@shipers-dev/multi 0.1.1 → 0.3.0

package/dist/index.js

@@ -71,21 +71,25 @@ async function getVersion(path) {
 }
 
 // src/client.ts
+var authToken = null;
+function setAuthToken(token) {
+  authToken = token;
+}
 async function request(url, options) {
   try {
-    const response = await fetch(url, {
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options?.headers
-      }
-    });
-    const raw = await response.json();
+    const headers = {
+      "Content-Type": "application/json",
+      ...options?.headers
+    };
+    if (authToken && !headers["Authorization"])
+      headers["Authorization"] = `Bearer ${authToken}`;
+    const response = await fetch(url, { ...options, headers });
+    const raw = await response.json().catch(() => ({}));
     if (!response.ok) {
-      return { success: false, error: raw?.error || `HTTP ${response.status}` };
+      return { success: false, error: raw?.error || `HTTP ${response.status}`, status: response.status };
     }
     const data = raw && typeof raw === "object" && "results" in raw ? raw.results : raw;
-    return { success: true, data };
+    return { success: true, data, status: response.status };
   } catch (error) {
     return { success: false, error: String(error) };
   }
@@ -5364,7 +5368,7 @@ function extractText(content) {
 
 // src/index.ts
 import { parseArgs } from "util";
-import { mkdirSync as mkdirSync2, existsSync as existsSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync2, appendFileSync, unlinkSync } from "fs";
+import { mkdirSync as mkdirSync2, existsSync as existsSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync2, appendFileSync, unlinkSync, readdirSync, statSync } from "fs";
 import { join, dirname as dirname2 } from "path";
 var HOME = process.env.HOME || process.env.USERPROFILE || ".";
 var MULTI_DIR = join(HOME, ".multi");
@@ -5413,9 +5417,11 @@ async function main() {
   }
   const apiUrl = args.values.api || process.env.MULTI_API_URL || "https://multi-api.adnb3r.workers.dev";
   const config = loadConfig();
+  if (config.token)
+    setAuthToken(config.token);
   switch (command) {
     case "setup":
-      await cmdSetup(args.values.name, args.values.workspace, apiUrl);
+      await cmdSetup(args.values.name, apiUrl);
       break;
     case "connect":
     case "start":
@@ -5466,12 +5472,8 @@ Examples:
   multi-agent connect
 `);
 }
-async function cmdSetup(name, workspaceId, apiUrl) {
+async function cmdSetup(name, apiUrl) {
   ensureDirs();
-  if (!workspaceId) {
-    console.log("\u274C Workspace ID required. Run: multi-agent setup --workspace <id>");
-    process.exit(1);
-  }
   console.log("\uD83D\uDD0D Detecting local agent runtimes...");
   const detected = await detectAgents();
   for (const a of detected)
@@ -5480,23 +5482,62 @@ async function cmdSetup(name, workspaceId, apiUrl) {
     console.log("  (none detected \u2014 stub runtime will be used)");
   const deviceName = name || process.env.HOSTNAME || "Unknown Device";
   console.log(`
-\uD83D\uDCDD Registering device "${deviceName}"...`);
-  const result = await apiClient.post(`${apiUrl}/api/devices/register`, {
-    workspace_id: workspaceId,
+\uD83D\uDCE1 Requesting pairing code for "${deviceName}"...`);
+  const start = await apiClient.post(`${apiUrl}/api/pair/start`, {
     name: deviceName,
     platform: process.platform,
     arch: process.arch,
     os_version: process.version,
     detected_runtimes: detected.map((a) => a.type)
   });
-  if (!result.success || !result.data) {
+  if (!start.success || !start.data) {
+    console.log(`
+\u274C Failed to start pairing:`, start.error);
+    process.exit(1);
+  }
+  const { code } = start.data;
+  const pairUrl = `${apiUrl}/pair/${code}`;
+  console.log(`
+\uD83D\uDC49 Open this URL in your browser to approve:
+
+   ${pairUrl}
+`);
+  console.log(`   Or enter code manually: ${code}`);
+  console.log(`
+\u23F3 Waiting for approval (10 min timeout)...`);
+  const deadline = Date.now() + 10 * 60 * 1000;
