dsh-code 1.0.0 → 1.0.1

package/lib/index.mjs

@@ -4,8 +4,8 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import { readFileSync, realpathSync } from "node:fs";
 import os, { homedir } from "node:os";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
+import { mkdir, open, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { installModelSelection } from "@deepseek-ai/dsh-agent";
 import { MessageId, ReasoningEffortId, assertNever, boundContextSummary, createUserMessage, normalizeApiKey } from "@deepseek-ai/dsh-llm";
@@ -14,11 +14,14 @@ import { PassThrough, Stream } from "node:stream";
 import process$1, { cwd, env } from "node:process";
 import { EventEmitter } from "node:events";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { execFile, spawn } from "node:child_process";
+import { credentialKeyId, credentialKeyScope } from "@deepseek-ai/dsh-credentials";
+import { AuthorizationDeclinedError } from "@deepseek-ai/dsh-authorization";
+import { fileURLToPath } from "node:url";
 import { DEFAULT_FILE_SEARCH_EXCLUDED_DIRECTORIES, DEFAULT_FILE_SEARCH_MAX_ENTRIES, DEFAULT_FILE_SEARCH_MAX_RESULTS, WorkspaceFileSearch } from "@deepseek-ai/dsh-file-reference-local";
 import { formatSessionReferenceMention, parseSessionReferenceText } from "@deepseek-ai/dsh-session-reference";
 import { UserQuestionError } from "@deepseek-ai/dsh-user-questions";
 import { isUserInvocable } from "@deepseek-ai/dsh-skill";
-import { execFile, spawn } from "node:child_process";
 //#region node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js
 /**
 * @license React
@@ -24919,7 +24922,9 @@ function imageLabels(images) {
 	if (images === void 0 || images.length === 0) return "";
 	return images.map((image, index) => {
 		const rawName = image.name?.trim() || `image ${index + 1}`;
-		return `[image: ${rawName.length <= 80 ? rawName : `${rawName.slice(0, 79)}…`} · ${image.width}×${image.height} · ${image.bytes} B]`;
+		const name = rawName.length <= 80 ? rawName : `${rawName.slice(0, 79)}…`;
+		const original = image.originalDimensions;
+		return `[image: ${name} · ${original === void 0 ? `${image.width}×${image.height}` : `${image.width}×${image.height} · original ${original.width}×${original.height}`} · ${image.bytes} B]`;
 	}).join("\n");
 }
 /** Prompt text with its durable image labels, without exposing local paths or bytes. */
@@ -27112,7 +27117,7 @@ function mergeSessionTitles(rows, observations) {
 	const titles = /* @__PURE__ */ new Map();
 	for (const observation of observations) {
 		if (observation.status !== "fulfilled") continue;
-		const title = observation.value?.title?.title ?? observation.value?.title?.text;
+		const title = observation.value?.title?.title;
 		if (title !== void 0 && title.trim() !== "") titles.set(observation.sessionId, title);
 	}
 	return rows.map((row) => titles.has(row.id) ? {
@@ -27253,10 +27258,10 @@ function formatRate(n) {
 /**
 * Cache-hit share of billed prompt-side input.
 * @param usage - cumulative token totals.
-* @returns rounded integer percent, or null when no input was billed.
+* @returns percent rounded to one decimal place, or null when no input was billed.
 */
 function cacheHitPercent(usage) {
-	return usage.inputTokens === 0 ? null : Math.round(usage.cacheReadTokens / usage.inputTokens * 100);
+	return usage.inputTokens === 0 ? null : Math.round(usage.cacheReadTokens / usage.inputTokens * 1e3) / 10;
 }
 /** Separator between trailing state spans. */
 const STATUS_ITEM_SEPARATOR = " · ";
@@ -28398,7 +28403,7 @@ const PASTE_END_MARKER = "[201~";
 * "[200~"/"[201~" markers Ink leaves after stripping the ESC byte.
 */
 function stripPasteMarkers(text) {
-	return text.replaceAll(PASTE_START_MARKER, "").replaceAll(PASTE_END_MARKER, "");
+	return text.replaceAll(`\x1b${PASTE_START_MARKER}`, "").replaceAll(`\x1b${PASTE_END_MARKER}`, "").replaceAll(PASTE_START_MARKER, "").replaceAll(PASTE_END_MARKER, "");
 }
 /** Match one CSI-u sequence (code, optional ;modifiers, then :event or ;alternate). */
 const CSI_U_SOURCE = "\x1B\\[(\\d+)(?:;(\\d+))?(?:[:;](\\d+))?u";
@@ -28409,7 +28414,6 @@ function legacyForKey(key) {
 	const alt = (bits & 2) !== 0;
 	const ctrl = (bits & 4) !== 0;
 	if (key.code === 13) {
-		if (shift) return "\x1B[13;2u";
 		if (ctrl) return "\n";
 		if (alt) return "\x1B\r";
 		return "\r";
@@ -29446,6 +29450,504 @@ function recallNewer(state) {
 	};
 }
 //#endregion
+//#region src/authorization.ts
+/** Terminal adapter over the Harness provider-authorization and credential-record seams. */
+/** Record scope used by the upstream pi-ai adapter for provider logins. */
+const PI_AI_RECORD_SCOPE = "llm-pi-ai";
+/** Load only model-provider flows; unrelated future authorization domains stay out of `/model`. */
+async function loadProviderAuthorizations(ctx) {
+	const authorization = ctx.get("authorization");
+	const credentials = ctx.get("credentials");
+	if (authorization === void 0 || credentials === void 0) return {
+		rows: [],
+		failures: []
+	};
+	const entries = authorization.list().filter((entry) => credentialKeyScope(entry.key) === PI_AI_RECORD_SCOPE);
+	const failures = [];
+	return {
+		rows: await Promise.all(entries.map(async (entry) => {
+			let record;
+			try {
+				record = await credentials.describeRecord(entry.key);
+			} catch (error) {
+				failures.push(`${entry.label}: ${error instanceof Error ? error.message : String(error)}`);
+				record = {
+					configured: false,
+					writable: false
+				};
+			}
+			return {
+				key: entry.key,
+				provider: credentialKeyId(entry.key),
+				label: entry.label,
+				methods: entry.methods,
+				inFlight: entry.inFlight,
+				record
+			};
+		})),
+		failures
+	};
+}
+/** Subscribe to login settlement and credential-record changes. */
+function subscribeProviderAuthorizations(ctx, listener) {
+	const settled = ctx.on("authorization/settled", (key) => {
+		if (credentialKeyScope(key) === PI_AI_RECORD_SCOPE) listener();
+	});
+	const records = ctx.on("credentials/record-updated", (key) => {
+		if (credentialKeyScope(key) === PI_AI_RECORD_SCOPE) listener();
+	});
+	return () => {
+		settled();
+		records();
+	};
+}
+/** Begin one provider login through the interaction surface owned by the caller. */
+async function beginProviderAuthorization(ctx, row, method, interaction, signal) {
+	const authorization = ctx.get("authorization");
+	if (authorization === void 0) throw new Error("provider login is unavailable in this profile");
+	return (await authorization.begin({
+		key: row.key,
+		method,
+		interaction,
+		signal
+	})).status;
+}
+/** Cancel the attempt currently serving this provider, if any. */
+function cancelProviderAuthorization(ctx, key) {
+	ctx.get("authorization")?.cancel(key);
+}
+/** Remove an authorization record without changing the provider's settings profile. */
+async function logoutProviderAuthorization(ctx, row) {
+	const credentials = ctx.get("credentials");
+	if (credentials === void 0) throw new Error("credential storage is unavailable in this profile");
+	const current = await credentials.describeRecord(row.key);
+	if (!current.configured) return;
+	if (!current.writable) throw new Error("this login record is read-only");
+	await credentials.deleteRecord(row.key);
+}
+/** Open an authorization URL with the platform default browser, without invoking a shell. */
+function openAuthorizationUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return false;
+	const target = url.toString();
+	try {
+		const child = process.platform === "win32" ? spawn("explorer.exe", [target], {
+			detached: true,
+			stdio: "ignore"
+		}) : process.platform === "darwin" ? spawn("/usr/bin/open", [target], {
+			detached: true,
+			stdio: "ignore"
+		}) : spawn("xdg-open", [target], {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.once("error", () => {});
+		child.unref();
