feat: make composer attachments available to managed runtimes #380

New issue

Open

opened 2026-07-18 00:17:08 +02:00 by dries · 0 comments

dries commented

2026-07-18 00:17:08 +02:00

Owner

Parent

#375

What to build

Make composer file and image attachments usable by OpenCode regardless of whether the project instance runs natively or in a managed container. Replace the accidental assumption that an arbitrary host cache path is directly readable by the agent runtime.

Prefer the smallest secure transport that works with the supported OpenCode API: a dedicated narrowly mounted attachment root is acceptable for the first slice; an authenticated short-lived download endpoint is preferable if it avoids broad filesystem exposure without complicating OpenCode input handling.

Acceptance criteria

Native attachment behavior remains functional.
A managed container can consume uploaded file and image attachments without access to unrelated host cache data.
Attachment location/transport is runtime-independent at the session operation seam.
Access is scoped to the intended session or managed runtime and cannot be used to read arbitrary host paths.
Existing size, filename, and file-permission protections remain enforced.
Temporary files have a documented cleanup/lifetime policy that handles stopped or removed containers.
Remote-host sessions keep attachment bytes and access on the owning host.
Tests cover native and container paths, inaccessible/stale attachments, traversal attempts, cleanup, and remote owner routing.
User-facing errors distinguish upload failure from runtime attachment access failure.

Blocked by

#378

## Parent #375 ## What to build Make composer file and image attachments usable by OpenCode regardless of whether the project instance runs natively or in a managed container. Replace the accidental assumption that an arbitrary host cache path is directly readable by the agent runtime. Prefer the smallest secure transport that works with the supported OpenCode API: a dedicated narrowly mounted attachment root is acceptable for the first slice; an authenticated short-lived download endpoint is preferable if it avoids broad filesystem exposure without complicating OpenCode input handling. ## Acceptance criteria - [ ] Native attachment behavior remains functional. - [ ] A managed container can consume uploaded file and image attachments without access to unrelated host cache data. - [ ] Attachment location/transport is runtime-independent at the session operation seam. - [ ] Access is scoped to the intended session or managed runtime and cannot be used to read arbitrary host paths. - [ ] Existing size, filename, and file-permission protections remain enforced. - [ ] Temporary files have a documented cleanup/lifetime policy that handles stopped or removed containers. - [ ] Remote-host sessions keep attachment bytes and access on the owning host. - [ ] Tests cover native and container paths, inaccessible/stale attachments, traversal attempts, cleanup, and remote owner routing. - [ ] User-facing errors distinguish upload failure from runtime attachment access failure. ## Blocked by - #378