@yolo-labs/yolobridge 0.17.0 → 0.19.0

package/dist/api-client.js

@@ -268,3 +268,38 @@ async function postEvent(cfg, workspaceId, payload) {
         return undefined;
     }
 }
+/**
+ * Phase 1 of a file share: ask common-api to reserve an asset and hand back a
+ * presigned PUT.
+ *
+ * Note what is NOT sent: no path. Only the basename, the mime type and the
+ * size. The operator's directory layout is not the cloud's business, and the
+ * server has no use for it.
+ *
+ * The tile is chosen SERVER-side from the attachment — there is deliberately no
+ * `tileId` parameter here, because a daemon does not get to pick.
+ */
+export async function presignShare(cfg, workspaceId, attachmentId, meta) {
+    const fetchImpl = cfg.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach/${attachmentId}/uploads`, {
+        method: 'POST',
+        headers: { ...authHeaders(cfg), 'Content-Type': 'application/json' },
+        body: JSON.stringify(meta),
+    });
+    if (!res.ok) {
+        const { message, code } = await parseErrorBody(res);
+        throw new YoloBridgeApiError(message, res.status, code);
+    }
+    return (await res.json());
+}
+/** Phase 2: the bytes are in R2; ask the server to verify and seal the asset. */
+export async function finalizeShare(cfg, workspaceId, attachmentId, assetId) {
+    const fetchImpl = cfg.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach/${attachmentId}/uploads/${encodeURIComponent(assetId)}/finalize`, { method: 'POST', headers: { ...authHeaders(cfg), 'Content-Type': 'application/json' }, body: '{}' });
+    if (!res.ok) {
+        const { message, code } = await parseErrorBody(res);
+        throw new YoloBridgeApiError(message, res.status, code);
+    }
+    const body = (await res.json());
+    return { assetId: body?.asset?.assetId ?? assetId };
+}

package/dist/approved-paths.js

@@ -0,0 +1,277 @@
+/**
+ * The approval list that bounds which paths the ATTACHED AGENT will send files
+ * from.
+ *
+ * ⚠️ READ THIS BEFORE RELYING ON IT: THIS IS NOT A SECURITY BOUNDARY.
+ *
+ * The attached agent runs as the SAME OS USER as this CLI and normally has
+ * shell access. It can therefore run `yolo-bridge allow /` itself, or simply
+ * edit `approved-paths.json`. The principal this list constrains can rewrite
+ * the list. No amount of care in the containment checks below changes that —
+ * they are checks against a mistake, not against an adversary who is already
+ * inside the same trust domain. (Found by codex review, gpt-5.6-sol, before
+ * this had any consumer; an earlier version of this comment claimed a
+ * "structural invariant" and was wrong.)
+ *
+ * The same reasoning cuts the other way and is why the feature is still worth
+ * having: an agent with a PTY can already `curl -T` any readable file to any
+ * host. Nothing here can stop a determined or injected agent from exfiltrating,
+ * because it never needed our upload path to do it.
+ *
+ * WHAT THIS ACTUALLY BUYS, stated so nobody over-trusts it:
+ *
+ *   - It stops ACCIDENTS. An agent casually sending `~/.aws/credentials`
+ *     because it seemed relevant is the common case, and this prevents it.
+ *   - It keeps the credentialed path deliberate. Sending through OUR upload,
+ *     with the operator's workspace credential, requires an explicit act rather
+ *     than being the path of least resistance.
+ *   - It is an AUDIT SURFACE. Approvals are visible in `yolo-bridge status`, so
+ *     a grant that was widened — by the operator or by an agent — is legible
+ *     rather than silent.