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Compact value-free status for the provider list. */
+function providerAuthorizationStatus(row) {
+	if (row === void 0) return "login unavailable";
+	if (row.inFlight) return "login in progress";
+	if (!row.record.configured) return "not logged in";
+	return row.record.kind === "grant" ? "OAuth" : "interactive API key";
+}
+/** Find a provider's login flow from a previously loaded directory. */
+function authorizationForProvider(directory, provider) {
+	return directory?.rows.find((row) => row.provider === provider);
+}
+//#endregion
+//#region src/authorization-panel.ts
+/** Bounded Ink surfaces for provider login and logout. */
+/** Run one upstream authorization flow without letting notices or prompts exceed the panel budget. */
+function ProviderAuthorizationPanel(props) {
+	const stdout = useStdout().stdout;
+	const viewport = panelViewport(stdout?.columns ?? 80, stdout?.rows ?? 30);
+	const [phase, setPhase] = (0, import_react.useState)("methods");
+	const [cursor, setCursor] = (0, import_react.useState)(0);
+	const [notices, setNotices] = (0, import_react.useState)([]);
+	const [prompt, setPrompt] = (0, import_react.useState)(void 0);
+	const [draft, setDraft] = (0, import_react.useState)("");
+	const [promptCursor, setPromptCursor] = (0, import_react.useState)(0);
+	const [error, setError] = (0, import_react.useState)(void 0);
+	const [copyState, setCopyState] = (0, import_react.useState)(void 0);
+	const controllerRef = (0, import_react.useRef)(void 0);
+	const replyRef = (0, import_react.useRef)(void 0);
+	const openedUrls = (0, import_react.useRef)(/* @__PURE__ */ new Set());
+	const clearReply = () => {
+		replyRef.current?.detach();
+		replyRef.current = void 0;
+		setPrompt(void 0);
+		setDraft("");
+		setPromptCursor(0);
+	};
+	const decline = () => {
+		const reply = replyRef.current;
+		clearReply();
+		reply?.reject(new AuthorizationDeclinedError());
+	};
+	const stop = () => {
+		controllerRef.current?.abort();
+		controllerRef.current = void 0;
+		props.cancel(props.row.key);
+		decline();
+	};
+	(0, import_react.useEffect)(() => () => {
+		controllerRef.current?.abort();
+		props.cancel(props.row.key);
+		const reply = replyRef.current;
+		replyRef.current = void 0;
+		reply?.detach();
+		reply?.reject(new AuthorizationDeclinedError());
+	}, [props.row.key]);
+	const start = (method) => {
+		setPhase("running");
+		setError(void 0);
+		setNotices([]);
+		setCopyState(void 0);
+		const controller = new AbortController();
+		controllerRef.current = controller;
+		props.begin(props.row, method, {
+			notify(notice) {
+				setNotices((current) => [...current.slice(-19), notice]);
+				if (notice.url !== void 0 && !openedUrls.current.has(notice.url)) {
+					openedUrls.current.add(notice.url);
+					props.openUrl(notice.url);
+				}
+			},
+			prompt(next) {
+				return new Promise((resolve, reject) => {
+					const onWithdraw = () => {
+						if (replyRef.current?.reject !== reject) return;
+						clearReply();
+						reject(/* @__PURE__ */ new Error("authorization prompt was withdrawn"));
+					};
+					next.signal?.addEventListener("abort", onWithdraw, { once: true });
+					replyRef.current = {
+						resolve,
+						reject,
+						detach: () => next.signal?.removeEventListener("abort", onWithdraw)
+					};
+					setPrompt(next);
+					setDraft("");
+					setPromptCursor(0);
+				});
+			}
+		}, controller.signal).then((status) => {
+			controllerRef.current = void 0;
+			clearReply();
+			if (status === "authorized") props.done();
+			else props.back();
+		}, (reason) => {
+			controllerRef.current = void 0;
+			clearReply();
+			if (controller.signal.aborted) {
+				props.back();
+				return;
+			}
+			setError(reason instanceof Error ? reason.message : String(reason));
+			setPhase("methods");
+		});
+	};
+	const answer = (value) => {
+		const reply = replyRef.current;
+		clearReply();
+		reply?.resolve(value);
+	};
+	useInput((input, key) => {
+		if (phase === "methods") {
+			if (key.escape || input === "q") {
+				props.back();
+				return;
+			}
+			if (props.row.methods.length === 0) return;
+			if (key.upArrow) {
+				setCursor((current) => (current + props.row.methods.length - 1) % props.row.methods.length);
+				return;
+			}
+			if (key.downArrow) {
+				setCursor((current) => (current + 1) % props.row.methods.length);
+				return;
+			}
+			if (key.return) start(props.row.methods[cursor]?.id ?? props.row.methods[0].id);
+			return;
+		}
+		if (key.escape) {
+			stop();
+			props.back();
+			return;
+		}
+		const copyValue = notices.at(-1)?.code ?? notices.at(-1)?.url;
+		if ((input === "c" || input === "C") && copyValue !== void 0) {
+			props.copy(copyValue).then(() => setCopyState("copied"), (reason) => setCopyState(`copy failed: ${reason instanceof Error ? reason.message : String(reason)}`));
+			return;
+		}
+		if (prompt === void 0) return;
+		if (prompt.kind === "select") {
+			if (prompt.options.length === 0) return;
+			if (key.upArrow) {
+				setPromptCursor((current) => (current + prompt.options.length - 1) % prompt.options.length);
+				return;
+			}
+			if (key.downArrow) {
+				setPromptCursor((current) => (current + 1) % prompt.options.length);
+				return;
+			}
+			if (key.return) answer(prompt.options[promptCursor]?.id ?? prompt.options[0].id);
+			return;
+		}
+		if (key.backspace || key.delete) {
+			setDraft((current) => [...current].slice(0, -1).join(""));
+			return;
+		}
+		if (key.return) {
+			if (draft.trim() !== "") answer(draft);
+			return;
+		}
+		if (input !== "" && !key.ctrl && !key.meta) setDraft((current) => current + input);
+	});
+	if (viewport.maxHeight === 0) return (0, import_react.createElement)(Box, { display: "none" });
+	if (viewport.compact) return (0, import_react.createElement)(Text, { wrap: "truncate-end" }, truncateColumns("provider login · esc cancel", viewport.contentColumns));
+	const rows = [];
+	if (phase === "methods") {
+		if (error !== void 0) rows.push({
+			key: "error",
+			text: `  ${singleLineText(error)}`,
+			color: inkColor(getPalette().error)
+		});
+		props.row.methods.forEach((method, index) => {
+			rows.push({
+				key: method.id,
+				text: `${index === cursor ? "› " : "  "}${displayText(method.label)}`,
+				color: inkColor(index === cursor ? getPalette().brandBright : getPalette().dim)
+			});
+		});
+	} else {
+		notices.forEach((notice, index) => {
+			rows.push({
+				key: `notice-${index}`,
+				text: `  ${displayText(notice.message)}`
+			});
+			if (notice.url !== void 0) rows.push({
+				key: `url-${index}`,
+				text: `  ${displayText(notice.url)}`,
+				color: inkColor(getPalette().brandBright)
+			});
+			if (notice.code !== void 0) rows.push({
+				key: `code-${index}`,
+				text: `  code ${displayText(notice.code)}`,
+				color: inkColor(getPalette().success),
+				bold: true
+			});
+		});
+		if (prompt !== void 0) {
+			rows.push({
+				key: "prompt",
+				text: `  ${displayText(prompt.message)}`,
+				color: inkColor(getPalette().brandBright)
+			});
+			if (prompt.kind === "select") prompt.options.forEach((option, index) => rows.push({
+				key: `option-${option.id}`,
+				text: `${index === promptCursor ? "› " : "  "}${displayText(option.label)}${option.description === void 0 ? "" : ` · ${displayText(option.description)}`}`,
+				color: inkColor(index === promptCursor ? getPalette().brandBright : getPalette().dim)
+			}));
+			else {
+				const shown = prompt.kind === "secret" ? "•".repeat([...draft].length) : displayText(draft);
+				rows.push({
+					key: "draft",
+					text: `  ${shown}▏`,
+					color: inkColor(getPalette().text)
+				});
+			}
+		} else rows.push({
+			key: "waiting",
+			text: "  waiting for provider…",
+			color: inkColor(getPalette().dim)
+		});
+		if (copyState !== void 0) rows.push({
+			key: "copy",
+			text: `  ${singleLineText(copyState)}`,
