hivenet 0.4.2 → 0.6.0

package/dist/{chunk-WWPF6V2Y.js → chunk-DNR6HNJD.js}

@@ -1389,10 +1389,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path6) {
+  if (!path6)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path6.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1801,11 +1801,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path6, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path6);
     return iss;
   });
 }
@@ -1952,16 +1952,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1988,17 +1988,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2030,8 +2030,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path6) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14723,13 +14723,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path6 = ref.slice(1).split("/").filter(Boolean);
+  if (path6.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1];
+  if (path6[0] === defsKey) {
+    const key = path6[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -15138,6 +15138,102 @@ function date4(params) {
 config(en_default());
 
 // ../spec/dist/index.js
+var MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+var MAX_ATTACHMENTS = 10;
+var MAX_ATTACHMENT_DESCRIPTION_LENGTH = 1e3;
+var ATTACHMENT_UPLOAD_PATH = "/v1/attachments";
+var attachmentDescriptionSchema = external_exports.string().trim().min(1).max(MAX_ATTACHMENT_DESCRIPTION_LENGTH).describe("Optional plain text: what this file shows and why it matters.");
+var attachmentIdSchema = external_exports.string().regex(/^att_[a-f0-9]{32}$/);
+var ATTACHMENT_TARGET_TYPES = [
+  "event",
+  "issue",
+  "question",
+  "eval",
+  "investigation",
+  "investigation_question",
+  "investigation_reply"
+];
+var attachmentTargetSchema = external_exports.object({
+  type: external_exports.enum(ATTACHMENT_TARGET_TYPES),
+  id: external_exports.string().min(1).max(64)
+});
+var attachmentManifestSchema = external_exports.object({
+  filename: external_exports.string().min(1).max(180).refine(
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Reject control characters in filenames and HTTP headers.
+    (name) => !/[\\/\u0000-\u001f\u007f]/.test(name) && name !== "." && name !== "..",
+    "Use a filename without directories or control characters."
+  ),
+  mediaType: external_exports.string().max(127).regex(/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/),
+  size: external_exports.number().int().min(1).max(MAX_ATTACHMENT_BYTES),
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+});
+var prepareAttachmentSchema = attachmentManifestSchema.extend({
+  to: external_exports.string().min(1).max(253).optional(),
+  scope: external_exports.enum(["reporter", "owner"]).default("reporter"),
+  /** Self-reported agent name for reporter uploads. */
+  uploader: external_exports.string().min(1).max(128).optional()
+});
+var preparedAttachmentSchema = external_exports.object({
+  reference: external_exports.object({
+    id: attachmentIdSchema,
+    token: external_exports.string().regex(/^hva_[a-f0-9]{64}$/)
+  }),
+  uploadUrl: external_exports.url(),
+  expiresAt: external_exports.string()
+});
+var attachmentReferenceSchema = preparedAttachmentSchema.shape.reference.extend({
+  description: attachmentDescriptionSchema.optional()
+});
+var attachmentReferencesSchema = external_exports.array(attachmentReferenceSchema).max(MAX_ATTACHMENTS).refine(
+  (refs) => new Set(refs.map((ref) => ref.id)).size === refs.length,
+  "Each file can be attached once."
