@saadnvd1/agent-os 0.3.810 → 0.3.817

package/README.md

@@ -55,16 +55,17 @@ You need Node.js 22+, git, tmux, and at least one agent CLI (the installer offer
 ```bash
 npm install -g @saadnvd1/agent-os
 agent-os install   # checks for tmux and ripgrep, installs what's missing, builds the app
-agent-os start     # runs in the background on http://localhost:3011
+agent-os setup     # keeps it running, chooses how your phone reaches it, adds the phone
 ```
 
 Without Node.js, the install script sets up everything:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/saadnvd1/agent-os/main/scripts/install.sh | bash
-agent-os start
 ```
 
+It ends by offering `agent-os setup`. If another device can't reach the machine later, `agent-os check` names the cause and the fix ([guide](docs/guides/reachability.md)).
+
 Then open AgentOS, add a project from ⌘K, and press ⌥N. The [install guide](docs/guides/install.md) covers Windows (WSL2), the supported agents, first run and the `agent-os` commands. To use it from your phone, see the [phone guide](docs/guides/phone.md).
 
 ## Connect

package/app/api/files/upload-temp/route.test.ts

@@ -68,7 +68,7 @@ describe("POST /api/files/upload-temp", () => {
   });
 
   it("refuses types it doesn't take, saying which", async () => {
-    for (const name of ["a.zip", "run.sh", "tool.exe", "noext"]) {
+    for (const name of ["a.zip", "tool.exe", "noext", "clip.mov"]) {
       const res = await upload(name, "x", { sessionId: SESSION });
       expect(res.status).toBe(415);
       expect((await res.json()).error).toContain(`${name}: this file type`);
@@ -105,11 +105,61 @@ describe("POST /api/files/upload-temp", () => {
 
   it("refuses a file over the limit, and says what the limit is", async () => {
     const big = Buffer.alloc(ATTACHMENT_LIMITS.maxBytes + 1, 97);
-    const res = await upload("big.txt", big, { sessionId: SESSION });
+    const res = await upload("big.csv", big, { sessionId: SESSION });
     expect(res.status).toBe(413);
     expect((await res.json()).error).toContain("the limit is 25.0 MB");
   });
 
+  it("takes shell scripts, config and extensionless names as text", async () => {
+    for (const name of ["run.sh", "Dockerfile", ".env.example", "main.tf"]) {
+      const res = await upload(name, "echo hi\n", { sessionId: SESSION });
+      expect(res.status, name).toBe(200);
+      expect((await res.json()).kind).toBe("text");
+    }
+  });
+
+  it("names what is accepted when it refuses a type", async () => {
+    const res = await upload("a.zip", "x", { sessionId: SESSION });
+    expect((await res.json()).error).toMatch(/HAR.*HEIC|HEIC.*HAR/);
+  });
+
+  it("redacts a HAR on the way in and keeps a summary beside it", async () => {
+    const secret = ["s", "3", "cr", "et"].join("") + Date.now();
+    const har = JSON.stringify({
+      log: {
+        entries: [
+          {
+            request: {
+              method: "GET",
+              url: "https://api.example.com/me",
+              headers: [{ name: "Authorization", value: `Bearer ${secret}` }],
+              cookies: [{ name: "sid", value: secret }],
+            },
+            response: { status: 500, headers: [], cookies: [] },
+          },
+        ],
+      },
+    });
+    const res = await upload("trace.har", har, { sessionId: SESSION });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.mediaType).toBe("application/json");
+    const saved = fs.readFileSync(body.path, "utf8");
+    expect(saved).not.toContain(secret);
+    expect(saved).toContain("api.example.com/me");
+    expect(fs.readFileSync(`${body.path}.summary.txt`, "utf8")).toContain(
+      "1 requests"
+    );
+  });
+
+  it("refuses a .har that isn't a HAR", async () => {
+    for (const data of ["not json", '{"log":{}}']) {
+      const res = await upload("x.har", data, { sessionId: SESSION });
+      expect(res.status).toBe(400);
+      expect((await res.json()).error).toContain("real HAR");
+    }
+  });
+
   it("refuses an image over the image limit", async () => {
     const big = Buffer.concat([
       PNG,
@@ -122,7 +172,9 @@ describe("POST /api/files/upload-temp", () => {
     const res = await POST(
       new Request("http://localhost/x", {
         method: "POST",
-        headers: { "content-length": String(ATTACHMENT_LIMITS.maxBytes * 2) },
+        headers: {
+          "content-length": String(ATTACHMENT_LIMITS.maxTextBytes * 2),
+        },
         body: "{}",
       })
     );

package/app/api/files/upload-temp/route.ts

@@ -4,11 +4,13 @@ import path from "path";
 import os from "os";
 import { checkUpload } from "@/lib/attachments/check";
 import { ATTACHMENT_LIMITS, tooBigMessage } from "@/lib/attachments/policy";
+import { prepareUpload } from "@/lib/attachments/prepare";
 import { saveAttachment } from "@/lib/attachments/store";
 import { peerChatLink } from "@/lib/chat/peer-relay";
 
 // Base64 is a third bigger than the bytes, and the JSON around it is small.
