feat: surface uploadable files to the agent

[lmorchard]

Summary

Builds on the upload_file action (#494): when upload_allowed_paths names specific files, the agent is now told those files exist and their exact paths, so it can complete upload-gated forms instead of giving up. Also stops advertising upload_file in the prompt when uploads are disabled (a pre-existing quirk).

• New Node-only helper resolveAdvertisedUploadFiles(allowFileUpload) resolves the allowlist entries that are existing regular files (directories/missing paths skipped). Exported from index.ts only — never the browser-safe core.ts.
• buildToolExamples gates the upload_file example on a new hasFileUpload flag and, when files are advertised, lists their exact paths near the affordance. Threaded through buildActionLoopSystemPrompt and buildStepErrorFeedbackPrompt.
• WebAgent stays browser-safe (no fs): CLI and server compute the file list (they already build allowFileUpload) and pass advertisedUploadFiles via WebAgentOptions.

Why

File upload was the dominant capability gap on the browser-use interaction benchmark (#462). With the allowlist as a pure security gate, the agent never knew a fixture existed; it now learns the path from its prompt, the way browser-use surfaces its available files.

Test Plan

• Unit: resolveAdvertisedUploadFiles (files included, dirs/missing excluded); buildToolExamples/builders show/hide upload_file + the file note by flag.
• pnpm --filter pilo-core --filter pilo-cli --filter pilo-server run test green; typecheck + format:check clean.
• Manual: with a task that does not name the path, the agent calls upload_file with the prompt-advertised path and the form accepts it.
• In-harness (local browser-use benchmark, Chromium): agent uploads the advertised fixture end-to-end.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves the agent’s ability to complete upload-gated web forms by (1) surfacing concrete allowlisted file paths in the agent prompt and (2) no longer advertising upload_file in prompts when uploads are disabled. It extends the existing upload allowlist security gate to also act as a “capability manifest” for the agent.

Changes:

• Add a Node-only utility resolveAdvertisedUploadFiles(allowFileUpload) to filter allowlist entries down to existing regular files and resolve them to absolute paths.
• Thread hasFileUpload + advertisedUploadFiles through prompt builders so upload_file examples are shown/hidden appropriately and can list exact available file paths.
• Update CLI and server runners to compute advertisedUploadFiles and pass them into WebAgentOptions; add/extend unit tests around the new behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/server/test/sensitive-data-leak.test.ts	Extend pilo-core mock to include the new export used by the server runner.
packages/server/src/taskRunner.ts	Compute advertisedUploadFiles from the upload allowlist and pass into WebAgent options.
packages/server/src/taskRunner.test.ts	Extend pilo-core mock to include the new export used by runTask().
packages/core/test/utils/uploadFiles.test.ts	Add unit tests for resolveAdvertisedUploadFiles() (files included; dirs/missing skipped).
packages/core/test/prompts.test.ts	Add tests asserting upload_file prompt gating and advertised file list rendering.
packages/core/src/webAgent.ts	Add advertisedUploadFiles option plumbed into prompt construction; derive hasFileUpload.
packages/core/src/utils/uploadFiles.ts	Introduce resolveAdvertisedUploadFiles() Node-only helper.
packages/core/src/prompts.ts	Gate upload_file tool example by hasFileUpload and include an advertised-files note when present.
packages/core/src/index.ts	Export the new Node-only helper from the main barrel export.
packages/cli/src/commands/run.ts	Compute advertisedUploadFiles in CLI and pass into WebAgent options.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lmorchard]

Verified, and the real issue is incomplete test mocks rather than the production call. pilo-core is a workspace:* dependency, so resolveAdvertisedUploadFiles is always present at runtime — there's no real version-mismatch path. The only place it's undefined is hand-written vi.mock("pilo-core", () => ({...})) factories that omit it; guarding the production call to accommodate those would degrade production code to satisfy test fakes.

Fixed by completing the mocks instead. You flagged routes/pilo.test.ts; the same gap also existed in routes/piloWs.test.ts (the WS route also calls runTask) — both now export resolveAdvertisedUploadFiles. (sensitive-data-leak.test.ts and taskRunner.test.ts already had it.) Note the routes/* suites were green before this because /pilo/run is an SSE stream: status 200 is sent when the stream opens, so the TypeError was thrown inside the stream callback and masked by tests that only assert the status, not the streamed events.

The CLI suite (run.test.ts) uses importOriginal() + spread, so it already had the real export — no change needed there.

[lmorchard]

Correction to my earlier reply: I'd also touched routes/piloWs.test.ts, but that was unnecessary and I've reverted it. That suite mocks ../taskRunner.js outright (runTask → a local vi.fn()), so the real runTask — and thus resolveAdvertisedUploadFiles — never runs there; its pilo-core mock didn't need the export. The only suite that genuinely hit the masked TypeError is routes/pilo.test.ts (real runTask via the SSE route), and that's the one fixed here. Force-pushed; the diff now only adds the export to routes/pilo.test.ts.