ompchamber 1.1.0 → 1.2.1

package/src/client/hooks/chat/composer/file-reads.test.ts

@@ -0,0 +1,211 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The priming contract, which is a TIMING contract.
+ *
+ * A dropped `File` may only be read from a read begun while the drop handler is
+ * still running; a read started afterwards fails with `NotReadableError` and
+ * keeps failing. These tests pin the two halves of that: `primeFileReads`
+ * issues its read synchronously, and the read pipeline consumes the primed
+ * result instead of starting a second, unauthorized one.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { primeFileReads, readFileTextWithRetry } from '@/client/hooks/chat/composer/file-reads';
+
+/** A `FileReader` that answers from a lookup, counting the reads it was asked for. */
+function installFakeReader(
+  contents: Map<string, string>,
+  options: { failDataUrl?: boolean; unreadable?: Set<File> } = {},
+) {
+  const calls: string[] = [];
+  /** A file the browser refuses to read, whatever its metadata says. */
+  const dead = (file: File) => options.unreadable?.has(file) ?? false;
+  class FakeReader {
+    result: string | ArrayBuffer | null = null;
+    error: { name: string; message: string } | null = null;
+    onload: (() => void) | null = null;
+    onerror: (() => void) | null = null;
+    onabort: (() => void) | null = null;
+
+    readAsArrayBuffer() {
+      calls.push('arrayBuffer');
+      queueMicrotask(() => {
+        if (options.failDataUrl) {
+          this.error = { name: 'NotReadableError', message: 'unreadable' };
+          this.onerror?.();
+          return;
+        }
+        this.result = new Uint8Array([1, 2, 3]).buffer;
+        this.onload?.();
+      });
+    }
+
+    readAsDataURL(file: File) {
+      calls.push(`dataURL:${file.name}`);
+      const body = dead(file) ? undefined : contents.get(file.name);
+      queueMicrotask(() => {
+        if (options.failDataUrl || body === undefined) {
+          this.error = {
+            name: 'NotReadableError',
+            message: 'permission problems that have occurred after a reference to a file was acquired',
+          };
+          this.onerror?.();
+          return;
+        }
+        // `data:<mime>;base64,<payload>` — the real reader's shape.
+        const base64 = btoa(String.fromCharCode(...new TextEncoder().encode(body)));
+        this.result = `data:text/plain;base64,${base64}`;
+        this.onload?.();
+      });
+    }
+
+    readAsText(file: File) {
+      calls.push(`text:${file.name}`);
+      const body = dead(file) ? undefined : contents.get(file.name);
+      queueMicrotask(() => {
+        if (body === undefined) {
+          this.error = { name: 'NotReadableError', message: 'unreadable' };
+          this.onerror?.();
+          return;
+        }
+        this.result = body;
+        this.onload?.();
+      });
+    }
+  }
+  (globalThis as unknown as { FileReader: unknown }).FileReader = FakeReader;
+  return calls;
+}
+
+const originalFileReader = (globalThis as unknown as { FileReader: unknown }).FileReader;
+
+afterEach(() => {
+  (globalThis as unknown as { FileReader: unknown }).FileReader = originalFileReader;
+});
+
+describe('primeFileReads', () => {
+  test('starts the read synchronously, in the caller\'s own tick', () => {
+    const calls = installFakeReader(new Map([['a.md', 'body']]));
+    const file = new File(['body'], 'a.md', { type: 'text/markdown' });
+
+    primeFileReads([file]);
+
+    // The point of the module: the calls are already made when this returns. A
+    // read deferred to a microtask would be outside the drop handler's tick and
+    // therefore unauthorized.
