dsh-global-todo 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## [0.16.0] — 2026-10-22
+
+The three small promises the roadmap still carried.
+
+- **`before:` / `after:` in the search box** bound the deadline (strict at the bound). Items
+  without a deadline cannot satisfy either bound, and a half-typed date such as `before:2026`
+  simply stops filtering instead of throwing on every keystroke.
+- **「重新挂载」 next to a dead attachment** re-points it in place (`POST /relink`, same
+  `{ todo, changed }` shape as `/update`), keeping the kind and title. `annotateLinks()` finally
+  has its unit test — and it now flags a dead **image** too, which it used to skip, so a missing
+  screenshot shows the existing chip instead of a broken frame.
+- **Accessibility pass**: the toast is a polite live region, errors are alerts, groups and rows
+  are list items, filter buttons report `aria-pressed`, and every icon-only button has a name.
+  `test/a11y.test.mjs` reads the client source so these cannot quietly regress without a browser.
+
+## [0.15.0] — 2026-10-22
+
+Image attachments: a reference that renders, not a copy that goes stale.
+
+- **`kind: "image"` is a third attachment kind** beside `url` and `file`. The path stays an
+  absolute reference — the list still never stores bytes — but it must have a renderable
+  extension (png / jpg / jpeg / webp / gif / avif; SVG is excluded because it can carry script
+  when served inline). A bare path is never guessed into an image: the caller states it.
+- **`GET /asset?id=&index=` serves the bytes**, reading the path out of the store rather than from
+  the request, so there is no traversal surface. Capped at 8 MB with `nosniff`, and only for
+  `image` links — a document link asked through this route is a 400, a missing index a 404.
+- **The panel shows a thumbnail on the row and a preview in the detail**, both lazy, and the
+  existing "file is gone" marker still applies: a dead image renders as a bad chip, not a broken
+  frame.
+- Tool schemas accept `kind: "image"` wherever an attachment does, so an agent can attach a
+  screenshot of what it built.
+
 ## [0.14.0] — 2026-10-22
 
 Choose how much surface a deployment pays for.

package/README.md

@@ -211,7 +211,10 @@ Your list is not touched by install or uninstall: it lives outside the plugin, a
 ### The panel
 
 - **Add** — type a title and press Enter. "More fields" reveals the description, the
-  attachment box (one document path or URL per line), tags, priority and a due time.
+  attachment box (one document path or URL per line), tags, priority and a due time. An
+  attachment may also be `{ kind: "image", value: "/abs/shot.png" }` — the row then shows a
+  thumbnail and the detail a preview, with the bytes read on demand (png/jpg/jpeg/webp/gif/avif,
+  ≤8 MB) and never copied into the list.
 - **Filters** — all / open / doing / done / overdue, plus a text search across titles,
   descriptions, tags and attachments. The count chips in the header are filters too.
 - **Grouped by urgency** — overdue / today / next up / later / no due date / done, each
@@ -249,7 +252,7 @@ Your list is not touched by install or uninstall: it lives outside the plugin, a
   That is an attempt order: an unloadable target means the next one is tried. Anything with
   nowhere to go comes back with a picker rather than being sent somewhere unchosen, and one
   failure does not abort the batch.
-- **Search syntax** — `tag:release` (or `#ops`), `is:overdue`, `is:active`, `has:link`,
+- **Search syntax** — `tag:release` (or `#ops`), `is:overdue`, `is:active`, `has:link`, `before:2026-11-01` / `after:2026-10-01` (deadline bounds; a half-typed date simply stops filtering),
   `has:note`, `level:p0`, plus free words combined with AND (which also match note text). A
   search without a colon behaves exactly as it always did.
 - **Progress notes** — an append-only trail per todo (count on the row, full text and an add
@@ -390,6 +393,8 @@ fence when that service is present, and by a strict loopback check otherwise.
 | POST | `/api/global-todo/review` | `{ id, decision: confirm\|reject }` — answer an agent's completion |
 | GET | `/api/global-todo/report?days=7` | what the agents finished in the window, and the files it touched |
 | GET | `/api/global-todo/session?id=` | what a bound conversation last said (`tail`, `alive`, `dir`) |
+| POST | `/api/global-todo/relink` | `{ id, index, value }` — re-point a dead attachment (the value must still be a valid absolute path or URL of that kind) |
+| GET | `/api/global-todo/asset?id=&index=` | the bytes of an **image** attachment (path read from the store, never from the request; ≤8 MB, png/jpg/jpeg/webp/gif/avif) |
 | POST | `/api/global-todo/link` | `{ id, add?: [...], remove?: [value \| index] }` |
 | POST | `/api/global-todo/dispatch` | `{ id, mode?: auto\|bound\|new\|current, sessionId?, dir? }` |
 | POST | `/api/global-todo/assign` | `{ ids, items?, target?, dir? }` — hand several todos over in one call; an id that matches nothing comes back instead of being sent elsewhere |

