@stigmer/cli 3.0.8

package/src/resources/reference.test.ts

@@ -0,0 +1,107 @@
+import { describe, expect, it } from "vitest";
+import {
+  hasResourceIdPrefix,
+  isAgentId,
+  isSessionId,
+  isWorkflowId,
+  parseReference,
+  validateResourceId,
+} from "./reference.js";
+
+// A syntactically valid 26-char ULID body for building complete IDs in tests.
+const ULID = "01arz3ndektsv4rrffq69g5fav";
+
+describe("parseReference", () => {
+  it("parses an org/slug pair", () => {
+    expect(parseReference("acme/my-agent", "default-org", "agt")).toEqual({
+      kind: "ref",
+      org: "acme",
+      slug: "my-agent",
+    });
+  });
+
+  it("treats a bare id-prefixed token as an ID", () => {
+    expect(parseReference("agt_abc123", "acme", "agt")).toEqual({ kind: "id", id: "agt_abc123" });
+  });
+
+  it("treats a bare token without the id prefix as a slug in the default org", () => {
+    expect(parseReference("my-agent", "acme", "agt")).toEqual({
+      kind: "ref",
+      org: "acme",
+      slug: "my-agent",
+    });
+  });
+
+  it("does not mistake a slug that merely contains the prefix for an ID", () => {
+    // "agent-foo" starts with "agt"? no — prefix match requires "agt_".
+    expect(parseReference("agent-foo", "acme", "agt")).toEqual({
+      kind: "ref",
+      org: "acme",
+      slug: "agent-foo",
+    });
+  });
+
+  it("trims surrounding whitespace", () => {
+    expect(parseReference("  acme/release  ", "default", "wkf")).toEqual({
+      kind: "ref",
+      org: "acme",
+      slug: "release",
+    });
+  });
+
+  it("falls back to a slug when no id prefix is configured", () => {
+    expect(parseReference("something", "acme", "")).toEqual({
+      kind: "ref",
+      org: "acme",
+      slug: "something",
+    });
+  });
+});
+
+describe("resource-ID classification", () => {
+  it("detects kind prefixes with either separator", () => {
+    expect(isAgentId(`agt_${ULID}`)).toBe(true);
+    expect(isAgentId(`agt-${ULID}`)).toBe(true);
+    expect(isSessionId(`ses_${ULID}`)).toBe(true);
+    expect(isWorkflowId(`wfl_${ULID}`)).toBe(true);
+  });
+
+  it("does not classify cross-kind prefixes", () => {
+    expect(isAgentId(`ses_${ULID}`)).toBe(false);
+    expect(isSessionId(`agt_${ULID}`)).toBe(false);
+    expect(isWorkflowId(`agt_${ULID}`)).toBe(false);
+  });
+
+  it("does not mistake a slug that merely starts with a prefix for an ID", () => {
+    // "agent-foo" begins with "agt"? No — the separator must immediately follow.
+    expect(isAgentId("agent-foo")).toBe(false);
+    expect(hasResourceIdPrefix("agent-foo")).toBe(false);
+  });
+
+  it("is case-sensitive (uppercase prefixes are not IDs)", () => {
+    expect(isAgentId(`AGT_${ULID}`)).toBe(false);
+  });
+
+  it("recognizes any known prefix via hasResourceIdPrefix (length-agnostic)", () => {
+    expect(hasResourceIdPrefix("agt_short")).toBe(true);
+    expect(hasResourceIdPrefix("wex_anything")).toBe(true);
+    expect(hasResourceIdPrefix("mcp-x")).toBe(true);
+    expect(hasResourceIdPrefix("plain-slug")).toBe(false);
+  });
+
+  it("validates a complete ID (prefix + 26-char ULID)", () => {
+    expect(validateResourceId(`agt_${ULID}`)).toBeNull();
+    expect(validateResourceId(`ses-${ULID}`)).toBeNull();
+  });
+
+  it("reports an incomplete ID when the prefix matches but the body is wrong", () => {
+    expect(validateResourceId("agt_tooshort")).toMatch(/incomplete/);
+    expect(validateResourceId(`agt_${ULID}extra`)).toMatch(/incomplete/);
+  });
+
+  it("accepts a legacy UUID and rejects unrelated tokens", () => {
+    expect(validateResourceId("123e4567-e89b-12d3-a456-426614174000")).toBeNull();
+    expect(hasResourceIdPrefix("123e4567-e89b-12d3-a456-426614174000")).toBe(true);
+    expect(validateResourceId("just-a-slug")).toMatch(/not a recognized/);
+  });
+});

package/src/resources/reference.ts

@@ -0,0 +1,140 @@
+// Parse a user-supplied resource reference into either an ID lookup or an
+// org/slug lookup, mirroring the Go CLI's parseOrgSlug + ID detection.
