An agent chat used to open with the model knowing the name of a machine and
nothing about what was on it, so the first two rounds of every reply went on
finding out. It now gets a listing: one read-only command, `git ls-files` where
that works and `find` otherwise, falling back to an SFTP walk that always does.
git first because a repository already carries somebody's considered list of
what is not part of the project, and reproducing it by hand is how an index
ends up mostly build output.
The listing is budgeted rather than dumped. A tree of a thousand files is worse
than no tree -- it costs the window on every request forever and buries the four
names that mattered -- so directories that will not fit are shown as a count and
the model is told to open one itself. Collapsing picks the deepest and largest
first: by saving alone it would take `src/` before `src/web/static/vendor/`,
because it contains it, and lose every name worth having.
Read from a cache and never fetched. `harness.context_variables` is synchronous
and sits on the request path; the walk happens in the generation setup, which is
async and already doing network work, with a short wait. A chat whose first
reply outruns its first walk simply has no listing that turn and the fragment
disappears rather than appearing as an empty heading.
Then `@`, over the same index and over the library, and `/` for commands with an
Alt-based keyboard for the same jobs. A mentioned file arrives as contents, not
a reference -- a small model asked to call file_read often does not bother -- and
it arrives with its absolute path and the machine it came from, because a model
handed `main.py` cannot tell which of four it is and cannot name it back when
asked to change something.
The rule that matters for `/`: a message that merely starts with a slash still
sends. `//` escapes and an unrecognised command is posted as written. Swallowing
somebody's message is a much worse failure than an unknown command.
Two exceptions to Manual mode now, not one. Browsing and indexing are a person
acting, not a model, so neither passes through policy.py -- the same argument
the terminal panel rests on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Drag, paste or pick a file in the composer. Images go to vision models
as multimodal content parts; PDFs and text files have their content
extracted and placed in the prompt. Verified end to end against
gemma4-e4b-q8 on llama-swap: given a drawing and a text file, it named
the red square and blue circle and read the number out of the document.
Type is decided by inspecting the bytes, never the filename or the
browser's Content-Type -- a .png full of text is stored as text. Images
are downscaled to 1400px and re-encoded: a phone photo is several
megabytes of base64, which is slow and a large slice of the context
window. PDF text is extracted once, at upload, and stored; re-extracting
per request would let a reply change because a parser was upgraded.
Design points worth keeping:
- Images are only sent to models an administrator has marked `vision`.
This is not graceful degradation -- most endpoints reject the entire
request rather than ignoring an image part. A plain text turn stays a
plain string for the same reason: the list form 400s on endpoints that
do not implement it.
- Images reach the model as base64 data URIs, not links. A local
endpoint has no route back to LLeMbas, and a hosted one has no
credentials for it.
- Non-images are served Content-Disposition: attachment with nosniff, so
an uploaded .html can never execute in this origin. Stored names are
random; the uploader's name is a label and never a path.
- Uploads are unbound until the message is sent, which is what lets a
file be removed beforehand. claim() only takes unclaimed rows owned by
the sender, so a forged id cannot pull in someone else's file.
Abandoned uploads are swept at startup.
- A scanned PDF says so rather than silently contributing nothing, and
truncation is declared to the model in the document tag so it can
admit it did not see page 400.
- "Here, look at this" with no words is a legitimate turn, so a message
is only empty when it carries neither text nor files.
Also fixes auto-titling, which read message["content"] as a string and
would have broken on the first multimodal turn.
186 tests, ruff clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jaroslav Beneš