fix(engine,workbench): sniff legacy inline images before storing and refuse refs on capability-less harnesses early

Author: Zerlight

packages/client/workbench/src/mock/dev-mock-host.ts

@@ -1507,6 +1507,17 @@ export class DevMockHost {
     session: MockSession,
     content: ContentBlock[],
   ): Promise<void> {
+    // The daemon sniffs before it stores; a mislabeled inline image is refused before any echo.
+    for (let i = 0, len = content.length; i < len; i++) {
+      const block = content[i];
+      if (block.type !== 'image') continue;
+      if (!declaredMimeTypeMatches(block.mimeType, mockBase64ToBytes(block.data).subarray(0, 16))) {
+        this.sendFailure(replyTo, `File contents are not ${block.mimeType}`, {
+          code: 'invalid_request',
+        });
+        return;
+      }
+    }
     const turn = this.beginTurn(session, content);
     turn.readContent = await this.ingestInlineImages(session.sessionId, content);
     const result = await this.streamMockReply(session, content);

packages/client/workbench/src/surface/__tests__/prompt-attachments.test.ts

@@ -77,7 +77,7 @@ describe('stageStoreAttachment', () => {
     const jpegBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0]);
     const file = new File([jpegBytes], 'shot.png', { type: 'image/png' });
     await expect(
-      stageStoreAttachment(client, file, pending, { unsupportedType: 'not a png' }),
+      stageStoreAttachment(client, file, pending, { contentMismatch: 'not a png' }),
     ).rejects.toThrow('not a png');
     expect(putAttachment).not.toHaveBeenCalled();
   });
@@ -184,6 +184,35 @@ describe('overlayPendingUserAttachments', () => {
     });
   });
 
+  it('paints an attachment-only prompt onto its empty echo', () => {
+    const session = 'sess-only-attachment' as SessionId;
+    const link: ContentBlock = {
+      type: 'resource_link',
+      uri: 'attachment:att-4',
+      name: 'only.png',
+    };
+    noteInflightUserAttachments(session, [link]);
+    const conversation: Conversation = {
+      ...EMPTY,
+      items: [
+        {
+          kind: 'message',
+          id: userRowMessageId('turn-4' as TurnId),
+          turnId: 'turn-4',
+          role: 'user',
+          blocks: [],
+          isStreaming: false,
+          receivedAt: Date.now() + 1,
+        },
+      ],
+    };
+    expect(
+      overlayPendingUserAttachments(conversation, session, pendingUserAttachmentsSnapshot())
+        .items[0],
+    ).toMatchObject({ blocks: [link] });
+    clearInflightUserAttachments(session);
+  });
+
   it('leaves a same-window user row alone when its text is not the sent prompt', () => {
     const session = 'sess-author' as SessionId;
     const link: ContentBlock = {

packages/client/workbench/src/surface/prompt-attachments.ts

@@ -89,12 +89,12 @@ export async function stageStoreAttachment(
   client: Pick<LinkCodeClient, 'putAttachment'>,
   file: File,
   pending: ComposerAttachment,
-  errors: { unsupportedType: string },
+  errors: { contentMismatch: string },
 ): Promise<ComposerAttachment> {
   const bytes = new Uint8Array(await file.arrayBuffer());
   // The daemon sniffs at commit; refusing here saves the transfer of a mislabeled file.
   if (!declaredMimeTypeMatches(file.type, bytes.subarray(0, 16))) {
-    throw new Error(errors.unsupportedType);
+    throw new Error(errors.contentMismatch);
   }
   const kind = pending.kind === 'image' ? 'image' : 'file';
   const { attachmentId } = await client.putAttachment({

packages/client/workbench/src/surface/workbench.tsx

@@ -515,7 +515,7 @@ function WorkbenchSessionSurface({
     pending: ComposerAttachment,
   ): Promise<ComposerAttachment> {
     return stageStoreAttachment(client, file, pending, {
-      unsupportedType: tComposer('attachmentUnsupportedType'),
+      contentMismatch: tComposer('attachmentContentMismatch', { type: file.type }),
     });
   }
 

packages/client/workbench/tests/integration/dev-mock-attachments.test.ts

@@ -205,4 +205,22 @@ describe('dev mock attachment store', () => {
     await sending;
     client.dispose();
   });
+
+  it('refuses a legacy inline image whose bytes are not the declared type', async () => {
+    const client = await connectedClient();
+    const sessionId = await client.startSession({ kind: 'codex', cwd: '/mock/repo' });
+    await expect(
+      client.send(sessionId, {
+        type: 'prompt',
+        content: [
+          {
+            type: 'image',
+            mimeType: 'image/png',
+            data: Buffer.from([0xff, 0xd8, 0xff, 0xe0]).toString('base64'),
+          },
+        ],
+      }),
+    ).rejects.toThrow('File contents are not image/png');
+    client.dispose();
+  });
 });

packages/host/engine/src/__tests__/engine-attachment-submit.test.ts

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { chmod, mkdir, mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { asHistoryId } from '@linkcode/agent-adapter';
@@ -81,6 +81,7 @@ async function started(kind: 'claude-code' | 'grok-build' = 'claude-code') {
     conversationStore,
     attachmentStore,
     blobStore,
+    stateDir,
     sessionId: startedId(h.sent, 'r1'),
     adapter: nullthrow(h.adapters[0]),
   };
@@ -125,9 +126,10 @@ describe('turn.submit attachment admit and materialize', () => {
     expect(await h.conversationStore.listTurns(h.sessionId)).toHaveLength(0);
   });
 
