@agentknight/sdk 0.9.38 → 0.9.39

package/dist/index.js

@@ -4,12 +4,12 @@ import {
   PeerChatRequestSchema,
   PeerChatResultSchema,
   validateDataDirectory
-} from "./chunks/chunk-4FC2WG64.js";
+} from "./chunks/chunk-UE4QYZCG.js";
 import {
   AgentSelectionSchema,
   assertSelectionSnapshotFits,
   supportsAgentSelection
-} from "./chunks/chunk-6YF3VZLR.js";
+} from "./chunks/chunk-KPRPUIXR.js";
 import {
   ConversationNormalizer,
   LiveTimelineProjection,
@@ -31,16 +31,16 @@ import {
   resolveGitProjectIdentity,
   sessionRestoreFailure,
   validateOperationResponse
-} from "./chunks/chunk-UIM3KQRC.js";
+} from "./chunks/chunk-QGPX4UDW.js";
 import {
   GROUP_CHAT_MAX_TURNS,
   GroupChatError
-} from "./chunks/chunk-YSJRQ35E.js";
+} from "./chunks/chunk-VCNYBWYE.js";
 import {
   assistantPreview,
   isContentfulAssistant,
   userPreview
-} from "./chunks/chunk-34DUD2Y4.js";
+} from "./chunks/chunk-N4MN54CD.js";
 import {
   AgentModelListingError,
   AgentSessionRenameError,
@@ -49,7 +49,7 @@ import {
   UnsupportedAgentOperationError,
   captureResearchAccess,
   captureWorkbenchAccess
-} from "./chunks/chunk-6GVMVE5N.js";
+} from "./chunks/chunk-BM6T2DLH.js";
 import {
   A2aRelayRequestSchema,
   A2aRelayResponseSchema,
@@ -107,8 +107,11 @@ import {
   SESSION_FILE_MAX_IMAGE_EDGE,
   SESSION_FILE_MAX_IMAGE_PIXELS,
   SESSION_FILE_MAX_ORIGINAL_BYTES,
+  SESSION_FILE_MAX_VIDEO_PIXELS,
   SESSION_FILE_READ_OPERATION,
+  SESSION_FILE_READ_V2_VERSION,
   SESSION_FILE_READ_VERSION,
+  SESSION_FILE_V2_MAX_ORIGINAL_BYTES,
   SESSION_GIT_DIFF_GZIP_MIN_BYTES,
   SESSION_GIT_DIFF_GZIP_VERSION,
   SESSION_GIT_DIFF_MAX_FILES,
@@ -116,6 +119,9 @@ import {
   SESSION_GIT_DIFF_MAX_RESPONSE_BYTES,
   SESSION_GIT_DIFF_OPERATION,
   SESSION_GIT_DIFF_VERSION,
+  SESSION_IMAGE_API_PATH,
+  SESSION_IMAGE_MAX_BYTES,
+  SESSION_IMAGE_MAX_PIXELS,
   SESSION_LIST_UPDATES_CAPABILITY,
   SESSION_OPTIONS_PARTIAL_CAPABILITY,
   SESSION_PROJECT_IDENTITY_OPERATION,
@@ -144,9 +150,14 @@ import {
   SessionDirectoryListResultDataSchema,
   SessionFileReadDataSchema,
   SessionFileReadResultDataSchema,
+  SessionFileReadV2ResultDataSchema,
   SessionGitDiffDataSchema,
   SessionGitDiffGzipResultDataSchema,
   SessionGitDiffResultDataSchema,
+  SessionImageCommitResultSchema,
+  SessionImageScopeSchema,
+  SessionImageUploadRequestSchema,
+  SessionImageUploadResultSchema,
   SessionListRequestSchema,
   SessionListResultSchema,
   SessionOptionsRequestSchema,
@@ -164,6 +175,8 @@ import {
   SessionTimelinePageSchema,
   SessionWatchRequestSchema,
   SessionsSnapshotSchema,
+  TIMELINE_IMAGE_BLOB_OPERATION,
+  TIMELINE_IMAGE_BLOB_VERSION,
   TIMELINE_IMAGE_CHUNK_BYTES,
   TIMELINE_IMAGE_MAX_BYTES,
   TIMELINE_IMAGE_OPERATION,
@@ -172,6 +185,8 @@ import {
   TIMELINE_SYNC_OPERATION,
   TIMELINE_SYNC_VERSION,
   TRANSPORT_V2,
+  TimelineImageBlobRequestSchema,
+  TimelineImageBlobResultSchema,
   TimelineImageChunkSchema,
   TimelineImageRequestSchema,
   TimelineSyncRequestSchema,
@@ -208,12 +223,12 @@ import {
   sessionCommunicationError,
   sessionCommunicationOperationCapability,
   workbenchCapability
-} from "./chunks/chunk-GNQC2IS2.js";
+} from "./chunks/chunk-E3XCZWRK.js";
 
 // src/initialize.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 
 // src/coding-agent-factory.ts
 import { resolve } from "node:path";
@@ -286,7 +301,7 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
   switch (engine.kind) {
     case "managed": {
       if (owner === void 0) throw new Error("Managed coding agents require the PC owner identity");
-      const { ManagedCodingAgentAdapter } = await import("./chunks/managed-agent-adapter-EMBDKITT.js");
+      const { ManagedCodingAgentAdapter } = await import("./chunks/managed-agent-adapter-T3FVUJHA.js");
       return new ManagedCodingAgentAdapter({
         dataDirectory: config.dataDirectory,
         owner,
@@ -325,7 +340,7 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
       });
     }
     case "copilot": {
-      const { GithubCopilotAdapter } = await import("./chunks/copilot-adapter-USX4UEWH.js");
+      const { GithubCopilotAdapter } = await import("./chunks/copilot-adapter-N5B7BNWO.js");
       if (owner !== void 0) {
         return new GithubCopilotAdapter(void 0, void 0, void 0, {
           dataDirectory: config.dataDirectory,
@@ -345,13 +360,13 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
     }
     case "pi": {
       assertPiRuntimeSupported();
-      const { PiCodingAgentAdapter } = await import("./chunks/pi-adapter-KT5M7Z6R.js");
+      const { PiCodingAgentAdapter } = await import("./chunks/pi-adapter-PHEFFJVF.js");
       return new PiCodingAgentAdapter(
         engine.agentDirectory === void 0 ? {} : { agentDirectory: resolve(engine.agentDirectory) }
       );
     }
     case "acp": {
-      const { AcpCodingAgentAdapter } = await import("./chunks/acp-adapter-DZ3EE36H.js");
+      const { AcpCodingAgentAdapter } = await import("./chunks/acp-adapter-BWVM6WIF.js");
       return new AcpCodingAgentAdapter({
         command: engine.command,
         args: engine.args,
@@ -367,6 +382,18 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
   }
 }
 
+// src/config.ts
+import { z } from "zod";
+var SessionImagesConfigSchema = z.object({
+  allowUnencryptedStorage: z.literal(true),
+  storageAccount: z.string().regex(/^[a-z0-9]{3,24}$/u),
+  storageContainer: z.string().min(3).max(63).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u)
+}).strict();
+var SessionImageRelayUrlSchema = z.url().refine((value) => {
+  const url = new URL(value);
+  return /^https:\/\/[^/?#\\@\s\x00-\x1f\x7f]+\/?$/iu.test(value) && url.protocol === "https:" && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+}, "Session images require an HTTPS Relay origin without a path, credentials, query or fragment").transform((value) => new URL(value).origin);
+
 // src/content-encryption.ts
 import {
   createCipheriv,
@@ -383,22 +410,22 @@ import {
 } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 var KEY_BYTES = 32;
 var NONCE_BYTES = 12;
 var AUTH_TAG_BYTES = 16;
 var DEFAULT_REPLAY_WINDOW_MS = 10 * 60 * 1e3;
 var MAX_REPLAY_ENTRIES = 1e4;
 var CONTENT_KEY_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-var ContentKeyFileSchema = z.object({
-  schemaVersion: z.literal(1),
-  key: z.string().regex(CONTENT_KEY_PATTERN)
+var ContentKeyFileSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  key: z2.string().regex(CONTENT_KEY_PATTERN)
 }).strict();
-var ReplayJournalEntrySchema = z.object({
-  schemaVersion: z.literal(1),
-  keyId: z.string().regex(/^[A-Za-z0-9_-]{22}$/u),
-  messageId: z.string().trim().min(1).max(256),
-  sentAt: z.number().int().nonnegative()
+var ReplayJournalEntrySchema = z2.object({
+  schemaVersion: z2.literal(1),
+  keyId: z2.string().regex(/^[A-Za-z0-9_-]{22}$/u),
+  messageId: z2.string().trim().min(1).max(256),
+  sentAt: z2.number().int().nonnegative()
 }).strict();
 var REPLAY_JOURNAL_COMPACT_EVERY = 256;
 var REPLAY_JOURNAL_MAX_BYTES = 1024 * 1024;
@@ -709,13 +736,13 @@ var ContentCipher = class {
 };
 
 // src/device-identity.ts
-import { z as z2 } from "zod";
-var DeviceIdentitySchema = z2.object({
-  schemaVersion: z2.literal(2),
-  machineId: z2.uuid(),
-  stableDeviceId: z2.uuid(),
-  machineName: z2.string().trim().min(1).max(120),
-  createdAt: z2.iso.datetime({ offset: true })
+import { z as z3 } from "zod";
+var DeviceIdentitySchema = z3.object({
+  schemaVersion: z3.literal(2),
+  machineId: z3.uuid(),
+  stableDeviceId: z3.uuid(),
+  machineName: z3.string().trim().min(1).max(120),
+  createdAt: z3.iso.datetime({ offset: true })
 });
 
