pi-multimodal-proxy 1.22.1 → 1.24.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.24.0] - 2026-10-11
+
+### Added
+
+- **Interactive YouTube 403 recovery** — a 403 on the media fetch with no cookies configured no longer dead-ends in a hint telling you to type a slash command. The proxy now opens a picker listing only the browsers actually installed on your machine (profile-dir detection per platform: Windows/macOS/Linux); picking one persists `ytdlpCookiesFromBrowser` (same write path as `/multimodal-proxy ytdlp cookies <browser>`, so future sessions just work) and retries the download immediately. Declining, headless sessions (`ctx.hasUI` false), or no detected browser fall back to a one-line notice. yt-dlp failure notifications also no longer echo the full command line: `summarizeYtDlpError` reduces the dump to the actionable `ERROR: …` line, and a 403 that persists *with* cookies now points at the extractor-args knob instead of the cookies knob. Ten new tests (559 total, all green): per-platform profile candidates, env-var fallback, XDG honoring, browser-set containment, and error summarization.
+
+## [1.23.0] - 2026-10-10
+
+### Fixed
+
+- **`#` image-recall autocomplete never fired on vision-capable base models** — two compounding defects, found live while dogfooding the 1.22.1 README claims. First, the dropdown drew candidates **only** from persisted `DescriptionEntry`s, so images analyzed via the `analyze_image` tool (which stores bytes in the in-session recall store but appends no description entry) and images retained in the store were invisible to it. Second, in the most common modern configuration (multimodal base model + default `fallback` mode) pasted/attached images pass through as pixels and entered **no** store at all — no description, no bytes, no meta — leaving the autocomplete permanently empty no matter what the user did. Fixes: `collectRecallCandidates` now unions described images with the recall store's keys (described entries win on collision, store-only candidates show the filename or hash-prefix label); and the `before_agent_start` pass-through branch retains attachment bytes+meta in the existing in-memory LRU store (no vision call, no description, no new persistence — the bytes were already in process as message attachments). Net effect: `#` and `analyze_image` recall now work in every mode except `off` (where the extension is disabled by intent and retains nothing), matching the README's "media memory" pillar. Two review fixes folded in (PR #40): retention is skipped entirely in `off` mode, and `storeImageData` runs unconditionally on re-attachment so the LRU refreshes recency (attach A, B, A, C evicts B, not A). Verified against pi 1.1.0's `AutocompleteItem`/`AutocompleteProvider` shapes (no API drift involved).
+
 ## [1.22.1] - 2026-10-10
 
 ### Changed

package/README.md

@@ -7,7 +7,7 @@ Media understanding for [Pi](https://pi.dev): images, video, audio, and YouTube
 - **Video, audio & YouTube** — paste a URL (`youtube.com/watch?v=…`, `youtu.be/…`, `/shorts/…`) or a local file path and a multimodal model (default: Grok 4.3) transcribes speech with speaker diarization, describes visual scenes, reads on-screen text, and reasons about the content in a single call. Almost no chat model or agent ingests video natively: this is the package's deepest capability.
 - **Vision for text-only models** — a large slice of Pi's catalog (DeepSeek, GLM, Nemotron, Devstral, gpt-oss, …) still has no image input. When an image reaches such a model, the extension describes it via your configured vision model, persists the description in the session, and injects it into context. The model "sees" images across turns, cached by content hash.
 - **Cheaper vision for multimodal models** — select `Multimodal Auto` and media turns escalate natively to the vision model (real pixels, no text fence; prompt caches survive the routing) while text turns stay on your base model. Pin it with `/multimodal-proxy virtual-base` to keep the cheap model after media turns too: unpinned, a text turn reuses whatever physical model handled the turn before, which after a media turn is the vision model. Or proxy every image through a flash-priced describer with mode `always`.
-- **Media memory that outlives the turn** — every proxied image gets a stable `image="<id>"`, so the agent can re-query or crop an earlier screenshot without a re-attachment ("zoom into that screenshot from before"), `#` autocompletes image ids in the prompt, and descriptions survive compaction via a recall digest. `analyze_image` answers targeted questions with locally applied crops; `generate_image` creates images that flow straight back through the same pipeline. (Recall applies to described images: text-only base models or mode `always`. Images passed through natively to a vision-capable base model stay in context as pixels and are not duplicated into recall.)
+- **Media memory that outlives the turn** — every image the agent can re-query gets a stable `image="<id>"`: described images (text-only base models, mode `always`, or explicit `analyze_image` calls) carry a description snippet, and pasted attachments on a vision-capable base model are retained in the recall store without a description. The agent can re-query or crop an earlier screenshot without a re-attachment ("zoom into that screenshot from before"), `#` autocompletes image ids in the prompt, and descriptions survive compaction via a recall digest. `analyze_image` answers targeted questions with locally applied crops; `generate_image` creates images that flow straight back through the same pipeline.
 - **Governed by default** — first-use data-egress consent per provider, persisted pre-consent lists, crops applied locally before upload, upload downscaling, decode-bomb protection, and recall bytes kept in memory only. See [Privacy & security](#privacy--security).
 