-  it('refuses an image on grok-build at admit', async () => {
+  it('refuses an image on grok-build at admit without touching the store', async () => {
     const h = await started('grok-build');
     const attachmentId = await readyPng(h);
+    const list = vi.spyOn(h.attachmentStore, 'listAttachments');
     await h.inject({
       kind: 'turn.submit',
       clientReqId: 's-grok',
@@ -146,6 +148,7 @@ describe('turn.submit attachment admit and materialize', () => {
     });
     expect(await h.conversationStore.listTurns(h.sessionId)).toHaveLength(0);
     expect(h.adapter.sentInputs).toEqual([]);
+    expect(list).not.toHaveBeenCalled();
   });
 
   it('materializes a declared image to the adapter without putting bytes on the echo or prompt row', async () => {
@@ -294,14 +297,15 @@ describe('turn.submit attachment admit and materialize', () => {
 });
 
 describe('legacy agent.input inline images', () => {
+  const image = {
+    type: 'image' as const,
+    data: PNG_1X1.toString('base64'),
+    mimeType: 'image/png',
+    name: 'shot.png',
+  };
+
   it('stores the image as a ref on the durable row while the adapter and echo keep it inline', async () => {
     const h = await started();
-    const image = {
-      type: 'image' as const,
-      data: PNG_1X1.toString('base64'),
-      mimeType: 'image/png',
-      name: 'shot.png',
-    };
     await h.inject({
       kind: 'agent.input',
       clientReqId: 'legacy',
@@ -376,4 +380,69 @@ describe('legacy agent.input inline images', () => {
     if (page?.kind !== 'attachment.read.result') throw new Error('no attachment.read.result');
     expect(page.data).toBe(image.data);
   });
+
+  it('refuses an image whose bytes are not the declared type before any echo or row', async () => {
+    const h = await started();
+    await h.inject({
+      kind: 'agent.input',
+      clientReqId: 'lie',
+      sessionId: h.sessionId,
+      input: {
+        type: 'prompt',
+        content: [
+          {
+            type: 'image',
+            mimeType: 'image/png',
+            data: Buffer.from([0xff, 0xd8, 0xff, 0xe0]).toString('base64'),
+          },
+        ],
+      },
+    });
+    expect(failure(h.sent, 'lie')).toMatchObject({
+      code: 'invalid_request',
+      message: 'File contents are not image/png',
+    });
+    expect(await h.conversationStore.listTurns(h.sessionId)).toHaveLength(0);
+    expect(h.adapter.sentInputs).toEqual([]);
+    expect(h.sent.some((p) => p.kind === 'agent.event' && p.event.type === 'user-message')).toBe(
+      false,
+    );
+  });
+
+  it('fails typed when the store cannot take the bytes and leaves the session usable', async () => {
+    const h = await started();
+    const blobsDir = join(h.stateDir, 'blobs');
+    await mkdir(blobsDir, { recursive: true });
+    await chmod(blobsDir, 0o500);
+    try {
+      await h.inject({
+        kind: 'agent.input',
+        clientReqId: 'ro',
+        sessionId: h.sessionId,
+        input: { type: 'prompt', content: [{ type: 'text', text: 'look' }, image] },
+      });
+      await vi.waitFor(() => {
+        expect(failure(h.sent, 'ro')).toMatchObject({
+          code: 'operation_failed',
+          message: 'Failed to store a prompt attachment',
+        });
+      });
+    } finally {
+      await chmod(blobsDir, 0o700);
+    }
+    expect(await h.conversationStore.listTurns(h.sessionId)).toHaveLength(0);
+    expect(h.adapter.sentInputs).toEqual([]);
+
+    await h.inject({
+      kind: 'agent.input',
+      clientReqId: 'after',
+      sessionId: h.sessionId,
+      input: { type: 'prompt', content: [{ type: 'text', text: 'still here' }] },
+    });
+    await vi.waitFor(() => {
+      expect(h.sent).toContainEqual(
+        expect.objectContaining({ kind: 'request.succeeded', replyTo: 'after' }),
+      );
+    });
+  });
 });

packages/host/engine/src/attachment/ingest.ts

@@ -1,10 +1,16 @@
 import { Buffer } from 'node:buffer';
 import { createHash, randomUUID } from 'node:crypto';
 import type { AttachmentId, ContentBlock, PromptBlock } from '@linkcode/schema';
-import { AttachmentIdSchema, blobIdFromSha256, MAX_ATTACHMENT_NAME_LENGTH } from '@linkcode/schema';
+import {
+  AttachmentIdSchema,
+  blobIdFromSha256,
+  declaredMimeTypeMatches,
+  MAX_ATTACHMENT_NAME_LENGTH,
+} from '@linkcode/schema';
 import { Effect } from 'effect';
+import { nullthrow } from 'foxts/guard';
 import { noop } from 'foxts/noop';
-import { OperationError } from '../failure';
+import { OperationError, RequestError } from '../failure';
 import type { AttachmentStore } from './attachment-store';
 import type { BlobStore } from './blob-store';
 import type { AttachmentIoMutex } from './io-mutex';
@@ -57,15 +63,33 @@ export class AttachmentIngest {
 