 // src/pairing.ts
@@ -812,7 +839,7 @@ import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypt
 import { lstat as lstat3, realpath as realpath3, stat as stat4 } from "node:fs/promises";
 import { isAbsolute as isAbsolute4, join as join5 } from "node:path";
 import { gunzipSync } from "node:zlib";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/session-directory.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -967,6 +994,152 @@ import { basename, extname, isAbsolute as isAbsolute3, join as join4 } from "nod
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 import sharp from "sharp";
+
+// src/session-video.ts
+function requireVideo(valid) {
+  if (!valid) throw new Error("Unsupported video container");
+}
+function one(elements, id) {
+  const matches = elements.filter((element) => element.id === id);
+  const match = matches[0];
+  requireVideo(matches.length === 1 && match !== void 0);
+  return match;
+}
+function validateSessionVideo(bytes, mediaType) {
+  requireVideo(bytes.length > 0 && bytes.length <= SESSION_FILE_V2_MAX_ORIGINAL_BYTES);
+  if (mediaType === "video/mp4") validateMp4(bytes);
+  else validateWebm(bytes);
+}
+function validateMp4(bytes) {
+  const boxes = (start, end) => {
+    const result = [];
+    while (start < end) {
+      requireVideo(end - start >= 8);
+      let size = bytes.readUInt32BE(start);
+      const id = bytes.toString("latin1", start + 4, start + 8);
+      let header = 8;
+      if (size === 1) {
+        requireVideo(end - start >= 16 && bytes.readUInt32BE(start + 8) === 0);
+        size = bytes.readUInt32BE(start + 12);
+        header = 16;
+      }
+      if (size === 0) {
+        requireVideo(id === "mdat");
+        size = end - start;
+      }
+      requireVideo(size >= header && size <= end - start);
+      result.push({ id, start: start + header, end: start + size });
+      start += size;
+    }
+    return result;
+  };
+  const children = (element) => boxes(element.start, element.end);
+  const top = boxes(0, bytes.length);
+  requireVideo(top[0]?.id === "ftyp" && top.every((box) => ["ftyp", "moov", "mdat", "free", "skip", "wide"].includes(box.id)));
+  const ftyp = one(top, "ftyp");
+  requireVideo(ftyp.end - ftyp.start >= 8 && (ftyp.end - ftyp.start) % 4 === 0);
+  const brands = [bytes.toString("latin1", ftyp.start, ftyp.start + 4)];
+  for (let offset = ftyp.start + 8; offset < ftyp.end; offset += 4) brands.push(bytes.toString("latin1", offset, offset + 4));
+  requireVideo(brands.some((brand) => ["isom", "iso2", "mp41", "mp42", "avc1"].includes(brand)));
+  requireVideo(top.some((box) => box.id === "mdat" && box.end > box.start));
+  const movie = children(one(top, "moov"));
+  requireVideo(!movie.some((box) => ["rmra", "mvex"].includes(box.id)));
+  let videoTracks = 0;
+  for (const track of movie.filter((box) => box.id === "trak")) {
+    const media = children(one(children(track), "mdia"));
+    const handler = one(media, "hdlr");
+    requireVideo(handler.end - handler.start >= 12);
+    const type = bytes.toString("latin1", handler.start + 8, handler.start + 12);
+    requireVideo(type === "vide" || type === "soun");
+    const info = children(one(media, "minf"));
+    const dref = one(children(one(info, "dinf")), "dref");
+    requireVideo(dref.end - dref.start >= 8 && bytes.readUInt32BE(dref.start) === 0 && bytes.readUInt32BE(dref.start + 4) === 1);
+    const references = boxes(dref.start + 8, dref.end);
+    const reference = one(references, "url ");
+    requireVideo(references.length === 1 && reference.end - reference.start === 4 && bytes.readUInt32BE(reference.start) === 1);
+    const descriptions = one(children(one(info, "stbl")), "stsd");
+    requireVideo(descriptions.end - descriptions.start >= 8 && bytes.readUInt32BE(descriptions.start) === 0 && bytes.readUInt32BE(descriptions.start + 4) === 1);
+    const entries = boxes(descriptions.start + 8, descriptions.end);
+    const entry = entries[0];
+    requireVideo(entries.length === 1 && entry !== void 0 && entry.end - entry.start >= 8 && bytes.readUInt16BE(entry.start + 6) === 1);
+    if (type === "vide") {
+      requireVideo(["avc1", "avc3"].includes(entry.id) && entry.end - entry.start >= 78);
+      const width = bytes.readUInt16BE(entry.start + 24);
+      const height = bytes.readUInt16BE(entry.start + 26);
+      requireVideo(width > 0 && height > 0 && width * height <= SESSION_FILE_MAX_VIDEO_PIXELS);
+      const config = one(boxes(entry.start + 78, entry.end), "avcC");
+      requireVideo(config.end - config.start >= 7 && bytes[config.start] === 1);
+      videoTracks++;
+    } else requireVideo(entry.id === "mp4a" && entry.end - entry.start >= 28);
+  }
+  requireVideo(videoTracks === 1);
+}
+function validateWebm(bytes) {
+  const vint = (offset, end, id) => {
+    requireVideo(offset < end);
+    const first = bytes[offset];
+    requireVideo(first !== void 0 && first !== 0);
+    let length = 1;
+    while ((first & 128 >> length - 1) === 0) length++;
+    requireVideo(length <= (id ? 4 : 8) && length <= end - offset);
+    let value = id ? first : first & 255 >> length;
+    let unknown = !id && value === 255 >> length;
+    for (let index = 1; index < length; index++) {
+      const byte = bytes[offset + index];
+      requireVideo(byte !== void 0);
+      value = value * 256 + byte;
+      unknown = unknown && byte === 255;
+    }
+    requireVideo(unknown || Number.isSafeInteger(value));
+    return { value, next: offset + length, unknown };
+  };
+  const elements = (start, end) => {
+    const result = [];
+    while (start < end) {
+      const id = vint(start, end, true);
+      const size = vint(id.next, end, false);
+      const tag = id.value.toString(16);
+      requireVideo(!size.unknown || tag === "18538067");
+      const length = size.unknown ? end - size.next : size.value;
+      requireVideo(length <= end - size.next);
+      result.push({ id: tag, start: size.next, end: size.next + length });
+      start = size.next + length;
+    }
+    return result;
+  };
+  const text = (element) => bytes.toString("latin1", element.start, element.end);
+  const uint = (element) => {
+    requireVideo(element.end - element.start >= 1 && element.end - element.start <= 4);
+    return bytes.readUIntBE(element.start, element.end - element.start);
+  };
+  const top = elements(0, bytes.length);
+  requireVideo(top.length === 2 && top[0]?.id === "1a45dfa3");
+  const header = one(top, "1a45dfa3");
+  requireVideo(text(one(elements(header.start, header.end), "4282")) === "webm");
+  const segment = one(top, "18538067");
+  const contents = elements(segment.start, segment.end);
+  requireVideo(contents.some((element) => element.id === "1f43b675" && element.end > element.start));
+  const tracks = one(contents, "1654ae6b");
+  let videoTracks = 0;
+  for (const track of elements(tracks.start, tracks.end).filter((element) => element.id === "ae")) {
+    const fields = elements(track.start, track.end);
+    const type = uint(one(fields, "83"));
+    const codec = text(one(fields, "86"));
+    requireVideo(!fields.some((field2) => field2.id === "6d80" || field2.id === "6fab"));
+    if (type === 1) {
+      requireVideo(codec === "V_VP8" || codec === "V_VP9");
+      const video = one(fields, "e0");
+      const dimensions = elements(video.start, video.end);
+      const width = uint(one(dimensions, "b0"));
+      const height = uint(one(dimensions, "ba"));
+      requireVideo(width > 0 && height > 0 && width * height <= SESSION_FILE_MAX_VIDEO_PIXELS);
+      videoTracks++;
+    } else requireVideo(type === 2 && (codec === "A_VORBIS" || codec === "A_OPUS"));
+  }
+  requireVideo(videoTracks === 1);
+}
+
+// src/session-file.ts
 var SESSION_FILE_CONCURRENCY = 4;
 var SESSION_FILE_TIMEOUT_MS = 5e3;
 var compress = promisify(gzip);
@@ -1204,10 +1377,12 @@ var SessionFileReader = class {
   }
   metadata;
   #active = 0;
-  async read(sessionId, path, rootRevision) {
+  async read(sessionId, path, rootRevision, version = SESSION_FILE_READ_VERSION) {
+    if (version !== SESSION_FILE_READ_VERSION && version !== SESSION_FILE_READ_V2_VERSION) fail2("UNSUPPORTED_OPERATION_VERSION");
     if (!SessionFileReadDataSchema.safeParse({ path, rootRevision }).success) fail2("INVALID_FILE_PATH");
-    return SessionFileReadResultDataSchema.parse(await this.#run(
-      (checkDeadline) => this.#read(sessionId, path, rootRevision, checkDeadline, false)
+    const schema = version === SESSION_FILE_READ_V2_VERSION ? SessionFileReadV2ResultDataSchema : SessionFileReadResultDataSchema;
+    return schema.parse(await this.#run(
+      (checkDeadline) => this.#read(sessionId, path, rootRevision, checkDeadline, false, version)
     ));
   }
   async readResource(sessionId, path, rootRevision) {
@@ -1241,7 +1416,7 @@ var SessionFileReader = class {
       clearTimeout(timer);
     }
   }
-  async #read(sessionId, path, rootRevision, checkDeadline, resource) {
+  async #read(sessionId, path, rootRevision, checkDeadline, resource, version = SESSION_FILE_READ_VERSION) {
     const metadata = await this.metadata(sessionId);
     checkDeadline();
     if (metadata === void 0) fail2("SESSION_NOT_FOUND");
@@ -1283,11 +1458,12 @@ var SessionFileReader = class {
       return file;
     };
     const before = await inspectPath();
-    const maxOriginalBytes = resource ? SESSION_RESOURCE_MAX_ORIGINAL_BYTES : SESSION_FILE_MAX_ORIGINAL_BYTES;
+    const maxOriginalBytes = resource ? SESSION_RESOURCE_MAX_ORIGINAL_BYTES : version === SESSION_FILE_READ_V2_VERSION ? SESSION_FILE_V2_MAX_ORIGINAL_BYTES : SESSION_FILE_MAX_ORIGINAL_BYTES;
     if (before.size > BigInt(maxOriginalBytes)) fail2("FILE_TOO_LARGE");
     const extension = extname(path).toLowerCase();
     const image = [".png", ".jpg", ".jpeg", ".webp"].includes(extension);
-    const mediaType = resource ? resourceMediaType(extension) : image ? "image/webp" : textMediaType(path);
+    const video = !resource && version === SESSION_FILE_READ_V2_VERSION && [".mp4", ".webm"].includes(extension);
+    const mediaType = resource ? resourceMediaType(extension) : image ? "image/webp" : video ? extension === ".mp4" ? "video/mp4" : "video/webm" : textMediaType(path);
     const handle = await open(target, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0) | (constants2.O_NONBLOCK ?? 0));
     try {
       const opened = await handle.stat({ bigint: true });
@@ -1313,6 +1489,13 @@ var SessionFileReader = class {
           await validateRawImage(bytes, extension, checkDeadline);
           canonical = bytes;
         } else canonical = await imagePreview(bytes, extension, checkDeadline);
+      } else if (mediaType === "video/mp4" || mediaType === "video/webm") {
+        try {
+          validateSessionVideo(bytes, mediaType);
+        } catch (error) {
+          throw new SessionFileReadError("FILE_UNSUPPORTED", { cause: error });
+        }
+        canonical = bytes;
       } else {
         let text;
         try {
@@ -1345,7 +1528,7 @@ var SessionFileReader = class {
         throw new SessionFileReadError("FILE_CHANGED", { cause: error });
       }
       checkDeadline();
-      return (resource ? SessionResourceReadResultDataSchema : SessionFileReadResultDataSchema).parse({
+      return (resource ? SessionResourceReadResultDataSchema : version === SESSION_FILE_READ_V2_VERSION ? SessionFileReadV2ResultDataSchema : SessionFileReadResultDataSchema).parse({
         path,
         rootRevision,
         mediaType,
@@ -1784,20 +1967,20 @@ function sensitiveSegments(segments) {
   }
   return false;
 }
-var pathSchema = z4.string().max(4096).default("");
-var listSchema = z4.object({
+var pathSchema = z5.string().max(4096).default("");
+var listSchema = z5.object({
   path: pathSchema,
-  cursor: z4.string().uuid().optional()
+  cursor: z5.string().uuid().optional()
 }).strict();
-var readSchema = z4.object({
-  path: z4.string().min(1).max(4096),
-  startLine: z4.number().int().min(1).max(500001).default(1),
-  lineCount: z4.number().int().min(1).max(200).default(200)
+var readSchema = z5.object({
+  path: z5.string().min(1).max(4096),
+  startLine: z5.number().int().min(1).max(500001).default(1),
+  lineCount: z5.number().int().min(1).max(200).default(200)
 }).strict();
-var searchSchema = z4.object({
+var searchSchema = z5.object({
   path: pathSchema,
-  query: z4.string().min(1).max(256),
-  cursor: z4.string().uuid().optional()
+  query: z5.string().min(1).max(256),
+  cursor: z5.string().uuid().optional()
 }).strict();
 var ResearchTools = class {
   constructor(parentSessionId, root, sourceMetadata, privateDirectories = [], onError, captureSourceAccess) {
@@ -2057,7 +2240,7 @@ var ResearchTools = class {
     const definition = (name, description, schema, run) => ({
       name,
       description,
-      parameters: z4.toJSONSchema(schema),
+      parameters: z5.toJSONSchema(schema),
       // Only these host-owned read tools bypass prompts; their path policy remains mandatory.
       skipPermission: true,
       defer: "never",
@@ -2070,7 +2253,7 @@ var ResearchTools = class {
           return { textResultForLlm: JSON.stringify(result), resultType: "success" };
         } catch (error) {
           const knownCode = workbenchErrorDetails(error).code;
-          const code = (error instanceof ResearchError || error instanceof SessionFileReadError) && knownCode !== "UNCLASSIFIED" ? knownCode : error instanceof z4.ZodError ? "RESEARCH_INVALID_ARGUMENT" : "RESEARCH_TOOL_FAILED";
+          const code = (error instanceof ResearchError || error instanceof SessionFileReadError) && knownCode !== "UNCLASSIFIED" ? knownCode : error instanceof z5.ZodError ? "RESEARCH_INVALID_ARGUMENT" : "RESEARCH_TOOL_FAILED";
           this.onError?.(new ResearchError(code, "The research tool failed", { cause: error }), { stage: name });
           return { textResultForLlm: JSON.stringify({ error: code }), resultType: "failure" };
         }
@@ -2225,7 +2408,7 @@ import { io } from "socket.io-client";
 
