[tim-smart]

Closes EFF-3309

The chat agent can now attach files from its sandbox to its reply on Slack and Discord. Until now, the only file that ever went out was the automatic reply.md for a reply too long to post as messages.

The tool

attachFile({ path, name? }) is a loop-side tool, like PR review's reportFinding. It reads the file from the sandbox right away and adds it to the turn's list. name is the filename shown in the thread and defaults to the file's own name. The content type comes from the extension, with application/octet-stream for anything else. The system prompt tells the agent to use the tool for generated images, diffs, logs and anything too big to paste.

Limits are checked inside the tool, so the model gets a message it can act on instead of a failure at post time:

• At most 9 files per reply. Discord takes 10 files a message, and an overflowing reply needs one of them for reply.md.
• At most 9 MiB in all. Discord's limit is 10 MiB a message on a server without boosts, and the remaining room covers reply.md. This is a total, so a single file over 9 MiB fails too.

The list belongs to one sandbox (makeReplyFiles in Chat/ReplyFiles.ts, created per attempt in Session.ts). A turn that resumes after losing its sandbox starts with an empty list, so stale bytes are never posted. A turn that fails, is cancelled, or is stopped by the kill switch posts nothing.

Reading from the sandbox

ChatSandbox.readFile(path, maxBytes) calls a new GET /files route on the container, which reads through readWorkspaceFile (Chat/Sandbox/Files.ts). It is a path filter. The path must be absolute and under /workspace. Symlinks are resolved with realpath, and the resolved file must still be under /workspace, be a regular file and fit maxBytes. The read uses the resolved path and stops one byte past maxBytes.

Posting

postReply takes files and posts them in the same message as the reply, as decided on the issue:

• Discord: the files go with the last chunk. Earlier chunks stay text-only, and the allowed_mentions / message_reference handling is unchanged.
• Slack: the files are uploaded before any text is posted. The earlier chunks then go out as markdown_text as before, and the last chunk is shared with the files through files.completeUploadExternal, its text as initial_comment in mrkdwn.
• reply.md: an overflowing reply is posted as reply.md plus the files, in one message, on both platforms.

If the platform refuses the files, whatever of the reply isn't out yet goes as text instead, ending in "(Couldn't attach plot.png.)": the whole reply when the files were refused with it, the last chunk when the earlier chunks are already out, and an overflowing reply as text chunks, however many it takes. The platform is the only layer that knows what went out, so it owns this, and nothing already posted is ever posted again. A failure whose answer was lost, where the message may be up, fails the reply, and the session doesn't retry anything. postReply succeeds with the text it posted, and the session saves that, so the stored reply keeps the note. The turn counts as replied whenever the text went out. uploadFile now takes bytes and a content type.

Open points

• Slack formatting: the message that carries the files loses some formatting. files.completeUploadExternal fails with internal_error when it carries a markdown block (python-slack-sdk#1756, still open), so that message's text goes as initial_comment in mrkdwn. Tim accepted the loss to keep the files in the reply's message. toMrkdwn rewrites headers and bold to *bold*, ~~strike~~ to ~strike~ and links to <url|text> outside code, escapes &, < and >, and drops a code fence's language. Tables, lists and italics stay as written. Replies without files still go as markdown_text. initial_comment is the documented argument, but a live check on Slack is still worth doing.
• What the path check guards: it refuses a path or symlink that resolves outside /workspace. It is a path filter, not isolation from the agent's own scripts: they run as root in the same container, and a symlink swapped in between the check and the read can still point outside. That gains them nothing, since they can copy any file into /workspace anyway. The container holds no credentials; the egress proxy swaps in the real tokens.

Tests

One test per behaviour, nine in all:

• Sandbox/Files.test.ts: readWorkspaceFile refuses .. escapes, absolute paths elsewhere, symlinks to a file or directory outside the workspace, and oversized files.
• Session.test.ts: attached files go out with the reply, named and typed by extension. The tool refuses a file over 9 MiB and a tenth file. Files from a turn that ends without a reply are never posted. A reply whose files can't be uploaded is still posted, naming them.
• Discord/Platform.test.ts and Slack/Platform.test.ts, one each: the files go in the same message as the reply's last part, and an overflowing reply sends reply.md and the files in one message.

The Session test for a refused upload still expects the session to post the reply a second time, which it no longer does; it needs to move to the platforms, where the fallback now lives. Until then vp test passes 946 of 947 tests, and vp check reports 0 errors.