fix: harden Web image admission

packages/client/ui-conversation/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: 74137edccc3ca68c40afd545350ce3811d6ae2e2
-README.zh.md: c974640ba08451d0a666061c6ec46ca88d66a85e
+README.md: ad64511120e3d4308ab03bb45de21b7d577b4335
+README.zh.md: 69926a282dea3f13564fe97e75d0c7c937b86335

packages/client/ui-conversation/README.md

@@ -22,9 +22,9 @@ Per-session UI state for selection and the active view lives in the declared cha
 
 The composer bar declares session-scoped single seats for `'conversation.input.plan'` (right of the local access-mode control) and `'conversation.input.model'` (immediately before the pending indicator and send/stop button), plus list slots for overlay, dock, left, and right input extensions. Feature packages own each control and its state; ui-conversation supplies placement, the `locked` owner prop, and the standard slot shares. While the `plan` projection's effective target is plan mode, InputBar swaps its textarea placeholder to the plan-task wording, localized through the `command.hint` locale namespace this package registers and shared verbatim with the claimed `/plan` command hint (a host-folded value read through the standard-kit `useProjection`; owner-supplied placeholders win). A pending composer takeover remains mounted when another conversation view is active so the blocked agent can still receive its answer; without a pending interaction, the active-session composer belongs to Chat. The resident no-session shell uses `DisabledInputBar` and therefore dispatches no session-scoped control seats.
 
-Image drafts keep only ordered runtime ids in that store. `ConversationService` owns the corresponding browser `File` and object URLs, applies the latest host capability and upload-limit snapshot before allocation, and releases draft URLs on removal or send plus historical URLs when their rendered session unmounts. Paste and drop share the same validation path; mixed clipboard text remains native textarea input.
+Image drafts keep only ordered `DraftAttachmentId` values in that store. `ConversationService` owns the corresponding browser `File` and object URLs, rejects unsupported declared image media types before allocating previews, and releases draft URLs on removal or send plus historical URLs when their rendered session unmounts. A historical read that completes after its rendered session or the service is disposed rejects before allocating an object URL. Paste and drop share the same validation path; mixed clipboard text remains native textarea input.
 
-`src/client/` is organized for the future package split: `contract/` is the sole inter-domain shared face (`slots.ts` slot declarations + composed slot props including the tool-row contract, `views.ts` shared primitives, `tool-call-model.ts`); the `skeleton/`, `chat/`, and `toolviews/` (sample registrants) domain directories import contract files and never each other; `apply.ts` is the only assembly point allowed to import all three domains. The `/client` export surface is the contract only — `apply`/`inject`, the two service classes, and the `contract/` type families; implementation components (skeleton, chat rows) and the store factory stay internal and reach the page exclusively through apply's slot registrations (tests take them via the `./src/*` subpath).
+`src/client/` is organized for the future package split: `contract/` is the sole inter-domain shared face (`slots.ts` slot declarations + composed slot props including the tool-row contract, `views.ts` shared primitives, `tool-call-model.ts`); the `skeleton/`, `chat/`, and `toolviews/` (sample registrants) domain directories import contract files and never each other; `apply.ts` is the only assembly point allowed to import all three domains. The `/client` export surface is limited to `apply`/`inject` and contract types; concrete services, implementation components (skeleton, chat rows), and the store factory stay internal. Same-package tests import those internals through `./src/*`.
 
 ## Model Experience
 

packages/client/ui-conversation/README.zh.md

@@ -22,9 +22,9 @@ todo 两个面就是在该形状上的两个注册项，都是普通注册方插
 
 输入栏为 `'conversation.input.plan'`（位于本地 access 模式控件右侧）和 `'conversation.input.model'`（渲染在 pending 指示器与发送／停止按钮之前）声明会话作用域的单实例 seat，并为 overlay、dock、left 和 right 输入扩展声明列表 slot。各功能包拥有相应控件及其状态；ui-conversation 提供放置位置、`locked` owner prop 和标准 slot share。当 `plan` 投影的有效目标为 plan mode 时，InputBar 将文本框 placeholder 切换为 plan 任务措辞，经本包注册的 `command.hint` locale 命名空间本地化，并与已认领 `/plan` 命令的提示逐字共用同一份文案（经标准套件 `useProjection` 读取的 host 折叠值；owner 提供的 placeholder 优先）。另一个会话视图活跃时，待处理的 composer 接管仍保持挂载，使被阻塞的 agent（智能体）仍能收到回答；没有待处理交互时，活跃会话的 composer 归 Chat 所有。常驻无会话壳使用 `DisabledInputBar`，因此不会分发任何会话作用域的控件 seat。
 
