kimiflare 0.10.0 → 0.12.0

package/README.md

@@ -11,36 +11,30 @@
 </p>
 
 <p align="center">
-  A terminal coding agent powered by <strong><a href="https://developers.cloudflare.com/workers-ai/models/kimi-k2.6/">Kimi-K2.6</a></strong> on Cloudflare Workers AI. Moonshot's 1T-parameter open-source model runs directly on your Cloudflare account. You bring the token, your traffic goes straight to Cloudflare.
+  <strong>A terminal coding agent powered by <a href="https://developers.cloudflare.com/workers-ai/models/kimi-k2.6/">Kimi-K2.6</a> on Cloudflare Workers AI.</strong><br>
+  Moonshot's 1T-parameter open-source model, running directly on your Cloudflare account.
 </p>
 
-```
-$ kimiflare
-kimiflare · /help for commands · ctrl-c to exit
-
-› what files are here?
-  ✓ glob(*)
-    /Users/you/proj/package.json
-    /Users/you/proj/src/index.ts
-    ...
-
-› add a /health endpoint to server.ts
-  ✓ read(src/server.ts)
-  ◐ edit src/server.ts
-    ─── permission requested ──────────────────
-    @@ -42,6 +42,10 @@
-       app.get('/', …)
-    +  app.get('/health', (_, res) => res.json({ ok: true }))
-    ─────────────────────────────────────────────
-    [Allow once] [Allow for session] [Deny]
-```
+<p align="center">
+  <img src="docs/screenshot.png" alt="kimiflare TUI" width="900">
+</p>
+
+## Why kimiflare
 
-## Install
+- **262k context window** — Read entire modules, large configs, and full stack traces without the model losing track.
+- **Image understanding** — Drop image paths into your prompt (PNG, JPG, WebP, GIF, BMP). The model sees them inline — great for UI reviews, diagrams, screenshots, and mockups.
+- **Direct to Cloudflare** — No AI Gateway, no proxy, no OpenAI SDK. Your traffic goes straight to Workers AI from your account.
+- **Plan mode** — Ask the agent to research and produce a plan without touching your filesystem. Review it, then exit plan mode to execute.
+
+## Quick start
 
 ```sh
 npm install -g kimiflare
+kimiflare
 ```
 
+On first run, an interactive onboarding wizard asks for your Cloudflare Account ID and API Token. That's it — you're ready.
+
 Or run without installing:
 
 ```sh
@@ -49,6 +43,25 @@ npx kimiflare
 
 Requires Node.js ≥ 20.
 
+## Features
+
+| Feature | What it does |
+|---------|-------------|
+| **Plan / Edit / Auto modes** | `plan` blocks all mutating tools for safe research. `edit` (default) prompts per mutating call. `auto` approves everything for trusted tasks. |
+| **Live task panel** | For multi-step work, the agent publishes a task list with progress icons (■ active, ☐ pending, ✓ done), elapsed time, and token deltas. |
+| **14 terminal themes** | dark, light, high-contrast, dracula, nord, one-dark, monokai, solarized-dark/light, tokyo-night, gruvbox-dark/light, catppuccin-mocha, rose-pine. Interactive picker with live preview (`Ctrl+T`). |
+| **Paste collapse** | Large pastes (≥200 chars or ≥2 newlines) collapse to `[pasted N lines #id]`. Full content still goes to the model — scrollback stays clean. |
+| **Type-ahead queue** | Type your next prompt while the model is still working. Queued prompts show as `⏳ …` and fire in order. `Ctrl-C` aborts current + clears queue. |
+| **Auto-compaction** | At ~80% context usage, kimiflare nudges you to run `/compact`. It summarizes older turns into a dense summary, keeping the last 4 turns intact. |
+| **Streaming reasoning** | Toggle the model's chain-of-thought with `/reasoning` or `Ctrl-R`. See how it thinks in real time. |
+| **Image understanding** | Drop image paths (PNG, JPG, WebP, GIF, BMP up to 5 MB) into any prompt. The model sees them inline — perfect for UI reviews, diagrams, and screenshots. |
+| **Live cost tracking** | Status bar shows real-time cost based on Cloudflare pricing: `$0.95/M input`, `$0.16/M cached`, `$4.00/M output`. |
+| **Session persistence** | Every turn is auto-saved. `/resume` lists past sessions (with message counts) in a paginated picker. |
+| **Smart permissions** | Bash session-allow is keyed by the first token (e.g., allow all `git` commands). Write/edit show a unified diff before you approve. |
+| **Project context (`/init`)** | Scans your repo and writes a concise `KIMI.md` — build commands, layout, conventions. Auto-loaded on every launch. |