+);
+var attachFilesSchema = external_exports.object({
+  target: attachmentTargetSchema,
+  attachments: attachmentReferencesSchema.min(1)
+});
+var attachmentSchema = attachmentManifestSchema.extend({
+  id: attachmentIdSchema,
+  createdAt: external_exports.string(),
+  source: external_exports.enum(["reporter", "owner"]),
+  /** Reporter names are self-reported; owner uploads are authenticated. */
+  uploader: external_exports.string().nullable(),
+  /** The record the file belongs to — a report when shown on its issue or eval. */
+  target: attachmentTargetSchema,
+  description: attachmentDescriptionSchema.optional()
+});
+var deliveredAttachmentSchema = attachmentSchema.extend({
+  url: external_exports.url(),
+  expiresAt: external_exports.string()
+});
+var MEDIA_TYPES = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mp3: "audio/mpeg",
+  m4a: "audio/mp4",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  pdf: "application/pdf",
+  json: "application/json",
+  jsonl: "application/x-ndjson",
+  ndjson: "application/x-ndjson",
+  txt: "text/plain",
+  log: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  zip: "application/zip",
+  html: "text/html"
+};
+function mediaTypeForFilename(filename) {
+  const extension = /\.([^./\\]+)$/.exec(filename)?.[1]?.toLowerCase();
+  return extension && MEDIA_TYPES[extension] || "application/octet-stream";
+}
 var PROTOCOL_VERSION = 1;
 var MAX_FEEDBACK_LENGTH = 5e3;
 var MAX_SUBJECT_LENGTH = 500;
@@ -15157,10 +15253,18 @@ var FEEDBACK_CATEGORIES = [
   "cli",
   "api",
   "model",
-  "eval",
   "ux",
   "other"
 ];
+var createQuestionInputSchema = external_exports.object({
+  prompt: external_exports.string().trim().min(8).max(500).describe('The question, e.g. "If you used <feature>: what broke or was missing?"'),
+  category: external_exports.enum(FEEDBACK_CATEGORIES).optional().describe("Only ask agents whose submission carries this category."),
+  attachments: attachmentReferencesSchema.optional().describe("Uploaded files, each {id, token, description?}; every agent asked can open them."),
+  idempotencyKey: external_exports.string().regex(/^[A-Za-z0-9_-]{8,64}$/).optional().describe(
+    "Same key + same project = the same question, so a retried publish never duplicates."
+  )
+});
+var LEGACY_CATEGORIES = ["eval"];
 var EVENT_STATUSES = [
   "new",
   "seen",
@@ -15169,10 +15273,20 @@ var EVENT_STATUSES = [
   "wont_fix",
   "spam"
 ];
-var ISSUE_STATUSES = ["open", "in_progress", "resolved", "wont_fix", "spam"];
+var ISSUE_STATUSES = [
+  "open",
+  "in_progress",
+  "needs_review",
+  "resolved",
+  "wont_fix",
+  "spam"
+];
+var issueStatusSchema = external_exports.enum(ISSUE_STATUSES);
+var EVAL_STATUSES = ["proposed", "accepted", "archived"];
 var VENDOR_CATEGORY_PATTERN = /^x-[a-z0-9][a-z0-9-]{0,38}$/;
 var categorySchema = external_exports.union([
   external_exports.enum(FEEDBACK_CATEGORIES),
+  external_exports.enum(LEGACY_CATEGORIES),
   external_exports.string().regex(VENDOR_CATEGORY_PATTERN, "vendor categories must match x-<kebab-case>")
 ]);
 var sentimentSchema = external_exports.enum(["positive", "negative", "neutral"]);
@@ -15234,6 +15348,10 @@ var feedbackEventSchema = external_exports.object({
   author: authorSchema.optional(),
   thread: external_exports.object({ id: external_exports.string().regex(THREAD_ID_PATTERN) }),
   eval: evalReportSchema.optional(),
+  /** Id of an owner/system question this submission answers (from a prior response's `ask`). */
+  question: external_exports.string().max(64).optional(),
+  /** Uploaded files, committed with the event or not at all. Bytes never travel in feedback JSON. */
+  attachments: attachmentReferencesSchema.optional(),
   context: feedbackContextSchema.optional(),
   metadata: metadataSchema.optional(),
   /** Client-minted retry key: same key + same project = same stored event. */
@@ -15244,6 +15362,31 @@ var feedbackEventSchema = external_exports.object({
   }),
   consent: external_exports.object({ telemetry: external_exports.boolean() })
 });
+var knownIssueSchema = external_exports.object({