 // src/service/requests/session-communication.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { join as join7 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 
@@ -3097,6 +3280,430 @@ var SessionGitDiffReader = class {
   }
 };
 
+// src/timeline-image-cache.ts
+import { createHash as createHash6 } from "node:crypto";
+var TimelineAssetError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+  code;
+};
+var TimelineImageCache = class {
+  constructor(maxBytes = 32 * 1024 * 1024) {
+    this.maxBytes = maxBytes;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < TIMELINE_IMAGE_MAX_BYTES) {
+      throw new Error("Image cache must hold at least one maximum-size image");
+    }
+  }
+  maxBytes;
+  #assets = /* @__PURE__ */ new Map();
+  #bytes = 0;
+  get bytes() {
+    return this.#bytes;
+  }
+  referenceItem(sessionId, item) {
+    if (!("attachments" in item) || item.attachments === void 0) return item;
+    return { ...item, attachments: item.attachments.map((attachment) => this.#reference(sessionId, attachment)) };
+  }
+  read(sessionId, request) {
+    const key = JSON.stringify([sessionId, request.sha256]);
+    const asset = this.#assets.get(key);
+    if (asset === void 0) throw new TimelineAssetError("IMAGE_ABSENT", "The image is no longer cached on this PC");
+    if (request.offset >= asset.bytes.length) {
+      throw new TimelineAssetError("IMAGE_OFFSET_INVALID", "The image chunk offset exceeds its length");
+    }
+    this.#assets.delete(key);
+    this.#assets.set(key, asset);
+    const end = Math.min(request.offset + TIMELINE_IMAGE_CHUNK_BYTES, asset.bytes.length);
+    return TimelineImageChunkSchema.parse({
+      sha256: request.sha256,
+      offset: request.offset,
+      totalBytes: asset.bytes.length,
+      mimeType: asset.mimeType,
+      data: asset.bytes.subarray(request.offset, end).toString("base64"),
+      eof: end === asset.bytes.length
+    });
+  }
+  readAsset(sessionId, sha256) {
+    const key = JSON.stringify([sessionId, sha256]);
+    const asset = this.#assets.get(key);
+    if (asset === void 0) throw new TimelineAssetError("IMAGE_ABSENT", "The image is no longer cached on this PC");
+    this.#assets.delete(key);
+    this.#assets.set(key, asset);
+    return { bytes: Buffer.from(asset.bytes), mimeType: asset.mimeType };
+  }
+  clearSession(sessionId) {
+    const prefix = JSON.stringify([sessionId]).slice(0, -1) + ",";
+    for (const [key, asset] of this.#assets) {
+      if (key.startsWith(prefix)) {
+        this.#assets.delete(key);
+        this.#bytes -= asset.bytes.length;
+      }
+    }
+  }
+  clear() {
+    this.#assets.clear();
+    this.#bytes = 0;
+  }
+  #reference(sessionId, attachment) {
+    if (attachment.kind !== "image" || attachment.data === void 0) return attachment;
+    const parsed = ConversationAttachmentSchema.parse(attachment);
+    const bytes = Buffer.from(attachment.data, "base64");
+    if (bytes.length !== parsed.byteLength || createHash6("sha256").update(bytes).digest("hex") !== parsed.sha256 || !hasSignature(bytes, parsed.mimeType)) {
+      throw new TimelineAssetError("IMAGE_INVALID", "Image content does not match its metadata");
+    }
+    const key = JSON.stringify([sessionId, parsed.sha256]);
+    const previous = this.#assets.get(key);
+    if (previous !== void 0) this.#bytes -= previous.bytes.length;
+    this.#assets.delete(key);
+    this.#assets.set(key, { bytes, mimeType: parsed.mimeType ?? "" });
+    this.#bytes += bytes.length;
+    while (this.#bytes > this.maxBytes) {
+      const oldest = this.#assets.entries().next().value;
+      if (oldest === void 0) break;
+      this.#assets.delete(oldest[0]);
+      this.#bytes -= oldest[1].bytes.length;
+    }
+    const { data: _data, ...metadata } = parsed;
+    return { ...metadata, imageRef: "sha256" };
+  }
+};
+function hasSignature(bytes, mimeType) {
+  switch (mimeType) {
+    case "image/png":
+      return bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+    case "image/jpeg":
+      return bytes.subarray(0, 3).equals(Buffer.from([255, 216, 255]));
+    case "image/gif":
+      return ["GIF87a", "GIF89a"].includes(bytes.subarray(0, 6).toString("ascii"));
+    case "image/webp":
+      return bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP";
+    default:
+      return false;
+  }
+}
+
+// src/session-image-uploader.ts
+import { createHash as createHash7 } from "node:crypto";
+import sharp2 from "sharp";
+import { z as z6 } from "zod";
+var MAX_ACTIVE_UPLOADS = 3;
+var MAX_JSON_BYTES = 16 * 1024;
+var REQUEST_TIMEOUT_MS = 2e4;
+var UPLOAD_TIMEOUT_MS = 7e4;
+var MAX_GRANT_LIFETIME_MS = 10 * 6e4 + 3e4;
+var UploaderConfigSchema = z6.object({
+  relayUrl: SessionImageRelayUrlSchema,
+  relayToken: z6.string().min(24).max(4096).regex(/^[\x21-\x7e]+$/u),
+  userId: IdSchema.refine((value) => /^[\x20-\x7e]+$/u.test(value)),
+  machineId: IdSchema,
+  storageAccount: SessionImagesConfigSchema.shape.storageAccount,
+  storageContainer: SessionImagesConfigSchema.shape.storageContainer
+});
+function safeCause(error) {
+  if (error instanceof SessionImageUploadError) return error;
+  if (error instanceof z6.ZodError) return new Error("Schema validation failed.");
+  const result = new Error("Image operation failed.");
+  if (error instanceof Error) {
+    if (["TypeError", "SyntaxError", "AbortError", "TimeoutError"].includes(error.name)) result.name = error.name;
+    const code = "code" in error ? error.code : void 0;
+    if (typeof code === "string" && ["ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"].includes(code)) {
+      result.cause = { code };
+    }
+  }
+  return result;
+}
+var SessionImageUploadError = class extends Error {
+  constructor(code, stage, status, cause) {
+    super(`${code} (${stage})`, cause === void 0 ? void 0 : { cause: safeCause(cause) });
+    this.code = code;
+    this.stage = stage;
+    this.status = status;
+    this.name = "SessionImageUploadError";
+  }
+  code;
+  stage;
+  status;
+};
+function digest(bytes) {
+  return createHash7("sha256").update(bytes).digest("hex");
+}
+function assert(condition, code, stage) {
+  if (!condition) throw new SessionImageUploadError(code, stage);
+}
+function parse(schema, input, stage) {
+  const result = schema.safeParse(input);
+  if (!result.success) throw new SessionImageUploadError(
+    stage === "config" ? "IMAGE_CONFIG_INVALID" : stage === "source" ? "IMAGE_CONTENT_INVALID" : "IMAGE_RESPONSE_INVALID",
+    stage,
+    void 0,
+    result.error
+  );
+  return result.data;
+}
+function abortable(operation, signal, stage) {
+  return new Promise((resolve5, reject) => {
+    const abort = () => reject(new SessionImageUploadError("IMAGE_ABORTED", stage));
+    if (signal.aborted) abort();
+    else signal.addEventListener("abort", abort, { once: true });
+    void operation.then((value) => {
+      signal.removeEventListener("abort", abort);
+      resolve5(value);
+    }, (error) => {
+      signal.removeEventListener("abort", abort);
+      reject(error);
+    });
+  });
+}
+var SessionImageUploader = class {
+  #config;
+  #fetch;
+  #active = /* @__PURE__ */ new Set();
+  #closed = false;
+  constructor(config, dependencies = {}) {
+    this.#config = parse(UploaderConfigSchema, config, "config");
+    this.#fetch = dependencies.fetch ?? globalThis.fetch;
+  }
+  close() {
+    this.#closed = true;
+    for (const controller of this.#active) controller.abort();
+  }
+  async upload(sessionId, source, signal, assertCurrent = () => void 0) {
+    assert(!this.#closed, "IMAGE_UPLOADER_CLOSED", "source");
+    assert(!signal?.aborted, "IMAGE_ABORTED", "source");
+    const revalidate = (stage) => {
+      try {
+        assertCurrent();
+      } catch (error) {
+        throw new SessionImageUploadError("IMAGE_ACCESS_REVOKED", stage, void 0, error);
+      }
+    };
+    revalidate("source");
+    assert(this.#active.size < MAX_ACTIVE_UPLOADS, "IMAGE_CAPACITY_EXCEEDED", "source");
+    assert(
+      Buffer.isBuffer(source) && source.length > 0 && source.length <= SESSION_IMAGE_MAX_BYTES,
+      "IMAGE_CONTENT_INVALID",
+      "source"
+    );
+    const scope = parse(SessionImageScopeSchema, { machineId: this.#config.machineId, sessionId }, "source");
+    const controller = new AbortController();
+    this.#active.add(controller);
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, UPLOAD_TIMEOUT_MS);
+    timer.unref();
+    try {
+      const bytes = Buffer.from(source);
+      const dimensions = await this.#dimensions(bytes);
+      const hash2 = digest(bytes);
+      const request = parse(SessionImageUploadRequestSchema, { ...scope, sizeBytes: bytes.length }, "source");
+      revalidate("reserve");
+      const upload = await this.#json(
+        `${SESSION_IMAGE_API_PATH}/uploads`,
+        request,
+        201,
+        SessionImageUploadResultSchema,
+        "reserve",
+        controller.signal
+      );
+      const target = this.#target(upload, scope.sessionId);
+      let ambiguous;
+      revalidate("put");
+      try {
+        await this.#request(target, {
+          method: "PUT",
+          headers: upload.mode === "direct" ? upload.headers : { ...this.#headers(), ...upload.headers },
+          body: new Uint8Array(bytes)
+        }, "put", controller.signal, async (response) => {
+          if (response.status !== 201) throw new SessionImageUploadError("IMAGE_HTTP_ERROR", "put", response.status);
+        });
+      } catch (error) {
+        if (!(error instanceof SessionImageUploadError) || controller.signal.aborted || !(error.code === "IMAGE_NETWORK_ERROR" || error.code === "IMAGE_TIMEOUT" || error.code === "IMAGE_HTTP_ERROR" && [409, 412].includes(error.status ?? 0))) throw error;
+        ambiguous = error;
+      }
+      revalidate("complete");
+      try {
+        const committed = await this.#json(
+          `${SESSION_IMAGE_API_PATH}/${upload.imageId}/complete`,
+          scope,
+          200,
+          SessionImageCommitResultSchema,
+          "complete",
+          controller.signal
+        );
+        assert(
+          committed.imageId === upload.imageId && committed.machineId === scope.machineId && committed.sessionId === scope.sessionId && committed.sha256 === hash2 && committed.sizeBytes === bytes.length && committed.width === dimensions.width && committed.height === dimensions.height && Number.isSafeInteger(committed.width) && Number.isSafeInteger(committed.height) && committed.width * committed.height <= SESSION_IMAGE_MAX_PIXELS && Number.isSafeInteger(committed.expiresAt) && committed.expiresAt > Date.now(),
+          "IMAGE_COMMIT_MISMATCH",
+          "complete"
+        );
+        revalidate("complete");
+        return committed;
+      } catch (error) {
+        if (ambiguous === void 0 || error instanceof SessionImageUploadError && error.code === "IMAGE_ACCESS_REVOKED") {
+          throw error;
+        }
+        const failure = new SessionImageUploadError("IMAGE_COMPLETION_FAILED", "complete", void 0, error);
+        failure.cause = new AggregateError([ambiguous, safeCause(error)], "PUT outcome and completion failed.");
+        throw failure;
+      }
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw new SessionImageUploadError(
+          timedOut ? "IMAGE_TIMEOUT" : "IMAGE_ABORTED",
+          error instanceof SessionImageUploadError ? error.stage : "source",
+          void 0,
+          error
+        );
+      }
+      if (error instanceof SessionImageUploadError) throw error;
+      throw new SessionImageUploadError("IMAGE_CONTENT_INVALID", "source", void 0, error);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      this.#active.delete(controller);
+    }
+  }
+  async #dimensions(bytes) {
+    assert(
+      bytes.length >= 20 && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP" && bytes.readUInt32LE(4) + 8 === bytes.length,
