codiedev 0.9.83 → 0.9.85

package/dist/cli.d.ts

@@ -9,6 +9,7 @@
  *   codiedev ping <user> "<msg>"       — send a message (optionally --with <key>)
  *   codiedev inbox                     — list pings (use --unread to filter)
  *   codiedev read <ping-id>            — mark read + show full message
+ *   codiedev reply <ping-id> "<msg>"   — answer a ping in its thread
  *   codiedev note "<text>"             — capture a thought
  *   codiedev help                      — show this help
  */

package/dist/cli.js

@@ -10,6 +10,7 @@
  *   codiedev ping <user> "<msg>"       — send a message (optionally --with <key>)
  *   codiedev inbox                     — list pings (use --unread to filter)
  *   codiedev read <ping-id>            — mark read + show full message
+ *   codiedev reply <ping-id> "<msg>"   — answer a ping in its thread
  *   codiedev note "<text>"             — capture a thought
  *   codiedev help                      — show this help
  */
@@ -53,8 +54,8 @@ const utils_1 = require("./utils");
 const push_1 = require("./commands/push");
 const delete_1 = require("./commands/delete");
 const pull_1 = require("./commands/pull");
-const ask_1 = require("./commands/ask");
 const ping_1 = require("./commands/ping");
+const reply_1 = require("./commands/reply");
 const inbox_1 = require("./commands/inbox");
 const note_1 = require("./commands/note");
 const doctor_1 = require("./commands/doctor");
@@ -100,19 +101,17 @@ Artifacts:
   codiedev delete <key> [-y]             Delete every version of an artifact you
                                          authored (clean up bad/test pushes).
                                          Asks for confirmation; -y to skip.
-  codiedev ask "<question>"              Ask a natural-language question of the
-                                         team's collective memory. Returns an
-                                         LLM-synthesized answer with citations
-                                         pointing at sessions + artifacts.
 
 Messaging:
-  codiedev ping <user> "<msg>" [--with <key>]
+  codiedev ping <user> "<msg>" [--with <key>] [--file <path>]
                                          Send a message to a teammate
   codiedev send <key> <user> ["<msg>"]   Share an artifact + ping in one step
   codiedev share <key> <user> [--role read|edit]
                                          Silently grant access (no notification)
   codiedev inbox [--unread] [--limit N]  Show messages
   codiedev read <ping-id>                Mark read + show full message
+  codiedev reply <ping-id> "<msg>" [--file <path>]
+                                         Answer a message in its thread
 
 Starter packs:
   codiedev pack list                     Packs assigned to your team
@@ -284,16 +283,36 @@ codiedev pull — fetch an artifact
 codiedev ping — send a teammate a message, optionally attached to an artifact
 
   Usage:
-    codiedev ping <user> "<message>" [--with <artifact-key>]
+    codiedev ping <user> "<message>" [--with <artifact-key>] [--file <path>]
 
   <user> resolves to a teammate in your org by first name, full name,
   or email. Ambiguous matches return a list — retry with the full email.
 
+  --file attaches a file (repeat for up to 10, 20 MB each). They see it
+  in their inbox and can open it in the portal.
+
   Teammates are notified by email and can reply from their own agent.
+  To answer a message you received, use 'codiedev reply' instead: it
+  keeps the exchange in one thread.
 
   Examples:
     codiedev ping <teammate> "thoughts on batch vs parallel?" --with spec-cart-clear.md
     codiedev ping <teammate>@example.com "can you take this one?"
+    codiedev ping <teammate> "shard timings from last night" --file ./timings.csv
+`.trim(),
+    reply: `
+codiedev reply — answer a message in its thread
+
+  Usage:
+    codiedev reply <ping-id> "<message>" [--file <path>]
+
+  Grab the ping-id from 'codiedev inbox'. The reply goes to whoever sent
+  that ping, stays in the same conversation, and marks their message
+  read and answered, so it stops showing as waiting on you.
+
+  Examples:
+    codiedev reply <ping-id> "yes, step 2 covers partial refunds"
+    codiedev reply <ping-id> "updated numbers attached" --file ./timings.csv
 `.trim(),
     inbox: `
 codiedev inbox — show messages from teammates
@@ -415,13 +434,12 @@ signal. The stored artifact type still follows the filename rule
 
 ## Portal
 
-Everything you do in the CLI is visible at:
+Messages you send and receive are also at:
 
     https://codiedev.com/portal/inbox
 
-Your CTO (or any non-technical teammate) can follow along without ever
-touching a terminal — they read the artifacts in the portal and get
-email notifications when pinged.
+A teammate can read and answer there without touching a terminal, and
+gets an email when pinged.
 
