@yeaft/webchat-agent 1.0.177 → 1.0.180

package/connection/message-router.js

@@ -113,6 +113,7 @@ export async function handleMessage(msg) {
 
       // ★ Flush 断连期间缓冲的消息
       await flushMessageBuffer();
+      await ctx.assetOutbox?.drain();
 
       // ★ Phase 1: 通知 server 同步完成
       sendToServer({ type: 'agent_sync_complete' });
@@ -130,6 +131,12 @@ export async function handleMessage(msg) {
         .finally(() => { preloadYeaftSkillSlashCommands(); });
       break;
 
+    case 'yeaft_asset_ack':
+      if ((msg.ok === true || msg.permanent === true) && ctx.assetOutbox?.acknowledge(msg.deliveryId)) {
+        ctx.assetOutbox.drain().catch(err => console.warn('[AssetOutbox] drain failed:', err?.message || err));
+      }
+      break;
+
     case 'create_conversation':
       await createConversation(msg);
       break;

package/context.js

@@ -47,6 +47,7 @@ export default {
   lastHeartbeatStallMs: 0,
   outboundSendQueue: [],
   outboundSendQueueActive: false,
+  assetOutbox: null,
   // 断连期间的消息缓冲队列（重连后 flush）
   messageBuffer: [],
   messageBufferMaxSize: 5000, // 防止内存无限增长

package/index.js

@@ -3,6 +3,7 @@ assertNodeVersion({ component: '@yeaft/webchat-agent' });
 
 import 'dotenv/config';
 import { platform, homedir } from 'os';
+import { createAssetOutbox } from './yeaft/asset-outbox.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, chmodSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { exec } from 'child_process';
@@ -107,6 +108,10 @@ const CONFIG = {
 // 初始化共享上下文
 ctx.CONFIG = CONFIG;
 ctx.saveConfig = saveConfig;
+ctx.assetOutbox = createAssetOutbox({
+  root: join(YEAFT_DIR, 'asset-outbox'),
+  send: message => ctx.sendToServer?.(message) || 'dropped',
+});
 
 // 初始加载 MCP servers（必须在 ctx.CONFIG 赋值之后）
 loadMcpServers();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.177",
+  "version": "1.0.180",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/asset-outbox.js

@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeAtomic } from './storage/atomic.js';
+
+const DEFAULT_MAX_ITEMS = 128;
+const DEFAULT_MAX_BYTES = 256 * 1024 * 1024;
+
+function safeDeliveryId(value) {
+  return typeof value === 'string' && /^[A-Za-z0-9_-]{16,128}$/.test(value) ? value : null;
+}
+
+export function createAssetOutbox({
+  root,
+  send,
+  maxItems = DEFAULT_MAX_ITEMS,
+  maxBytes = DEFAULT_MAX_BYTES,
+  retryDelayMs = 30_000,
+} = {}) {
+  if (!root) throw new Error('Asset outbox root is required');
+  if (typeof send !== 'function') throw new Error('Asset outbox send function is required');
+  mkdirSync(root, { recursive: true });
+  let draining = null;
+  let retryTimer = null;
+
+  const itemPath = deliveryId => join(root, `${deliveryId}.json`);
+  const list = () => readdirSync(root)
+    .filter(name => /^[A-Za-z0-9_-]{16,128}\.json$/.test(name))
+    .map(name => {
+      const path = join(root, name);
+      try {
+        const stat = statSync(path);
+        return { path, size: stat.size, createdAt: stat.birthtimeMs || stat.mtimeMs };
+      } catch { return null; }
+    })
+    .filter(Boolean)
+    .sort((a, b) => a.createdAt - b.createdAt || a.path.localeCompare(b.path));
+
+  const read = path => {
+    try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+  };
+
+  function enforceCapacity(extraBytes) {
+    const items = list();
+    const bytes = items.reduce((sum, item) => sum + item.size, 0);
+    if (items.length >= maxItems || bytes + extraBytes > maxBytes) {
+      throw new Error('Asset outbox is full; generated image was not queued');
+    }
+  }
+
+  function enqueue(message) {
+    const deliveryId = safeDeliveryId(message?.deliveryId) || randomUUID();
+    const payload = { ...message, type: 'yeaft_asset_put', deliveryId, queuedAt: Date.now() };
+    const data = JSON.stringify(payload);
+    enforceCapacity(Buffer.byteLength(data));
+    writeAtomic(itemPath(deliveryId), data);
+    return deliveryId;
+  }
+
+  function acknowledge(deliveryId) {
+    const id = safeDeliveryId(deliveryId);
+    if (!id) return false;
+    const path = itemPath(id);
+    if (!existsSync(path)) return false;
+    rmSync(path, { force: true });
+    return true;
+  }
+
+  const scheduleRetry = () => {
+    if (retryTimer || list().length === 0) return;
+    retryTimer = setTimeout(() => {
+      retryTimer = null;
+      drain().catch(err => console.warn('[AssetOutbox] retry failed:', err?.message || err));
+    }, retryDelayMs);
+    retryTimer.unref?.();
+  };
+
+  async function drain() {
+    if (draining) return draining;
+    if (retryTimer) {
+      clearTimeout(retryTimer);
+      retryTimer = null;
+    }
+    draining = (async () => {
+      for (const item of list()) {
+        const payload = read(item.path);
+        if (!payload || !safeDeliveryId(payload.deliveryId)) {
+          rmSync(item.path, { force: true });
+          continue;
+        }
+        let outcome;
+        try { outcome = await send(payload); } catch { outcome = 'dropped'; }
+        if (outcome !== 'sent') break;
+      }
+    })().finally(() => {
+      draining = null;
+      scheduleRetry();
+    });
+    return draining;
+  }
+
+  function removeSession(sessionId) {
+    let removed = 0;
+    for (const item of list()) {
+      const payload = read(item.path);
+      if (payload?.sessionId !== sessionId) continue;
+      rmSync(item.path, { force: true });
+      removed++;
+    }
+    return removed;
+  }
+
+  return {
+    enqueue,
+    acknowledge,
+    drain,
+    removeSession,
+    list,
+    close() {
+      if (retryTimer) clearTimeout(retryTimer);
+      retryTimer = null;
+    },
+  };
+}