package/README.zh.md

@@ -188,6 +188,7 @@ dsh plugin --profile web remove dsh-global-todo
 
 ### 面板
 
+- **图片附件**：附件也可以写成 `{ "kind": "image", "value": "/绝对路径/shot.png" }`，行上显示缩略图、详情里显示预览；字节按需读取（png/jpg/jpeg/webp/gif/avif，≤8MB），**不复制进清单**。
 - **添加**：写一句标题回车即存。「更多字段」展开描述、附件框（一行一个文档绝对路径或网址）、
   标签、优先级、截止时间。
 - **筛选**：全部 / 未完成 / 进行中 / 已完成 / 逾期，外加跨标题、描述、标签、附件的文本搜索；
@@ -206,7 +207,7 @@ dsh plugin --profile web remove dsh-global-todo
 - **「抓取」在每个对话的分组上**：让**那个对话**里的 Agent 把该跟进的事登记成待办，结果就归在它自己那组下面（分组名旁边那个「抓取」）。工具栏上的「从本对话抓取」只在**当前对话还没有分组**时出现——否则没地方点它。抓取对象没在运行会**先唤醒**再问（与派发同一条规则）。
 - **工作目录**：`选择` 会用宿主的目录选择器；如果这个部署没挂载它（远程命名空间缺失），面板会自动改为**手动填路径**（`手动填` → 粘绝对路径 → `使用`），并说明原因——不会只丢一条看不懂的错误。
 - **一键分配（多选）**：工具栏点「选择」→ 勾几条 → 「一键分配」。每条按**原对话 → 同工作区对话 → 你选的目标**的顺序尝试（是**尝试顺序**，不是一次定死：原对话加载不了就自动往下走）。都找不到的会**报回来并给你选择器**，绝不擅自送到别处；其中一条失败也不会中断整批。
-- **搜索语法**：`tag:发布`（或 `#发布`）、`is:overdue`、`is:active`、`has:link`、`has:note`、`level:p0`（也可写 `level:urgent`），自由词之间是 **AND**，并且会一并搜进展记录。不带冒号的普通搜索行为不变。
+- **搜索语法**：`tag:发布`（或 `#发布`）、`is:overdue`、`is:active`、`has:link`、`has:note`、`level:p0`（也可写 `level:urgent`）、`before:2026-11-01` / `after:2026-10-01`（按截止时间卡边界；日期没打完时只是不生效，不会报错），自由词之间是 **AND**，并且会一并搜进展记录。不带冒号的普通搜索行为不变。
 - **进展记录**：每条待办可追加「谁在什么时候说了什么」的流水（行上显示条数，详情里看全文并可直接补一条）。Agent 报「做不完、卡在哪」应该写在这里，**而不是改写你的描述**。
 - **失效附件会标出来**：文件被移走/删除的附件在行上标红、详情里注明；这个标记是**读取时算的**，不写进记录——文件回来了就不该再标红。
 - **新对话开在哪**：默认**继承写下这条待办的对话所在的工作区**（新会话的工作目录也就是那个工作区），所以「接着这个活干」不会跑到不相干的工作区去；想指定就选 `＋ 新对话 · 工作区名`（列在工作区一栏里），指定的优先。只有当两者都不知道时，才退回按工作目录判断。
@@ -293,6 +294,8 @@ dsh plugin --profile web remove dsh-global-todo
 | POST | `/api/global-todo/review` | `{ id, decision: confirm\|reject }` —— 回答 Agent 的完成声明 |
 | GET | `/api/global-todo/report?days=7` | 这段时间里 Agent 完成了什么、触及了哪些文件 |
 | GET | `/api/global-todo/session?id=` | 绑定的会话最后说了什么（`tail` / `alive` / `dir`） |
+| POST | `/api/global-todo/relink` | `{ id, index, value }`——把失效附件重新指向（新值仍须是该类型的合法绝对路径/网址） |
+| GET | `/api/global-todo/asset?id=&index=` | 读**图片附件**的字节（路径只从待办记录里取，不接受请求传路径；≤8MB，png/jpg/jpeg/webp/gif/avif） |
 | POST | `/api/global-todo/link` | `{ id, add?: [...], remove?: [值 或 下标] }` |
 | POST | `/api/global-todo/dispatch` | `{ id, mode?: auto\|bound\|new\|current, sessionId?, dir? }` |
 | POST | `/api/global-todo/assign` | `{ ids, items?, target?, dir? }`——一次把多条交给 Agent；配不上的 id 原样报回，不擅自送到别处 |

