dsh-cindy-host 0.1.38 → 0.1.40

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.40 — 2026-11-07
+
+- Declare `source: 'desktop'` consistently on ordinary DSH task rows in session lists and direct detail reads, independently of model/provider identity. Let Cindy recognize known ordinary-task provenance without requiring an extra source-confirmation lookup before mounting the chat.
+- Preserve provenance when history counts are unavailable and keep missing tasks as explicit `NOT_FOUND` failures. Add projection/router regressions without changing authorization, source logs, provider selection, Cindy code or its cache implementation; handset re-entry/cache behavior remains separate acceptance.
+
+## 0.1.39 — 2026-11-07
+
+- Serve bounded, authorized project-grid WebP thumbnails through the existing file-browser contract; keep original-file reads independent of codec failures.
+- Preserve native tool/assistant image blocks through deterministic Cindy managed-media references. Resolve only the DSH attachment namespace against visible source messages and full native descriptors (including omitted optional names), verify bytes/hash/MIME, and deliver bounded thumbnails or on-demand staged originals. Keep live/history identities, source/connection fences, retry/cache budgets and explicit missing-source failures; never infer upload authority from JSON localPath.
+- Add Host regressions for generated PNG/JPEG media, legacy/canonical results, restart/history consistency, thumbnail resource/path boundaries and staging retries. No Cindy changes; publication, runtime activation and handset acceptance are separate verification steps.
+- Classify newly observed companion-live/setup-snapshot/setup-transfer channels as unsupported with exact refusal regressions. This read-only audit maintenance enables no cloud-companion, configuration migration, secret transfer or SSH authorization capability.
+
 ## 0.1.38 — 2026-11-07
 
 - Show a valid `run_code` description in Cindy's collapsed tool label as a Host-only display alias. Normalize the preview to one bounded line, remove control/bidi-spoofing characters, and cap it at 120 Unicode code points without changing original input or full details.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.38** shows valid `run_code` work descriptions in Cindy's collapsed tool labels without renaming execution tools or changing call/result pairing. It retains the earlier history stability, interruption controls and native capability subsets. Host regressions do not establish handset rendering or white-screen acceptance.
+Version **0.1.40** declares ordinary-task provenance consistently in session list/detail rows, independent of the model provider, so Cindy can recognize known DSH tasks without an additional source-confirmation lookup. It retains the earlier image delivery, thumbnails, work titles, history stability and interruption controls. It does not implement a new phone cache; handset re-entry, rendering and white-screen acceptance remain separate.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.38
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.40
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-message-row.js

@@ -16,6 +16,8 @@
  *   tool_result       content: anything previewable  read by `contentToPreview`
  */
 
+import { attachmentImageUrl, nativeMessageImages, toolResultWithImages } from './host-attachment-reference.js';
+
 /**
  * DSH message roles this Host renders, and the phone row role each becomes.
  *
@@ -314,7 +316,7 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
     const id = `${sessionId}:${message.id}:0`;
     return [{ id, clientId: id, sessionId, role: 'tool_result', toolUseId: message.toolCallId, agentMeta: null,
       createdAt: createdAt ?? now().toISOString(),
-      content: { text: flattenToolResult(message.content), isError: message.isError === true } }];
+      content: { text: toolResultWithImages(flattenToolResult(message.content), message, sessionId), isError: message.isError === true } }];
   }
   const role = ROW_ROLE_BY_MESSAGE_ROLE.get(message?.role);
   // `system` (the prompt injection), a hook's injected turn, or any role this
@@ -346,10 +348,19 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
 