 Media routing is automatic: content sniffing and path detection feed a pipeline with transient-error retry and model fallback on the image path (the native xAI video path is one-shot), plus compact transcript rows for `analyze_image`/`generate_image` (Pi ≥ 1.0.1).
@@ -47,9 +47,10 @@ winget install yt-dlp.yt-dlp        # Windows
 
 #### 403 Forbidden / download failures
 
-YouTube periodically rejects unauthenticated media fetches with `HTTP Error 403: Forbidden`, even on the latest `yt-dlp`. The proxy can't fix YouTube's backend, but you can satisfy the auth check:
+YouTube periodically rejects unauthenticated media fetches with `HTTP Error 403: Forbidden`, even on the latest `yt-dlp`. The proxy can't fix YouTube's backend, but it can satisfy the auth check:
 
-- **Reuse a logged-in browser session** — `/multimodal-proxy ytdlp cookies chrome` (also `firefox`, `edge`, `brave`, `opera`, `safari`, `vivaldi`, `chromium`, `whale`). yt-dlp reads that browser's YouTube cookies. This fixes most 403s.
+- **Interactive fix (default)** — when a download 403s and no cookies are configured, a picker offers the browsers actually installed on your machine. Pick one and the download retries immediately with that browser's YouTube cookies; the choice is persisted, so it only happens once.
+- **Manual setup** — `/multimodal-proxy ytdlp cookies chrome` (also `firefox`, `edge`, `brave`, `opera`, `safari`, `vivaldi`, `chromium`, `whale`). Same effect as the picker, for headless setups or pre-configuration.
 - **Try alternate player clients** — `/multimodal-proxy ytdlp extractor-args "youtube:player_client=web_safari,web"`.
 - Show current settings with `/multimodal-proxy ytdlp`; turn either off with `... off`.
 
@@ -206,7 +207,10 @@ Every `<vision_proxy_description>`, `<vision_proxy_analysis>`, and
 can pass that id back to `analyze_image` (or `/multimodal-proxy describe`) to
 re-examine or crop an image the user shared earlier in the session — even once
 it is no longer attached to the current message (e.g. *"zoom into that
-screenshot from before"*). The image bytes are retained **in memory only** for
+screenshot from before"*). Pasted attachments on a vision-capable base model
+are also retained (no description; labeled by filename, or by hash prefix when
+the paste carries no filename), so `#` recall works in every mode except `off`.
+The image bytes are retained **in memory only** for
 the life of the session, never written to the session log or disk, and are
 evicted oldest-first once the recall budget (`PI_VISION_PROXY_IMAGE_RECALL_BYTES`,
 default 64 MB) is exceeded.

package/extensions/__tests__/internal.test.ts

@@ -53,6 +53,8 @@ import {
 	sanitizeAllowedFolders,
 	sanitizeYtdlpCookiesFromBrowser,
 	sanitizeYtdlpExtractorArgs,
+	browserProfileCandidates,
+	summarizeYtDlpError,
 	sanitizeProviderHeaders,
 	YTDLP_COOKIES_BROWSERS,
 	pathAccessFromConfig,
@@ -348,6 +350,63 @@ describe("yt-dlp config sanitizers", () => {
 	});
 });
 