+  title: external_exports.string().max(120),
+  /** wont_fix is disclosed only when the owner attached a closing note. */
+  status: external_exports.enum(["open", "wont_fix"]),
+  /** This very report flipped a resolved issue back open — already recorded. */
+  reopened: external_exports.boolean().optional(),
+  /** Total reports on this issue, including this one. */
+  reports: external_exports.number().int().positive(),
+  /** The owner's closing note, verbatim — their explanation of the decision. */
+  note: external_exports.string().max(MAX_GUIDANCE_LENGTH).optional(),
+  /** Server-composed next step for the submitting agent. */
+  hint: external_exports.string().max(300)
+});
+var ownerIssueSchema = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  summary: external_exports.string().nullable(),
+  status: issueStatusSchema,
+  fingerprint: external_exports.string().nullable(),
+  event_count: external_exports.number(),
+  reopened_count: external_exports.number(),
+  first_seen: external_exports.string(),
+  last_seen: external_exports.string(),
+  links_json: external_exports.string()
+});
 var ingestResponseSchema = external_exports.object({
   id: external_exports.string().max(64),
   thread: external_exports.string().regex(THREAD_ID_PATTERN),
@@ -15251,6 +15394,19 @@ var ingestResponseSchema = external_exports.object({
   resume: external_exports.string().max(512).optional(),
   /** Vendor-configured answer back to the submitting agent (known issues, workarounds). */
   guidance: external_exports.string().max(MAX_GUIDANCE_LENGTH).optional(),
+  /** The report matched an already-tracked issue; recorded — don't file variants. */
+  known_issue: knownIssueSchema.optional(),
+  /**
+   * A question from the project's team, delivered at most one per response.
+   * Answering is optional and must be grounded in what the agent actually did;
+   * `command` is ready to run and files the answer on this thread.
+   */
+  ask: external_exports.object({
+    id: external_exports.string().max(64),
+    prompt: external_exports.string().max(500),
+    command: external_exports.string().max(512),
+    attachments: external_exports.array(deliveredAttachmentSchema).optional()
+  }).optional(),
   /** True when idempotencyKey matched an already-stored event; id/thread are the original's. */
   duplicate: external_exports.boolean().optional()
 });
@@ -15279,8 +15435,8 @@ var repoEntrySchema = external_exports.object({
 var repoListSchema = external_exports.array(repoEntrySchema).max(20);
 function formatIssues(error51) {
   return error51.issues.map((issue2) => {
-    const path5 = issue2.path.join(".");
-    return path5 ? `${path5}: ${issue2.message}` : issue2.message;
+    const path6 = issue2.path.join(".");
+    return path6 ? `${path6}: ${issue2.message}` : issue2.message;
   });
 }
 function validateFeedbackEvent(input) {
@@ -15297,8 +15453,11 @@ function validateIngestResponse(input) {
 }
 
 // ../core/dist/index.js
-import { readFileSync } from "fs";
+import { createHash } from "crypto";
+import { readFile, stat } from "fs/promises";
 import path2 from "path";
+import { readFileSync } from "fs";
+import path3 from "path";
 
 // ../../node_modules/.pnpm/agent-cli-detector@0.1.5/node_modules/agent-cli-detector/dist/index.js
 import { execFileSync } from "child_process";
@@ -15662,29 +15821,152 @@ function matchesEnvSignal(signal, env) {
 
 // ../core/dist/index.js
 import { homedir } from "os";
-import path3 from "path";
+import path22 from "path";
 import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import path32 from "path";
-import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import path4 from "path";
+import { randomUUID } from "crypto";
+import { appendFileSync, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync, rmSync } from "fs";
+import path5 from "path";
 import { randomBytes } from "crypto";
 import { createRequire } from "module";
+var FeedbackError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FeedbackError";
+  }
+};
+async function readLocalAttachments(inputs, cwd = process.cwd()) {