-const MAX_BODY = Math.ceil((ATTACHMENT_LIMITS.maxBytes * 4) / 3) + 64 * 1024;
+const MAX_BODY =
+  Math.ceil((ATTACHMENT_LIMITS.maxTextBytes * 4) / 3) + 64 * 1024;
 
 const fail = (error: string, status: number) =>
   NextResponse.json({ error }, { status });
@@ -34,6 +36,8 @@ export async function POST(request: Request) {
     const buffer = Buffer.from(base64, "base64");
     const checked = checkUpload(name, buffer);
     if (!checked.ok) return fail(checked.error, checked.status);
+    const prepared = await prepareUpload(checked.type, name, buffer);
+    if (!prepared.ok) return fail(prepared.error, prepared.status);
 
     if (typeof sessionId === "string" && sessionId) {
       if (sessionId !== "draft" && peerChatLink(sessionId))
@@ -43,25 +47,26 @@ export async function POST(request: Request) {
         );
       const file = saveAttachment(
         sessionId,
-        name,
-        buffer,
-        checked.type.mediaType
+        prepared.name,
+        prepared.data,
+        prepared.mediaType,
+        prepared.summary
       );
-      return NextResponse.json({ ...file, kind: checked.type.kind });
+      return NextResponse.json({ ...file, kind: prepared.kind });
     }
 
     const tempDir = path.join(os.tmpdir(), "agent-os-screenshots");
     await mkdir(tempDir, { recursive: true });
-    const safeName = name.replace(/[^a-zA-Z0-9.-]/g, "_");
+    const safeName = prepared.name.replace(/[^a-zA-Z0-9.-]/g, "_");
     const filePath = path.join(tempDir, `${Date.now()}-${safeName}`);
-    await writeFile(filePath, buffer);
+    await writeFile(filePath, prepared.data);
 
     return NextResponse.json({
       path: filePath,
       name: safeName,
-      size: buffer.length,
-      mediaType: checked.type.mediaType,
-      kind: checked.type.kind,
+      size: prepared.data.length,
+      mediaType: prepared.mediaType,
+      kind: prepared.kind,
     });
   } catch (error) {
     console.error("Upload error:", error);

package/app/api/reach/probe/route.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { GET } from "./route";
+
+// Public before pairing: it may only ever say "AgentOS, this boot".
+describe("GET /api/reach/probe", () => {
+  it("answers the same two fields to everyone, all boot long, uncached", async () => {
+    const a = GET();
+    const b = GET();
+    const body = await a.json();
+    expect(Object.keys(body).sort()).toEqual(["boot", "ok"]);
+    expect(body).toEqual({
+      ok: true,
+      boot: expect.stringMatching(/^[0-9a-f]{16}$/),
+    });
+    expect(await b.json()).toEqual(body);
+    expect(a.headers.get("cache-control")).toBe("no-store");
+  });
+
+  it("takes no input", () => {
+    expect(GET.length).toBe(0);
+  });
+});

package/app/api/reach/probe/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { bootId } from "@/lib/reach/probeConnect";
+
+// GET /api/reach/probe - public: the same answer for anyone, all boot long.