+ *
+ * WHAT IT DOES NOT BUY: protection against a cloud-originated prompt injection
+ * that instructs the agent to widen the list first. If that threat is the one
+ * that matters, the approval has to come from a channel the LOCAL AGENT cannot
+ * reach — the operator approving in their own authenticated webapp session
+ * would qualify, since an injected local agent cannot click it. That is a
+ * different design, deliberately not this one, and it still would not stop
+ * `curl`.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { configDir, loadAttachment as loadAttachmentDefault, defaultIO } from './config-store.js';
+function approvalsPath(env) {
+    return path.join(configDir(env), 'approved-paths.json');
+}
+export const defaultResolver = {
+    realpath(p) {
+        try {
+            return fs.realpathSync(p);
+        }
+        catch {
+            return undefined;
+        }
+    },
+    isDirectory(p) {
+        try {
+            return fs.statSync(p).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    },
+};
+/**
+ * Is `candidate` inside `root`?
+ *
+ * ⚠️ BOTH SIDES MUST ALREADY BE REALPATHS. This function does no resolution —
+ * that is the caller's job — because the containment check is worthless on
+ * unresolved input: a symlink sitting inside an approved directory and pointing
+ * at `~/.ssh/id_rsa` passes a naive `startsWith` every time.
+ *
+ * The separator is not decoration either. Without it an approval of
+ * `/home/yolo/projA` also covers `/home/yolo/projA-secrets`.
+ */
+export function isWithinRoot(candidateRealpath, rootRealpath) {
+    if (candidateRealpath === rootRealpath)
+        return true;
+    const root = rootRealpath.endsWith(path.sep) ? rootRealpath : rootRealpath + path.sep;
+    return candidateRealpath.startsWith(root);
+}
+export function loadApprovals(env = process.env, io = defaultIO) {
+    const raw = io.readFile(approvalsPath(env));
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed?.approvals))
+            return [];
+        return parsed.approvals.filter((a) => !!a && typeof a.path === 'string' && typeof a.workspaceId === 'string');
+    }
+    catch {
+        // A corrupt list must not be read as "everything is approved". Empty is the
+        // safe reading, and the operator can re-add.
+        return [];
+    }
+}
+function saveApprovals(approvals, env = process.env, io = defaultIO) {
+    io.writeFile(approvalsPath(env), `${JSON.stringify({ approvals }, null, 2)}\n`);
+}
+/**
+ * Approve a path for one workspace.
+ *
+ * Resolved and existence-checked HERE rather than at send time, so the operator
+ * finds out about a typo now instead of when a send mysteriously fails.
+ */
+export function approvePath(rawPath, workspaceId, env = process.env, io = defaultIO, resolver = defaultResolver, now = () => new Date()) {
+    const resolved = resolver.realpath(path.resolve(rawPath));
+    if (!resolved) {
+        return { ok: false, message: `No such path: ${rawPath}` };
+    }
+    const existing = loadApprovals(env, io);
+    if (existing.some((a) => a.workspaceId === workspaceId && a.path === resolved)) {
+        return {
+            ok: true,
+            alreadyPresent: true,
+            approved: existing.find((a) => a.workspaceId === workspaceId && a.path === resolved),
+        };
+    }
+    const approved = {
+        path: resolved,
+        raw: rawPath,
+        workspaceId,
+        approvedAt: now().toISOString(),
+    };
+    saveApprovals([...existing, approved], env, io);
+    return { ok: true, approved, alreadyPresent: false };
+}
+/** Remove one approval. Matches on the RESOLVED path, so removing by the same
+ *  spelling the operator approved with works even through a symlink. */
+export function revokePath(rawPath, workspaceId, env = process.env, io = defaultIO, resolver = defaultResolver) {
+    // Match on the RESOLVED path only. Matching the stored `raw` spelling as well
+    // looked convenient and was data loss: approving `output` from two different
+    // working directories stores two distinct resolved paths with the SAME raw
+    // spelling, so revoking either removed both. (codex P2, gpt-5.6-sol.)
+    //
+    // Two candidates, because an approved directory may since have been deleted —
+    // realpath then fails, and the operator must still be able to revoke the
+    // dangling grant by its absolute path.