+  let approved = null;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    const poll = await apiClient.get(`${apiUrl}/api/pair/poll/${code}`);
+    if (!poll.success) {
+      if (poll.status === 410) {
+        console.log(`
+\u274C Pairing expired. Run setup again.`);
+        process.exit(1);
+      }
+      continue;
+    }
+    if (poll.data?.status === "approved") {
+      approved = { device_id: poll.data.device_id, token: poll.data.token };
+      break;
+    }
+  }
+  if (!approved) {
     console.log(`
-\u274C Registration failed:`, result.error);
+\u274C Timed out.`);
     process.exit(1);
   }
-  console.log(`\u2705 Device registered. ID: ${result.data.id}`);
-  saveConfig({ deviceId: result.data.id, workspaceId, apiUrl });
-  await syncSkills(apiUrl, workspaceId);
+  console.log(`
+\u2705 Device paired. ID: ${approved.device_id}`);
+  saveConfig({ deviceId: approved.device_id, token: approved.token, apiUrl });
+  setAuthToken(approved.token);
+  const dev = await apiClient.get(`${apiUrl}/api/devices/${approved.device_id}`);
+  const workspaceId = dev.data?.workspace_id;
+  if (workspaceId) {
+    saveConfig({ deviceId: approved.device_id, token: approved.token, workspaceId, apiUrl });
+    await syncSkills(apiUrl, workspaceId);
+  }
   console.log(`
 Next: link to an agent with: multi-agent link --agent <agentId>`);
   console.log("Then: multi-agent connect");
@@ -5549,7 +5590,7 @@ async function cmdConnect(apiUrl, config) {
   log(`\uD83D\uDE80 Connecting device ${config.deviceId} (pid ${process.pid})`);
   log(`   runtimes: ${detected.map((d) => d.type).join(", ") || "stub"}`);
   await apiClient.post(`${apiUrl}/api/devices/${config.deviceId}/heartbeat`, { status: "online" });
-  const wsUrl = apiUrl.replace(/^http/, "ws") + `/ws/devices/${config.deviceId}`;
+  const wsUrl = apiUrl.replace(/^http/, "ws") + `/ws/devices/${config.deviceId}?token=${encodeURIComponent(config.token || "")}`;
   let ws = null;
   let running = true;
   const shutdown = async (reason) => {
@@ -5608,9 +5649,19 @@ async function cmdConnect(apiUrl, config) {
 async function handleRunTask(apiUrl, deviceId, task, detected) {
   const issueId = task.issue_id;
   const isFollowup = !!task.followup;
-  log(`\u25B6 run_task ${task.key}: ${isFollowup ? "(follow-up) " : ""}${task.title}`);
+  const workingDir = task.working_dir && existsSync2(task.working_dir) ? task.working_dir : undefined;
+  log(`\u25B6 run_task ${task.key}: ${isFollowup ? "(follow-up) " : ""}${task.title}${workingDir ? ` [cwd: ${workingDir}]` : ""}`);
   await apiClient.patch(`${apiUrl}/api/issues/${issueId}`, { status: "in_progress" });
   await postStream(apiUrl, issueId, "progress", { message: `Device ${deviceId} picked up ${isFollowup ? "follow-up" : "task"}` });
+  let attachmentRefs = [];
+  if (task.from_comment_id) {
+    const baseDir = workingDir || join(MULTI_DIR, "tmp", issueId);
+    const inDir = join(baseDir, ".multi-in", task.from_comment_id);
+    attachmentRefs = await downloadCommentAttachments(apiUrl, task.from_comment_id, inDir);
+    if (attachmentRefs.length)
+      log(`  fetched ${attachmentRefs.length} attachment(s) \u2192 ${inDir}`);
+  }
+  const outDir = join(workingDir || join(MULTI_DIR, "tmp", issueId), ".multi-out");
   let liveCommentId;
   let liveBody = "";
   let hadError = false;
@@ -5814,6 +5865,22 @@ ${task.description || ""}`.trim();
 ---
 Context (original task ${task.key}): ${task.title}` : base || task.title;
       userPart = stripSelfMention(userPart, preferType);
+      if (attachmentRefs.length) {
+        const lines = attachmentRefs.map((a) => `- ${a.filename}: ${a.path}`).join(`
+`);
+        userPart += `
+
+---
+Attached files (on local disk, read them with your tools):
+${lines}
+
+To return generated files, write them to: ${outDir}`;
+      } else {
+        userPart += `
+
+---
+To return generated files, write them to: ${outDir}`;
+      }
       let preamble = "";
       try {
         const agentRes = await apiClient.get(`${apiUrl}/api/agents/${task.agent_id}`);
@@ -5866,6 +5933,7 @@ ${userPart}` : userPart;