-图片草稿在该 store 中只保留有序的运行时 id。`ConversationService` 持有对应的浏览器 `File` 和对象 URL，在分配前应用最新的宿主能力与上传限制快照，并在图片移除或发送时释放草稿 URL，在所渲染的会话卸载时释放历史 URL。粘贴与拖放共用同一校验路径；混合剪贴板文本仍由 textarea 原生输入。
+图片草稿在该 store 中只保留有序的 `DraftAttachmentId` 值。`ConversationService` 持有对应的浏览器 `File` 和对象 URL，会在分配预览前拒绝声明媒体类型不受支持的图片，并在图片移除或发送时释放草稿 URL，在所渲染的会话卸载时释放历史 URL。一项历史读取如果在其所渲染的会话卸载或该服务释放后才完成，会在分配对象 URL 前被拒绝。粘贴与拖放共用同一校验路径；混合剪贴板文本仍由 textarea 原生输入。
 
-`src/client/` 按未来的包拆分组织：`contract/` 是唯一的跨领域共享表层（`slots.ts` slot 声明 + 组合后的 slot props，包括工具行契约、`views.ts` 共享原语、`tool-call-model.ts`）；`skeleton/`、`chat/` 和 `toolviews/`（示例注册方）领域目录只导入 contract 文件，彼此绝不导入；`apply.ts` 是唯一允许导入全部三个领域的组装点。`/client` 导出表层只包含契约：`apply`／`inject`、两个服务类和 `contract/` 类型家族；实现组件（骨架、聊天行）与 store factory 保持内部状态，只能通过 apply 的 slot 注册到达页面（测试通过 `./src/*` 子路径获取它们）。
+`src/client/` 按未来的包拆分组织：`contract/` 是唯一的跨领域共享表层（`slots.ts` slot 声明 + 组合后的 slot props，包括工具行契约、`views.ts` 共享原语、`tool-call-model.ts`）；`skeleton/`、`chat/` 和 `toolviews/`（示例注册方）领域目录只导入 contract 文件，彼此绝不导入；`apply.ts` 是唯一允许导入全部三个领域的组装点。`/client` 导出表层仅限 `apply`／`inject` 与契约类型；具体服务、实现组件（骨架、聊天行）和 store factory 均保持内部状态。同包测试通过 `./src/*` 导入这些内部实现。
 
 ## 模型体验
 

packages/client/ui-conversation/package.json

@@ -40,6 +40,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/dsh-attachment": "^0.0.1",
+    "@deepseek-ai/dsh-brand": "^0.0.1",
     "@deepseek-ai/dsh-client-locale": "^0.0.1",
     "@deepseek-ai/dsh-client-runtime": "^0.0.1",
     "@deepseek-ai/dsh-client-ui-primitives": "^0.0.1",
@@ -51,6 +52,7 @@
   },
   "devDependencies": {
     "@deepseek-ai/dsh-attachment": "workspace:^",
+    "@deepseek-ai/dsh-brand": "workspace:^",
     "@deepseek-ai/dsh-client-locale": "workspace:^",
     "@deepseek-ai/dsh-client-runtime": "workspace:^",
     "@deepseek-ai/dsh-goal": "workspace:^",

packages/client/ui-conversation/src/client/contract/slots.ts

@@ -6,14 +6,14 @@ import type {
 } from '@deepseek-ai/dsh-client-ui-slots'
 import type { CommandNode, ConversationSnapshot, ObservableSnapshot, PendingInteraction, PendingWait, SessionId, ToolCallBlock, WorkspaceId } from '@deepseek-ai/dsh-client-runtime/client'
 import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
-import type { ComposerKeyboard, InputActions, InputNotice, InputState } from '../input/contract.ts'
+import type { ComposerKeyboard, DraftAttachmentId, InputActions, InputNotice, InputState } from '../input/contract.ts'
 import type { createChatStore } from '../stores.ts'
 import type { CallId, SelectionTarget, ViewTab } from './views.ts'
 
