@pheem49/mint 1.16.0 → 1.18.0

package/crates/mint-core/src/agent/memory.rs

@@ -55,6 +55,8 @@ pub fn subagent_name(chat_id: &str) -> Option<&str> {
 pub enum MemoryError {
     #[error("library error: {0}")]
     Library(String),
+    #[error("trajectory error: {0}")]
+    Trajectory(String),
     #[error("unable to determine the user config directory")]
     ConfigDirectoryUnavailable,
     #[error("unable to create database directory {path}: {source}")]
@@ -336,8 +338,8 @@ impl MemoryStore {
         Ok(())
     }
 
-    fn expire_abandoned_turns(&self, chat_id: &str) -> Result<(), MemoryError> {
-        self.connection()?.execute(
+    fn expire_abandoned_turns(connection: &Connection, chat_id: &str) -> Result<(), MemoryError> {
+        connection.execute(
             "UPDATE interaction_memories SET status = 'interrupted', lease_until = 0
              WHERE chat_id = ?1 AND status IN ('queued', 'running') AND lease_until < unixepoch()",
             params![normalized_chat_id(chat_id)],
@@ -385,8 +387,8 @@ impl MemoryStore {
         limit: usize,
     ) -> Result<ConversationChanges, MemoryError> {
         let chat_id = normalized_chat_id(chat_id);
-        self.expire_abandoned_turns(&chat_id)?;
         let connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, &chat_id)?;
         let mut statement = connection.prepare(
             "SELECT c.sequence, c.interaction_id,
                     m.id, m.chat_id, m.user_text, m.ai_text, m.provider, m.model,
@@ -441,8 +443,8 @@ impl MemoryStore {
     }
 
     pub fn latest_conversation_sequence(&self, chat_id: &str) -> Result<i64, MemoryError> {
-        self.expire_abandoned_turns(chat_id)?;
         let connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, chat_id)?;
         Ok(connection.query_row(
             "SELECT coalesce(max(sequence), 0) FROM conversation_changes WHERE chat_id = ?1",
             params![normalized_chat_id(chat_id)],
@@ -457,8 +459,8 @@ impl MemoryStore {
         limit: usize,
     ) -> Result<ConversationSnapshot, MemoryError> {
         let chat_id = normalized_chat_id(chat_id);
-        self.expire_abandoned_turns(&chat_id)?;
         let mut connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, &chat_id)?;
         let tx = connection.transaction()?;
         let cursor: i64 = tx.query_row(
             "SELECT coalesce(max(sequence), 0) FROM conversation_changes WHERE chat_id = ?1",
@@ -553,6 +555,68 @@ impl MemoryStore {
         rows.collect::<Result<Vec<_>, _>>().map_err(Into::into)
     }
 
+    /// Exports the execution trajectory for a given chat and optional run/interaction ID
+    /// formatted according to the SWE-bench / Agent Protocol StandardTrajectoryRun v1.0.
+    pub fn export_trajectory_json(
+        &self,
+        chat_id: &str,
+        run_id_or_interaction_id: Option<&str>,
+    ) -> Result<String, MemoryError> {
+        let interactions = self.recent_interactions_for_chat(chat_id, 50)?;
+        if interactions.is_empty() {
+            return Err(MemoryError::Trajectory(format!(
+                "No interactions found for chat '{chat_id}'"
+            )));
+        }
+
+        let target = if let Some(id_query) = run_id_or_interaction_id {
+            interactions.into_iter().find(|im| {
+                if im.id.to_string() == id_query {
+                    return true;
+                }
+                if let Some(act) = &im.agent_activity {
+                    let act_str = act.to_string();
+                    if act_str.contains(id_query) {
+                        return true;
+                    }
+                }
+                false
+            })
+        } else {
+            interactions.into_iter().next()
+        };
+
+        let interaction = target.ok_or_else(|| {
+            MemoryError::Trajectory(format!(
+                "No interaction matching identifier '{:?}' found for chat '{}'",
+                run_id_or_interaction_id, chat_id
+            ))
+        })?;
+
+        let activity_val = interaction.agent_activity.as_ref().ok_or_else(|| {
+            MemoryError::Trajectory("No agent activity recorded for this interaction".into())
+        })?;
+
+        let events: Vec<crate::orchestration::AgentProgress> =
+            serde_json::from_value(activity_val.clone()).map_err(|e| {
+                MemoryError::Trajectory(format!("Failed to parse agent activity events: {e}"))
+            })?;
+
+        let fallback_run_id = format!("run-{}", interaction.id);
+        let run =
+            crate::orchestration::trajectory_schema::StandardTrajectoryRun::from_agent_activity(
+                &interaction.chat_id,
+                &fallback_run_id,
+                &interaction.user_text,
+                &interaction.model,
+                &interaction.provider,
+                &events,
+            );
+
+        run.to_json_pretty()
+            .map_err(|e| MemoryError::Trajectory(format!("Failed to serialize trajectory: {e}")))
+    }
+
     /// Full-text search over `chat_id`'s past interactions for the turns most
     /// relevant to `query` (BM25 ranked), skipping the `exclude_recent` newest
     /// rows since those are already injected verbatim elsewhere. Returns
@@ -769,6 +833,25 @@ impl MemoryStore {
         )?)
     }
 