         prompt,
         sessionId: task.session_id || null,
         adapterBin,
+        cwd: workingDir,
         onEvent: eventHandler,
         onSession: async (sid) => {
           try {
@@ -5885,6 +5953,11 @@ ${userPart}` : userPart;
       for await (const event of runner(task))
         await eventHandler(event);
     }
+    if (liveCommentId) {
+      const n = await uploadOutputDir(apiUrl, liveCommentId, outDir);
+      if (n > 0)
+        log(`  \uD83D\uDCCE uploaded ${n} output file(s)`);
+    }
     if (hadError) {
       await apiClient.post(`${apiUrl}/api/issues/${issueId}/fail`, {});
       log(`  \u2717 ${task.key} failed`);
@@ -5945,6 +6018,80 @@ async function resolveAcpAdapter(agentType, detectedPath) {
 async function postStream(apiUrl, issueId, event_type, payload) {
   await apiClient.post(`${apiUrl}/api/streams/${issueId}`, { event_type, payload });
 }
+async function downloadCommentAttachments(apiUrl, commentId, destDir) {
+  try {
+    const list = await apiClient.get(`${apiUrl}/api/attachments/comments/${commentId}`);
+    const items = list.data?.results || list.data || [];
+    if (!Array.isArray(items) || items.length === 0)
+      return [];
+    mkdirSync2(destDir, { recursive: true });
+    const token = authTokenHeader();
+    const out = [];
+    for (const it of items) {
+      const res = await fetch(`${apiUrl}/api/attachments/${it.id}`, { headers: token ? { Authorization: token } : {} });
+      if (!res.ok)
+        continue;
+      const buf = new Uint8Array(await res.arrayBuffer());
+      const safe = it.filename.replace(/[^A-Za-z0-9._-]/g, "_");
+      const p = join(destDir, safe);
+      writeFileSync2(p, buf);
+      out.push({ filename: it.filename, path: p });
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+function authTokenHeader() {
+  const cfg = loadConfig();
+  return cfg.token ? `Bearer ${cfg.token}` : null;
+}
+async function uploadOutputDir(apiUrl, commentId, dir) {
+  if (!existsSync2(dir))
+    return 0;
+  const files = [];
+  const walk = (d, depth = 0) => {
+    if (depth > 3)
+      return;
+    for (const name of readdirSync(d)) {
+      const p = join(d, name);
+      try {
+        const st = statSync(p);
+        if (st.isDirectory())
+          walk(p, depth + 1);
+        else if (st.isFile())
+          files.push(p);
+      } catch {}
+    }
+  };
+  walk(dir);
+  if (!files.length)
+    return 0;
+  const token = authTokenHeader();
+  let uploaded = 0;
+  for (const f of files) {
+    try {
+      const data = readFileSync2(f);
+      const form = new FormData;
+      const blob = new Blob([data]);
+      form.append("file", blob, f.split("/").pop() || "file");
+      const res = await fetch(`${apiUrl}/api/attachments/comments/${commentId}`, {
+        method: "POST",
+        body: form,
+        headers: token ? { Authorization: token } : {}
+      });
+      if (res.ok) {
+        uploaded++;
+        try {
+          unlinkSync(f);
+        } catch {}
+      }
+    } catch (e) {
+      log(`upload failed for ${f}: ${String(e)}`);
+    }
+  }
+  return uploaded;
+}
 function pickRunner(detected, preferType) {
   const forceStub = process.env.MULTI_STUB === "1";
   if (forceStub || !detected.length)
@@ -5976,7 +6123,7 @@ Context (original task ${task.key}): ${task.title}` : base || task.title;
     yield { event_type: "progress", payload: { message: `spawning ${agent.type}`, cmd: `${agent.path} ${args.slice(0, 2).join(" ")} \u2026` } };
     let proc;
     try {
-      proc = Bun.spawn([agent.path, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore" });
+      proc = Bun.spawn([agent.path, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd: task?.working_dir || undefined });
     } catch (e) {
       yield { event_type: "error", payload: { message: `spawn failed: ${String(e)}` } };
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipers-dev/multi",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "type": "module",
   "bin": {
     "multi-agent": "./dist/index.js"