 /** Browser-owned image that has not crossed the durable host boundary. */
 export interface ComposerAttachment {
   kind: 'image'
-  id: string
+  id: DraftAttachmentId
   file: File
   previewUrl: string
 }
@@ -275,9 +275,9 @@ export interface ComposerBarInjected {
   /** Create browser previews and append their ids to the session input state. */
   addImages: (files: readonly File[]) => string | null
   /** Release one browser preview and remove its id from the session input state. */
-  removeImage: (id: string) => void
+  removeImage: (id: DraftAttachmentId) => void
   /** Resolve ordered input-state ids to browser-owned draft attachments. */
-  draftImages: (ids: readonly string[]) => readonly ComposerAttachment[]
+  draftImages: (ids: readonly DraftAttachmentId[]) => readonly ComposerAttachment[]
   /** Cancel the in-flight turn. */
   stop: () => void
   /**

packages/client/ui-conversation/src/client/index.ts

@@ -4,8 +4,8 @@
  * owns their slot assembly.
  */
 export { apply, inject } from './apply.ts'
-export { ConversationService } from './service.ts'
 export type { IConversation } from './service.ts'
+export type { DraftAttachmentId } from './input/contract.ts'
 
 export type {
   CallId, ChatStoreState, SelectionTarget, ViewTab,

packages/client/ui-conversation/src/client/input/contract.ts

@@ -6,11 +6,15 @@
  * (machine.ts) is package-private and never exported.
  */
 import type { ClientContext, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import type { Branded } from '@deepseek-ai/dsh-brand'
 import type {
   ArbitrateKey, ArbitrateOutcome, CommandClaim, ConsumeTokenRequest, PickOutcome,
   ReferenceInsert, SubmitOutcome, TokenSpan,
 } from '@deepseek-ai/dsh-client-ui-slash/client'
 
+/** Browser-runtime identity of one unsent image draft. */
+export type DraftAttachmentId = Branded<'DraftAttachmentId'>
+
 /**
  * The scoped-event application verbs: the hub's bail listeners call these,
  * and the boolean answer IS the event's bail value (true ⟺ the machine
@@ -28,11 +32,11 @@ export interface SessionInput extends InputTarget {
   /** Single write path for draft text (all mutation rides machine events). */
   setDraft(text: string): void
   /** Append ordered browser-owned draft attachment ids. */
-  addImages(ids: readonly string[]): void
+  addImages(ids: readonly DraftAttachmentId[]): void
   /** Remove one browser-owned draft attachment id. */
-  removeImage(id: string): void
+  removeImage(id: DraftAttachmentId): void
   /** Drop ids whose browser objects no longer exist. */
-  pruneImages(ids: readonly string[]): void
+  pruneImages(ids: readonly DraftAttachmentId[]): void
   /** THE complexity sink: enter adjudication, submit transaction, and the default sink live inside. */
   submit(mode?: 'queue' | 'steer'): void
   /**
@@ -65,11 +69,11 @@ export interface InputActions {
   /** Single public draft write path (full next draft; occurrence math via diff scan). */
   setDraft(text: string): void
   /** Append ordered browser-owned draft attachment ids. */
-  addImages(ids: readonly string[]): void
+  addImages(ids: readonly DraftAttachmentId[]): void
   /** Remove one browser-owned draft attachment id. */
-  removeImage(id: string): void
+  removeImage(id: DraftAttachmentId): void
   /** Drop ids whose browser objects no longer exist. */
-  pruneImages(ids: readonly string[]): void
+  pruneImages(ids: readonly DraftAttachmentId[]): void
   /** Enter submission (adjudication / claim transaction / default sink inside). */
   submit(mode?: 'queue' | 'steer'): void
 }
@@ -198,7 +202,7 @@ export interface InputMachineOptions {
 export interface InputState {
   readonly draft: string
   /** Ordered runtime-only image ids; bytes and object URLs stay in ConversationService. */
-  readonly imageIds: readonly string[]
+  readonly imageIds: readonly DraftAttachmentId[]
   /** Monotonic draft revision (span CAS compares against this). */
   readonly draftRev: number
   readonly phase: 'plain' | 'adjudicating' | 'claimed' | 'submitting'