+describe("browserProfileCandidates", () => {
+	it("lists Windows profile dirs from LOCALAPPDATA/APPDATA, without safari", () => {
+		const env = { LOCALAPPDATA: join("C:", "Users", "u", "AppData", "Local"), APPDATA: join("C:", "Users", "u", "AppData", "Roaming") };
+		const map = new Map(browserProfileCandidates("win32", env, join("C:", "Users", "u")).map((c) => [c.browser, c.dirs]));
+		assert.ok(map.get("chrome")![0].endsWith(join("Google", "Chrome", "User Data")));
+		assert.ok(map.get("firefox")![0].endsWith(join("Mozilla", "Firefox", "Profiles")));
+		assert.ok(map.has("edge") && map.has("brave") && map.has("vivaldi") && map.has("chromium") && map.has("whale"));
+		assert.ok(!map.has("safari"));
+	});
+	it("falls back to homedir AppData when env vars are missing", () => {
+		const home = join("C:", "Users", "u");
+		const map = new Map(browserProfileCandidates("win32", {}, home).map((c) => [c.browser, c.dirs]));
+		assert.ok(map.get("chrome")![0].startsWith(join(home, "AppData", "Local")));
+		assert.ok(map.get("firefox")![0].startsWith(join(home, "AppData", "Roaming")));
+	});
+	it("lists macOS profile dirs including safari", () => {
+		const map = new Map(browserProfileCandidates("darwin", {}, "/Users/u").map((c) => [c.browser, c.dirs]));
+		assert.ok(map.get("firefox")![0].endsWith(join("Firefox", "Profiles")));
+		assert.ok(map.get("chrome")![0].endsWith(join("Google", "Chrome")));
+		assert.ok(map.get("safari")![0].endsWith("Safari.app"));
+		assert.ok(!map.has("whale"));
+	});
+	it("honors XDG_CONFIG_HOME on linux", () => {
+		const map = new Map(browserProfileCandidates("linux", { XDG_CONFIG_HOME: "/xdg" }, "/home/u").map((c) => [c.browser, c.dirs]));
+		assert.equal(map.get("chrome")![0], join("/xdg", "google-chrome"));
+		assert.equal(map.get("firefox")![0], join("/home/u", ".mozilla", "firefox"));
+		assert.ok(!map.has("safari"));
+	});
+	it("returns empty for unsupported platforms", () => {
+		assert.deepEqual(browserProfileCandidates("freebsd", {}, "/home/u"), []);
+	});
+	it("only yields browsers yt-dlp supports", () => {
+		for (const platform of ["win32", "darwin", "linux"] as const) {
+			for (const { browser } of browserProfileCandidates(platform, {}, "/home/u")) {
+				assert.ok(YTDLP_COOKIES_BROWSERS.has(browser), `${browser} on ${platform}`);
+			}
+		}
+	});
+});
+
+describe("summarizeYtDlpError", () => {
+	it("extracts the last ERROR line without the prefix", () => {
+		const msg = "Command failed: yt-dlp --no-playlist --no-warnings https://x\nWARNING: something\nERROR: unable to download video data: HTTP Error 403: Forbidden";
+		assert.equal(summarizeYtDlpError(msg), "unable to download video data: HTTP Error 403: Forbidden");
+	});
+	it("prefers the last ERROR line over earlier ones", () => {
+		const msg = "ERROR: first\nnoise\nERROR: second";
+		assert.equal(summarizeYtDlpError(msg), "second");
+	});
+	it("falls back to the last non-empty line", () => {
+		assert.equal(summarizeYtDlpError("Command failed: yt-dlp\n\nsome other failure\n"), "some other failure");
+	});
+	it("returns the message itself when it has no non-empty lines", () => {
+		assert.equal(summarizeYtDlpError(""), "");
+	});
+});
+
 describe("selectVisionModels", () => {
 	const img = (id: string) => ({ id, input: ["text", "image"] as readonly string[] });
 	const txt = (id: string) => ({ id, input: ["text"] as readonly string[] });