package/src/client.ts

@@ -2,29 +2,35 @@ interface ApiResponse<T = unknown> {
   success: boolean;
   data?: T;
   error?: string;
+  status?: number;
+}
+
+let authToken: string | null = null;
+
+export function setAuthToken(token: string | null) {
+  authToken = token;
 }
 
 async function request<T>(url: string, options?: RequestInit): Promise<ApiResponse<T>> {
   try {
-    const response = await fetch(url, {
-      ...options,
-      headers: {
-        'Content-Type': 'application/json',
-        ...options?.headers,
-      },
-    });
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      ...(options?.headers as Record<string, string> | undefined),
+    };
+    if (authToken && !headers['Authorization']) headers['Authorization'] = `Bearer ${authToken}`;
 
-    const raw = await response.json();
+    const response = await fetch(url, { ...options, headers });
+    const raw = await response.json().catch(() => ({}));
 
     if (!response.ok) {
-      return { success: false, error: (raw as any)?.error || `HTTP ${response.status}` };
+      return { success: false, error: (raw as any)?.error || `HTTP ${response.status}`, status: response.status };
     }
 
     const data = (raw && typeof raw === 'object' && 'results' in (raw as any))
       ? (raw as any).results
       : raw;
 
-    return { success: true, data };
+    return { success: true, data, status: response.status };
   } catch (error) {
     return { success: false, error: String(error) };
   }

package/src/index.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env bun
 
 import { detectAgents } from './detect';
-import { apiClient } from './client';
+import { apiClient, setAuthToken } from './client';
 import { runAcp } from './acp-runner';
 import { parseArgs } from 'util';
-import { mkdirSync, existsSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
+import { mkdirSync, existsSync, writeFileSync, readFileSync, appendFileSync, unlinkSync, readdirSync, statSync } from 'fs';
 import { join, dirname } from 'path';
 
 const HOME = process.env.HOME || process.env.USERPROFILE || '.';
@@ -61,10 +61,11 @@ async function main() {
 
   const apiUrl = args.values.api || process.env.MULTI_API_URL || 'https://multi-api.adnb3r.workers.dev';
   const config = loadConfig();
+  if (config.token) setAuthToken(config.token);
 
   switch (command) {
     case 'setup':
-      await cmdSetup(args.values.name, args.values.workspace, apiUrl);
+      await cmdSetup(args.values.name, apiUrl);
       break;
     case 'connect':
     case 'start':
@@ -117,12 +118,8 @@ Examples:
 `);
 }
 