package/docs/ROADMAP.md

@@ -200,14 +200,14 @@ of conversations involved, files touched with counts, and how many wait for revi
 time, never stored. The panel shows it from `⋯ → 本周报告`. Tests:
 `test/markdown.test.mjs` (pure aggregation) and `test/routes.test.mjs`.
 
-### 5. Image attachments
+### 5. ~~Image attachments~~ — landed in 0.15.0
 
-`kind: 'image'` beside `url` / `file`, so a screenshot can be attached instead of a path
-to one.
-
-- Today: `LINK_KINDS = ['url', 'file']` (`lib/links.js`); the link shape is already prepared.
-- Effort: medium — the store must not inline bytes, so this is a path with a preview and a
-  clear "the file is gone" state, which #3-adjacent work already models.
+`kind: 'image'` beside `url` / `file`: still an absolute reference (the store never holds
+bytes), required to carry a renderable extension, with `GET /asset?id=&index=` reading the
+path out of the record rather than from the request (8 MB cap, `nosniff`, image links only).
+The row shows a thumbnail and the detail a preview; a dead image keeps the existing
+missing-file chip instead of rendering a broken frame. `lib/links.js`, `lib/routes.js`,
+`lib/client.js`; tests in `test/links.test.mjs` and `test/routes.test.mjs`.
 
 ### 6. Source adapters for the ingest door
 
@@ -218,11 +218,17 @@ to one.
 - Effort: large, and the mode of the work is different: every adapter is an external
   dependency with its own failure modes. Do it when a real source exists, not before.
 
-### 7. Small, well-understood items
-
-- `before:` / `after:` date bounds in the search syntax (the parser already walks tokens).
-- 「重新挂载」 next to a dead attachment, plus the `annotateLinks()` unit test it owes.
-- A screen-reader pass over the panel and the group headers; the keyboard path is close.
+### 7. ~~Small, well-understood items~~ — landed in 0.16.0
+
+- **`before:` / `after:` date bounds** in the search syntax, applied to the deadline and strict
+  at the bound (`lib/service.js`); a half-typed date stops filtering instead of erroring on
+  every keystroke.
+- **「重新挂载」** beside a dead attachment (`POST /relink`, same shape as `/update`), plus the
+  `annotateLinks()` unit test the code owed — including the image kind, which the annotation
+  used to skip.
+- **Accessibility pass**: the toast is a polite live region, errors are alerts, groups and rows
+  are list items, filter buttons report `aria-pressed`, and every icon-only button carries a
+  name (`test/a11y.test.mjs` guards all of it).
 