package/extensions/__tests__/recall-autocomplete.test.ts

@@ -64,6 +64,40 @@ describe("collectRecallCandidates", () => {
 			{ hash: "h1", description: "first image", filename: undefined },
 		]);
 	});
+
+	it("merges store-only hashes (pass-through attachments) after described ones", () => {
+		const descriptions = new Map([["h1", "described earlier"]]);
+		const meta = new Map([["h3", { width: 8, height: 6, filename: "paste.png" }]]);
+		const out = collectRecallCandidates(descriptions, (h) => meta.get(h), ["h2", "h3"]);
+		assert.deepEqual(out, [
+			{ hash: "h1", description: "described earlier", filename: undefined },
+			{ hash: "h3", description: undefined, filename: "paste.png" }, // newest store entry first
+			{ hash: "h2", description: undefined, filename: undefined },
+		]);
+	});
+
+	it("descriptions win when a hash appears in both sources", () => {
+		const out = collectRecallCandidates(
+			new Map([["shared", "the description"]]),
+			() => undefined,
+			["shared", "other"],
+		);
+		assert.equal(out.length, 2);
+		assert.equal(out[0]!.description, "the description");
+		assert.equal(out[1]!.hash, "other");
+	});
+
+	it("feeds store-only candidates into buildRecallItems labels", () => {
+		const hash = "c".repeat(32);
+		const candidates = collectRecallCandidates(new Map(), () => ({ width: 2, height: 2, filename: "shot.png" }), [hash]);
+		const items = buildRecallItems(candidates, "");
+		assert.equal(items.length, 1);
+		assert.equal(items[0]!.label, "shot.png");
+		assert.ok(items[0]!.value.endsWith(hash));
+		// no filename → hash-prefix label
+		const bare = buildRecallItems(collectRecallCandidates(new Map(), () => undefined, [hash]), "");
+		assert.equal(bare[0]!.label, `${hash.slice(0, 12)}…`);
+	});
 });
 
 describe("buildRecallItems", () => {

package/extensions/internal.ts

@@ -318,16 +318,28 @@ export function extractRecallToken(
 }
 
 /**
- * Collect recall candidates from persisted descriptions, most recent first.
+ * Collect recall candidates for the `#` autocomplete, most recent first.
  * `metaLookup` supplies in-memory filename/dimensions when still available.
+ * `recallableHashes` (keys of the in-session image-data store) adds images
+ * that are re-queryable by id but were never described: pass-through
+ * attachments on vision-capable base models and analyze_image results.
+ * Described images win on collision (they carry description text).
  */
 export function collectRecallCandidates(
 	descriptions: ReadonlyMap<string, string>,
 	metaLookup: (hash: string) => ImageMeta | undefined,
+	recallableHashes?: Iterable<string>,
 ): RecallCandidate[] {
-	return [...descriptions]
-		.reverse()
-		.map(([hash, description]) => ({ hash, description, filename: metaLookup(hash)?.filename }));
+	const out = new Map<string, RecallCandidate>();
+	for (const [hash, description] of [...descriptions].reverse()) {
+		out.set(hash, { hash, description, filename: metaLookup(hash)?.filename });
+	}
+	if (recallableHashes) {
+		for (const hash of [...recallableHashes].reverse()) {
+			if (!out.has(hash)) out.set(hash, { hash, description: undefined, filename: metaLookup(hash)?.filename });
+	}
+	}
+	return [...out.values()];
 }
 
 /** One-line dropdown snippet (no fence markers, single line, hard cap). */
@@ -1151,6 +1163,68 @@ export function sanitizeYtdlpExtractorArgs(value: unknown): string {
 	return value.replace(/[\x00-\x1f\x7f]/g, "").trim().slice(0, YTDLP_EXTRACTOR_ARGS_MAX);
 }
 