   blocks.forEach((block, index) => {
     if (block === null || typeof block !== 'object') return;
+    // Native assistant images use the same locator as tool images, not a fabricated user attachment.
+    if (role === 'assistant' && block.type === 'image') {
+      const image = nativeMessageImages(message).find(image => image.blockPath === String(index));
+      const url = image && attachmentImageUrl(sessionId, message.id, image.blockPath, image.ref);
+      if (url) {
+        const id = `${sessionId}:${message.id}:${index}`;
+        const label = (image.ref.name ?? 'image').replace(/[\[\]\r\n]/g, '_');
+        rows.push({ id, clientId: id, sessionId, role: 'assistant', toolUseId: null, agentMeta: null, createdAt: time, content: `![${label}](${url})` });
+      }
+      return;
+    }
     const kind = ROLE_BY_BLOCK[block.type];
-    // Images and files are not rows of their own here: an image needs a media
-    // channel this Host does not serve, and the file's chip travels on the text
-    // row above. Emitting them as empty rows would add noise, not information.
+    // User attachments travel on their text row; unknown blocks stay silent.
     if (kind === undefined) return;
     if (toolResultMessage && block.type !== 'tool-result') return;
 
@@ -414,7 +425,7 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
         rows.push({
           ...base,
           toolUseId: typeof block.toolCallId === 'string' ? block.toolCallId : null,
-          content: { text: flattenToolResult(block.content), isError: block.isError === true },
+          content: { text: toolResultWithImages(flattenToolResult(block.content), message, sessionId, index), isError: block.isError === true },
         });
         return;
       default:

package/src/cindy-session-row.js

@@ -76,6 +76,11 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
   return {
     id,
     title,
+    // DSH projects ordinary user tasks, not Cindy Make/bot sessions. The phone's
+    // entry gate requires explicit provenance before mounting the chat and its
+    // local history cache; omitting it forces an extra remote lookup on re-entry.
+    // This is task provenance, independent of the model's providerId below.
+    source: 'desktop',
     createdAt,
     updatedAt,
     // `'active' | 'archived' | 'deleted'`; the controller's default status filter

package/src/dsh-plugin.js

@@ -23,6 +23,7 @@ import { createHistoryViewController } from './host-history-view.js';
 import { createFileReader } from './host-files.js';
 import { createFileBrowser } from './host-file-browser.js';
 import { createAttachmentMaterializer } from './host-attachments.js';
+import { createNativeAttachmentSourceReader } from './host-attachment-media.js';
 import { createGoalWriter } from './host-goals.js';
 import { startHost } from './host.js';
 import { refusalError } from './cindy-channels.js';
@@ -654,6 +655,11 @@ export function buildDshSource(ctx, serviceName, options = {}) {
         return null;
       }
     };
+    const readAttachmentSource = createNativeAttachmentSourceReader({
+      getSession: sessionId => sessionSource.getSession(sessionId),
+      readSessionLog: sessionQuery === undefined ? undefined : sessionId => sessionQuery.readSession(sessionId),
+      readImage: readImageAttachment,
+    });
     const readMessages = sessionQuery === undefined
       ? undefined
       : createMessageReader({ readSessionLog: (sessionId) => sessionQuery.readSession(sessionId), readImageAttachment });
@@ -839,6 +845,7 @@ export function buildDshSource(ctx, serviceName, options = {}) {
       // Reported through the status route: "the photo does not render" has three
       // indistinguishable causes from the outside, and this separates them.
       attachmentReads,
+      readAttachmentSource,
       // Internal plumbing rather than a controller capability: the live push path has to inline a
       // message's images before the row leaves, exactly like the two read paths do. It rides the
       // seam so there is **one** hydrator (`hydrateRows`) instead of one per caller — a second
@@ -1485,6 +1492,7 @@ export function capabilityProvider(sources) {
     // NOT_AVAILABLE while the controller sat right here (the `queueControl` failure).
     historyView: sources.historyView,
     attachmentReads: sources.attachmentReads,
+    readAttachmentSource: sources.readAttachmentSource,
     // Internal (the live push path), but it crosses the same seam, so it is forwarded here: the
     // invariant test in `test/dsh-plugin.test.js` requires every seam key to be reachable, and a
     // key that exists but is reachable from nowhere is exactly the bug class this repo keeps

