@yeaft/webchat-agent 1.0.155 → 1.0.157

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.155",
+  "version": "1.0.157",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/llm/openai-responses.js

@@ -41,6 +41,7 @@ import {
 } from './adapter.js';
 import {
   normalizeEffort,
+  getModelEffortOptions,
   getThinkingCapability,
   mapEffortToOpenAIReasoning,
 } from '../models.js';
@@ -57,10 +58,9 @@ function thinkingV1Enabled() {
 }
 
 /**
- * Translate a normalised effort ('minimal'|'low'|'medium'|'high'|'xhigh'|'max') into the value
- * accepted by the OpenAI Responses `reasoning.effort` field. Responses today
- * accepts 'minimal'|'low'|'medium'|'high'|'xhigh'. Unsupported Anthropic-only
- * adaptive efforts must be dropped, not downgraded.
+ * Translate a normalised effort into the OpenAI Responses `reasoning.effort`
+ * field. Model capability filtering happens at the call site because `max` is
+ * supported by GPT-5.6 but not by older OpenAI reasoning models.
  */
 function effortForResponses(effort) {
   return mapEffortToOpenAIReasoning(effort);
@@ -248,7 +248,7 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
   // ─── Streaming ──────────────────────────────────────────
 
   /**
-   * @param {{ model: string, system: string, messages: import('./adapter.js').UnifiedMessage[], tools?: import('./adapter.js').UnifiedToolDef[], maxTokens?: number, effort?: 'minimal'|'low'|'medium'|'high'|'xhigh'|'max', effortSource?: 'user'|'auto', extraBody?: object, signal?: AbortSignal, onRawExchange?: ({rawRequest, rawResponse}) => void }} params
+   * @param {{ model: string, system: string, messages: import('./adapter.js').UnifiedMessage[], tools?: import('./adapter.js').UnifiedToolDef[], maxTokens?: number, effort?: 'minimal'|'low'|'medium'|'high'|'xhigh'|'max', effortSource?: 'user'|'auto', effortContext?: object, extraBody?: object, signal?: AbortSignal, onRawExchange?: ({rawRequest, rawResponse}) => void, onRequestStart?: () => void }} params
    *
    * NOTE on `extraBody`: any keys you spread here are merged verbatim into
    * the wire body and — because the verbatim debug feature is intentionally
@@ -257,7 +257,7 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
    * `api-key` headers are auto-redacted (see `redactRawRequest` in
    * `adapter.js`); request-body fields are caller-controlled.
    */
-  async *stream({ model, system, messages, tools, maxTokens = 16384, effort, effortSource, extraBody, signal, onRawExchange, onRequestStart }) {
+  async *stream({ model, system, messages, tools, maxTokens = 16384, effort, effortSource, effortContext = {}, extraBody, signal, onRawExchange, onRequestStart }) {
     if (signal?.aborted) throw new LLMAbortError();
 
     const body = {
@@ -276,8 +276,9 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
     // Unknown / unsupported models silently drop the field.
     const normEffort = normalizeEffort(effort);
     if ((thinkingV1Enabled() || effortSource === 'user') && normEffort) {
-      const cap = getThinkingCapability(model);
-      if (cap.supportsThinking && cap.thinkingProtocol === 'openai-reasoning') {
+      const cap = getThinkingCapability(model, effortContext);
+      const supportedEfforts = getModelEffortOptions(model, effortContext);
+      if (cap.supportsThinking && cap.thinkingProtocol === 'openai-reasoning' && supportedEfforts.includes(normEffort)) {
         const wireEffort = effortForResponses(normEffort);
         if (wireEffort) body.reasoning = { effort: wireEffort };
       }
@@ -517,7 +518,7 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
    * expose them, mirror the stream() instrumentation. Parity with
    * anthropic.js's `call()`.
    */
-  async call({ model, system, messages, maxTokens = 4096, effort, effortSource, extraBody, signal, onRequestStart }) {
+  async call({ model, system, messages, maxTokens = 4096, effort, effortSource, effortContext = {}, extraBody, signal, onRequestStart }) {
     if (signal?.aborted) throw new LLMAbortError();
 
     const body = {
@@ -530,8 +531,9 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
     // Mirror stream()'s thinking injection for non-streaming side queries.
     const normEffort = normalizeEffort(effort);
     if ((thinkingV1Enabled() || effortSource === 'user') && normEffort) {
-      const cap = getThinkingCapability(model);
-      if (cap.supportsThinking && cap.thinkingProtocol === 'openai-reasoning') {
+      const cap = getThinkingCapability(model, effortContext);
+      const supportedEfforts = getModelEffortOptions(model, effortContext);
+      if (cap.supportsThinking && cap.thinkingProtocol === 'openai-reasoning' && supportedEfforts.includes(normEffort)) {
         const wireEffort = effortForResponses(normEffort);
         if (wireEffort) body.reasoning = { effort: wireEffort };
       }