+      "IMAGE_CONTENT_INVALID",
+      "source"
+    );
+    const decoder = sharp2(bytes, { limitInputPixels: SESSION_IMAGE_MAX_PIXELS, failOn: "warning" });
+    try {
+      const metadata = await decoder.metadata();
+      assert(metadata.format === "webp" && metadata.width !== void 0 && metadata.height !== void 0 && metadata.width > 0 && metadata.height > 0 && (metadata.pages ?? 1) === 1 && metadata.width * metadata.height <= SESSION_IMAGE_MAX_PIXELS, "IMAGE_CONTENT_INVALID", "source");
+      return { width: metadata.width, height: metadata.height };
+    } finally {
+      decoder.destroy();
+    }
+  }
+  #headers() {
+    return { authorization: `Bearer ${this.#config.relayToken}`, "x-agentknight-user-id": this.#config.userId };
+  }
+  #target(upload, sessionId) {
+    const now = Date.now();
+    assert(Number.isSafeInteger(upload.uploadExpiresAt) && upload.uploadExpiresAt > now && upload.uploadExpiresAt <= now + MAX_GRANT_LIFETIME_MS, "IMAGE_UPLOAD_EXPIRED", "reserve");
+    assert(
+      upload.headers["content-type"] === "image/webp" && (upload.headers["if-none-match"] === void 0 || upload.headers["if-none-match"] === "*"),
+      "IMAGE_UPLOAD_TARGET_INVALID",
+      "reserve"
+    );
+    if (upload.mode === "proxy") {
+      const path2 = `${SESSION_IMAGE_API_PATH}/${upload.imageId}/content`;
+      const url2 = new URL(upload.uploadUrl, this.#config.relayUrl);
+      assert(
+        upload.uploadUrl.split("?")[0] === path2 && url2.origin === this.#config.relayUrl && [...url2.searchParams.keys()].length === 2 && url2.searchParams.getAll("machineId").length === 1 && url2.searchParams.get("machineId") === this.#config.machineId && url2.searchParams.getAll("sessionId").length === 1 && url2.searchParams.get("sessionId") === sessionId && upload.headers["x-ms-blob-type"] === void 0,
+        "IMAGE_UPLOAD_TARGET_INVALID",
+        "reserve"
+      );
+      return url2.href;
+    }
+    const { storageAccount, storageContainer, userId, machineId } = this.#config;
+    const host = `${storageAccount}.blob.core.windows.net`;
+    const path = `/${storageContainer}/uploads/${digest(userId)}/${digest(machineId)}/${upload.imageId}.webp`;
+    const url = new URL(upload.uploadUrl);
+    const query = url.searchParams;
+    const allowed = /* @__PURE__ */ new Set(["sv", "spr", "st", "se", "sr", "sp", "sig", "skoid", "sktid", "skt", "ske", "sks", "skv"]);
+    assert(
+      upload.uploadUrl.startsWith(`https://${host}${path}?`) && url.host === host && url.pathname === path && upload.headers["x-ms-blob-type"] === "BlockBlob" && [...query.keys()].every((key) => allowed.has(key) && query.getAll(key).length === 1) && [...allowed].every((key) => (query.get(key)?.length ?? 0) > 0) && query.get("sp") === "c" && query.get("sr") === "b" && query.get("spr") === "https" && query.get("sks") === "b",
+      "IMAGE_UPLOAD_TARGET_INVALID",
+      "reserve"
+    );
+    const expiresAt = Date.parse(query.get("se") ?? "");
+    const startsAt = Date.parse(query.get("st") ?? "");
+    const keyStartsAt = Date.parse(query.get("skt") ?? "");
+    const keyExpiresAt = Date.parse(query.get("ske") ?? "");
+    assert(
+      Number.isFinite(startsAt) && startsAt <= now + 3e4 && Number.isFinite(keyStartsAt) && keyStartsAt <= now + 3e4 && Number.isFinite(expiresAt) && expiresAt > now && expiresAt <= upload.uploadExpiresAt && Number.isFinite(keyExpiresAt) && keyExpiresAt >= expiresAt,
+      "IMAGE_UPLOAD_TARGET_INVALID",
+      "reserve"
+    );
+    return url.href;
+  }
+  async #json(path, body, status, schema, stage, signal) {
+    return this.#request(`${this.#config.relayUrl}${path}`, {
+      method: "POST",
+      headers: { ...this.#headers(), "content-type": "application/json" },
+      body: JSON.stringify(body)
+    }, stage, signal, async (response, requestSignal) => {
+      if (response.status !== status) throw new SessionImageUploadError("IMAGE_HTTP_ERROR", stage, response.status);
+      const contentLength = response.headers.get("content-length");
+      assert(
+        contentLength === null || /^\d+$/u.test(contentLength) && Number(contentLength) <= MAX_JSON_BYTES,
+        "IMAGE_RESPONSE_TOO_LARGE",
+        stage
+      );
+      assert(response.body !== null, "IMAGE_RESPONSE_INVALID", stage);
+      const reader = response.body.getReader();
+      const chunks = [];
+      let size = 0;
+      try {
+        while (true) {
+          const next = await abortable(reader.read(), requestSignal, stage);
+          requestSignal.throwIfAborted();
+          if (next.done) break;
+          size += next.value.byteLength;
+          assert(size <= MAX_JSON_BYTES, "IMAGE_RESPONSE_TOO_LARGE", stage);
+          chunks.push(next.value);
+        }
+        let value;
+        try {
+          value = JSON.parse(Buffer.concat(chunks, size).toString("utf8"));
+        } catch (error) {
+          throw new SessionImageUploadError("IMAGE_RESPONSE_INVALID", stage, void 0, error);
+        }
+        return parse(schema, value, stage);
+      } finally {
+        reader.releaseLock();
+      }
+    });
+  }
+  async #request(url, init, stage, signal, consume) {
+    assert(!signal.aborted, "IMAGE_ABORTED", stage);
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal.addEventListener("abort", abort, { once: true });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, REQUEST_TIMEOUT_MS);
+    timer.unref();
+    try {
+      const response = await this.#fetch(url, {
+        ...init,
+        signal: controller.signal,
+        redirect: "error",
+        credentials: "omit",
+        cache: "no-store",
+        referrerPolicy: "no-referrer"
+      });
+      try {
+        controller.signal.throwIfAborted();
+        assert(!response.redirected, "IMAGE_RESPONSE_INVALID", stage);
+        return await consume(response, controller.signal);
+      } finally {
+        await response.body?.cancel();
+      }
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw new SessionImageUploadError(timedOut ? "IMAGE_TIMEOUT" : "IMAGE_ABORTED", stage, void 0, error);
+      }
+      if (error instanceof SessionImageUploadError) throw error;
+      throw new SessionImageUploadError("IMAGE_NETWORK_ERROR", stage, void 0, error);
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", abort);
+    }
+  }
+};
+
 // src/service/requests/request-errors.ts
 function operationErrorCode(agentId, operation, error) {
   if (isSessionRestoreFailure(error)) return "SESSION_RESTORE_FAILED";
@@ -3113,7 +3720,7 @@ function unsupportedOperation(error) {
 // src/service/requests/communication-operations.ts
 var compress2 = promisify2(gzip3);
 function createCommunicationOperations(options) {
-  const { adapter, publications } = options;
+  const { adapter, publications, imageBlob } = options;
   const directoryLister = new SessionDirectoryLister(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId));
   const fileReader = new SessionFileReader(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId));
   const gitDiffReader = new SessionGitDiffReader(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId), options.gitDiffDirectory);
@@ -3122,6 +3729,24 @@ function createCommunicationOperations(options) {
   const renameSession = adapter.renameSession?.bind(adapter);
   return [
     ...options.workbenchOperations,
+    ...imageBlob === void 0 ? [] : [
+      sessionCommunicationOperation({
+        operation: TIMELINE_IMAGE_BLOB_OPERATION,
+        version: TIMELINE_IMAGE_BLOB_VERSION,
+        schema: TimelineImageBlobRequestSchema,
+        handle: async ({ sha256 }, request) => {
+          const assertCurrent = options.captureRequestAccess();
+          assertCurrent();
+          const result = await imageBlob.publish(request.sessionId, sha256, assertCurrent);
+          assertCurrent();
+          return SessionCommunicationDataSchema.parse(result);
+        },
+        onError: (error) => ({
+          code: error instanceof TimelineAssetError || error instanceof SessionImageUploadError || error instanceof SessionNotSharedError || error instanceof AgentSessionRenameError ? error.code : "IMAGE_BLOB_FAILED",
+          message: "The cloud image is unavailable"
+        })
+      })
+    ],
     ...renameSession === void 0 ? [] : [
       sessionCommunicationOperation({
         operation: SESSION_RENAME_OPERATION,
@@ -3198,16 +3823,16 @@ function createCommunicationOperations(options) {
         }),
         onError: (error) => unsupportedOperation(error) ?? (error instanceof SessionDirectoryError ? { code: error.code, message: error.message } : { code: "DIRECTORY_UNAVAILABLE", message: "The directory is unavailable" })
       }),
-      sessionCommunicationOperation({
+      ...[SESSION_FILE_READ_VERSION, SESSION_FILE_READ_V2_VERSION].map((version) => sessionCommunicationOperation({
         operation: SESSION_FILE_READ_OPERATION,
-        version: SESSION_FILE_READ_VERSION,
+        version,
         schema: SessionFileReadDataSchema,
-        handle: ({ path, rootRevision }, request) => fileReader.read(request.sessionId, path, rootRevision),
+        handle: ({ path, rootRevision }, request) => fileReader.read(request.sessionId, path, rootRevision, version),
         onError: (error) => unsupportedOperation(error) ?? {
           code: error instanceof SessionFileReadError ? error.code : "FILE_UNAVAILABLE",
           message: "The file preview is unavailable"
         }
-      }),
+      })),
       sessionCommunicationOperation({
         operation: SESSION_RESOURCE_READ_OPERATION,
         version: SESSION_RESOURCE_READ_VERSION,
@@ -3269,6 +3894,7 @@ var SessionCommunicationHandler = class {
         return assertCurrent;
       },
       incrementalOperations: options.incrementalOperations.filter((operation) => config.timelineIncrementalEnabled !== false || operation.operation === TIMELINE_IMAGE_OPERATION),
+      ...options.imageBlob === void 0 ? {} : { imageBlob: options.imageBlob },
       workbenchOperations: this.#operations === void 0 ? [] : createWorkbenchOperations({
         ...workbench === void 0 ? {} : { runtime: workbench },
         ...researchWorkbench === void 0 ? {} : { research: researchWorkbench },
@@ -3437,7 +4063,7 @@ var SessionCommunicationHandler = class {
     }
     const clientId = scope.clientId;
     const owner = [config.userId, machineId, clientId, request.sessionId];
-    const key = (parts) => createHash6("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
+    const key = (parts) => createHash8("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
     const knownSource = this.#researchParents.get(request.sessionId) ?? adapter.sessionPublicationSource?.(request.sessionId) ?? request.sessionId;
     const arrivalPublication = adapter.isSessionVisible?.(knownSource) === true ? publications.capture(knownSource) : void 0;
     let researchParent = this.#researchParents.get(request.sessionId);
@@ -3470,7 +4096,7 @@ var SessionCommunicationHandler = class {
     }
     if (researchParent !== void 0) {
       if (lifecycle !== void 0) lifecycle.preflightPhase = "isolation";
-      const unifiedSync = research?.chat !== void 0 && this.options.supportsResearchChat?.(clientId) === true && (request.operation === TIMELINE_SYNC_OPERATION || request.operation === TIMELINE_IMAGE_OPERATION);
+      const unifiedSync = research?.chat !== void 0 && this.options.supportsResearchChat?.(clientId) === true && (request.operation === TIMELINE_SYNC_OPERATION || request.operation === TIMELINE_IMAGE_OPERATION || request.operation === TIMELINE_IMAGE_BLOB_OPERATION);
       if (!unifiedSync && !["research.timeline", "research.send", "research.abort", "research.delete", "operation.get", "insights.read"].includes(request.operation)) {
         reject("research-isolated");
         emit("session.communication", sessionCommunicationError(request, {
@@ -3617,7 +4243,7 @@ var SessionCommunicationHandler = class {
 };
 