-async function cmdSetup(name?: string, workspaceId?: string, apiUrl?: string) {
+async function cmdSetup(name?: string, apiUrl?: string) {
   ensureDirs();
-  if (!workspaceId) {
-    console.log('❌ Workspace ID required. Run: multi-agent setup --workspace <id>');
-    process.exit(1);
-  }
 
   console.log('🔍 Detecting local agent runtimes...');
   const detected = await detectAgents();
@@ -130,25 +127,53 @@ async function cmdSetup(name?: string, workspaceId?: string, apiUrl?: string) {
   if (!detected.length) console.log('  (none detected — stub runtime will be used)');
 
   const deviceName = name || process.env.HOSTNAME || 'Unknown Device';
-  console.log(`\n📝 Registering device "${deviceName}"...`);
+  console.log(`\n📡 Requesting pairing code for "${deviceName}"...`);
 
-  const result = await apiClient.post<{ id: string }>(`${apiUrl}/api/devices/register`, {
-    workspace_id: workspaceId,
+  const start = await apiClient.post<{ code: string; expires_at: number }>(`${apiUrl}/api/pair/start`, {
     name: deviceName,
     platform: process.platform,
     arch: process.arch,
     os_version: process.version,
     detected_runtimes: detected.map(a => a.type),
   });
-
-  if (!result.success || !result.data) {
-    console.log('\n❌ Registration failed:', result.error);
+  if (!start.success || !start.data) {
+    console.log('\n❌ Failed to start pairing:', start.error);
     process.exit(1);
   }
 
-  console.log(`✅ Device registered. ID: ${result.data.id}`);
-  saveConfig({ deviceId: result.data.id, workspaceId, apiUrl });
-  await syncSkills(apiUrl!, workspaceId);
+  const { code } = start.data;
+  const pairUrl = `${apiUrl}/pair/${code}`;
+  console.log(`\n👉 Open this URL in your browser to approve:\n\n   ${pairUrl}\n`);
+  console.log(`   Or enter code manually: ${code}`);
+  console.log('\n⏳ Waiting for approval (10 min timeout)...');
+
+  const deadline = Date.now() + 10 * 60 * 1000;
+  let approved: { device_id: string; token: string } | null = null;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    const poll = await apiClient.get<any>(`${apiUrl}/api/pair/poll/${code}`);
+    if (!poll.success) {
+      if (poll.status === 410) { console.log('\n❌ Pairing expired. Run setup again.'); process.exit(1); }
+      continue;
+    }
+    if (poll.data?.status === 'approved') {
+      approved = { device_id: poll.data.device_id, token: poll.data.token };
+      break;
+    }
+  }
+  if (!approved) { console.log('\n❌ Timed out.'); process.exit(1); }
+
+  console.log(`\n✅ Device paired. ID: ${approved.device_id}`);
+  saveConfig({ deviceId: approved.device_id, token: approved.token, apiUrl });
+  setAuthToken(approved.token);
+
+  // Fetch workspace_id from device (now authed)
+  const dev = await apiClient.get<any>(`${apiUrl}/api/devices/${approved.device_id}`);
+  const workspaceId = dev.data?.workspace_id;
+  if (workspaceId) {
+    saveConfig({ deviceId: approved.device_id, token: approved.token, workspaceId, apiUrl });
+    await syncSkills(apiUrl!, workspaceId);
+  }
   console.log('\nNext: link to an agent with: multi-agent link --agent <agentId>');
   console.log('Then: multi-agent connect');
 }
@@ -204,7 +229,7 @@ async function cmdConnect(apiUrl: string, config: Config) {
 
   await apiClient.post(`${apiUrl}/api/devices/${config.deviceId}/heartbeat`, { status: 'online' });
 
-  const wsUrl = apiUrl.replace(/^http/, 'ws') + `/ws/devices/${config.deviceId}`;
+  const wsUrl = apiUrl.replace(/^http/, 'ws') + `/ws/devices/${config.deviceId}?token=${encodeURIComponent(config.token || '')}`;
   let ws: WebSocket | null = null;
   let running = true;
 