 ### Landed after this list was written
 

package/lib/client.js

@@ -40,6 +40,11 @@ window.__ModuleLoader__.load({
     const LOCALE_NS = 'global-todo'
     /** Route prefix, relative to the document base. */
     const API = 'api/global-todo'
+    /**
+     * Where an image attachment's bytes come from. The route reads the path out of the
+     * store, so this URL carries an id and an index — never a filesystem path.
+     */
+    const assetUrl = (id, index) => `${API}/asset?id=${encodeURIComponent(id)}&index=${index}`
     const POLL_MS = 20000
     /** How long a deleted todo can be brought back. */
     const UNDO_MS = 8000
@@ -232,6 +237,7 @@ window.__ModuleLoader__.load({
       'dir.picked': '（已指定）',
       'action.save': '保存',
       'action.cancel': '取消',
+      'action.relink': '重新挂载',
       'filter.all': '全部',
       'filter.active': '未完成',
       'filter.doing': '进行中',
@@ -534,6 +540,7 @@ window.__ModuleLoader__.load({
       'meta.origin': 'from {dir}',
       'meta.completed': 'Completed {when}',
       'action.save': 'Save',
+      'action.relink': 'Re-point',
       'action.cancel': 'Cancel',
       'filter.all': 'All',
       'filter.active': 'Open',
@@ -1329,6 +1336,11 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
 .gt-attach .gt-chip { max-width: 280px; color: var(--dsw-alias-label-secondary); }
 .gt-attach a.gt-chip:hover { color: var(--dsw-alias-label-primary); border-color: var(--dsw-alias-border-l2); }
 .gt-attach-title { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.gt-chip-img { padding: 2px 8px 2px 3px; }
+.gt-thumb { width: 16px; height: 16px; object-fit: cover; border-radius: 999px; display: block; }
+.gt-shot-wrap { display: inline-flex; }
+.gt-shot { width: 84px; height: 56px; object-fit: cover; border-radius: 6px;
+  border: 1px solid var(--dsw-alias-border-l1); background: var(--dsw-alias-bg-layer-2); }
 .gt-menu { position: absolute; top: 40px; right: 10px; z-index: 3; min-width: 184px; display: flex;
   flex-direction: column; padding: 5px; background: var(--dsw-alias-bg-overlay);
   border: 1px solid var(--dsw-alias-border-l2); border-radius: 10px; }
@@ -1367,6 +1379,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
 .gt-pre { white-space: pre-wrap; word-break: break-word; margin: 0; line-height: 1.6; }
 .gt-muted { color: var(--dsw-alias-label-secondary); }
 .gt-links { display: flex; flex-direction: column; gap: 4px; margin: 0; padding: 0; list-style: none; }
+.gt-relink { display: flex; flex: 1 1 100%; gap: 6px; align-items: center; }
 .gt-link { display: flex; gap: 8px; align-items: center; padding: 4px 0; min-width: 0; }
 .gt-link-main { display: flex; align-items: center; gap: 6px; min-width: 0; flex: 1; }
 .gt-evidence { margin: 0; padding: 2px 0 2px 10px; border-left: 2px solid var(--dsw-alias-border-l2);
@@ -1722,6 +1735,9 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
       // the only place the question "did it get anywhere" is asked.
       const [tail, setTail] = useState(null)
       const [linkValue, setLinkValue] = useState('')
+      // Re-pointing a dead attachment: which row is editing, and what path it now holds.
+      const [relinkIndex, setRelinkIndex] = useState(null)
+      const [relinkValue, setRelinkValue] = useState('')
       const [linkTitle, setLinkTitle] = useState('')
       const [draft, setDraft] = useState({
         title: todo.title,
@@ -1935,7 +1951,21 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                   'div',
                   { className: 'gt-attach' },
                   todo.links.slice(0, MAX_LINK_CHIPS).map((link, index) =>
-                    link.kind === 'url'
+                    link.kind === 'image' && link.missing !== true
+                      ? h(
+                          'a',
+                          {
+                            key: `${index}:${link.value}`,
+                            className: 'gt-chip gt-chip-img',
+                            href: assetUrl(todo.id, index),
+                            target: '_blank',
+                            rel: 'noreferrer noopener',
+                            title: link.value,
+                          },
+                          h('img', { className: 'gt-thumb', src: assetUrl(todo.id, index), alt: link.title, loading: 'lazy' }),
+                          h('span', { className: 'gt-attach-title' }, link.title),
+                        )
+                      : link.kind === 'url'
                       ? h(
                           'a',
                           {
@@ -2376,6 +2406,19 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                         h(
                           'li',
                           { className: 'gt-link', key: `${link.kind}:${link.value}` },
+                          link.kind === 'image' && link.missing !== true
+                            ? h(
+                                'a',
+                                {
+                                  className: 'gt-shot-wrap',
+                                  href: assetUrl(todo.id, index),
+                                  target: '_blank',
+                                  rel: 'noreferrer noopener',
+                                  title: link.value,
+                                },
+                                h('img', { className: 'gt-shot', src: assetUrl(todo.id, index), alt: link.title, loading: 'lazy' }),
+                              )