+    const absolute = path.resolve(rawPath);
+    const resolved = resolver.realpath(absolute);
+    const before = loadApprovals(env, io);
+    const after = before.filter((a) => {
+        if (a.workspaceId !== workspaceId)
+            return true;
+        return !(a.path === absolute || (resolved !== undefined && a.path === resolved));
+    });
+    if (after.length !== before.length)
+        saveApprovals(after, env, io);
+    return { removed: before.length - after.length };
+}
+export function listApprovals(workspaceId, env = process.env, io = defaultIO) {
+    return loadApprovals(env, io).filter((a) => a.workspaceId === workspaceId);
+}
+/**
+ * May the AGENT send this path?
+ *
+ * A check against a MISTAKE, not against an adversary — see the module header.
+ * The agent can rewrite the list this consults.
+ *
+ * `implicitRoots` is the daemon's own working directory: the project the agent
+ * is already operating in, whose files it can read anyway. Everything else
+ * needs an explicit `yolo-bridge allow`.
+ *
+ * Fails closed on anything it cannot resolve — a path that does not exist, or a
+ * broken symlink, is not approved.
+ */
+export function checkPathApproved(rawPath, workspaceId, implicitRoots = [], env = process.env, io = defaultIO, resolver = defaultResolver) {
+    const resolved = resolver.realpath(path.resolve(rawPath));
+    if (!resolved)
+        return { approved: false, reason: `No such file: ${rawPath}` };
+    // Implicit roots are resolved too — the working directory can itself be
+    // reached through a symlink.
+    const roots = [];
+    for (const r of implicitRoots) {
+        const rr = resolver.realpath(path.resolve(r));
+        if (rr)
+            roots.push(rr);
+    }
+    for (const a of loadApprovals(env, io)) {
+        if (a.workspaceId === workspaceId)
+            roots.push(a.path);
+    }
+    for (const root of roots) {
+        if (isWithinRoot(resolved, root))
+            return { approved: true, root, resolvedPath: resolved };
+    }
+    return {
+        approved: false,
+        reason: `${path.basename(resolved)} is outside every approved path for this workspace. `
+            + 'Approve it from your own shell with `yolo-bridge allow <path>`.',
+    };
+}
+/**
+ * POSIX single-quoting for a path we print back as a COPYABLE command.
+ *
+ * Media directories routinely contain spaces (`~/My Footage/`), which alone
+ * makes an unquoted suggestion wrong. The sharper reason is that a path is
+ * attacker-influenceable in a way the operator would not expect — an agent can
+ * create a directory — and an unquoted `;` in a line the operator copies runs.
+ * Single quotes are literal in POSIX shells; the `'\''` dance closes, escapes
+ * one quote, and reopens. (codex P2, gpt-5.6-sol.)
+ */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * `yolo-bridge allow` — add, list or remove an approved path.
+ *
+ * Requires an attachment, because an approval is scoped to ONE workspace. A
+ * machine that attaches to several workspaces should not have a grant made for
+ * one silently apply to the others.