+			color: inkColor(copyState === "copied" ? getPalette().success : getPalette().error)
+		});
+	}
+	const visible = rows.slice(Math.max(0, rows.length - viewport.bodyRows));
+	const footer = phase === "methods" ? "↑↓ choose · enter continue · esc/q back" : "enter answer · c copy URL/code · esc cancel login";
+	return (0, import_react.createElement)(Box, {
+		flexDirection: "column",
+		width: viewport.outerColumns,
+		paddingX: 1,
+		borderStyle: "round",
+		borderColor: inkColor(getPalette().brand)
+	}, (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().brand),
+		bold: true,
+		wrap: "truncate-end"
+	}, truncateColumns(`/model · login ${displayText(props.row.label)}`, viewport.contentColumns)), ...visible.map((row) => (0, import_react.createElement)(Text, {
+		key: row.key,
+		color: row.color,
+		bold: row.bold,
+		wrap: "truncate-end"
+	}, truncateColumns(row.text, viewport.contentColumns))), (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().dim),
+		wrap: "truncate-end"
+	}, truncateColumns(footer, viewport.contentColumns)));
+}
+function ProviderAuthorizationLogoutPanel({ row, confirm, done, back }) {
+	const stdout = useStdout().stdout;
+	const viewport = panelViewport(stdout?.columns ?? 80, stdout?.rows ?? 30);
+	const [busy, setBusy] = (0, import_react.useState)(false);
+	const [error, setError] = (0, import_react.useState)(void 0);
+	useInput((input, key) => {
+		if (busy) return;
+		if (key.escape || input === "n" || input === "N") {
+			back();
+			return;
+		}
+		if (input !== "y" && input !== "Y") return;
+		setBusy(true);
+		setError(void 0);
+		confirm(row).then(done, (reason) => {
+			setBusy(false);
+			setError(reason instanceof Error ? reason.message : String(reason));
+		});
+	});
+	if (viewport.maxHeight === 0) return (0, import_react.createElement)(Box, { display: "none" });
+	if (viewport.compact) return (0, import_react.createElement)(Text, { wrap: "truncate-end" }, truncateColumns("y logout · n/esc back", viewport.contentColumns));
+	return (0, import_react.createElement)(Box, {
+		flexDirection: "column",
+		width: viewport.outerColumns,
+		paddingX: 1,
+		borderStyle: "round",
+		borderColor: inkColor(getPalette().warn)
+	}, (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().warn),
+		bold: true,
+		wrap: "truncate-end"
+	}, truncateColumns("/model · logout provider", viewport.contentColumns)), (0, import_react.createElement)(Text, { wrap: "truncate-end" }, truncateColumns(`  remove ${displayText(row.label)} login record`, viewport.contentColumns)), (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().dim),
+		wrap: "truncate-end"
+	}, truncateColumns("  provider endpoint and model configuration stay unchanged", viewport.contentColumns)), error === void 0 ? void 0 : (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().error),
+		wrap: "truncate-end"
+	}, truncateColumns(`  ${singleLineText(error)}`, viewport.contentColumns)), (0, import_react.createElement)(Text, {
+		color: inkColor(getPalette().dim),
+		wrap: "truncate-end"
+	}, truncateColumns(busy ? "working…" : "y confirm · n/esc back", viewport.contentColumns)));
+}
+//#endregion
+//#region src/attachments.ts
+/** Terminal image-file adapter over the Harness durable attachment service. */
+const IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".png",
+	".jpg",
+	".jpeg",
+	".webp",
+	".gif"
+]);
+/** Detect the supported encoded raster formats from bytes, never from a path suffix. */
+function detectImageMediaType(data) {
+	if (data.length >= 8 && data[0] === 137 && data[1] === 80 && data[2] === 78 && data[3] === 71 && data[4] === 13 && data[5] === 10 && data[6] === 26 && data[7] === 10) return "image/png";
+	if (data.length >= 3 && data[0] === 255 && data[1] === 216 && data[2] === 255) return "image/jpeg";
+	if (data.length >= 6) {
+		const signature = String.fromCharCode(...data.subarray(0, 6));
+		if (signature === "GIF87a" || signature === "GIF89a") return "image/gif";
+	}
+	if (data.length >= 12 && String.fromCharCode(...data.subarray(0, 4)) === "RIFF" && String.fromCharCode(...data.subarray(8, 12)) === "WEBP") return "image/webp";
+}
+/** Whether a path-like token is worth probing as an image attachment. */
+function looksLikeImagePath(path) {
+	return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
+}
+/** Parse a terminal paste/drop containing only one or more image paths. */
+function parsePastedImagePaths(input) {
+	const text = input.trim();
+	if (text === "") return [];
+	const tokens = [];
+	for (const match of text.matchAll(/"([^"]+)"|'([^']+)'|(\S+)/gu)) {
+		const token = match[1] ?? match[2] ?? match[3];
+		if (token === void 0) continue;
+		let path = token;
+		if (path.startsWith("file://")) try {
+			path = fileURLToPath(path);
+		} catch {
+			return [];
+		}
+		if (!looksLikeImagePath(path)) return [];
+		tokens.push(path);
+	}
+	return tokens;
+}
+/** Validate path, byte size and encoded signature without writing an attachment object. */
+async function inspectImagePaths(paths, attachments, cwd = process.cwd()) {
+	if (paths.length === 0) return [];
+	if (attachments === void 0) throw new Error("image attachments are unavailable in this profile");
+	if (paths.length > attachments.imageLimits.maxImagesPerMessage) throw new Error(`too many images (${paths.length}; limit ${attachments.imageLimits.maxImagesPerMessage})`);
+	const inspected = [];
+	let totalBytes = 0;
+	for (const raw of paths) {
+		const path = isAbsolute(raw) ? resolve(raw) : resolve(cwd, raw);
+		let facts;
+		try {
+			facts = await stat(path);
+		} catch (error) {
+			throw new Error(`cannot read image "${raw}": ${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (!facts.isFile()) throw new Error(`image path is not a file: "${raw}"`);
+		if (facts.size > attachments.imageLimits.maxImageBytes) throw new Error(`image "${basename(path)}" is ${facts.size} bytes; limit ${attachments.imageLimits.maxImageBytes}`);
+		totalBytes += facts.size;
+		if (totalBytes > attachments.imageLimits.maxMessageImageBytes) throw new Error(`image batch is ${totalBytes} bytes; limit ${attachments.imageLimits.maxMessageImageBytes}`);
+		const handle = await open(path, "r");
+		try {
+			const signature = /* @__PURE__ */ new Uint8Array(16);
+			const { bytesRead } = await handle.read(signature, 0, signature.length, 0);
+			const mediaType = detectImageMediaType(signature.subarray(0, bytesRead));
+			if (mediaType === void 0 || !attachments.imageLimits.mediaTypes.includes(mediaType)) throw new Error(`unsupported image file "${raw}" (expected PNG, JPEG, WebP, or GIF)`);
+			inspected.push({
+				path,
+				name: basename(path),
+				mediaType,
+				bytes: facts.size
+			});
+		} finally {
+			await handle.close();
+		}
+	}
+	return inspected;
+}
+/** Read, validate, and persist an ordered image path list as model content blocks. */
+async function saveImagePaths(paths, attachments) {
+	if (paths.length === 0) return [];
+	if (attachments === void 0) throw new Error("image attachments are unavailable in this profile");
+	const inputs = [];
+	for (const path of paths) {
+		let data;
+		try {
+			data = await readFile(path);
+		} catch (error) {
+			throw new Error(`cannot read image "${path}": ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const mediaType = detectImageMediaType(data);
+		if (mediaType === void 0) throw new Error(`unsupported image file "${path}" (expected PNG, JPEG, WebP, or GIF)`);
+		inputs.push({
+			data,
+			mediaType,
+			name: basename(path)
+		});
+	}
+	return (await attachments.saveImages(inputs)).map((attachment) => ({
+		type: "image",
+		attachment
+	}));
+}
+//#endregion
 //#region src/app.ts
 /**
 * The Ink terminal app: whale-and-wordmark header in DeepSeek blue, the live
@@ -29490,6 +29992,106 @@ function readSettledRowCap() {
 const PASTE_BRACKET_TIMEOUT_MS = 1e3;