+//
+//   "agt_abc123"        -> by ID
+//   "my-org/my-agent"   -> by org/slug (explicit org)
+//   "my-agent"          -> by org/slug (org from --org/context)
+//
+// The kind's id_prefix disambiguates a bare token: "org" resolves "org_x" as an
+// ID but "acme" as a slug.
+//
+// The lower half of this module adds the *strict* classification the run/resume
+// resolvers need (Go's pkg/reference): prefix-by-kind detection and full ID
+// validation (prefix + 26-char ULID, or UUID). This is deliberately distinct
+// from parseReference's lenient `${prefix}_` test — `run my-agent` must not
+// treat a slug that merely starts with a known prefix as an ID.
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { KIND_META } from "../registry/index.js";
+
+export type ParsedReference =
+  | { readonly kind: "id"; readonly id: string }
+  | { readonly kind: "ref"; readonly org: string; readonly slug: string };
+
+export function parseReference(ref: string, defaultOrg: string, idPrefix: string): ParsedReference {
+  const trimmed = ref.trim();
+
+  const slash = trimmed.indexOf("/");
+  if (slash > 0) {
+    return { kind: "ref", org: trimmed.slice(0, slash), slug: trimmed.slice(slash + 1) };
+  }
+
+  if (idPrefix !== "" && trimmed.startsWith(`${idPrefix}_`)) {
+    return { kind: "id", id: trimmed };
+  }
+
+  return { kind: "ref", org: defaultOrg, slug: trimmed };
+}
+
+// Crockford base-32 ULID body length. Mirrors Go's reference.ulidLength: the
+// resolver only checks the length (not the alphabet), so a 26-char body after a
+// known prefix is accepted as a complete ID.
+const ULID_LENGTH = 26;
+
+// Execution-runtime prefixes that are not in KIND_META (which only carries the
+// addressable, registry-relevant kinds) but that the run resolver must still
+// recognize so it can reject them with explicit-form guidance. "wex" is the
+// workflow-execution prefix; "aex" is already in KIND_META.
+const RUNTIME_ID_PREFIXES: readonly string[] = ["wex"];
+
+/** The id_prefix for a kind (from the proto kind_meta mirror), or "". */
+function idPrefixFor(kind: ApiResourceKind): string {
+  return KIND_META.get(kind)?.idPrefix ?? "";
+}
+
+// Every known resource-ID prefix, deduped. Built once from the kind_meta mirror
+// plus the runtime prefixes so there is a single source of truth shared with
+// the rest of the CLI (the registry) rather than a hand-rolled prefix list.
+const ALL_ID_PREFIXES: readonly string[] = (() => {
+  const set = new Set<string>(RUNTIME_ID_PREFIXES);
+  for (const meta of KIND_META.values()) {
+    if (meta.idPrefix !== "") set.add(meta.idPrefix);
+  }
+  return [...set];
+})();
+
+// Mirrors Go's reference.isResourceIDWithKind: a kind prefix followed by either
+// separator the backend accepts ("_" canonical, "-" legacy). Case-sensitive.