+/**
+ * Well-known profile-dir candidates per browser, per platform (1.24.0). Pure:
+ * the caller does the fs checks and keeps only browsers whose dir exists.
+ * Drives the interactive 403 picker so it offers browsers that can actually
+ * work instead of listing all nine yt-dlp values blindly.
+ */
+export function browserProfileCandidates(
+	platform: NodeJS.Platform,
+	env: NodeJS.ProcessEnv,
+	homedir: string,
+): Array<{ browser: string; dirs: string[] }> {
+	const out: Array<{ browser: string; dirs: string[] }> = [];
+	const push = (browser: string, dirs: string[]) => out.push({ browser, dirs });
+	if (platform === "win32") {
+		const local = env.LOCALAPPDATA ?? join(homedir, "AppData", "Local");
+		const roaming = env.APPDATA ?? join(homedir, "AppData", "Roaming");
+		push("chrome", [join(local, "Google", "Chrome", "User Data")]);
+		push("firefox", [join(roaming, "Mozilla", "Firefox", "Profiles")]);
+		push("edge", [join(local, "Microsoft", "Edge", "User Data")]);
+		push("brave", [join(local, "BraveSoftware", "Brave-Browser", "User Data")]);
+		push("opera", [join(roaming, "Opera Software", "Opera Stable")]);
+		push("vivaldi", [join(local, "Vivaldi", "User Data")]);
+		push("chromium", [join(local, "Chromium", "User Data")]);
+		push("whale", [join(local, "Naver", "Naver Whale", "User Data")]);
+	} else if (platform === "darwin") {
+		const appSupport = join(homedir, "Library", "Application Support");
+		push("chrome", [join(appSupport, "Google", "Chrome")]);
+		push("firefox", [join(appSupport, "Firefox", "Profiles")]);
+		push("edge", [join(appSupport, "Microsoft Edge")]);
+		push("brave", [join(appSupport, "BraveSoftware", "Brave-Browser")]);
+		push("opera", [join(appSupport, "com.operasoftware.Opera")]);
+		push("vivaldi", [join(appSupport, "Vivaldi")]);
+		push("chromium", [join(appSupport, "Chromium")]);
+		push("safari", [join("/", "Applications", "Safari.app")]);
+	} else if (platform === "linux") {
+		const config = env.XDG_CONFIG_HOME ?? join(homedir, ".config");
+		push("chrome", [join(config, "google-chrome")]);
+		push("firefox", [join(homedir, ".mozilla", "firefox")]);
+		push("edge", [join(config, "microsoft-edge")]);
+		push("brave", [join(config, "BraveSoftware", "Brave-Browser")]);
+		push("opera", [join(config, "opera")]);
+		push("vivaldi", [join(config, "vivaldi")]);
+		push("chromium", [join(config, "chromium")]);
+		push("whale", [join(config, "naver-whale")]);
+	}
+	return out;
+}
+
+/**
+ * Reduce an execFile failure dump to the single actionable yt-dlp line: the
+ * last `ERROR: …` from stderr, else the last non-empty line. Keeps user-facing
+ * notifications to one line instead of echoing the full command (1.24.0).
+ */
+export function summarizeYtDlpError(message: string): string {
+	const lines = message.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const m = /^ERROR:\s*(.+)$/i.exec(lines[i]);
+		if (m) return m[1].trim();
+	}
+	return lines[lines.length - 1] ?? message;
+}
+
 /**
  * Drop `null` header values from a `ProviderHeaders` map. Since pi 0.84.0,
  * `ModelRegistry.getApiKeyAndHeaders()` returns `Record<string, string | null>`

package/extensions/vision-proxy.ts

@@ -254,6 +254,7 @@ import {
 	buildVideoDescriptionFence,
 	buildVideoEmptyResponseError,
 	buildVideoProxySection,
+	browserProfileCandidates,
 	extractXaiResponsesText,
 	formatXaiSttTranscript,
 	analyzeDetailsForTranscript,
@@ -321,6 +322,7 @@ import {
 	isUncPath,
 	MAX_ALLOWED_FOLDERS,
 	sanitizeYtdlpExtractorArgs,
+	summarizeYtDlpError,
 	YTDLP_COOKIES_BROWSERS,
 
 	readMediaFileWithReason,
@@ -1448,6 +1450,65 @@ interface DownloadedMedia {
 	title: string;
 }
 