package/src/host-attachment-media.js

@@ -0,0 +1,97 @@
+import { createHash } from 'node:crypto';
+import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
+import { nativeMessageImages, attachmentImageUrl, parseAttachmentImageUrl, isImageDescriptor } from './host-attachment-reference.js';
+import { renderBoundedThumbnail } from './host-file-thumbnail.js';
+import { MEDIA_FETCH_MAX_BYTES, INLINE_ORIGINAL_MAX_BYTES, STAGING_CACHE_MAX, STAGING_CACHE_TTL_MS, isThumbnailableMime } from './host-media-fetch.js';
+
+const failure = (code, message) => ({ ok: false, code, message });
+
+/** Reconstruct from the authorized source log on every request, including after restart. */
+export function createNativeAttachmentSourceReader({ getSession, readSessionLog, readImage }) {
+  return async locator => {
+    if (typeof getSession !== 'function' || typeof readSessionLog !== 'function' || typeof readImage !== 'function')
+      return failure('NOT_AVAILABLE', 'native attachment services unavailable');
+    try {
+      if (!await getSession(locator.sessionId)) return failure('FORBIDDEN', 'source session unavailable');
+      const log = await readSessionLog(locator.sessionId);
+      let ref;
+      for (const event of Array.isArray(log?.events) ? log.events : []) {
+        if (!event || !isAppendSurfaceEvent(event)) continue;
+        const message = deriveEventMessage(event);
+        if (message?.id !== locator.messageId) continue;
+        const image = nativeMessageImages(message).find(image => image.blockPath === locator.blockPath);
+        if (image?.ref.attachmentId === locator.attachmentId && image.ref.mediaType === locator.mediaType) ref = image.ref;
+        break;
+      }
+      if (!ref) return failure('MEDIA_SOURCE_MISSING', 'source image no longer available');
+      if (ref.bytes > MEDIA_FETCH_MAX_BYTES) return failure('BAD_REQUEST', 'source image exceeds media budget');
+      const stored = await readImage(ref);
+      if (!stored || typeof stored.base64 !== 'string') return failure('MEDIA_SOURCE_MISSING', 'source image no longer readable');
+      return { ok: true, ref, bytes: Buffer.from(stored.base64, 'base64') };
+    } catch { return failure('MEDIA_SOURCE_MISSING', 'source image no longer readable'); }
+  };
+}
+
+/** These URLs do not name paths, so they never enter the arbitrary local-file resolver. */
+export function createAttachmentMediaFetcher({ readSource, uploader, render = renderBoundedThumbnail, now = Date.now, maxBytes = MEDIA_FETCH_MAX_BYTES, getScope = () => 0, isAllowed = () => true, maxConcurrent = 4 } = {}) {
+  const staged = new Map();
+  const flights = new Map();
+  const inline = (mimeType, bytes) => ({ ok: true, result: { ossKey: '', mimeType, size: bytes.length, inlineBase64: bytes.toString('base64') } });
+  let active = 0;
+  async function fetchImage(input) {
+    const locator = parseAttachmentImageUrl(input?.url);
+    if (!locator) return failure('BAD_REQUEST', 'invalid DSH attachment image locator');
+    const scope = getScope();
+    const current = () => scope !== null && getScope() === scope && isAllowed(locator);
+    const superseded = () => failure('FORBIDDEN', 'image request authorization changed');
+    if (!current()) return superseded();