+ */
+export function runAllow(args, deps = {}) {
+    const { env, io, resolver } = deps;
+    const loadAttachmentFn = deps.loadAttachmentImpl
+        ?? ((e, i) => loadAttachmentDefault(e, i));
+    const attachment = loadAttachmentFn(env, io);
+    if (!attachment) {
+        return {
+            ok: false,
+            reason: 'not-attached',
+            message: 'No active attachment — run `yolo-bridge attach` first. Approvals are scoped to one workspace.',
+        };
+    }
+    const workspaceId = attachment.workspaceId;
+    if (args.includes('--list') || args.length === 0) {
+        const approvals = listApprovals(workspaceId, env, io);
+        if (!approvals.length) {
+            return {
+                ok: true,
+                lines: [
+                    'No approved paths for this workspace.',
+                    '',
+                    'The attached agent can send files from the daemon\'s working directory.',
+                    'To let it send from anywhere else:  yolo-bridge allow <path>',
+                ],
+            };
+        }
+        return {
+            ok: true,
+            lines: [
+                `Approved paths (${approvals.length}) — the attached agent may send files from these:`,
+                ...approvals.map((a) => `  ${a.path}${a.raw !== a.path ? `   (added as ${a.raw})` : ''}`),
+            ],
+        };
+    }
+    const removeIdx = args.indexOf('--remove');
+    if (removeIdx !== -1) {
+        const target = args[removeIdx + 1];
+        if (!target)
+            return { ok: false, reason: 'error', message: '`--remove` needs a path.' };
+        const { removed } = revokePath(target, workspaceId, env, io, resolver);
+        return removed
+            ? { ok: true, lines: [`Removed ${removed} approval(s) for ${target}.`] }
+            : { ok: false, reason: 'error', message: `${target} was not an approved path for this workspace.` };
+    }
+    const target = args.find((a) => !a.startsWith('-'));
+    if (!target)
+        return { ok: false, reason: 'error', message: 'A path is required.' };
+    const result = approvePath(target, workspaceId, env, io, resolver);
+    if (!result.ok)
+        return { ok: false, reason: 'error', message: result.message };
+    if (result.alreadyPresent) {
+        return { ok: true, lines: [`Already approved: ${result.approved.path}`] };
+    }
+    return {
+        ok: true,
+        lines: [
+            `Approved: ${result.approved.path}`,
+            'The attached agent may now send files from here. Remove it with:',
+            // The RESOLVED path, not what was typed: a relative spelling is ambiguous
+            // across working directories, and pasting it later could revoke a
+            // different grant than the one just made.
+            `  yolo-bridge allow --remove ${shellQuote(result.approved.path)}`,
+        ],
+    };
+}

package/dist/cli.js

@@ -22,6 +22,8 @@ import { realpathSync, existsSync, readFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { runLogin } from './login-cmd.js';
 import { runAttachFromDisk, pickWorkspaceFromDisk } from './attach-cmd.js';
+import { runShare } from './share-cmd.js';
+import { runAllow } from './approved-paths.js';
 import { runDetach } from './detach-cmd.js';
 import { getStatus, formatStatus } from './status-cmd.js';
 import { startLocalAgent, stopLocalAgent, DEFAULT_AGENT_BIN } from './local-agent.js';
@@ -99,6 +101,11 @@ function printHelp() {
         '                         RESUMES it (same tile) instead of adding a duplicate; --fresh skips',
         '                         that check entirely.',
         '  detach                 Detach the current workspace attachment.',
+        '  allow <path>           Let the ATTACHED AGENT send files from this path. You type',
+        '                         this; nothing in the cloud can. Also --list and --remove <path>.',
+        '                         The daemon\'s own working directory is always allowed.',
+        '  share <path>           Share a local file with the attached workspace, so a cloud',
+        '                         agent can see it. Push only — nothing reads your disk remotely.',
         '  status                 Print local login/attach state.',
         '  version                Print the installed yolo-bridge version (also --version, -v).',
         '  --help                 Print this help.',
@@ -547,6 +554,30 @@ function cmdStatus() {
     process.stdout.write(`${formatStatus(getStatus())}\n`);
     return 0;
 }
+function cmdAllow(args) {
+    const result = runAllow(args);
+    if (!result.ok) {
+        process.stderr.write(`yolo-bridge allow: ${result.message}\n`);
+        return 1;
+    }
+    process.stdout.write(`${result.lines.join('\n')}\n`);
+    return 0;
+}
+async function cmdShare(args) {
+    const rawPath = args[0];
+    if (!rawPath || rawPath.startsWith('-')) {
+        process.stderr.write('yolo-bridge share: a file path is required.\n\n  yolo-bridge share ./cut.mp4\n');
+        return 64;
+    }
+    const result = await runShare(rawPath, { commonApiBaseUrl: apiUrl() });
+    if (!result.ok) {
+        // Every one of these is an operator-actionable condition, not a bug, so it
+        // prints as a sentence with no stack trace.