+function hasKindPrefix(ref: string, prefix: string): boolean {
+  if (prefix === "") return false;
+  const trimmed = ref.trim();
+  return trimmed.startsWith(`${prefix}_`) || trimmed.startsWith(`${prefix}-`);
+}
+
+/** True if `ref` carries the agent ID prefix (`agt_…`/`agt-…`). */
+export function isAgentId(ref: string): boolean {
+  return hasKindPrefix(ref, idPrefixFor(ApiResourceKind.agent));
+}
+
+/** True if `ref` carries the workflow ID prefix (`wfl_…`/`wfl-…`). */
+export function isWorkflowId(ref: string): boolean {
+  return hasKindPrefix(ref, idPrefixFor(ApiResourceKind.workflow));
+}
+
+/** True if `ref` carries the session ID prefix (`ses_…`/`ses-…`). */
+export function isSessionId(ref: string): boolean {
+  return hasKindPrefix(ref, idPrefixFor(ApiResourceKind.session));
+}
+
+/**
+ * True if `ref` starts with ANY known resource-ID prefix (length-agnostic).
+ * Mirrors Go's reference.HasResourceIDPrefix: use it to detect *intent* (the
+ * user typed something ID-shaped), then {@link validateResourceId} to enforce
+ * completeness.
+ */
+export function hasResourceIdPrefix(ref: string): boolean {
+  if (ALL_ID_PREFIXES.some((prefix) => hasKindPrefix(ref, prefix))) return true;
+  return isUuid(ref.trim());
+}
+
+/**
+ * Validate that `ref` is a syntactically complete resource ID. Returns null
+ * when valid, or a user-facing error message otherwise. Mirrors Go's
+ * reference.ValidateResourceID/ResourceIDKind: a known prefix followed by a
+ * 26-char ULID body, or a bare UUID (legacy). A matched prefix with the wrong
+ * body length is reported as "incomplete" so callers can guide the user to
+ * paste the full ID.
+ */
+export function validateResourceId(ref: string): string | null {
+  const trimmed = ref.trim();
+  for (const prefix of ALL_ID_PREFIXES) {
+    for (const sep of ["_", "-"]) {
+      const pfx = `${prefix}${sep}`;
+      if (!trimmed.startsWith(pfx)) continue;
+      const body = trimmed.slice(pfx.length);
+      if (body.length !== ULID_LENGTH) {
+        return "incomplete resource ID: expected 26-character ULID after prefix";
+      }
+      return null;
+    }
+  }
+  if (isUuid(trimmed)) return null;
+  return "not a recognized resource ID";
+}
+
+// Mirrors Go's reference.isUUID: 8-4-4-4-12 hex with hyphens at fixed offsets.
+function isUuid(value: string): boolean {
+  if (value.length !== 36) return false;
+  if (value[8] !== "-" || value[13] !== "-" || value[18] !== "-" || value[23] !== "-") {
+    return false;
+  }
+  for (let i = 0; i < value.length; i++) {
+    if (i === 8 || i === 13 || i === 18 || i === 23) continue;
+    if (!isHexDigit(value[i])) return false;
+  }
+  return true;
+}
+
+function isHexDigit(c: string): boolean {
+  return (c >= "0" && c <= "9") || (c >= "a" && c <= "f") || (c >= "A" && c <= "F");
+}

package/src/resources/render.ts

@@ -0,0 +1,118 @@
+// Uniform rendering for read verbs.
+//
+// All resource protos share the ApiResourceMetadata envelope, so the human
+// (table) view of a single `get` is derived generically from the protojson
+// projection — no per-kind formatter. json/yaml use the canonical protojson
+// renderers for full fidelity and Go byte-parity. Collections render via the
+// shared table renderer with a caller-supplied row extractor.
+//
+// The render boundary intentionally uses the base proto types (DescMessage /
+// Message) so generic verb dispatch can pass a (schema, message) pair without
+// threading a concrete type parameter through the registry.