+| **Co-author auto-append** | Detects `git commit` commands and auto-injects `Co-authored-by: kimiflare <kimiflare@proton.me>`. |
+| **Resilient transport** | Retries Cloudflare capacity errors (code 3040) and 5xx with exponential backoff up to 5 attempts. |
+
 ## Configure
 
 Get credentials from Cloudflare:
@@ -79,50 +92,98 @@ chmod 600 ~/.config/kimiflare/config.json
 
 ## Usage
 
+### Interactive TUI
+
 ```sh
-kimiflare                             # interactive TUI
-kimiflare -p "summarize PLAN.md"      # one-shot, streams answer to stdout
-kimiflare -p "..." --dangerously-allow-all   # auto-approve mutating tools (for scripts)
+kimiflare                             # launch TUI
 kimiflare --model @cf/moonshotai/kimi-k2.6   # override model
-kimiflare --reasoning                 # (print mode) stream chain-of-thought to stderr
 ```
 
-Interactive slash commands:
+### Print mode (one-shot, non-interactive)
+
+```sh
+kimiflare -p "summarize PLAN.md"                    # stream answer to stdout
+kimiflare -p "..." --dangerously-allow-all          # auto-approve mutating tools (for scripts)
+kimiflare -p "..." --reasoning                      # include chain-of-thought in stderr
+```
+
+### Image understanding
+
+Reference image files directly in your prompt — the model sees them inline:
+
+```sh
+kimiflare
+› fix the layout bug in this screenshot docs/bug.png
+› convert this mockup design.png to Tailwind HTML
+› explain this architecture diagram.png
+```
+
+Supported formats: PNG, JPG, JPEG, WebP, GIF, BMP (up to 5 MB each, 10 per message).
 
-| Command                     | Effect                                                                          |
-|-----------------------------|---------------------------------------------------------------------------------|
-| `/mode edit\|plan\|auto`     | Switch mode. `edit` prompts for permission (default), `plan` is read-only research, `auto` auto-approves every tool call. |
-| `/plan` `/auto` `/edit`     | Shortcuts for the three modes.                                                  |
+### CLI flags
+
+| Flag | Short | Description |
+|------|-------|-------------|
+| `--print <prompt>` | `-p` | One-shot mode: send prompt, stream reply, exit |
+| `--model <id>` | `-m` | Model ID (default: `@cf/moonshotai/kimi-k2.6`) |
+| `--dangerously-allow-all` | — | Auto-approve every permission prompt (print mode only) |
+| `--reasoning` | — | Stream chain-of-thought to stderr (print mode only) |
+| `--version` | `-V` | Show version |
+| `--help` | `-h` | Show help |
+
+## Slash commands
+
+| Command | Effect |
+|---------|--------|
+| `/mode edit\|plan\|auto` | Switch mode. `edit` prompts for permission (default), `plan` is read-only research, `auto` auto-approves every tool call. |
+| `/plan` `/auto` `/edit` | Shortcuts for the three modes. |
 | `/thinking low\|medium\|high` | Reasoning effort. `low` = fastest, shallow; `medium` = balanced (default); `high` = deepest, slowest. Saved to config. |
-| `/theme NAME`               | Switch color scheme: `dark` (default), `light` (bright terminals), `high-contrast`. Saved to config. |
-| `/resume`                   | Pick a past conversation to restore.                                            |
-| `/compact`                  | Summarize older turns to free context. Suggested automatically at ~80% full.    |
-| `/init`                     | Scan the repo and write a `KIMI.md` so future agents have project context.      |
-| `/reasoning`                | Toggle chain-of-thought display.                                                |
-| `/clear`                    | Reset the current conversation.                                                 |
-| `/cost` `/model` `/update`  | Info commands.                                                                  |
-| `/logout`                   | Clear saved credentials.                                                        |
-| `/help` `/exit`             | List commands / quit.                                                           |
-
-Keys: `Shift+Tab` cycles mode · `Ctrl-R` toggles reasoning · `Ctrl-O` toggles verbose tool output · `Ctrl-C` interrupts an in-flight turn (press again to exit) · `↑`/`↓` walks prompt history.