 /** Release the held frame after Ink has replayed the source-backed Static rows. */
 const SYNCHRONIZED_UPDATE_END = "\x1B[?2026l";
+/** One source of truth for TUI-owned slash commands in completion and `/help`. */
+const LOCAL_COMMANDS = [
+	{
+		label: "/help",
+		description: "show this overlay"
+	},
+	{
+		label: "/model",
+		description: "switch the model and manage providers"
+	},
+	{
+		label: "/effort",
+		description: "adjust reasoning effort for the current model"
+	},
+	{
+		label: "/mode",
+		description: "inspect or select the agent preset (/mode [preset])"
+	},
+	{
+		label: "/permission",
+		description: "inspect or select the permission preset (/permission [preset])"
+	},
+	{
+		label: "/new",
+		description: "create and switch to a fresh session (/new [preset])"
+	},
+	{
+		label: "/fork",
+		description: "fork at the latest completed turn (/fork [event-seq])"
+	},
+	{
+		label: "/resume",
+		description: "browse or switch root sessions (/resume [id|prefix])"
+	},
+	{
+		label: "/plugin",
+		description: "inspect the live plugin composition"
+	},
+	{
+		label: "/jobs",
+		description: "inspect background jobs"
+	},
+	{
+		label: "/statusline",
+		description: "customize the status line items"
+	},
+	{
+		label: "/theme",
+		description: "switch the color theme"
+	},
+	{
+		label: "/history",
+		description: "search and recall past prompts"
+	},
+	{
+		label: "/agents",
+		description: "inspect subagent sessions of this conversation"
+	},
+	{
+		label: "/todos",
+		description: "inspect the full todo list"
+	},
+	{
+		label: "/subagent",
+		description: "choose the model delegated subagents run on"
+	},
+	{
+		label: "/delete",
+		description: "delete a session and its subagent threads"
+	},
+	{
+		label: "/clear",
+		description: "clear the screen"
+	},
+	{
+		label: "/export",
+		description: "export the transcript to markdown (/export [path])"
+	},
+	{
+		label: "/title",
+		description: "rename this session (/title <text>)"
+	},
+	{
+		label: "/copy",
+		description: "copy the latest assistant response"
+	},
+	{
+		label: "/diff",
+		description: "inspect Git changes (/diff [--staged|ref])"
+	},
+	{
+		label: "/review",
+		description: "review Git changes under read-only permissions"
+	},
+	{
+		label: "/quit",
+		description: "exit"
+	}
+];
+const LOCAL_COMMAND_NAMES = new Set(LOCAL_COMMANDS.map((command) => command.label.slice(1)));
 /** Pad text with spaces to a visible-column target (menu name column). */
 function padColumns(text, width) {
 	const clipped = truncateColumns(singleLineText(text), width);
@@ -30544,7 +31146,8 @@ function ModelPanel({ directory, error, current, onSelect, onProviders, onRetry,
 		wrap: "truncate-end"
 	}, truncateColumns(`/model — select model${rows.length === 0 ? "" : ` · ${cursor + 1}/${rows.length}`}`, viewport.contentColumns)), (0, import_react.createElement)(PanelGap, { visible: viewport.gapRows > 0 }), ...visibleStateRows, ...visible.map((row) => {
 		const index = rows.indexOf(row);
-		const label = displayText(`${row.providerName} · ${row.modelName}`);
+		const capability = row.inputModalities?.includes("image") === true ? " · image" : "";
+		const label = displayText(`${row.providerName} · ${row.modelName}${capability}`);
 		return (0, import_react.createElement)(Text, {
 			key: `${row.provider}/${row.model}`,
 			color: index === cursor ? inkColor(getPalette().brandBright) : inkColor(getPalette().dim),
@@ -30567,7 +31170,7 @@ function providerStateLabel(row) {
 	return `${route} · ${row.configured ? "provider auth" : "not configured"}`;
 }
 /** The provider-management stage reached from /model with `a`. */
-function ProviderPanel({ directory, error, onCredential, onConfigure, onUnset, onRemove, onRetry, onBack }) {
+function ProviderPanel({ directory, error, authorizations, authorizationError, onCredential, onConfigure, onUnset, onRemove, onLogin, onLogout, onRetry, onBack }) {
 	const stdout = useStdout().stdout;
 	const viewport = panelViewport(stdout?.columns ?? 80, stdout?.rows ?? 30);
 	const rows = directory?.rows ?? [];
@@ -30630,6 +31233,19 @@ function ProviderPanel({ directory, error, onCredential, onConfigure, onUnset, o
 			else onRemove(target);
 			return;
 		}
+		const authorization = authorizationForProvider(authorizations, target.provider);
+		if (input === "l" || input === "L") {
+			if (authorization === void 0) setActionError("this provider offers no interactive login flow");
+			else if (authorization.inFlight) setActionError("a login attempt is already running for this provider");
+			else onLogin(target, authorization);
+			return;
+		}
+		if (input === "o" || input === "O") {
+			if (authorization === void 0 || !authorization.record.configured) setActionError("this provider has no login record to remove");
+			else if (!authorization.record.writable) setActionError("this login record is read-only");
+			else onLogout(target, authorization);
+			return;
+		}
 		if (key.return) {
 			if (target.settingsNs.length === 0) setActionError("this provider is not managed by Harness settings");
 			else if (target.credential?.kind === "error") setActionError("credential status is unavailable; retry before writing");
@@ -30659,6 +31275,16 @@ function ProviderPanel({ directory, error, onCredential, onConfigure, onUnset, o
 			color: inkColor(getPalette().warn),
 			wrap: "truncate-end"
 		}, truncateColumns(`  ${singleLineText(failure)}`, viewport.contentColumns))),
+		...authorizationError === void 0 ? [] : [(0, import_react.createElement)(Text, {
+			key: "authorization-error",
+			color: inkColor(getPalette().warn),
+			wrap: "truncate-end"
+		}, truncateColumns(`  login status unavailable: ${singleLineText(authorizationError)}`, viewport.contentColumns))],
+		...(authorizations?.failures ?? []).map((failure, index) => (0, import_react.createElement)(Text, {
+			key: `authorization-failure-${index}`,
+			color: inkColor(getPalette().warn),
+			wrap: "truncate-end"
+		}, truncateColumns(`  ${singleLineText(failure)}`, viewport.contentColumns))),
 		...rows.length === 0 ? [(0, import_react.createElement)(Text, {
 			key: "empty",
 			color: inkColor(getPalette().dim),
@@ -30680,7 +31306,10 @@ function ProviderPanel({ directory, error, onCredential, onConfigure, onUnset, o
 		wrap: "truncate-end"
 	}, truncateColumns(`/model — providers${rows.length === 0 ? "" : ` · ${cursor + 1}/${rows.length}`}`, viewport.contentColumns)), (0, import_react.createElement)(PanelGap, { visible: viewport.gapRows > 0 }), ...visibleStateRows, ...visible.map((row) => {
 		const index = rows.indexOf(row);
-		const label = `${row.displayName === row.provider ? row.provider : `${row.displayName} (${row.provider})`} · ${providerStateLabel(row)}${row.removable ? " · custom" : ""}`;
+		const identity = row.displayName === row.provider ? row.provider : `${row.displayName} (${row.provider})`;
+		const authorization = authorizationForProvider(authorizations, row.provider);
+		const authLabel = !(row.credential?.kind === "facts" && row.credential.configured) || authorization?.record.configured === true || authorization?.inFlight === true ? ` · ${providerAuthorizationStatus(authorization)}` : "";
+		const label = `${identity} · ${providerStateLabel(row)}${authLabel}${row.removable ? " · custom" : ""}`;
 		return (0, import_react.createElement)(Text, {
 			key: row.provider,
 			color: index === cursor ? inkColor(getPalette().brandBright) : inkColor(getPalette().dim),
@@ -30689,7 +31318,7 @@ function ProviderPanel({ directory, error, onCredential, onConfigure, onUnset, o
 	}), (0, import_react.createElement)(PanelGap, { visible: viewport.gapRows > 0 }), (0, import_react.createElement)(Text, {
 		color: inkColor(getPalette().dim),
 		wrap: "truncate-end"
-	}, truncateColumns("↑↓ move · tab configure · enter add/update key · d remove key · x remove custom provider · r retry · esc back", viewport.contentColumns)));