package/yeaft/conversation/persist.js

@@ -263,6 +263,7 @@ function serializeMessage(msg) {
   // Defaults to 'main' for legacy messages (see migrate-messages-threadid.js).
   fm.push(`threadId: ${msg.threadId || 'main'}`);
   if (msg.turnId) fm.push(`turnId: ${msg.turnId}`);
+  if (msg.imageAssetAnchor) fm.push('imageAssetAnchor: true');
   // task-313: when a thread is merged into another, the messages keep
   // their original thread id in `sourceThreadId` so the UI can still
   // render a small "#source" pill next to each bubble.
@@ -285,6 +286,12 @@ function serializeMessage(msg) {
       fm.push(`attachmentsB64: ${b64}`);
     } catch { /* best-effort: attachments are UI metadata, not engine-critical */ }
   }
+  if (Array.isArray(msg.images) && msg.images.length > 0) {
+    try {
+      const b64 = Buffer.from(JSON.stringify(msg.images)).toString('base64');
+      fm.push(`imagesB64: ${b64}`);
+    } catch { /* best-effort: image display metadata is not engine-critical */ }
+  }
   // Internal/synthetic rows must round-trip so refresh/history replay can
   // keep them out of the user-visible conversation. Reflection folding uses
   // `_reflection`; other engine-only rows may use one of the explicit flags.
@@ -392,6 +399,7 @@ export function parseMessage(raw) {
       case 'tokens_est': msg.tokens_est = parseInt(value, 10); break;
       case 'threadId': msg.threadId = value; break;
       case 'turnId': msg.turnId = value; break;
+      case 'imageAssetAnchor': msg.imageAssetAnchor = value === 'true'; break;
       case 'sourceThreadId': msg.sourceThreadId = value; break;
       case 'sessionId': msg.sessionId = value; break;
       case 'chatId': msg.chatId = value; break;
@@ -403,6 +411,12 @@ export function parseMessage(raw) {
           if (Array.isArray(parsed)) msg.attachments = parsed;
         } catch { /* best-effort: ignore malformed attachment metadata */ }
         break;
+      case 'imagesB64':
+        try {
+          const parsed = JSON.parse(Buffer.from(value, 'base64').toString('utf8'));
+          if (Array.isArray(parsed)) msg.images = parsed;
+        } catch { /* best-effort: ignore malformed image metadata */ }
+        break;
       case '_reflection': msg._reflection = value === 'true'; break;
       case 'internal': msg.internal = value === 'true'; break;
       case 'systemOnly': msg.systemOnly = value === 'true'; break;