-
-Editing keys (macOS):
-
-- `⌥←` / `⌥→` — jump word left/right (also works with `Esc b` / `Esc f`)
-- `⌘←` / `⌘→` — jump to start / end of line (in iTerm2's default profile; in Terminal.app you may need to map these to send `Ctrl-A` / `Ctrl-E`)
-- `⌥⌫` — delete word backward
-- `⌘⌫` — delete to start of line (iTerm2 sends this as `Ctrl-U`; map in Terminal.app if needed)
-- `⌥⌦` — delete word forward
-- `Ctrl-A` / `Ctrl-E` — start / end of line (always works)
-- `Ctrl-W` / `Ctrl-U` / `Ctrl-K` — delete word backward / to start of line / to end of line
-
-### Modes
+| `/theme` | Interactive theme picker with live preview (`Ctrl+T`). Saved to config. |
+| `/theme NAME` | Set theme by name directly. |
+| `/resume` | Pick a past conversation to restore. |
+| `/compact` | Summarize older turns to free context. Suggested automatically at ~80% full. |
+| `/init` | Scan the repo and write a `KIMI.md` so future agents have project context. |
+| `/reasoning` | Toggle chain-of-thought display. |
+| `/clear` | Reset the current conversation. |
+| `/cost` | Show token usage for the current turn. |
+| `/model` | Show current model. |
+| `/update` | Check for updates manually. |
+| `/logout` | Clear saved credentials. |
+| `/help` | List all commands. |
+| `/exit` | Quit. |
+
+## Keyboard shortcuts
+
+### Global
+
+| Shortcut | Action |
+|----------|--------|
+| `Ctrl+C` | Interrupt current turn (press again to exit) |
+| `Ctrl+R` | Toggle reasoning display |
+| `Ctrl+O` | Toggle verbose tool output |
+| `Ctrl+T` | Open theme picker |
+| `Shift+Tab` | Cycle mode (edit → plan → auto) |
+| `↑` / `↓` | Walk prompt history |
+
+### Editing (macOS / Linux)
+
+| Shortcut | Action |
+|----------|--------|
+| `⌥←` / `⌥→` | Jump word left/right |
+| `⌘←` / `⌘→` | Jump to start / end of line |
+| `⌥⌫` | Delete word backward |
+| `⌘⌫` | Delete to start of line |
+| `⌥⌦` | Delete word forward |
+| `Ctrl+A` / `Ctrl+E` | Start / end of line |
+| `Ctrl+W` / `Ctrl+U` / `Ctrl+K` | Delete word backward / to start / to end of line |
+
+## Modes
 
 - **edit** — default. The agent calls tools freely for read-only work; mutating tools (`write`, `edit`, `bash`) pause for your approval.
 - **plan** — read-only. Mutating tools are hard-blocked. Ask "plan a refactor" and the agent will investigate and produce a plan without touching the filesystem. Exit plan mode to execute.
 - **auto** — autonomous. Every tool call is auto-approved. Use for trusted, well-scoped tasks.
 
-### Thinking level (quality vs speed)
+## Thinking level (quality vs speed)
 
 Kimi-K2.6 always reasons, but you can cap the effort:
 
@@ -132,52 +193,26 @@ Kimi-K2.6 always reasons, but you can cap the effort:
 
 Set with `/thinking medium` (persists), or per-launch via `KIMI_REASONING_EFFORT=high`.
