mirror of
https://github.com/Kilo-Org/kilocode.git
synced 2026-09-01 15:32:11 +08:00
Igor Šćekić
e72238a665
* feat(cli): accept mobile file attachments in remote sessions The mobile client uploads each attachment to R2 and sends a first-class FilePartInput with a server-issued <uuid>.<ext> basename. The CLI fetches the file over HTTPS, re-emits it as a data: URL for text / image / PDF, or writes it to a per-session scratch directory for generic binaries so the agent's tools can read it. - Fetches are HTTPS-only, reject redirects, never forward credentials, are bounded to 5 MB + 1 byte (partial deleted on overflow), and time out. - Any per-attachment failure becomes an explanatory text part so the rest of the prompt still runs; the send_message ACK is unaffected because materialization happens inside the long-running dispatch before prompt(). - Scratch directory (0700 / files 0600) lives under Global.Path.tmp and is removed on session deletion and sender dispose. Basenames derive from the attachment id + validated extension, never the client-supplied filename. - The relay heartbeat now advertises capabilities.attachments so the mobile app only enables attachments for CLIs that support them. * fix(cli): secure remote attachment materialization * chore(cli): remove redundant change markers * fix(cli): coordinate remote attachment lifetime * fix(cli): fail closed during attachment cleanup * fix(cli): track idle attachment cleanup