@yeaft/webchat-agent 1.0.154 → 1.0.156

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.154",
+  "version": "1.0.156",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/workbench/file-ops.js

@@ -103,7 +103,7 @@ export async function handleWriteFile(msg) {
 }
 
 export async function handleListDirectory(msg) {
-  const { conversationId, dirPath, _requestUserId, _requestClientId } = msg;
+  const { conversationId, requestId, dirPath, _requestUserId, _requestClientId } = msg;
   const conv = ctx.conversations.get(conversationId);
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
@@ -121,6 +121,7 @@ export async function handleListDirectory(msg) {
         ctx.sendToServer({
           type: 'directory_listing',
           conversationId,
+          requestId,
           _requestUserId,
           _requestClientId,
           dirPath: '',
@@ -137,6 +138,7 @@ export async function handleListDirectory(msg) {
         ctx.sendToServer({
           type: 'directory_listing',
           conversationId,
+          requestId,
           _requestUserId,
           _requestClientId,
           dirPath: '/',
@@ -147,6 +149,7 @@ export async function handleListDirectory(msg) {
       ctx.sendToServer({
         type: 'directory_listing',
         conversationId,
+        requestId,
         _requestUserId,
         _requestClientId,
         dirPath: '',
@@ -194,6 +197,7 @@ export async function handleListDirectory(msg) {
     ctx.sendToServer({
       type: 'directory_listing',
       conversationId,
+      requestId,
       _requestUserId,
       _requestClientId,
       dirPath: resolved,
@@ -203,6 +207,7 @@ export async function handleListDirectory(msg) {
     ctx.sendToServer({
       type: 'directory_listing',
       conversationId,
+      requestId,
       _requestUserId,
       _requestClientId,
       dirPath: dirPath || workDir,

package/yeaft/work-center/attachments.js

@@ -9,6 +9,7 @@ import {
   readFileSync,
   realpathSync,
   rmSync,
+  unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
@@ -175,6 +176,43 @@ function removeCreatedDirectory(state) {
   }
 }
 
+function openAttachmentDirectory(root, workItemId) {
+  if (process.platform !== 'linux') {
+    throw new Error('Secure WorkItem attachment access requires Linux');
+  }
+  const { attachmentRoot, itemDirectory } = attachmentDirectory(root, workItemId);
+  const rootDescriptor = openDirectory(attachmentRoot, 'WorkItem attachment root');
+  try {
+    const ownerName = safeWorkItemId(workItemId);
+    const itemDescriptor = openDirectory(
+      `/proc/self/fd/${rootDescriptor}/${ownerName}`,
+      'WorkItem attachment owner directory',
+    );
+    try {
+      assertDescriptorMatchesPath(rootDescriptor, attachmentRoot, 'WorkItem attachment root');
+      assertDescriptorMatchesPath(itemDescriptor, itemDirectory, 'WorkItem attachment owner directory');
+      return { attachmentRoot, itemDirectory, ownerName, rootDescriptor, itemDescriptor };
+    } catch (error) {
+      closeSync(itemDescriptor);
+      throw error;
+    }
+  } catch (error) {
+    closeSync(rootDescriptor);
+    throw error;
+  }
+}
+
+function removeAttachmentFile(directoryState, storageName) {
+  if (!/^[A-Za-z0-9_-]+(?:\.[a-z0-9]{1,10})?$/.test(storageName)) return;
+  assertDescriptorMatchesPath(directoryState.rootDescriptor, directoryState.attachmentRoot, 'WorkItem attachment root');
+  assertDescriptorMatchesPath(directoryState.itemDescriptor, directoryState.itemDirectory, 'WorkItem attachment owner directory');
+  try {
+    unlinkSync(`/proc/self/fd/${directoryState.itemDescriptor}/${storageName}`);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
 export function persistWorkItemAttachments(files, options = {}) {
   if (!Array.isArray(files) || files.length === 0) return [];
   if (files.length > MAX_WORK_ITEM_ATTACHMENTS) {
@@ -226,6 +264,74 @@ export function persistWorkItemAttachments(files, options = {}) {
   }
 }
 