 ## Agent-native
 
@@ -564,8 +582,10 @@ async function main() {
                 await (0, pull_1.runPull)(rest);
                 return;
             case "ask":
-                await (0, ask_1.runAsk)(rest);
-                return;
+                // Removed 2026-11. Kept as a named case so the answer is a pointer,
+                // not "unknown command".
+                console.error('codiedev ask has been removed. Use: codiedev search "<query>"');
+                process.exit(1);
             case "ping":
                 await (0, ping_1.runPing)(rest);
                 return;
@@ -582,6 +602,9 @@ async function main() {
             case "read":
                 await (0, inbox_1.runRead)(rest);
                 return;
+            case "reply":
+                await (0, reply_1.runReply)(rest);
+                return;
             case "scrub": {
                 const { runScrubCommand } = await Promise.resolve().then(() => __importStar(require("./commands/scrub")));
                 process.exitCode = await runScrubCommand(rest);

package/dist/commands/inbox.js

@@ -107,7 +107,16 @@ async function runRead(args) {
         console.log();
         console.log(ping.body || "(empty)");
         console.log();
+        if (ping.attachments?.length) {
+            console.log(ping.attachments.length === 1 ? "File:" : "Files:");
+            for (const a of ping.attachments) {
+                console.log(`  ${(0, inboxFormat_1.fileList)([a])}`);
+                console.log(`    ${a.url ?? "(no longer stored)"}`);
+            }
+            console.log();
+        }
         console.log("✓ Marked as read");
+        console.log(`Reply: codiedev reply ${ping.pingId} "<message>"`);
         if (ping.subjectKey) {
             console.log(`Pull:  codiedev pull ${ping.subjectKey}`);
         }

