dsh-cindy-host 0.1.37 → 0.1.39

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.39 — 2026-11-07
+
+- Serve bounded, authorized project-grid WebP thumbnails through the existing file-browser contract; keep original-file reads independent of codec failures.
+- Preserve native tool/assistant image blocks through deterministic Cindy managed-media references. Resolve only the DSH attachment namespace against visible source messages and full native descriptors (including omitted optional names), verify bytes/hash/MIME, and deliver bounded thumbnails or on-demand staged originals. Keep live/history identities, source/connection fences, retry/cache budgets and explicit missing-source failures; never infer upload authority from JSON localPath.
+- Add Host regressions for generated PNG/JPEG media, legacy/canonical results, restart/history consistency, thumbnail resource/path boundaries and staging retries. No Cindy changes; publication, runtime activation and handset acceptance are separate verification steps.
+- Classify newly observed companion-live/setup-snapshot/setup-transfer channels as unsupported with exact refusal regressions. This read-only audit maintenance enables no cloud-companion, configuration migration, secret transfer or SSH authorization capability.
+
+## 0.1.38 — 2026-11-07
+
+- Show a valid `run_code` description in Cindy's collapsed tool label as a Host-only display alias. Normalize the preview to one bounded line, remove control/bidi-spoofing characters, and cap it at 120 Unicode code points without changing original input or full details.
+- Keep execution tool names, call/result identities, other tools and exact-name special cards unchanged. Share the projection between live and history reads; invalid/missing descriptions retain the original name. Add focused display/input-immutability/pairing regressions; handset rendering remains separate acceptance.
+
 ## 0.1.37 — 2026-11-06
 
 - Use explicit source-order history snapshots for both validated persistence and the hot fallback reader. Preserve legacy raw order, reconcile live reasoning through native history-live client identities, and page by source cuts; unknown cursors now fail explicitly rather than silently skipping history.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.37** stabilizes source-order history pagination, per-controller history delivery state and bounded interim reasoning updates. It retains 0.1.36's interruption controls and the earlier diagnostics, question synchronization, authentication and native capability subsets. Host regressions do not establish that handset white-screen issues are resolved.
+Version **0.1.39** adds bounded project-grid thumbnails and native tool/assistant image delivery through authorized managed-media references. It retains the earlier tool work titles, history stability and interruption controls. Thumbnail decoding reuses the Host's image codec; codec failure does not block independent original-file reads. Host regressions do not establish handset rendering or white-screen acceptance.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.37
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.39
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
@@ -95,6 +95,10 @@ Organization ID/slug/domain and email discovery check both regions. A found orga
 
 This feature ships in 0.1.33; installation and runtime activation are verified separately. Tests cover protocol, real local callbacks, settings-panel state, credential races and both regions' actual runtime URL routing with fake credentials. Real Apple/enterprise identity providers and iOS discovery/file round trips still require an authorized test account after deployment. See [authentication flow notes](doc/auth-login.md). The new browser flow is exposed by the settings page; the older interactive CLI is not a replacement for that UI on Windows.
 
+## Tool work titles on Cindy mobile (0.1.38)
+
+The Host projects `run_code` calls with a non-empty string `description` as `run_code · <description>` in Cindy’s collapsed tool row. Titles are normalized to one line and limited to a 120-code-point preview; the original input, code and full description remain in expanded details. Calls without a valid title and all other tool names keep their existing mapping. Live events and history use the same projection, and results remain paired by `toolUseId`. This is a Host-only display alias, not a renamed DSH execution tool. Reload an updated Host to apply it; existing phone-cached history may need reloading. Handset rendering has not been acceptance-tested.
+
 ## Thinking content on Cindy mobile (0.1.33)
 
 The Host sends DSH-provided public reasoning text/summaries as native structured `thinking` content (`{ text }`), not ordinary prose strings. Expand the work/activity group, then its thinking row, to read it. No Cindy or DSH core patch is needed. Models that expose no reasoning text still have nothing to show; signatures and provider-private replay metadata are never forwarded.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-message-row.js

@@ -16,6 +16,8 @@
  *   tool_result       content: anything previewable  read by `contentToPreview`
  */
 