+	}, truncateColumns("↑↓ move · enter key · l login · o logout · tab configure · d remove key · x remove provider · r retry · esc back", viewport.contentColumns)));
 }
 /** Provider configuration editor: only explicit models are written to settings. */
 function ProviderConfigurationPanel({ target, catalog, save, done, back }) {
@@ -31002,7 +31631,7 @@ function HelpPanel({ descriptors, skills, commandError, skillError, onClose }) {
 			key: "key-submit",
 			dimColor: true,
 			wrap: "truncate-end"
-		}, "  enter submit · alt+enter / ctrl+j newline · up/down history · tab complete"),
+		}, "  enter submit · up/down history · tab complete"),
 		(0, import_react.createElement)(Text, {
 			key: "key-mentions",
 			dimColor: true,
@@ -31039,31 +31668,8 @@ function HelpPanel({ descriptors, skills, commandError, skillError, onClose }) {
 			color: inkColor(getPalette().error),
 			wrap: "truncate-end"
 		}, truncateColumns(`  command catalog unavailable: ${singleLineText(commandError)}`, viewport.contentColumns))],
-		(0, import_react.createElement)(Box, { key: "local-help" }, row("/help", "show this overlay")),
-		(0, import_react.createElement)(Box, { key: "local-model" }, row("/model", "switch the model")),
-		(0, import_react.createElement)(Box, { key: "local-effort" }, row("/effort", "adjust reasoning effort for the current model")),
-		(0, import_react.createElement)(Box, { key: "local-mode" }, row("/mode", "inspect or select the agent preset (/mode [preset])")),
-		(0, import_react.createElement)(Box, { key: "local-permission" }, row("/permission", "inspect or select the permission preset (/permission [preset])")),
-		(0, import_react.createElement)(Box, { key: "local-new" }, row("/new", "create and switch to a fresh session (/new [preset])")),
-		(0, import_react.createElement)(Box, { key: "local-fork" }, row("/fork", "fork at the latest completed turn (/fork [event-seq])")),
-		(0, import_react.createElement)(Box, { key: "local-resume" }, row("/resume", "browse or switch root sessions (/resume [id|prefix])")),
-		(0, import_react.createElement)(Box, { key: "local-plugin" }, row("/plugin", "inspect the live plugin composition")),
-		(0, import_react.createElement)(Box, { key: "local-jobs" }, row("/jobs", "inspect background jobs")),
-		(0, import_react.createElement)(Box, { key: "local-statusline" }, row("/statusline", "customize the status line items")),
-		(0, import_react.createElement)(Box, { key: "local-theme" }, row("/theme", "switch the color theme")),
-		(0, import_react.createElement)(Box, { key: "local-history" }, row("/history", "search and recall past prompts")),
-		(0, import_react.createElement)(Box, { key: "local-agents" }, row("/agents", "inspect subagent sessions of this conversation")),
-		(0, import_react.createElement)(Box, { key: "local-todos" }, row("/todos", "inspect the full todo list")),
-		(0, import_react.createElement)(Box, { key: "local-subagent" }, row("/subagent", "choose the model delegated subagents run on")),
-		(0, import_react.createElement)(Box, { key: "local-delete" }, row("/delete", "delete a session and its subagent threads")),
-		(0, import_react.createElement)(Box, { key: "local-clear" }, row("/clear", "clear the screen")),
-		(0, import_react.createElement)(Box, { key: "local-export" }, row("/export", "export the transcript to markdown (/export [path])")),
-		(0, import_react.createElement)(Box, { key: "local-title" }, row("/title", "rename this session (/title <text>)")),
-		(0, import_react.createElement)(Box, { key: "local-copy" }, row("/copy", "copy the latest assistant response")),
-		(0, import_react.createElement)(Box, { key: "local-diff" }, row("/diff", "inspect Git changes (/diff [--staged|ref])")),
-		(0, import_react.createElement)(Box, { key: "local-review" }, row("/review", "review Git changes under read-only permissions")),
-		(0, import_react.createElement)(Box, { key: "local-quit" }, row("/quit", "exit")),
-		...descriptors.map((descriptor) => (0, import_react.createElement)(Text, {
+		...LOCAL_COMMANDS.map((command) => (0, import_react.createElement)(Box, { key: `local-${command.label.slice(1)}` }, row(command.label, command.description))),
+		...descriptors.filter((descriptor) => !LOCAL_COMMAND_NAMES.has(descriptor.name)).map((descriptor) => (0, import_react.createElement)(Text, {
 			key: `command-${descriptor.name}`,
 			dimColor: true,
 			wrap: "truncate-end"
@@ -31332,130 +31938,11 @@ const MemoStaticTranscript = (0, import_react.memo)(StaticTranscript);
 function completionCandidates(value, descriptors, skills) {
 	if (!value.startsWith("/")) return [];
 	const prefix = value.slice(1).split(" ")[0] ?? "";
-	const local = [
-		{
-			label: "/help",
-			description: "show commands",
-			origin: "command"
-		},
-		{
-			label: "/model",
-			description: "switch the model",
-			origin: "command"
-		},
-		{
-			label: "/effort",
-			description: "adjust reasoning effort for the current model",
-			origin: "command"
-		},
-		{
-			label: "/mode",
-			description: "select the agent preset",
-			origin: "command"
-		},
-		{
-			label: "/permission",
-			description: "inspect or select the permission preset",
-			origin: "command"
-		},
-		{
-			label: "/new",
-			description: "start a fresh session",
-			origin: "command"
-		},
-		{
-			label: "/fork",
-			description: "fork at a completed turn",
-			origin: "command"
-		},
-		{
-			label: "/resume",
-			description: "browse or switch sessions",
-			origin: "command"
-		},
-		{
-			label: "/plugin",
-			description: "inspect the plugin composition",
-			origin: "command"
-		},
-		{
-			label: "/jobs",
-			description: "inspect background jobs",
-			origin: "command"
-		},
-		{
-			label: "/statusline",
-			description: "customize the status line",
-			origin: "command"
-		},
-		{
-			label: "/theme",
-			description: "switch the color theme",
-			origin: "command"
-		},
-		{
-			label: "/history",
-			description: "search and recall past prompts",
-			origin: "command"
-		},
-		{
-			label: "/agents",
-			description: "inspect subagent sessions of this conversation",
-			origin: "command"
-		},
-		{
-			label: "/todos",
-			description: "inspect the full todo list",
-			origin: "command"
-		},
-		{
-			label: "/subagent",
-			description: "choose the model delegated subagents run on",
-			origin: "command"
-		},
-		{
-			label: "/delete",
-			description: "delete a session and its subagent threads",
-			origin: "command"
-		},
-		{
-			label: "/clear",
-			description: "clear the screen",
-			origin: "command"
-		},
-		{
-			label: "/export",
-			description: "export the transcript to markdown",
-			origin: "command"
-		},
-		{
-			label: "/title",
-			description: "rename this session",
-			origin: "command"
-		},
-		{
-			label: "/copy",
-			description: "copy the latest assistant response",
-			origin: "command"
-		},
-		{
-			label: "/diff",
-			description: "inspect Git changes",
-			origin: "command"
-		},
-		{
-			label: "/review",
-			description: "review changes read-only",
-			origin: "command"
-		},
-		{
-			label: "/quit",
-			description: "exit",
-			origin: "command"
-		}
-	];
-	const localNames = new Set(local.map((candidate) => candidate.label.slice(1)));
-	const registry = descriptors.filter((descriptor) => !localNames.has(descriptor.name)).map((descriptor) => ({
+	const local = LOCAL_COMMANDS.map((command) => ({
+		...command,
+		origin: "command"
+	}));
+	const registry = descriptors.filter((descriptor) => !LOCAL_COMMAND_NAMES.has(descriptor.name)).map((descriptor) => ({
 		label: `/${descriptor.name}`,
 		description: descriptor.description,
 		origin: "command"
@@ -31534,11 +32021,19 @@ function CompletionMenu({ active, mention, index, rows }) {
 * While a modal (approval / question / model panel) owns the keys, the
 * box passes every key through untouched.