packages/client/ui-conversation/src/client/input/facade.ts

@@ -13,7 +13,7 @@ import type {
   ReferenceInsert, SlashController, TokenSpan,
 } from '@deepseek-ai/dsh-client-ui-slash/client'
 import type {
-  EditRange, EditSelection, InputActions, InputEffect, InputNotice, InputState,
+  DraftAttachmentId, EditRange, EditSelection, InputActions, InputEffect, InputNotice, InputState,
   PasteComponent, QueuedMessage, SessionInput, SubmitAttempt,
 } from './contract.ts'
 import { InputMachine } from './machine.ts'
@@ -39,7 +39,7 @@ export interface SessionInputDeps {
   /** Queue read face; overlaid onto InputState.queue (absent = empty). */
   queue?: ObservableSnapshot<readonly QueuedMessage[]> | undefined
   /** The plain-message sink (send choreography / materialize fork — the hub owns it). */
-  defaultSink(text: string, mode: 'queue' | 'steer', imageIds: readonly string[]): void
+  defaultSink(text: string, mode: 'queue' | 'steer', imageIds: readonly DraftAttachmentId[]): void
 }
 
 /** Guard tier from the machine phase. */
@@ -79,7 +79,7 @@ export class SessionInputShell implements SessionInput {
   private readonly core = new InputMachine({ now: () => Date.now() })
   private noticeSeq = 0
   private lastDraft = ''
-  private imageIds: readonly string[] = []
+  private imageIds: readonly DraftAttachmentId[] = []
   private disposed = false
   /** Draft persistence mirror (chat store write; receives the clipboard projection, never raw placeholders). */
   private mirrorFn: ((text: string) => void) | undefined
@@ -102,14 +102,14 @@ export class SessionInputShell implements SessionInput {
   }
 
   /** Append ordered browser-owned draft attachment ids. */
-  addImages(ids: readonly string[]): void {
+  addImages(ids: readonly DraftAttachmentId[]): void {
     if (ids.length === 0 || this.snapshot.phase === 'adjudicating' || this.snapshot.phase === 'submitting') return
     this.imageIds = [...this.imageIds, ...ids]
     this.publish()
   }
 
   /** Remove one browser-owned draft attachment id. */
-  removeImage(id: string): void {
+  removeImage(id: DraftAttachmentId): void {
     const next = this.imageIds.filter(candidate => candidate !== id)
     if (next.length === this.imageIds.length) return
     this.imageIds = next
@@ -120,7 +120,7 @@ export class SessionInputShell implements SessionInput {
    * Drop ids whose browser objects no longer exist.
    * @param available - ids that still resolve through the browser attachment registry.
    */
-  pruneImages(available: readonly string[]): void {
+  pruneImages(available: readonly DraftAttachmentId[]): void {
     const keep = new Set(available)
     const next = this.imageIds.filter(id => keep.has(id))
     if (next.length === this.imageIds.length) return
@@ -132,7 +132,7 @@ export class SessionInputShell implements SessionInput {
    * Restore a failed attempt's ids before any images added after submission.
    * @param ids - ordered identifiers captured by the failed attempt.
    */
-  restoreImages(ids: readonly string[]): void {
+  restoreImages(ids: readonly DraftAttachmentId[]): void {
     const current = new Set(this.imageIds)
     this.imageIds = [...ids.filter(id => !current.has(id)), ...this.imageIds]
     this.publish()
@@ -144,7 +144,7 @@ export class SessionInputShell implements SessionInput {
    * (the command path gets the same discipline from submit-settled success).
    * @param imageIds - identifiers included in the committed attempt.
    */
-  commitSend(imageIds: readonly string[]): void {
+  commitSend(imageIds: readonly DraftAttachmentId[]): void {
     const submitted = new Set(imageIds)
     this.imageIds = this.imageIds.filter(id => !submitted.has(id))
     this.run(this.core.dispatch({ type: 'send-committed' }))