+    expect(calls.filter((c) => c.startsWith('dataURL:'))).toEqual(['dataURL:a.md']);
+    expect(calls.filter((c) => c === 'arrayBuffer').length).toBe(1);
+  });
+
+  test('reads each file once however many batches carry it', () => {
+    const calls = installFakeReader(new Map([['a.md', 'body']]));
+    const file = new File(['body'], 'a.md', { type: 'text/markdown' });
+
+    primeFileReads([file, file]);
+
+    expect(calls.filter((c) => c.startsWith('dataURL:'))).toEqual(['dataURL:a.md']);
+  });
+
+  test('stays inside the attach cap, so an oversized drop is not read whole', () => {
+    const calls = installFakeReader(new Map());
+    const files = Array.from({ length: 80 }, (_, i) => new File(['x'], `f${i}.txt`));
+
+    primeFileReads(files);
+
+    expect(calls.filter((c) => c.startsWith('dataURL:')).length).toBeLessThanOrEqual(50);
+  });
+});
+
+describe('a drop that exposes one file as two objects', () => {
+  // A drop can hand over the same file twice — once in `files`, once in the item
+  // list — and only one of the two objects actually reads. Which one is not
+  // knowable up front: the same drop read fine in a browser tab and failed in an
+  // installed app window, with the unreadable object still reporting the right
+  // name and size. So the read path tries the counterpart instead of trusting
+  // the choice.
+  test('falls back to the counterpart object when the primary will not read', async () => {
+    const primary = new File(['x'.repeat(40)], 'notes.md', { type: 'text/markdown' });
+    const counterpart = new File(['rescued body'], 'notes.md', { type: 'text/markdown' });
+    // The primary refuses to read while declaring bytes; the counterpart reads.
+    const calls = installFakeReader(
+      new Map([['notes.md', 'rescued body']]),
+      { unreadable: new Set([primary]) },
+    );
+    const primed = primeFileReads([primary], new Map([[primary, counterpart]]));
+
+    const content = await readFileTextWithRetry(primary, primed);
+
+    expect(content).toBe('rescued body');
+    expect(calls.filter((c) => c.startsWith('dataURL:')).length).toBe(2);
+
+    // Not vacuous: with no counterpart primed the same file stays unreadable,
+    // which is exactly the failure this pairing exists to prevent.
+    const alone = primeFileReads([primary]);
+    expect(await readFileTextWithRetry(primary, alone)).toBeNull();
+  });
+
+  test('the counterpart is primed in the same tick, not read on demand', () => {
+    const primary = new File(['x'], 'a.md', { type: 'text/markdown' });
+    const counterpart = new File(['y'], 'a.md', { type: 'text/markdown' });
+    const calls = installFakeReader(new Map());
+
+    primeFileReads([primary], new Map([[primary, counterpart]]));
+
+    // Both reads must already be in flight when the call returns: one started
+    // later would be outside the drop's permission window.
+    expect(calls.filter((c) => c.startsWith('dataURL:')).length).toBe(2);
+  });
+});
+
+describe('readFileTextWithRetry with a primed read', () => {
+  test('returns the primed body without starting another read', async () => {
+    const calls = installFakeReader(new Map([['a.md', 'primed body']]));
+    const file = new File(['primed body'], 'a.md', { type: 'text/markdown' });
+    const primed = primeFileReads([file]);
+
+    const content = await readFileTextWithRetry(file, primed);
+
+    expect(content).toBe('primed body');
+    // Exactly one read: a second would be the unauthorized one, and its failure
+    // would be indistinguishable from an unreadable file.
+    expect(calls.filter((c) => c.startsWith('dataURL:'))).toEqual(['dataURL:a.md']);
+  });
+
+  test('falls back to its own reads when the file was never primed', async () => {
+    const calls = installFakeReader(new Map([['b.md', 'late body']]));
+    const file = new File(['late body'], 'b.md', { type: 'text/markdown' });
+
+    const content = await readFileTextWithRetry(file);
+
+    expect(content).toBe('late body');
+    expect(calls.length).toBeGreaterThan(0);
+  });
+
+  test('retries a primed read that came back empty, for a promised file', async () => {
+    // The primed read lands before the bytes do; the retry loop is what covers
+    // that, so it must not be short-circuited by the primed attempt.
+    const calls = installFakeReader(new Map());
+    const file = new File(['x'.repeat(100)], 'promised.md', { type: 'text/markdown' });
+    const primed = primeFileReads([file]);
+
+    const content = await readFileTextWithRetry(file, primed);
+
+    // Null, not '': the file DECLARES bytes, so an empty body is a failure the
+    // caller reports rather than a genuinely empty file it accepts.