+export function appendWorkItemAttachments(existing, files, options = {}) {
+  if (!Array.isArray(files) || files.length === 0) return [];
+  const current = Array.isArray(existing) ? existing : [];
+  if (current.length === 0) return persistWorkItemAttachments(files, options);
+  if (current.length + files.length > MAX_WORK_ITEM_ATTACHMENTS) {
+    throw new Error(`WorkItem supports at most ${MAX_WORK_ITEM_ATTACHMENTS} attachments`);
+  }
+
+  let totalBytes = current.reduce((total, attachment) => total + (Number(attachment?.size) || 0), 0);
+  const prepared = files.map((file, index) => {
+    if (!file || typeof file !== 'object' || Array.isArray(file)) {
+      throw new Error(`Attachment ${index + 1} is invalid`);
+    }
+    const name = safeDisplayName(file.name, current.length + index);
+    const mimeType = typeof file.mimeType === 'string' && file.mimeType.trim()
+      ? file.mimeType.trim().slice(0, 255)
+      : 'application/octet-stream';
+    const kind = assertSupportedWorkItemAttachment(name, mimeType);
+    const buffer = decodeBase64(file.data);
+    assertWorkItemAttachmentSize(buffer.length);
+    totalBytes += buffer.length;
+    if (totalBytes > MAX_WORK_ITEM_ATTACHMENT_BYTES) {
+      throw new Error(`WorkItem attachments exceed ${MAX_WORK_ITEM_ATTACHMENT_BYTES} bytes`);
+    }
+    const id = randomUUID();
+    return {
+      buffer,
+      attachment: {
+        id,
+        name,
+        storageName: `${id}${safeExtension(name)}`,
+        mimeType,
+        size: buffer.length,
+        sha256: digest(buffer),
+        kind,
+        isImage: kind === 'image',
+      },
+    };
+  });
+
+  const directoryState = openAttachmentDirectory(options.root, options.workItemId);
+  const written = [];
+  try {
+    for (const entry of prepared) {
+      writeAttachmentFile(directoryState, entry.attachment.storageName, entry.buffer);
+      written.push(entry.attachment);
+    }
+    return written;
+  } catch (error) {
+    for (const attachment of written) {
+      try { removeAttachmentFile(directoryState, attachment.storageName); } catch {}
+    }
+    throw error;
+  } finally {
+    closeDirectoryState(directoryState);
+  }
+}
+
+export function removeWorkItemAttachmentFiles(root, workItemId, attachments) {
+  if (!Array.isArray(attachments) || attachments.length === 0) return;
+  const directoryState = openAttachmentDirectory(root, workItemId);
+  try {
+    for (const attachment of attachments) removeAttachmentFile(directoryState, attachment?.storageName);
+  } finally {
+    closeDirectoryState(directoryState);
+  }
+}
+
 export function removeWorkItemAttachments(root, workItemId, options = {}) {
   if (!root || !workItemId) return;
   if (process.platform !== 'linux') {
@@ -286,6 +392,26 @@ function resolveAttachmentPath(root, workItemId, attachment) {
   return { filePath: actualPath, size: stat.size, itemDirectory: itemRoot };
 }
 
+export function readWorkItemAttachment(workItem, attachmentId, options = {}) {
+  const attachment = Array.isArray(workItem?.attachments)
+    ? workItem.attachments.find(item => item?.id === attachmentId)
+    : null;
+  if (!attachment) throw new Error('WorkItem attachment not found');
+  const resolved = resolveAttachmentPath(options.root, workItem.id, attachment);
+  const buffer = readFileSync(resolved.filePath);
+  if (resolved.size !== Number(attachment.size) || digest(buffer) !== attachment.sha256) {
+    throw new Error(`WorkItem attachment changed after creation: ${attachment.name || attachment.id}`);
+  }
+  return {
+    id: attachment.id,
+    name: attachment.name,
+    mimeType: attachment.mimeType,
+    size: resolved.size,
+    isImage: attachment.isImage === true,
+    data: buffer.toString('base64'),
+  };
+}
+
 function escapePromptText(value) {
   return String(value || '')
     .replace(/&/g, '&')