 // src/desktop-workspaces.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { readdir, realpath as realpath5, stat as stat6 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { basename as basename2, join as join8, normalize } from "node:path";
@@ -3633,7 +4259,7 @@ function desktopRootCandidates(environment2 = process.env) {
 }
 function workspaceId(path) {
   const normalizedPath = workspacePathKey(path);
-  return createHash7("sha256").update(normalizedPath).digest("base64url").slice(0, 32);
+  return createHash9("sha256").update(normalizedPath).digest("base64url").slice(0, 32);
 }
 function workspacePathKey(path) {
   const normalizedPath = normalize(path);
@@ -4395,9 +5021,9 @@ var SessionCommandsHandler = class {
 };
 
 // src/service/requests/session-prompt.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function promptOperationFingerprint(request) {
-  return createHash8("sha256").update(request.sessionId).update("\0").update(request.mode).update("\0").update(request.prompt).update("\0").update(request.attachments?.map((attachment) => attachment.sha256).join(",") ?? "").update("\0").update(JSON.stringify(request.fileAttachments?.map(({ name, mimeType, sha256 }) => ({
+  return createHash10("sha256").update(request.sessionId).update("\0").update(request.mode).update("\0").update(request.prompt).update("\0").update(request.attachments?.map((attachment) => attachment.sha256).join(",") ?? "").update("\0").update(JSON.stringify(request.fileAttachments?.map(({ name, mimeType, sha256 }) => ({
     name,
     mimeType,
     sha256
@@ -4643,8 +5269,8 @@ import { randomUUID as randomUUID5 } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
 import { Role, TaskState } from "@a2a-js/sdk";
 import { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } from "@a2a-js/sdk/client";
-import { z as z5 } from "zod";
-var TextSchema = z5.string().max(16e3).refine((text) => text.trim().length > 0);
+import { z as z7 } from "zod";
+var TextSchema = z7.string().max(16e3).refine((text) => text.trim().length > 0);
 var HTTP_TIMEOUT_MS = 1e4;
 var MAX_RESPONSE_BYTES = 262144;
 function relayEndpoint(relayUrl, target) {
@@ -4803,7 +5429,7 @@ var A2aPeerClient = class {
 };
 
 // src/a2a-server.ts
-import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash11, randomUUID as randomUUID6 } from "node:crypto";
 import {
   AgentCard,
   Role as Role2,
@@ -4829,7 +5455,7 @@ import {
   ServerCallContext,
   validateVersion
 } from "@a2a-js/sdk/server";
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 var MAX_ACTIVE = 4;
 var MAX_TASKS = 128;
 var MAX_RECEIPTS = 256;
@@ -4838,52 +5464,52 @@ var TURN_TIMEOUT_MS = 12e4;
 var SHORT_REQUEST_TIMEOUT_MS = 9e3;
 var MAX_TEXT2 = 16e3;
 var TASK_WIRE_BUDGET = 6e4;
-var idSchema = z6.string().min(1).max(256).regex(/^[^\s\u0000-\u001f\u007f]+$/u);
-var optionalIdSchema = z6.union([z6.literal(""), idSchema]).optional();
-var historySchema = z6.number().int().min(0).max(128).optional();
-var emptyMetadataSchema = z6.object({}).strict().optional();
-var tenantSchema = z6.literal("").optional();
-var rpcSchema = z6.object({
-  jsonrpc: z6.literal("2.0"),
-  id: z6.union([idSchema, z6.number().int().safe(), z6.null()]),
-  method: z6.string().min(1).max(128),
-  params: z6.unknown()
+var idSchema = z8.string().min(1).max(256).regex(/^[^\s\u0000-\u001f\u007f]+$/u);
+var optionalIdSchema = z8.union([z8.literal(""), idSchema]).optional();
+var historySchema = z8.number().int().min(0).max(128).optional();
+var emptyMetadataSchema = z8.object({}).strict().optional();
+var tenantSchema = z8.literal("").optional();
+var rpcSchema = z8.object({
+  jsonrpc: z8.literal("2.0"),
+  id: z8.union([idSchema, z8.number().int().safe(), z8.null()]),
+  method: z8.string().min(1).max(128),
+  params: z8.unknown()
 }).strict();
-var sendSchema = z6.object({
+var sendSchema = z8.object({
   tenant: tenantSchema,
-  message: z6.object({
+  message: z8.object({
     messageId: idSchema,
     contextId: optionalIdSchema,
     taskId: optionalIdSchema,
-    role: z6.union([z6.literal("ROLE_USER"), z6.literal(Role2.ROLE_USER)]),
-    parts: z6.array(z6.object({
-      text: z6.string().max(MAX_TEXT2),
-      mediaType: z6.union([z6.literal(""), z6.literal("text/plain")]).optional(),
-      filename: z6.literal("").optional(),
+    role: z8.union([z8.literal("ROLE_USER"), z8.literal(Role2.ROLE_USER)]),
+    parts: z8.array(z8.object({
+      text: z8.string().max(MAX_TEXT2),
+      mediaType: z8.union([z8.literal(""), z8.literal("text/plain")]).optional(),
+      filename: z8.literal("").optional(),
       metadata: emptyMetadataSchema
     }).strict()).min(1).max(32),
     metadata: emptyMetadataSchema,
-    extensions: z6.array(z6.never()).optional(),
-    referenceTaskIds: z6.array(z6.never()).optional()
+    extensions: z8.array(z8.never()).optional(),
+    referenceTaskIds: z8.array(z8.never()).optional()
   }).strict().refine((message) => {
     const text = message.parts.map((part) => part.text).join("\n");
     return text.trim().length > 0 && text.length <= MAX_TEXT2;
   }, "A message must contain nonempty plain text of at most 16000 characters."),
-  configuration: z6.object({
-    acceptedOutputModes: z6.array(z6.literal("text/plain")).max(1).optional(),
-    returnImmediately: z6.boolean().optional(),
+  configuration: z8.object({
+    acceptedOutputModes: z8.array(z8.literal("text/plain")).max(1).optional(),
+    returnImmediately: z8.boolean().optional(),
     historyLength: historySchema
   }).strict().optional(),
   metadata: emptyMetadataSchema
 }).strict();
-var getSchema = z6.object({ tenant: tenantSchema, id: idSchema, historyLength: historySchema }).strict();
-var cancelSchema = z6.object({ tenant: tenantSchema, id: idSchema, metadata: emptyMetadataSchema }).strict();
-var listSchema2 = z6.object({
+var getSchema = z8.object({ tenant: tenantSchema, id: idSchema, historyLength: historySchema }).strict();
+var cancelSchema = z8.object({ tenant: tenantSchema, id: idSchema, metadata: emptyMetadataSchema }).strict();
+var listSchema2 = z8.object({
   tenant: tenantSchema,
   contextId: optionalIdSchema,
-  status: z6.union([
-    z6.number().int().min(0).max(8),
-    z6.enum([
+  status: z8.union([
+    z8.number().int().min(0).max(8),
+    z8.enum([
       "TASK_STATE_UNSPECIFIED",
       "TASK_STATE_SUBMITTED",
       "TASK_STATE_WORKING",
@@ -4895,11 +5521,11 @@ var listSchema2 = z6.object({
       "TASK_STATE_AUTH_REQUIRED"
     ])
   ]).optional(),
-  pageSize: z6.number().int().min(1).max(100).optional(),
-  pageToken: z6.string().regex(/^(?:|0|[1-9]\d{0,3})$/u).optional(),
+  pageSize: z8.number().int().min(1).max(100).optional(),
+  pageToken: z8.string().regex(/^(?:|0|[1-9]\d{0,3})$/u).optional(),
   historyLength: historySchema,
-  statusTimestampAfter: z6.iso.datetime({ offset: true }).optional(),
-  includeArtifacts: z6.boolean().optional()
+  statusTimestampAfter: z8.iso.datetime({ offset: true }).optional(),
+  includeArtifacts: z8.boolean().optional()
 }).strict();
 function deferred() {
   let resolve5 = () => {
@@ -5105,7 +5731,7 @@ var A2aPeerServer = class {
     if (message === void 0) throw new RequestMalformedError("A message is required.");
     const scope = scopedOwner(context);
     const key = JSON.stringify([scope, message.messageId]);
-    const fingerprint = createHash9("sha256").update(JSON.stringify(SendMessageRequest.toJSON(params))).digest("hex");
+    const fingerprint = createHash11("sha256").update(JSON.stringify(SendMessageRequest.toJSON(params))).digest("hex");
     const previous = this.#receipts.get(key);
     if (previous !== void 0) {
       if (previous.fingerprint !== fingerprint) throw new RequestMalformedError("messageId was already used with different content.");
@@ -5980,7 +6606,7 @@ var SessionInventory = class {
 };
 