 
-### Type-ahead queue
-
-You can type the next prompt while the model is still executing. Submitted prompts show up as `⏳ …` and fire in order as each turn completes. `Ctrl-C` aborts the current turn and clears the queue.
-
-### Session persistence
-
-Sessions are saved to `~/.local/share/kimiflare/sessions/` after each turn. `/resume` lists the most recent (with first prompt + message count) so you can pick one up later.
-
-### Task panel
-
-For multi-step requests, the agent can publish a live task list via the `tasks_set` tool. The panel shows progress inline with status icons (`■` active, `☐` pending, `✓` done), elapsed time, and tokens consumed for the current task batch. Press `Ctrl-O` while a turn is running to switch tool output between compact (first line) and verbose (full output) modes.
-
-### Paste collapse
-
-Paste a large block (≥ 200 chars or ≥ 3 newlines in one paste) into the prompt and the input collapses it to `[pasted N lines #id]`. The full content still goes to the model on submit — only the on-screen display and chat history are collapsed, so scrollback doesn't get buried by a wall of code.
-
-### Project context (KIMI.md)
-
-Run `/init` inside a repo and kimiflare scans the project (reads `package.json`, `README`, source layout, etc.) and writes a concise `KIMI.md` at the repo root — project overview, build/test commands, conventions, quirks. On every subsequent launch in that directory, `KIMI.md` (or `KIMIFLARE.md` or `AGENT.md`, whichever exists) is auto-loaded into the system prompt so the agent already "knows" the project. If the file already exists, `/init` refuses so you don't overwrite hand-edited context.
-
-## Why
-
-- **262k context.** Read entire modules without pagination.
-- **Native tool use.** File I/O, shell, globs, grep, web fetch — all wired up, with per-call approval for anything mutating.
-- **Streaming reasoning + content.** The model's chain-of-thought streams separately; toggle with `/reasoning` or `Ctrl-R`.
-- **Pay your own way.** Your Cloudflare account, your credits, your rate limits. `$0.95 / M input`, `$0.16 / M cached input`, `$4.00 / M output`. The bottom status line shows live cost.
-
 ## Tools
 
 All tool calls show inline; mutating ones require per-call approval the first time, with an option to allow for the rest of the session.
 
-| Tool        | Permission | What it does |
-|-------------|------------|--------------|
-| `read`      | auto       | Read a text file (≤ 2MB) with optional line range. |
-| `write`     | prompt     | Create or overwrite a file. Shows a unified diff before you approve. |
-| `edit`      | prompt     | Replace an exact substring. Fails unless `old_string` is unique (or `replace_all=true`). |
-| `bash`      | prompt     | Run a shell command via `bash -lc`. Session-allow is keyed by the first token of the command. |
-| `glob`      | auto       | Match files by pattern (`**/*.ts`), sorted by mtime. |
-| `grep`      | auto       | Regex search. Uses `rg` if installed; falls back to a JS walk. |
-| `web_fetch` | auto       | Fetch a URL, convert HTML → markdown (≤ 100KB). |
+| Tool | Permission | What it does |
+|------|------------|--------------|
+| `read` | auto | Read a text file (≤ 2MB) with optional line range. |
+| `write` | prompt | Create or overwrite a file. Shows a unified diff before you approve. |
+| `edit` | prompt | Replace an exact substring. Fails unless `old_string` is unique (or `replace_all=true`). |
+| `bash` | prompt | Run a shell command via `bash -lc`. Session-allow is keyed by the first token of the command. |
+| `glob` | auto | Match files by pattern (`**/*.ts`), sorted by mtime. |
+| `grep` | auto | Regex search. Uses `rg` if installed; falls back to a JS walk. |
+| `web_fetch` | auto | Fetch a URL, convert HTML → markdown (≤ 100KB). |
+| `tasks_set` | auto | Publish a live task list for multi-step work. |
 
 ## How it works
 
 ```
            ┌───────────────────────────────────────────────────────────┐
-           │ kimiflare (Node + Ink TUI)                                │
+           │ kimiflare (Node.js TUI)                                   │
  user ─▶   │                                                           │
            │   user msg ─▶ agent loop ─▶ runKimi() ──[POST SSE]──▶     │
            │                       ▲                                   │
@@ -204,9 +239,23 @@ npm run build
 npm link          # or: ln -s "$PWD/bin/kimiflare.mjs" ~/.local/bin/kimiflare
 ```
 
-## Status
+Scripts:
+- `npm run build` — bundle with tsup (`dist/` + `bin/kimiflare.mjs`)
+- `npm run dev` — run via tsx (`tsx src/index.tsx`)
+- `npm run typecheck` — `tsc --noEmit`
+- `npm start` — run compiled bin
+
+## Contributing
+
+Contributions are welcome!