package/yeaft/engine.js

@@ -47,6 +47,7 @@ import { attachRouterPlan, extractPriorPlan, stripMetaForWire } from './router/c
 import { resolveThinking } from './router/thinking.js';
 import { approxTokens } from './memory/budget.js';
 import { COLLAB_TOOL_POLICY, normalizeToolOutput, truncateToolResultIfNeeded } from './tools/registry.js';
+import { extractDisplayImages, stripDisplayImageData } from './image-assets.js';
 import { acknowledgePendingNotifications, formatNotificationsForPrompt, peekPendingNotifications } from './sub-agent/notifications.js';
 import {
   TOOL_BATCH_SIZE,
@@ -2183,6 +2184,7 @@ export class Engine {
     let continueTurns = 0; // auto-continue counter
     let toolLoopTurns = 0; // task-327b: tool-use turns for long-loop auto-bump
     let fullResponseText = '';
+    let hasDisplayImageAnchor = false;
     let currentModel = this.#config.model;
     let cumulativeInputTokens = 0;
     let cumulativeOutputTokens = 0;
@@ -3068,6 +3070,7 @@ export class Engine {
             // for this turn. The hook still persists assistant + tool
             // rows for THIS VP's contribution.
             userAlreadyPersisted,
+            hasDisplayImageAnchor,
           });
 
           if (hookResult.consolidated) {
@@ -3252,6 +3255,7 @@ export class Engine {
         }
 
         let output;
+        let displayImages = [];
         let isError = false;
         currentToolCallForAsyncTask = {
           id: tc.id,
@@ -3285,7 +3289,12 @@ export class Engine {
               const rawOutput = await tool.execute(tc.input, toolCtx);
               output = normalizeToolOutput(rawOutput);
             }
-            yield { type: 'tool_end', id: tc.id, name: tc.name, output, isError: false, threadId: this.currentThreadId };
+            displayImages = extractDisplayImages(tc.name, output);
+            if (displayImages.length > 0) {
+              output = stripDisplayImageData(output, displayImages);
+            }
+            yield { type: 'tool_end', id: tc.id, name: tc.name, output, displayImages, isError: false, threadId: this.currentThreadId };
+            if (displayImages.some(image => image.deliveryQueued === true)) hasDisplayImageAnchor = true;
           } catch (err) {
             output = `Error: ${err.message}`;
             isError = true;
@@ -3310,6 +3319,7 @@ export class Engine {
           durationMs: toolDurationMs,
           isError,
           toolOutput: output,
+          ...(displayImages.length > 0 ? { displayImageCount: displayImages.length } : {}),
         };
 
         // 2026-05-13: feed the per-tool counters. Stays best-effort — a
@@ -3334,7 +3344,6 @@ export class Engine {
           toolOutput: output,
           durationMs: toolDurationMs,
           isError,
-          toolOutput: output,
         });
 