+    expect(content).toBeNull();
+    expect(calls.filter((c) => c === 'text:promised.md').length).toBeGreaterThan(1);
+  });
+
+  test('accepts an empty body for a file that declares no bytes', async () => {
+    // A genuinely empty file is empty forever; retrying it cannot change that,
+    // so it settles as empty rather than as a failure.
+    installFakeReader(new Map());
+    const file = new File([], 'empty.md', { type: 'text/markdown' });
+
+    expect(await readFileTextWithRetry(file, primeFileReads([file]))).toBe('');
+  });
+});

package/src/client/hooks/chat/composer/file-reads.ts

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Reading a dropped `File`'s bytes — and the one browser rule that makes the
+ * TIMING of that read part of the contract.
+ *
+ * A file that arrives through a drop is not an ordinary `Blob`. The browser
+ * holds a permission reference to the real file, and that reference is released
+ * when the `drop` event's handler returns. A read started after that point
+ * fails with `NotReadableError: ... permission problems that have occurred
+ * after a reference to a file was acquired`, and it fails PERMANENTLY — every
+ * retry after it fails the same way, because the reference is gone rather than
+ * busy. This is why a dropped file showed a chip with a correct name and size
+ * while its contents never arrived, and why three retries did not help.
+ *
+ * `FileReader.readAs*` checks the permission when it is CALLED, not when it
+ * completes. So the read must be STARTED synchronously inside the drop handler;
+ * awaiting its result later is fine. `primeFileReads` is that start, and every
+ * later consumer takes the already-running read rather than beginning its own.
+ */
+
+
+/** How many times a read that came back empty is retried before giving up. */
+export const READ_ATTEMPTS = 3;
+
+/** Base delay between read attempts; a promised file needs a beat to land. */
+export const READ_RETRY_MS = 60;
+
+/**
+ * How many files a single drop primes up front. Matches `MAX_DROPPED_FILES`:
+ * priming beyond what can be attached would hold bytes the budget will reject.
+ */
+const MAX_PRIMED_FILES = 50;
+
+export function delay(ms: number): Promise<void> {
+  const { promise, resolve } = Promise.withResolvers<void>();
+  setTimeout(resolve, ms);
+  return promise;
+}
+
+/**
+ * Start a data-URL read and return the still-running promise.
+ *
+ * MUST be called synchronously from the drop handler — see the module note. The
+ * result is the whole `data:<mime>;base64,<payload>` string, because the two
+ * consumers want different halves of it: an image takes the payload, a text file
+ * decodes it back to text.
+ */
+function startDataUrlRead(file: File): Promise<string | null> {
+  const { promise, resolve } = Promise.withResolvers<string | null>();
+  const reader = new FileReader();
+  reader.onload = () => resolve(typeof reader.result === 'string' ? reader.result : null);
+  reader.onerror = () => {
+    resolve(null);
+  };
+  reader.onabort = () => resolve(null);
+  reader.readAsDataURL(file);
+  return promise;
+}
+
+/**
+ * A read already in flight, started while the drop's permission was live.
+ *
+ * `dataUrl` and `prefix` are the PRIMARY file's reads. `spare` holds the reads
+ * of the same drop's other `File` object, tried when the primary yields nothing:
+ * a drop can expose one file twice and only one of the two objects reads, with
+ * neither the metadata nor the context saying which. See `drop-entries.ts`.
+ */
+export interface PrimedRead {
+  /** The whole file as a data URL — the authorized read of a dropped file. */
+  dataUrl: Promise<string | null>;
+  /**
+   * The leading bytes, for the text sniff and the empty-stub check.
+   *
+   * Those two ask a `File` for bytes through `slice().arrayBuffer()`, which is
+   * subject to the same permission as `FileReader` — so they have to be served
+   * from a read started in the drop's tick as well, not started on demand.