+    pub fn truncate_interactions_from(
+        &self,
+        chat_id: &str,
+        from_id: i64,
+    ) -> Result<usize, MemoryError> {
+        let chat_id = normalized_chat_id(chat_id);
+        let connection = self.connection()?;
+        let _ = connection.execute(
+            "DELETE FROM conversation_source_attachments WHERE interaction_id IN (
+                SELECT id FROM interaction_memories WHERE chat_id = ?1 AND id >= ?2
+            )",
+            params![chat_id, from_id],
+        );
+        Ok(connection.execute(
+            "DELETE FROM interaction_memories WHERE chat_id = ?1 AND id >= ?2",
+            params![chat_id, from_id],
+        )?)
+    }
+
     pub fn delete_chat_session(&self, chat_id: &str) -> Result<usize, MemoryError> {
         let chat_id = normalized_chat_id(chat_id);
         if chat_id == CHAT_CLI_ID {
@@ -796,6 +879,9 @@ impl MemoryStore {
         let deleted =
             transaction.execute("DELETE FROM chat_sessions WHERE id = ?1", params![chat_id])?;
         transaction.commit()?;
+        if let Err(error) = crate::mcp_result::delete_chat_artifacts(&chat_id) {
+            eprintln!("Could not remove conversation artifacts: {error}");
+        }
         Ok(deleted)
     }
 
@@ -1229,8 +1315,8 @@ fn restrict_to_owner(path: &Path) {
 fn restrict_to_owner(_path: &Path) {}
 
 pub fn memory_path() -> Result<PathBuf, MemoryError> {
-    dirs::config_dir()
-        .map(|directory| directory.join("mint").join("mint-knowledge.sqlite"))
+    crate::mint_config_dir()
+        .map(|directory| directory.join("mint-knowledge.sqlite"))
         .ok_or(MemoryError::ConfigDirectoryUnavailable)
 }
 
@@ -1780,7 +1866,7 @@ fn interaction_row(row: &rusqlite::Row<'_>) -> Result<InteractionMemory, rusqlit
 
 fn normalized_chat_id(chat_id: &str) -> String {
     let trimmed = chat_id.trim();
-    if trimmed.is_empty() {
+    if trimmed.is_empty() || trimmed == "default" {
         DEFAULT_CONVERSATION_ID.to_owned()
     } else {
         trimmed.to_owned()
@@ -2035,6 +2121,41 @@ mod conversation_sync_tests {
         );
     }
 
