[robstolarz]

Lets depot agent session send files, directories, piped output and images to an agent, and turns attach into a chat whose input stays usable while output streams.

• create and send take --file <path> (repeatable; a file or a directory) and --stdin-file <name>, e.g. some-cmd | depot agent session send <id> --stdin-file out.txt "look at this". In attach, /file <path> [message] adds a file to the next message.
• Every source goes through one upload: the CLI hashes locally, then PUTs each file to the signed URL the API returns for its hash, with the signed headers as given. The media type comes from the content, then the extension, so a piped screenshot reaches the model as an image.
• Limits on file count, per-file size and message total come from the API and are checked before anything is read in full or uploaded. Each send shows the file count and size.
• A directory sends what git would track, so .gitignore applies, and is refused if git fails inside a work tree; outside one it skips .git. Names are flattened to dir_sub_file, with a ~N suffix to keep them unique, within 255 bytes. Each file is read once, so the upload matches its hash.
• In a terminal, attach prints the conversation above an editable input line. Each user message names its sender and lists its files.
• Depends on an API that is not released yet. Part of DEP-7247.

Test plan

• go test -race ./pkg/cmd/agent/, golangci-lint run, go vet ./... clean
• Fake-server tests: only the returned URLs are PUT, with the signed headers; over-limit, over-count and empty-directory refusals; .gitignore honoured; a piped PNG without an extension sent as image/png; unique names; /file queueing and the cumulative limit in attach
• Once the API ships: depot agent session send <id> --file ./src "review this" and cat shot.png | depot agent session send <id> --stdin-file shot, then confirm the agent sees both

Stack, decisions, and deferred / known-open

1. feat: add depot agent session commands #606 depot agent session commands
2. this PR: files and chat attach
3. feat: add depot agent pull and push #610 depot agent pull and push (on this PR)

#608 plugin views is also based on #606.

Decisions made without Rob:

• A directory sends git ls-files --cached --others --exclude-standard inside a work tree, and is refused if git fails there, rather than falling back to sending everything.
• Directory files are flattened to dir_sub_file, since attachment names are base names; collisions get ~N, and long names lose leading characters of the stem to fit 255 bytes.
• A symlinked directory is followed; symlinks inside a directory are skipped.
• The media type comes from the content first. The extension is used only when it narrows a generic result: zip to .docx, text to any type that isn't image, video, audio or font (.md, .rtf; .svg is allowed), MP4/WebM to an audio type (.m4a), or bytes the sniffer can't place. The system MIME table differs by machine (.ts can map to video/mp2t), so text always stays text.
• The narrowing is by family, not an allowlist of aliases: a name that contradicts its bytes (a zip named .pdf, a text file named .wasm) keeps the name's type. The CLI only guarantees that a machine's MIME table cannot relabel a correctly named file.
• Message attachments are field 8, leaving 6 and 7 for the author and sender fields on the same message.
• attach keeps an editable input line while output streams, rather than plain stdin lines.
• A sender shows as name (kind) for any kind but user, so a new kind like subagent needs no CLI change.

Deferred / known-open:

• A file queued with /file in attach is uploaded at once, and the stored copy is kept for at least 24 hours. If the next message comes after that, the send fails with the API's error instead of re-uploading. The queued files are then dropped and the chat says to /file them again. Holding the bytes to re-upload would keep up to 64 MiB in memory for the whole chat, for a rare case.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NdhqP6oGqJMRJLwBU5Zepm

[linear-code]

DEP-7247

[cursor]

Stale comment

Risk: medium. Left a non-blocking comment: Cursor Bugbot was present but did not finish within the wait window, so this run is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: medium. Left a non-blocking comment: Cursor Bugbot was present but did not finish within the wait window, so this run is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0f2281f. Configure here.}

[cursor]

Risk: medium. Approved: Cursor Bugbot completed successfully and the prior finding is resolved, so this run does not need human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[robstolarz]

Superseded by #613 in the per-feature Depot agents stack (DEP-7247). Closing.