+
+import type { DescMessage, JsonValue, Message } from "@bufbuild/protobuf";
+import type { OutputFormat } from "../output/index.js";
+import {
+  protoToJsonValue,
+  renderEmpty,
+  renderProtoJson,
+  renderProtoListJson,
+  renderProtoListYaml,
+  renderProtoYaml,
+  renderTable,
+} from "../output/index.js";
+
+export type JsonObject = Record<string, JsonValue>;
+
+/** A row extractor + headers describing a collection's table view. */
+export interface TableShape {
+  readonly resourceName: string;
+  readonly headers: readonly string[];
+  readonly row: (json: JsonObject) => readonly string[];
+}
+
+/** Render a single resource for a read verb (json/yaml = protojson; table = fields). */
+export function renderResource(schema: DescMessage, message: Message, format: OutputFormat): string {
+  if (format === "json") return renderProtoJson(schema, message);
+  if (format === "yaml") return renderProtoYaml(schema, message);
+  return renderResourceFields(protoToJsonValue(schema, message));
+}
+
+/** Render a collection for a read verb (json/yaml = protojson array; table = grid). */
+export function renderCollection(
+  schema: DescMessage,
+  messages: readonly Message[],
+  format: OutputFormat,
+  table: TableShape,
+): string {
+  if (format === "json") return renderProtoListJson(schema, messages);
+  if (format === "yaml") return renderProtoListYaml(schema, messages);
+  if (messages.length === 0) return renderEmpty(table.resourceName);
+  const rows = messages.map((message) => table.row(asObject(protoToJsonValue(schema, message))));
+  return `\n${renderTable(table.headers, rows)}`;
+}
+
+/**
+ * Render a *list message* (e.g. AgentExecutionList, SessionList) for a read verb.
+ *
+ * Unlike `renderCollection`, which serializes a bare slice, this mirrors Go's
+ * `DisplayProto(list, ...)`: json/yaml emit the whole list envelope (including
+ * `total_pages`), while table projects the nested `entries` into a grid.
+ */
+export function renderListMessage(
+  schema: DescMessage,
+  message: Message,
+  format: OutputFormat,
+  table: TableShape,
+): string {
+  if (format === "json") return renderProtoJson(schema, message);
+  if (format === "yaml") return renderProtoYaml(schema, message);
+  const entries = protoToJsonValue(schema, message);
+  const list = asObject(entries).entries;
+  const rows = (Array.isArray(list) ? list : []).map((entry) => table.row(asObject(entry)));
+  if (rows.length === 0) return renderEmpty(table.resourceName);
+  return `\n${renderTable(table.headers, rows)}`;
+}
+
+// Human field view of a resource's metadata envelope (+ common spec fields).
+function renderResourceFields(json: JsonValue): string {
+  const obj = asObject(json);
+  const metadata = asObject(obj.metadata);
+  const spec = asObject(obj.spec);
+
+  const fields: Array<[string, string]> = [];
+  pushField(fields, "ID", metadata.id);
+  pushField(fields, "Name", metadata.name);
+  pushField(fields, "Slug", metadata.slug);
+  pushField(fields, "Org", metadata.org);
+  pushField(fields, "Visibility", metadata.visibility);
+  pushField(fields, "Description", spec.description);
+
+  const width = Math.max(0, ...fields.map(([key]) => key.length));
+  const lines = fields.map(([key, value]) => `  ${key}:${" ".repeat(width - key.length + 2)}${value}`);
+  return `\n${lines.join("\n")}\n`;
+}
+
+function pushField(fields: Array<[string, string]>, key: string, value: JsonValue | undefined): void {
+  if (typeof value === "string" && value !== "") fields.push([key, value]);
+}
+
+function asObject(value: JsonValue | undefined): JsonObject {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? (value as JsonObject) : {};
+}
+
+/** Read a string field from a protojson object, defaulting to "". */
+export function str(json: JsonObject, key: string): string {
+  const value = json[key];
+  return typeof value === "string" ? value : "";
+}
+
+/** Read a nested object field from a protojson object, defaulting to {}. */
+export function obj(json: JsonObject, key: string): JsonObject {
+  return asObject(json[key]);
+}
+
+/** Boolean field from a protojson object (defaults to false). */
+export function bool(json: JsonObject, key: string): boolean {
+  return json[key] === true;
+}

package/src/resources/run/agent-exec.ts

@@ -0,0 +1,107 @@
+// The "run a resolved agent" flow (Go's executeResolvedAgent in
+// run_agent_exec.go): create the workspace session if needed, create the agent
+// execution, then either detach (print header + re-attach hint) or stream and
+// optionally download artifacts. Shared by `run` and `draft`.
