feat(tasks): upload agent-created artifacts

[tatoalo]

Problem

Files created by cloud agents only live in the temporary sandbox, so users cannot download non-code deliverables after a run ends.

Why: Cloud tasks need a durable, adapter-independent way to deliver reports, images, archives, and other generated files.

Changes

• Add a shared Claude/Codex tool that uploads selected workspace files through the existing task artifact storage flow
• Restrict uploads to workspace files and document cloud artifact paths and limits

[trunk-io]

😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 271b5a1.}

[veria-ai]

High: Symlink race bypasses workspace containment

The containment check and stat operate before this readFile, so an agent can run a background rename/symlink loop that makes realpath validate an in-workspace file and then redirects this reopen to a file such as /tmp/agent-env. That lets the agent register sandbox credentials or other out-of-workspace data as a downloadable artifact. Open the file once, verify the opened descriptor's canonical target is within workspace, and use that same descriptor for stat and reading rather than reopening the pathname.

[veria-ai]

PR overview

This pull request adds support for uploading artifacts created by agents through the local tools adapter.

One security issue remains open in the artifact upload path: a symlink race can bypass workspace containment and expose files outside the workspace as downloadable artifacts. No issues have yet been addressed, and the remaining flaw could disclose sandbox credentials or other sensitive data accessible to the agent process.

Open issues (1)

• High: Symlink race bypasses workspace containment — packages/agent/src/adapters/local-tools/tools/upload-artifact.ts:92

Fixed/addressed: 0 · PR risk: 8/10

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(tasks): upload agent-created artifa..." | Re-trigger Greptile}