs(false);
-            send(text, images.length ? images : undefined, compact);
+            send(
+              text,
+              images.length ? images : undefined,
+              compact,
+              files.length ? files : undefined
+            );
             if (replyTo) {
               resolveQuestion.mutate(replyTo.id);
               setReplyTo(null);

package/components/Chat/FileChip.tsx

@@ -0,0 +1,67 @@
+import {
+  FileCode,
+  FileSpreadsheet,
+  FileText,
+  Loader2,
+  X,
+  type LucideIcon,
+} from "lucide-react";
+import {
+  formatBytes,
+  typeFor,
+  type AttachmentKind,
+} from "@/lib/attachments/policy";
+import { cn } from "@/lib/utils";
+
+const ICONS: Record<AttachmentKind, LucideIcon> = {
+  image: FileText,
+  pdf: FileText,
+  sheet: FileSpreadsheet,
+  doc: FileText,
+  text: FileCode,
+};
+
+// A file attached to a message: in the composer (with a way to remove it,
+// and a spinner while it uploads) and in the sent message.
+export function FileChip({
+  file,
+  uploading,
+  onRemove,
+}: {
+  file: { name: string; size: number };
+  uploading?: boolean;
+  onRemove?: () => void;
+}) {
+  const Icon = ICONS[typeFor(file.name)?.kind ?? "text"];
+  return (
+    <div
+      className={cn(
+        "bg-foreground/[0.05] flex h-14 max-w-56 min-w-0 items-center gap-2 rounded-lg pl-3",
+        onRemove ? "pr-1" : "pr-3"
+      )}
+      title={file.name}
+    >
+      {uploading ? (
+        <Loader2 className="text-muted-foreground h-4 w-4 shrink-0 animate-spin" />
+      ) : (
+        <Icon className="text-muted-foreground h-4 w-4 shrink-0" />
+      )}
+      <span className="min-w-0">
+        <span className="block truncate text-sm">{file.name}</span>
+        <span className="text-muted-foreground block text-xs">
+          {uploading ? "Uploading…" : formatBytes(file.size)}
+        </span>
+      </span>
+      {onRemove && (
+        <button
+          type="button"
+          aria-label={`Remove ${file.name}`}
+          onClick={onRemove}
+          className="text-muted-foreground hover:text-foreground flex h-11 w-11 shrink-0 items-center justify-center"
+        >
+          <X className="h-4 w-4" />
+        </button>
+      )}
+    </div>
+  );
+}