         // Append only the bounded copy to the model message history. Raw

package/yeaft/image-assets.js

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto';
+
+const SUPPORTED_IMAGE_MIME = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+const MAX_UI_IMAGE_BYTES = 20 * 1024 * 1024;
+
+function parseJsonObject(value) {
+  if (value && typeof value === 'object') return value;
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return null;
+  try { return JSON.parse(trimmed); } catch { return null; }
+}
+
+function decodeDataUri(value) {
+  const match = typeof value === 'string'
+    ? value.match(/^data:(image\/[A-Za-z0-9.+-]+);base64,([A-Za-z0-9+/=\s]+)$/)
+    : null;
+  if (!match) return null;
+  const mimeType = match[1].toLowerCase();
+  if (!SUPPORTED_IMAGE_MIME.has(mimeType)) return null;
+  const data = match[2].replace(/\s+/g, '');
+  let buffer;
+  try { buffer = Buffer.from(data, 'base64'); } catch { return null; }
+  if (!buffer.length || buffer.length > MAX_UI_IMAGE_BYTES) return null;
+  return { mimeType, data, buffer };
+}
+
+function imageCandidates(payload) {
+  if (!payload) return [];
+  if (Array.isArray(payload)) return payload;
+  const out = [];
+  if (payload.image) out.push(typeof payload.image === 'object' ? payload.image : { image: payload.image });
+  if (payload.dataUri) out.push({ dataUri: payload.dataUri });
+  if (Array.isArray(payload.images)) out.push(...payload.images);
+  return out;
+}
+
+export function extractDisplayImages(toolName, output) {
+  const payload = parseJsonObject(output);
+  const images = [];
+  const seen = new Set();
+  for (const item of imageCandidates(payload)) {
+    const dataUri = typeof item === 'string'
+      ? item
+      : (item?.dataUri || item?.image || (item?.data && item?.mimeType ? `data:${item.mimeType};base64,${item.data}` : null));
+    const decoded = decodeDataUri(dataUri);
+    if (!decoded) continue;
+    const assetId = createHash('sha256').update(decoded.buffer).digest('hex');
+    if (seen.has(assetId)) continue;
+    seen.add(assetId);
+    const filename = String(item?.filename || payload?.filename || payload?.path || `${toolName || 'image'}-${assetId.slice(0, 12)}`)
+      .split(/[/\\]/)
+      .pop();
+    images.push({
+      assetId,
+      mimeType: decoded.mimeType,
+      filename,
+      size: decoded.buffer.length,
+      width: Number.isFinite(item?.width ?? payload?.width) ? Number(item?.width ?? payload.width) : null,
+      height: Number.isFinite(item?.height ?? payload?.height) ? Number(item?.height ?? payload.height) : null,
+      previewData: { data: decoded.data, mimeType: decoded.mimeType, filename },
+    });
+  }
+  return images;
+}
+
+export function imageMetadataForPersistence(image) {
+  if (!image?.assetId || !image?.mimeType) return null;
+  return {
+    assetId: image.assetId,
+    mimeType: image.mimeType,
+    filename: image.filename || 'image',
+    size: Number(image.size) || null,
+    width: Number(image.width) || null,
+    height: Number(image.height) || null,
+  };
+}
+
+export function stripDisplayImageData(output, images) {
+  if (!Array.isArray(images) || images.length === 0) {
+    return typeof output === 'string' ? output : JSON.stringify(output ?? '');
+  }
+  const payload = parseJsonObject(output);
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return '[image asset]';
+  const clean = { ...payload };
+  delete clean.image;
+  delete clean.images;
+  delete clean.dataUri;
+  if (typeof clean.data === 'string' && clean.data.length > 1024) delete clean.data;
+  return JSON.stringify({ ...clean, imageAssetIds: images.map(image => image.assetId) });
+}