@@ -259,11 +284,22 @@ async function cmdConnect(apiUrl: string, config: Config) {
 async function handleRunTask(apiUrl: string, deviceId: string, task: any, detected: { type: string; path: string }[]) {
   const issueId = task.issue_id;
   const isFollowup = !!task.followup;
-  log(`▶ run_task ${task.key}: ${isFollowup ? '(follow-up) ' : ''}${task.title}`);
+  const workingDir = task.working_dir && existsSync(task.working_dir) ? task.working_dir : undefined;
+  log(`▶ run_task ${task.key}: ${isFollowup ? '(follow-up) ' : ''}${task.title}${workingDir ? ` [cwd: ${workingDir}]` : ''}`);
 
   await apiClient.patch(`${apiUrl}/api/issues/${issueId}`, { status: 'in_progress' });
   await postStream(apiUrl, issueId, 'progress', { message: `Device ${deviceId} picked up ${isFollowup ? 'follow-up' : 'task'}` });
 
+  // Fetch attachments from originating comment into a scratch dir under working_dir (or tmp)
+  let attachmentRefs: { filename: string; path: string }[] = [];
+  if (task.from_comment_id) {
+    const baseDir = workingDir || join(MULTI_DIR, 'tmp', issueId);
+    const inDir = join(baseDir, '.multi-in', task.from_comment_id);
+    attachmentRefs = await downloadCommentAttachments(apiUrl, task.from_comment_id, inDir);
+    if (attachmentRefs.length) log(`  fetched ${attachmentRefs.length} attachment(s) → ${inDir}`);
+  }
+  const outDir = join(workingDir || join(MULTI_DIR, 'tmp', issueId), '.multi-out');
+
   let liveCommentId: string | undefined;
   let liveBody = '';
   let hadError = false;
@@ -438,6 +474,12 @@ async function handleRunTask(apiUrl: string, deviceId: string, task: any, detect
         ? `${task.followup}\n\n---\nContext (original task ${task.key}): ${task.title}`
         : (base || task.title);
       userPart = stripSelfMention(userPart, preferType);
+      if (attachmentRefs.length) {
+        const lines = attachmentRefs.map(a => `- ${a.filename}: ${a.path}`).join('\n');
+        userPart += `\n\n---\nAttached files (on local disk, read them with your tools):\n${lines}\n\nTo return generated files, write them to: ${outDir}`;
+      } else {
+        userPart += `\n\n---\nTo return generated files, write them to: ${outDir}`;
+      }
 
       // Pull agent + linked skills to construct system/context preamble
       let preamble = '';
@@ -477,6 +519,7 @@ async function handleRunTask(apiUrl: string, deviceId: string, task: any, detect
         apiUrl, issueId, deviceId, prompt,
         sessionId: task.session_id || null,
         adapterBin,
+        cwd: workingDir,
         onEvent: eventHandler,
         onSession: async (sid) => {
           try { await apiClient.patch(`${apiUrl}/api/issues/${issueId}`, { session_id: sid } as any); } catch {}
@@ -494,6 +537,12 @@ async function handleRunTask(apiUrl: string, deviceId: string, task: any, detect
       for await (const event of runner(task)) await eventHandler(event);
     }
 
+    // Upload any files the agent wrote to .multi-out as attachments on the live comment
+    if (liveCommentId) {
+      const n = await uploadOutputDir(apiUrl, liveCommentId, outDir);
+      if (n > 0) log(`  📎 uploaded ${n} output file(s)`);
+    }
+
     if (hadError) { await apiClient.post(`${apiUrl}/api/issues/${issueId}/fail`, {}); log(`  ✗ ${task.key} failed`); }
     else { await apiClient.post(`${apiUrl}/api/issues/${issueId}/complete`, {}); log(`  ✓ ${task.key} complete`); }
   } catch (e) {
@@ -552,6 +601,69 @@ async function postStream(apiUrl: string, issueId: string, event_type: string, p
   await apiClient.post(`${apiUrl}/api/streams/${issueId}`, { event_type, payload });
 }
 