+                            : null,
                           h(
                             'span',
                             { className: 'gt-link-main' },
@@ -2392,11 +2435,53 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                                 { type: 'button', className: 'gt-btn gt-btn-quiet', onClick: () => copy(link.value) },
                                 copied === link.value ? t('action.copied') : t('action.copy'),
                               ),
+                          link.missing === true
+                            ? h(
+                                'button',
+                                {
+                                  type: 'button',
+                                  className: 'gt-btn gt-btn-quiet',
+                                  disabled: busy,
+                                  onClick: () => {
+                                    setRelinkIndex(index)
+                                    setRelinkValue(link.value)
+                                  },
+                                },
+                                t('action.relink'),
+                              )
+                            : null,
                           h(
                             'button',
                             { type: 'button', className: 'gt-btn gt-btn-quiet', disabled: busy, onClick: () => onAction('unlink', todo, { index }) },
                             t('action.unlink'),
                           ),
+                          relinkIndex === index
+                            ? h(
+                                'span',
+                                { className: 'gt-relink' },
+                                h('input', {
+                                  className: 'gt-input',
+                                  value: relinkValue,
+                                  placeholder: t('field.linkValue'),
+                                  onChange: (event) => setRelinkValue(event.target.value),
+                                }),
+                                h(
+                                  'button',
+                                  {
+                                    type: 'button',
+                                    className: 'gt-btn',
+                                    disabled: busy || relinkValue.trim() === '',
+                                    onClick: () => onAction('relink', todo, { index, value: relinkValue }),
+                                  },
+                                  t('action.save'),
+                                ),
+                                h(
+                                  'button',
+                                  { type: 'button', className: 'gt-btn gt-btn-quiet', onClick: () => setRelinkIndex(null) },
+                                  t('action.cancel'),
+                                ),
+                              )
+                            : null,
                         ),
                       ),
                     ),
@@ -3487,6 +3572,13 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
         if (kind === 'steps') return run(todo.id, () => call('update', { method: 'POST', body: { id: todo.id, steps: payload.steps } }))
         if (kind === 'note') return run(todo.id, () => call('note', { method: 'POST', body: { id: todo.id, ...payload } }))
         if (kind === 'link') return run(todo.id, () => call('link', { method: 'POST', body: { id: todo.id, ...payload } }))
+        if (kind === 'relink') {
+          return run(todo.id, async () => {
+            await call('relink', { method: 'POST', body: { id: todo.id, ...payload } })
+            setRelinkIndex(null)
+            setRelinkValue('')
+          })
+        }
         if (kind === 'unlink') return run(todo.id, () => call('link', { method: 'POST', body: { id: todo.id, remove: [payload.index] } }))
         if (kind === 'remove') {
           return run(todo.id, async () => {
@@ -4745,7 +4837,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                     const exemptGroup = typeof group.dir === 'string' && group.dir !== '' && exemptWorkspaces.includes(group.dir)
                     return h(
                       'div',
-                      { className: 'gt-group', key: group.key, 'data-collapsed': isCollapsed ? '1' : '0' },
+                      { className: 'gt-group', key: group.key, role: 'listitem', 'data-collapsed': isCollapsed ? '1' : '0' },
                       h(
                         'div',
                         { className: 'gt-group-head' },
@@ -4836,7 +4928,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                         ? null
                         : h(
                             'div',
-                            { className: 'gt-list' },
+                            { className: 'gt-list', role: 'list' },
                             group.todos.map((todo) =>
                               h(TodoItem, {
                         selecting: selectMode,
@@ -4872,7 +4964,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
         notice !== null && notice !== undefined
           ? h(
               'div',
-              { className: 'gt-toast' },
+              { className: 'gt-toast', role: 'status', 'aria-live': 'polite' },
               h('span', null, notice.text),
               // Only offer the jump when the capability is really there: a button
               // that does nothing is worse than no button.