+// This machine fetches it through its own Connect address to prove the
+// answer came from this process, not a cache or another AgentOS.
+export function GET() {
+  return NextResponse.json(
+    { ok: true, boot: bootId() },
+    { headers: { "Cache-Control": "no-store" } }
+  );
+}

package/app/api/reach/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { checkReach } from "@/lib/reach/checkReach";
+import { classifyReach } from "@/lib/reach/classify";
+import { demoMode } from "@/lib/security/demo";
+import type { ReachRoute } from "@/lib/reach/types";
+
+const ROUTES = new Set<string>(["connect", "tailscale", "lan"]);
+
+// GET /api/reach[?fresh][&want=lan,connect] - can other devices reach this
+// machine, and if not, why. `want` adds routes the caller means to use.
+export async function GET(request: NextRequest) {
+  if (demoMode()) return NextResponse.json(demoReach());
+  const params = request.nextUrl.searchParams;
+  const want = (params.get("want") ?? "")
+    .split(",")
+    .filter((r): r is ReachRoute => ROUTES.has(r));
+  return NextResponse.json(await checkReach(params.has("fresh"), want));
+}
+
+// Nothing about the machine a demo runs on.
+function demoReach() {
+  return classifyReach({
+    now: Date.now(),
+    port: 3011,
+    lan: { on: false, addresses: [] },
+    firewall: "unknown",
+    tailscale: { state: "missing" },
+    connect: { state: "off", linked: false, enabled: false },
+  });
+}

package/app/api/sessions/list-size.test.ts

@@ -0,0 +1,77 @@
+import { randomUUID } from "crypto";
+import { beforeEach, describe, expect, it } from "vitest";
+
+const { db, insertSessionRow } = await import("@/lib/db");
+const { GET } = await import("./route");
+
+type Row = Record<string, unknown> & { id: string };
+
+function seed(extra: Record<string, unknown> = {}): string {
+  const id = randomUUID();
+  insertSessionRow(db, {
+    id,
+    name: "n",
+    tmux_name: `claude-${id}`,
+    working_directory: "/tmp",
+    ...extra,
+  });
+  return id;
+}
+
+const list = async (query = "") => {
+  const res = await GET({
+    nextUrl: new URL(`http://x/api/sessions${query}`),
+  } as never);
+  return (await res.json()).sessions as Row[];
+};
+
+beforeEach(() => {
+  db.prepare(`DELETE FROM sessions`).run();
+});
+
+describe("GET /api/sessions payload", () => {
+  it("never carries the full prompt, the chat context or the orchestrator token", async () => {
+    const id = seed({
+      task_status: "running",
+      task_prompt: "x".repeat(5000),
+      chat_context: "ctx",
+      orch_token: "secret-token",
+    });
+    const row = (await list()).find((r) => r.id === id)!;
+    // Installed phone builds read !!task_prompt, so a short prefix stays.