 */
-function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, interrupt, quit, openModel, openEffort, openHelp, openMode, openPermission, openResume, openPlugin, openJobs, openStatusline, openTheme, openHistory, openAgents, openSubagent, openTodos, openDelete, openDiff, reviewChanges, deleteConfirm, confirmDelete, cancelDelete, createSession, forkSession, cancelSessionSwitch, notify, hasNotice, dismissNotice, toggleReasoning, openVerbose, clearView, refresh, loadMentions, cyclePermission, exportTranscript, renameTitle, copyLastResponse, recallSpace, recordLocal, recordHistory, queued, cancelQueued, historyFill, historyConsumed, waveTier, waveStyle, maxRows, onEditorRows }) {
+function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, interrupt, quit, openModel, openEffort, openHelp, openMode, openPermission, openResume, openPlugin, openJobs, openStatusline, openTheme, openHistory, openAgents, openSubagent, openTodos, openDelete, openDiff, reviewChanges, deleteConfirm, confirmDelete, cancelDelete, createSession, forkSession, cancelSessionSwitch, notify, hasNotice, dismissNotice, toggleReasoning, openVerbose, clearView, refresh, loadMentions, inspectImages, prepareImages, cyclePermission, exportTranscript, renameTitle, copyLastResponse, recallSpace, recordLocal, recordHistory, queued, cancelQueued, historyFill, historyConsumed, waveTier, waveStyle, maxRows, onEditorRows }) {
 	const columns = useStdout().stdout?.columns ?? 80;
 	const stdin = useStdin().stdin;
 	const [value, setValue] = (0, import_react.useState)("");
 	const [cursor, setCursor] = (0, import_react.useState)(0);
+	const valueRef = (0, import_react.useRef)(value);
+	const cursorRef = (0, import_react.useRef)(cursor);
+	valueRef.current = value;
+	cursorRef.current = cursor;
+	const [draftImages, setDraftImages] = (0, import_react.useState)([]);
+	const draftImagesRef = (0, import_react.useRef)(draftImages);
+	draftImagesRef.current = draftImages;
+	const [preparingImages, setPreparingImages] = (0, import_react.useState)(false);
 	const killRef = (0, import_react.useRef)("");
 	const preferredColumnRef = (0, import_react.useRef)(null);
 	const editorScrollRef = (0, import_react.useRef)(0);
@@ -31551,6 +32046,8 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 	(0, import_react.useEffect)(() => {
 		if (historyFill === void 0) return;
 		const safe = sanitizeDraftText(historyFill.text);
+		draftImagesRef.current = [];
+		setDraftImages([]);
 		setValue(safe);
 		setCursor(safe.length);
 		preferredColumnRef.current = null;
@@ -31567,6 +32064,13 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 		recallSpace,
 		historyConsumed
 	]);
+	(0, import_react.useEffect)(() => {
+		setDraftImages((current) => {
+			const next = current.filter((image) => value.includes(image.marker));
+			draftImagesRef.current = next;
+			return next.length === current.length ? current : next;
+		});
+	}, [value]);
 	(0, import_react.useEffect)(() => {
 		if (stdin === void 0) return;
 		const originalRead = stdin.read.bind(stdin);
@@ -31602,6 +32106,64 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 	};
 	const mentionActive = mentionToken !== void 0;
 	const [mentionRows, setMentionRows] = (0, import_react.useState)([]);
+	const sameImagePath = (left, right) => process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+	const uniqueImageMarker = (name, source, reserved = []) => {
+		const safeName = singleLineText(sanitizeDraftText(name));
+		let marker = source === "mention" ? `@${safeName}` : `[image: ${safeName}]`;
+		let suffix = 2;
+		while (valueRef.current.includes(marker) || draftImagesRef.current.some((image) => image.marker === marker) || reserved.includes(marker)) {
+			marker = source === "mention" ? `@${safeName} (${suffix})` : `[image: ${safeName} ${suffix}]`;
+			suffix += 1;
+		}
+		return marker;
+	};
+	const registerDraftImage = (inspection, marker) => {
+		if (draftImagesRef.current.some((image) => sameImagePath(image.path, inspection.path))) {
+			notify(`${inspection.name} is already attached`, "warning");
+			return false;
+		}
+		const next = [...draftImagesRef.current, {
+			...inspection,
+			marker
+		}];
+		draftImagesRef.current = next;
+		setDraftImages(next);
+		return true;
+	};
+	const insertDroppedImages = (paths) => {
+		notify(`checking ${paths.length} image${paths.length === 1 ? "" : "s"}…`);
+		inspectImages(paths).then((inspected) => {
+			const additions = [];
+			const markers = [];
+			for (const inspection of inspected) {
+				if ([...draftImagesRef.current, ...additions].some((image) => sameImagePath(image.path, inspection.path))) continue;
+				const marker = uniqueImageMarker(inspection.name, "drop", markers);
+				additions.push({
+					...inspection,
+					marker
+				});
+				markers.push(marker);
+			}
+			if (additions.length === 0) {
+				notify("those images are already attached", "warning");
+				return;
+			}
+			const at = cursorRef.current;
+			const current = valueRef.current;
+			const insertion = `${at > 0 && !/\s$/u.test(current.slice(0, at)) ? " " : ""}${markers.join(" ")}${current.slice(at) === "" ? "" : " "}`;
+			const next = current.slice(0, at) + insertion + current.slice(at);
+			valueRef.current = next;
+			cursorRef.current = at + insertion.length;
+			setValue(next);
+			setCursor(cursorRef.current);
+			const nextImages = [...draftImagesRef.current, ...additions];
+			draftImagesRef.current = nextImages;
+			setDraftImages(nextImages);
+			notify(`${additions.length} image${additions.length === 1 ? "" : "s"} ready for the next message`);
+		}, (reason) => {
+			notify(`image attachment failed: ${reason instanceof Error ? reason.message : String(reason)}`, "error");
+		});
+	};
 	(0, import_react.useEffect)(() => {
 		if (!active || !mentionActive) {
 			setMentionRows([]);
@@ -31629,6 +32191,41 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 		if (mentionActive && mentionToken !== void 0) {
 			const row = mentionRows[completionIndex % mentionRows.length];
 			if (row !== void 0) {
+				if (row.kind === "file" && row.path !== void 0 && looksLikeImagePath(row.path)) {
+					const tokenText = value.slice(mentionToken.start, cursor);
+					const start = mentionToken.start;
+					notify(`checking image ${basename(row.path)}…`);
+					inspectImages([row.path]).then((inspected) => {
+						const inspection = inspected[0];
+						if (inspection === void 0) return;
+						const current = valueRef.current;
+						if (current.slice(start, start + tokenText.length) !== tokenText) return;
+						if (draftImagesRef.current.some((image) => sameImagePath(image.path, inspection.path))) {
+							const next = current.slice(0, start) + current.slice(start + tokenText.length);
+							valueRef.current = next;
+							cursorRef.current = start;
+							setValue(next);
+							setCursor(start);
+							setDismissedMenuValue(next);
+							notify(`${inspection.name} is already attached`, "warning");
+							return;
+						}
+						const marker = uniqueImageMarker(inspection.name, "mention");
+						const next = current.slice(0, start) + marker + current.slice(start + tokenText.length);
+						valueRef.current = next;
+						cursorRef.current = start + marker.length;
+						setValue(next);
+						setCursor(cursorRef.current);
+						setDismissedMenuValue(next);
+						registerDraftImage(inspection, marker);
+						notify(`${inspection.name} ready for the next message`);
+					}, (reason) => {
+						notify(`image attachment failed: ${reason instanceof Error ? reason.message : String(reason)}`, "error");
+					});
+					setCompletionIndex(0);
+					setDismissedMenuValue(void 0);
+					return;
+				}
 				const insertion = row.label.startsWith("@") ? row.label : `@${row.label}${row.kind === "directory" ? "/" : ""}`;
 				setValue(value.slice(0, mentionToken.start) + insertion + value.slice(cursor));
 				setCursor(mentionToken.start + insertion.length);
@@ -31660,6 +32257,7 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 	};
 	useInput((input, key) => {
 		if (!active) return;
+		if (preparingImages) return;
 		if (deleteConfirm !== void 0) {
 			if (input === "y" || input === "Y") confirmDelete();
 			else cancelDelete();
@@ -31687,6 +32285,8 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 			else if (value !== "") {
 				setValue("");
 				setCursor(0);
+				draftImagesRef.current = [];
+				setDraftImages([]);
 				setCompletionIndex(0);
 				setDismissedMenuValue(void 0);
 			} else quit();
@@ -31717,18 +32317,11 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 			cancelQueued(queued[queued.length - 1].messageId);