+import { attachmentImageUrl, nativeMessageImages, toolResultWithImages } from './host-attachment-reference.js';
+
 /**
  * DSH message roles this Host renders, and the phone row role each becomes.
  *
@@ -69,8 +71,26 @@ function parseToolArguments(raw) {
  */
 const TOOL_NAME_BY_DSH_NAME = { todo_write: 'TodoWrite' };
 
-/** Map one DSH tool name to the phone's vocabulary. */
-function cindyToolName(name) {
+/**
+ * Project a tool name for Cindy's read-only transcript, never for execution.
+ * Mobile's generic tool row uses toolName as its collapsed label and leaves
+ * input.description in expanded details. Only run_code needs this display alias;
+ * special card names (notably TodoWrite) must retain their exact vocabulary.
+ */
+function cindyToolName(name, input) {
+  if (name === 'run_code' && input !== null && typeof input === 'object'
+    && !Array.isArray(input) && typeof input.description === 'string') {
+    // One bounded line, without control/bidi characters that could spoof the name.
+    // Keep the original input intact for expanded details and result pairing by ID.
+    const title = input.description
+      .replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, ' ')
+      .replace(/\s+/gu, ' ').trim();
+    const characters = Array.from(title);
+    if (characters.length > 0) {
+      const preview = characters.length > 120 ? `${characters.slice(0, 119).join('')}…` : title;
+      return `${name} · ${preview}`;
+    }
+  }
   return TOOL_NAME_BY_DSH_NAME[name] ?? name;
 }
 
@@ -296,7 +316,7 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
     const id = `${sessionId}:${message.id}:0`;
     return [{ id, clientId: id, sessionId, role: 'tool_result', toolUseId: message.toolCallId, agentMeta: null,
       createdAt: createdAt ?? now().toISOString(),
-      content: { text: flattenToolResult(message.content), isError: message.isError === true } }];
+      content: { text: toolResultWithImages(flattenToolResult(message.content), message, sessionId), isError: message.isError === true } }];
   }
   const role = ROW_ROLE_BY_MESSAGE_ROLE.get(message?.role);
   // `system` (the prompt injection), a hook's injected turn, or any role this
@@ -328,10 +348,19 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
 
   blocks.forEach((block, index) => {
     if (block === null || typeof block !== 'object') return;
+    // Native assistant images use the same locator as tool images, not a fabricated user attachment.
+    if (role === 'assistant' && block.type === 'image') {
+      const image = nativeMessageImages(message).find(image => image.blockPath === String(index));
+      const url = image && attachmentImageUrl(sessionId, message.id, image.blockPath, image.ref);
+      if (url) {
+        const id = `${sessionId}:${message.id}:${index}`;
+        const label = (image.ref.name ?? 'image').replace(/[\[\]\r\n]/g, '_');
+        rows.push({ id, clientId: id, sessionId, role: 'assistant', toolUseId: null, agentMeta: null, createdAt: time, content: `![${label}](${url})` });
+      }
+      return;
+    }
     const kind = ROLE_BY_BLOCK[block.type];
-    // Images and files are not rows of their own here: an image needs a media
-    // channel this Host does not serve, and the file's chip travels on the text
-    // row above. Emitting them as empty rows would add noise, not information.
+    // User attachments travel on their text row; unknown blocks stay silent.
     if (kind === undefined) return;
     if (toolResultMessage && block.type !== 'tool-result') return;
 
@@ -379,22 +408,24 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
           ? `${sessionId}:reasoning-stream:${identity.turn}:${identity.step}:${index}` : clientId;
         rows.push({ ...base, clientId: logical, content: { text: block.text } });
         return;
-      case 'tool-call':
+      case 'tool-call': {
+        const input = parseToolArguments(block.arguments);
         rows.push({
           ...base,
           toolUseId: typeof block.id === 'string' ? block.id : null,
           content: {
-            toolName: typeof block.name === 'string' ? cindyToolName(block.name) : '',
-            input: parseToolArguments(block.arguments),
+            toolName: typeof block.name === 'string' ? cindyToolName(block.name, input) : '',
+            input,
             ...(typeof block.id === 'string' ? { toolUseId: block.id } : {}),
           },
         });
         return;
+      }
       case 'tool-result':
         rows.push({
           ...base,
           toolUseId: typeof block.toolCallId === 'string' ? block.toolCallId : null,
-          content: { text: flattenToolResult(block.content), isError: block.isError === true },
+          content: { text: toolResultWithImages(flattenToolResult(block.content), message, sessionId, index), isError: block.isError === true },
         });
         return;
       default:

package/src/dsh-plugin.js

@@ -23,6 +23,7 @@ import { createHistoryViewController } from './host-history-view.js';
 import { createFileReader } from './host-files.js';
 import { createFileBrowser } from './host-file-browser.js';
 import { createAttachmentMaterializer } from './host-attachments.js';
+import { createNativeAttachmentSourceReader } from './host-attachment-media.js';
 import { createGoalWriter } from './host-goals.js';
 import { startHost } from './host.js';
 import { refusalError } from './cindy-channels.js';
@@ -654,6 +655,11 @@ export function buildDshSource(ctx, serviceName, options = {}) {
         return null;
       }
     };
+    const readAttachmentSource = createNativeAttachmentSourceReader({
+      getSession: sessionId => sessionSource.getSession(sessionId),
+      readSessionLog: sessionQuery === undefined ? undefined : sessionId => sessionQuery.readSession(sessionId),
+      readImage: readImageAttachment,
+    });
     const readMessages = sessionQuery === undefined
       ? undefined
       : createMessageReader({ readSessionLog: (sessionId) => sessionQuery.readSession(sessionId), readImageAttachment });
@@ -839,6 +845,7 @@ export function buildDshSource(ctx, serviceName, options = {}) {
       // Reported through the status route: "the photo does not render" has three
       // indistinguishable causes from the outside, and this separates them.
       attachmentReads,
+      readAttachmentSource,
       // Internal plumbing rather than a controller capability: the live push path has to inline a
       // message's images before the row leaves, exactly like the two read paths do. It rides the
       // seam so there is **one** hydrator (`hydrateRows`) instead of one per caller — a second
@@ -1485,6 +1492,7 @@ export function capabilityProvider(sources) {
     // NOT_AVAILABLE while the controller sat right here (the `queueControl` failure).
     historyView: sources.historyView,
     attachmentReads: sources.attachmentReads,
+    readAttachmentSource: sources.readAttachmentSource,
     // Internal (the live push path), but it crosses the same seam, so it is forwarded here: the
     // invariant test in `test/dsh-plugin.test.js` requires every seam key to be reachable, and a
     // key that exists but is reachable from nowhere is exactly the bug class this repo keeps