+    #[test]
+    fn truncate_interactions_from_deletes_specified_and_subsequent_rows() {
+        let memory = store();
+        let id1 = memory
+            .add_interaction_for_chat("cli::test", "prompt 1", "reply 1", "test", "model")
+            .unwrap();
+        let id2 = memory
+            .add_interaction_for_chat("cli::test", "prompt 2", "reply 2", "test", "model")
+            .unwrap();
+        let id3 = memory
+            .add_interaction_for_chat("cli::test", "prompt 3", "reply 3", "test", "model")
+            .unwrap();
+
+        let cursor = memory.latest_conversation_sequence("cli::test").unwrap();
+        let deleted_count = memory.truncate_interactions_from("cli::test", id2).unwrap();
+        assert_eq!(deleted_count, 2);
+
+        let remaining = memory.interactions_for_chat("cli::test").unwrap();
+        assert_eq!(remaining.len(), 1);
+        assert_eq!(remaining[0].id, id1);
+
+        let changes = memory
+            .conversation_changes("cli::test", cursor, 100)
+            .unwrap();
+        let tombstones: Vec<i64> = changes
+            .changes
+            .iter()
+            .filter(|c| c.interaction.is_none())
+            .map(|c| c.interaction_id)
+            .collect();
+        assert!(tombstones.contains(&id2));
+        assert!(tombstones.contains(&id3));
+        assert!(!tombstones.contains(&id1));
+    }
+
     #[test]
     fn heartbeat_does_not_emit_visible_changes() {
         let memory = store();

package/crates/mint-core/src/agent/safety.rs

@@ -331,10 +331,11 @@ pub fn assert_path_capability(
         Capability::Read => &config.allowed_read_paths,
         Capability::Write => &config.allowed_write_paths,
     };
-    if !allowed_paths
-        .iter()
-        .map(|path| resolve_path(path))
-        .any(|path| resolved.starts_with(path))
+    if !is_temp_path(&resolved)
+        && !allowed_paths
+            .iter()
+            .map(|path| resolve_path(path))
+            .any(|path| resolved.starts_with(path))
     {
         return Err(SafetyError::PathDenied {
             capability: capability.as_str(),
@@ -344,6 +345,31 @@ pub fn assert_path_capability(
     Ok(resolved)
 }
 
+fn is_temp_path(path: &Path) -> bool {
+    let temp = std::env::temp_dir();
+    if path.starts_with(&temp) {
+        return true;
+    }
+    if let Ok(canonical_temp) = temp.canonicalize() {
+        if path.starts_with(&canonical_temp) {
+            return true;
+        }
+    }
+    #[cfg(unix)]
+    {
+        let slash_tmp = Path::new("/tmp");
+        if path.starts_with(slash_tmp) {
+            return true;
+        }
+        if let Ok(canonical_slash_tmp) = slash_tmp.canonicalize() {
+            if path.starts_with(&canonical_slash_tmp) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
 fn resolve_path(path: &Path) -> PathBuf {
     let expanded = expand_home(path);
     let absolute = if expanded.is_absolute() {
@@ -476,4 +502,30 @@ mod tests {
             assert_path_capability(Path::new("/var/lib/private"), Capability::Read, &config);
         assert!(matches!(result, Err(SafetyError::PathDenied { .. })));
     }
+
+    #[test]
+    fn allows_temp_directory_paths_even_when_allowed_paths_is_empty() {
+        let config = MintConfig {
+            allowed_read_paths: vec![],
+            allowed_write_paths: vec![],
+            ..MintConfig::default()
+        };
+        let temp_file = std::env::temp_dir().join("some_image.png");
+        let result = assert_path_capability(&temp_file, Capability::Read, &config);
+        assert!(result.is_ok());
+        let write_result = assert_path_capability(&temp_file, Capability::Write, &config);
+        assert!(write_result.is_ok());
+    }
+
+    #[test]
+    fn blocks_sensitive_files_even_inside_temp_directory() {
+        let config = MintConfig {
+            allowed_read_paths: vec![],
+            blocked_file_names: vec![".env".into()],
+            ..MintConfig::default()
+        };
+        let temp_env = std::env::temp_dir().join(".env");
+        let result = assert_path_capability(&temp_env, Capability::Read, &config);
+        assert!(matches!(result, Err(SafetyError::BlockedFileName { .. })));
+    }
 }

package/crates/mint-core/src/agent/skill_inventory.rs

@@ -96,7 +96,9 @@ fn discover_from(
             discovered.push(entry);
         }
     };
-    add_layer(memory.learned_skills(100)?, SkillLocation::Database);
+    if let Ok(learned) = memory.learned_skills(100) {
+        add_layer(learned, SkillLocation::Database);
+    }
     if let Some(home) = home {
         let mut rules = Vec::new();
         load_agent_rules_file(&home.join(".gemini/config/AGENTS.md"), &mut rules);