package/yeaft/remote-image-download.js

@@ -0,0 +1,199 @@
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+
+export const MAX_REMOTE_IMAGE_BYTES = 20 * 1024 * 1024;
+const MAX_REDIRECTS = 5;
+
+function parseIpv4(address) {
+  const parts = address.split('.').map(Number);
+  return parts.length === 4 && parts.every(part => Number.isInteger(part) && part >= 0 && part <= 255) ? parts : null;
+}
+
+function parseIpv6(address) {
+  const normalized = address.toLowerCase().split('%')[0];
+  if (!normalized || normalized.includes(':::')) return null;
+  const halves = normalized.split('::');
+  if (halves.length > 2) return null;
+  const parseHalf = (value) => {
+    if (!value) return [];
+    const groups = [];
+    for (const part of value.split(':')) {
+      if (part.includes('.')) {
+        const bytes = parseIpv4(part);
+        if (!bytes) return null;
+        groups.push((bytes[0] << 8) | bytes[1], (bytes[2] << 8) | bytes[3]);
+      } else if (!/^[0-9a-f]{1,4}$/.test(part)) {
+        return null;
+      } else {
+        groups.push(Number.parseInt(part, 16));
+      }
+    }
+    return groups;
+  };
+  const left = parseHalf(halves[0]);
+  const right = parseHalf(halves[1] || '');
+  if (!left || !right) return null;
+  if (halves.length === 1) return left.length === 8 ? left : null;
+  const zeros = 8 - left.length - right.length;
+  if (zeros < 1) return null;
+  return [...left, ...Array(zeros).fill(0), ...right];
+}
+
+function ipv4FromGroups(groups, index) {
+  const high = groups[index];
+  const low = groups[index + 1];
+  return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;
+}
+
+export function isPublicNetworkAddress(address) {
+  const version = isIP(address);
+  if (version === 4) {
+    const bytes = parseIpv4(address);
+    if (!bytes) return false;
+    const [a, b, c] = bytes;
+    if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
+    if (a === 100 && b >= 64 && b <= 127) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 0 && (c === 0 || c === 2)) return false;
+    if (a === 192 && b === 88 && c === 99) return false;
+    if (a === 192 && b === 168) return false;
+    if (a === 198 && (b === 18 || b === 19)) return false;
+    if (a === 198 && b === 51 && c === 100) return false;
+    if (a === 203 && b === 0 && c === 113) return false;
+    return true;
+  }
+  if (version !== 6) return false;
+  const normalized = address.toLowerCase().split('%')[0];
+  if (normalized === '::' || normalized === '::1') return false;
+  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return false;
+  if (/^fe[89ab]/.test(normalized)) return false;
+  if (normalized.startsWith('ff')) return false;
+  const groups = parseIpv6(normalized);
+  if (!groups) return false;
+  const isMappedIpv4 = groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff;
+  if (isMappedIpv4) return isPublicNetworkAddress(ipv4FromGroups(groups, 6));
+  const isCompatibleIpv4 = groups.slice(0, 6).every(group => group === 0);
+  const isNat64 = (groups[0] === 0x0064 && groups[1] === 0xff9b && groups.slice(2, 6).every(group => group === 0))
+    || (groups[0] === 0x0064 && groups[1] === 0xff9b && groups[2] === 0x0001);
+  const is6to4 = groups[0] === 0x2002;
+  const isTeredo = groups[0] === 0x2001 && groups[1] === 0;
+  const isIsatap = groups[5] === 0x5efe;
+  if (isCompatibleIpv4 || isNat64 || is6to4 || isTeredo || isIsatap) return false;
+  return !(groups[0] === 0x2001 && groups[1] === 0x0db8);
+}
+
+async function resolvePublicTarget(url, lookup = dnsLookup) {
+  if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Generated image URL must use http or https');
+  if (url.username || url.password) throw new Error('Generated image URL must not contain credentials');
+  const hostname = url.hostname.replace(/^\[|\]$/g, '');
+  const literalVersion = isIP(hostname);
+  const records = literalVersion
+    ? [{ address: hostname, family: literalVersion }]
+    : await lookup(hostname, { all: true, verbatim: true });
+  if (!Array.isArray(records) || records.length === 0) throw new Error('Generated image host did not resolve');
+  if (records.some(record => !isPublicNetworkAddress(record.address))) {
+    throw new Error('Generated image URL resolves to a private or reserved network');
+  }
+  return records[0];
+}
+
+function detectMime(buffer) {
+  if (buffer.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) return 'image/png';
+  if (buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) return 'image/jpeg';
+  const head6 = buffer.subarray(0, 6).toString('ascii');
+  if (head6 === 'GIF87a' || head6 === 'GIF89a') return 'image/gif';
+  if (buffer.subarray(0, 4).toString('ascii') === 'RIFF' && buffer.subarray(8, 12).toString('ascii') === 'WEBP') return 'image/webp';
+  return null;
+}
+
+function requestOnce(url, target, { signal, requestImpl } = {}) {
+  return new Promise((resolve, reject) => {
+    const request = requestImpl || (url.protocol === 'https:' ? httpsRequest : httpRequest);
+    let settled = false;
+    const finishReject = (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    };
+    const req = request(url, {
+      signal,
+      lookup: (_hostname, _options, callback) => callback(null, target.address, target.family),
+      headers: { accept: 'image/png,image/jpeg,image/gif,image/webp' },
+    }, response => {
+      if (settled) {
+        response.destroy();
+        return;
+      }
+      settled = true;
+      resolve(response);
+    });
+    req.on('error', finishReject);
+    req.end();
+  });
+}
+
+async function readBounded(response, maxBytes) {
+  const declared = Number(response.headers['content-length']);
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    response.destroy();
+    throw new Error('Generated image exceeds 20 MiB');
+  }
+  const chunks = [];
+  let total = 0;
+  try {
+    for await (const chunk of response) {
+      total += chunk.length;
+      if (total > maxBytes) {
+        response.destroy();
+        throw new Error('Generated image exceeds 20 MiB');
+      }
+      chunks.push(chunk);
+    }
+  } catch (err) {
+    response.destroy();
+    throw err;
+  }
+  if (total === 0) throw new Error('Generated image is empty');
+  return Buffer.concat(chunks, total);
+}
+
+export async function downloadRemoteImage(value, {
+  signal,
+  lookup = dnsLookup,
+  requestImpl,
+  maxBytes = MAX_REMOTE_IMAGE_BYTES,
+  maxRedirects = MAX_REDIRECTS,
+} = {}) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error('Image API returned an invalid image URL'); }
+  for (let redirects = 0; ; redirects++) {
+    const target = await resolvePublicTarget(url, lookup);
+    const response = await requestOnce(url, target, { signal, requestImpl });
+    const status = Number(response.statusCode || 0);
+    if (status >= 300 && status < 400 && response.headers.location) {
+      response.destroy();
+      if (redirects >= maxRedirects) throw new Error('Generated image download exceeded redirect limit');
+      const nextUrl = new URL(response.headers.location, url);
+      if (url.protocol === 'https:' && nextUrl.protocol !== 'https:') {
+        throw new Error('Generated image redirect must not downgrade HTTPS');
+      }
+      url = nextUrl;
+      continue;
+    }
+    if (status < 200 || status >= 300) {
+      response.destroy();
+      throw new Error(`Image download returned ${status}`);
+    }
+    const mimeType = String(response.headers['content-type'] || '').split(';')[0].toLowerCase();
+    if (!['image/png', 'image/jpeg', 'image/gif', 'image/webp'].includes(mimeType)) {
+      response.destroy();
+      throw new Error(`Unsupported generated image type: ${mimeType}`);
+    }
+    const buffer = await readBounded(response, maxBytes);
+    if (detectMime(buffer) !== mimeType) throw new Error('Generated image MIME does not match file bytes');
+    return { buffer, mimeType, url: url.href };
+  }
+}