 // src/snapshot-audience.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 var SnapshotAudience = class {
   constructor(send) {
     this.send = send;
@@ -6009,9 +6635,9 @@ var SnapshotAudience = class {
   async publish(snapshot, recipient) {
     const generation = this.#generation;
     const { sequence: _sequence, generatedAt: _generatedAt, ...content } = snapshot;
-    const digest = createHash10("sha256").update(JSON.stringify(content)).digest("base64url");
+    const digest2 = createHash12("sha256").update(JSON.stringify(content)).digest("base64url");
     if (recipient !== void 0) {
-      await this.#direct(snapshot, recipient, digest, generation);
+      await this.#direct(snapshot, recipient, digest2, generation);
       return;
     }
     if (!this.#negotiated || this.#registrationBaseline) {
@@ -6023,10 +6649,10 @@ var SnapshotAudience = class {
     }
     const pending = [];
     for (const [clientId, baseline] of this.#audiences) {
-      if (baseline.digest === digest) {
+      if (baseline.digest === digest2) {
         this.#metrics.unchangedRecipients += 1;
       } else {
-        pending.push(this.#direct(snapshot, clientId, digest, generation));
+        pending.push(this.#direct(snapshot, clientId, digest2, generation));
       }
     }
     if (this.#audiences.size === 0) this.#metrics.withoutRecipients += 1;
@@ -6039,12 +6665,12 @@ var SnapshotAudience = class {
     this.#metrics = this.#emptyMetrics();
     return metrics;
   }
-  async #direct(snapshot, recipient, digest, generation) {
+  async #direct(snapshot, recipient, digest2, generation) {
     const baseline = this.#audiences.get(recipient);
     this.#metrics.directedAttempts += 1;
     await this.send(snapshot, recipient);
     if (generation === this.#generation && baseline !== void 0 && this.#audiences.get(recipient) === baseline) {
-      baseline.digest = digest;
+      baseline.digest = digest2;
     }
   }
   #emptyMetrics() {
@@ -6141,106 +6767,8 @@ var ConversationAudience = class {
 };
 
 // src/timeline-incremental-transport.ts
-import { createHash as createHash12, randomUUID as randomUUID8 } from "node:crypto";
+import { createHash as createHash13, randomUUID as randomUUID8 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-
-// src/timeline-image-cache.ts
-import { createHash as createHash11 } from "node:crypto";
-var TimelineAssetError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-  code;
-};
-var TimelineImageCache = class {
-  constructor(maxBytes = 32 * 1024 * 1024) {
-    this.maxBytes = maxBytes;
-    if (!Number.isSafeInteger(maxBytes) || maxBytes < TIMELINE_IMAGE_MAX_BYTES) {
-      throw new Error("Image cache must hold at least one maximum-size image");
-    }
-  }
-  maxBytes;
-  #assets = /* @__PURE__ */ new Map();
-  #bytes = 0;
-  get bytes() {
-    return this.#bytes;
-  }
-  referenceItem(sessionId, item) {
-    if (!("attachments" in item) || item.attachments === void 0) return item;
-    return { ...item, attachments: item.attachments.map((attachment) => this.#reference(sessionId, attachment)) };
-  }
-  read(sessionId, request) {
-    const key = JSON.stringify([sessionId, request.sha256]);
-    const asset = this.#assets.get(key);
-    if (asset === void 0) throw new TimelineAssetError("IMAGE_ABSENT", "The image is no longer cached on this PC");
-    if (request.offset >= asset.bytes.length) {
-      throw new TimelineAssetError("IMAGE_OFFSET_INVALID", "The image chunk offset exceeds its length");
-    }
-    this.#assets.delete(key);
-    this.#assets.set(key, asset);
-    const end = Math.min(request.offset + TIMELINE_IMAGE_CHUNK_BYTES, asset.bytes.length);
-    return TimelineImageChunkSchema.parse({
-      sha256: request.sha256,
-      offset: request.offset,
-      totalBytes: asset.bytes.length,
-      mimeType: asset.mimeType,
-      data: asset.bytes.subarray(request.offset, end).toString("base64"),
-      eof: end === asset.bytes.length
-    });
-  }
-  clearSession(sessionId) {
-    const prefix = JSON.stringify([sessionId]).slice(0, -1) + ",";
-    for (const [key, asset] of this.#assets) {
-      if (key.startsWith(prefix)) {
-        this.#assets.delete(key);
-        this.#bytes -= asset.bytes.length;
-      }
-    }
-  }
-  clear() {
-    this.#assets.clear();
-    this.#bytes = 0;
-  }
-  #reference(sessionId, attachment) {
-    if (attachment.kind !== "image" || attachment.data === void 0) return attachment;
-    const parsed = ConversationAttachmentSchema.parse(attachment);
-    const bytes = Buffer.from(attachment.data, "base64");
-    if (bytes.length !== parsed.byteLength || createHash11("sha256").update(bytes).digest("hex") !== parsed.sha256 || !hasSignature(bytes, parsed.mimeType)) {
-      throw new TimelineAssetError("IMAGE_INVALID", "Image content does not match its metadata");
-    }
-    const key = JSON.stringify([sessionId, parsed.sha256]);
-    const previous = this.#assets.get(key);
-    if (previous !== void 0) this.#bytes -= previous.bytes.length;
-    this.#assets.delete(key);
-    this.#assets.set(key, { bytes, mimeType: parsed.mimeType ?? "" });
-    this.#bytes += bytes.length;
-    while (this.#bytes > this.maxBytes) {
-      const oldest = this.#assets.entries().next().value;
-      if (oldest === void 0) break;
-      this.#assets.delete(oldest[0]);
-      this.#bytes -= oldest[1].bytes.length;
-    }
-    const { data: _data, ...metadata } = parsed;
-    return { ...metadata, imageRef: "sha256" };
-  }
-};
-function hasSignature(bytes, mimeType) {
-  switch (mimeType) {
-    case "image/png":
-      return bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
-    case "image/jpeg":
-      return bytes.subarray(0, 3).equals(Buffer.from([255, 216, 255]));
-    case "image/gif":
-      return ["GIF87a", "GIF89a"].includes(bytes.subarray(0, 6).toString("ascii"));
-    case "image/webp":
-      return bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP";
-    default:
-      return false;
-  }
-}
-
-// src/timeline-incremental-transport.ts
 function journalDiagnostic(state) {
   return {
     currentSequence: state.sequence,
@@ -6373,7 +6901,7 @@ var TimelineIncrementalTransport = class {
   }
   #observeColdStep(state, upsert) {
     const cold = state.coldSteps;
-    const key = createHash12("sha256").update(JSON.stringify([upsert.activityId, upsert.step.id])).digest("hex");
+    const key = createHash13("sha256").update(JSON.stringify([upsert.activityId, upsert.step.id])).digest("hex");
     const revision = cold.revisions.get(key);
     if (revision !== void 0 && upsert.revision < revision) return false;
     cold.revisions.delete(key);
@@ -6383,7 +6911,7 @@ var TimelineIncrementalTransport = class {
       if (oldest === void 0) break;
       cold.revisions.delete(oldest);
     }
-    const fingerprint = createHash12("sha256").update(JSON.stringify(upsert)).digest("hex");
+    const fingerprint = createHash13("sha256").update(JSON.stringify(upsert)).digest("hex");
     const observed = cold.fingerprints.has(fingerprint);
     cold.fingerprints.delete(fingerprint);
     cold.fingerprints.add(fingerprint);
@@ -6664,6 +7192,104 @@ function canAppend(previous, item) {
   return isDeepStrictEqual(oldMetadata, newMetadata);
 }
 