package/dist/commands/pack.d.ts

@@ -2,6 +2,7 @@ import { CodiedevConfig } from "../utils";
 import { InstallOptions, PackInstallResult, PackUninstallResult } from "../packs/install";
 import { HarnessName } from "../packs/harnesses";
 import { PackManifest } from "../packs/manifest";
+import { PackBundleFile } from "../packs/files";
 export declare const DEFAULT_BACKEND_URL = "https://cli.codiedev.com";
 /** CODIEDEV_TOKEN alone is enough: no ~/.codiedev/config.json needed (CI).
  * CODIEDEV_URL defaults to production. Otherwise the connected config. */
@@ -22,6 +23,8 @@ export interface PackArgs {
     manifest?: boolean;
 }
 export declare function parsePackArgs(args: string[]): PackArgs;
+/** Download a pack's files (SIG-127) into the blob cache, verified by sha256. */
+export declare function downloadPackFiles(config: CodiedevConfig, slug: string, files: PackBundleFile[], dir: string): Promise<number>;
 export declare function runList(config: CodiedevConfig, json: boolean, overrides?: Partial<InstallOptions>): Promise<void>;
 export interface InstallRun {
     installed: PackInstallResult[];
@@ -45,10 +48,10 @@ export declare function commitExport(dir: string, message: string): string;
 /** Write a CI-committable copy of the pack: `<out>/plugins/<slug>/…` plus
  * `<out>/.claude-plugin/marketplace.json` (existing entries for other packs
  * in the same folder are kept). */
-export declare function exportPluginFolder(out: string, manifest: PackManifest): string;
+export declare function exportPluginFolder(out: string, manifest: PackManifest, blobDir?: string): string;
 export declare function runExport(config: CodiedevConfig, args: PackArgs): Promise<{
     written: string;
     commit?: string;
 }>;
 export declare function runApply(config: CodiedevConfig, args: PackArgs): Promise<Record<string, unknown>>;
-export declare const PACK_HELP = "Usage:\n  codiedev pack list                     Packs assigned to your team\n  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie,pi] [--dry-run] [--json] [--quiet]\n                                         Install one pack, or every pack that applies\n  codiedev pack status [--json]          Installed packs and whether they're up to date\n  codiedev pack export <slug> --out <dir> [--git] [--manifest]\n                                         Write the pack as a Claude-format plugin folder plus\n                                         .claude-plugin/marketplace.json (commit it for CI).\n                                         --git inits the folder and commits; --manifest writes\n                                         an editable <slug>.pack.md instead\n  codiedev pack apply <pack.md>          Create or update a pack from a pack.md\n\nCursor: packs are copied to ~/.cursor/plugins/local/codiedev-<slug>/. A Cursor\nteam admin can disable \"user local plugin imports\"; then Cursor ignores them.\n\nAuto-update: session starts run `codiedev pack install --quiet` in the background\nabout once an hour. Opt out with CODIEDEV_PACK_AUTOSYNC=0.\n\nHooks for specific skills only: codiedev hook-gate --skills a,b --cmd-b64 <base64url of the command>\n(the pack editor writes this; the command runs via /bin/sh, or cmd.exe on Windows)\n\nCI: set CODIEDEV_TOKEN to a pack CI key (cdvci_\u2026, from the pack's page in the portal).\nNo `codiedev connect` or config file is needed. CI mode (a cdvci_ key, or CI=true)\nnever auto-syncs, reports or prunes, installs the one pack the key can see, defaults\n--harness to claude when it's on PATH, and exits non-zero unless every requested tool\ngot the pack. Skills from a pack are /<pack-slug>:<skill> in Claude Code.\n\n  GitLab CI (.gitlab-ci.yml; add CODIEDEV_TOKEN and ANTHROPIC_API_KEY as masked\n  CI/CD variables):\n    pack-scan:\n      image: node:22\n      script:\n        - npm i -g codiedev @anthropic-ai/claude-code\n        - codiedev pack install --harness claude\n        - claude -p \"/platform-starter:healthcare-scan\" --output-format text\n\n  GitHub Actions (repository secrets CODIEDEV_TOKEN and ANTHROPIC_API_KEY):\n    - uses: actions/setup-node@v4\n      with: { node-version: 22 }\n    - run: npm i -g codiedev @anthropic-ai/claude-code\n    - run: codiedev pack install --harness claude\n      env:\n        CODIEDEV_TOKEN: ${{ secrets.CODIEDEV_TOKEN }}\n    - run: claude -p \"/platform-starter:healthcare-scan\" --output-format text\n      env:\n        ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n\n  Or vendor the plugin into the repo instead of installing at build time:\n    codiedev pack export <slug> --out .codiedev/packs";
+export declare const PACK_HELP = "Usage:\n  codiedev pack list                     Packs assigned to your team\n  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie,pi] [--dry-run] [--json] [--quiet]\n                                         Install one pack, or every pack that applies\n  codiedev pack status [--json]          Installed packs and whether they're up to date\n  codiedev pack export <slug> --out <dir> [--git] [--manifest]\n                                         Write the pack as a Claude-format plugin folder plus\n                                         .claude-plugin/marketplace.json (commit it for CI).\n                                         --git inits the folder and commits; --manifest writes\n                                         an editable <slug>.pack.md instead\n  codiedev pack apply <pack.md> [--dry-run]\n                                         Create or update a pack from a pack.md\n\nFiles (scripts, PDFs, a runner folder): list them under \"## Files\" in pack.md,\none \"- <path in pack> <- <local path>\" per line (local paths are relative to\nthe pack.md; \".\" is the pack root):\n\n  ## Files\n\n  - runner <- ~/.claude/runner\n  - skills/healthcare-scan <- ~/.claude/skills/healthcare-scan\n\n`pack apply` uploads them (admins and team managers; 15MB per file, 50MB per\npack; caches, .git and hidden files are skipped). Without a \"## Files\"\nsection the pack's files are left alone. In skills, point at files relative to\nthe skill's folder, or use ${CLAUDE_PLUGIN_ROOT}/runner/...: Codiedev swaps in the\nreal path for Codex, Copilot, Cursor, pi and Codie.\n\nCursor: packs are copied to ~/.cursor/plugins/local/codiedev-<slug>/. A Cursor\nteam admin can disable \"user local plugin imports\"; then Cursor ignores them.\n\nAuto-update: session starts run `codiedev pack install --quiet` in the background\nabout once an hour. Opt out with CODIEDEV_PACK_AUTOSYNC=0.\n\nHooks for specific skills only: codiedev hook-gate --skills a,b --cmd-b64 <base64url of the command>\n(the pack editor writes this; the command runs via /bin/sh, or cmd.exe on Windows)\n\nCI: set CODIEDEV_TOKEN to a pack CI key (cdvci_\u2026, from the pack's page in the portal).\nNo `codiedev connect` or config file is needed. CI mode (a cdvci_ key, or CI=true)\nnever auto-syncs, reports or prunes, installs the one pack the key can see, defaults\n--harness to claude when it's on PATH, and exits non-zero unless every requested tool\ngot the pack. Skills from a pack are /<pack-slug>:<skill> in Claude Code.\n\n  GitLab CI (.gitlab-ci.yml; add CODIEDEV_TOKEN and ANTHROPIC_API_KEY as masked\n  CI/CD variables):\n    pack-scan:\n      image: node:22\n      script:\n        - npm i -g codiedev @anthropic-ai/claude-code\n        - codiedev pack install --harness claude\n        - claude -p \"/platform-starter:healthcare-scan\" --output-format text\n\n  GitHub Actions (repository secrets CODIEDEV_TOKEN and ANTHROPIC_API_KEY):\n    - uses: actions/setup-node@v4\n      with: { node-version: 22 }\n    - run: npm i -g codiedev @anthropic-ai/claude-code\n    - run: codiedev pack install --harness claude\n      env:\n        CODIEDEV_TOKEN: ${{ secrets.CODIEDEV_TOKEN }}\n    - run: claude -p \"/platform-starter:healthcare-scan\" --output-format text\n      env:\n        ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n\n  Or vendor the plugin into the repo instead of installing at build time:\n    codiedev pack export <slug> --out .codiedev/packs";