+   */
+  prefix: Promise<Uint8Array | null>;
+  /** The counterpart object's reads, when the payload exposed the file twice. */
+  spare?: PrimedRead;
+}
+
+export type PrimedReads = Map<File, PrimedRead>;
+
+/** Bytes sampled to decide whether an unclassified file is text. */
+const PREFIX_BYTES = 4096;
+
+function startPrefixRead(file: File): Promise<Uint8Array | null> {
+  const { promise, resolve } = Promise.withResolvers<Uint8Array | null>();
+  const reader = new FileReader();
+  reader.onload = () => resolve(reader.result instanceof ArrayBuffer ? new Uint8Array(reader.result) : null);
+  reader.onerror = () => resolve(null);
+  reader.onabort = () => resolve(null);
+  reader.readAsArrayBuffer(file.slice(0, PREFIX_BYTES));
+  return promise;
+}
+
+/**
+ * Begin reading every file NOW, in the drop handler's own tick.
+ *
+ * Returns a lookup the later async pipeline consults instead of reading the
+ * `File` itself. Files that were not primed (a directory walk discovers its
+ * children after the tick) simply have no entry and fall back to a fresh read.
+ */
+export function primeFileReads(files: readonly File[], fallbacks?: Map<File, File>): PrimedReads {
+  const primed: PrimedReads = new Map();
+  // Bounded by the same cap the attach path applies: a read is buffered as a
+  // data URL, so priming a thousand-file drop would hold every byte twice
+  // before the budget had a chance to reject any of them.
+  for (const file of files.slice(0, MAX_PRIMED_FILES)) {
+    if (primed.has(file)) continue;
+    const counterpart = fallbacks?.get(file);
+    primed.set(file, {
+      dataUrl: startDataUrlRead(file),
+      prefix: startPrefixRead(file),
+      // Primed in the same tick for the same reason: a fallback whose own read
+      // starts after the drop window closes is not authorized either.
+      ...(counterpart
+        ? { spare: { dataUrl: startDataUrlRead(counterpart), prefix: startPrefixRead(counterpart) } }
+        : {}),
+    });
+  }
+  return primed;
+}
+
+/**
+ * The primed leading bytes, or `undefined` when the file was never primed.
+ *
+ * An empty array means the read was attempted and yielded nothing — which is
+ * also what a genuine empty file gives, and what the sniff should see.
+ */
+export async function primedPrefix(file: File, primed?: PrimedReads): Promise<Uint8Array | undefined> {
+  const started = primed?.get(file);
+  if (!started) return undefined;
+  const bytes = await started.prefix;
+  if (bytes && bytes.byteLength > 0) return bytes;
+  if (started.spare) {
+    const spare = await started.spare.prefix;
+    if (spare && spare.byteLength > 0) return spare;
+  }
+  return bytes ?? new Uint8Array(0);
+}
+
+/** The base64 payload of a data URL, or null when there is none. */
+export function base64Of(dataUrl: string | null): string | null {
+  if (dataUrl === null) return null;
+  const comma = dataUrl.indexOf(',');
+  return comma === -1 ? null : dataUrl.slice(comma + 1);
+}
+
+/**
+ * Decode a data URL's payload back to text, or null when it cannot be decoded.
+ *
+ * Null covers both "no payload" and "payload is not text": a dropped binary
+ * arrives through the same data-URL read, and its bytes are not a UTF-8 string.
+ */
+export function textOf(dataUrl: string | null): string | null {
+  const base64 = base64Of(dataUrl);
+  if (base64 === null) return null;
+  try {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+    return new TextDecoder('utf-8').decode(bytes);
+  } catch {
+    return null;
+  }
+}
+
+/** Read a File as base64, or null when the read fails. */
+export async function readAsDataUrl(file: File, primed?: PrimedReads): Promise<string | null> {
+  const started = primed?.get(file);
+  if (started) {
+    const payload = base64Of(await started.dataUrl);
+    if (payload !== null) return payload;
+    // The primary object did not read; the drop's other object for the same file
+    // may. One of the two is unreadable in a given context and it is not the one
+    // the metadata suggests.