package/src/host-attachment-media.js

@@ -0,0 +1,97 @@
+import { createHash } from 'node:crypto';
+import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
+import { nativeMessageImages, attachmentImageUrl, parseAttachmentImageUrl, isImageDescriptor } from './host-attachment-reference.js';
+import { renderBoundedThumbnail } from './host-file-thumbnail.js';
+import { MEDIA_FETCH_MAX_BYTES, INLINE_ORIGINAL_MAX_BYTES, STAGING_CACHE_MAX, STAGING_CACHE_TTL_MS, isThumbnailableMime } from './host-media-fetch.js';
+
+const failure = (code, message) => ({ ok: false, code, message });
+
+/** Reconstruct from the authorized source log on every request, including after restart. */
+export function createNativeAttachmentSourceReader({ getSession, readSessionLog, readImage }) {
+  return async locator => {
+    if (typeof getSession !== 'function' || typeof readSessionLog !== 'function' || typeof readImage !== 'function')
+      return failure('NOT_AVAILABLE', 'native attachment services unavailable');
+    try {
+      if (!await getSession(locator.sessionId)) return failure('FORBIDDEN', 'source session unavailable');
+      const log = await readSessionLog(locator.sessionId);
+      let ref;
+      for (const event of Array.isArray(log?.events) ? log.events : []) {
+        if (!event || !isAppendSurfaceEvent(event)) continue;
+        const message = deriveEventMessage(event);
+        if (message?.id !== locator.messageId) continue;
+        const image = nativeMessageImages(message).find(image => image.blockPath === locator.blockPath);
+        if (image?.ref.attachmentId === locator.attachmentId && image.ref.mediaType === locator.mediaType) ref = image.ref;
+        break;
+      }
+      if (!ref) return failure('MEDIA_SOURCE_MISSING', 'source image no longer available');
+      if (ref.bytes > MEDIA_FETCH_MAX_BYTES) return failure('BAD_REQUEST', 'source image exceeds media budget');
+      const stored = await readImage(ref);
+      if (!stored || typeof stored.base64 !== 'string') return failure('MEDIA_SOURCE_MISSING', 'source image no longer readable');
+      return { ok: true, ref, bytes: Buffer.from(stored.base64, 'base64') };
+    } catch { return failure('MEDIA_SOURCE_MISSING', 'source image no longer readable'); }
+  };
+}
+
+/** These URLs do not name paths, so they never enter the arbitrary local-file resolver. */
+export function createAttachmentMediaFetcher({ readSource, uploader, render = renderBoundedThumbnail, now = Date.now, maxBytes = MEDIA_FETCH_MAX_BYTES, getScope = () => 0, isAllowed = () => true, maxConcurrent = 4 } = {}) {
+  const staged = new Map();
+  const flights = new Map();
+  const inline = (mimeType, bytes) => ({ ok: true, result: { ossKey: '', mimeType, size: bytes.length, inlineBase64: bytes.toString('base64') } });
+  let active = 0;
+  async function fetchImage(input) {
+    const locator = parseAttachmentImageUrl(input?.url);
+    if (!locator) return failure('BAD_REQUEST', 'invalid DSH attachment image locator');
+    const scope = getScope();
+    const current = () => scope !== null && getScope() === scope && isAllowed(locator);
+    const superseded = () => failure('FORBIDDEN', 'image request authorization changed');
+    if (!current()) return superseded();
+    if (typeof readSource !== 'function') return failure('NOT_AVAILABLE', 'native attachment reader unavailable');
+    // Authorization and current source existence are checked even on a staging-cache hit.
+    let source;
+    try { source = await readSource(locator); } catch { return failure('MEDIA_SOURCE_MISSING', 'source image unreadable'); }
+    if (!current()) return superseded();
+    if (!source?.ok) return source ?? failure('MEDIA_SOURCE_MISSING', 'source image unavailable');
+    const { ref, bytes } = source;
+    if (!isImageDescriptor(ref) || attachmentImageUrl(locator.sessionId, locator.messageId, locator.blockPath, ref) !== input.url
+      || !Buffer.isBuffer(bytes) || bytes.length !== ref.bytes
+      || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== ref.attachmentId)
+      return failure('MEDIA_SOURCE_MISSING', 'source image descriptor mismatch');
+    if (bytes.length > maxBytes) return failure('BAD_REQUEST', 'source image exceeds media budget');
+    if (input?.prepareOnly === true && input?.thumbnail !== true)
+      return failure('NOT_AVAILABLE', 'native attachment images use media fetch, not file-peer');
+    const cacheKey = `${scope}:${ref.attachmentId}`;
+    const key = `${cacheKey}:${input?.thumbnail === true ? 'thumbnail' : 'original'}:${input?.skipCache === true ? 'refresh' : 'cached'}`;
+    if (flights.has(key)) {
+      const result = await flights.get(key);
+      return current() ? result : superseded();
+    }
+    const work = Promise.resolve().then(async () => {
+      if (!current()) return superseded();
+      if (input?.thumbnail === true) {
+        let thumb;
+        try { thumb = isThumbnailableMime(ref.mediaType) ? await render(bytes) : null; } catch { thumb = null; }
+        if (!current()) return superseded();
+        if (thumb?.ok && Buffer.isBuffer(thumb.data) && thumb.data.length > 0 && thumb.data.length <= 700 * 1024) return inline('image/webp', thumb.data);
+        if (bytes.length <= INLINE_ORIGINAL_MAX_BYTES) return inline(ref.mediaType, bytes);
+      }
+      if (typeof uploader !== 'function') return failure('NOT_AVAILABLE', 'media staging unavailable');
+      const cached = staged.get(cacheKey);
+      if (input?.skipCache !== true && cached && cached.at + STAGING_CACHE_TTL_MS > now()) return { ok: true, result: { ...cached.result } };
+      if (!current()) return superseded();
+      const result = await uploader(bytes, { ext: locator.ext, contentType: ref.mediaType });
+      if (!current()) return superseded();
+      if (!result?.ok || typeof result.key !== 'string' || !result.key) return failure('INTERNAL', 'image staging failed; retry later');
+      const answer = { ossKey: result.key, mimeType: ref.mediaType, size: bytes.length };
+      staged.set(cacheKey, { at: now(), result: answer });
+      while (staged.size > STAGING_CACHE_MAX) staged.delete(staged.keys().next().value);
+      return { ok: true, result: answer };
+    }).catch(() => failure('INTERNAL', 'image staging failed; retry later')).finally(() => flights.delete(key));
+    flights.set(key, work);
+    return work;
+  }
+  return async input => {
+    if (active >= maxConcurrent) return failure('INTERNAL', 'image reader busy; retry later');
+    active++;
+    try { return await fetchImage(input); } finally { active--; }
+  };
+}