+  if (inputs.length > MAX_ATTACHMENTS)
+    throw new FeedbackError(`At most ${MAX_ATTACHMENTS} files can be attached.`);
+  const files = [];
+  for (const input of inputs) {
+    const selected = typeof input === "string" ? input : input.path;
+    const filename = path2.basename(selected);
+    const description = attachmentDescriptionSchema.optional().safeParse(typeof input === "string" ? void 0 : input.description);
+    if (!description.success)
+      throw new FeedbackError(
+        `Invalid description for "${filename}": ${description.error.issues.map((issue2) => issue2.message).join("; ")}`
+      );
+    const file2 = path2.resolve(cwd, selected);
+    const info = await stat(file2).catch(() => null);
+    if (!info?.isFile())
+      throw new FeedbackError(`Cannot attach "${selected}": choose an existing, readable file.`);
+    if (info.size < 1 || info.size > MAX_ATTACHMENT_BYTES)
+      throw new FeedbackError(`"${filename}" must be between 1 byte and 20 MiB.`);
+    const bytes = new Uint8Array(
+      await readFile(file2).catch(() => {
+        throw new FeedbackError(`Cannot read "${selected}".`);
+      })
+    );
+    const manifest = attachmentManifestSchema.safeParse({
+      filename,
+      mediaType: mediaTypeForFilename(filename),
+      size: bytes.length,
+      sha256: createHash("sha256").update(bytes).digest("hex")
+    });
+    if (!manifest.success)
+      throw new FeedbackError(
+        `Cannot attach "${filename}": ${manifest.error.issues.map((issue2) => issue2.message).join("; ")}`
+      );
+    files.push({
+      manifest: manifest.data,
+      bytes,
+      ...description.data ? { description: description.data } : {}
+    });
+  }
+  return files;
+}
+var AttachmentUploadError = class extends FeedbackError {
+  constructor(message, rejected) {
+    super(message);
+    this.rejected = rejected;
+    this.name = "AttachmentUploadError";
+  }
+  rejected;
+};
+async function send(fetchImpl, url2, init, timeoutMs) {
+  let response;
+  try {
+    response = await fetchImpl(url2, {
+      ...init,
+      redirect: "error",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch {
+    throw new AttachmentUploadError("Could not reach the server to upload files.", false);
+  }
+  if (response.ok) return response;
+  const body = await response.json().catch(() => null);
+  const errors = Array.isArray(body?.errors) ? body.errors.map(String).join("; ") : void 0;
+  if (response.status === 404 && !errors)
+    throw new AttachmentUploadError("This server does not accept files.", false);
+  throw new AttachmentUploadError(
+    errors ?? `File upload failed (${response.status}).`,
+    !(response.status >= 500 || response.status === 429 || response.status === 408)
+  );
+}
+async function uploadFiles(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 6e4;
+  const origin = new URL(options.endpoint).origin;
+  const references = [];
+  for (const file2 of options.files) {
+    const response = await send(
+      fetchImpl,
+      `${origin}${ATTACHMENT_UPLOAD_PATH}`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...options.secretKey ? { authorization: `Bearer ${options.secretKey}` } : {},
+          ...options.writeKey ? { [WRITE_KEY_HEADER]: options.writeKey } : {}
+        },
+        body: JSON.stringify({
+          ...file2.manifest,
+          to: options.to,
+          scope: options.secretKey ? "owner" : "reporter",
+          uploader: options.uploader
+        })
+      },
+      timeoutMs
+    );
+    const prepared = preparedAttachmentSchema.safeParse(await response.json().catch(() => null));
+    if (!prepared.success || new URL(prepared.data.uploadUrl).origin !== origin)
+      throw new AttachmentUploadError("The server returned an invalid upload response.", true);
+    await send(
+      fetchImpl,
+      prepared.data.uploadUrl,
+      {
+        method: "PUT",
+        headers: { authorization: `Bearer ${prepared.data.reference.token}` },
+        body: file2.bytes
+      },
+      // At least 100 KB/s: a 20 MiB file on a slow link still gets about 3.5 minutes.