package/yeaft/models.js

@@ -34,7 +34,7 @@ import { lookupModelLimitSync } from './llm/models-dev.js';
  * @property {'anthropic' | 'anthropic-adaptive' | 'openai-reasoning' | 'none'} [thinkingProtocol] — task-327a:
  *   'anthropic' → thinking:{type:'enabled', budget_tokens:N}
  *   'anthropic-adaptive' → thinking:{type:'adaptive'} + output_config:{effort}
- *   'openai-reasoning' → reasoning:{effort:'minimal'|'low'|'medium'|'high'|'xhigh'}
+ *   'openai-reasoning' → reasoning:{effort:'minimal'|'low'|'medium'|'high'|'xhigh'|'max'}
  *   'none' (default) → parameter silently dropped by router
  * @property {'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null} [defaultEffort] — adapter-level default
  *   when caller doesn't specify effort (null = no default / decision-tree decides).
@@ -405,12 +405,12 @@ export const ANTHROPIC_THINKING_BUDGETS = {
 };
 
 /**
- * Map a Yeaft effort level to the OpenAI reasoning.effort enum. Current
- * OpenAI APIs expose xhigh, but not Anthropic's 'max'. Unsupported values are
- * dropped by returning null; the adapter MUST NOT error.
+ * Map a Yeaft effort level to the OpenAI reasoning.effort enum. Supported
+ * values are model-dependent; capability filtering happens before this wire
+ * translation. Unsupported values are dropped; the adapter MUST NOT error.
  *
  * @param {Effort} effort
- * @returns {'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | null}
+ * @returns {'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null}
  */
 export function mapEffortToOpenAIReasoning(effort) {
   if (!effort) return null;
@@ -420,11 +420,13 @@ export function mapEffortToOpenAIReasoning(effort) {
     case 'medium': return 'medium';
     case 'high': return 'high';
     case 'xhigh': return 'xhigh';
+    case 'max': return 'max';
     default: return null;
   }
 }
 
 export const OPENAI_REASONING_EFFORT_OPTIONS = ['minimal', 'low', 'medium', 'high', 'xhigh'];
+export const OPENAI_MAX_REASONING_EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
 export const ANTHROPIC_MANUAL_EFFORT_OPTIONS = ['low', 'medium', 'high'];
 export const ANTHROPIC_ADAPTIVE_EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
 export const ANTHROPIC_ADAPTIVE_MAX_EFFORT_OPTIONS = ['low', 'medium', 'high', 'max'];
@@ -454,6 +456,19 @@ function inferThinkingCapability(model) {
   const id = parseModelRef(model).modelId.toLowerCase();
   if (!id) return null;
 
+  // GPT-5.6 adds the model-specific `max` tier. Keep this ahead of the generic
+  // GPT inference so older OpenAI models do not advertise a value they reject.
+  // Provider suffixes such as gpt-5.6-sol are variants of the same model family.
+  if (/^gpt-5\.6($|[-.])/.test(id)) {
+    return {
+      supportsThinking: true,
+      thinkingProtocol: 'openai-reasoning',
+      defaultEffort: null,
+      maxBudgetTokens: null,
+      effortOptions: OPENAI_MAX_REASONING_EFFORT_OPTIONS,
+    };
+  }
+
   if (/^(gpt-5|o1|o3|o4|chatgpt-|codex-)/.test(id)) {
     return { supportsThinking: true, thinkingProtocol: 'openai-reasoning', defaultEffort: null, maxBudgetTokens: null };
   }

package/yeaft/work-center/attachments.js

@@ -9,6 +9,7 @@ import {
   readFileSync,
   realpathSync,
   rmSync,
+  unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
@@ -175,6 +176,43 @@ function removeCreatedDirectory(state) {
   }
 }
 