package/dist/commands/pack.js

@@ -37,6 +37,7 @@ exports.PACK_HELP = exports.DEFAULT_BACKEND_URL = void 0;
 exports.resolvePackConfig = resolvePackConfig;
 exports.ciHarnesses = ciHarnesses;
 exports.parsePackArgs = parsePackArgs;
+exports.downloadPackFiles = downloadPackFiles;
 exports.runList = runList;
 exports.runInstall = runInstall;
 exports.runStatus = runStatus;
@@ -59,6 +60,7 @@ const harnesses_2 = require("../packs/harnesses");
 const os = __importStar(require("os"));
 const utils_1 = require("../utils");
 const shared_1 = require("./shared");
+const files_1 = require("../packs/files");
 // --- CI (pack-scoped `cdvci_` keys) ------------------------------------------
 exports.DEFAULT_BACKEND_URL = "https://cli.codiedev.com";
 /** CODIEDEV_TOKEN alone is enough: no ~/.codiedev/config.json needed (CI).
@@ -101,7 +103,23 @@ const USAGE = `Usage:
                                          .claude-plugin/marketplace.json (commit it for CI).
                                          --git inits the folder and commits; --manifest writes
                                          an editable <slug>.pack.md instead
-  codiedev pack apply <pack.md>          Create or update a pack from a pack.md
+  codiedev pack apply <pack.md> [--dry-run]
+                                         Create or update a pack from a pack.md
+
+Files (scripts, PDFs, a runner folder): list them under "## Files" in pack.md,
+one "- <path in pack> <- <local path>" per line (local paths are relative to
+the pack.md; "." is the pack root):
+
+  ## Files
+
+  - runner <- ~/.claude/runner
+  - skills/healthcare-scan <- ~/.claude/skills/healthcare-scan
+
+\`pack apply\` uploads them (admins and team managers; 15MB per file, 50MB per
+pack; caches, .git and hidden files are skipped). Without a "## Files"
+section the pack's files are left alone. In skills, point at files relative to
+the skill's folder, or use \${CLAUDE_PLUGIN_ROOT}/runner/...: Codiedev swaps in the
+real path for Codex, Copilot, Cursor, pi and Codie.
 