+// Download attachments of a comment to a local dir. Returns list of absolute paths.
+async function downloadCommentAttachments(apiUrl: string, commentId: string, destDir: string): Promise<{ filename: string; path: string }[]> {
+  try {
+    const list = await apiClient.get<any>(`${apiUrl}/api/attachments/comments/${commentId}`);
+    const items = list.data?.results || list.data || [];
+    if (!Array.isArray(items) || items.length === 0) return [];
+    mkdirSync(destDir, { recursive: true });
+    const token = authTokenHeader();
+    const out: { filename: string; path: string }[] = [];
+    for (const it of items) {
+      const res = await fetch(`${apiUrl}/api/attachments/${it.id}`, { headers: token ? { Authorization: token } : {} });
+      if (!res.ok) continue;
+      const buf = new Uint8Array(await res.arrayBuffer());
+      const safe = it.filename.replace(/[^A-Za-z0-9._-]/g, '_');
+      const p = join(destDir, safe);
+      writeFileSync(p, buf);
+      out.push({ filename: it.filename, path: p });
+    }
+    return out;
+  } catch { return []; }
+}
+
+function authTokenHeader(): string | null {
+  const cfg = loadConfig();
+  return cfg.token ? `Bearer ${cfg.token}` : null;
+}
+
+// Scan a directory for files (recursive, shallow cap) and upload each as an attachment to a comment.
+async function uploadOutputDir(apiUrl: string, commentId: string, dir: string): Promise<number> {
+  if (!existsSync(dir)) return 0;
+  const files: string[] = [];
+  const walk = (d: string, depth = 0) => {
+    if (depth > 3) return;
+    for (const name of readdirSync(d)) {
+      const p = join(d, name);
+      try {
+        const st = statSync(p);
+        if (st.isDirectory()) walk(p, depth + 1);
+        else if (st.isFile()) files.push(p);
+      } catch {}
+    }
+  };
+  walk(dir);
+  if (!files.length) return 0;
+  const token = authTokenHeader();
+  let uploaded = 0;
+  for (const f of files) {
+    try {
+      const data = readFileSync(f);
+      const form = new FormData();
+      const blob = new Blob([data]);
+      form.append('file', blob, f.split('/').pop() || 'file');
+      const res = await fetch(`${apiUrl}/api/attachments/comments/${commentId}`, {
+        method: 'POST',
+        body: form,
+        headers: token ? { Authorization: token } : {},
+      });
+      if (res.ok) { uploaded++; try { unlinkSync(f); } catch {} }
+    } catch (e) { log(`upload failed for ${f}: ${String(e)}`); }
+  }
+  return uploaded;
+}
+
 type StreamEvent = { event_type: 'progress' | 'stdout' | 'stderr' | 'tool_call' | 'done' | 'error'; payload: any };
 type Runner = (task: any) => AsyncGenerator<StreamEvent>;
 
@@ -585,7 +697,7 @@ function makeCliRunner(agent: { type: string; path: string }): Runner {
 
     let proc: ReturnType<typeof Bun.spawn>;
     try {
-      proc = Bun.spawn([agent.path, ...args], { stdout: 'pipe', stderr: 'pipe', stdin: 'ignore' });
+      proc = Bun.spawn([agent.path, ...args], { stdout: 'pipe', stderr: 'pipe', stdin: 'ignore', cwd: (task as any)?.working_dir || undefined });
     } catch (e) {
       yield { event_type: 'error', payload: { message: `spawn failed: ${String(e)}` } };
       return;
@@ -777,6 +889,7 @@ interface Config {
   deviceId?: string;
   workspaceId?: string;
   apiUrl?: string;
+  token?: string;
   // legacy
   agentId?: string;
 }