+        process.stderr.write(`yolo-bridge share: ${result.message}\n`);
+        return 1;
+    }
+    return 0;
+}
 async function cmdWorkspaces() {
     const result = await runListWorkspaces({ commonApiBaseUrl: apiUrl() });
     if (!result.ok) {
@@ -601,6 +632,10 @@ async function main() {
             return cmdAttach(rest);
         case 'detach':
             return cmdDetach();
+        case 'allow':
+            return cmdAllow(rest);
+        case 'share':
+            return cmdShare(rest);
         case 'status':
             return cmdStatus();
         case 'version':

package/dist/share-cmd.js

@@ -0,0 +1,217 @@
+/**
+ * `yolo-bridge share <path>` — hand a LOCAL file up to the attached workspace
+ * so the cloud orchestrator can see it.
+ *
+ * DIRECTION IS THE SECURITY MODEL. This is the only file path in the daemon,
+ * and it runs because the operator (or their local agent) asked for THIS file.
+ * There is no counterpart that lets the cloud name a path and have the daemon
+ * read it — that would turn a cloud-side prompt injection into a read of the
+ * operator's disk.
+ *
+ * Bytes go straight from this process to R2 via a presigned PUT. They do not
+ * pass through common-api, so a large file is not bounded by any JSON body
+ * limit, and the API never holds the operator's content.
+ */
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import path from 'node:path';
+import { presignShare, finalizeShare, YoloBridgeApiError, } from './api-client.js';
+import { loadAuth, loadAttachment } from './config-store.js';
+/**
+ * Mirrors common-api's `MAX_ASSET_BYTES`. The server is authoritative and
+ * refuses over-cap uploads on its own; this copy exists so a 2 GB video fails
+ * in a second with a readable message instead of after a long upload.
+ *
+ * If the server cap ever moves, the worst this stale copy produces is a local
+ * refusal of something the server would have accepted — a clear message, not a
+ * corrupt upload.
+ */
+export const MAX_SHARE_BYTES = 100 * 1024 * 1024;
+const MIME_BY_EXT = {
+    '.mp4': 'video/mp4', '.mov': 'video/quicktime', '.webm': 'video/webm', '.mkv': 'video/x-matroska',
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif',
+    '.webp': 'image/webp', '.svg': 'image/svg+xml', '.heic': 'image/heic',
+    '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.m4a': 'audio/mp4', '.flac': 'audio/flac',
+    '.pdf': 'application/pdf', '.zip': 'application/zip', '.json': 'application/json',
+    '.txt': 'text/plain', '.md': 'text/markdown', '.csv': 'text/csv',
+};
+export function guessMimeType(filename) {
+    return MIME_BY_EXT[path.extname(filename).toLowerCase()] ?? 'application/octet-stream';
+}
+export function formatBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)} KB`;
+    if (n < 1024 * 1024 * 1024)
+        return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+    return `${(n / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+/** Raised for a condition the operator can act on. The CLI prints `.message`
+ *  and exits non-zero — no stack trace, because none of these are bugs. */
+export class ShareError extends Error {
+}
+/**
+ * Everything decided from the local filesystem, BEFORE a single byte moves.
+ *
+ * Split out from the upload so the refusals are testable without a network,
+ * and so an over-cap file costs a `stat`, not an upload.
+ */
+export async function inspectLocalFile(rawPath) {
+    const absolutePath = path.resolve(rawPath);
+    let info;
+    try {
+        info = await stat(absolutePath);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === 'ENOENT')
+            throw new ShareError(`No such file: ${rawPath}`);
+        if (code === 'EACCES')
+            throw new ShareError(`Permission denied reading ${rawPath}`);
+        throw new ShareError(`Could not read ${rawPath}: ${err.message}`);
+    }
+    if (info.isDirectory()) {
+        throw new ShareError(`${rawPath} is a directory. Share a single file.`);
+    }
+    if (!info.isFile()) {
+        throw new ShareError(`${rawPath} is not a regular file.`);
+    }
+    if (info.size > MAX_SHARE_BYTES) {
+        // Name both numbers: "too large" without the cap leaves the operator
+        // guessing how much to trim.