packages/client/ui-conversation/src/client/input/hub.ts

@@ -11,7 +11,7 @@
 import type { ClientContext, ISessions, SessionBinding, SessionFace, SessionId } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SlashController } from '@deepseek-ai/dsh-client-ui-slash/client'
 import { queueReadFaceOf } from '../queue/store.ts'
-import type { ComposerKeyboard, InputService, SessionInput } from './contract.ts'
+import type { ComposerKeyboard, DraftAttachmentId, InputService, SessionInput } from './contract.ts'
 import type { PopupDismissFace } from './facade.ts'
 import { SessionInputShell } from './facade.ts'
 
@@ -26,9 +26,9 @@ interface ConversationAttachmentFace {
     session: SessionFace,
     text: string,
     mode: 'queue' | 'steer',
-    imageIds: readonly string[],
+    imageIds: readonly DraftAttachmentId[],
   ): Promise<void>
-  releaseDraftImage(id: string): void
+  releaseDraftImage(id: DraftAttachmentId): void
 }
 
 /** Session-addressed input facade registry (InputService face + composer-layer extras). */
@@ -138,7 +138,7 @@ export class InputHub implements InputService {
     session: SessionFace,
     text: string,
     mode: 'queue' | 'steer',
-    imageIds: readonly string[],
+    imageIds: readonly DraftAttachmentId[],
   ): void {
     if (text === '' && imageIds.length === 0) return
     const shell = this.shells.get(session.sessionId)

packages/client/ui-conversation/src/client/service.ts

@@ -15,7 +15,7 @@ import type { Context } from 'cordis'
 import type { ISessions, SessionFace, SessionId } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ImageAttachmentRef, ImageMediaType } from '@deepseek-ai/dsh-attachment'
 import type { ComposerAttachment } from './contract/slots.ts'
-import type { InputService } from './input/contract.ts'
+import type { DraftAttachmentId, InputService } from './input/contract.ts'
 
 /**
  * The outward conversation face (`ctx.conversation`): the scope-addressed
@@ -46,7 +46,7 @@ export interface IConversation {
 
 /** Create one browser-only draft descriptor; only its id enters input state. */
 function browserDraftAttachment(file: File): ComposerAttachment {
-  return { kind: 'image', id: crypto.randomUUID(), previewUrl: URL.createObjectURL(file), file }
+  return { kind: 'image', id: crypto.randomUUID() as DraftAttachmentId, previewUrl: URL.createObjectURL(file), file }
 }
 
 interface ImageUrlEntry {
@@ -59,10 +59,11 @@ interface ImageUrlEntry {
 export class ConversationService extends Service implements IConversation {
   /** The per-session input machine registry (InputService face, design §5.2). */
   readonly input: InputService
-  private readonly draftAttachments = new Map<string, ComposerAttachment>()
+  private readonly draftAttachments = new Map<DraftAttachmentId, ComposerAttachment>()
   private readonly imageUrls = new Map<string, ImageUrlEntry>()
   private readonly imageGenerations = new Map<SessionId, number>()
   private readonly createdImageUrls = new Set<string>()
+  private disposed = false
 