 Cursor: packs are copied to ~/.cursor/plugins/local/codiedev-<slug>/. A Cursor
 team admin can disable "user local plugin imports"; then Cursor ignores them.
@@ -188,6 +206,16 @@ async function fetchManifest(config, slug) {
     const raw = await (0, shared_1.apiRequest)("GET", "/api/cli/packs/manifest", { config, query: { slug } });
     return (0, manifest_1.parseManifest)(raw);
 }
+/** Download a pack's files (SIG-127) into the blob cache, verified by sha256. */
+async function downloadPackFiles(config, slug, files, dir) {
+    if (!files.length)
+        return 0;
+    const { downloaded } = await (0, files_1.ensureBlobs)(dir, files, (file) => (0, shared_1.apiRequestBytes)("GET", "/api/cli/packs/file", { config, query: { slug, sha256: file.sha256 }, maxBytes: files_1.PACK_FILE_MAX_BYTES + 1 })
+        .catch((error) => {
+        throw new Error(`couldn't download ${file.path} (${error.message})`);
+    }));
+    return downloaded;
+}
 async function runList(config, json, overrides = {}) {
     const packs = await listPacks(config);
     const registry = (0, store_1.readRegistry)((0, paths_1.packsRoot)(overrides.env, overrides.home));
@@ -206,6 +234,7 @@ async function runList(config, json, overrides = {}) {
             `${p.itemCount ?? 0} skill${p.itemCount === 1 ? "" : "s"}`,
             `${p.agentCount ?? 0} agent${p.agentCount === 1 ? "" : "s"}`,
             ...(p.hasHooks ? ["hooks"] : []),
+            ...(p.fileCount ? [`${p.fileCount} file${p.fileCount === 1 ? "" : "s"}`] : []),
         ].join(", ");
         const channel = (0, manifest_2.cleanLabel)(p.channel, 16);
         console.log(`${p.slug}  v${p.version}${channel ? ` [${channel}]` : ""}  ${(0, manifest_2.displayName)(p)}  (${counts}) — ${state}`);
@@ -244,8 +273,27 @@ async function runInstall(config, args, overrides = {}) {
             // A listed pack that 404s a moment later (race with an unassign) is skipped.
         }
     }
-    let installed = manifests.length
-        ? (0, install_1.installPacks)({ ...overrides, manifests, harnesses, dryRun: args.dryRun })
+    // Pack files first: a pack whose files can't be fetched keeps its previous
+    // install untouched rather than shipping half its folders.
+    const blobDir = overrides.blobDir ?? (0, files_1.blobsDir)(root);
+    const ready = [];
+    let downloadFailed = false;
+    for (const manifest of manifests) {
+        if (args.dryRun || !manifest.files?.length) {
+            ready.push(manifest);
+            continue;
+        }
+        try {
+            await downloadPackFiles(config, manifest.slug, manifest.files, blobDir);
+            ready.push(manifest);
+        }
+        catch (error) {
+            downloadFailed = true;
+            console.error(`✗ ${manifest.slug}: ${error.message}`);
+        }
+    }
+    let installed = ready.length
+        ? (0, install_1.installPacks)({ ...overrides, manifests: ready, harnesses, dryRun: args.dryRun, blobDir })
         : [];
     let removed = [];
     if (!args.dryRun && !ci) {
@@ -293,7 +341,7 @@ async function runInstall(config, args, overrides = {}) {
     const ciFailed = ci && !args.dryRun && (installed.length === 0 || installed.some((p) => p.results.some((r) => r.status !== "ok")));
     if (ci && !args.dryRun && installed.length === 0)
         console.error("No pack is visible to this key.");
-    if (failed || ciFailed || (args.slug && removed.length + revoked.length > 0))
+    if (failed || ciFailed || downloadFailed || (args.slug && removed.length + revoked.length > 0))
         process.exitCode = 1;
     return run;
 }
@@ -494,9 +542,9 @@ function readMarketplaceEntries(dir) {
 /** Write a CI-committable copy of the pack: `<out>/plugins/<slug>/…` plus
  * `<out>/.claude-plugin/marketplace.json` (existing entries for other packs
  * in the same folder are kept). */
-function exportPluginFolder(out, manifest) {
+function exportPluginFolder(out, manifest, blobDir) {
     fs.mkdirSync(out, { recursive: true });
-    const dir = (0, store_1.writePluginDir)(out, manifest);
+    const dir = (0, store_1.writePluginDir)(out, manifest, { blobDir });
     const entries = readMarketplaceEntries(out).filter((e) => e.slug !== manifest.slug);
     entries.push({ slug: manifest.slug, description: manifest.description || manifest.name, version: manifest.version });
     (0, store_1.writeMarketplace)(out, entries);
@@ -524,7 +572,24 @@ async function runExport(config, args) {
         fs.mkdirSync(out, { recursive: true });
         // <slug>.pack.md so several packs can share one folder.
         written = path.join(out, `${args.slug}.pack.md`);
-        (0, store_1.writeFileAtomic)(written, res.markdown.endsWith("\n") ? res.markdown : `${res.markdown}\n`);
+        let markdown = res.markdown.endsWith("\n") ? res.markdown : `${res.markdown}\n`;
+        // Pack files go beside it in <slug>.files/, mapped back with `## Files`
+        // so `pack apply` round-trips them.
+        const files = (0, manifest_1.parseManifest)({ slug: args.slug, version: 0, contentHash: "-", files: res.files }).files ?? [];
+        if (files.length) {
+            const blobDir = (0, files_1.blobsDir)((0, paths_1.packsRoot)());
+            await downloadPackFiles(config, args.slug, files, blobDir);