 
-Early but functional. Transport + tools + agent loop + print mode are verified end-to-end. Interactive TUI ships modes, themes, thinking levels, session resume, compaction, and type-ahead queue.
+1. Fork the repository
+2. Create a branch: `git checkout -b feat/your-feature`
+3. Make your changes
+4. Run `npm run typecheck` and `npm run build`
+5. Commit: `git commit -m "feat: description"`
+6. Push: `git push origin feat/your-feature`
+7. Open a Pull Request
 
 ## License
 

package/dist/index.js

@@ -296,10 +296,19 @@ async function* parseStream(body, signal) {
 }
 function sanitizeMessagesForApi(messages) {
   return messages.map((m) => {
-    if (!m.tool_calls || m.tool_calls.length === 0) return m;
+    let next = m;
+    if (Array.isArray(m.content)) {
+      next = {
+        ...m,
+        content: m.content.map(
+          (part) => part.type === "text" ? { ...part, text: sanitizeString(part.text) } : part
+        )
+      };
+    }
+    if (!next.tool_calls || next.tool_calls.length === 0) return next;
     return {
-      ...m,
-      tool_calls: m.tool_calls.map((tc) => ({
+      ...next,
+      tool_calls: next.tool_calls.map((tc) => ({
         ...tc,
         function: {
           name: tc.function.name,
@@ -1533,15 +1542,16 @@ async function compactMessages(opts2) {
     return { summary: "", newMessages: messages, replacedCount: 0 };
   }
   const transcript = toSummarize.map((m) => {
+    const contentStr = typeof m.content === "string" ? m.content : m.content?.map((p) => p.type === "text" ? p.text : "[image]").join(" ") ?? "";
     if (m.role === "tool") {
-      const snippet = (m.content ?? "").slice(0, 500);
+      const snippet = contentStr.slice(0, 500);
       return `[tool ${m.name ?? ""}] ${snippet}`;
     }
     if (m.role === "assistant") {
       const calls = m.tool_calls ? ` (tool_calls: ${m.tool_calls.map((c) => c.function.name).join(", ")})` : "";
-      return `[assistant]${calls} ${m.content ?? ""}`;
+      return `[assistant]${calls} ${contentStr}`;
     }
-    return `[${m.role}] ${m.content ?? ""}`;
+    return `[${m.role}] ${contentStr}`;
   }).join("\n");
   let summary = "";
   const events = runKimi({
@@ -1867,12 +1877,18 @@ function EventView({
   verbose
 }) {
   if (evt.kind === "user") {
-    return /* @__PURE__ */ jsxs4(Box4, { children: [
-      /* @__PURE__ */ jsxs4(Text4, { bold: true, color: theme.user, children: [
-        "\u203A",
-        " "
+    return /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Box4, { children: [
+        /* @__PURE__ */ jsxs4(Text4, { bold: true, color: theme.user, children: [
+          "\u203A",
+          " "
+        ] }),
+        /* @__PURE__ */ jsx4(Text4, { bold: true, children: evt.text })
       ] }),
-      /* @__PURE__ */ jsx4(Text4, { bold: true, children: evt.text })
+      evt.images && evt.images.length > 0 && /* @__PURE__ */ jsx4(Box4, { paddingLeft: 2, children: /* @__PURE__ */ jsxs4(Text4, { color: theme.info.color, dimColor: theme.info.dim, children: [
+        "\u{1F5BC}\uFE0F ",
+        evt.images.join(", ")
+      ] }) })
     ] });
   }
   if (evt.kind === "assistant") {
@@ -3470,7 +3486,7 @@ async function listSessions(limit = 30) {
       const [s, raw] = await Promise.all([stat2(path), readFile7(path, "utf8")]);