package/yeaft/work-center/bridge.js

@@ -20,21 +20,18 @@ let serviceFactory = null;
 const BROWSER_DETAIL_OPS = new Set(['get', 'create', 'update', 'start', 'cancel', 'guide', 'retry']);
 // `files` is an internal server-to-Agent field. The browser relay rejects any
 // client-supplied value and only emits files resolved from owned upload ids.
-const BROWSER_CREATE_FIELDS = Object.freeze([
-  'title',
-  'goal',
-  'acceptanceCriteria',
-  'workDir',
-  'reuseMemory',
-  'origin',
-  'linkedSessionIds',
-  'files',
-  'start',
-]);
-
-function browserCreatePayload(value) {
+const BROWSER_FILE_FIELDS = Object.freeze({
+  create: [
+    'title', 'goal', 'acceptanceCriteria', 'workDir', 'reuseMemory', 'origin',
+    'linkedSessionIds', 'files', 'start',
+  ],
+  guide: ['id', 'guidance', 'actionId', 'revision', 'files'],
+});
+
+function browserFilePayload(op, value) {
   const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-  return Object.fromEntries(BROWSER_CREATE_FIELDS
+  const fields = BROWSER_FILE_FIELDS[op] || [];
+  return Object.fromEntries(fields
     .filter(field => Object.prototype.hasOwnProperty.call(source, field))
     .map(field => [field, source[field]]));
 }
@@ -176,10 +173,10 @@ export async function handleWorkCenterRequest(msg) {
       data = await readSettingsResponse();
     } else {
       const workCenter = await ensureWorkCenter();
-      data = await workCenter.handle(
-        op,
-        op === 'create' ? browserCreatePayload(msg.payload) : (msg.payload || {}),
-      );
+      const payload = Object.hasOwn(BROWSER_FILE_FIELDS, op)
+        ? browserFilePayload(op, msg.payload)
+        : (msg.payload || {});
+      data = await workCenter.handle(op, payload);
     }
     if (BROWSER_DETAIL_OPS.has(op)) data = projectWorkItemDetail(data);
     send({

package/yeaft/work-center/controller.js

@@ -172,7 +172,9 @@ export class WorkflowController {
 
   guide(id, input = {}) {
     const guidance = typeof input.guidance === 'string' ? input.guidance.trim().slice(0, 8_000) : '';
-    if (!guidance) throw new Error('guidance is required');
+    const addedAttachmentCount = Math.max(0, Number(input.addedAttachmentCount) || 0);
+    if (!guidance && addedAttachmentCount === 0) throw new Error('guidance or attachments are required');
+    const guidanceSummary = guidance || `The user added ${addedAttachmentCount} attachment(s) as additional context for this Action.`;
     const expected = {
       actionId: typeof input.actionId === 'string' ? input.actionId : '',
       revision: Number(input.revision),
@@ -180,11 +182,11 @@ export class WorkflowController {
     if (!expected.actionId || !Number.isInteger(expected.revision)) {
       throw new Error('actionId and revision are required for guidance');
     }
-    const detail = this.store.addActionGuidance(id, guidance, expected, (workItem, previous) => {
+    const detail = this.store.addActionGuidance(id, guidanceSummary, expected, (workItem, previous) => {
       const context = [...(previous.context || []), {
         type: 'guidance',
         role: 'user',
-        summary: guidance,
+        summary: guidanceSummary,
         evidence: [],
       }];
       const step = {
@@ -200,7 +202,7 @@ export class WorkflowController {
         instruction: actionInstruction(step, workItem, context),
         maxAttempts: previous.maxAttempts || 2,
       };
-    });
+    }, input.attachments);
     if (!detail) throw new Error(`WorkItem not found: ${id}`);
     return detail;
   }