+    if (typeof readSource !== 'function') return failure('NOT_AVAILABLE', 'native attachment reader unavailable');
+    // Authorization and current source existence are checked even on a staging-cache hit.
+    let source;
+    try { source = await readSource(locator); } catch { return failure('MEDIA_SOURCE_MISSING', 'source image unreadable'); }
+    if (!current()) return superseded();
+    if (!source?.ok) return source ?? failure('MEDIA_SOURCE_MISSING', 'source image unavailable');
+    const { ref, bytes } = source;
+    if (!isImageDescriptor(ref) || attachmentImageUrl(locator.sessionId, locator.messageId, locator.blockPath, ref) !== input.url
+      || !Buffer.isBuffer(bytes) || bytes.length !== ref.bytes
+      || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== ref.attachmentId)
+      return failure('MEDIA_SOURCE_MISSING', 'source image descriptor mismatch');
+    if (bytes.length > maxBytes) return failure('BAD_REQUEST', 'source image exceeds media budget');
+    if (input?.prepareOnly === true && input?.thumbnail !== true)
+      return failure('NOT_AVAILABLE', 'native attachment images use media fetch, not file-peer');
+    const cacheKey = `${scope}:${ref.attachmentId}`;
+    const key = `${cacheKey}:${input?.thumbnail === true ? 'thumbnail' : 'original'}:${input?.skipCache === true ? 'refresh' : 'cached'}`;
+    if (flights.has(key)) {
+      const result = await flights.get(key);
+      return current() ? result : superseded();
+    }
+    const work = Promise.resolve().then(async () => {
+      if (!current()) return superseded();
+      if (input?.thumbnail === true) {
+        let thumb;
+        try { thumb = isThumbnailableMime(ref.mediaType) ? await render(bytes) : null; } catch { thumb = null; }
+        if (!current()) return superseded();
+        if (thumb?.ok && Buffer.isBuffer(thumb.data) && thumb.data.length > 0 && thumb.data.length <= 700 * 1024) return inline('image/webp', thumb.data);
+        if (bytes.length <= INLINE_ORIGINAL_MAX_BYTES) return inline(ref.mediaType, bytes);
+      }
+      if (typeof uploader !== 'function') return failure('NOT_AVAILABLE', 'media staging unavailable');
+      const cached = staged.get(cacheKey);
+      if (input?.skipCache !== true && cached && cached.at + STAGING_CACHE_TTL_MS > now()) return { ok: true, result: { ...cached.result } };
+      if (!current()) return superseded();
+      const result = await uploader(bytes, { ext: locator.ext, contentType: ref.mediaType });
+      if (!current()) return superseded();
+      if (!result?.ok || typeof result.key !== 'string' || !result.key) return failure('INTERNAL', 'image staging failed; retry later');
+      const answer = { ossKey: result.key, mimeType: ref.mediaType, size: bytes.length };
+      staged.set(cacheKey, { at: now(), result: answer });
+      while (staged.size > STAGING_CACHE_MAX) staged.delete(staged.keys().next().value);
+      return { ok: true, result: answer };
+    }).catch(() => failure('INTERNAL', 'image staging failed; retry later')).finally(() => flights.delete(key));
+    flights.set(key, work);
+    return work;
+  }
+  return async input => {
+    if (active >= maxConcurrent) return failure('INTERNAL', 'image reader busy; retry later');
+    active++;
+    try { return await fetchImage(input); } finally { active--; }
+  };
+}