+            const filesDir = path.join(out, `${args.slug}.files`);
+            fs.rmSync(filesDir, { recursive: true, force: true });
+            for (const f of files) {
+                const target = path.join(filesDir, ...f.path.split("/"));
+                fs.mkdirSync(path.dirname(target), { recursive: true });
+                fs.copyFileSync((0, files_1.blobPath)(blobDir, f.sha256), target);
+                fs.chmodSync(target, f.executable ? 0o755 : 0o644);
+            }
+            markdown = `${markdown.trimEnd()}\n\n## Files\n\n- . <- ./${args.slug}.files\n`;
+        }
+        (0, store_1.writeFileAtomic)(written, markdown);
         message = `codiedev pack export ${args.slug} (${args.slug}.pack.md)`;
     }
     else {
@@ -539,7 +604,9 @@ async function runExport(config, args) {
                 throw new Error(`Refusing to export ${args.slug}: ${error.message}`);
             throw error;
         }
-        written = exportPluginFolder(out, manifest);
+        const blobDir = (0, files_1.blobsDir)((0, paths_1.packsRoot)());
+        await downloadPackFiles(config, manifest.slug, manifest.files ?? [], blobDir);
+        written = exportPluginFolder(out, manifest, blobDir);
         message = `codiedev pack export ${manifest.slug} v${manifest.version}`;
     }
     const commit = args.git ? commitExport(out, message) : undefined;
@@ -567,13 +634,31 @@ async function runApply(config, args) {
     }
     if (!markdown.trim())
         throw new Error(`${file} is empty`);
+    // `## Files` (SIG-127): local folders/files to ship in the plugin dir.
+    // Absent ⇒ the pack's files are left as they are.
+    const entries = (0, files_1.parseFilesSection)(markdown);
+    const local = entries ? (0, files_1.collectLocalFiles)(entries, path.dirname(file)) : null;
+    for (const note of local?.notes ?? [])
+        console.log(`  · ${note}`);
     if (args.dryRun) {
-        console.log(`Dry run — would apply ${file} (${Buffer.byteLength(markdown)} bytes).`);
+        const extra = local ? `, ${local.files.length} file${local.files.length === 1 ? "" : "s"} (${formatBytes(local.files.reduce((n, f) => n + f.size, 0))})` : "";
+        console.log(`Dry run — would apply ${file} (${Buffer.byteLength(markdown)} bytes${extra}).`);
+        for (const f of local?.files ?? [])
+            console.log(`  ${f.path}`);
         return {};
     }
+    let uploaded = 0;
+    if (local?.files.length)
+        uploaded = await uploadPackFiles(config, local.files);
     let res;
     try {
-        res = await (0, shared_1.apiRequest)("POST", "/api/cli/packs/apply", { config, body: { markdown } });
+        res = await (0, shared_1.apiRequest)("POST", "/api/cli/packs/apply", {
+            config,
+            body: {
+                markdown,
+                ...(local ? { files: local.files.map((f) => ({ path: f.path, sha256: f.sha256, ...(f.executable ? { executable: true } : {}) })) } : {}),
+            },
+        });
     }
     catch (error) {
         // The server reports pack.md problems with line numbers; show them as-is.
@@ -590,6 +675,8 @@ async function runApply(config, args) {
         const verb = res.created === true ? "Created" : res.changed === false ? "No changes to" : "Updated";
         const version = typeof res.version === "number" ? ` v${res.version}` : "";
         console.log(`✓ ${verb} ${slug}${version} from ${path.basename(file)}`);
+        if (local)
+            console.log(`  files: ${local.files.length} (${uploaded} uploaded, ${local.files.length - uploaded} already on Codiedev)`);
         if (Array.isArray(res.warnings)) {
             for (const w of res.warnings) {
                 const text = typeof w === "string" ? w : typeof w?.message === "string" ? `${w.agent ? `${w.agent}: ` : ""}${w.message}` : JSON.stringify(w);
@@ -599,4 +686,36 @@ async function runApply(config, args) {
     }
     return res;
 }
+function formatBytes(n) {
+    return n >= 1024 * 1024 ? `${(n / (1024 * 1024)).toFixed(1)}MB` : n >= 1024 ? `${Math.round(n / 1024)}KB` : `${n}B`;
+}
+/** Upload the blobs Codiedev doesn't have yet. Returns how many were sent. */
+async function uploadPackFiles(config, files) {
+    const unique = [...new Map(files.map((f) => [f.sha256, f])).values()];
+    let known;
+    try {
+        known = (await (0, shared_1.apiRequest)("POST", "/api/cli/packs/files/known", { config, body: { sha256s: unique.map((f) => f.sha256) } })).known ?? [];
+    }
+    catch (error) {
+        const e = error;
+        if (e.status === 403)
+            throw new Error(`Only admins and team managers can add files to a pack (${e.message})`);
+        throw error;
+    }
+    const have = new Set(known);
+    let sent = 0;
+    for (const f of unique) {
+        if (have.has(f.sha256))
+            continue;
+        const body = fs.readFileSync(f.abs);
+        try {
+            await (0, shared_1.apiRequestBytes)("POST", "/api/cli/packs/files/upload", { config, body, query: { sha256: f.sha256 } });
+        }
+        catch (error) {
+            throw new Error(`couldn't upload ${f.path} (${error.message})`);
+        }
+        sent += 1;
+    }
+    return sent;
+}
 exports.PACK_HELP = USAGE;

