airlok 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to airlok. The format follows Keep a Changelog; versions follow SemVer.
 
+## [0.9.2] - 2026-09-13
+
+### Added
+
+- Image input. Ctrl+V, or Alt+V, attaches an image from the clipboard and puts a chip like `[image 1: 1024x768 png, 210 KB]` in the line at the cursor, so the sentence can refer to it. Several images fit in one message. The backend is chosen per platform, `osascript` on macOS, `wl-paste` then `xclip` on Linux after checking a display server is running at all, and PowerShell on Windows; `-v` names the one that ran.
+- A path to an image, whether typed, Tab-completed or dropped into the terminal, is offered as an attachment. Taken, it becomes a chip and the picture is what the model gets; refused, the text stays exactly as typed. A path that does not exist, or is not an image, is left alone.
+- `ContentBlock::Image` in the llm crate, sent as base64 on all three wire shapes: Anthropic's `source` object, Chat Completions' `image_url` data URL, and the Responses API's `input_image`. Anything over 1568px on the long edge is downscaled and anything over 5 MB is re-encoded, with a line saying what was done; a message whose images come to more than 20 MB is refused.
+- `[safety] confirm_images`, on by default, asks before an image leaves, because an image cannot be scanned for secrets. `--yes` skips it like the other confirmations, and `/permissions` shows and sets it.
+- `[models."<id>"] vision = false` makes a model that takes no images refuse at attach time, naming the model, instead of failing the turn later as a provider error. A provider that rejects an image now explains itself in terms of that setting.
+
+### Fixed
+
+- Session files record an image as its hash, dimensions and format, never its bytes, so `--resume` shows that an image was sent without keeping it. A resumed image becomes a line of text on the way to the provider, since there are no bytes left to send.
+- An image is estimated at a flat token cost rather than the length of its base64. Counting those characters read one screenshot as hundreds of thousands of tokens, which compacted the session on the next turn and made `/context` and the token counter nonsense.
+
 ## [0.9.1] - 2026-09-13
 
 ### Added

package/README.md

@@ -55,6 +55,8 @@ While a turn runs, a status line below the output shows a spinner, what airlok i
 | Tab | take the first `/` command, `@` path, or command argument on offer; Tab again cycles through the rest |
 | Right arrow | take the rest of the `/` command shown after the cursor |
 | Esc or Ctrl-C | during a turn, cancel it |
+| Ctrl+V | attach an image from the clipboard. A chip like `[image 1: 1024x768 png, 210 KB]` goes in at the cursor, so the sentence can refer to it; several fit in one message. Alt+V does the same, for terminals that keep Ctrl+V for themselves. Every failure says why on its own line |
+| a path to an image | typed, Tab-completed or dropped into the terminal, a path ending `.png`, `.jpg`, `.jpeg`, `.gif` or `.webp` is offered as an attachment. Approved, it becomes a chip, so the model gets the picture rather than the path; refused, it stays as typed |
 | Ctrl-C | at the prompt, clear the line; on an empty line it does nothing |
 | Ctrl-D | save and quit |
 | Ctrl-R | search this run's history; Up and Down step through it |
@@ -267,6 +269,7 @@ keep_recent_turns = 4    # turns kept verbatim after the summary
 [safety]
 confirm_writes = true    # show a diff and ask before write_file / edit_file
 confirm_bash = true      # ask before running a command that is not allow-listed
+confirm_images = true    # ask before sending an image, which cannot be scanned for secrets
 bash_allowlist = ["git status", "git diff", "ls", "cat", "pwd", "find", "grep", "rg", "cargo check", "cargo test", "cargo build"]
 bash_denylist = ["rm -rf", "git push --force", "sudo"]
 
@@ -279,6 +282,7 @@ show_secrets_in_output = false   # show secrets from files in full in the termin
 [models."gpt-6-astra"]    # settings for one model id (the deployment name on Azure); none by default
 reasoning_effort = "none" # openai only, sent as reasoning_effort; not validated
 api = "responses"         # openai only, overrides [provider] api for this model
+vision = false            # the model takes no images, so airlok refuses at attach time
 ```
 
 For openai, `base_url` falls back to the `OPENAI_BASE_URL` environment variable when the config does not set it.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT OR Apache-2.0",
       "name": "airlok",
-      "version": "0.9.1"
+      "version": "0.9.2"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.9.1"
+  "version": "0.9.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/airlok-dev/airlok/releases/download/v0.9.1"
+    "https://github.com/airlok-dev/airlok/releases/download/v0.9.2"
   ],
   "bin": {
     "airlok": "run-airlok.js"
@@ -60,7 +60,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.9.1",
+  "version": "0.9.2",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"