       const parsed = JSON.parse(raw);
       const firstUser = parsed.messages.find((m) => m.role === "user");
-      const firstPrompt = typeof firstUser?.content === "string" ? firstUser.content : "(no prompt)";
+      const firstPrompt = typeof firstUser?.content === "string" ? firstUser.content : firstUser?.content ? firstUser.content.find((p) => p.type === "text")?.text ?? "(no prompt)" : "(no prompt)";
       summaries.push({
         id: parsed.id,
         filePath: path,
@@ -3495,6 +3511,45 @@ var init_sessions = __esm({
   }
 });
 
+// src/util/image.ts
+import { readFile as readFile8 } from "fs/promises";
+import { basename as basename2 } from "path";
+async function encodeImageFile(filePath) {
+  const buf = await readFile8(filePath);
+  if (buf.byteLength > MAX_IMAGE_BYTES) {
+    throw new Error(
+      `image too large (${(buf.byteLength / 1024 / 1024).toFixed(1)} MB); max is ${MAX_IMAGE_BYTES / 1024 / 1024} MB`
+    );
+  }
+  const ext = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+  const mime = EXT_TO_MIME[ext] ?? "image/jpeg";
+  const b64 = buf.toString("base64");
+  return {
+    filename: basename2(filePath),
+    mime,
+    dataUrl: `data:${mime};base64,${b64}`
+  };
+}
+function isImagePath(path) {
+  const ext = path.slice(path.lastIndexOf(".")).toLowerCase();
+  return ext in EXT_TO_MIME;
+}
+var MAX_IMAGE_BYTES, EXT_TO_MIME;
+var init_image = __esm({
+  "src/util/image.ts"() {
+    "use strict";
+    MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+    EXT_TO_MIME = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".bmp": "image/bmp"
+    };
+  }
+});
+
 // src/app.tsx
 var app_exports = {};
 __export(app_exports, {
@@ -3510,6 +3565,16 @@ function capEvents(prev) {
   if (prev.length <= MAX_EVENTS) return prev;
   return prev.slice(prev.length - MAX_EVENTS);
 }
+function findImagePaths(text) {
+  const paths = [];
+  for (const token of text.split(/\s+/)) {
+    const clean = token.replace(/^["']|["',;:!?]$/g, "").replace(/[.,;:!?]$/, "");
+    if (isImagePath(clean) && existsSync(clean)) {
+      paths.push(clean);
+    }
+  }
+  return [...new Set(paths)];
+}
 function App({ initialCfg, initialUpdateResult }) {
   const { exit } = useApp();
   const [cfg, setCfg] = useState6(initialCfg);
@@ -3679,7 +3744,13 @@ function App({ initialCfg, initialUpdateResult }) {
     if (!cfg) return;
     if (!sessionIdRef.current) {
       const firstUser = messagesRef.current.find((m) => m.role === "user");
-      const firstText = typeof firstUser?.content === "string" ? firstUser.content : "session";
+      let firstText = "session";
+      if (typeof firstUser?.content === "string") {
+        firstText = firstUser.content;
+      } else if (Array.isArray(firstUser?.content)) {
+        const textPart = firstUser.content.find((p) => p.type === "text");
+        if (textPart?.text) firstText = textPart.text;
+      }
       sessionIdRef.current = makeSessionId(firstText);
     }
     try {
@@ -3967,7 +4038,12 @@ function App({ initialCfg, initialUpdateResult }) {
             text: `resumed session ${picked.id} (${picked.messageCount} msgs)`
           }
         ]);
-        const userMsgs = file.messages.filter((m) => m.role === "user" && typeof m.content === "string").map((m) => m.content);