package/src/host-attachment-reference.js

@@ -0,0 +1,46 @@
+/** Deterministic, non-bearer locators. No path or caller-supplied descriptor is admitted. */
+const EXT = Object.freeze({ 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif' });
+const token = value => Buffer.from(value, 'utf8').toString('base64url');
+export function isImageDescriptor(ref) {
+  return ref && /^sha256:[a-f0-9]{64}$/.test(ref.attachmentId) && Object.hasOwn(EXT, ref.mediaType)
+    && Number.isSafeInteger(ref.bytes) && ref.bytes > 0
+    && Number.isSafeInteger(ref.width) && ref.width > 0 && Number.isSafeInteger(ref.height) && ref.height > 0
+    && (ref.name === undefined || typeof ref.name === 'string');
+}
+export function attachmentImageUrl(sessionId, messageId, blockPath, ref) {
+  if (![sessionId, messageId].every(v => typeof v === 'string' && v.length > 0 && v.length <= 256)
+    || !/^(0|[1-9][0-9]{0,5})(\.(0|[1-9][0-9]{0,5}))?$/.test(blockPath) || !isImageDescriptor(ref)) return null;
+  return `xdt-image://dsh-attachment/v1/${token(sessionId)}/${token(messageId)}/${blockPath}/${ref.attachmentId.slice(7)}.${EXT[ref.mediaType]}`;
+}
+export function parseAttachmentImageUrl(url) {
+  if (typeof url !== 'string' || url.length > 2048) return null;
+  const match = /^xdt-image:\/\/dsh-attachment\/v1\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)\/((?:0|[1-9][0-9]{0,5})(?:\.(?:0|[1-9][0-9]{0,5}))?)\/([a-f0-9]{64})\.(png|jpg|webp|gif)$/.exec(url);
+  if (!match) return null;
+  const [, sid, mid, blockPath, hash, ext] = match;
+  const sessionId = Buffer.from(sid, 'base64url').toString('utf8');
+  const messageId = Buffer.from(mid, 'base64url').toString('utf8');
+  if (!sessionId || !messageId || sessionId.length > 256 || messageId.length > 256 || token(sessionId) !== sid || token(messageId) !== mid) return null;
+  return { sessionId, messageId, blockPath, attachmentId: `sha256:${hash}`, mediaType: Object.keys(EXT).find(mime => EXT[mime] === ext), ext };
+}
+
+/** Only native image blocks in renderable model/tool messages, never JSON text. */
+export function nativeMessageImages(message) {
+  const source = message?.source?.kind;
+  const direct = message?.role === 'tool' && (!source || source === 'tool')
+    || message?.role === 'assistant' && (!source || source === 'model');
+  const legacy = message?.role === 'user' && (!source || source === 'tool');
+  const found = [];
+  for (const [index, block] of (Array.isArray(message?.content) ? message.content : []).entries()) {
+    if (direct && block?.type === 'image' && isImageDescriptor(block.attachment)) found.push({ blockPath: String(index), ref: block.attachment });
+    if (legacy && block?.type === 'tool-result' && Array.isArray(block.content)) {
+      for (const [child, nested] of block.content.entries())
+        if (nested?.type === 'image' && isImageDescriptor(nested.attachment)) found.push({ blockPath: `${index}.${child}`, ref: nested.attachment });
+    }
+  }
+  return found;
+}
+export function toolResultWithImages(text, message, sessionId, resultIndex = null) {
+  const urls = nativeMessageImages(message).filter(image => resultIndex === null || image.blockPath.startsWith(`${resultIndex}.`))
+    .map(image => attachmentImageUrl(sessionId, message.id, image.blockPath, image.ref)).filter(Boolean);
+  return urls.length ? JSON.stringify({ text, xdt_image_urls: urls }) : text;
+}

package/src/host-file-browser.js

@@ -17,6 +17,8 @@
  *    reference host returns for an op it does not know.
  */
 
+import { fileThumbnail } from './host-file-thumbnail.js';
+
 /** Longest file this Host will inline for `readFile`. */
 export const READ_LIMIT_BYTES = 1024 * 1024;
 