+    if (started.spare) return base64Of(await started.spare.dataUrl);
+    return null;
+  }
+  return base64Of(await startDataUrlRead(file));
+}
+
+/** Read a File as text through `readAsText`, or null when the read fails. */
+function readAsTextDirect(file: File): Promise<string | null> {
+  const { promise, resolve } = Promise.withResolvers<string | null>();
+  const reader = new FileReader();
+  reader.onload = () => resolve(typeof reader.result === 'string' ? reader.result : null);
+  reader.onerror = () => {
+    resolve(null);
+  };
+  reader.onabort = () => resolve(null);
+  reader.readAsText(file);
+  return promise;
+}
+
+/**
+ * Read a File's text, preferring a read that was already started.
+ *
+ * The primed read is the one that matters: it is the only one the browser is
+ * guaranteed to authorize for a dropped file (see the module note), so it is
+ * consulted first and a non-empty body from it ends the call. The loop behind it
+ * exists for a PROMISED file — another app's drag, whose bytes land a moment
+ * after the entry exists — and for a file that was never primed at all.
+ *
+ * Returns null when no attempt produced a body for a file that declares bytes.
+ */
+export async function readFileTextWithRetry(file: File, primed?: PrimedReads): Promise<string | null> {
+  const started = primed?.get(file);
+  if (started) {
+    const content = textOf(await started.dataUrl);
+    if (content !== null && content.length > 0) return content;
+    if (started.spare) {
+      const spare = textOf(await started.spare.dataUrl);
+      if (spare !== null && spare.length > 0) return spare;
+    }
+  }
+
+  let last: string | null = null;
+  for (let attempt = 0; attempt < READ_ATTEMPTS; attempt += 1) {
+    last = await readAsTextDirect(file);
+    if (last === null || last.length === 0) {
+      const viaDataUrl = textOf(await startDataUrlRead(file));
+      if (viaDataUrl !== null && viaDataUrl.length > 0) return viaDataUrl;
+    }
+    if (last !== null && last.length > 0) return last;
+    // An empty body is the real answer once the file has had a beat to
+    // materialize AND declares no bytes of its own.
+    if (file.size === 0 && attempt > 0) return last ?? '';
+    await delay(READ_RETRY_MS);
+  }
+  return last;
+}

package/src/client/hooks/chat/composer/index.ts

@@ -2,7 +2,7 @@ import { useCallback, useId, useLayoutEffect, useMemo, useRef, useState } from '
 import type { ChangeEvent, RefObject } from 'preact/compat';
 import type { TargetedKeyboardEvent } from 'preact';
 import type { ComposerMatchItem, ComposerPickItem, ComposerTrigger } from '@/shared/types';
-import { detectComposerTrigger, insertToken, tokenForItem } from '@/shared/lib/chat/composer/trigger';
+import { detectComposerTrigger, insertToken, sendInsteadOfAccept, tokenForItem } from '@/shared/lib/chat/composer/trigger';
 import { filterComposerItems } from '@/shared/lib/chat/composer/filter';
 import { useComposerItems } from '@/client/hooks/chat/composer/items';
 
@@ -152,6 +152,12 @@ export function useComposerTrigger(options: UseComposerTriggerOptions): Composer
       }
 
       if ((e.key === 'Enter' || e.key === 'Tab') && matches.length > 0) {
+        // A complete command with nothing left to complete: Enter is a send, so
+        // drop the popup rather than consuming the keystroke.
+        if (e.key === 'Enter' && sendInsteadOfAccept(trigger, matches[clampedIndex])) {
+          close();
+          return false;
+        }
         e.preventDefault();
         e.stopPropagation();
         selectItem(matches[clampedIndex]);

package/src/client/hooks/chat/composer/pipeline.ts

@@ -0,0 +1,181 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The composer's attach-and-send pipeline: everything between "a file arrived"
+ * and "a prompt is dispatched", plus the one line of feedback each outcome
+ * produces.
+ *
+ * Extracted from ChatInput so the component stays a layout shell and the
+ * composer keeps room under the repo's per-file size ceiling.
+ *
+ * The rules encoded here, each of which was a bug once:
+ *
+ * - A drop registers its files in the attachment hook BEFORE the component
+ *   re-renders, so a send clicked immediately afterwards must read the hook's
+ *   list, not the component's `attachments` prop — that prop is a frame behind
+ *   and an empty read clears the composer and dispatches nothing.