+    expect(row.task_prompt).toBe("x".repeat(80));
+    expect(row).not.toHaveProperty("chat_context");
+    expect(row).not.toHaveProperty("orch_token");
+    expect(row.has_prompt).toBe(1);
+  });
+
+  it("says has_prompt 0 for a plain session", async () => {
+    const id = seed();
+    expect((await list()).find((r) => r.id === id)!.has_prompt).toBe(0);
+  });
+
+  it("leaves null fields out", async () => {
+    const id = seed();
+    const row = (await list()).find((r) => r.id === id)!;
+    expect(Object.values(row)).not.toContain(null);
+    expect(row).not.toHaveProperty("pr_url");
+  });
+
+  it("lists the 100 most recent merged tasks, all with ?done=all", async () => {
+    for (let i = 0; i < 103; i++) {
+      const day = String(i + 1).padStart(3, "0");
+      seed({
+        task_status: "merged",
+        merged_at: `2026-01-01 00:00:${i % 60}`.replace(/:(\d)$/, ":0$1"),
+        updated_at: `2026-02-01 00:00:00`,
+        name: `done-${day}`,
+      });
+    }
+    const live = seed({ task_status: "running" });
+    const capped = await list();
+    expect(capped.filter((r) => r.task_status === "merged")).toHaveLength(100);
+    expect(capped.map((r) => r.id)).toContain(live);
+    const all = await list("?done=all");
+    expect(all.filter((r) => r.task_status === "merged")).toHaveLength(103);
+  });
+});

package/app/api/sessions/route.ts

@@ -10,9 +10,14 @@ import { ModelUnavailableError } from "@/lib/models/agent-binding";
 import { namesLine, waitBadges } from "@/lib/bus/waits/store";
 import { claimsSnapshot } from "@/lib/claims";
 import { isProjectRef } from "@/lib/tasks/project-ref";
+import { omitNulls } from "@/lib/sessions/omit-null";
+
+// The sidebar's Done shelf lists this many finished tasks; ?done=all lists
+// every one.
+const DONE_LISTED = 100;
 
 // GET /api/sessions - List the sidebar's sessions and the user's groups
-export async function GET() {
+export async function GET(request?: NextRequest) {
   try {
     const db = getDb();
     // Merged tasks are listed (the sidebar files them under Done). Dropped
@@ -20,12 +25,18 @@ export async function GET() {
     // and archived sessions in the Archived view: none is in the sidebar.
     const badges = waitBadges();
     const claims = claimsSnapshot();
-    const sessions = (queries.getSidebarSessions(db).all() as Session[]).map(
-      (s) => {
-        const b = badges.get(s.id);
-        const overlap = claims.bySession.get(s.id);
-        const row = overlap ? { ...s, overlap } : s;
-        return b
+    const all = request?.nextUrl.searchParams.get("done") === "all";
+    const rows = (
+      all
+        ? queries.getSidebarSessions(db).all()
+        : queries.getSidebarSessionsCapped(db, DONE_LISTED).all()
+    ) as Session[];
+    const sessions = rows.map((s) => {
+      const b = badges.get(s.id);
+      const overlap = claims.bySession.get(s.id);
+      const row = overlap ? { ...s, overlap } : s;
+      return omitNulls(
+        b
           ? {
               ...row,
               waiting_on: b.on.length
@@ -35,9 +46,9 @@ export async function GET() {
                 ? namesLine(b.by.map((w) => w.name))
                 : null,
             }
-          : row;
-      }
-    );
+          : row
+      );
+    });
     return NextResponse.json({
       sessions,
       sessionGroups: listGroups(),

package/app/api/tasks/list-size.test.ts

@@ -0,0 +1,50 @@
+import { randomUUID } from "crypto";
+import { describe, expect, it } from "vitest";
+
+const { db, insertSessionRow } = await import("@/lib/db");
+const { GET } = await import("./route");
+
+describe("GET /api/tasks payload", () => {
+  it("lists hasPrompt, not the prompt text, and leaves null fields out", async () => {
+    const id = randomUUID();
+    insertSessionRow(db, {
+      id,
+      name: "t",
+      tmux_name: `claude-${id}`,
+      working_directory: "/tmp",
+      task_status: "running",
+      task_prompt: "p".repeat(5000),
+    });
+    const { tasks } = await (await GET()).json();
+    const t = tasks.find((x: { id: string }) => x.id === id);
+    expect(t.hasPrompt).toBe(true);
+    expect(t).not.toHaveProperty("prompt");
+    expect(JSON.stringify(t)).not.toContain("ppppp");
+    expect(Object.values(t)).not.toContain(null);
+  });
+});
+
+describe("taskSessions with a merged limit", () => {