@@ -147,7 +149,7 @@ function looksBinary(text) {
  * @param options - the filesystem service, plus injectable limits.
  * @returns `(args) => Promise<unknown>`, one result per op.
  */
-export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTES, listAllLimit = LIST_ALL_LIMIT }) {
+export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTES, listAllLimit = LIST_ALL_LIMIT, thumbnail = fileThumbnail }) {
   if (fileSystem === undefined || fileSystem === null) throw new Error('createFileBrowser requires a filesystem service');
 
   /** Resolve a workdir-relative path, or null when it escapes or cannot resolve. */
@@ -379,17 +381,11 @@ export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTE
     // reason* answer in their own documented shape, so the controller degrades
     // deliberately instead of showing a transport-looking failure.
     //
-    //  - `thumbnail` needs an image pipeline that produces the `image/webp` data
-    //    URL the controller expects; `THUMB_UNSUPPORTED` is the reference host's
-    //    own code for "this host cannot make one".
-    //  - `exportFileStart` hands a file on this machine to the account's staging area
-    //    so the *controller* can download it — the reverse of the attachment flow this
-    //    Host does serve (there it fetches what the phone uploaded). Uploading on
-    //    demand, with the progress polling `exportFileStatus` implies, is a transfer
-    //    manager rather than a read, and is not served.
-    if (op === 'thumbnail') {
-      return { ok: false, code: 'THUMB_UNSUPPORTED', message: 'this Host generates no thumbnails' };
-    }
+    // Thumbnail failures retain Cindy's THUMB_* result shape; original file reads
+    // remain independent of codec availability.
+    // Export jobs are intercepted by cindy-channels before reaching this reader;
+    // a standalone reader has no transfer manager and refuses those operations.
+    if (op === 'thumbnail') return thumbnail({ workdir, relPath });
     if (op === 'exportFileStart' || op === 'exportFileStatus') {
       return { ok: false, message: 'file export needs the Cindy media pipeline, which this Host does not serve' };
     }