+// src/timeline-image-blob.ts
+import { createHash as createHash14 } from "node:crypto";
+import sharp3 from "sharp";
+var TimelineImageBlobPublisher = class {
+  constructor(images, uploader) {
+    this.images = images;
+    this.uploader = uploader;
+  }
+  images;
+  uploader;
+  #references = /* @__PURE__ */ new Map();
+  #flights = /* @__PURE__ */ new Map();
+  #closed = false;
+  async publish(sessionId, sha256, assertCurrent) {
+    TimelineImageBlobRequestSchema.parse({ sha256 });
+    assertCurrent();
+    if (this.#closed) throw new TimelineAssetError("IMAGE_BLOB_CLOSED", "The image publisher is closed");
+    const key = JSON.stringify([sessionId, sha256]);
+    const cached = this.#references.get(key);
+    if (cached !== void 0) {
+      this.#references.delete(key);
+      if (cached.image.expiresAt > Date.now() + 3e4) {
+        this.#references.set(key, cached);
+        return cached;
+      }
+    }
+    let flight = this.#flights.get(key);
+    if (flight === void 0) {
+      if (this.#flights.size >= 3) throw new TimelineAssetError("IMAGE_BLOB_BUSY", "Too many image uploads");
+      const controller = new AbortController();
+      const check = () => {
+        controller.signal.throwIfAborted();
+        assertCurrent();
+      };
+      const promise = this.#publish(sessionId, sha256, controller.signal, check).then((result2) => {
+        check();
+        this.#references.set(key, result2);
+        while (this.#references.size > 256) {
+          const oldest = this.#references.keys().next().value;
+          if (oldest === void 0) break;
+          this.#references.delete(oldest);
+        }
+        return result2;
+      }).finally(() => {
+        this.#flights.delete(key);
+      });
+      flight = { sessionId, controller, promise };
+      this.#flights.set(key, flight);
+    }
+    const result = await flight.promise;
+    assertCurrent();
+    return result;
+  }
+  clearSession(sessionId) {
+    for (const [key, reference] of this.#references) {
+      if (reference.image.sessionId === sessionId) this.#references.delete(key);
+    }
+    for (const flight of this.#flights.values()) {
+      if (flight.sessionId === sessionId) flight.controller.abort();
+    }
+  }
+  reset() {
+    this.#references.clear();
+    for (const flight of this.#flights.values()) flight.controller.abort();
+  }
+  async close() {
+    this.#closed = true;
+    this.reset();
+    await Promise.allSettled([...this.#flights.values()].map((flight) => flight.promise));
+  }
+  async #publish(sessionId, sha256, signal, check) {
+    const asset = this.images.readAsset(sessionId, sha256);
+    const extension = { "image/png": ".png", "image/jpeg": ".jpg", "image/webp": ".webp" }[asset.mimeType];
+    if (extension === void 0) throw new TimelineAssetError("IMAGE_BLOB_UNSUPPORTED", "This image requires encrypted transfer");
+    if (createHash14("sha256").update(asset.bytes).digest("hex") !== sha256) {
+      throw new TimelineAssetError("IMAGE_INVALID", "Image content does not match its reference");
+    }
+    let bytes;
+    try {
+      await validateRawImage(asset.bytes, extension, check);
+      bytes = extension === ".webp" ? asset.bytes : await sharp3(asset.bytes, { limitInputPixels: SESSION_IMAGE_MAX_PIXELS, failOn: "warning" }).rotate().webp({ lossless: true, effort: 3 }).timeout({ seconds: 10 }).toBuffer();
+    } catch (error) {
+      check();
+      if (error instanceof SessionFileReadError) {
+        throw new TimelineAssetError("IMAGE_BLOB_UNSUPPORTED", "The image cannot be safely stored as WebP", { cause: error });
+      }
+      throw new TimelineAssetError("IMAGE_BLOB_ENCODING_FAILED", "Unable to encode the image for storage", { cause: error });
+    }
+    check();
+    if (bytes.length > SESSION_IMAGE_MAX_BYTES) {
+      throw new TimelineAssetError("IMAGE_BLOB_TOO_LARGE", "The lossless WebP exceeds the image storage limit");
+    }
+    const image = await this.uploader.upload(sessionId, bytes, signal, check);
+    check();
+    return TimelineImageBlobResultSchema.parse({ sha256, image });
+  }
+};
+
 // src/secure-traffic-metrics.ts
 var SecureTrafficMetrics = class {
   #samples = /* @__PURE__ */ new Map();
@@ -7208,6 +7834,14 @@ var PcAgent = class {
     this.#timelineIncremental = new TimelineIncrementalTransport({
       readHead: (sessionId) => this.adapter.readSessionTimelinePage(sessionId, { pageSize: 100 })
     });
+    const imageSettings = config.sessionImages === void 0 ? void 0 : SessionImagesConfigSchema.parse(config.sessionImages);
+    this.#imageBlob = imageSettings === void 0 ? void 0 : new TimelineImageBlobPublisher(this.#timelineIncremental.images, new SessionImageUploader({
+      relayUrl: config.relayUrl,
+      relayToken: config.relayToken,
+      userId: config.userId,
+      machineId: identity2.machineId,
+      ...imageSettings
+    }));
     const emit = (event, payload) => this.#emitSecure(event, payload);
     const handlerOptions = { adapter, config, machineId: identity2.machineId, logger, emit };
     this.#communication = new SessionCommunicationHandler({
@@ -7218,6 +7852,7 @@ var PcAgent = class {
       audience: this.#conversationAudience,
       metrics: this.#operationMetrics,
       incrementalOperations: this.#timelineIncremental.operations,
+      ...this.#imageBlob === void 0 ? {} : { imageBlob: this.#imageBlob },
       captureResearchAccess: (sessionId) => captureResearchAccess(adapter, sessionId),
       captureWorkbenchAccess: (sessionId) => captureWorkbenchAccess(adapter, sessionId),
       ...research === void 0 ? {} : { research },
@@ -7244,6 +7879,7 @@ var PcAgent = class {
       supportsAgentControls: (clientId) => this.#supportsAgentControls(clientId),
       refreshSessions: (clientId) => this.#inventoryPublisher.request(clientId, true),
       removeSession: (sessionId) => {
+        this.#imageBlob?.clearSession(sessionId);
         this.#timelineIncremental.remove(sessionId);
         this.#conversationAudience.removeSession(sessionId);
         this.#publication.revoke(sessionId);
@@ -7424,6 +8060,7 @@ var PcAgent = class {
       },
       onTimelineInvalidated: (sessionId, invalidation) => {
         if (this.adapter.isSessionVisible?.(sessionId) === false) return;
+        this.#imageBlob?.clearSession(sessionId);
         this.#publication.capture(sessionId);
         const envelope = SessionTimelineInvalidatedSchema.parse({
           userId: this.config.userId,
@@ -7573,6 +8210,7 @@ var PcAgent = class {
   #readMetrics = { readStarts: 0, readJoins: 0, untrackedReads: 0, peakInFlightPerSession: 0 };
   #conversationAudience = new ConversationAudience();
   #timelineIncremental;
+  #imageBlob;
   #pendingAcks = /* @__PURE__ */ new Set();
   #connectionGeneration = 0;
   #heartbeatTimer;
@@ -7833,6 +8471,7 @@ var PcAgent = class {
       return this.#stopped;
     }
     this.#stopping = true;
+    const imagesStopped = this.#imageBlob?.close();
     const peerStopped = this.#peerChat.close();
     const a2aStopped = this.#a2aServer.close();
     this.#machineRegistered = false;
@@ -7859,6 +8498,7 @@ var PcAgent = class {
         this.adapter.stop(),
         peerStopped,
         a2aStopped,
+        ...imagesStopped === void 0 ? [] : [imagesStopped],
         ...this.research === void 0 ? [] : [this.research.stop()]
       ]);
       const operationsStopped = await Promise.allSettled(
@@ -7915,6 +8555,7 @@ var PcAgent = class {
       this.#peerTransportNegotiated = false;
       this.#a2aNegotiated = false;
       this.#peerChat.reset(new Error("Relay disconnected; peer conversation will not be replayed."));
+      this.#imageBlob?.reset();
       this.#a2aServer.reset(new Error("Relay disconnected; A2A execution will not be replayed."));
       this.#conversationAudience.reset();
       this.#cancelSnapshotSync();
@@ -8206,6 +8847,7 @@ var PcAgent = class {
     if (this.adapter.isSessionVisible === void 0) return;
     let removed = 0;
     for (const id of this.#publication.revokeHidden()) {
+      this.#imageBlob?.clearSession(id);
       this.#timelineIncremental.remove(id);
       this.#conversationAudience.removeSession(id);
       removed += 1;
@@ -8699,46 +9341,46 @@ function contextItem(item) {
 