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools, normalizeToolGroups, selectTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.14.0'
+export const VERSION = '0.16.0'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/links.js

@@ -17,8 +17,28 @@
 
 import { TodoError } from './errors.js'
 
-/** Accepted attachment kinds. */
-export const LINK_KINDS = Object.freeze(['url', 'file'])
+/**
+ * Accepted attachment kinds.
+ *
+ * `image` is a reference like `file` — the bytes stay where they are — but it is
+ * declared rather than inferred, because the panel renders it and a guess would
+ * turn a random document into a broken thumbnail. The list still never copies
+ * bytes; `GET /asset` reads the referenced file on demand.
+ */
+export const LINK_KINDS = Object.freeze(['url', 'file', 'image'])
+
+/** Extensions the panel can actually render. SVG is excluded: served inline from the same
+ * origin it can carry script. */
+export const IMAGE_EXTENSIONS = Object.freeze(['.png', '.jpg', '.jpeg', '.webp', '.gif', '.avif'])
+
+/**
+ * @param {string} value
+ * @returns {boolean} whether the path looks like a renderable image
+ */
+export function isImagePath(value) {
+  const lower = String(value ?? '').toLowerCase()
+  return IMAGE_EXTENSIONS.some((extension) => lower.endsWith(extension))
+}
 
 const MAX_URL = 2048
 const MAX_PATH = 4096
@@ -27,6 +47,8 @@ const MAX_TITLE = 200
 /**
  * Guess the kind of a bare string attachment.
  *
+ * `image` is never inferred: it is a rendering decision the caller states.
+ *
  * @param {string} value
  * @returns {'url' | 'file'}
  */
@@ -91,6 +113,9 @@ export function normalizeLink(input, options = {}) {
   if (!isAbsolutePath(value)) {
     throw new TodoError('invalid-link', `文档请给绝对路径（相对路径会在不同会话下指向不同文件）：${value}`)
   }
+  if (kind === 'image' && !isImagePath(value)) {
+    throw new TodoError('invalid-link', `图片附件需要图片扩展名（${IMAGE_EXTENSIONS.join(' / ')}）：${value}`)
+  }
   if (options.requireExistingFiles === true && typeof options.exists === 'function' && !options.exists(value)) {
     throw new TodoError('invalid-link', `找不到这个文件：${value}`)
   }
@@ -113,7 +138,7 @@ export function isAbsolutePath(value) {
  * @returns {string}
  */
 export function defaultLinkTitle(kind, value) {
-  if (kind === 'file') {
+  if (kind === 'file' || kind === 'image') {
     const parts = value.split(/[\\/]/).filter(Boolean)
     return parts.length === 0 ? value : parts[parts.length - 1]
   }

package/lib/routes.js

@@ -21,7 +21,7 @@
  */
 
 import { createHash, timingSafeEqual } from 'node:crypto'
-import { readdir, stat } from 'node:fs/promises'
+import { readFile, readdir, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
 