+      Math.max(timeoutMs, file2.bytes.length / 100)
+    );
+    references.push({
+      ...prepared.data.reference,
+      ...file2.description ? { description: file2.description } : {}
+    });
+  }
+  return references;
+}
 var DSN_ENV_VAR = "HIVENET_DSN";
 var REGISTRY_ENV_VAR = "HIVENET_REGISTRY";
 var HOME_ENV_VAR = "HIVENET_HOME";
 var NO_TELEMETRY_ENV_VAR = "HIVENET_NO_TELEMETRY";
 function feedbackHomeDir(env = process.env) {
   const override = env[HOME_ENV_VAR];
-  return override?.trim() ? override : path3.join(homedir(), ".hivenet");
+  return override?.trim() ? override : path22.join(homedir(), ".hivenet");
 }
 function isTelemetryDisabled(extraOptOutEnvVars = [], env = process.env) {
   const vars = ["DO_NOT_TRACK", NO_TELEMETRY_ENV_VAR, ...extraOptOutEnvVars];
   return vars.some((name) => env[name] === "1" || env[name] === "true");
 }
 var MAX_SESSION_ID_LENGTH = 256;
-function detectAgentSafe() {
+function detectAgentSafe(env) {
   try {
-    const result = detectAgent();
+    const result = detectAgent({ env });
     if (result.detected && result.agent) {
       return {
         id: result.agent.id,
@@ -15696,9 +15978,9 @@ function detectAgentSafe() {
   }
   return void 0;
 }
-function detectSandboxSafe() {
+function detectSandboxSafe(env) {
   try {
-    const result = detectSandbox();
+    const result = detectSandbox({ env });
     if (result.detected && result.sandbox) {
       return {
         id: result.sandbox.id,
@@ -15763,7 +16045,7 @@ function resolveSessions(sources, projectRoot, env) {
     }
     const value = "envVar" in source ? normalizeSessionId(env[source.envVar]) : normalizeSessionId(
       readDotenvKey(
-        path2.resolve(projectRoot, source.dotenvFile),
+        path3.resolve(projectRoot, source.dotenvFile),
         source.dotenvKey ?? source.key
       )
     );
@@ -15779,8 +16061,8 @@ async function collectContext(options = {}) {
     return void 0;
   }
   const projectRoot = options.projectRoot ?? process.cwd();
-  const agent = detectAgentSafe();
-  const sandbox = detectSandboxSafe();
+  const agent = detectAgentSafe(env);
+  const sandbox = detectSandboxSafe(env);
   const ci = detectCi();
   const session = resolveSessions(options.sessions ?? [], projectRoot, env);
   let project;
@@ -15803,12 +16085,6 @@ async function collectContext(options = {}) {
 function inferAuthor(context) {
   return context?.agent ? "agent" : void 0;
 }
-var FeedbackError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "FeedbackError";
-  }
-};
 var CONFIG_FILE_NAME = "feedback.config.json";
 var DESCRIPTOR_CACHE_TTL_MS = 60 * 60 * 1e3;
 var RESOLVE_TIMEOUT_MS = 5e3;
@@ -15833,9 +16109,9 @@ function parseDsn(dsn) {
   };
 }
 function findConfigFile(startDir) {
-  let current = path32.resolve(startDir);
+  let current = path4.resolve(startDir);
   while (true) {
-    const candidate = path32.join(current, CONFIG_FILE_NAME);
+    const candidate = path4.join(current, CONFIG_FILE_NAME);
     try {
       const raw = readFileSync2(candidate, "utf8");
       const parsed = JSON.parse(raw);
@@ -15844,7 +16120,7 @@ function findConfigFile(startDir) {
       }
     } catch {
     }
-    const parent = path32.dirname(current);
+    const parent = path4.dirname(current);
     if (parent === current) {
       return void 0;
     }
@@ -15852,7 +16128,7 @@ function findConfigFile(startDir) {
   }
 }
 function cacheFilePath(cacheDir) {
-  return path32.join(cacheDir, "descriptors.json");
+  return path4.join(cacheDir, "descriptors.json");
 }
 function readCache(cacheDir) {
   try {
@@ -15977,7 +16253,7 @@ async function postEvent(options) {
       error: error51 instanceof Error ? error51.message : String(error51)