 // src/research-sessions.ts
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash13, randomUUID as randomUUID12 } from "node:crypto";
+import { createHash as createHash15, randomUUID as randomUUID12 } from "node:crypto";
 import { mkdir as mkdir5, lstat as lstat8, realpath as realpath8 } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { join as join12, resolve as resolve4 } from "node:path";
 import { promisify as promisify4 } from "node:util";
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 
 // src/research-thread-store.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { mkdir as mkdir4, readFile as readFile2, rename as rename2, rm as rm2, lstat as lstat6, realpath as realpath7, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join10, resolve as resolve3 } from "node:path";
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 var RESEARCH_PROFILE = "research-readonly";
 var RESEARCH_PROFILE_VERSION = 1;
 var MAX_THREADS = 256;
-var recordSchema = z7.object({
-  threadId: z7.string().uuid(),
-  researchSessionId: z7.string().uuid(),
-  parentSessionId: z7.string().min(1).max(256),
-  operationId: z7.string().min(1).max(256),
-  fingerprint: z7.string().min(1).max(128),
-  title: z7.string().min(1).max(200),
-  profile: z7.literal(RESEARCH_PROFILE),
-  profileVersion: z7.literal(RESEARCH_PROFILE_VERSION),
-  workingDirectory: z7.string().min(1).max(8192),
-  rootIdentity: z7.string().min(1).max(128),
-  contextAnchor: z7.string().min(1).max(256),
-  contextSampledAt: z7.string().datetime(),
-  contextTruncated: z7.boolean(),
-  chatVersion: z7.literal(1).optional(),
-  createdAt: z7.string().datetime(),
-  state: z7.enum(["creating", "ready", "uncertain", "failed", "deleting"]),
-  errorCode: z7.string().max(128).optional()
+var recordSchema = z9.object({
+  threadId: z9.string().uuid(),
+  researchSessionId: z9.string().uuid(),
+  parentSessionId: z9.string().min(1).max(256),
+  operationId: z9.string().min(1).max(256),
+  fingerprint: z9.string().min(1).max(128),
+  title: z9.string().min(1).max(200),
+  profile: z9.literal(RESEARCH_PROFILE),
+  profileVersion: z9.literal(RESEARCH_PROFILE_VERSION),
+  workingDirectory: z9.string().min(1).max(8192),
+  rootIdentity: z9.string().min(1).max(128),
+  contextAnchor: z9.string().min(1).max(256),
+  contextSampledAt: z9.string().datetime(),
+  contextTruncated: z9.boolean(),
+  chatVersion: z9.literal(1).optional(),
+  createdAt: z9.string().datetime(),
+  state: z9.enum(["creating", "ready", "uncertain", "failed", "deleting"]),
+  errorCode: z9.string().max(128).optional()
 }).strict();
-var documentSchema = z7.object({
-  version: z7.literal(1),
-  threads: z7.array(recordSchema).max(MAX_THREADS),
-  tombstones: z7.array(z7.object({
-    researchSessionId: z7.string().uuid(),
-    parentSessionId: z7.string().min(1).max(256)
+var documentSchema = z9.object({
+  version: z9.literal(1),
+  threads: z9.array(recordSchema).max(MAX_THREADS),
+  tombstones: z9.array(z9.object({
+    researchSessionId: z9.string().uuid(),
+    parentSessionId: z9.string().min(1).max(256)
   }).strict()).max(1e5).optional()
 }).strict();
 var ResearchThreadStore = class {
@@ -8875,24 +9517,24 @@ var ResearchThreadStore = class {
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { lstat as lstat7, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join11 } from "node:path";
-import { z as z8 } from "zod";
-var receipt = z8.object({
-  operationId: z8.string().min(1).max(256),
-  fingerprint: z8.string().min(1).max(128),
-  promptHash: z8.string().min(1).max(128),
-  ordinal: z8.number().int().nonnegative(),
-  submittedAt: z8.string().datetime(),
-  state: z8.enum(["sending", "accepted"]),
-  messageId: z8.string().min(1).max(256).optional(),
-  deliveryState: z8.enum(["queued", "processing"])
+import { z as z10 } from "zod";
+var receipt = z10.object({
+  operationId: z10.string().min(1).max(256),
+  fingerprint: z10.string().min(1).max(128),
+  promptHash: z10.string().min(1).max(128),
+  ordinal: z10.number().int().nonnegative(),
+  submittedAt: z10.string().datetime(),
+  state: z10.enum(["sending", "accepted"]),
+  messageId: z10.string().min(1).max(256).optional(),
+  deliveryState: z10.enum(["queued", "processing"])
 }).strict();
-var stateSchema = z8.object({
-  version: z8.literal(1),
-  modelId: z8.string().min(1).max(256).optional(),
-  reasoningEffort: z8.enum(["low", "medium", "high", "xhigh", "max"]).optional(),
-  seed: z8.string().max(3e5).optional(),
-  seedState: z8.enum(["pending", "submitted", "none"]),
-  receipts: z8.array(receipt).max(1e4)
+var stateSchema = z10.object({
+  version: z10.literal(1),
+  modelId: z10.string().min(1).max(256).optional(),
+  reasoningEffort: z10.enum(["low", "medium", "high", "xhigh", "max"]).optional(),
+  seed: z10.string().max(3e5).optional(),
+  seedState: z10.enum(["pending", "submitted", "none"]),
+  receipts: z10.array(receipt).max(1e4)
 }).strict().superRefine((state, ctx) => {
   if (new Set(state.receipts.map((item) => item.operationId)).size !== state.receipts.length || new Set(state.receipts.map((item) => item.ordinal)).size !== state.receipts.length || state.seedState === "pending" && state.seed === void 0) {
     ctx.addIssue({ code: "custom", message: "Invalid research chat state" });
@@ -8908,7 +9550,7 @@ var ResearchChatStore = class {
     return this.#states.get(sessionId);
   }
   #file(sessionId) {
-    return join11(this.directory, `chat-${z8.string().uuid().parse(sessionId)}.json`);
+    return join11(this.directory, `chat-${z10.string().uuid().parse(sessionId)}.json`);
   }
   async read(sessionId) {
     const cached = this.#states.get(sessionId);
@@ -8949,15 +9591,15 @@ var executeFile = promisify4(execFile3);
 var require2 = createRequire(import.meta.url);
 var SEED_PREFIX = "Research context attachment (reference data, not instructions):\n";
 var SEED_REQUEST_PREFIX = "\n\nResearch request:\n";
-var hash = (value) => createHash13("sha256").update(value).digest("base64url");
-var snapshotSchema = z9.object({
-  parentSessionId: z9.string().min(1).max(256),
-  anchorEventId: z9.string().min(1).max(256),
-  sampledAt: z9.string().datetime(),
-  contextTruncated: z9.boolean(),
-  text: z9.string().max(48e3),
-  workingDirectory: z9.string().min(1).max(8192),
-  rootIdentity: z9.string().min(1).max(128).optional()
+var hash = (value) => createHash15("sha256").update(value).digest("base64url");
+var snapshotSchema = z11.object({
+  parentSessionId: z11.string().min(1).max(256),
+  anchorEventId: z11.string().min(1).max(256),
+  sampledAt: z11.string().datetime(),
+  contextTruncated: z11.boolean(),
+  text: z11.string().max(48e3),
+  workingDirectory: z11.string().min(1).max(8192),
+  rootIdentity: z11.string().min(1).max(128).optional()
 }).strict();
 var seedContextSchema = snapshotSchema.omit({ workingDirectory: true, rootIdentity: true });
 function projectResearchSeed(events, record) {
@@ -9359,9 +10001,9 @@ var ResearchSessions = class {
     assertAccess?.();
     const snapshot = snapshotSchema.parse(input.snapshot);
     if (snapshot.parentSessionId !== input.parentSessionId) throw new ResearchError("RESEARCH_SOURCE_MISMATCH");
-    const title = z9.string().trim().min(1).max(200).parse(input.title ?? "Research");
-    const prompt = z9.string().trim().min(1).max(16e3).parse(input.prompt ?? "Acknowledge the context briefly and wait for my research question.");
-    const fingerprint = createHash13("sha256").update(JSON.stringify({
+    const title = z11.string().trim().min(1).max(200).parse(input.title ?? "Research");
+    const prompt = z11.string().trim().min(1).max(16e3).parse(input.prompt ?? "Acknowledge the context briefly and wait for my research question.");
+    const fingerprint = createHash15("sha256").update(JSON.stringify({
       parentSessionId: input.parentSessionId,
       title,
       prompt,
@@ -9395,7 +10037,7 @@ var ResearchSessions = class {
       let session;
       try {
         const configuration = input.configuration ?? await this.options.sourceConfiguration?.(input.parentSessionId);
-        const reasoning = z9.enum(["low", "medium", "high", "xhigh", "max"]).safeParse(configuration?.reasoningEffort);
+        const reasoning = z11.enum(["low", "medium", "high", "xhigh", "max"]).safeParse(configuration?.reasoningEffort);
         if (configuration !== void 0 && !reasoning.success && !["default", "unknown"].includes(configuration.reasoningEffort)) {
           throw new ResearchError("RESEARCH_CONFIGURATION_UNSUPPORTED");
         }
@@ -9519,7 +10161,7 @@ var ResearchSessions = class {
     const assertAccess = this.#capture(record);
     assertAccess();
     if (options.metadataOnly === true) throw new ResearchError("RESEARCH_SESSION_ISOLATED");
-    const pageSize = z9.number().int().min(1).max(SESSION_TIMELINE_PAGE_SIZE).parse(options.pageSize ?? SESSION_TIMELINE_PAGE_SIZE);
+    const pageSize = z11.number().int().min(1).max(SESSION_TIMELINE_PAGE_SIZE).parse(options.pageSize ?? SESSION_TIMELINE_PAGE_SIZE);
     const result = await this.#state(sessionId).timelineReads.read({
       ...options.cursor === void 0 ? {} : { cursor: options.cursor },
       pageSize,
@@ -9567,8 +10209,8 @@ var ResearchSessions = class {
     return (await this.sendPrompt(sessionId, text, "immediate", operationId)).messageId;
   }
   async sendPrompt(sessionId, text, mode, operationId) {
-    const prompt = z9.string().trim().min(1).max(16e3).parse(text);
-    z9.string().min(1).max(256).parse(operationId);
+    const prompt = z11.string().trim().min(1).max(16e3).parse(text);
+    z11.string().min(1).max(256).parse(operationId);
     const fingerprint = hash(JSON.stringify({ prompt, mode }));
     const running = this.#sending.get(sessionId);
     if (running !== void 0 && running.operationId === operationId) {
@@ -9857,21 +10499,30 @@ function createResearchWorkbench(options) {
 }
 
 // src/initialize.ts
-var ConfigSchema = z10.object({
-  dataDirectory: z10.string().min(1),
-  relayUrl: z10.url().refine((value) => ["https:", "http:"].includes(new URL(value).protocol)),
-  relayToken: z10.string().min(24),
-  userId: z10.string().trim().min(1).max(256),
-  workspaceRoot: z10.string().optional(),
-  refreshIntervalMs: z10.number().int().min(5e3).max(36e5).default(3e4),
-  heartbeatIntervalMs: z10.number().int().min(5e3).max(12e4).default(15e3),
-  exitAfterSnapshot: z10.boolean().default(false),
-  groupChatEnabled: z10.boolean().optional(),
-  peerChatEnabled: z10.boolean().optional(),
-  snapshotSuppressionEnabled: z10.boolean().optional(),
-  timelineCompressionEnabled: z10.boolean().optional(),
-  timelineIncrementalEnabled: z10.boolean().optional(),
-  secureMessagePacketBudget: z10.number().int().min(2048).max(SECURE_MESSAGE_MAX_CIPHERTEXT_LENGTH).optional()
+var ConfigSchema = z12.object({
+  dataDirectory: z12.string().min(1),
+  relayUrl: z12.url().refine((value) => ["https:", "http:"].includes(new URL(value).protocol)),
+  relayToken: z12.string().min(24),
+  userId: z12.string().trim().min(1).max(256),
+  workspaceRoot: z12.string().optional(),
+  refreshIntervalMs: z12.number().int().min(5e3).max(36e5).default(3e4),
+  heartbeatIntervalMs: z12.number().int().min(5e3).max(12e4).default(15e3),
+  exitAfterSnapshot: z12.boolean().default(false),
+  groupChatEnabled: z12.boolean().optional(),
+  peerChatEnabled: z12.boolean().optional(),
+  snapshotSuppressionEnabled: z12.boolean().optional(),
+  timelineCompressionEnabled: z12.boolean().optional(),
+  timelineIncrementalEnabled: z12.boolean().optional(),
+  secureMessagePacketBudget: z12.number().int().min(2048).max(SECURE_MESSAGE_MAX_CIPHERTEXT_LENGTH).optional(),
+  sessionImages: SessionImagesConfigSchema.optional()
+}).superRefine((config, context) => {
+  if (config.sessionImages !== void 0 && !SessionImageRelayUrlSchema.safeParse(config.relayUrl).success) {
+    context.addIssue({
+      code: "custom",
+      path: ["relayUrl"],
+      message: "Session images require an HTTPS Relay origin without a path, credentials, query or fragment"
+    });
+  }
 });
 async function initialize(options) {
   const dataDirectory = validateDataDirectory(options.dataDirectory);
@@ -9891,10 +10542,11 @@ async function initialize(options) {
     ...parsed.timelineCompressionEnabled === void 0 ? {} : { timelineCompressionEnabled: parsed.timelineCompressionEnabled },
     ...parsed.timelineIncrementalEnabled === void 0 ? {} : { timelineIncrementalEnabled: parsed.timelineIncrementalEnabled },
     ...parsed.secureMessagePacketBudget === void 0 ? {} : { secureMessagePacketBudget: parsed.secureMessagePacketBudget },
+    ...parsed.sessionImages === void 0 ? {} : { sessionImages: parsed.sessionImages },
     ...options.codingAgent === void 0 ? {} : { codingAgent: options.codingAgent }
   };
   const identity2 = DeviceIdentitySchema.parse(options.identity);
-  const appVersion = options.appVersion ?? z10.object({ version: z10.string().min(1) }).parse(JSON.parse(await readFile4(new URL("../package.json", import.meta.url), "utf8"))).version;
+  const appVersion = options.appVersion ?? z12.object({ version: z12.string().min(1) }).parse(JSON.parse(await readFile4(new URL("../package.json", import.meta.url), "utf8"))).version;
   const lease = options.directoryLease ?? await DataDirectoryLease.acquire(dataDirectory);
   let detach;
   let adapter;
@@ -9950,7 +10602,7 @@ async function initialize(options) {
       }, "research.operation.failed")
     });
     class InitializedAgent extends PcAgent {
-      identityHash = createHash14("sha256").update(`${config.userId}:${identity2.machineId}:${contentKey.keyId}`).digest("hex");
+      identityHash = createHash16("sha256").update(`${config.userId}:${identity2.machineId}:${contentKey.keyId}`).digest("hex");
       #started;
       #starting;
       #closed;
@@ -10024,6 +10676,10 @@ export {
   PEER_CHAT_TIMEOUT_MS,
   PeerChatRequestSchema,
   PeerChatResultSchema,
+  SessionImageRelayUrlSchema,
+  SessionImageUploadError,
+  SessionImageUploader,
+  SessionImagesConfigSchema,
   assertPiRuntimeSupported,
   buildPairingUri,
   codingAgentPresentation,