package/crates/mint-core/src/agent/skills.rs

@@ -504,6 +504,7 @@ mod tests {
         );
         let denied = crate::MintConfig {
             allowed_read_paths: vec![],
+            blocked_paths: vec![root.clone()],
             ..config.clone()
         };
         assert!(read_skill_file(&memory, &skills[0], "denied", &denied).is_err());

package/crates/mint-core/src/agent/tasks.rs

@@ -260,8 +260,8 @@ impl TaskStore {
 }
 
 pub fn tasks_path() -> Result<PathBuf, TaskError> {
-    dirs::config_dir()
-        .map(|directory| directory.join("mint").join("tasks.json"))
+    crate::mint_config_dir()
+        .map(|directory| directory.join("tasks.json"))
         .ok_or(TaskError::ConfigDirectoryUnavailable)
 }
 

package/crates/mint-core/src/api_server/routes/auth.rs

@@ -128,10 +128,7 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
                 "gif" => "image/gif",
                 _ => "image/png",
             };
-            let file_path = profile_pictures_dir()
-                .ok()
-                .filter(|_| !filename.is_empty())
-                .map(|dir| dir.join(&filename));
+            let file_path = resolve_avatar_file_path(&filename);
             match file_path.and_then(|path| std::fs::read(path).ok()) {
                 Some(bytes) => send_binary_response(socket, "200 OK", content_type, &bytes).await,
                 None => {

package/crates/mint-core/src/api_server/routes/chat.rs

@@ -53,6 +53,26 @@ impl ApiChatRequest {
     }
 }
 
+fn apply_request_overrides_to_config(config: &mut MintConfig, chat_req: &ChatRequest) {
+    let active_model = config.active_model().to_string();
+    if let Some(temp) = chat_req.temperature {
+        config.temperature = Some(temp);
+        config.set_model_temperature(&active_model, Some(temp));
+    }
+    if chat_req.thinking_enabled.is_some() || chat_req.thinking_effort.is_some() {
+        let (cur_enabled, cur_effort) = config.resolved_thinking();
+        let enabled = chat_req.thinking_enabled.unwrap_or(cur_enabled);
+        let effort = chat_req
+            .thinking_effort
+            .as_deref()
+            .unwrap_or(cur_effort)
+            .to_string();
+        config.thinking_enabled = enabled;
+        config.thinking_effort = effort.clone();
+        config.set_model_thinking(&active_model, enabled, &effort);
+    }
+}
+
 pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpStream) {
     let owner = match background_request_owner(ctx.request_str) {
         Ok(owner) => owner,
@@ -98,9 +118,10 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpS
     match (method, route) {
         ("POST", "/api/chat") => {
             if let Ok(req) = serde_json::from_str::<ApiChatRequest>(body) {
-                let config = load_config().unwrap_or_default();
+                let mut config = load_config().unwrap_or_default();
                 let metadata = req.attachment_metadata.clone();
                 let chat_req = req.into_chat_request(&config);
+                apply_request_overrides_to_config(&mut config, &chat_req);
                 let (mut chat_req, receipt) =
                     match crate::library::prepare_chat(&chat_req, metadata.as_ref(), &config).await
                     {
@@ -229,9 +250,10 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpS
 