+ * - A send waits for in-flight reads and then uses the list those reads
+ *   returned: an attachment whose bytes landed during the wait is sent
+ *   complete, never as the pre-read entry.
+ * - A send that would carry neither text nor any readable attachment is
+ *   REPORTED, never dispatched. An empty prompt reaching the model is worse
+ *   than not sending, and it is what a failed read used to produce.
+ */
+
+import { useCallback, useRef, useState } from 'preact/hooks';
+import type { SetStateAction } from 'preact/compat';
+import type { Attachment } from '@/shared/types';
+import { attachmentName, describeAttachmentBudget } from '@/shared/lib/chat/attachments';
+import { useComposerAttachments } from '@/client/hooks/chat/composer/attachments';
+import { useFileDrop, DROP_LIMIT_NOTICE, type FileDropProps } from '@/client/hooks/chat/composer/file-drop';
+import type { PrimedReads } from '@/client/hooks/chat/composer/file-reads';
+import {
+  describeReferenceFailure,
+  describeUnreadable,
+  readDroppedReference,
+  referenceName,
+  type ReferenceFailure,
+} from '@/client/hooks/chat/composer/drop-references';
+
+export interface UseComposerPipelineOptions {
+  attachments: Attachment[];
+  setAttachments: (updater: SetStateAction<Attachment[]>) => void;
+  /** Current composer text, read at send time. */
+  value: string;
+  disabled: boolean;
+  /** Workspace root, used to resolve a dropped path reference. */
+  rootPath?: string | null;
+  onSend: (attachments: Attachment[], options?: { steering?: boolean }) => void;
+}
+
+export interface ComposerPipeline {
+  /** Inline notice shown above the input; null when there is nothing to say. */
+  notice: string | null;
+  dismissNotice: () => void;
+  /** True while a file drag hovers the composer. */
+  isDragging: boolean;
+  /** Drag handlers for the composer card. */
+  dropProps: FileDropProps;
+  /** Attach a batch (picker, paste, or a drop the caller already parsed). */
+  acceptFiles: (files: File[], incomplete?: boolean, references?: string[], primed?: PrimedReads) => void;
+  /** Remove one attachment. */
+  removeAttachment: (id: string) => void;
+  /** Send the composer's contents. */
+  submit: (options?: { steering?: boolean }) => void;
+}
+
+export function useComposerPipeline({
+  attachments,
+  setAttachments,
+  value,
+  disabled,
+  rootPath,
+  onSend,
+}: UseComposerPipelineOptions): ComposerPipeline {
+  const { addFiles, removeAttachment, readyForSend, peek, clear } = useComposerAttachments({ attachments, setAttachments });
+  // Guards a double click: the composer is cleared only after the reads land, so
+  // without this a second click would dispatch the same attachment twice.
+  const sendingRef = useRef(false);
+  const [notice, setNotice] = useState<string | null>(null);
+
+  // A download dragged out of a web page carries no File — only a URL. The
+  // server reads it, because the browser cannot fetch an arbitrary path and the
+  // drop gives no bytes to work with.
+  const attachReferences = useCallback(async (references: string[]) => {
+    const resolved: File[] = [];
+    const failed: string[] = [];
+    const reasons = new Map<string, ReferenceFailure>();
+    await Promise.all(references.map(async (reference) => {
+      const name = referenceName(reference);
+      const result = await readDroppedReference(reference, rootPath ?? null);
+      if (result.ok) {
+        resolved.push(result.file);
+        return;
+      }
+      failed.push(name);
+      reasons.set(name, result.reason);
+    }));
+    if (resolved.length > 0) {
+      const { unreadable } = await addFiles(resolved);
+      setNotice(unreadable.length > 0 ? describeUnreadable(unreadable) : null);
+    }
+    if (failed.length > 0) {
+      // Named per cause: "outside the folders the chamber may read" is something
+      // the user can act on, while a bare "could not be read" is not.