@@ -81,6 +81,21 @@ export function isLoopbackRequest(request) {
  * @param {number} status
  * @param {unknown} body
  */
+/** Cap for an inline image; a screenshot is a few hundred KB, a 4K render is not. */
+const MAX_ASSET_BYTES = 8 * 1024 * 1024
+
+/**
+ * @param {string} file
+ * @returns {string} the content type for a served image extension
+ */
+function mimeForImage(file) {
+  const lower = String(file).toLowerCase()
+  if (lower.endsWith('.png')) return 'image/png'
+  if (lower.endsWith('.webp')) return 'image/webp'
+  if (lower.endsWith('.gif')) return 'image/gif'
+  if (lower.endsWith('.avif')) return 'image/avif'
+  return 'image/jpeg'
+}
 function sendJson(response, status, body) {
   const payload = JSON.stringify(body)
   response.statusCode = status
@@ -403,6 +418,38 @@ export function createRoutes(deps) {
      * Derived, never stored: completion records already hold the facts, and a cached
      * aggregate would be a second truth to keep honest.
      */
+
+    /**
+     * Serve the bytes of an image attachment.
+     *
+     * The path comes from the store, never from the request: the caller names a todo and
+     * a link index, so there is no traversal surface here. The list still stores only a
+     * reference; this route reads the file when the panel needs a thumbnail.
+     */
+    exact('GET', `${ROUTE_BASE}/asset`, async (request, response) => {
+      const query = params(request)
+      const id = (query.get('id') ?? '').trim()
+      const index = Number.parseInt(query.get('index') ?? '', 10)
+      if (id === '' || !Number.isInteger(index) || index < 0) {
+        throw new TodoError('invalid-body', 'asset 需要 id 与 index')
+      }
+      const todo = await service.get(id)
+      const link = (todo.links ?? [])[index]
+      if (link === undefined) throw new TodoError('not-found', '这条待办没有这个附件')
+      if (link.kind !== 'image') throw new TodoError('invalid-link', '只有图片附件可以这样读取')
+      const info = await stat(link.value).catch(() => null)
+      if (info === null || info.isFile() !== true) throw new TodoError('not-found', '图片不在了')
+      if (info.size > MAX_ASSET_BYTES) {
+        throw new TodoError('payload-too-large', `图片超过 ${Math.round(MAX_ASSET_BYTES / 1024 / 1024)}MB`)
+      }
+      const bytes = await readFile(link.value)
+      response.statusCode = 200
+      response.setHeader('content-type', mimeForImage(link.value))
+      response.setHeader('cache-control', 'no-store')
+      response.setHeader('x-content-type-options', 'nosniff')
+      response.end(bytes)
+    }),
+
     exact('GET', `${ROUTE_BASE}/report`, async (request) => {
       const days = Number.parseInt(params(request).get('days') ?? '', 10)
       const todos = await service.listAll()
@@ -671,6 +718,28 @@ export function createRoutes(deps) {
       return { todo: await service.remove(body.id, { by: 'human' }) }
     }),
 
+    exact('POST', `${ROUTE_BASE}/relink`, async (request) => {
+      // Re-pointing a dead attachment: the byte-free equivalent of "upload it again".
+      const body = await readJsonBody(request)
+      if (typeof body.id !== 'string' || body.id.trim() === '') {
+        throw new TodoError('invalid-body', 'relink 需要 id')
+      }
+      const index = Number(body.index)
+      if (!Number.isInteger(index) || index < 0) {
+        throw new TodoError('invalid-body', 'relink 需要 index（附件在列表里的位置）')
+      }
+      const todo = await service.get(body.id)
+      const link = (todo.links ?? [])[index]
+      if (link === undefined) throw new TodoError('not-found', '这条待办没有这个附件')
+      if (typeof body.value !== 'string' || body.value.trim() === '') {
+        throw new TodoError('invalid-body', 'relink 需要新的 value（绝对路径或网址）')
+      }
+      const links = todo.links.slice()
+      links[index] = { kind: link.kind, value: body.value.trim(), ...(link.title === '' ? {} : { title: link.title }) }
+      // Same shape as /update: the service already answers `{ todo, changed }`.
+      return service.update(body.id, { links }, { by: 'human' })
+    }),
+
     exact('POST', `${ROUTE_BASE}/restore`, async (request) => {
       // The panel's undo: put a removed record back verbatim, timestamps and
       // attachments included, instead of re-creating it as a new todo.