   /** Durable blocks for legacy prompt content: inline images are stored and referenced, so the
    * row keeps them after the live echo is gone. Other binary blocks were refused at admit. */
-  promptBlocks(content: readonly ContentBlock[]): Effect.Effect<PromptBlock[], OperationError> {
+  promptBlocks(
+    content: readonly ContentBlock[],
+  ): Effect.Effect<PromptBlock[], OperationError | RequestError> {
+    const images = new Map<number, Buffer>();
+    for (let i = 0, len = content.length; i < len; i++) {
+      const block = content[i];
+      if (block.type !== 'image') continue;
+      const bytes = Buffer.from(block.data, 'base64');
+      // Every writer into the store sniffs: a mislabeled record is trusted on every later reference.
+      if (!declaredMimeTypeMatches(block.mimeType, bytes.subarray(0, 16))) {
+        return Effect.fail(
+          new RequestError({
+            code: 'invalid_request',
+            message: `File contents are not ${block.mimeType}`,
+          }),
+        );
+      }
+      images.set(i, bytes);
+    }
     return Effect.tryPromise({
       try: () =>
         Promise.all(
-          content.map(async (block): Promise<PromptBlock | undefined> => {
+          content.map(async (block, index): Promise<PromptBlock | undefined> => {
             if (block.type === 'text') return { type: 'text', text: block.text };
             if (block.type !== 'image') return;
             // The legacy block's name is unbounded; the record's is not.
-            const attachmentId = await this.store(Buffer.from(block.data, 'base64'), {
+            const attachmentId = await this.store(nullthrow(images.get(index)), {
               kind: 'image',
               name: (block.name || 'image').slice(0, MAX_ATTACHMENT_NAME_LENGTH),
               mimeType: block.mimeType,

packages/host/engine/src/session/lifecycle-service.ts

@@ -748,16 +748,22 @@ export class SessionLifecycleService {
     const ids = uniqueAttachmentIds(occurrences);
     if (ids.length === 0) return Effect.void;
     const capability = effectiveAttachmentCapability(kind);
-    // Bound the ref count before the store load: `admitPromptAttachments` charges per occurrence,
-    // and an unbounded id list would otherwise reach SQLite as one oversized `IN (...)`.
-    if (capability !== undefined) {
-      const maxCount =
-        (capability.kinds.image?.maxCount ?? 0) + (capability.kinds.file?.maxCount ?? 0);
-      if (occurrences.length > maxCount) {
-        return Effect.fail(
-          new RequestError({ code: 'limit_exceeded', message: 'Too many attachments' }),
-        );
-      }
+    // Refuse before the store load: the same answers `admitPromptAttachments` gives, without an
+    // unbounded id list reaching SQLite as one oversized `IN (...)`.
+    if (capability === undefined) {
+      return Effect.fail(
+        new RequestError({
+          code: 'unsupported_attachment',
+          message: 'Prompt attachments are not supported by this harness',
+        }),
+      );
+    }
+    const maxCount =
+      (capability.kinds.image?.maxCount ?? 0) + (capability.kinds.file?.maxCount ?? 0);
+    if (occurrences.length > maxCount) {
+      return Effect.fail(
+        new RequestError({ code: 'limit_exceeded', message: 'Too many attachments' }),
+      );
     }
     return Effect.tryPromise({
       try: () => this.attachments.listAttachments(ids),

packages/presentation/i18n/src/locales/en.ts

@@ -370,6 +370,7 @@ export const en = {
       attachmentsTotalTooLarge: 'Attachments exceed the 12MB total limit',
       attachmentLimit: 'You can attach at most {count} images',
       attachmentUnsupportedType: 'Only JPEG / PNG / GIF / WEBP images are supported',
+      attachmentContentMismatch: 'File contents are not {type}',
       attachmentUnsupportedAgent: "This agent doesn't support image attachments yet",
       attachmentReadFailed: 'Failed to read the file',
       approvalTitle: 'How should {agent} actions be approved?',

packages/presentation/i18n/src/locales/zh-cn.ts

@@ -360,6 +360,7 @@ export const zhCN = {
       attachmentsTotalTooLarge: '附件总大小超过 12MB 上限',
       attachmentLimit: '最多添加 {count} 个图片附件',
       attachmentUnsupportedType: '仅支持 JPEG / PNG / GIF / WEBP 图片',
+      attachmentContentMismatch: '文件内容与 {type} 不符',
       attachmentUnsupportedAgent: '当前 agent 暂不支持图片附件',
       attachmentReadFailed: '读取文件失败',
       approvalTitle: '如何审批 {agent} 的操作？',