+  it("keeps the most recently merged ones and every unmerged one", async () => {
+    const { taskSessions } = await import("@/lib/tasks/session");
+    const add = (status: string, merged_at: string | null) => {
+      const id = randomUUID();
+      insertSessionRow(db, {
+        id,
+        name: "t",
+        tmux_name: `claude-${id}`,
+        working_directory: "/tmp",
+        task_status: status,
+        merged_at,
+      });
+      return id;
+    };
+    const oldest = add("merged", "2020-01-01 00:00:00");
+    const newer = add("merged", "2020-01-03 00:00:00");
+    const newest = add("merged", "2020-01-04 00:00:00");
+    const running = add("running", null);
+    const ids = taskSessions(false, 2).map((s) => s.id);
+    expect(ids).toEqual(expect.arrayContaining([newer, newest, running]));
+    expect(ids).not.toContain(oldest);
+  });
+});

package/app/api/tasks/route.ts

@@ -1,6 +1,6 @@
 import { parseOverride } from "@/lib/models/resolve";
 import { NextRequest, NextResponse } from "next/server";
-import { createTask, listTasks, movedTasks } from "@/lib/tasks";
+import { createTask, listTasks, movedTasks, type TaskView } from "@/lib/tasks";
 import { stampPriority, startOrQueue } from "@/lib/tasks/queue";
 import { isPriority } from "@/lib/tasks/schedule-types";
 import { TASK_CAPABILITIES } from "@/lib/tasks/contract/types";
@@ -13,12 +13,29 @@ import {
 } from "@/lib/tasks/move-bundle";
 import { startView } from "@/lib/sessions/launch";
 import { isValidAgentType } from "@/lib/providers";
+import { omitNulls } from "@/lib/sessions/omit-null";
 import { isAgentModelName } from "@/lib/providers/registry";
 
+// The most recent merged tasks the list holds; ?done=all lists every one.
+const MERGED_LISTED = 100;
+
+// A task as the list shows it: no prompt text (a mirrored one from a machine
+// that still sends it included) and no null fields.
+function listed(task: TaskView) {
+  const { prompt: _prompt, ...rest } = task;
+  return omitNulls(rest);
+}
+
 // moved and capabilities are for another machine that mirrors these tasks.
-export async function GET() {
+export async function GET(request?: NextRequest) {
   return NextResponse.json({
-    tasks: await listTasks(),
+    tasks: (
+      await listTasks(
+        request?.nextUrl.searchParams.get("done") === "all"
+          ? undefined
+          : MERGED_LISTED
+      )
+    ).map(listed),
     moved: movedTasks(),
     capabilities: TASK_CAPABILITIES,
   });

package/components/Chat/FileChip.tsx

@@ -32,14 +32,18 @@ export function FileChip({
   uploading?: boolean;
   onRemove?: () => void;
 }) {
-  const Icon = ICONS[typeFor(file.name)?.kind ?? "text"];
+  const type = typeFor(file.name);
+  const Icon = ICONS[type?.kind ?? "text"];
+  const detail = uploading
+    ? "Uploading…"
+    : [formatBytes(file.size), type?.note].filter(Boolean).join(" · ");
   return (
     <div
       className={cn(
         "bg-foreground/[0.05] flex h-14 max-w-56 min-w-0 items-center gap-2 rounded-lg pl-3",
         onRemove ? "pr-1" : "pr-3"
       )}
-      title={file.name}
+      title={type?.note ? `${file.name} (${type.note})` : file.name}
     >
       {uploading ? (
         <Loader2 className="text-muted-foreground h-4 w-4 shrink-0 animate-spin" />
@@ -48,8 +52,8 @@ export function FileChip({
       )}
       <span className="min-w-0">
         <span className="block truncate text-sm">{file.name}</span>
-        <span className="text-muted-foreground block text-xs">
-          {uploading ? "Uploading…" : formatBytes(file.size)}
+        <span className="text-muted-foreground block truncate text-xs">
+          {detail}
         </span>
       </span>
       {onRemove && (

package/components/Chat/ViewSwitch.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { MessageSquare, SquareTerminal } from "lucide-react";
+import { hasPrompt } from "@/lib/sessions/has-prompt";
 import type { Session } from "@/lib/db";
 import { supportsChat } from "@/lib/chat/capabilities";
 import { viewSwitchActions } from "@/stores/viewSwitch";
@@ -15,7 +16,7 @@ export function ViewSwitch({
   if (!session || !supportsChat(session.agent_type)) return null;
   if (session.host_id && session.host_id !== "local") return null;
   // A task's agent runs in its terminal with its brief; chat would end it.
