[touch2be]

Builds on #173. It includes that commit (ebdde51) for the Desktop sidecar attachmentBaseUrl. Please merge #173 first; this diff then shrinks to the second commit.

Problem

When the agent creates an image and replies with ![Maus auf dem Mars](maus-auf-dem-mars.png), the transcript shows only the alt text. MarkdownRenderer blocks every markdown image so that tracking pixels can't load. A file on the Host is not a third-party origin, so it doesn't need that block.

Change

Markdown images in assistant replies

• Project-relative paths, absolute paths, file: URLs, and inline raster data:image/* render as a preview. Clicking a preview opens the existing lightbox.
• http(s), javascript:, SVG data URLs, and files without an image extension still render as alt text.
• They load through the existing /api/fs/file route, so path grants, OPENGUI_ALLOWED_ROOTS, and realpath checks apply unchanged.
• Without a MarkdownImageContext (any other MarkdownRenderer use), behaviour is unchanged.

Paths and permissions across Shells and Hosts

Setup	Handling
Windows	/api/fs/file uses the platform's isAbsolute, so C:\… and \\server\share are no longer joined onto the Project directory. The Frontend also treats UNC paths as absolute. A custom urlTransform keeps C:\… and file: image sources, which react-markdown's default would drop as unknown protocols. Percent-encoding (spaces, umlauts, %5C) is decoded before the path is resolved.
macOS	realpath (/var → /private/var) is already enforced by the Host. Nothing new needed.
Desktop Local	Previews use the sidecar URL (attachmentBaseUrl). ToolCallPartView and FilePartView still used the stored workspace URL and requested the wrong port.
Desktop → Remote Host (token)	<img> can't send Authorization. The new HostImage component fetches with the bearer token and shows a blob URL. The Desktop Local credential is never sent to another Host. This also fixes uploaded-image thumbnails on token-authenticated Remote Hosts.
Hosted / Web (cookie session)	Plain <img> requests, as before.
Restricted Hosts / missing file	A path outside the grants returns 403 and shows an "Image unavailable" placeholder instead of a broken image.

Hardening /api/fs/file

• X-Content-Type-Options: nosniff.
• Content-Security-Policy: sandbox; default-src 'none'; …: SVG written by the agent can't run script on the Host origin when opened directly.
• Cache-Control: no-cache: images the agent overwrites in place refresh in the transcript.

Other

• System prompt: one line telling models to reference images as ![alt](path).
• Tool image attachments also accept gif and webp.
• i18n: attachments.openImage and attachments.imageUnavailable in en, de, and es.

Not in this PR (follow-up)

• Images from MCP tools and the read tool are stored under the Host data directory (tool-output/), and the tool-result projection doesn't carry them into state.attachments yet. Restricted Hosts don't grant that directory, so the follow-up needs a session-scoped route (/api/host/sessions/:id/tool-output/:file, checked via readSession) plus the projection fix.
• Showing image previews in collapsed tool groups, e.g. for write of *.png/*.svg.

Testing

• vp check: clean
• vp test: frontend 541, backend + harness 706, all passing
• pnpm run slop-check: ok
• New tests:
  • classifyMarkdownImageSource: POSIX, Windows, UNC, file:, percent-encoding, rejections
  • resolveAttachmentAuthToken
  • MarkdownRenderer: Host route URL, Windows path, remote still blocked, placeholder, no-context fallback
  • HostImage: direct load vs. bearer fetch vs. 403 placeholder
  • /api/fs/file: security headers and Project-relative path
• Not yet tested by hand in the running app (Desktop Local, Web, Windows/macOS builds).

🤖 Generated with Claude Code