+function openAttachmentDirectory(root, workItemId) {
+  if (process.platform !== 'linux') {
+    throw new Error('Secure WorkItem attachment access requires Linux');
+  }
+  const { attachmentRoot, itemDirectory } = attachmentDirectory(root, workItemId);
+  const rootDescriptor = openDirectory(attachmentRoot, 'WorkItem attachment root');
+  try {
+    const ownerName = safeWorkItemId(workItemId);
+    const itemDescriptor = openDirectory(
+      `/proc/self/fd/${rootDescriptor}/${ownerName}`,
+      'WorkItem attachment owner directory',
+    );
+    try {
+      assertDescriptorMatchesPath(rootDescriptor, attachmentRoot, 'WorkItem attachment root');
+      assertDescriptorMatchesPath(itemDescriptor, itemDirectory, 'WorkItem attachment owner directory');
+      return { attachmentRoot, itemDirectory, ownerName, rootDescriptor, itemDescriptor };
+    } catch (error) {
+      closeSync(itemDescriptor);
+      throw error;
+    }
+  } catch (error) {
+    closeSync(rootDescriptor);
+    throw error;
+  }
+}
+
+function removeAttachmentFile(directoryState, storageName) {
+  if (!/^[A-Za-z0-9_-]+(?:\.[a-z0-9]{1,10})?$/.test(storageName)) return;
+  assertDescriptorMatchesPath(directoryState.rootDescriptor, directoryState.attachmentRoot, 'WorkItem attachment root');
+  assertDescriptorMatchesPath(directoryState.itemDescriptor, directoryState.itemDirectory, 'WorkItem attachment owner directory');
+  try {
+    unlinkSync(`/proc/self/fd/${directoryState.itemDescriptor}/${storageName}`);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
 export function persistWorkItemAttachments(files, options = {}) {
   if (!Array.isArray(files) || files.length === 0) return [];
   if (files.length > MAX_WORK_ITEM_ATTACHMENTS) {
@@ -226,6 +264,74 @@ export function persistWorkItemAttachments(files, options = {}) {
   }
 }
 
+export function appendWorkItemAttachments(existing, files, options = {}) {
+  if (!Array.isArray(files) || files.length === 0) return [];
+  const current = Array.isArray(existing) ? existing : [];
+  if (current.length === 0) return persistWorkItemAttachments(files, options);
+  if (current.length + files.length > MAX_WORK_ITEM_ATTACHMENTS) {
+    throw new Error(`WorkItem supports at most ${MAX_WORK_ITEM_ATTACHMENTS} attachments`);
+  }
+
+  let totalBytes = current.reduce((total, attachment) => total + (Number(attachment?.size) || 0), 0);
+  const prepared = files.map((file, index) => {
+    if (!file || typeof file !== 'object' || Array.isArray(file)) {
+      throw new Error(`Attachment ${index + 1} is invalid`);
+    }
+    const name = safeDisplayName(file.name, current.length + index);
+    const mimeType = typeof file.mimeType === 'string' && file.mimeType.trim()
+      ? file.mimeType.trim().slice(0, 255)
+      : 'application/octet-stream';
+    const kind = assertSupportedWorkItemAttachment(name, mimeType);
+    const buffer = decodeBase64(file.data);
+    assertWorkItemAttachmentSize(buffer.length);
+    totalBytes += buffer.length;
+    if (totalBytes > MAX_WORK_ITEM_ATTACHMENT_BYTES) {
+      throw new Error(`WorkItem attachments exceed ${MAX_WORK_ITEM_ATTACHMENT_BYTES} bytes`);
+    }
+    const id = randomUUID();
+    return {
+      buffer,
+      attachment: {
+        id,
+        name,
+        storageName: `${id}${safeExtension(name)}`,
+        mimeType,
+        size: buffer.length,
+        sha256: digest(buffer),
+        kind,
+        isImage: kind === 'image',
+      },
+    };
+  });
+
+  const directoryState = openAttachmentDirectory(options.root, options.workItemId);
+  const written = [];
+  try {
+    for (const entry of prepared) {
+      writeAttachmentFile(directoryState, entry.attachment.storageName, entry.buffer);
+      written.push(entry.attachment);
+    }
+    return written;
+  } catch (error) {
+    for (const attachment of written) {
+      try { removeAttachmentFile(directoryState, attachment.storageName); } catch {}
+    }
+    throw error;
+  } finally {
+    closeDirectoryState(directoryState);
+  }
+}
+
+export function removeWorkItemAttachmentFiles(root, workItemId, attachments) {
+  if (!Array.isArray(attachments) || attachments.length === 0) return;
+  const directoryState = openAttachmentDirectory(root, workItemId);
+  try {
+    for (const attachment of attachments) removeAttachmentFile(directoryState, attachment?.storageName);
+  } finally {
+    closeDirectoryState(directoryState);
+  }
+}
+
 export function removeWorkItemAttachments(root, workItemId, options = {}) {
   if (!root || !workItemId) return;
   if (process.platform !== 'linux') {
@@ -286,6 +392,26 @@ function resolveAttachmentPath(root, workItemId, attachment) {
   return { filePath: actualPath, size: stat.size, itemDirectory: itemRoot };
 }
 