         ("POST", "/api/chat-stream") => {
             if let Ok(req) = serde_json::from_str::<ApiChatRequest>(body) {
-                let config = load_config().unwrap_or_default();
+                let mut config = load_config().unwrap_or_default();
                 let metadata = req.attachment_metadata.clone();
                 let chat_req = req.into_chat_request(&config);
+                apply_request_overrides_to_config(&mut config, &chat_req);
                 let (mut chat_req, receipt) =
                     match crate::library::prepare_chat(&chat_req, metadata.as_ref(), &config).await
                     {
@@ -379,7 +401,7 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpS
                                 }
                             });
                         } else {
-                            let root = std::env::current_dir().unwrap_or_default();
+                            let root = resolve_agent_root(chat_req.workspace_path.as_deref());
                             let fast_mode = config
                                 .extra
                                 .get("enableFastMode")
@@ -390,20 +412,7 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpS
                             let config_clone = config.clone();
                             let chat_id = chat_req.chat_id.clone();
                             let chat_id_str = chat_id.clone().unwrap_or_default();
-                            // Unlike `root` above (this route's agent-mode tools
-                            // deliberately still operate against the API server
-                            // process's own cwd, not any client-sent workspace —
-                            // out of scope for the chat_id-scoping fix), the
-                            // conversation identity itself DOES need the client's
-                            // workspace: `orchestrate_agent_loop` would otherwise
-                            // self-derive from `root` (constant across every web
-                            // request), which can't distinguish workspaces at
-                            // all. Pre-scoping here is safe/idempotent — see
-                            // `scoped_chat_id`'s docs — so its self-derivation
-                            // becomes a no-op on the id we hand it below. The raw,
-                            // unscoped `chat_id_str` above is left untouched: it's
-                            // only a cancellation-token key, and `/api/cancel-chat`
-                            // sends back the same raw id it started with.
+                            // Resolve client's workspace path for parity with desktop. Idempotent on scoped_chat_id.
                             let agent_scoped_chat_id = crate::agent::memory::scoped_chat_id(
                                 chat_id.as_deref().unwrap_or(DEFAULT_CONVERSATION_ID),
                                 chat_req.workspace_path.as_deref(),
@@ -586,4 +595,31 @@ mod tests {
             assert!(request.tools.is_none());
         }
     }
+
+    #[test]
+    fn resolve_agent_root_uses_workspace_path_when_valid_and_falls_back_to_current_dir() {
+        let current = std::env::current_dir().unwrap_or_default();
+        let canonical_current = current.canonicalize().unwrap_or_else(|_| current.clone());
+
+        // None falls back to current_dir
+        assert_eq!(resolve_agent_root(None), canonical_current);
+
+        // Empty string falls back to current_dir
+        assert_eq!(resolve_agent_root(Some("")), canonical_current);
+        assert_eq!(resolve_agent_root(Some("   ")), canonical_current);
+
+        // Non-existent directory falls back to current_dir
+        assert_eq!(
+            resolve_agent_root(Some("/path/that/does/not/exist_12345")),
+            canonical_current
+        );
+
+        // Valid directory returns its canonical path
+        let temp = std::env::temp_dir();
+        let canonical_temp = temp.canonicalize().unwrap_or_else(|_| temp.clone());
+        assert_eq!(
+            resolve_agent_root(Some(temp.to_str().unwrap())),
+            canonical_temp
+        );
+    }
 }

package/crates/mint-core/src/api_server/routes/gemini_live.rs

@@ -67,11 +67,24 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpS
             let chat_id = query_param(query, "chatId").unwrap_or_default();
 
             let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<String>();
+            let tx_approval = tx.clone();
             let handle = crate::gemini_live::start_session(
                 config,
                 root,
                 chat_id,
-                |_| Ok(ApprovalOutcome::Denied),
+                move |approval| {
+                    crate::PENDING_APPROVALS.request_blocking(|token| {
+                        let event = crate::gemini_live::GeminiLiveEvent::ApprovalRequested {
+                            token: token.to_owned(),
+                            approval: approval.clone(),
+                        };
+                        let json_val =
+                            serde_json::to_string(&event).map_err(|error| error.to_string())?;
+                        tx_approval
+                            .send(json_val)
+                            .map_err(|error| error.to_string())
+                    })
+                },
                 move |event| {
                     if let Ok(json_val) = serde_json::to_string(&event) {
                         let _ = tx.send(json_val);

package/crates/mint-core/src/api_server/routes/html_preview.rs

@@ -32,8 +32,7 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             .as_str()
             .ok_or("Missing preview path")?
             .to_string();
-        let mint = body["mintBrowser"].as_bool().unwrap_or(false);
-        let mut config = load_config().map_err(|e| e.to_string())?;
+        let config = load_config().map_err(|e| e.to_string())?;
         let worker_config = config.clone();
         let preview = tokio::task::spawn_blocking(move || {
             crate::system::html_preview::start(
@@ -54,12 +53,6 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             .map_err(|e| e.to_string())?
             .error_for_status()
             .map_err(|e| e.to_string())?;
-        if mint {
-            if crate::enable_browser_tools(&mut config) {
-                crate::save_config(&config).map_err(|e| e.to_string())?;
-            }
-            crate::browser::spawn_automation_browser_with_url(&config, Some(url)).await?;
-        }
         Ok::<_, String>(preview)
     }
     .await;

package/crates/mint-core/src/api_server/routes/misc.rs

@@ -181,6 +181,42 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             }
         }
 
