privateer-agent 0.12.24 → 0.12.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.24",
+  "version": "0.12.25",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/remote/relayClient.ts

@@ -254,8 +254,9 @@ export interface RelayCallbacks {
   // STRICT mode (it executes a graph — non-idempotent, like task_spawn).
   onWorkflowsRun?: (idOrName: string, sig?: string, ts?: number) => void;
   // A file finished transferring from the app (reassembled from chunks). Held to
-  // ride along with the next remote prompt.
-  onAttachment: (file: { name: string; mediaType: string; base64: string }) => void;
+  // ride along with the next remote prompt. `path` instead of `base64` is the desktop
+  // loopback's shape only — see RemoteAttachment; nothing on this WebSocket sets it.
+  onAttachment: (file: { name: string; mediaType: string; base64?: string; path?: string }) => void;
   // Surface a one-line status/notice in the TUI.
   onStatus?: (text: string) => void;
   // The relay socket closed (controller no longer reachable until reconnect).

package/src/remote/remoteBridge.ts

@@ -112,7 +112,12 @@ export interface InputRequest {
 export interface RemoteAttachment {
   name: string;
   mediaType: string;
-  base64: string;
+  // Exactly one of these. `base64` is the cloud relay's shape: the app is on another
+  // machine, so the bytes are chunked across. `path` is the desktop's: app and agent
+  // share a disk (IpcRelay), so the file is named rather than moved — which is why a
+  // desktop attachment has no size cap. Both are consumed by AttachmentStore.register.
+  base64?: string;
+  path?: string;
 }
 
 export interface RemoteBridgeConfig {

package/src/tools/saveAttachment.ts

@@ -4,7 +4,7 @@
 // extension gates the tool_call, classified as a write against the destination path).
 
 import { Type } from "typebox";
-import { writeFileSync, mkdirSync, readFileSync } from "node:fs";
+import { mkdirSync, copyFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import type { AttachmentStore } from "../util/attachmentStore.ts";
 
@@ -42,9 +42,13 @@ export function makeSaveAttachmentTool(store: AttachmentStore) {
       const cwd = ctx?.cwd ?? process.cwd();
       const abs = isAbsolute(params.path) ? params.path : resolve(cwd, params.path);
       mkdirSync(dirname(abs), { recursive: true });
-      const bytes = readFileSync(entry.path);
-      writeFileSync(abs, bytes);
-      return text(`Saved attachment #${params.ref} (${entry.name}, ${entry.mediaType}) to ${params.path} (${bytes.length} bytes).`);
+      // copy rather than read-then-write: a desktop attachment is the user's own file
+      // at its own path (AttachmentStore adopts it instead of staging a copy), and
+      // those have no size cap — reading a 4 GB video into the heap to write it back
+      // out would be the one place the uncapped path could still fall over.
+      copyFileSync(entry.path, abs);
+      const size = statSync(abs).size;
+      return text(`Saved attachment #${params.ref} (${entry.name}, ${entry.mediaType}) to ${params.path} (${size} bytes).`);
     },
   };
 }

package/src/util/attachmentStore.ts

@@ -6,12 +6,19 @@ import { join, extname } from "node:path";
 // scratch dir keyed by the "#n" reference the model sees, so the save_attachment tool
 // can write one back out to a real path on demand. Ported/adapted from tree-cli
 // (which persisted paste/drop bytes); here the source is inbound relay attachments.
+//
+// A DESKTOP attachment arrives as a path instead of bytes — the app and this agent
+// share a disk, so there is nothing to transfer and nothing to stage. Such an entry
+// simply points at the file where it already lives; `owned` is what tells the two
+// apart, so cleanup() removes only what we wrote. That is also why the desktop
+// composer has no attachment size cap: a 4 GB video costs one string here.
 
 export interface StoredAttachment {
   n: number;
-  path: string; // absolute scratch-file path holding the decoded bytes
+  path: string; // absolute path holding the bytes — our scratch file, or the user's own file
   mediaType: string;
   name: string; // original filename from the app
+  owned: boolean; // did WE write this file? false for a desktop path hand-off
 }
 
 export class AttachmentStore {
@@ -26,13 +33,24 @@ export class AttachmentStore {
     return this.dir;
   }
 
-  // Persist an inbound attachment's bytes, assign it the next ref number, and return
-  // the stored record (its ref + scratch path).
-  register(file: { name: string; mediaType: string; base64: string }): StoredAttachment {
+  // Register an inbound attachment under the next ref number and return the stored
+  // record. Bytes are staged into the scratch dir; a `path` (desktop) is adopted
+  // as-is — copying a file the agent can already open would be pure waste, and for
+  // the large files this path exists to carry, waste measured in gigabytes.
+  register(file: { name: string; mediaType: string; base64?: string; path?: string }): StoredAttachment {
     const n = this.nextN++;
+    if (file.path) {
+      const stored: StoredAttachment = {
+        n, path: file.path, mediaType: file.mediaType, name: file.name, owned: false,
+      };
+      this.byN.set(n, stored);
+      return stored;
+    }
     const path = join(this.ensureDir(), `att-${n}${extname(file.name) || ""}`);
-    writeFileSync(path, Buffer.from(file.base64, "base64"));
-    const stored: StoredAttachment = { n, path, mediaType: file.mediaType, name: file.name };
+    writeFileSync(path, Buffer.from(file.base64 ?? "", "base64"));
+    const stored: StoredAttachment = {
+      n, path, mediaType: file.mediaType, name: file.name, owned: true,
+    };
     this.byN.set(n, stored);
     return stored;
   }