package/yeaft/work-center/service.js

@@ -5,7 +5,10 @@ import { WorkItemStore } from './store.js';
 import { WorkflowController } from './controller.js';
 import { WorkItemWatcher } from './watcher.js';
 import {
+  appendWorkItemAttachments,
   persistWorkItemAttachments,
+  readWorkItemAttachment,
+  removeWorkItemAttachmentFiles,
   removeWorkItemAttachments,
 } from './attachments.js';
 import { projectWorkItemDetail, projectWorkItemSummary } from './projection.js';
@@ -157,15 +160,57 @@ export class WorkCenterService {
       }
       case 'guide': {
         const id = requiredString(payload.id, 'id');
-        const detail = this.controller.guide(id, {
-          guidance: typeof payload.guidance === 'string' ? payload.guidance : '',
-          actionId: typeof payload.actionId === 'string' ? payload.actionId : '',
-          revision: payload.revision,
-        });
+        const workItem = this.#requiredItem(id);
+        let addedAttachments = [];
+        let detail;
+        try {
+          addedAttachments = appendWorkItemAttachments(workItem.attachments, payload.files, {
+            root: this.attachmentRoot,
+            workItemId: id,
+          });
+          detail = this.controller.guide(id, {
+            guidance: typeof payload.guidance === 'string' ? payload.guidance : '',
+            actionId: typeof payload.actionId === 'string' ? payload.actionId : '',
+            revision: payload.revision,
+            addedAttachmentCount: addedAttachments.length,
+            attachments: [...(workItem.attachments || []), ...addedAttachments],
+          });
+        } catch (error) {
+          try {
+            if ((workItem.attachments || []).length === 0 && addedAttachments.length > 0) {
+              removeWorkItemAttachments(this.attachmentRoot, id);
+            } else {
+              removeWorkItemAttachmentFiles(this.attachmentRoot, id, addedAttachments);
+            }
+          } catch {}
+          throw error;
+        }
         this.watcher.abortInvalidWorkItemRuns(id);
         this.#emit({ type: 'action.guidance_added', workItem: detail });
         return detail;
       }
+      case 'preview_attachment': {
+        const id = requiredString(payload.id, 'id');
+        const attachment = readWorkItemAttachment(
+          this.#requiredItem(id),
+          requiredString(payload.attachmentId, 'attachmentId'),
+          { root: this.attachmentRoot },
+        );
+        return {
+          attachment: {
+            id: attachment.id,
+            name: attachment.name,
+            mimeType: attachment.mimeType,
+            size: attachment.size,
+            isImage: attachment.isImage,
+          },
+          previewData: {
+            data: attachment.data,
+            mimeType: attachment.mimeType,
+            filename: attachment.name,
+          },
+        };
+      }
       case 'retry': {
         const detail = this.controller.retry(requiredString(payload.id, 'id'), {
           answer: typeof payload.answer === 'string' ? payload.answer : '',

package/yeaft/work-center/store.js

@@ -536,7 +536,7 @@ export class WorkItemStore {
     });
   }
 
-  addActionGuidance(id, guidance, expected, makeAction) {
+  addActionGuidance(id, guidance, expected, makeAction, attachments = null) {
     return withTransaction(this.db, () => {
       const workItem = this.getWorkItem(id);
       if (!workItem) return null;
@@ -563,7 +563,12 @@ export class WorkItemStore {
         contractRevision: workItem.revision,
       }, this.#nextSequence(id), now);
       this.db.prepare(`UPDATE work_items SET status = 'ready', current_action_id = ?,
-        current_run_id = NULL, updated_at = ? WHERE id = ?`).run(action.id, now, id);
+        current_run_id = NULL, attachments = ?, updated_at = ? WHERE id = ?`).run(
+        action.id,
+        stringify(Array.isArray(attachments) ? attachments : workItem.attachments),
+        now,
+        id,
+      );
       this.appendEvent(id, 'action.guidance_added', { guidance }, { actionId: action.id });
       return this.getWorkItemDetail(id);
     });