Release v0.4.7

[code-crusher]

What's new

This release introduces a file attachment system — users can now attach documents and images to their prompts for richer context.

Features

• File picker — use /attach or Ctrl+F to open the native OS file picker (macOS, Windows, Linux)
• Drag-and-drop — files pasted from the terminal are automatically detected as attachments (only when every pasted token is a supported file, so ordinary text is unaffected)
• Document extraction — text is extracted from PDF, DOCX, XLSX, CSV, TSV, JSON, XML, YAML, Markdown, and plain-text files, bounded to 200K chars per file (500K total)
• Image support — PNG, JPEG, and WebP images are validated by signature and sent as data URLs for vision-capable models; unsupported models show a clear warning
• Composer UI — attached files are shown inline with indicators for type (📎), image vs document, and truncation; backspace on an empty prompt removes the last file; escape clears the composer
• Attachment limits — 20 files max, 10 MB per file, 25 MB total source bytes; prevents abuse and keeps context manageable
• Session persistence — attachment summaries are stored in transcript entries so they survive session save/resume

Dependencies added

• mammoth — DOCX text extraction
• pdf-parse — PDF text extraction
• read-excel-file — XLSX text extraction

[matterai-app]

Summary By MatterAI

🔄 What Changed

This PR introduces comprehensive file attachment support to the OrbCode CLI. It adds the ability to attach images (JPEG, PNG, WebP) and documents (PDF, DOCX, XLSX, CSV, etc.) via a new /attach command, system file pickers, or terminal drag-and-drop. The core agent now handles multi-modal content, and the TUI has been updated to display attachment status and summaries.

🔍 Impact of the Change

Users can now provide rich context to the AI directly from the terminal. The system automatically extracts text from complex document formats and validates image integrity. This significantly expands the agent's utility for data analysis and vision-based tasks while maintaining strict resource limits (10MB per file, 500k characters total) to ensure performance.

📁 Total Files Changed

Click to Expand

File	ChangeLog
Version Bump package.json	Updated to v0.4.7; added mammoth, pdf-parse, and read-excel-file dependencies.
Multi-modal Client src/api/aiSdkClient.ts	Added support for ImagePart in user messages for Vercel AI SDK integration.
Attachment Logic src/attachments.ts	New utility for file picking, text extraction (PDF/DOCX/XLSX), and image validation.
Logo Colors src/branding.ts	Defined immutable orbital colors for consistent branding across themes.
Agent Loop src/core/agent.ts	Integrated attachment handling into the conversation turn and system prompt context.
Session Types src/core/sessions.ts	Updated transcript types to include attachment summaries.
UI Orchestration src/ui/App.tsx	Added message queuing for attachments and updated TUI layout for file display.
Branding UI src/ui/components/Header.tsx	Updated header to use new immutable branding colors.
Input Handling src/ui/components/InputBox.tsx	Implemented file drag-and-drop, /attach command, and attachment status display.
Row Rendering src/ui/components/rows.tsx	Updated user block rendering to display attached file icons and names.
Attachment Tests test/attachments.test.ts	New tests for path parsing, text extraction limits, and image signature checks.

🧪 Test Added/Recommended

Added

• test/attachments.test.ts: Validates shell-escaped path recognition, text extraction from CSV, image signature validation, and character truncation logic.

Recommended

• Add integration tests for the /attach command flow within the InputBox component.
• Add unit tests for truncateExtractedText to ensure edge cases (very small limits) are handled correctly.

🔒 Security Vulnerabilities

• Resource Exhaustion: Mitigated by MAX_SOURCE_FILE_BYTES and MAX_EXTRACTED_CHARACTERS_TOTAL limits.
• File Injection: Image signature validation (validateImageSignature) prevents spoofed extensions.
• Path Traversal: path.resolve and fs.statSync checks in droppedAttachmentPaths ensure only valid files are processed.