package/yeaft/stop-hooks.js

@@ -74,6 +74,7 @@ export async function runStopHooks(context) {
     // row exactly once before fan-out. Each VP's stop-hook then skips
     // the user record but still writes its own assistant + tool rows.
     userAlreadyPersisted = false,
+    hasDisplayImageAnchor = false,
   } = context;
 
   // Model name for persisted messages: use primaryModel if provided, else config.model
@@ -125,6 +126,15 @@ export async function runStopHooks(context) {
         }
       }
       const recentMessages = messages.slice(turnStart);
+      const isPersistable = (msg) => Boolean(msg?.role) && (
+        (typeof msg.content === 'string' && msg.content.length > 0) ||
+        (msg.content && typeof msg.content !== 'string') ||
+        (Array.isArray(msg.toolCalls) && msg.toolCalls.length > 0) ||
+        msg.role === 'tool'
+      );
+      const imageAnchorMessage = hasDisplayImageAnchor
+        ? recentMessages.findLast(msg => msg?.role === 'assistant' && isPersistable(msg)) || null
+        : null;
       for (const msg of recentMessages) {
         if (!msg || !msg.role) continue;
         // Skip the user row if the orchestrator already wrote it once for
@@ -145,12 +155,7 @@ export async function runStopHooks(context) {
         if (userAlreadyPersisted && msg.role === 'user' && msg === recentMessages[0]) continue;
         // Allow empty assistant content when toolCalls are present;
         // tool messages have content by construction.
-        const hasContent =
-          (typeof msg.content === 'string' && msg.content.length > 0) ||
-          (msg.content && typeof msg.content !== 'string') ||
-          (Array.isArray(msg.toolCalls) && msg.toolCalls.length > 0) ||
-          msg.role === 'tool';
-        if (!hasContent) continue;
+        if (!isPersistable(msg)) continue;
 
         const record = {
           role: msg.role,
@@ -164,6 +169,7 @@ export async function runStopHooks(context) {
         if (Array.isArray(msg.toolCalls) && msg.toolCalls.length > 0) {
           record.toolCalls = msg.toolCalls;
         }
+        if (msg === imageAnchorMessage) record.imageAssetAnchor = true;
         if (msg.isError) record.isError = true;
         // Bug 6: stamp sessionId / threadId so replay can re-route by group.
         if (sessionId) record.sessionId = sessionId;