+      const reason = reasons.get(failed[0]) ?? 'unavailable';
+      setNotice(describeReferenceFailure(failed, reason));
+    }
+  }, [addFiles, rootPath]);
+
+  const acceptFiles = useCallback((
+    files: File[],
+    incomplete = false,
+    references: string[] = [],
+    primed?: PrimedReads,
+  ) => {
+    void (async () => {
+      const { added, skipped, unreadable } = await addFiles(files, primed);
+      if (skipped.length > 0) {
+        setNotice(describeAttachmentBudget(skipped));
+      } else if (incomplete) {
+        setNotice(DROP_LIMIT_NOTICE);
+      } else if (unreadable.length > 0) {
+        // Reported, never silent: a chip whose bytes never arrived would send a
+        // prompt that names a file the model cannot see.
+        setNotice(describeUnreadable(unreadable));
+      } else if (added > 0) {
+        setNotice(null);
+      }
+      if (references.length > 0) await attachReferences(references);
+    })();
+  }, [addFiles, attachReferences]);
+
+  // OS drag-and-drop. Bound to the composer CARD, not the textarea: the whole
+  // composer is the drop target, so a drop anywhere inside it (including on the
+  // textarea) bubbles here instead of letting the browser navigate away.
+  const { isDragging, dropProps } = useFileDrop({ disabled, onFiles: acceptFiles });
+
+  const submit = useCallback((options?: { steering?: boolean }) => {
+    // The hook's list, not the prop: a drop registers its files before this
+    // component re-renders, so a send clicked right after a drop would see an
+    // empty prop, clear the composer and dispatch a prompt carrying nothing.
+    const pending = peek();
+    if (!value.trim() && pending.length === 0) {
+      return;
+    }
+    if (sendingRef.current) {
+      return;
+    }
+    sendingRef.current = true;
+    // Bytes are read at attach time; waiting here returns the list as it stands
+    // once those reads land, so an attachment whose read was still in flight is
+    // sent complete rather than empty.
+    void readyForSend().then((outgoing) => {
+      clear();
+      // "Readable" means there is something TO SEND. An attachment whose read
+      // produced an empty string has a `content` field but no content, and
+      // treating that as readable is how a prompt with an empty body went out.
+      const readable = outgoing.some((a) => (a.content?.length ?? 0) > 0 || a.dataBase64 !== undefined);
+      if (!value.trim() && outgoing.length > 0 && !readable) {
+        setNotice(describeUnreadable(outgoing.map((a) => attachmentName(a))));
+        return;
+      }
+      onSend(outgoing, options);
+    }).finally(() => {
+      sendingRef.current = false;
+    });
+  }, [clear, onSend, peek, readyForSend, value]);
+
+  return {
+    notice,
+    dismissNotice: useCallback(() => setNotice(null), []),
+    isDragging,
+    dropProps,
+    acceptFiles,
+    removeAttachment,
+    submit,
+  };
+}

package/src/client/hooks/chat/omp/index.ts

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from 'preact/hooks';
-import type { ChatMessageData, OmpAgentCallbacks, OmpAgentHandle, OmpAgentState, StreamTransport } from '@/shared/types';
+import type { AgentImage, ChatMessageData, OmpAgentCallbacks, OmpAgentHandle, OmpAgentState, StreamTransport } from '@/shared/types';
 import type { ExtensionUiDialogRequest } from '@/shared/types/omp/agent';
 import { type ToolResultRecord, useOmpAgentStream } from '@/client/hooks/chat/omp/stream';
 import { useOmpPromptSender } from '@/client/hooks/chat/omp/prompt-send';
@@ -120,7 +120,7 @@ export function useOmpAgent(sessionId: string | null, callbacks: OmpAgentCallbac
    *  arrives via the interruptPending guard. */
   const sendInterruptAndReply = useCallback(async (
     message: string,
-    images?: { data: string; mimeType: string }[],
+    images?: AgentImage[],
   ): Promise<boolean> => {
     const sid = sessionIdRef.current;
     if (!sid) return false;
@@ -153,7 +153,7 @@ export function useOmpAgent(sessionId: string | null, callbacks: OmpAgentCallbac
   /** Enqueue a follow-up message the agent processes after the current turn. */
   const sendFollowUp = useCallback(async (
     message: string,
-    images?: { data: string; mimeType: string }[],
+    images?: AgentImage[],
   ): Promise<boolean> => {
     const sid = sessionIdRef.current;
     if (!sid) return false;