Merge remote-tracking branch 'origin/master' into fix/preset-host-plane-task-registry

packages/bundle/base/cordis.patch.yml

@@ -107,6 +107,12 @@
       config:
         root: !!js dshHomePath('sessions')
 
+    # Durable image bytes live outside the append-only session log. Messages
+    # keep content-addressed references that this shared backend resolves for
+    # provider requests and authorized history reads.
+    - id: attachment-local
+      name: '@deepseek-ai/dsh-attachment-local'
+
     # Raw configs can supply a process-local path or disable this shared session
     # capability. The neutral default is process-local and opens only when used.
     - id: session-query-sqlite

packages/bundle/base/package.json

@@ -39,6 +39,7 @@
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-agent-default-model": "workspace:^",
     "@deepseek-ai/dsh-agent-loop": "workspace:^",
+    "@deepseek-ai/dsh-attachment-local": "workspace:^",
     "@deepseek-ai/dsh-bash-env": "workspace:^",
     "@deepseek-ai/dsh-bash-sandbox": "workspace:^",
     "@deepseek-ai/dsh-command-compact": "workspace:^",

packages/bundle/web-app/cordis.patch.yml

@@ -4,7 +4,7 @@
 #
 # A patch replaces the targeted row's whole `config`, so each row below
 # restates every key it owns. The `dsh web` launcher alias turns --host/--port/
-# --dev/--workspace-root/--trusted-host into further patches over these rows
+# --dev/--trusted-host into further patches over these rows
 # (`--dev` inserts the dsh-client-hmr row).
 
 # ── surface-specific values the base deliberately omits ─────────────────────