+        throw new ShareError(`${path.basename(absolutePath)} is ${formatBytes(info.size)}, over the ${formatBytes(MAX_SHARE_BYTES)} limit for a shared file.`);
+    }
+    return {
+        absolutePath,
+        // Only the BASENAME travels. The operator's directory layout is not the
+        // cloud's business.
+        filename: path.basename(absolutePath),
+        size: info.size,
+        mimeType: guessMimeType(absolutePath),
+    };
+}
+/**
+ * Presign → PUT the bytes to R2 → finalize.
+ *
+ * The PUT streams from disk rather than buffering: a 100 MB file must not
+ * become a 100 MB string in this process.
+ */
+export async function shareFile(rawPath, deps) {
+    const write = deps.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const file = await inspectLocalFile(rawPath);
+    // One fetch for all three legs. Taking it from `deps` too means a caller can
+    // inject it once instead of having to remember to put it on `cfg` as well.
+    const cfg = { ...deps.cfg, fetchImpl: deps.cfg.fetchImpl ?? deps.fetchImpl };
+    write(`Sharing ${file.filename} (${formatBytes(file.size)})…`);
+    const presigned = await presignShare(cfg, deps.workspaceId, deps.attachmentId, {
+        filename: file.filename,
+        mimeType: file.mimeType,
+        size: file.size,
+    });
+    const fetchImpl = (deps.fetchImpl ?? deps.cfg.fetchImpl ?? fetch);
+    // Streamed from disk rather than buffered: a 100 MB file must not become a
+    // 100 MB Buffer in this process. The stream is opened lazily, so it is held
+    // in a variable and explicitly destroyed on every failure path — otherwise a
+    // rejected or refused PUT leaks the descriptor.
+    const body = createReadStream(file.absolutePath);
+    // A read failure — the file deleted, truncated or unreadable mid-upload —
+    // arrives as an 'error' EVENT, not a rejected promise. With no listener Node
+    // escalates it to an uncaughtException and takes the process down, which for
+    // a daemon sharing a file the operator just moved is a very poor trade.
+    // Captured here and reported as an ordinary failure instead.
+    let readError;
+    body.on('error', (err) => { readError = err; });
+    let put;
+    try {
+        put = await fetchImpl(presigned.uploadUrl, {
+            method: presigned.method || 'PUT',
+            headers: { ...presigned.headers, 'Content-Length': String(file.size) },
+            body: body,
+            // Node's fetch requires this for a stream body.
+            duplex: 'half',
+        });
+    }
+    catch (err) {
+        body.destroy();
+        throw new ShareError(`Upload failed: ${err?.message || 'network error'}`);
+    }
+    if (!put.ok) {
+        body.destroy();
+        // The presigned URL is short-lived and size-bound; both failure modes are
+        // worth naming rather than surfacing a bare status.
+        throw new ShareError(`Upload failed (HTTP ${put.status}). The link may have expired, or the file changed size while uploading. Try again.`);
+    }
+    if (readError) {
+        throw new ShareError(`Could not read ${file.filename} while uploading: ${readError.message}`);
+    }
+    const finalized = await finalizeShare(cfg, deps.workspaceId, deps.attachmentId, presigned.assetId);
+    write(`Shared ${file.filename} → ${finalized.assetId}`);
+    return finalized;
+}
+/** Turn an API error into something the operator can act on. */
+export function describeShareFailure(err) {
+    if (err instanceof ShareError)
+        return err.message;
+    if (err instanceof YoloBridgeApiError) {
+        if (err.code === 'PAYLOAD_TOO_LARGE')
+            return err.message;
+        if (err.code === 'STORAGE_NOT_CONFIGURED')
+            return 'File sharing is not available on this server.';
+        if (err.code === 'WORKSPACE_LIMIT_REACHED' || err.code === 'LIMIT_REACHED')
+            return err.message;
+        if (err.status === 403)
+            return 'This daemon is not attached to that workspace any more. Re-run `yolo-bridge attach`.';
+        return err.message;
+    }
+    return err?.message || 'Share failed.';
+}
+/**
+ * The disk-backed entry point, mirroring `runDetach`.