+
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { BackendClient } from "../../client/index.js";
+import { CliExitError, ExitCode } from "../../errors/index.js";
+import { downloadExecutionArtifacts } from "../download.js";
+import { createAgentExecution, createSessionForAgent } from "./create.js";
+import { renderSessionHeader, type SessionHeaderInfo, workspaceNames } from "./header.js";
+import type { PreparedRun } from "./prepare.js";
+import { streamAgentExecution, type RunOutputMode } from "./stream.js";
+
+export interface ResolvedAgentExecInput {
+  readonly agent: Agent;
+  readonly prepared: PreparedRun;
+  readonly org: string;
+  /** Artifact download directory; "" skips download. */
+  readonly downloadDir: string;
+  readonly outputMode: RunOutputMode;
+  readonly client: BackendClient;
+}
+
+export async function executeResolvedAgent(input: ResolvedAgentExecInput): Promise<void> {
+  const { prepared, org, client } = input;
+  const controller = client.controller.bind(client);
+  const progress = stderrProgress();
+
+  // Workspaces require a CLI-created session: the backend's auto-create flow has
+  // no workspace passthrough (Go's createSessionForAgent).
+  let sessionId = "";
+  if (prepared.workspaceEntries.length > 0) {
+    const instanceId = input.agent.status?.defaultInstanceId ?? "";
+    if (instanceId === "") {
+      throw new CliExitError("agent has no default instance — cannot create workspace session", ExitCode.General);
+    }
+    progress("Creating workspace...");
+    const session = await createSessionForAgent(controller, {
+      agentInstanceId: instanceId,
+      orgId: org,
+      workspaceEntries: prepared.workspaceEntries,
+    });
+    sessionId = session.metadata?.id ?? "";
+  }
+
+  progress("Creating execution...");
+  const execution = await createAgentExecution(controller, {
+    agentId: input.agent.metadata?.id,
+    sessionId: sessionId === "" ? undefined : sessionId,
+    orgId: org,
+    message: prepared.message,
+    runtimeEnv: prepared.runtimeEnv,
+    attachments: prepared.attachments,
+    workspaceFileRefs: prepared.workspaceFileRefs,
+    model: prepared.model,
+    mode: prepared.mode,
+    autoApproveAll: prepared.autoApproveAll,
+  });
+
+  // The backend owns the canonical session id; prefer it over the CLI-created
+  // one (they agree, but the spec value is authoritative).
+  sessionId = execution.spec?.sessionId ?? sessionId;
+
+  const header: SessionHeaderInfo = {
+    agentName: input.agent.metadata?.name ?? "",
+    sessionId,
+    model: prepared.model,
+    mode: prepared.mode,
+    workspaces: workspaceNames(prepared.workspaceEntries),
+  };
+
+  if (prepared.detach) {
+    renderSessionHeader(process.stderr, header);
+    if (sessionId !== "") {
+      process.stderr.write(`Detached (still running) — stigmer resume ${sessionId} to re-attach\n`);
+    }
+    return;
+  }
+
+  const finalExec = await streamAgentExecution({
+    client: client.stigmer,
+    sessionId,
+    executionId: execution.metadata?.id ?? "",
+    org,
+    mode: prepared.mode,
+    defaultAction: prepared.defaultAction,
+    outputMode: input.outputMode,
+    header,
+  });
+
+  if (input.downloadDir !== "" && (finalExec.status?.artifacts.length ?? 0) > 0) {
+    await downloadExecutionArtifacts(
+      client.stigmer,
+      finalExec.metadata?.id ?? "",
+      { artifactName: "", outputDir: input.downloadDir },
+      progress,
+    );
+  }
+}
+
+// Progress lines go to stderr, but only when it is a TTY — matching Go's spinner,
+// which is suppressed under pipes/CI so it never pollutes captured output.
+function stderrProgress(): (line: string) => void {
+  if (process.stderr.isTTY !== true) return () => {};
+  return (line) => void process.stderr.write(`${line}\n`);
+}

package/src/resources/run/attachments.test.ts

@@ -0,0 +1,113 @@
+// Unit tests for attachment processing: workspace-relative classification vs
+// upload, directory zipping, MIME detection, and the size cap. The uploader is
+// faked so no network is required.
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { create } from "@bufbuild/protobuf";
+import { unzipSync } from "fflate";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  type UploadAttachmentRequest,
+  UploadAttachmentResponseSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+import { type AttachmentUploader, processAttachments } from "./attachments.js";
+
+// Records each upload and returns a deterministic storage key.