+        ("GET", route) if route == "/api/proxy-image" || route.starts_with("/api/proxy-image") => {
+            let target_url = query_param(query, "url").unwrap_or_default();
+            if target_url.trim().is_empty() {
+                send_json_response(
+                    socket,
+                    "400 Bad Request",
+                    "{\"error\":\"missing url query parameter\"}",
+                )
+                .await;
+                return;
+            }
+
+            let cache_dir = crate::media::image_proxy::default_cache_dir();
+            match crate::media::image_proxy::fetch_and_cache_image(&cache_dir, &target_url).await {
+                Ok((mime_type, bytes)) => {
+                    send_binary_response(socket, "200 OK", &mime_type, &bytes).await;
+                }
+                Err(err) => {
+                    let status = match &err {
+                        crate::media::image_proxy::ImageProxyError::InvalidUrl(_)
+                        | crate::media::image_proxy::ImageProxyError::SsrfBlocked(_) => {
+                            "400 Bad Request"
+                        }
+                        crate::media::image_proxy::ImageProxyError::BadStatus(code)
+                            if *code == 404 =>
+                        {
+                            "404 Not Found"
+                        }
+                        _ => "502 Bad Gateway",
+                    };
+                    let err_msg = serde_json::json!({ "error": err.to_string() }).to_string();
+                    send_json_response(socket, status, &err_msg).await;
+                }
+            }
+        }
+
         ("GET", "/api/media") => {
             let path_param = query_param(query, "path")
                 .map(|p| percent_decode(&p))
@@ -444,6 +480,86 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             }
         }
 
+        ("GET", "/api/file/media") => {
+            let path = query_param(query, "path").unwrap_or_default();
+            let root = query_param(query, "workspace").unwrap_or_default();
+            let prepared = tokio::task::spawn_blocking(move || {
+                if root.trim().is_empty() {
+                    return Err("Select a source workspace".to_string());
+                }
+                crate::workspace::prepare_media(
+                    std::path::Path::new(&root),
+                    &path,
+                    &load_config().map_err(|error| error.to_string())?,
+                )
+            })
+            .await
+            .map_err(|error| error.to_string())
+            .and_then(|value| value);
+            match prepared {
+                Ok(media) => match tokio::fs::File::open(&media.path).await {
+                    Ok(mut file) => {
+                        let headers = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: {}\r\nContent-Length: {}\r\nX-Content-Type-Options: nosniff\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nConnection: close\r\n\r\n",
+                            media.mime_type, media.byte_length
+                        );
+                        let mut socket = socket;
+                        if socket.write_all(headers.as_bytes()).await.is_ok() {
+                            let _ = tokio::io::copy(&mut file, &mut socket).await;
+                        }
+                    }
+                    Err(error) => {
+                        send_json_response(
+                            socket,
+                            "404 Not Found",
+                            &json!({"error": error.to_string()}).to_string(),
+                        )
+                        .await
+                    }
+                },
+                Err(error) => {
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({"error": error}).to_string(),
+                    )
+                    .await
+                }
+            }
+        }
+
+        ("GET", "/api/file/image") => {
+            let path = query_param(query, "path").unwrap_or_default();
+            let root = query_param(query, "workspace").unwrap_or_default();
+            let result = tokio::task::spawn_blocking(move || {
+                if root.trim().is_empty() {
+                    return Err("Select a source workspace".to_string());
+                }
+                let config = load_config().map_err(|error| error.to_string())?;
+                crate::workspace::read_image(std::path::Path::new(&root), &path, &config)
+            })
+            .await;
+            match result {
+                Ok(Ok(data_url)) => {
+                    send_json_response(socket, "200 OK", &json!({"dataUrl": data_url}).to_string())
+                        .await
+                }
+                other => {
+                    let error = match other {
+                        Ok(Err(error)) => error,
+                        Err(error) => error.to_string(),
+                        _ => unreachable!(),
+                    };
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({"error": error}).to_string(),
+                    )
+                    .await;
+                }
+            }
+        }
+
         ("GET", "/api/file/read") => {
             let file_path = query_param(query, "path").unwrap_or_default();
             if file_path.is_empty() {