package/dist/commands/ping.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPing = runPing;
 const shared_1 = require("./shared");
-function parseArgs(args) {
+const pingFiles_1 = require("./pingFiles");
+function parseArgs(allArgs) {
+    const { files, rest: args } = (0, pingFiles_1.takeFileArgs)(allArgs);
     let to;
     const positional = [];
     let subjectKey;
@@ -18,31 +20,33 @@ function parseArgs(args) {
             positional.push(a);
         }
     }
-    if (positional.length < 2) {
-        console.error("Usage: codiedev ping <user> \"<message>\" [--with <artifact-key>]");
+    // A file can stand in for the message.
+    if (positional.length < 2 && !(positional.length === 1 && files.length > 0)) {
+        console.error("Usage: codiedev ping <user> \"<message>\" [--with <artifact-key>] [--file <path>]");
         process.exit(1);
     }
     to = positional[0];
     // Join remaining positionals in case the shell split the message on spaces
     // despite quoting (happens with some escape sequences).
     const body = (0, shared_1.stripQuotes)(positional.slice(1).join(" "));
-    return { to, body, subjectKey };
+    return { to, body: body || (files.length ? "Sent a file." : ""), subjectKey, files };
 }
 async function runPing(args) {
-    const { to, body, subjectKey } = parseArgs(args);
+    const { to, body, subjectKey, files } = parseArgs(args);
     const config = (0, shared_1.requireConfig)();
     const start = Date.now();
     try {
+        const attachmentIds = await (0, pingFiles_1.uploadOrExit)(config, files);
         const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ping", {
             config,
-            body: { to, body, subjectKey },
+            body: { to, body, subjectKey, ...(attachmentIds.length ? { attachmentIds } : {}) },
         });
         (0, shared_1.recordAgentEvent)(config, {
             tool: "codiedev_ping",
             ok: true,
             latencyMs: Date.now() - start,
         });
-        console.log(`✓ Pinged ${res.recipient.name} <${res.recipient.email}>${subjectKey ? ` on ${subjectKey}` : ""}`);
+        console.log(`✓ Pinged ${res.recipient.name} <${res.recipient.email}>${subjectKey ? ` on ${subjectKey}` : ""}${files.length ? ` with ${files.length} file${files.length === 1 ? "" : "s"}` : ""}`);
     }
     catch (err) {
         const e = err;

