[maria-rcks]

attachment paths disappeared when generated context exceeded 120,000 characters, and pi silently skipped unresolved attachments. every attachment now has a path or an explicit unavailable entry. optional captured-window context keeps its budget and reports truncation; pi uses the shared formatter.

git history traces the guard to the orchestrator introduction (de34391), alongside the captured-window budget test, with no provider-specific hard limit documented. codex, claude, cursor, acp/grok, muse, and both opencode adapters already use the shared formatter and inherit the fix.

blacksmith passed 104 focused tests, both package typechecks, and scoped lint with zero errors and one existing warning. real web/codex turns with matching 119,984-character messages and four pasted files returned 0/4 paths before and 4/4 after. real pi turns with forward-compatible attachment metadata that resolves to null changed from "no attachments received" to naming the unavailable file. other providers were source-audited, not exercised live.

Built by gpt-6.1-sol in Codex, orchestrated from T3 Code.

[macroscopeapp]

Approvability

Verdict: Approved at 859796e

Macroscope's review found this PR approvable — This is a localized server bug fix that preserves attachment paths or explicitly reports unavailable attachments, while keeping optional captured-window context within its budget. Pi now uses the shared formatter, with focused tests covering the boundary and unresolved-attachment cases.

No code changes detected at ee75562. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 1eb4071 · PR result: ee75562 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 55d10d07-afce-4990-ac13-fb66adc71bb0

📥 Commits

Reviewing files that changed from the base of the PR and between 037fddf and 859796e.

📒 Files selected for processing: 2

• packages/provider-core/src/server/attachmentPrompt.test.ts
• packages/provider-pi/src/server/adapter.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The prompt builder now includes attachment paths or unavailable notices and omits optional captured-window context when it cannot fit within the input limit. The provider adapter uses this builder and continues to include image payloads.

Changes: Attachment prompt construction

Layer / File(s)	Summary
Attachment entries and context budget packages/provider-core/src/server/attachmentPrompt.ts, packages/provider-core/src/server/attachmentPrompt.test.ts	The prompt builder adds a path entry or unavailable notice for each attachment. It reserves space for a truncation notice before adding optional captured-window context. Tests cover input-limit boundaries, unavailable attachments, and omitted context.
Provider adapter prompt integration packages/provider-pi/src/server/adapter.ts, packages/provider-pi/src/server/adapter.test.ts	The adapter uses the shared prompt builder for message text and attachment paths. It continues to encode image attachments as native payloads. Tests cover resolvable paths, image data, and unavailable attachments.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 85979

The attachment prompt changes are mergeable after normal checks; no actionable issue remains.

Security architecture risk: 🔵 Low · up to 85979

Attachment availability becomes explicit without adding file-reading privileges. The main considerations are handling captured-window content as untrusted data and ensuring providers accept messages that exceed the text-input budget after attachment entries are added.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly established exposure is attachment-derived content entering the selected provider’s prompt. In Pi, more attachment metadata becomes visible, but the inspected change does not add file writes, credential access, or new file-reading authority.

Trust Boundaries and Controls

• observed — Both Pi text formatting and native image loading use the host-provided attachment resolver. Null paths produce unavailable text and skip native reads. The host contract requires paths to resolve inside the attachment directory, but its concrete enforcement was not inspected.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		The description clearly states the problem, explains the implementation, documents scope, and provides detailed verification results. It also identifies the agent and harness used. The required templa…
Title check		The title clearly and concisely describes the primary change: preventing attachments from being silently dropped from prompts.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly states the problem, explains the implementation, documents scope, and provides detailed verification results. It also identifies the agent and harness used. The required template headings are omitted, but the required information is present and the focused bug rationale addresses the scope requirement.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate 859796e