   /**
    * @param ctx - owning root context (the plugin apply context; the service
@@ -74,6 +75,7 @@ export class ConversationService extends Service implements IConversation {
     super(ctx, 'conversation')
     this.input = config.input
     ctx.effect(() => () => {
+      this.disposed = true
       for (const url of this.createdImageUrls) URL.revokeObjectURL(url)
       this.createdImageUrls.clear()
       this.draftAttachments.clear()
@@ -107,7 +109,7 @@ export class ConversationService extends Service implements IConversation {
     session: SessionFace,
     text: string,
     mode: 'queue' | 'steer',
-    imageIds: readonly string[],
+    imageIds: readonly DraftAttachmentId[],
   ): Promise<void> {
     const attachments = this.draftImages(imageIds)
     if (attachments.length !== imageIds.length) {
@@ -149,7 +151,7 @@ export class ConversationService extends Service implements IConversation {
    * @param ids - ordered ids from the per-session input state.
    * @returns attachments still available in this browser runtime.
    */
-  draftImages(ids: readonly string[]): readonly ComposerAttachment[] {
+  draftImages(ids: readonly DraftAttachmentId[]): readonly ComposerAttachment[] {
     const attachments: ComposerAttachment[] = []
     for (const id of ids) {
       const attachment = this.draftAttachments.get(id)
@@ -162,7 +164,7 @@ export class ConversationService extends Service implements IConversation {
    * Release one draft attachment preview.
    * @param id - draft-local attachment id.
    */
-  releaseDraftImage(id: string): void {
+  releaseDraftImage(id: DraftAttachmentId): void {
     const attachment = this.draftAttachments.get(id)
     if (attachment === undefined) return
     this.draftAttachments.delete(id)
@@ -185,6 +187,7 @@ export class ConversationService extends Service implements IConversation {
    * @returns a browser URL for inline and original-size display.
    */
   resolveImage(sessionId: SessionId, attachment: ImageAttachmentRef): Promise<string> {
+    if (this.disposed) return Promise.reject(new Error('conversation.resolveImage: service is disposed'))
     const key = `${sessionId}:${attachment.attachmentId}`
     const cached = this.imageUrls.get(key)
     if (cached !== undefined) return cached.pending
@@ -194,6 +197,10 @@ export class ConversationService extends Service implements IConversation {
     const pending = session.readAttachment(attachment.attachmentId)
       .then((result) => {
         if (!result.ok) throw new Error(`${result.error.code}: ${result.error.message}`)
+        if (this.disposed) throw new Error('conversation.resolveImage: service was disposed before loading completed')
+        if ((this.imageGenerations.get(sessionId) ?? 0) !== generation) {
+          throw new Error('historical image scope was released before loading completed')
+        }
         if (typeof URL.createObjectURL !== 'function') {
           return `data:${result.value.attachment.mediaType};base64,${bytesToBase64(result.value.data)}`
         }
@@ -201,10 +208,6 @@ export class ConversationService extends Service implements IConversation {
         const url = URL.createObjectURL(new Blob([bytes.buffer], {
           type: result.value.attachment.mediaType,
         }))
-        if ((this.imageGenerations.get(sessionId) ?? 0) !== generation) {
-          revokePreview(url)
-          throw new Error('historical image scope was released before loading completed')
-        }
         this.createdImageUrls.add(url)
         return url
       })

packages/client/ui-conversation/tests/input-bar.spec.tsx

@@ -13,6 +13,7 @@ import { SessionInputShell } from '../src/client/input/facade.ts'
 import { InputBar } from '../src/client/skeleton/InputBar.tsx'
 import type { InputBarProps } from '../src/client/skeleton/InputBar.tsx'
 import type { ComposerAttachment } from '../src/client/contract/slots.ts'
+import type { DraftAttachmentId } from '../src/client/input/contract.ts'
 
 afterEach(cleanup)
 
@@ -78,7 +79,7 @@ function bench(over?: BenchOptions) {
     promptError: over?.promptError ?? null,
   }))
   const stop = vi.fn()
-  const removeImage = vi.fn((id: string) => { shell.removeImage(id) })
+  const removeImage = vi.fn((id: DraftAttachmentId) => { shell.removeImage(id) })
   const slotCalls: { key: string; owner: unknown }[] = []
   const renderSlot = ((key: string, owner: object) => {
     slotCalls.push({ key, owner })
@@ -523,7 +524,7 @@ describe('image draft rail', () => {
 
   it('allows image-only send, removes a thumbnail, and opens original preview on double-click', () => {
     const file = new File([Uint8Array.of(1)], 'pixel.png', { type: 'image/png' })
-    const attachment = { kind: 'image' as const, id: 'draft-1', file, previewUrl: 'blob:draft-1' }
+    const attachment = { kind: 'image' as const, id: 'draft-1' as DraftAttachmentId, file, previewUrl: 'blob:draft-1' }
     const { view, textarea, sink, removeImage } = bench({ attachments: [attachment] })
     const send = view.getByRole('button', { name: 'Send message' }) as HTMLButtonElement
     expect(send.disabled).toBe(false)
@@ -536,7 +537,7 @@ describe('image draft rail', () => {
 