+ *
+ * `share` and a running `yolo-bridge attach` are two SEPARATE processes, so
+ * this reads the attachment identity and its workspace-scoped credential from
+ * the config store rather than from daemon memory — the same credential the
+ * running daemon uses, and the only one the upload routes accept (Boundary B).
+ */
+export async function runShare(rawPath, deps) {
+    // Same precondition ordering as detach: `auth.json` is what makes this a
+    // set-up machine, and its absence has a far better remedy to offer than a
+    // 403 would.
+    if (!loadAuth(deps.env, deps.io)) {
+        return { ok: false, reason: 'not-logged-in', message: 'Not logged in — run `yolo-bridge login` first.' };
+    }
+    const attachment = loadAttachment(deps.env, deps.io);
+    if (!attachment) {
+        return { ok: false, reason: 'not-attached', message: 'No active attachment — run `yolo-bridge attach` first.' };
+    }
+    const scopedToken = attachment.scopedToken;
+    if (!scopedToken) {
+        // Nothing on this machine can mint one for an existing attachment, so say
+        // so plainly rather than sending an account token to be refused.
+        return {
+            ok: false,
+            reason: 'no-scoped-credential',
+            message: 'No workspace-scoped credential is stored for this attachment, so files cannot be shared '
+                + 'from this machine. Run `yolo-bridge attach` to reconnect.',
+        };
+    }
+    const cfg = {
+        commonApiBaseUrl: deps.commonApiBaseUrl,
+        accessToken: scopedToken,
+        fetchImpl: deps.fetchImpl,
+    };
+    try {
+        const { assetId } = await shareFile(rawPath, {
+            cfg,
+            workspaceId: attachment.workspaceId,
+            attachmentId: attachment.attachmentId,
+            fetchImpl: deps.fetchImpl,
+            write: deps.write,
+        });
+        return { ok: true, assetId };
+    }
+    catch (err) {
+        return { ok: false, reason: 'error', message: describeShareFailure(err) };
+    }
+}

package/dist/status-cmd.js

@@ -22,6 +22,7 @@
  * longer invisible just because it can't be printed to the screen.
  */
 import { loadAuth, loadAttachment } from './config-store.js';
+import { listApprovals } from './approved-paths.js';
 import { loadConnectionState, formatConnectionEvent } from './connection-state.js';
 export function getStatus(deps = {}) {
     const now = deps.now ?? Date.now;
@@ -31,6 +32,11 @@ export function getStatus(deps = {}) {
         loggedIn: Boolean(auth),
         attached: Boolean(attachment),
     };
+    if (attachment) {
+        const approvals = listApprovals(attachment.workspaceId, deps.env, deps.io);
+        if (approvals.length)
+            report.approvedPaths = approvals.map((a) => a.path);
+    }
     if (auth) {
         report.tokenExpiresAtMs = auth.expiresAtMs;
         report.tokenExpired = auth.expiresAtMs <= now();
@@ -78,5 +84,11 @@ export function formatStatus(report) {
             }
         }
     }
+    if (report.approvedPaths?.length) {
+        lines.push(`Agent may send files from (${report.approvedPaths.length} approved path(s)):`);
+        for (const p of report.approvedPaths)
+            lines.push(`  ${p}`);
+        lines.push('(plus the daemon\'s working directory. Change with `yolo-bridge allow`.)');
+    }
     return lines.join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yolo-labs/yolobridge",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "YoloBridge — local coding-agent daemon that attaches a user's own Claude Code/Codex session to a YOLO Studio workspace as a first-class tile (docs/YOLOBRIDGE_PLAN.md, build-order Phase 5).",
   "license": "MIT",
   "type": "module",