package/src/host-attachment-reference.js

@@ -0,0 +1,46 @@
+/** Deterministic, non-bearer locators. No path or caller-supplied descriptor is admitted. */
+const EXT = Object.freeze({ 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif' });
+const token = value => Buffer.from(value, 'utf8').toString('base64url');
+export function isImageDescriptor(ref) {
+  return ref && /^sha256:[a-f0-9]{64}$/.test(ref.attachmentId) && Object.hasOwn(EXT, ref.mediaType)
+    && Number.isSafeInteger(ref.bytes) && ref.bytes > 0
+    && Number.isSafeInteger(ref.width) && ref.width > 0 && Number.isSafeInteger(ref.height) && ref.height > 0
+    && (ref.name === undefined || typeof ref.name === 'string');
+}
+export function attachmentImageUrl(sessionId, messageId, blockPath, ref) {
+  if (![sessionId, messageId].every(v => typeof v === 'string' && v.length > 0 && v.length <= 256)
+    || !/^(0|[1-9][0-9]{0,5})(\.(0|[1-9][0-9]{0,5}))?$/.test(blockPath) || !isImageDescriptor(ref)) return null;
+  return `xdt-image://dsh-attachment/v1/${token(sessionId)}/${token(messageId)}/${blockPath}/${ref.attachmentId.slice(7)}.${EXT[ref.mediaType]}`;
+}
+export function parseAttachmentImageUrl(url) {
+  if (typeof url !== 'string' || url.length > 2048) return null;
+  const match = /^xdt-image:\/\/dsh-attachment\/v1\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)\/((?:0|[1-9][0-9]{0,5})(?:\.(?:0|[1-9][0-9]{0,5}))?)\/([a-f0-9]{64})\.(png|jpg|webp|gif)$/.exec(url);
+  if (!match) return null;
+  const [, sid, mid, blockPath, hash, ext] = match;
+  const sessionId = Buffer.from(sid, 'base64url').toString('utf8');
+  const messageId = Buffer.from(mid, 'base64url').toString('utf8');
+  if (!sessionId || !messageId || sessionId.length > 256 || messageId.length > 256 || token(sessionId) !== sid || token(messageId) !== mid) return null;
+  return { sessionId, messageId, blockPath, attachmentId: `sha256:${hash}`, mediaType: Object.keys(EXT).find(mime => EXT[mime] === ext), ext };
+}
+
+/** Only native image blocks in renderable model/tool messages, never JSON text. */
+export function nativeMessageImages(message) {
+  const source = message?.source?.kind;
+  const direct = message?.role === 'tool' && (!source || source === 'tool')
+    || message?.role === 'assistant' && (!source || source === 'model');
+  const legacy = message?.role === 'user' && (!source || source === 'tool');
+  const found = [];
+  for (const [index, block] of (Array.isArray(message?.content) ? message.content : []).entries()) {
+    if (direct && block?.type === 'image' && isImageDescriptor(block.attachment)) found.push({ blockPath: String(index), ref: block.attachment });
+    if (legacy && block?.type === 'tool-result' && Array.isArray(block.content)) {
+      for (const [child, nested] of block.content.entries())
+        if (nested?.type === 'image' && isImageDescriptor(nested.attachment)) found.push({ blockPath: `${index}.${child}`, ref: nested.attachment });
+    }
+  }
+  return found;
+}
+export function toolResultWithImages(text, message, sessionId, resultIndex = null) {
+  const urls = nativeMessageImages(message).filter(image => resultIndex === null || image.blockPath.startsWith(`${resultIndex}.`))
+    .map(image => attachmentImageUrl(sessionId, message.id, image.blockPath, image.ref)).filter(Boolean);
+  return urls.length ? JSON.stringify({ text, xdt_image_urls: urls }) : text;
+}

package/src/host-file-browser.js

@@ -17,6 +17,8 @@
  *    reference host returns for an op it does not know.
  */
 
+import { fileThumbnail } from './host-file-thumbnail.js';
+
 /** Longest file this Host will inline for `readFile`. */
 export const READ_LIMIT_BYTES = 1024 * 1024;
 
@@ -147,7 +149,7 @@ function looksBinary(text) {
  * @param options - the filesystem service, plus injectable limits.
  * @returns `(args) => Promise<unknown>`, one result per op.
  */
-export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTES, listAllLimit = LIST_ALL_LIMIT }) {
+export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTES, listAllLimit = LIST_ALL_LIMIT, thumbnail = fileThumbnail }) {
   if (fileSystem === undefined || fileSystem === null) throw new Error('createFileBrowser requires a filesystem service');
 