     };
   }
-  if (response.status >= 500) {
+  if (response.status >= 500 || response.status === 429 || response.status === 408) {
     return { kind: "unreachable", error: `server error (${response.status})` };
   }
   if (!response.ok) {
@@ -16005,13 +16281,14 @@ async function postEvent(options) {
 }
 var OUTBOX_FILE = "outbox.jsonl";
 var MAX_OUTBOX_ENTRIES = 100;
+var STALE_CLAIM_MS = 30 * 60 * 1e3;
 function outboxPath(env = process.env) {
-  return path4.join(feedbackHomeDir(env), OUTBOX_FILE);
+  return path5.join(feedbackHomeDir(env), OUTBOX_FILE);
 }
 function appendToOutbox(entry, env = process.env) {
   try {
     const file2 = outboxPath(env);
-    mkdirSync2(path4.dirname(file2), { recursive: true });
+    mkdirSync2(path5.dirname(file2), { recursive: true });
     appendFileSync(file2, `${JSON.stringify(entry)}
 `);
     return true;
@@ -16019,19 +16296,43 @@ function appendToOutbox(entry, env = process.env) {
     return false;
   }
 }
-function readOutbox(env) {
+function readEntries(file2) {
   try {
-    return readFileSync3(outboxPath(env), "utf8").split("\n").filter((line) => line.trim()).slice(-MAX_OUTBOX_ENTRIES).map((line) => JSON.parse(line));
+    return readFileSync3(file2, "utf8").split("\n").filter((line) => line.trim()).flatMap((line) => {
+      try {
+        return [JSON.parse(line)];
+      } catch {
+        return [];
+      }
+    });
   } catch {
     return [];
   }
 }
+function claimQueue(env) {
+  const file2 = outboxPath(env);
+  let names;
+  try {
+    names = readdirSync(path5.dirname(file2));
+  } catch {
+    return [];
+  }
+  const claims = names.filter((name) => {
+    const claimedAt = Number(/\.flushing-(\d+)-/.exec(name)?.[1]);
+    return name.startsWith(OUTBOX_FILE) && Date.now() - claimedAt > STALE_CLAIM_MS;
+  }).map((name) => path5.join(path5.dirname(file2), name));
+  const fresh = `${file2}.flushing-${Date.now()}-${randomUUID()}`;
+  try {
+    renameSync(file2, fresh);
+    claims.push(fresh);
+  } catch {
+  }
+  return claims;
+}
 async function flushOutbox(options = {}) {
   const env = options.env ?? process.env;
-  const entries = readOutbox(env);
-  if (entries.length === 0) {
-    return { delivered: 0, remaining: 0 };
-  }
+  const claims = claimQueue(env);
+  const entries = claims.flatMap(readEntries).slice(-MAX_OUTBOX_ENTRIES);
   const failures = [];
   let delivered = 0;
   for (const entry of entries) {
@@ -16048,12 +16349,13 @@ async function flushOutbox(options = {}) {
       failures.push(entry);
     }
   }
-  try {
-    writeFileSync2(
-      outboxPath(env),
-      failures.map((entry) => JSON.stringify(entry)).join("\n") + (failures.length ? "\n" : "")
-    );
-  } catch {
+  if (failures.every((entry) => appendToOutbox(entry, env))) {
+    for (const claim of claims) {
+      try {
+        rmSync(claim, { force: true });
+      } catch {
+      }
+    }
   }
   return { delivered, remaining: failures.length };
 }
@@ -16073,10 +16375,10 @@ function ownerApi(options) {
   const origin = (options.apiOrigin ?? new URL(DEFAULT_REGISTRY_URL).origin).replace(/\/$/, "");
   const fetchImpl = options.fetchImpl ?? fetch;
   const timeoutMs = options.timeoutMs ?? 15e3;
-  async function request(path5, init) {
+  async function request(path6, init) {
     let response;
     try {
-      response = await fetchImpl(`${origin}${path5}`, {
+      response = await fetchImpl(`${origin}${path6}`, {
         ...init,
         signal: AbortSignal.timeout(timeoutMs),
         headers: {
@@ -16104,7 +16406,34 @@ function ownerApi(options) {
     }
     return body;
   }
+  async function upload(paths, cwd) {