+export function readWorkItemAttachment(workItem, attachmentId, options = {}) {
+  const attachment = Array.isArray(workItem?.attachments)
+    ? workItem.attachments.find(item => item?.id === attachmentId)
+    : null;
+  if (!attachment) throw new Error('WorkItem attachment not found');
+  const resolved = resolveAttachmentPath(options.root, workItem.id, attachment);
+  const buffer = readFileSync(resolved.filePath);
+  if (resolved.size !== Number(attachment.size) || digest(buffer) !== attachment.sha256) {
+    throw new Error(`WorkItem attachment changed after creation: ${attachment.name || attachment.id}`);
+  }
+  return {
+    id: attachment.id,
+    name: attachment.name,
+    mimeType: attachment.mimeType,
+    size: resolved.size,
+    isImage: attachment.isImage === true,
+    data: buffer.toString('base64'),
+  };
+}
+
 function escapePromptText(value) {
   return String(value || '')
     .replace(/&/g, '&')

package/yeaft/work-center/bridge.js

@@ -20,21 +20,18 @@ let serviceFactory = null;
 const BROWSER_DETAIL_OPS = new Set(['get', 'create', 'update', 'start', 'cancel', 'guide', 'retry']);
 // `files` is an internal server-to-Agent field. The browser relay rejects any
 // client-supplied value and only emits files resolved from owned upload ids.
-const BROWSER_CREATE_FIELDS = Object.freeze([
-  'title',
-  'goal',
-  'acceptanceCriteria',
-  'workDir',
-  'reuseMemory',
-  'origin',
-  'linkedSessionIds',
-  'files',
-  'start',
-]);
-
-function browserCreatePayload(value) {
+const BROWSER_FILE_FIELDS = Object.freeze({
+  create: [
+    'title', 'goal', 'acceptanceCriteria', 'workDir', 'reuseMemory', 'origin',
+    'linkedSessionIds', 'files', 'start',
+  ],
+  guide: ['id', 'guidance', 'actionId', 'revision', 'files'],
+});
+
+function browserFilePayload(op, value) {
   const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-  return Object.fromEntries(BROWSER_CREATE_FIELDS
+  const fields = BROWSER_FILE_FIELDS[op] || [];
+  return Object.fromEntries(fields
     .filter(field => Object.prototype.hasOwnProperty.call(source, field))
     .map(field => [field, source[field]]));
 }
@@ -176,10 +173,10 @@ export async function handleWorkCenterRequest(msg) {
       data = await readSettingsResponse();
     } else {
       const workCenter = await ensureWorkCenter();
-      data = await workCenter.handle(
-        op,
-        op === 'create' ? browserCreatePayload(msg.payload) : (msg.payload || {}),
-      );
+      const payload = Object.hasOwn(BROWSER_FILE_FIELDS, op)
+        ? browserFilePayload(op, msg.payload)
+        : (msg.payload || {});
+      data = await workCenter.handle(op, payload);
     }
     if (BROWSER_DETAIL_OPS.has(op)) data = projectWorkItemDetail(data);
     send({

package/yeaft/work-center/controller.js

@@ -172,7 +172,9 @@ export class WorkflowController {
 
   guide(id, input = {}) {
     const guidance = typeof input.guidance === 'string' ? input.guidance.trim().slice(0, 8_000) : '';
-    if (!guidance) throw new Error('guidance is required');
+    const addedAttachmentCount = Math.max(0, Number(input.addedAttachmentCount) || 0);
+    if (!guidance && addedAttachmentCount === 0) throw new Error('guidance or attachments are required');
+    const guidanceSummary = guidance || `The user added ${addedAttachmentCount} attachment(s) as additional context for this Action.`;
     const expected = {
       actionId: typeof input.actionId === 'string' ? input.actionId : '',
       revision: Number(input.revision),
@@ -180,11 +182,11 @@ export class WorkflowController {
     if (!expected.actionId || !Number.isInteger(expected.revision)) {
       throw new Error('actionId and revision are required for guidance');
     }
-    const detail = this.store.addActionGuidance(id, guidance, expected, (workItem, previous) => {
+    const detail = this.store.addActionGuidance(id, guidanceSummary, expected, (workItem, previous) => {
       const context = [...(previous.context || []), {
         type: 'guidance',
         role: 'user',
-        summary: guidance,
+        summary: guidanceSummary,
         evidence: [],
       }];
       const step = {
@@ -200,7 +202,7 @@ export class WorkflowController {
         instruction: actionInstruction(step, workItem, context),
         maxAttempts: previous.maxAttempts || 2,
       };
-    });
+    }, input.attachments);
     if (!detail) throw new Error(`WorkItem not found: ${id}`);
     return detail;
   }

