[andrebrait]

Summary

Tool-result images (agent screenshots, read of an image file) were invisible after opening or reloading a session. Every history load uses ?deferMedia=1, which replaced each tool-result image with [1 tool result image omitted from initial history payload …, ~57 bytes], and nothing ever loaded the image back. The byte count was also wrong: it measured the blob:sha256: reference, not the image. The deferral came from 41d2f27.

Tool-result images now reach the browser as links, both in history and in live output:

• Each image becomes {type: "image", mimeType, url: "/api/media/<sha256>"}. The hash is omp's own blob address (sha256 of the bytes), so history entries map directly. Live images are hashed and copied to omp-web's data folder (media/) until omp writes its blob.
• GET /api/media/<sha256> serves the full image. ?thumb=1 serves a 480px WebP preview, generated once with sharp, EXIF-rotated, and cached on disk.
• An expanded tool row loads only the previews (1–7 KB each in the smoke test, against 30 KB to several MB for the originals). Clicking a preview opens the full image in the lightbox.
• No base64 for tool-result images reaches the browser any more, including live tool_execution_*, message_*, turn_end and agent_end frames and the reconnect snapshot. Many large screenshots therefore no longer fill browser memory or slow the chat down. User and custom-message images are unchanged.

Safety

• The route accepts only ^[a-f0-9]{64}$ hashes and serves only PNG, JPEG, GIF and WebP, detected by magic bytes (everything else gets 415, with nosniff). It sits behind the existing password guard.
• omp writes blobs in place, so the route serves omp-web's copy until omp's blob has the same size. A truncated image is never cached as immutable.
• A daily sweep, run on the next media write, deletes copies omp now holds and any file older than 30 days. Previews regenerate on demand.
• A missing blob shows the existing [image unavailable: blob … not found] text instead of a broken image.
• sharp is added as a direct dependency. It was already installed as Next's optional dependency, and Next keeps it external. If it fails to load, the route serves the full image instead of a preview.

Verification

• tsc --noEmit, lint (no new warnings), npm test: 1,223 pass / 0 fail. New and updated tests:
  • lib/media-route.test.mjs: full image and preview size, preview reuse, EXIF orientation, non-image 415, a real decoy image outside the store that stays unreachable, partial blob, sweep, and every rewritten event type.
  • lib/session-reader.test.mjs: deferred history returns URLs and keeps user images inline. A missing blob gives the placeholder text.
  • lib/rpc-manager.test.mjs: live frames and the reconnect snapshot carry the URL, and no base64 reaches a listener.
• Smoke test with a dev server and headless Chromium on an isolated agent dir: an expanded tool row showed five 480px previews, including a legacy inline image, and the lightbox opened the full 1024×640 image.
• Live run with real omp 18.6.2 and gemini-3.7-flash reading a WebP: the SSE stream carried /api/media/<hash> and no base64.
• One condensed adversarial review round, then Codex and CodeRabbit on the review companion ([companion] fix(chat): show tool-result images as cached previews andrebrait/ompweb#83). Every finding is fixed in follow-up commits, and Codex's last review of the final head found nothing. Fixes: incomplete-blob handling on the live path, a 404 retry after concurrent removal, a 16 MiB cap on the hash memo, no-cache when the full image stands in for a preview, rewriting subagent_event payloads, and unique temp names. CodeRabbit reviewed the first two commits; its follow-up review was rate-limited.

[kahme247]

Review — approve (SHIP, all three)

Verified by independent review with attack probes and joint-tree merges.

Tool-result images (#223). [hash] validated by ^[a-f0-9]{64}$ (traversal/uppercase/suffix all 404 by test); MIME from magic bytes only (SVG/HTML rejected); nosniff; 16MB memo cap + 30-day sweep. Only new dep is sharp, lock in sync. Non-blocking follow-ups noted: disk-quota cap, sharp as optionalDependency for exotic platforms.

Lightbox (#226). Zoom math sound (fit returns 1 on zero-size; steps clamp to [min(fit,10%), 800%]); native <dialog> focus handling; locales consistent; inline reset SVG replaced with lucide Maximize.

Markdown links (#224). href="" trap closed (rejected schemes arrive as undefined → <span>); anchors stay, externals get target=_blank rel=noopener noreferrer, unopenable locals become plain text; no server-side fetch of attacker URLs (no SSRF). Joint trees compose cleanly.