   it('opens the original preview on double-click and closes it with Escape', () => {
     const file = new File([Uint8Array.of(1)], 'pixel.png', { type: 'image/png' })
-    const attachment = { kind: 'image' as const, id: 'draft-1', file, previewUrl: 'blob:draft-1' }
+    const attachment = { kind: 'image' as const, id: 'draft-1' as DraftAttachmentId, file, previewUrl: 'blob:draft-1' }
     const { view } = bench({ attachments: [attachment] })
     fireEvent.doubleClick(view.getByTitle('双击查看原图'))
     expect(view.getByRole('dialog', { name: '原图预览' })).toBeTruthy()

packages/client/ui-conversation/tests/service-orchestration.spec.ts

@@ -6,17 +6,19 @@
 import { Context } from 'cordis'
 import { describe, expect, it, vi } from 'vitest'
 import { SlotTestRuntime } from '@deepseek-ai/dsh-client-test-runtime'
-import { ConversationService } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { AttachmentId } from '@deepseek-ai/dsh-attachment'
+import type { SessionFace } from '@deepseek-ai/dsh-client-runtime/client'
 import { InputHub } from '../src/client/input/hub.ts'
+import { ConversationService } from '../src/client/service.ts'
 
-async function bench() {
+async function bench(readAttachment?: SessionFace['readAttachment']) {
   const runtime = await SlotTestRuntime.create()
   const prompt = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
   const cancel = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
   const loadOlder = vi.fn(() => Promise.resolve())
   await runtime.sessions.add({
     id: 's1',
-    session: { prompt, cancel, loadOlder },
+    session: { prompt, cancel, loadOlder, ...(readAttachment === undefined ? {} : { readAttachment }) },
   })
   // config.input is required (the apply shares its hub with the inject
   // factories); the bench passes its own instance explicitly.
@@ -25,7 +27,7 @@ async function bench() {
   await fiber.await()
   const root = runtime.ctx.get('conversation') as ConversationService
   const scoped = runtime.sessions.scope('s1')!.get('conversation') as ConversationService
-  return { runtime, hub, root, scoped, prompt, cancel, loadOlder }
+  return { runtime, fiber, hub, root, scoped, prompt, cancel, loadOlder }
 }
 
 describe('ConversationService', () => {
@@ -122,6 +124,37 @@ describe('ConversationService', () => {
     await b.runtime.dispose()
   })
 
+  it('does not publish a historical image URL after disposal', async () => {
+    let resolveRead!: (result: Awaited<ReturnType<SessionFace['readAttachment']>>) => void
+    const readAttachment: SessionFace['readAttachment'] = vi.fn(() => new Promise<Awaited<ReturnType<SessionFace['readAttachment']>>>(
+      (resolve) => { resolveRead = resolve },
+    ))
+    const b = await bench(readAttachment)
+    const created = vi.spyOn(URL, 'createObjectURL')
+    const sessionId = b.runtime.sessions.behavior('s1').sessionId
+    const attachment = {
+      attachmentId: AttachmentId('image-1'),
+      mediaType: 'image/png',
+      bytes: 1,
+      width: 1,
+      height: 1,
+    } as const
+    const pending = b.root.resolveImage(sessionId, attachment)
+    await b.fiber.dispose()
+    await expect(b.root.resolveImage(sessionId, attachment)).rejects.toThrow('service is disposed')
+    resolveRead({
+      ok: true,
+      value: {
+        attachment,
+        data: Uint8Array.of(1),
+      },
+    })
+    await expect(pending).rejects.toThrow('service was disposed before loading completed')
+    expect(created).not.toHaveBeenCalled()
+    created.mockRestore()
+    await b.runtime.dispose()
+  })
+
   it('fails loudly from the root scope, on an unbound session, or without SessionsService', async () => {
     const b = await bench()
     await expect(b.root.send('x', 'queue')).rejects.toThrow(/requires a session scope/)

packages/client/ui-conversation/tsconfig.json

@@ -11,6 +11,9 @@
     {
       "path": "../../attachment/attachment"
     },
+    {
+      "path": "../../util/brand"
+    },
     {
       "path": "../../../vendor/cordis"
     },