-  if (session.task_prompt) return null;
+  if (hasPrompt(session)) return null;
   const options = [
     { view: "chat" as const, icon: MessageSquare, label: "Chat" },
     { view: "terminal" as const, icon: SquareTerminal, label: "Terminal" },

package/components/Chat/composer/paste.ts

@@ -14,9 +14,12 @@ export interface PasteHandlers {
 }
 
 // Dragged files sometimes arrive without a type; go by the name then.
+// Only the formats a model takes; HEIC photos and SVG go up as files, where
+// the server converts or keeps them.
+const INLINE_IMAGE = /^image\/(png|jpe?g|gif|webp)$/;
 export const isImage = (f: File) =>
-  f.type.startsWith("image/") ||
-  (!f.type && /\.(png|jpe?g|gif|webp|heic)$/i.test(f.name));
+  INLINE_IMAGE.test(f.type) ||
+  (!f.type && /\.(png|jpe?g|gif|webp)$/i.test(f.name));
 
 function editorMode(data: DataTransfer): string | undefined {
   try {

package/components/Chat/composer/useAttachFiles.ts

@@ -9,6 +9,7 @@ import {
 } from "@/data/client-config/queries";
 import {
   acceptAttr,
+  limitFor,
   tooBigMessage,
   typeFor,
   unsupportedMessage,
@@ -83,11 +84,13 @@ export function useAttachFiles({
         const shrunk = await shrinkImage(f, limits.maxImageBytes);
         if (shrunk.ok) images.push(shrunk.file);
         else error = tooBigMessage(f.name, f.size, limits.maxImageBytes);
-      } else if (!typeFor(f.name, limits.types))
-        error = unsupportedMessage(f.name);
-      else if (f.size > limits.maxBytes)
-        error = tooBigMessage(f.name, f.size, limits.maxBytes);
-      else others.push(f);
+      } else {
+        const type = typeFor(f.name, limits.types);
+        if (!type) error = unsupportedMessage(f.name);
+        else if (f.size > limitFor(type, limits))
+          error = tooBigMessage(f.name, f.size, limitFor(type, limits));
+        else others.push(f);
+      }
       if (error) toast.error(error);
     }
     if (images.length) onImages(await Promise.all(images.map(readImage)));

package/components/Devices/NetworkSection.tsx

@@ -4,6 +4,7 @@ import { SettingToggle as Toggle } from "@/components/Settings/SettingToggle";
 import { useNetworkQuery, useUpdateNetwork } from "@/data/devices";
 import { TailscaleCard } from "./TailscaleCard";
 import { ConnectCard } from "./ConnectCard";
+import { ReachRow } from "@/components/Reach/ReachRow";
 
 export function NetworkSection({
   open,
@@ -22,6 +23,7 @@ export function NetworkSection({
 
   return (
     <div className="space-y-2">
+      <ReachRow enabled={open} />
       <ConnectCard
         connect={data.connect}
         canManage={canManage}

package/components/Pane/index.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { hasPrompt } from "@/lib/sessions/has-prompt";
 import { useTaskLogQuery } from "@/data/session-logs";
 import { SetupCard } from "@/components/Chat/SetupCard";
 import { SignInCard } from "@/components/Terminal/SignInCard";
@@ -217,10 +218,11 @@ export const Pane = memo(function Pane({
 
   // A merged task keeps the log AgentOS wrote of it.
   const merged =
-    !!session?.task_prompt &&
+    !!session &&
+    hasPrompt(session) &&
     (session.task_status === "merged" || session.pr_status === "merged");
   const hasLog = !!useTaskLogQuery(session?.id, merged).data;
-  const hasReport = !!session?.task_prompt;
+  const hasReport = !!session && hasPrompt(session);
 
   // Get current project and its repositories
   const currentProject = useMemo(() => {