package/src/host-file-thumbnail.js

@@ -0,0 +1,67 @@
+import { createLocalFileResolver, readPreparedInline, resolveThumbnailCodec } from './host-media-fetch.js';
+import { createLocalFileUrl } from './host-file-reference.js';
+
+export const GRID_THUMBNAIL_LIMITS = Object.freeze({ edge: 256, quality: 70, outputBytes: 128 * 1024 });
+export const IMAGE_INPUT_BYTES = 48 * 1024 * 1024;
+export const IMAGE_INPUT_PIXELS = 40_000_000;
+
+const failed = (code, message) => ({ ok: false, code, message });
+
+/** Soft deadlines do not release the concurrency slot until native work actually settles. */
+export function createThumbnailRenderer({ codec = resolveThumbnailCodec, concurrency = 2, timeoutMs = 5000 } = {}) {
+  let active = 0;
+  let loaded;
+  return async function render(bytes, { edge = 1024, quality = 80, outputBytes = 700 * 1024 } = {}) {
+    if (!Buffer.isBuffer(bytes) || bytes.length === 0 || bytes.length > IMAGE_INPUT_BYTES)
+      return failed('THUMB_TOO_LARGE', 'invalid or oversized input');
+    if (active >= concurrency) return failed('THUMB_FAILED', 'thumbnail renderer busy; retry later');
+    try { loaded ??= codec(); } catch { return failed('THUMB_UNSUPPORTED', 'image codec unavailable'); }
+    if (typeof loaded !== 'function') return failed('THUMB_UNSUPPORTED', 'image codec unavailable');
+    active++;
+    let timer;
+    const work = Promise.resolve().then(async () => {
+      const out = await loaded(bytes, { limitInputPixels: IMAGE_INPUT_PIXELS, failOn: 'error', animated: false })
+        .rotate().resize({ width: edge, height: edge, fit: 'inside', withoutEnlargement: true })
+        .webp({ quality }).toBuffer({ resolveWithObject: true });
+      if (!Buffer.isBuffer(out?.data) || !out.data.length || out.data.length > outputBytes)
+        return failed('THUMB_TOO_LARGE', 'thumbnail exceeds output budget');
+      if (![out.info?.width, out.info?.height].every(n => Number.isInteger(n) && n > 0 && n <= edge))
+        return failed('THUMB_FAILED', 'invalid thumbnail dimensions');
+      return { ok: true, data: out.data, width: out.info.width, height: out.info.height, mimeType: 'image/webp' };
+    }).catch(() => failed('THUMB_FAILED', 'image could not be decoded')).finally(() => { active--; });
+    try {
+      return await Promise.race([work, new Promise(resolve => {
+        timer = setTimeout(() => resolve(failed('THUMB_FAILED', 'thumbnail render timeout')), timeoutMs);
+      })]);
+    } finally { clearTimeout(timer); }
+  };
+}
+
+export const renderBoundedThumbnail = createThumbnailRenderer();
+
+/** Local-only file browser thumbnails reuse the exact authorization boundary of fileUrl. */
+export function createFileThumbnail({
+  resolveFile = createLocalFileResolver({ maxBytes: IMAGE_INPUT_BYTES }),
+  readBytes = readPreparedInline, render = renderBoundedThumbnail,
+} = {}) {
+  const fileUrl = createLocalFileUrl({ resolveFile });
+  let active = 0;
+  return async function thumbnail({ workdir, relPath } = {}) {
+    if (active >= 2) return failed('THUMB_FAILED', 'thumbnail reader busy; retry later');
+    active++;
+    try {
+      const reference = await fileUrl({ workdir, relPath });
+      if (!reference.ok) return failed(reference.code === 'BAD_REQUEST' && /byte limit/.test(reference.message) ? 'THUMB_TOO_LARGE' : 'THUMB_FAILED', 'image path is unavailable, not allowed or too large');
+      const source = await resolveFile(reference.url);
+      if (!source.ok) return failed('THUMB_FAILED', 'image path is unavailable or not allowed');
+      if (source.info.size > IMAGE_INPUT_BYTES) return failed('THUMB_TOO_LARGE', 'image exceeds input budget');
+      const bytes = await readBytes(source.real, source.info);
+      const result = await render(bytes, GRID_THUMBNAIL_LIMITS);
+      if (!result.ok) return result;
+      return { ok: true, dataBase64: result.data.toString('base64'), mimeType: result.mimeType, width: result.width, height: result.height };
+    } catch { return failed('THUMB_FAILED', 'image changed or could not be read'); }
+    finally { active--; }
+  };
+}
+
+export const fileThumbnail = createFileThumbnail();

package/src/host-frame-budget.js

@@ -31,6 +31,8 @@
  * character, and a page of base64 images is 4/3 of their size.
  */
 
+import { parseAttachmentImageUrl } from './host-attachment-reference.js';
+
 /**
  * The relay's hard frame ceiling, mirrored from `@cindy/device-link-protocol`.
  *
@@ -119,6 +121,30 @@ export function cutToBytes(text, limit) {
   return { text: `${text.slice(0, cut)}${TRUNCATION_SUFFIX}`, cut: true };
 }
 