+class FakeUploader implements AttachmentUploader {
+  readonly uploads: UploadAttachmentRequest[] = [];
+  async uploadAttachment(req: UploadAttachmentRequest) {
+    this.uploads.push(req);
+    return create(UploadAttachmentResponseSchema, { storageKey: `attachments/key/${req.filename}` });
+  }
+}
+
+let dir: string;
+let uploader: FakeUploader;
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "attach-test-"));
+  uploader = new FakeUploader();
+});
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("workspace-relative classification", () => {
+  it("records a file inside a workspace root as a relative ref (no upload)", async () => {
+    const root = join(dir, "repo");
+    mkdirSync(join(root, "src"), { recursive: true });
+    const file = join(root, "src", "main.ts");
+    writeFileSync(file, "x");
+
+    const result = await processAttachments(uploader, [file], [root]);
+    expect(result.workspaceFileRefs).toEqual(["src/main.ts"]);
+    expect(result.attachments).toHaveLength(0);
+    expect(uploader.uploads).toHaveLength(0);
+  });
+
+  it("uploads a file outside every workspace root", async () => {
+    const root = join(dir, "repo");
+    mkdirSync(root, { recursive: true });
+    const outside = join(dir, "outside.txt");
+    writeFileSync(outside, "data");
+
+    const result = await processAttachments(uploader, [outside], [root]);
+    expect(result.workspaceFileRefs).toHaveLength(0);
+    expect(result.attachments).toHaveLength(1);
+    expect(result.attachments[0].filename).toBe("outside.txt");
+    expect(result.attachments[0].contentType).toBe("text/plain");
+    expect(result.attachments[0].storageKey).toBe("attachments/key/outside.txt");
+    expect(result.attachments[0].localPath).toBe(outside);
+  });
+});
+
+describe("file upload", () => {
+  it("uploads with no workspace roots configured", async () => {
+    const file = join(dir, "config.yaml");
+    writeFileSync(file, "a: 1\n");
+    const result = await processAttachments(uploader, [file], []);
+    expect(result.attachments).toHaveLength(1);
+    expect(result.attachments[0].contentType).toBe("application/x-yaml");
+    expect(uploader.uploads[0].filename).toBe("config.yaml");
+  });
+
+  it("falls back to octet-stream for unknown extensions", async () => {
+    const file = join(dir, "blob.unknownext");
+    writeFileSync(file, "x");
+    const result = await processAttachments(uploader, [file], []);
+    expect(result.attachments[0].contentType).toBe("application/octet-stream");
+  });
+
+  it("errors on a missing file", async () => {
+    await expect(processAttachments(uploader, [join(dir, "nope.txt")], [])).rejects.toThrow(/file not found/);
+  });
+});
+
+describe("directory zipping", () => {
+  it("zips a directory, marks extract, and sets the mount path", async () => {
+    const subdir = join(dir, "bundle");
+    mkdirSync(join(subdir, "nested"), { recursive: true });
+    writeFileSync(join(subdir, "a.txt"), "aaa");
+    writeFileSync(join(subdir, "nested", "b.txt"), "bbb");
+    writeFileSync(join(subdir, ".hidden"), "secret"); // skipped
+
+    const result = await processAttachments(uploader, [subdir], []);
+    expect(result.attachments).toHaveLength(1);
+    const att = result.attachments[0];
+    expect(att.filename).toBe("bundle.zip");
+    expect(att.extract).toBe(true);
+    expect(att.mountPath).toBe("inputs/bundle/");
+    expect(att.contentType).toBe("application/zip");
+
+    const entries = Object.keys(unzipSync(uploader.uploads[0].content)).sort();
+    expect(entries).toEqual(["a.txt", "nested/b.txt"]);
+  });
+
+  it("errors when a directory has no attachable files", async () => {
+    const empty = join(dir, "empty");
+    mkdirSync(empty);
+    writeFileSync(join(empty, ".hidden"), "x"); // only hidden -> nothing attachable
+    await expect(processAttachments(uploader, [empty], [])).rejects.toThrow(/no attachable files/);
+  });
+});