+    return uploadFiles({
+      endpoint: origin,
+      files: await readLocalAttachments(paths, cwd),
+      secretKey: options.secretKey,
+      fetchImpl,
+      timeoutMs: Math.max(timeoutMs, 6e4)
+    });
+  }
   return {
+    /** Upload local files and attach them to a record (at most 10 files per record). */
+    async attachFiles(target, paths, cwd) {
+      if (!paths.length) throw new FeedbackError("Select at least one file.");
+      const attachments = await upload(paths, cwd);
+      return request("/v1/attachments/attach", {
+        method: "POST",
+        body: JSON.stringify({ target, attachments })
+      });
+    },
+    /** A record's files; issues and evals include their reports' files. */
+    async listAttachments(target, offset = 0) {
+      return request(
+        `/v1/attachments?${new URLSearchParams({ type: target.type, id: target.id, offset: String(offset) })}`
+      );
+    },
+    async deleteAttachment(id) {
+      return request(`/v1/attachments/${encodeURIComponent(id)}`, { method: "DELETE" });
+    },
     async listFeedback(filters = {}) {
       const params = new URLSearchParams();
       if (filters.status) params.set("status", filters.status);
@@ -16141,10 +16470,53 @@ function ownerApi(options) {
         body: JSON.stringify({ status, ...note !== void 0 ? { note } : {} })
       });
     },
+    async listQuestions(filters = {}) {
+      const query = filters.status ? `?status=${filters.status}` : "";
+      return request(`/v1/questions${query}`);
+    },
+    /** Files are shared with every agent that receives the question. */
+    async createQuestion(prompt, category, options2 = {}) {
+      const attachments = options2.files?.length ? await upload(options2.files, options2.cwd) : [];
+      return request("/v1/questions", {
+        method: "POST",
+        body: JSON.stringify({
+          prompt,
+          ...category ? { category } : {},
+          ...attachments.length ? { attachments } : {},
+          ...options2.idempotencyKey ? { idempotencyKey: options2.idempotencyKey } : {}
+        })
+      });
+    },
+    async closeQuestion(id) {
+      return request(`/v1/questions/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: JSON.stringify({ status: "closed" })
+      });
+    },
+    async listEvals(filters = {}) {
+      const query = filters.status ? `?status=${filters.status}` : "";
+      return request(`/v1/evals${query}`);
+    },
+    async getEval(id) {
+      return request(`/v1/evals/${encodeURIComponent(id)}`);
+    },
+    /** Promote a failed-task report (category=eval event) into the eval corpus. */
+    async promoteEval(eventId) {
+      return request("/v1/evals", {
+        method: "POST",
+        body: JSON.stringify({ event_id: eventId })
+      });
+    },
+    async setEvalStatus(id, status, note) {
+      return request(`/v1/evals/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: JSON.stringify({ status, ...note !== void 0 ? { note } : {} })
+      });
+    },
     /** Attach an external link (Slack message, Linear/GitHub issue, PR) to evt_… or iss_…. */
     async addLink(id, url2, label) {
-      const path5 = id.startsWith("iss_") ? `/v1/issues/${id}` : `/v1/events/${id}`;
-      return request(path5, {
+      const path6 = id.startsWith("iss_") ? `/v1/issues/${id}` : `/v1/events/${id}`;
+      return request(path6, {
         method: "PATCH",
         body: JSON.stringify({ addLink: { url: url2, ...label !== void 0 ? { label } : {} } })
       });
@@ -16172,9 +16544,10 @@ function resolveThreadId(resume) {
   }
   return { id: generateThreadId(), resumed: false };
 }
-async function sendFeedback(options) {