 			return;
 		}
-		const shiftEnterSequence = input === "[13;2u" || input === "[27;2;13~";
-		if (shiftEnterSequence || key.return) {
+		if (key.return) {
 			if (pasteBracketRef.current) {
 				applyEdit(insertText(value, cursor, "\n"));
 				return;
 			}
-			if (shiftEnterSequence || key.shift || key.meta || key.ctrl && input === "j") {
-				setValue(value.slice(0, cursor) + "\n" + value.slice(cursor));
-				setCursor(cursor + 1);
-				setDismissedMenuValue(void 0);
-				return;
-			}
 			if (menuActive) {
 				if (!(!mentionActive && candidates.some((candidate) => candidate.label === value))) {
 					acceptMenuCandidate();
@@ -31736,6 +32329,34 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 				}
 			}
 			const text = value.trim();
+			if (draftImagesRef.current.length > 0) {
+				setPreparingImages(true);
+				notify(`processing ${draftImagesRef.current.length} image${draftImagesRef.current.length === 1 ? "" : "s"}…`);
+				const snapshot = draftImagesRef.current;
+				prepareImages(snapshot.map((image) => image.path)).then((images) => {
+					setPreparingImages(false);
+					valueRef.current = "";
+					cursorRef.current = 0;
+					setValue("");
+					setCursor(0);
+					draftImagesRef.current = [];
+					setDraftImages([]);
+					setCompletionIndex(0);
+					setDismissedMenuValue(void 0);
+					dismissNotice();
+					if (text !== "") {
+						recordLocal(text);
+						recordHistory(text);
+					}
+					recall.current = beginRecall(recallSpace, "");
+					if (busy) steer(text, images);
+					else dispatch(text, images);
+				}, (reason) => {
+					setPreparingImages(false);
+					notify(`image submission failed: ${reason instanceof Error ? reason.message : String(reason)}`, "error");
+				});
+				return;
+			}
 			setValue("");
 			setCursor(0);
 			setCompletionIndex(0);
@@ -31863,6 +32484,7 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 			dispatch(text);
 			return;
 		}
+		if (input === "\n" || input === "\r") return;
 		if (menuActive && key.upArrow) {
 			setCompletionIndex((index) => (index + menuRows.length - 1) % menuRows.length);
 			return;
@@ -32011,6 +32633,11 @@ function Input({ active, frozen, busy, descriptors, skills, dispatch, steer, int
 				text = text.replaceAll(PASTE_END_MARKER, "");
 			}
 			if (text === "") return;
+			const droppedPaths = text.length > 1 ? parsePastedImagePaths(text) : [];
+			if (droppedPaths.length > 0) {
+				insertDroppedImages(droppedPaths);
+				return;
+			}
 			applyEdit(insertText(value, cursor, text));
 		}
 	});
@@ -32429,6 +33056,8 @@ function App(props) {
 	const [modelError, setModelError] = (0, import_react.useState)(void 0);
 	const [providerDirectory, setProviderDirectory] = (0, import_react.useState)(void 0);
 	const [providerError, setProviderError] = (0, import_react.useState)(void 0);
+	const [authorizationDirectory, setAuthorizationDirectory] = (0, import_react.useState)(void 0);
+	const [authorizationError, setAuthorizationError] = (0, import_react.useState)(void 0);
 	const [modelLoadEpoch, setModelLoadEpoch] = (0, import_react.useState)(0);
 	const [notice, setNotice] = (0, import_react.useState)(void 0);
 	const notify = (0, import_react.useCallback)((text, tone = "info") => {
@@ -32476,6 +33105,24 @@ function App(props) {
 		modelLoadEpoch,
 		props.loadModelProviders
 	]);
+	(0, import_react.useEffect)(() => {
+		if (!modelOpen || props.loadProviderAuthorizations === void 0) return;
+		let cancelled = false;
+		setAuthorizationDirectory(void 0);
+		setAuthorizationError(void 0);
+		Promise.resolve().then(() => props.loadProviderAuthorizations()).then((loaded) => {
+			if (!cancelled) setAuthorizationDirectory(loaded);
+		}, (error) => {
+			if (!cancelled) setAuthorizationError(error instanceof Error ? error.message : String(error));
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [
+		modelOpen,
+		modelLoadEpoch,
+		props.loadProviderAuthorizations
+	]);
 	(0, import_react.useEffect)(() => {
 		const subscribe = props.subscribeModelProviders;
 		if (!modelOpen || subscribe === void 0) return;
@@ -32485,6 +33132,15 @@ function App(props) {
 			setProviderError(error instanceof Error ? error.message : String(error));
 		}
 	}, [modelOpen, props.subscribeModelProviders]);
+	(0, import_react.useEffect)(() => {
+		const subscribe = props.subscribeProviderAuthorizations;
+		if (!modelOpen || subscribe === void 0) return;
+		try {
+			return subscribe(() => setModelLoadEpoch((epoch) => epoch + 1));
+		} catch (error) {
+			setAuthorizationError(error instanceof Error ? error.message : String(error));
+		}
+	}, [modelOpen, props.subscribeProviderAuthorizations]);
 	const busy = view.busy;
 	const [showReasoning, setShowReasoning] = (0, import_react.useState)(false);
 	const [verboseOpen, setVerboseOpen] = (0, import_react.useState)(false);
@@ -32681,13 +33337,16 @@ function App(props) {
 		busy,
 		streamingActive
 	]);
+	const sessionHasImages = (0, import_react.useMemo)(() => view.entries.some((entry) => (entry.kind === "user" || entry.kind === "pending") && (entry.images?.length ?? 0) > 0), [view.entries]);
 	/** Apply one /model pick: record the selection, close the panel, report via notice. */
 	const applyModel = (row, effortId) => {
 		try {
 			const label = props.selectModel(row, effortId);
 			setModelLabel(label);
 			setEffortLabel(effortId);
-			notify(`model → next step uses ${label}${effortId === void 0 || effortId === "" ? "" : `@${effortId}`}`);
+			const selected = `${label}${effortId === void 0 || effortId === "" ? "" : `@${effortId}`}`;
+			if (sessionHasImages && row.inputModalities !== void 0 && !row.inputModalities.includes("image")) notify(`model → ${selected} · image history will be sent as text placeholders`, "warning");
+			else notify(`model → next step uses ${selected}`);
 			setModelOpen(false);
 			setProviderOpen(false);
 			setProviderAction(void 0);
@@ -32707,7 +33366,37 @@ function App(props) {
 	};
 	let modelSurface;
 	if (modelOpen && !approvalPending && !questionPending) {
-		if (providerAction?.kind === "configure" && props.saveModelProviderConfiguration !== void 0) modelSurface = (0, import_react.createElement)(ProviderConfigurationPanel, {
+		if (providerAction?.kind === "login" && props.beginProviderAuthorization !== void 0 && props.cancelProviderAuthorization !== void 0 && props.openAuthorizationUrl !== void 0 && props.copyTextValue !== void 0) modelSurface = (0, import_react.createElement)(ProviderAuthorizationPanel, {
+			row: providerAction.authorization,
+			begin: props.beginProviderAuthorization,
+			cancel: () => props.cancelProviderAuthorization(providerAction.authorization),
+			openUrl: props.openAuthorizationUrl,
+			copy: props.copyTextValue,
+			done: () => {
+				const authorization = providerAction.authorization;
+				setProviderAction(void 0);
+				setProviderOpen(false);
+				reloadModelSurfaces();
+				notify(`logged in to ${authorization.label}; select a model`);
+			},
+			back: () => {
+				setProviderAction(void 0);
+				setProviderOpen(true);
+			}
+		});
+		else if (providerAction?.kind === "logout" && props.logoutProviderAuthorization !== void 0) modelSurface = (0, import_react.createElement)(ProviderAuthorizationLogoutPanel, {
+			row: providerAction.authorization,
+			confirm: props.logoutProviderAuthorization,
+			done: () => {
+				const authorization = providerAction.authorization;
+				setProviderAction(void 0);
+				setProviderOpen(true);
+				reloadModelSurfaces();
+				notify(`logged out from ${authorization.label}`);
+			},
+			back: () => setProviderAction(void 0)
+		});
+		else if (providerAction?.kind === "configure" && props.saveModelProviderConfiguration !== void 0) modelSurface = (0, import_react.createElement)(ProviderConfigurationPanel, {
 			target: providerAction.target,
 			catalog: directory?.rows ?? [],
 			save: props.saveModelProviderConfiguration,
@@ -32761,6 +33450,8 @@ function App(props) {
 		else if (providerOpen) modelSurface = (0, import_react.createElement)(ProviderPanel, {
 			directory: providerDirectory,
 			error: providerError,
+			authorizations: authorizationDirectory,
+			authorizationError,
 			onCredential: (target) => {
 				if (props.saveModelProviderCredential === void 0) {
 					notify("API key storage is unavailable in this profile", "warning");
@@ -32801,6 +33492,32 @@ function App(props) {
 					target
 				});
 			},
+			onLogin: (target, authorization) => {
+				if (busy) {
+					notify("provider login is available only while the agent is idle", "warning");
+					return;
+				}