package/dist/commands/pingFiles.d.ts

@@ -0,0 +1,22 @@
+import type { CodiedevConfig } from "../utils";
+export declare const MAX_PING_FILES = 10;
+export declare const MAX_PING_FILE_BYTES: number;
+export declare function contentTypeFor(fileName: string): string;
+export declare function formatBytes(bytes: number): string;
+/** Pull every `--file <path>` / `-f <path>` / `--file=<path>` out of argv,
+ *  returning the paths and the remaining args untouched. */
+export declare function takeFileArgs(args: string[]): {
+    files: string[];
+    rest: string[];
+};
+export type FileProblem = {
+    path: string;
+    reason: string;
+};
+/** Check every path before uploading any, so one bad path can't leave the
+ *  others uploaded and unsent. */
+export declare function checkFiles(paths: string[]): FileProblem[];
+/** Upload in order; the returned ids go in the ping's `attachmentIds`. */
+export declare function uploadPingFiles(config: CodiedevConfig, paths: string[]): Promise<string[]>;
+/** Validate, then upload. Prints the problems and exits on a bad path. */
+export declare function uploadOrExit(config: CodiedevConfig, paths: string[]): Promise<string[]>;

package/dist/commands/pingFiles.js

@@ -0,0 +1,155 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_PING_FILE_BYTES = exports.MAX_PING_FILES = void 0;
+exports.contentTypeFor = contentTypeFor;
+exports.formatBytes = formatBytes;
+exports.takeFileArgs = takeFileArgs;
+exports.checkFiles = checkFiles;
+exports.uploadPingFiles = uploadPingFiles;
+exports.uploadOrExit = uploadOrExit;
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const path_1 = __importDefault(require("path"));
+const version_1 = require("../version");
+// Files sent with `codiedev ping --file` / `codiedev reply --file`. The server
+// stores each one and hands back an id; the ping then names those ids. Limits
+// mirror the server's so a too-large file fails here, before the upload.
+exports.MAX_PING_FILES = 10;
+exports.MAX_PING_FILE_BYTES = 20 * 1024 * 1024;
+const CONTENT_TYPES = {
+    csv: "text/csv",
+    tsv: "text/tab-separated-values",
+    txt: "text/plain",
+    log: "text/plain",
+    md: "text/markdown",
+    json: "application/json",
+    yaml: "text/plain",
+    yml: "text/plain",
+    diff: "text/plain",
+    patch: "text/plain",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    pdf: "application/pdf",
+    zip: "application/zip",
+};
+function contentTypeFor(fileName) {
+    const ext = path_1.default.extname(fileName).slice(1).toLowerCase();
+    return CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.round(bytes / 1024)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** Pull every `--file <path>` / `-f <path>` / `--file=<path>` out of argv,
+ *  returning the paths and the remaining args untouched. */
+function takeFileArgs(args) {
+    const files = [];
+    const rest = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if ((a === "--file" || a === "-f") && i + 1 < args.length)
+            files.push(args[++i]);
+        else if (a.startsWith("--file="))
+            files.push(a.slice("--file=".length));
+        else
+            rest.push(a);
+    }
+    return { files, rest };
+}
+/** Check every path before uploading any, so one bad path can't leave the
+ *  others uploaded and unsent. */
+function checkFiles(paths) {
+    const problems = [];
+    if (paths.length > exports.MAX_PING_FILES) {
+        problems.push({ path: "--file", reason: `at most ${exports.MAX_PING_FILES} files per message` });
+    }
+    for (const p of paths) {
+        let stat;
+        try {
+            stat = fs_1.default.statSync(p);
+        }
+        catch {
+            problems.push({ path: p, reason: "file not found" });
+            continue;
+        }
+        if (!stat.isFile())
+            problems.push({ path: p, reason: "not a file" });
+        else if (stat.size === 0)
+            problems.push({ path: p, reason: "file is empty" });
+        else if (stat.size > exports.MAX_PING_FILE_BYTES) {
+            problems.push({ path: p, reason: `larger than 20 MB (${formatBytes(stat.size)})` });
+        }
+    }
+    return problems;
+}
+function uploadOne(config, filePath) {
+    return new Promise((resolve, reject) => {
+        const name = path_1.default.basename(filePath);
+        const data = fs_1.default.readFileSync(filePath);
+        const url = new URL("/api/cli/ping-attachment", config.backendUrl);
+        url.searchParams.set("name", name);
+        const lib = url.protocol === "https:" ? https_1.default : http_1.default;
+        const req = lib.request({
+            hostname: url.hostname,
+            port: url.port || (url.protocol === "https:" ? 443 : 80),
+            path: url.pathname + url.search,
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${config.token}`,
+                "X-Codiedev-Cli-Version": version_1.CLI_VERSION,
+                "Content-Type": contentTypeFor(name),
+                "Content-Length": data.length,
+            },
+        }, (res) => {
+            let chunks = "";
+            res.on("data", (c) => (chunks += c));
+            res.on("end", () => {
+                let parsed = {};
+                try {
+                    parsed = chunks ? JSON.parse(chunks) : {};
+                }
+                catch {
+                    /* fall through to the status check */
+                }
+                if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300 && parsed.attachment?.id) {
+                    resolve(parsed.attachment.id);
+                }
+                else {
+                    reject(new Error(`${name}: ${parsed.error ?? `HTTP ${res.statusCode}`}`));
+                }
+            });
+        });
+        req.on("error", (err) => reject(new Error(`${name}: ${err.message}`)));
+        req.write(data);
+        req.end();
+    });
+}
+/** Upload in order; the returned ids go in the ping's `attachmentIds`. */
+async function uploadPingFiles(config, paths) {
+    const ids = [];
+    for (const p of paths)
+        ids.push(await uploadOne(config, p));
+    return ids;
+}
+/** Validate, then upload. Prints the problems and exits on a bad path. */
+async function uploadOrExit(config, paths) {
+    if (paths.length === 0)
+        return [];
+    const problems = checkFiles(paths);
+    if (problems.length) {
+        for (const p of problems)
+            console.error(`Can't attach ${p.path}: ${p.reason}`);
+        process.exit(1);
+    }
+    return await uploadPingFiles(config, paths);
+}

package/dist/commands/reply.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Answer a ping. Unlike a fresh `codiedev ping` back, this threads under the
+ * original and marks it read + replied, so it stops counting as waiting.
+ */
+export declare function runReply(args: string[]): Promise<void>;