+/**
+ * Browsers from yt-dlp's --cookies-from-browser set whose profile dir exists
+ * on this machine (1.24.0). Drives the interactive 403 picker so it only
+ * offers browsers that can actually work.
+ */
+async function detectCookieBrowsers(): Promise<string[]> {
+	const found: string[] = [];
+	for (const { browser, dirs } of browserProfileCandidates(os.platform(), process.env, os.homedir())) {
+		for (const d of dirs) {
+			if (await pathExists(d)) {
+				found.push(browser);
+				break;
+			}
+		}
+	}
+	return found;
+}
+
+/**
+ * Persist a single config patch outside the slash-command handler (1.24.0).
+ * Mirrors commandHandler's writePersisted: sanitize → session entry → file,
+ * keeping allowedProviders file-scoped. Used by the interactive 403 flow.
+ */
+function persistConfigPatch(pi: ExtensionAPI, ctx: ExtensionContext, patch: Partial<VisionConfig>): void {
+	const validated = sanitize({ ...persistedBase(ctx.sessionManager.getEntries()), ...patch });
+	delete validated.allowedProviders;
+	pi.appendEntry(CUSTOM_TYPE_CONFIG, validated);
+	const fileNext: Partial<VisionConfig> = { ...validated };
+	if (_fileConfig.allowedProviders !== undefined) {
+		fileNext.allowedProviders = normalizeAllowedProviders(_fileConfig.allowedProviders) ?? [];
+	}
+	writePersistentFile(fileNext);
+	_fileConfig = fileNext;
+}
+
+/**
+ * Interactive half of the 403 flow (1.24.0): offer the installed browsers,
+ * persist the pick (same as `/multimodal-proxy ytdlp cookies <browser>`), and
+ * return it so the caller retries. Returns null when declined, when no UI is
+ * available, or when no supported browser is detected.
+ */
+async function promptForCookieBrowser(pi: ExtensionAPI, ctx: ExtensionContext): Promise<string | null> {
+	if (!ctx.hasUI) return null;
+	const browsers = await detectCookieBrowsers();
+	if (browsers.length === 0) return null;
+	const CANCEL = "Don't retry";
+	const choice = await ctx.ui.select(
+		"YouTube blocked the download (403 — it wants a logged-in session). Retry with cookies from:",
+		[...browsers, CANCEL],
+	);
+	if (!choice || choice === CANCEL || !YTDLP_COOKIES_BROWSERS.has(choice)) return null;
+	persistConfigPatch(pi, ctx, { ytdlpCookiesFromBrowser: choice });
+	ctx.ui.notify(
+		`[multimodal-proxy] Saved: yt-dlp will reuse ${choice} cookies from now on (change via /multimodal-proxy ytdlp cookies). Retrying…`,
+		"info",
+	);
+	return choice;
+}
+
 /**
  * Download a media URL via yt-dlp into a fresh temp dir.
  *
@@ -1464,6 +1525,7 @@ async function downloadMediaUrl(
 	signal: AbortSignal | undefined,
 	ctx: ExtensionContext,
 	ytdlp?: { cookiesFromBrowser?: string; extractorArgs?: string },
+	hooks?: { onForbidden?: () => Promise<string | null> },
 ): Promise<DownloadedMedia | null> {
 	if (!(await checkYtDlp())) {
 		ctx.ui.notify(
@@ -1524,12 +1586,32 @@ async function downloadMediaUrl(
 	} catch (err) {
 		if (signal?.aborted) return null;
 		const msg = err instanceof Error ? err.message : String(err);
-		// A 403 on the media fetch usually means YouTube wants a logged-in
-		// session; point the user at the cookies knob if it isn't already set.
-		const hint = /403|forbidden/i.test(msg) && !ytdlp?.cookiesFromBrowser
-			? " (a 403 often means YouTube wants a logged-in session — try /multimodal-proxy ytdlp cookies <browser>)"
+		const forbidden = /403|forbidden/i.test(msg);
+		// A 403 without cookies means YouTube wants a logged-in session. Offer to
+		// reuse a browser's cookies interactively (1.24.0) and retry once with
+		// them; the hook also persists the choice so later downloads just work.
+		if (forbidden && !ytdlp?.cookiesFromBrowser && hooks?.onForbidden) {
+			let browser: string | null = null;
+			try {
+				browser = await hooks.onForbidden();
+			} catch {
+				browser = null;
+			}
+			if (signal?.aborted) return null;
+			if (browser) {
+				return downloadMediaUrl(url, signal, ctx, { ...ytdlp, cookiesFromBrowser: browser });
+			}
+			// Declined (or nothing to offer): keep the notice to one line.
+			ctx.ui.notify(`[multimodal-proxy] YouTube download failed: ${summarizeYtDlpError(msg)}`, "warning");
+			return null;
+		}
+		// Point the user at the right knob depending on what is already set.
+		const hint = forbidden
+			? ytdlp?.cookiesFromBrowser
+				? " (still blocked with cookies — try /multimodal-proxy ytdlp extractor-args \"youtube:player_client=android\")"
+				: " (a 403 often means YouTube wants a logged-in session — try /multimodal-proxy ytdlp cookies <browser>)"
 			: "";
-		ctx.ui.notify(`[multimodal-proxy] YouTube download failed for ${url}: ${msg}${hint}`, "warning");
+		ctx.ui.notify(`[multimodal-proxy] YouTube download failed for ${url}: ${summarizeYtDlpError(msg)}${hint}`, "warning");
 		return null;
 	}
 }
@@ -2366,9 +2448,14 @@ export default function (pi: ExtensionAPI) {
 						const entries = ctx.sessionManager.getEntries();
 						const config = resolveConfig(entries, process.env, _fileConfig);
 						if (config.mode !== "off") {
+							// Candidates = described images ∪ everything retained in the
+							// in-memory recall store (pass-through attachments, analyze_image
+							// results) — anything analyze_image can resolve by id.
+							const sessionState = getSessionState(ctx);
 							const candidates = collectRecallCandidates(
 								findDescriptions(entries),
-								(hash) => getSessionState(ctx).imageMeta.get(hash),
+								(hash) => sessionState.imageMeta.get(hash),
+								sessionState.imageData.map.keys(),
 							);
 							const items = buildRecallItems(candidates, token.query);
 							if (items.length > 0) return { items, prefix: token.prefix };
@@ -3086,6 +3173,10 @@ export default function (pi: ExtensionAPI) {
 						() => downloadMediaUrl(watch, ctx.signal, ctx, {
 							cookiesFromBrowser: config.ytdlpCookiesFromBrowser,
 							extractorArgs: config.ytdlpExtractorArgs,
+						}, {
+							// 403 without cookies → offer to reuse an installed browser's
+							// session, persist the pick, and retry (1.24.0).
+							onForbidden: () => promptForCookieBrowser(pi, ctx),
 						}),
 					);
 					if (!dl) continue;
@@ -3242,8 +3333,28 @@ export default function (pi: ExtensionAPI) {
 			}
 
