fix(gui): address ds-review-bot findings on image attachments

- dsh web gains --provider/--model: a non-deepseek provider mounts the
  matching pi-ai catalog route (ambient credentials), making image input
  reachable from the shipped Web assembly; requires an explicit --model
- attachment-local syncs the publication directories after the hard-link
  publish so a reported durable reference survives a crash (POSIX; Windows
  relies on filesystem metadata journaling)
- the attachment seam gains storage-free validateImage; the host validates a
  complete multi-image prompt before persisting any member, so one malformed
  image cannot strand valid members as unreferenced objects
- startSession sends before navigating: a rejected first send keeps the empty
  state, its error strip, and the complete draft mounted
- the webserver rejects an undeclared-length body the moment it crosses the
  configured limit instead of draining a potentially endless stream to EOF

packages/attachment/attachment-local/README.md

@@ -1,6 +1,6 @@
 # @deepseek-ai/dsh-attachment-local
 
-The private local implementation of [`@deepseek-ai/dsh-attachment`](../attachment). Objects land at `<DSH_HOME>/attachments/v1/objects/<sha256-prefix>/<sha256>` and are addressed by an opaque `sha256:` id. Writes use a private staging directory, owner-only files, a synced temporary file, and an atomic exclusive hard-link publish; reads re-check the digest, media signature, dimensions, and logged metadata. Byte and pixel limits are write-time admission policy, so a later policy reduction does not make already-admitted history unreadable.
+The private local implementation of [`@deepseek-ai/dsh-attachment`](../attachment). Objects land at `<DSH_HOME>/attachments/v1/objects/<sha256-prefix>/<sha256>` and are addressed by an opaque `sha256:` id. Writes use a private staging directory, owner-only files, a synced temporary file, an atomic exclusive hard-link publish, and a directory sync on the publication directories (POSIX; Windows relies on filesystem metadata journaling) so the reported reference survives a crash; reads re-check the digest, media signature, dimensions, and logged metadata. Byte and pixel limits are write-time admission policy, so a later policy reduction does not make already-admitted history unreadable.
 
 `DSH_HOME` resolves through the shared path policy: explicit config, `$DSH_HOME`, then `~/.dsh`. Session logs contain only the reference and verified metadata, never this host path.
 

packages/attachment/attachment-local/src/index.ts

@@ -6,10 +6,10 @@ import z from 'schemastery'
 import { AttachmentStore } from '@deepseek-ai/dsh-attachment'
 import type { ImageAttachmentLimits, ImageAttachmentRef, SaveImageAttachment, StoredImageAttachment } from '@deepseek-ai/dsh-attachment'
 import { resolveDshHome } from '@deepseek-ai/dsh-paths'
-import { readImageFile, saveImageFile } from './store.ts'
+import { readImageFile, saveImageFile, validateImageFile } from './store.ts'
 
 export { detectImage } from './image.ts'
-export { readImageFile, saveImageFile } from './store.ts'
+export { readImageFile, saveImageFile, validateImageFile } from './store.ts'
 export { AttachmentError } from '@deepseek-ai/dsh-attachment'
 export type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment'
 
@@ -62,6 +62,10 @@ export class LocalAttachmentStore extends AttachmentStore {
     })
   }
 
+  validateImage(input: SaveImageAttachment): void {
+    validateImageFile(input, this.imageLimits)
+  }
+
   async saveImage(input: SaveImageAttachment): Promise<ImageAttachmentRef> {
     return saveImageFile(this.root, input, this.imageLimits)
   }

packages/attachment/attachment-local/src/store.ts

@@ -52,6 +52,32 @@ function validateAdmission(metadata: Omit<ImageAttachmentRef, 'attachmentId' | '
   }
 }
 