+        const userMsgs = file.messages.filter((m) => m.role === "user" && m.content).map((m) => {
+          if (!m.content) return "";
+          if (typeof m.content === "string") return m.content;
+          const textPart = m.content.find((p) => p.type === "text");
+          return textPart?.text ?? "";
+        }).filter((text) => text.length > 0);
         if (userMsgs.length > 0) setHistory(userMsgs);
         setUsage(null);
       } catch (e) {
@@ -4223,8 +4299,36 @@ use: /thinking low | medium | high`
       if (!trimmed) return;
       if (trimmed.startsWith("/") && handleSlash(trimmed)) return;
       const display = displayText?.trim() || trimmed;
-      setEvents((e) => [...e, { kind: "user", key: mkKey(), text: display }]);
-      messagesRef.current.push({ role: "user", content: sanitizeString(trimmed) });
+      const imagePaths = findImagePaths(trimmed).slice(0, MAX_IMAGES_PER_MESSAGE);
+      let images = [];
+      let content = sanitizeString(trimmed);
+      if (imagePaths.length > 0) {
+        const encoded = await Promise.all(
+          imagePaths.map(async (path) => {
+            try {
+              const img = await encodeImageFile(path);
+              return { path, img };
+            } catch (e) {
+              setEvents((es) => [
+                ...es,
+                { kind: "error", key: mkKey(), text: `failed to encode image ${path}: ${e.message}` }
+              ]);
+              return null;
+            }
+          })
+        );
+        const valid = encoded.filter((x) => x !== null);
+        if (valid.length > 0) {
+          images = valid.map((v) => v.img.filename);
+          const parts = [
+            { type: "text", text: sanitizeString(trimmed) },
+            ...valid.map((v) => ({ type: "image_url", image_url: { url: v.img.dataUrl } }))
+          ];
+          content = parts;
+        }
+      }
+      setEvents((e) => [...e, { kind: "user", key: mkKey(), text: display, images: images.length > 0 ? images : void 0 }]);
+      messagesRef.current.push({ role: "user", content });
       setBusy(true);
       setTurnStartedAt(Date.now());
       const controller = new AbortController();
@@ -4522,7 +4626,7 @@ async function renderApp(cfg, updateResult) {
   const instance = render(/* @__PURE__ */ jsx13(App, { initialCfg: cfg, initialUpdateResult: updateResult }));
   await instance.waitUntilExit();
 }
-var CONTEXT_LIMIT, AUTO_COMPACT_SUGGEST_PCT, MAX_EVENTS, nextAssistantId, nextKey, mkKey, EFFORT_DESCRIPTIONS;
+var CONTEXT_LIMIT, AUTO_COMPACT_SUGGEST_PCT, MAX_EVENTS, nextAssistantId, nextKey, mkKey, MAX_IMAGES_PER_MESSAGE, EFFORT_DESCRIPTIONS;
 var init_app = __esm({
   "src/app.tsx"() {
     "use strict";
@@ -4546,12 +4650,14 @@ var init_app = __esm({
     init_theme();
     init_mode();
     init_sessions();
+    init_image();
     CONTEXT_LIMIT = 262e3;
     AUTO_COMPACT_SUGGEST_PCT = 0.8;
     MAX_EVENTS = 500;
     nextAssistantId = 1;
     nextKey = 1;
     mkKey = () => `evt_${nextKey++}`;
+    MAX_IMAGES_PER_MESSAGE = 10;
     EFFORT_DESCRIPTIONS = {
       low: "low \u2014 fastest; lightest reasoning. Best for simple Q&A, small edits, quick coordination.",
       medium: "medium \u2014 balanced (default). Solid quality on most edits, fast on trivial prompts.",