+				if (props.beginProviderAuthorization === void 0 || props.cancelProviderAuthorization === void 0 || props.openAuthorizationUrl === void 0 || props.copyTextValue === void 0) {
+					notify("provider login is unavailable in this profile", "warning");
+					return;
+				}
+				setProviderAction({
+					kind: "login",
+					target,
+					authorization
+				});
+			},
+			onLogout: (target, authorization) => {
+				if (props.logoutProviderAuthorization === void 0) {
+					notify("provider logout is unavailable in this profile", "warning");
+					return;
+				}
+				setProviderAction({
+					kind: "logout",
+					target,
+					authorization
+				});
+			},
 			onRetry: reloadModelSurfaces,
 			onBack: () => setProviderOpen(false)
 		});
@@ -32983,6 +33700,8 @@ function App(props) {
 			setModelError(void 0);
 			setProviderDirectory(void 0);
 			setProviderError(void 0);
+			setAuthorizationDirectory(void 0);
+			setAuthorizationError(void 0);
 			setProviderOpen(false);
 			setProviderAction(void 0);
 			setEffortFor(void 0);
@@ -33070,6 +33789,8 @@ function App(props) {
 			if (!busy && !streamingActive) refreshScreen();
 		},
 		loadMentions: props.loadMentions,
+		inspectImages: props.inspectImages,
+		prepareImages: props.prepareImages,
 		cyclePermission: props.cyclePermission,
 		exportTranscript: props.exportTranscript,
 		renameTitle: props.renameTitle,
@@ -33394,14 +34115,16 @@ async function loadModelDirectory(ctx) {
 					provider: provider.id,
 					providerName: provider.name,
 					model: model.id,
-					modelName: model.name
+					modelName: model.name,
+					...model.inputModalities === void 0 ? {} : { inputModalities: [...model.inputModalities] }
 				};
 				if (llmResolve.resolveModelInfo === void 0) return row;
 				try {
 					const resolved = await llmResolve.resolveModelInfo(provider.id, model.id);
-					return resolved.reasoning === void 0 ? row : {
+					return {
 						...row,
-						reasoning: mapReasoning(resolved.reasoning)
+						...resolved.inputModalities === void 0 ? {} : { inputModalities: [...resolved.inputModalities] },
+						...resolved.reasoning === void 0 ? {} : { reasoning: mapReasoning(resolved.reasoning) }
 					};
 				} catch {
 					reasoningFailures.push(`${provider.id}/${model.id}`);
@@ -33503,7 +34226,7 @@ function deriveCredentialRef(provider) {
 }
 /** Events that invalidate the official Models provider/settings/credential join. */
 const PROVIDER_SETTINGS_EVENTS = [
-	"credentials/updated",
+	"credentials/reference-updated",
 	"settings/document-updated",
 	"llm/adapters-updated"
 ];
@@ -33821,7 +34544,8 @@ function createMentions(ctx, agent, cwd) {
 			const fileRows = files.slice(0, MAX_FILE_ROWS).map((candidate) => ({
 				label: candidate.path,
 				description: candidate.kind === "directory" ? "Folder" : "File",
-				kind: candidate.kind
+				kind: candidate.kind,
+				...candidate.kind === "file" ? { path: isAbsolute(candidate.path) ? candidate.path : resolve(cwd, candidate.path) } : {}
 			}));
 			const sessionRows = sessions.map((candidate) => ({
 				label: formatSessionReferenceMention(candidate),
@@ -34284,44 +35008,6 @@ function buildExportMarkdown(view, sessionId) {
 	return out.join("\n");
 }
 //#endregion
-//#region src/attachments.ts
-/** Terminal image-file adapter over the Harness durable attachment service. */
-/** Detect the supported encoded raster formats from bytes, never from a path suffix. */
-function detectImageMediaType(data) {
-	if (data.length >= 8 && data[0] === 137 && data[1] === 80 && data[2] === 78 && data[3] === 71 && data[4] === 13 && data[5] === 10 && data[6] === 26 && data[7] === 10) return "image/png";
-	if (data.length >= 3 && data[0] === 255 && data[1] === 216 && data[2] === 255) return "image/jpeg";
-	if (data.length >= 6) {
-		const signature = String.fromCharCode(...data.subarray(0, 6));
-		if (signature === "GIF87a" || signature === "GIF89a") return "image/gif";
-	}
-	if (data.length >= 12 && String.fromCharCode(...data.subarray(0, 4)) === "RIFF" && String.fromCharCode(...data.subarray(8, 12)) === "WEBP") return "image/webp";
-}
-/** Read, validate, and persist an ordered image path list as model content blocks. */
-async function saveImagePaths(paths, attachments) {
-	if (paths.length === 0) return [];
-	if (attachments === void 0) throw new Error("image attachments are unavailable in this profile");
-	const inputs = [];
-	for (const path of paths) {
-		let data;
-		try {
-			data = await readFile(path);
-		} catch (error) {
-			throw new Error(`cannot read image "${path}": ${error instanceof Error ? error.message : String(error)}`);
-		}
-		const mediaType = detectImageMediaType(data);
-		if (mediaType === void 0) throw new Error(`unsupported image file "${path}" (expected PNG, JPEG, WebP, or GIF)`);
-		inputs.push({
-			data,
-			mediaType,
-			name: basename(path)
-		});
-	}
-	return (await attachments.saveImages(inputs)).map((attachment) => ({
-		type: "image",
-		attachment
-	}));
-}
-//#endregion
 //#region src/editor.ts
 /** Host editor and clipboard adapters used by the terminal surface. */
 function waitForProcess(command, args, input) {
@@ -34602,7 +35288,6 @@ function applyPendingPermission(service, session, pending) {
 */
 function listPermissionRows(service) {
 	return service.names.map((id) => {
-		if (service.optionOf === void 0) return { id };
 		try {
 			return {
 				id,
@@ -35216,16 +35901,16 @@ async function run(ctx, startup, io) {
 		deliverLine(line, mode, images);
 	};
 	/** Dispatch one submitted line: slash commands to the registry, other text to the agent. */
-	const dispatch = (text) => {
-		send(text, "followup");
+	const dispatch = (text, images = []) => {
+		send(text, "followup", images);
 	};
 	/**
 	* Submit steering: a running driver consumes the text at its next step
 	* boundary (the inbox delivers between steps); an idle driver just starts
 	* a turn, so this doubles as the busy-state submit path.
 	*/
-	const steer = (text) => {
-		send(text, "steer");
+	const steer = (text, images = []) => {
+		send(text, "steer", images);
 	};
 	/** Interrupt the running turn (Esc); true when a turn was actually cancelled. */
 	const interrupt = () => {
@@ -35637,7 +36322,16 @@ async function run(ctx, startup, io) {
 			saveModelProviderConfiguration: (target, configuration) => saveProviderConfiguration(ctx, target, configuration),
 			unsetModelProviderCredential: (target) => unsetProviderCredential(ctx, target),
 			removeModelProvider: (target) => removeProviderSettings(ctx, target),
+			loadProviderAuthorizations: () => loadProviderAuthorizations(ctx),
+			subscribeProviderAuthorizations: (listener) => subscribeProviderAuthorizations(ctx, listener),
+			beginProviderAuthorization: (row, method, interaction, signal) => beginProviderAuthorization(ctx, row, method, interaction, signal),
+			cancelProviderAuthorization: (row) => cancelProviderAuthorization(ctx, row.key),
+			logoutProviderAuthorization: (row) => logoutProviderAuthorization(ctx, row),
+			openAuthorizationUrl,
+			copyTextValue: copyText,
 			loadMentions: (query, signal) => mentions.candidates(query, signal),
+			inspectImages: (paths) => inspectImagePaths(paths, ctx.get("attachments"), session?.header.cwd ?? cwd),
+			prepareImages: (paths) => saveImagePaths(paths, ctx.get("attachments")),
 			cyclePermission: cyclePermission$1,
 			setPermission: setPermissionAction,
 			selectModel,
@@ -35687,7 +36381,13 @@ async function run(ctx, startup, io) {
 		mountRef.current?.rerender(appElement());
 	};
 	mountRef.current = io.mount(appElement());
-	if (startup.prompt !== void 0 || (startup.images?.length ?? 0) > 0) saveImagePaths(startup.images ?? [], ctx.get("attachments")).then((images) => send(startup.prompt ?? "", "followup", images), (error) => bridge.notify(`initial prompt failed: ${error instanceof Error ? error.message : String(error)}`, "error"));
+	if (startup.prompt !== void 0 || (startup.images?.length ?? 0) > 0) {
+		if ((startup.images?.length ?? 0) > 0) bridge.notify(`processing ${startup.images.length} startup image${startup.images.length === 1 ? "" : "s"}…`);
+		saveImagePaths(startup.images ?? [], ctx.get("attachments")).then((images) => {
+			if (images.length > 0) bridge.notify(`${images.length} startup image${images.length === 1 ? "" : "s"} attached`);
+			send(startup.prompt ?? "", "followup", images);
+		}, (error) => bridge.notify(`initial prompt failed: ${error instanceof Error ? error.message : String(error)}`, "error"));
+	}
 	async function copyLastResponse() {
 		const text = latestAssistantText(store.getView());
 		if (text === void 0) return "nothing to copy yet";