   /** Resolve a workdir-relative path, or null when it escapes or cannot resolve. */
@@ -379,17 +381,11 @@ export function createFileBrowser({ fileSystem, readLimitBytes = READ_LIMIT_BYTE
     // reason* answer in their own documented shape, so the controller degrades
     // deliberately instead of showing a transport-looking failure.
     //
-    //  - `thumbnail` needs an image pipeline that produces the `image/webp` data
-    //    URL the controller expects; `THUMB_UNSUPPORTED` is the reference host's
-    //    own code for "this host cannot make one".
-    //  - `exportFileStart` hands a file on this machine to the account's staging area
-    //    so the *controller* can download it — the reverse of the attachment flow this
-    //    Host does serve (there it fetches what the phone uploaded). Uploading on
-    //    demand, with the progress polling `exportFileStatus` implies, is a transfer
-    //    manager rather than a read, and is not served.
-    if (op === 'thumbnail') {
-      return { ok: false, code: 'THUMB_UNSUPPORTED', message: 'this Host generates no thumbnails' };
-    }
+    // Thumbnail failures retain Cindy's THUMB_* result shape; original file reads
+    // remain independent of codec availability.
+    // Export jobs are intercepted by cindy-channels before reaching this reader;
+    // a standalone reader has no transfer manager and refuses those operations.
+    if (op === 'thumbnail') return thumbnail({ workdir, relPath });
     if (op === 'exportFileStart' || op === 'exportFileStatus') {
       return { ok: false, message: 'file export needs the Cindy media pipeline, which this Host does not serve' };
     }

package/src/host-file-thumbnail.js

@@ -0,0 +1,67 @@
+import { createLocalFileResolver, readPreparedInline, resolveThumbnailCodec } from './host-media-fetch.js';
+import { createLocalFileUrl } from './host-file-reference.js';
+
+export const GRID_THUMBNAIL_LIMITS = Object.freeze({ edge: 256, quality: 70, outputBytes: 128 * 1024 });
+export const IMAGE_INPUT_BYTES = 48 * 1024 * 1024;
+export const IMAGE_INPUT_PIXELS = 40_000_000;
+
+const failed = (code, message) => ({ ok: false, code, message });
+
+/** Soft deadlines do not release the concurrency slot until native work actually settles. */
+export function createThumbnailRenderer({ codec = resolveThumbnailCodec, concurrency = 2, timeoutMs = 5000 } = {}) {
+  let active = 0;
+  let loaded;
+  return async function render(bytes, { edge = 1024, quality = 80, outputBytes = 700 * 1024 } = {}) {
+    if (!Buffer.isBuffer(bytes) || bytes.length === 0 || bytes.length > IMAGE_INPUT_BYTES)
+      return failed('THUMB_TOO_LARGE', 'invalid or oversized input');
+    if (active >= concurrency) return failed('THUMB_FAILED', 'thumbnail renderer busy; retry later');
+    try { loaded ??= codec(); } catch { return failed('THUMB_UNSUPPORTED', 'image codec unavailable'); }
+    if (typeof loaded !== 'function') return failed('THUMB_UNSUPPORTED', 'image codec unavailable');
+    active++;
+    let timer;
+    const work = Promise.resolve().then(async () => {
+      const out = await loaded(bytes, { limitInputPixels: IMAGE_INPUT_PIXELS, failOn: 'error', animated: false })
+        .rotate().resize({ width: edge, height: edge, fit: 'inside', withoutEnlargement: true })
+        .webp({ quality }).toBuffer({ resolveWithObject: true });
+      if (!Buffer.isBuffer(out?.data) || !out.data.length || out.data.length > outputBytes)
+        return failed('THUMB_TOO_LARGE', 'thumbnail exceeds output budget');
+      if (![out.info?.width, out.info?.height].every(n => Number.isInteger(n) && n > 0 && n <= edge))
+        return failed('THUMB_FAILED', 'invalid thumbnail dimensions');
+      return { ok: true, data: out.data, width: out.info.width, height: out.info.height, mimeType: 'image/webp' };
+    }).catch(() => failed('THUMB_FAILED', 'image could not be decoded')).finally(() => { active--; });
+    try {
+      return await Promise.race([work, new Promise(resolve => {
+        timer = setTimeout(() => resolve(failed('THUMB_FAILED', 'thumbnail render timeout')), timeoutMs);
+      })]);
+    } finally { clearTimeout(timer); }
+  };
+}
+
+export const renderBoundedThumbnail = createThumbnailRenderer();
+
+/** Local-only file browser thumbnails reuse the exact authorization boundary of fileUrl. */
+export function createFileThumbnail({
+  resolveFile = createLocalFileResolver({ maxBytes: IMAGE_INPUT_BYTES }),
+  readBytes = readPreparedInline, render = renderBoundedThumbnail,
+} = {}) {
+  const fileUrl = createLocalFileUrl({ resolveFile });
+  let active = 0;
+  return async function thumbnail({ workdir, relPath } = {}) {
+    if (active >= 2) return failed('THUMB_FAILED', 'thumbnail reader busy; retry later');
+    active++;
+    try {
+      const reference = await fileUrl({ workdir, relPath });
+      if (!reference.ok) return failed(reference.code === 'BAD_REQUEST' && /byte limit/.test(reference.message) ? 'THUMB_TOO_LARGE' : 'THUMB_FAILED', 'image path is unavailable, not allowed or too large');
+      const source = await resolveFile(reference.url);
+      if (!source.ok) return failed('THUMB_FAILED', 'image path is unavailable or not allowed');
+      if (source.info.size > IMAGE_INPUT_BYTES) return failed('THUMB_TOO_LARGE', 'image exceeds input budget');
+      const bytes = await readBytes(source.real, source.info);
+      const result = await render(bytes, GRID_THUMBNAIL_LIMITS);
+      if (!result.ok) return result;
+      return { ok: true, dataBase64: result.data.toString('base64'), mimeType: result.mimeType, width: result.width, height: result.height };
+    } catch { return failed('THUMB_FAILED', 'image changed or could not be read'); }
+    finally { active--; }
+  };
+}
+
+export const fileThumbnail = createFileThumbnail();