 			if (!shouldStripImages(config, ctx.model)) {
-				// off, or fallback + model supports images → pass through unchanged
-				// But still inject video descriptions if we have them
+				// fallback + model supports images → pass through unchanged (mode
+				// "off" retains nothing: the extension is disabled by intent).
+				// Retain the attachments in the in-memory recall store (no vision
+				// call, no description, bytes were already in process as message
+				// attachments; the store is memory-only and LRU-bounded) so `#`
+				// autocomplete and analyze_image can re-query them by id later in
+				// the session. Path-detected images were already stored on read.
+				// storeImageData runs unconditionally so a re-attached image
+				// refreshes its LRU recency (attach A, B, A, C must evict B, not A).
+				if (config.mode !== "off") {
+					for (const raw of images) {
+						try {
+							const img = toPiAiImage(raw);
+							const hash = hashImageData(img.data);
+							if (!imageMeta.has(hash)) storeImageMeta(imageMeta, hash, img.data);
+							storeImageData(imageData, hash, img.data, img.mimeType);
+						} catch {
+							// Undecodable attachment — pass it through untouched.
+						}
+					}
+				}
+				// Still inject video descriptions if we have them
 				if (videoDescriptionFence) {
 					return {
 						systemPrompt:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-multimodal-proxy",
-  "version": "1.22.1",
+  "version": "1.24.0",
   "description": "Media understanding for any model in Pi: video/audio/YouTube analysis, vision for text-only models, cost-routed vision, and session image recall.",
   "keywords": [
     "pi-package"