osborn 0.8.17 → 0.8.18

package/dist/index.js

@@ -491,6 +491,11 @@ async function main() {
     let userState = 'listening'; // Track user speech state for queue safety
     let currentVoiceMode = voiceMode; // Track active voice mode for data handlers
     let currentProvider = realtimeConfig.provider; // Track active realtime provider
+    // Authenticated Supabase userId from participant metadata. Used to scope
+    // workspace artifact uploads to the owner's prefix in Supabase Storage.
+    // Empty string = anonymous / unauthenticated; uploads fall back to a
+    // session-only path (no user prefix).
+    let currentUserId = '';
     // Track the active resume session ID across scopes (ParticipantConnected + DataReceived)
     // Updated by resume_session, session_selected, continue_session, switch_session handlers
     let currentResumeSessionId;
@@ -1776,6 +1781,15 @@ async function main() {
         try {
             const metadata = JSON.parse(participant.metadata || '{}');
             console.log(`📋 Participant metadata:`, metadata);
+            // userId from authenticated Supabase session — used to scope Supabase
+            // Storage uploads so each user's workspace artifacts live under their
+            // own prefix. Falls through to '' (anonymous) if not authenticated.
+            if (typeof metadata.userId === 'string' && metadata.userId.length > 0) {
+                currentUserId = metadata.userId;
+            }
+            else {
+                currentUserId = '';
+            }
             if (metadata.voiceArch === 'realtime' || metadata.voiceArch === 'direct' || metadata.voiceArch === 'pipeline') {
                 sessionVoiceMode = metadata.voiceArch;
                 console.log(`🎙️ Using voice mode from frontend: ${sessionVoiceMode}`);
@@ -2733,6 +2747,20 @@ async function main() {
                                 const form = new FormData();
                                 form.append('file', new Blob([buf], { type: mimeType }), fileName);
                                 form.append('folder', 'artifacts');
+                                // Pass userId + sessionId so /api/upload can place the file
+                                // under `{userId}/{sessionId}/...` in Supabase Storage for
+                                // easy ownership queries and future RLS policies. Both are
+                                // optional — route falls back to `artifacts/...` if missing.
+                                if (currentUserId)
+                                    form.append('userId', currentUserId);
+                                // Prefer the live resume session id (updated by session
+                                // switches), fall back to whatever SDK session id the LLM
+                                // reports, fall back to empty.
+                                const uploadSessionId = currentResumeSessionId
+                                    || currentLLM?.sessionId
+                                    || '';
+                                if (uploadSessionId)
+                                    form.append('sessionId', uploadSessionId);
                                 const r = await fetch(`${FRONTEND_URL.replace(/\/$/, '')}/api/upload`, {
                                     method: 'POST', body: form,
                                     signal: AbortSignal.timeout(15_000),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.8.17",
+  "version": "0.8.18",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {