Merge remote-tracking branch 'origin/master' into worktree/web-theme-settings-integration-fde706

# Conflicts:
#	docs/module-graph.i18n.yaml
#	docs/module-graph.md
#	docs/module-graph.zh.md
#	packages/client/ui-conversation/package.json
#	pnpm-lock.yaml

apps/cli/composition.md

@@ -46,6 +46,8 @@ flowchart LR
   cfg --> plugin_dsh_base_llm_pi_ai
   plugin_dsh_base_session_persistence_jsonl["session-persistence-jsonl<br/>@deepseek-ai/dsh-session-persistence-jsonl"]
   cfg --> plugin_dsh_base_session_persistence_jsonl
+  plugin_dsh_base_attachment_local["attachment-local<br/>@deepseek-ai/dsh-attachment-local"]
+  cfg --> plugin_dsh_base_attachment_local
   plugin_dsh_base_session_query_sqlite["session-query-sqlite<br/>@deepseek-ai/dsh-session-query-sqlite"]
   cfg --> plugin_dsh_base_session_query_sqlite
   plugin_dsh_base_session_projection["session-projection<br/>@deepseek-ai/dsh-session-projection"]
@@ -183,6 +185,7 @@ flowchart LR
 | `credentials` | `@deepseek-ai/dsh-credentials-local` |
 | `llm-pi-ai` | `@deepseek-ai/dsh-llm-pi-ai` |
 | `session-persistence-jsonl` | `@deepseek-ai/dsh-session-persistence-jsonl` |
+| `attachment-local` | `@deepseek-ai/dsh-attachment-local` |
 | `session-query-sqlite` | `@deepseek-ai/dsh-session-query-sqlite` |
 | `session-projection` | `@deepseek-ai/dsh-session-projection` |
 | `telemetry-otel` | `@deepseek-ai/dsh-session-telemetry-otel` |

apps/web/tests/agent-preset-authoring.e2e.ts

@@ -44,9 +44,15 @@ describe('web e2e: agent-preset authoring is a host-side copy', () => {
     return page.getByRole('dialog', { name: '设置' })
   }
 
-  /** Tokenize the lane-owned preset root the way the scaffold tokenizes cwd. */
+  /** Tokenize the lane-owned preset root after general aria normalization. */
   function withPresetRoot(snapshot: string): string {
-    return snapshot.split(userRoot).join('{{presetRoot}}')
+    const rootSuffix = `/${userRoot.split('/').pop()!}`
+    return snapshot.split('\n').map((line) => {
+      const rootStart = line.indexOf(rootSuffix)
+      if (rootStart === -1) return line
+      const pathStart = line.lastIndexOf(' ', rootStart) + 1
+      return `${line.slice(0, pathStart)}{{presetRoot}}${line.slice(rootStart + rootSuffix.length)}`
+    }).join('\n')
   }
 
   beforeAll(async () => {

apps/web/tests/image-display.snapshot.ts

@@ -0,0 +1,138 @@
+// @vitest-environment jsdom
+// Multimodal image surfaces over the BUILT client graph (the code-mode-fixture
+// idiom: real bundles via AppWebEntry, keyless FixtureApiClient transport).
+// Opens the fixture history session whose turn 72 carries an image in BOTH a
+// user message and an assistant message, and pins the product surfaces: the
+// history ImageGallery loading real fixture bytes through the authorized
+// sessions.attachment route, the double-click ImageLightbox, and the composer
+// intake chain (paste → ordered thumbnail rail → image-only send enablement → remove).
+import { fireEvent, screen, waitFor, within } from '@testing-library/react'
+import { expect, it } from 'vitest'
+import { installAssembledBootEnv, mountAssembledApp } from './assembled-boot.ts'
+
+installAssembledBootEnv()
+
+/** Open the fixture history session (the alpha log carrying the turn-72 image pair) and wait for its gallery. */
+async function openFixtureSession(): Promise<void> {
+  const tree = await screen.findByRole('tree', { name: '会话' }, { timeout: 10_000 })
+  const group = (await within(tree).findAllByText('fixture'))
+    .map(el => el.closest<HTMLElement>('[role="treeitem"]'))
+    .find(el => el?.getAttribute('aria-expanded') !== null)
+  if (group === null || group === undefined) throw new Error('fixture Workspace group missing')
+  if (group.getAttribute('aria-expanded') === 'false') {
+    fireEvent.click(within(group).getByText('fixture'))
+    await waitFor(() => {
+      expect(group.getAttribute('aria-expanded')).toBe('true')
+    })
+  }
+  const session = await within(tree).findByText('Fixture 历史会话')
+  fireEvent.click(session)
+  await waitFor(() => {
+    expect(document.querySelectorAll('[data-align] img').length).toBeGreaterThan(0)
+  }, { timeout: 10_000 })
+}
+
+it('renders the history image pair through the authorized attachment route and opens the lightbox', async () => {
+  localStorage.setItem('dsh.locale', 'zh')
+  mountAssembledApp()
+  await openFixtureSession()
+
+  // Both the user-side (align=end) and assistant-side (align=start) galleries
+  // load real fixture bytes over sessions.attachment. jsdom provides
+  // createObjectURL, so this environment MUST take the object-URL path — a
+  // data: src here would mean the fallback ran where it should not.
+  await waitFor(() => {
+    if (document.querySelector('[data-align="end"] img') === null
+      || document.querySelector('[data-align="start"] img') === null) {
+      throw new Error('history image galleries missing')
+    }
+  }, { timeout: 10_000 })
+  const galleryShape = (align: string) => [...document.querySelectorAll(`[data-align="${align}"] img`)]
+    .map(img => ({ alt: img.getAttribute('alt'), scheme: img.getAttribute('src')?.split(':')[0] }))
+  expect({ user: galleryShape('end'), assistant: galleryShape('start') }).toMatchInlineSnapshot(`
+    {
+      "assistant": [
+        {
+          "alt": "fixture-image.png",
+          "scheme": "blob",
+        },
+      ],
+      "user": [
+        {
+          "alt": "fixture-image.png",
+          "scheme": "blob",
+        },
+      ],
+    }
+  `)
+  const userImage = document.querySelector<HTMLElement>('[data-align="end"] img')!
+
+  // Double-click opens the original-size lightbox; Escape/close dismisses it.
+  const frame = userImage.closest('button')
+  if (frame === null) throw new Error('image frame button missing')
+  fireEvent.doubleClick(frame)
+  const lightbox = await screen.findByRole('dialog')
+  expect(within(lightbox).getByRole('img').getAttribute('src')?.split(':')[0]).toBe('blob')
+  fireEvent.click(within(lightbox).getByRole('button', { name: /关闭/ }))
+  await waitFor(() => {
+    expect(screen.queryByRole('dialog')).toBeNull()
+  })
+})
+
+it('accepts pasted images into the composer rail in order and removes them', async () => {
+  localStorage.setItem('dsh.locale', 'zh')
+  mountAssembledApp()
+
+  const tree = await screen.findByRole('tree', { name: '会话' }, { timeout: 10_000 })
+  const start = tree.querySelector<HTMLButtonElement>('button[aria-label="在“fixture”中新建会话"]')
+  if (start === null) throw new Error('fixture Workspace new-session action missing')
+  fireEvent.click(start)
+
+  // Image-only send arming is pinned at package level (input-bar.spec.tsx);
+  // this assembled lane pins the intake chain over the built graph.
+  const textarea = await screen.findByPlaceholderText('描述你想要构建的内容', {}, { timeout: 10_000 })
+  const image = new File([new Uint8Array([137, 80, 78, 71])], 'pasted.png', { type: 'image/png' })
+  fireEvent.paste(textarea, {
+    clipboardData: {
+      items: [{ kind: 'file', type: 'image/png', getAsFile: () => image }],
+      getData: () => '',
+    },
+  })
+
+  // The rail is an accessible group holding the draft thumbnail (queried via
+  // DOM: jsdom's a11y-visibility computation hides the composer subtree).
+  const rail = await waitFor(() => {
+    const el = document.querySelector('[role="group"][aria-label="待发送图片"]')
+    if (el === null) throw new Error('attachment rail missing')
+    return el
+  }, { timeout: 5_000 })
+  expect([...rail.querySelectorAll('img')].map(img => ({
+    alt: img.getAttribute('alt'), scheme: img.getAttribute('src')?.split(':')[0],
+  }))).toMatchInlineSnapshot(`
+    [
+      {
+        "alt": "pasted.png",
+        "scheme": "blob",
+      },
+    ]
+  `)
+
+  const second = new File([new Uint8Array([137, 80, 78, 71])], 'second.png', { type: 'image/png' })
+  fireEvent.paste(textarea, {
+    clipboardData: {
+      items: [{ kind: 'file', type: 'image/png', getAsFile: () => second }],
+      getData: () => '',
+    },
+  })
+  await waitFor(() => {
+    expect([...rail.querySelectorAll('img')].map(img => img.getAttribute('alt')))
+      .toEqual(['pasted.png', 'second.png'])
+  })
+
+  const remove = [...rail.querySelectorAll('button[aria-label^="移除图片"]')]
+  if (remove.length !== 2) throw new Error('remove buttons missing')
+  for (const button of remove) fireEvent.click(button)
+  await waitFor(() => {
+    expect(document.querySelector('[role="group"][aria-label="待发送图片"]')).toBeNull()
+  })
+})

apps/web/tests/subagent-conversation.e2e.ts

@@ -446,7 +446,7 @@ describe('web e2e: persisted subagent conversation and human continuation', () =
     ).toBe(3)
     expect(await page.getByText('Ungrouped', { exact: true }).count()).toBe(0)
     const hierarchy = page.getByRole('navigation', { name: 'Session hierarchy' })
-    expect(await hierarchy.getByRole('button').count()).toBe(1)
+    await expect.poll(() => hierarchy.getByRole('button').count()).toBe(1)
     await compareOrRefreshGolden(
       FORK_EXPECTED,
       await captureStableAria(page, '[role="tree"][aria-label="Sessions"]', scaffold.workspaceCwd),

apps/web/tests/todo-row.snapshot.ts

@@ -2,7 +2,7 @@
 // Assembled todo snapshot: boots the real built `packages/client/*/lib/
 // client.js` bundles through AppWebEntry's ModuleLoader path against the
 // keyless FixtureApiClient transport, opens the fixture session, and pins the
-// two surfaces the fixture's parallel plan (turn 72, two items `in_progress`)
+// two surfaces the fixture's parallel plan (turn 73, two items `in_progress`)
 // reaches — the `todo_write` tool row and the dock's plan strip.
 //
 // The row is pinned as three separate fields on purpose. `summary=` is the