package/src/host-frame-budget.js

@@ -31,6 +31,8 @@
  * character, and a page of base64 images is 4/3 of their size.
  */
 
+import { parseAttachmentImageUrl } from './host-attachment-reference.js';
+
 /**
  * The relay's hard frame ceiling, mirrored from `@cindy/device-link-protocol`.
  *
@@ -119,6 +121,30 @@ export function cutToBytes(text, limit) {
   return { text: `${text.slice(0, cut)}${TRUNCATION_SUFFIX}`, cut: true };
 }
 
+/** Keep Host-derived media JSON parseable when long tool text is compacted. */
+function cutManagedImageResult(text, limit) {
+  if (typeof text !== 'string' || !text.includes('xdt_image_urls') || byteLength(text) <= limit) return null;
+  let parsed;
+  try { parsed = JSON.parse(text); } catch { return null; }
+  if (typeof parsed?.text !== 'string' || !Array.isArray(parsed.xdt_image_urls) || !parsed.xdt_image_urls.length
+    || Object.keys(parsed).some(key => key !== 'text' && key !== 'xdt_image_urls')
+    || !parsed.xdt_image_urls.every(url => parseAttachmentImageUrl(url))) return null;
+  const urls = [...parsed.xdt_image_urls];
+  const encode = body => JSON.stringify({ text: body, xdt_image_urls: urls });
+  const suffix = () => TRUNCATION_SUFFIX + (urls.length < parsed.xdt_image_urls.length ? `\n[${parsed.xdt_image_urls.length - urls.length} image references omitted]` : '');
+  while (urls.length && byteLength(encode(suffix())) > limit) urls.pop();
+  let low = 0; let high = parsed.text.length;
+  const prefix = length => {
+    const value = parsed.text.slice(0, length);
+    return /[\uD800-\uDBFF]$/.test(value) ? value.slice(0, -1) : value;
+  };
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (byteLength(encode(prefix(middle) + suffix())) <= limit) low = middle; else high = middle - 1;
+  }
+  return { text: encode(prefix(low) + suffix()), cut: true };
+}
+
 /** `agentMeta` with the truncation witness merged in, as the reference marks it. */
 function markContentTruncated(agentMeta) {
   const base = agentMeta !== null && typeof agentMeta === 'object' && !Array.isArray(agentMeta) ? agentMeta : {};
@@ -152,7 +178,7 @@ export function compactRowText(rows) {
     }
     if (content === null || typeof content !== 'object' || Array.isArray(content)) return row;
     if (row.role === 'tool_result' || row.role === 'tool-use') {
-      const result = cutToBytes(content.text, TOOL_RESULT_LIMIT);
+      const result = cutManagedImageResult(content.text, TOOL_RESULT_LIMIT) ?? cutToBytes(content.text, TOOL_RESULT_LIMIT);
       if (result.cut) {
         changed = true;
         return { ...row, content: { ...content, text: result.text }, agentMeta: markContentTruncated(row.agentMeta) };