+/** Keep Host-derived media JSON parseable when long tool text is compacted. */
+function cutManagedImageResult(text, limit) {
+  if (typeof text !== 'string' || !text.includes('xdt_image_urls') || byteLength(text) <= limit) return null;
+  let parsed;
+  try { parsed = JSON.parse(text); } catch { return null; }
+  if (typeof parsed?.text !== 'string' || !Array.isArray(parsed.xdt_image_urls) || !parsed.xdt_image_urls.length
+    || Object.keys(parsed).some(key => key !== 'text' && key !== 'xdt_image_urls')
+    || !parsed.xdt_image_urls.every(url => parseAttachmentImageUrl(url))) return null;
+  const urls = [...parsed.xdt_image_urls];
+  const encode = body => JSON.stringify({ text: body, xdt_image_urls: urls });
+  const suffix = () => TRUNCATION_SUFFIX + (urls.length < parsed.xdt_image_urls.length ? `\n[${parsed.xdt_image_urls.length - urls.length} image references omitted]` : '');
+  while (urls.length && byteLength(encode(suffix())) > limit) urls.pop();
+  let low = 0; let high = parsed.text.length;
+  const prefix = length => {
+    const value = parsed.text.slice(0, length);
+    return /[\uD800-\uDBFF]$/.test(value) ? value.slice(0, -1) : value;
+  };
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (byteLength(encode(prefix(middle) + suffix())) <= limit) low = middle; else high = middle - 1;
+  }
+  return { text: encode(prefix(low) + suffix()), cut: true };
+}
+
 /** `agentMeta` with the truncation witness merged in, as the reference marks it. */
 function markContentTruncated(agentMeta) {
   const base = agentMeta !== null && typeof agentMeta === 'object' && !Array.isArray(agentMeta) ? agentMeta : {};
@@ -152,7 +178,7 @@ export function compactRowText(rows) {
     }
     if (content === null || typeof content !== 'object' || Array.isArray(content)) return row;
     if (row.role === 'tool_result' || row.role === 'tool-use') {
-      const result = cutToBytes(content.text, TOOL_RESULT_LIMIT);
+      const result = cutManagedImageResult(content.text, TOOL_RESULT_LIMIT) ?? cutToBytes(content.text, TOOL_RESULT_LIMIT);
       if (result.cut) {
         changed = true;
         return { ...row, content: { ...content, text: result.text }, agentMeta: markContentTruncated(row.agentMeta) };

package/src/host-media-fetch.js

@@ -349,7 +349,7 @@ function sameFileVersion(before, after) {
 }
 
 /** Read at most the authorized size plus one sentinel byte, even if the file grows. */
-async function readPreparedInline(real, info, open, stat) {
+export async function readPreparedInline(real, info, open = openImpl, stat = statImpl) {
   const file = await open(real, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOFOLLOW ?? 0));
   try {
     if (!sameFileVersion(info, await file.stat())) throw new Error('file changed');

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.37';
+export const HOST_PLUGIN_VERSION = '0.1.39';

package/src/host.js

@@ -49,6 +49,7 @@ import { MAX_ATTACHMENT_BYTES } from './host-attachments.js';
 import { createMediaRefResolver, createMediaReleaser, createMediaUploader, mediaApiBaseUrl, isAttachmentOssRef } from './host-media.js';
 import { createLocalMediaFetcher, createLocalFileResolver, isBlockedMediaPath, isInsideDirectory, mimeForMediaPath } from './host-media-fetch.js';
 import { createFilePeerManager } from './host-file-peer.js';
+import { createAttachmentMediaFetcher } from './host-attachment-media.js';
 import { createFileIceLoader } from './host-file-ice.js';
 import { createLocalFileUrl } from './host-file-reference.js';
 import { FILE_PEER_MAX_BYTES } from './file-peer-protocol.js';
@@ -256,7 +257,20 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * uploader as the file browser's export ops, stricter request handling
    * (`host-media-fetch.js`): a containment root is mandatory and both sides are realpath'd.
    */
-  const fetchLocalMedia = createLocalMediaFetcher({ uploader: uploadMedia });
+  const fetchFileMedia = createLocalMediaFetcher({ uploader: uploadMedia });
+  const fetchAttachmentMedia = createAttachmentMediaFetcher({
+    uploader: uploadMedia,
+    getScope: () => stopped ? null : `${generation}:${sourceRevision}`,
+    isAllowed: locator => !sessionIsHidden(locator.sessionId),
+    readSource: async locator => {
+    if (sessionIsHidden(locator.sessionId)) return { ok: false, code: 'FORBIDDEN', message: 'source session unavailable' };
+    const capabilities = typeof options.resolveCapabilities === 'function' ? options.resolveCapabilities() : {};
+    return typeof capabilities.readAttachmentSource === 'function'
+      ? capabilities.readAttachmentSource(locator)
+      : { ok: false, code: 'NOT_AVAILABLE', message: 'native attachment reader unavailable' };
+  } });
+  const fetchLocalMedia = input => typeof input?.url === 'string' && input.url.startsWith('xdt-image://')
+    ? fetchAttachmentMedia(input) : fetchFileMedia(input);
   const resolvePeerFile = createLocalFileResolver({ maxBytes: FILE_PEER_MAX_BYTES });
   const fileUrl = createLocalFileUrl({ resolveFile: resolvePeerFile });