+async function prepareFeedback(options) {
   const env = options.env ?? process.env;
   const cwd = options.cwd ?? process.cwd();
+  const files = await readLocalAttachments(options.attachments ?? [], cwd);
   const config2 = findConfigFile(cwd)?.config;
   const resolveOptions = {
     ...options.to !== void 0 ? { to: options.to } : {},
@@ -16210,6 +16583,7 @@ async function sendFeedback(options) {
     ...author ? { author } : {},
     thread: { id: thread.id },
     ...options.eval ? { eval: options.eval } : {},
+    ...options.question ? { question: options.question } : {},
     ...context ? { context } : {},
     ...options.metadata && Object.keys(options.metadata).length > 0 ? { metadata: options.metadata } : {},
     // Minted before the first attempt so outbox retries replay the SAME event
@@ -16225,7 +16599,32 @@ async function sendFeedback(options) {
   if (!validated.ok) {
     throw new FeedbackError(`Invalid feedback event: ${validated.errors.join("; ")}`);
   }
-  const event = validated.data;
+  return { event: validated.data, destination, resumed: thread.resumed, files };
+}
+async function sendFeedback(options) {
+  const env = options.env ?? process.env;
+  const { event, destination, resumed, files } = await prepareFeedback(options);
+  const names = files.map((file2) => file2.manifest.filename);
+  let filesNotAttached;
+  if (files.length) {
+    try {
+      event.attachments = await uploadFiles({
+        endpoint: destination.endpoint,
+        files,
+        ...destination.to ? { to: destination.to } : {},
+        ...destination.writeKey ? { writeKey: destination.writeKey } : {},
+        ...event.context?.agent?.id ? { uploader: event.context.agent.id } : {},
+        ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
+      });
+    } catch (error51) {
+      if (!(error51 instanceof AttachmentUploadError) || error51.rejected) {
+        throw new FeedbackError(
+          `${error51 instanceof Error ? error51.message : String(error51)} Nothing was sent.`
+        );
+      }
+      filesNotAttached = { files: names, reason: error51.message };
+    }
+  }
   const result = await postEvent({
     endpoint: destination.endpoint,
     ...destination.writeKey ? { writeKey: destination.writeKey } : {},
@@ -16239,12 +16638,17 @@ async function sendFeedback(options) {
       response: result.response,
       event,
       destination,
-      resumed: thread.resumed
+      resumed,
+      ...filesNotAttached ? { filesNotAttached } : {}
     };
   }
   if (result.kind === "rejected") {
     throw new FeedbackError(`Feedback rejected: ${result.errors.join("; ")}`);
   }
+  if (event.attachments) {
+    delete event.attachments;
+    filesNotAttached = { files: names, reason: result.error };
+  }
   const queued = options.outbox !== false && appendToOutbox(
     {
       endpoint: destination.endpoint,
@@ -16260,20 +16664,29 @@ async function sendFeedback(options) {
     error: result.error,
     event,
     destination,
-    resumed: thread.resumed
+    resumed,
+    ...filesNotAttached ? { filesNotAttached } : {}
   };
 }
 
 export {
   __toESM,
+  external_exports,
+  MAX_ATTACHMENTS,
+  attachmentDescriptionSchema,
+  ATTACHMENT_TARGET_TYPES,
+  attachmentTargetSchema,
   PROTOCOL_VERSION,
   MAX_FEEDBACK_LENGTH,
   WELL_KNOWN_PATH,
   FEEDBACK_CATEGORIES,
   EVENT_STATUSES,
   ISSUE_STATUSES,
+  EVAL_STATUSES,
   sentimentSchema,
   authorSchema,
+  evalReportSchema,
+  feedbackEventSchema,
   validateFeedbackEvent,
   validateDescriptor,
   FeedbackError,
@@ -16284,6 +16697,7 @@ export {
   resolveApiOrigin,
   ownerApi,
   generateThreadId,
+  prepareFeedback,
   sendFeedback,
   require_arg
 };