package/src/host-media-fetch.js

@@ -349,7 +349,7 @@ function sameFileVersion(before, after) {
 }
 
 /** Read at most the authorized size plus one sentinel byte, even if the file grows. */
-async function readPreparedInline(real, info, open, stat) {
+export async function readPreparedInline(real, info, open = openImpl, stat = statImpl) {
   const file = await open(real, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOFOLLOW ?? 0));
   try {
     if (!sameFileVersion(info, await file.stat())) throw new Error('file changed');

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.38';
+export const HOST_PLUGIN_VERSION = '0.1.40';

package/src/host.js

@@ -49,6 +49,7 @@ import { MAX_ATTACHMENT_BYTES } from './host-attachments.js';
 import { createMediaRefResolver, createMediaReleaser, createMediaUploader, mediaApiBaseUrl, isAttachmentOssRef } from './host-media.js';
 import { createLocalMediaFetcher, createLocalFileResolver, isBlockedMediaPath, isInsideDirectory, mimeForMediaPath } from './host-media-fetch.js';
 import { createFilePeerManager } from './host-file-peer.js';
+import { createAttachmentMediaFetcher } from './host-attachment-media.js';
 import { createFileIceLoader } from './host-file-ice.js';
 import { createLocalFileUrl } from './host-file-reference.js';
 import { FILE_PEER_MAX_BYTES } from './file-peer-protocol.js';
@@ -256,7 +257,20 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * uploader as the file browser's export ops, stricter request handling
    * (`host-media-fetch.js`): a containment root is mandatory and both sides are realpath'd.
    */
-  const fetchLocalMedia = createLocalMediaFetcher({ uploader: uploadMedia });
+  const fetchFileMedia = createLocalMediaFetcher({ uploader: uploadMedia });
+  const fetchAttachmentMedia = createAttachmentMediaFetcher({
+    uploader: uploadMedia,
+    getScope: () => stopped ? null : `${generation}:${sourceRevision}`,
+    isAllowed: locator => !sessionIsHidden(locator.sessionId),
+    readSource: async locator => {
+    if (sessionIsHidden(locator.sessionId)) return { ok: false, code: 'FORBIDDEN', message: 'source session unavailable' };
+    const capabilities = typeof options.resolveCapabilities === 'function' ? options.resolveCapabilities() : {};
+    return typeof capabilities.readAttachmentSource === 'function'
+      ? capabilities.readAttachmentSource(locator)
+      : { ok: false, code: 'NOT_AVAILABLE', message: 'native attachment reader unavailable' };
+  } });
+  const fetchLocalMedia = input => typeof input?.url === 'string' && input.url.startsWith('xdt-image://')
+    ? fetchAttachmentMedia(input) : fetchFileMedia(input);
   const resolvePeerFile = createLocalFileResolver({ maxBytes: FILE_PEER_MAX_BYTES });
   const fileUrl = createLocalFileUrl({ resolveFile: resolvePeerFile });