package/lib/service.js

@@ -28,6 +28,7 @@ import {
   newId,
   normalizeActor,
   normalizeStored,
+  parseDueText,
   pushActivity,
   recordDispatch as recordDispatchOn,
   removeLink as removeLinkFrom,
@@ -132,8 +133,21 @@ export function createService(options) {
    * @param {string} raw
    * @returns {{ text: string[], tags: string[], levels: string[], flags: string[] }}
    */
+/**
+ * A due-date bound from a `before:` / `after:` token.
+ *
+ * Only the explicit deadline shapes are accepted (date, date+time), because a search bound
+ * that silently became New Year's Day would filter the list without saying so.
+ *
+ * @param {string} text e.g. `2026-11-01` or `2026-11-01T18:00`
+ * @returns {number | null} epoch millis, or null when the token is not a date bound
+ */
+function dueBound(text) {
+  const verdict = parseDueText(text)
+  return verdict.ok === true ? Date.parse(verdict.iso) : null
+}
   function parseQuery(raw) {
-    const parsed = { text: [], tags: [], levels: [], flags: [] }
+    const parsed = { text: [], tags: [], levels: [], flags: [], before: null, after: null }
     for (const token of String(raw).split(/\s+/)) {
       if (token === '') continue
       const lower = token.toLowerCase()
@@ -142,6 +156,17 @@ export function createService(options) {
       else if (lower.startsWith('level:') && lower.length > 6) {
         const value = lower.slice(6)
         parsed.levels.push(LEVEL_ALIAS[value] ?? value)
+      } else if (lower.startsWith('before:') && lower.length > 7) {
+        // A partial date is what a search box contains while it is being typed; turning that
+        // into an error would make the list flicker red on every keystroke. An unparseable
+        // bound is therefore ignored, and the token stays a plain search term.
+        const bound = dueBound(lower.slice(7))
+        if (bound === null) parsed.text.push(lower)
+        else parsed.before = bound
+      } else if (lower.startsWith('after:') && lower.length > 6) {
+        const bound = dueBound(lower.slice(6))
+        if (bound === null) parsed.text.push(lower)
+        else parsed.after = bound
       } else if (lower.startsWith('is:') && lower.length > 3) parsed.flags.push(lower)
       else if (lower.startsWith('has:') && lower.length > 4) parsed.flags.push(lower)
       else parsed.text.push(lower)
@@ -162,6 +187,14 @@ export function createService(options) {
     for (const level of parsed.levels) {
       if (todo.priority !== level) return false
     }
+    // A date bound is about the deadline. A todo without one cannot satisfy either bound:
+    // "what is due before Friday" has no meaningful answer for something with no deadline.
+    if (parsed.before !== null || parsed.after !== null) {
+      const due = typeof todo.dueAt === 'string' ? Date.parse(todo.dueAt) : Number.NaN
+      if (!Number.isFinite(due)) return false
+      if (parsed.before !== null && due >= parsed.before) return false
+      if (parsed.after !== null && due <= parsed.after) return false
+    }
     for (const flag of parsed.flags) {
       if (flag === 'is:overdue' && !isOverdue(todo, at)) return false
       if (flag === 'is:due' && (todo.dueAt === null || todo.dueAt === undefined)) return false
@@ -437,7 +470,9 @@ export function createService(options) {
     return {
       ...todo,
       links: todo.links.map((link) => {
-        if (link.kind !== 'file') return { ...link }
+        // A dead image must be flagged exactly like a dead document: the panel would
+        // otherwise render a broken frame instead of the existing missing-file chip.
+        if (link.kind !== 'file' && link.kind !== 'image') return { ...link }
         let present = true
         try {
           present = check(link.value) !== false

package/lib/tools.js

@@ -52,14 +52,14 @@ const STEPS_SHAPE = {
 const LINKS_INPUT = {
   type: 'array',
   description:
-    '相关文档与地址。字符串写法按内容自动判别：http(s):// 开头算地址，其余必须是以 / 或盘符开头的绝对路径（文档原地引用，不复制内容）。也可给对象 { kind: "url"|"file", value, title }。',
+    '相关文档与地址。字符串写法按内容自动判别：http(s):// 开头算地址，其余必须是以 / 或盘符开头的绝对路径（文档原地引用，不复制内容）。也可给对象 { kind: "url"|"file"|"image", value, title }；kind:"image" 用于截图，必须是图片路径（png/jpg/jpeg/webp/gif/avif），面板会显示缩略图。',
   items: {
     oneOf: [
       { type: 'string' },
       {
         type: 'object',
         properties: {
-          kind: { type: 'string', enum: ['url', 'file'] },
+          kind: { type: 'string', enum: ['url', 'file', 'image'] },
           value: { type: 'string' },
           title: { type: 'string' },
         },
@@ -136,7 +136,7 @@ const TODO_SHAPE = {  type: 'object',
       items: {
         type: 'object',
         properties: {
-          kind: { type: 'string', enum: ['url', 'file'] },
+          kind: { type: 'string', enum: ['url', 'file', 'image'] },
           value: { type: 'string' },
           title: { type: 'string' },
         },
@@ -815,7 +815,7 @@ export function createTools(service, options = {}) {
             items: {
               type: 'object',
               properties: {
-                kind: { type: 'string', enum: ['url', 'file'] },
+                kind: { type: 'string', enum: ['url', 'file', 'image'] },
                 value: { type: 'string' },
                 title: { type: 'string' },
               },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",