package/yeaft/work-center/service.js

@@ -5,7 +5,10 @@ import { WorkItemStore } from './store.js';
 import { WorkflowController } from './controller.js';
 import { WorkItemWatcher } from './watcher.js';
 import {
+  appendWorkItemAttachments,
   persistWorkItemAttachments,
+  readWorkItemAttachment,
+  removeWorkItemAttachmentFiles,
   removeWorkItemAttachments,
 } from './attachments.js';
 import { projectWorkItemDetail, projectWorkItemSummary } from './projection.js';
@@ -157,15 +160,57 @@ export class WorkCenterService {
       }
       case 'guide': {
         const id = requiredString(payload.id, 'id');
-        const detail = this.controller.guide(id, {
-          guidance: typeof payload.guidance === 'string' ? payload.guidance : '',
-          actionId: typeof payload.actionId === 'string' ? payload.actionId : '',
-          revision: payload.revision,
-        });
+        const workItem = this.#requiredItem(id);
+        let addedAttachments = [];
+        let detail;
+        try {
+          addedAttachments = appendWorkItemAttachments(workItem.attachments, payload.files, {
+            root: this.attachmentRoot,
+            workItemId: id,
+          });
+          detail = this.controller.guide(id, {
+            guidance: typeof payload.guidance === 'string' ? payload.guidance : '',
+            actionId: typeof payload.actionId === 'string' ? payload.actionId : '',
+            revision: payload.revision,
+            addedAttachmentCount: addedAttachments.length,
+            attachments: [...(workItem.attachments || []), ...addedAttachments],
+          });
+        } catch (error) {
+          try {
+            if ((workItem.attachments || []).length === 0 && addedAttachments.length > 0) {
+              removeWorkItemAttachments(this.attachmentRoot, id);
+            } else {
+              removeWorkItemAttachmentFiles(this.attachmentRoot, id, addedAttachments);
+            }
+          } catch {}
+          throw error;
+        }
         this.watcher.abortInvalidWorkItemRuns(id);
         this.#emit({ type: 'action.guidance_added', workItem: detail });
         return detail;
       }
+      case 'preview_attachment': {
+        const id = requiredString(payload.id, 'id');
+        const attachment = readWorkItemAttachment(
+          this.#requiredItem(id),
+          requiredString(payload.attachmentId, 'attachmentId'),
+          { root: this.attachmentRoot },
+        );
+        return {
+          attachment: {
+            id: attachment.id,
+            name: attachment.name,
+            mimeType: attachment.mimeType,
+            size: attachment.size,
+            isImage: attachment.isImage,
+          },
+          previewData: {
+            data: attachment.data,
+            mimeType: attachment.mimeType,
+            filename: attachment.name,
+          },
+        };
+      }
       case 'retry': {
         const detail = this.controller.retry(requiredString(payload.id, 'id'), {
           answer: typeof payload.answer === 'string' ? payload.answer : '',

package/yeaft/work-center/store.js

@@ -536,7 +536,7 @@ export class WorkItemStore {
     });
   }
 
-  addActionGuidance(id, guidance, expected, makeAction) {
+  addActionGuidance(id, guidance, expected, makeAction, attachments = null) {
     return withTransaction(this.db, () => {
       const workItem = this.getWorkItem(id);
       if (!workItem) return null;
@@ -563,7 +563,12 @@ export class WorkItemStore {
         contractRevision: workItem.revision,
       }, this.#nextSequence(id), now);
       this.db.prepare(`UPDATE work_items SET status = 'ready', current_action_id = ?,
-        current_run_id = NULL, updated_at = ? WHERE id = ?`).run(action.id, now, id);
+        current_run_id = NULL, attachments = ?, updated_at = ? WHERE id = ?`).run(
+        action.id,
+        stringify(Array.isArray(attachments) ? attachments : workItem.attachments),
+        now,
+        id,
+      );
       this.appendEvent(id, 'action.guidance_added', { guidance }, { actionId: action.id });
       return this.getWorkItemDetail(id);
     });