+/**
+ * Run the full admission policy for one image without touching storage.
+ * @param input - encoded bytes and declared metadata.
+ * @param limits - resolved storage policy.
+ */
+export function validateImageFile(input: SaveImageAttachment, limits: ImageAttachmentLimits): void {
+  validateAdmission(inspectMetadata(input.data, input.mediaType), limits)
+}
+
+/**
+ * Make a directory's entries durable (fsync on a read-only directory handle).
+ * A synced file alone does not survive a crash when its directory entry never
+ * reached storage, so the publication directory is synced before a durable
+ * reference is reported.
+ */
+async function syncDirectory(path: string): Promise<void> {
+  /* v8 ignore next -- Windows cannot open directory handles; NTFS metadata journaling owns entry durability there. */
+  if (process.platform === 'win32') return
+  const handle = await open(path, constants.O_RDONLY)
+  try {
+    await handle.sync()
+  } finally {
+    await handle.close()
+  }
+}
+
 /**
  * Save and verify immutable image bytes below a versioned attachment root.
  * @param root - absolute `DSH_HOME/attachments/v1` root.
@@ -86,6 +112,13 @@ export async function saveImageFile(root: string, input: SaveImageAttachment, li
       const existing = new Uint8Array(await readFile(target))
       if (digest(existing) !== sha256) throw new AttachmentError('Stored attachment failed integrity verification.', 'ATTACHMENT_CORRUPT')
     }
+    // The synced file becomes durable only once its directory entries are: sync
+    // the bucket (the new object entry) and its parent (the possibly new bucket
+    // entry) before this reference can reach a session checkpoint. The dedup
+    // path syncs too — the earlier save that created the entry may have crashed
+    // before its own directory sync.
+    await syncDirectory(bucket)
+    await syncDirectory(join(root, 'objects'))
     await unlink(temporary)
   } catch (error) {
     /* v8 ignore next -- A descriptor can remain open only when the underlying write/sync/close operation fails. */

packages/attachment/attachment-local/tests/index.spec.ts

@@ -1,4 +1,5 @@
 import { Context } from 'cordis'
+import { existsSync } from 'node:fs'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -36,4 +37,22 @@ describe('local attachment service', () => {
       await rm(dshHome, { recursive: true, force: true })
     }
   })
+
+  it('validates without persisting: a rejected image leaves no storage root behind', async () => {
+    const dshHome = await mkdtemp(join(tmpdir(), 'dsh-attachment-validate-'))
+    try {
+      const service = new LocalAttachmentStore(new Context(), { dshHome })
+      expect(() => { service.validateImage({ data: Uint8Array.of(1, 2, 3), mediaType: 'image/png' }) })
+        .toThrow(/Unsupported or malformed image data/)
+      const valid = Uint8Array.from(Buffer.from(
+        'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=',
+        'base64',
+      ))
+      expect(() => { service.validateImage({ data: valid, mediaType: 'image/png' }) }).not.toThrow()
+      // Validation is storage-free: nothing below the root may exist yet.
+      expect(existsSync(service.root)).toBe(false)
+    } finally {
+      await rm(dshHome, { recursive: true, force: true })
+    }
+  })
 })

packages/attachment/attachment/README.md

@@ -2,7 +2,7 @@
 
 The durable attachment seam. `ctx.attachments` validates and atomically commits immutable image bytes, then returns a serializable `ImageAttachmentRef`; consumers never persist browser paths, object URLs, provider URLs, or base64 in session events.
 
-Unsent composer images remain browser-owned temporary drafts. `saveImage` is called only at message submission or while committing structured provider output, before any model-visible session event is published. `readImage` verifies the content-addressed object against its logged metadata.
+Unsent composer images remain browser-owned temporary drafts. `saveImage` is called only at message submission or while committing structured provider output, before any model-visible session event is published. `validateImage` runs the same admission policy without persisting; batch writers validate every member first so one malformed member cannot strand earlier members as unreferenced objects (there is no garbage collection). `readImage` verifies the content-addressed object against its logged metadata.
 
 ## Model Experience
 

packages/attachment/attachment/src/index.ts

@@ -33,6 +33,14 @@ export abstract class AttachmentStore extends Service {
   /** Deployment-resolved image policy used by authoritative and fast-path validation. */
   abstract readonly imageLimits: ImageAttachmentLimits
 
+  /**
+   * Validate one image against the deployment policy without persisting anything.
+   * Callers persisting a multi-image batch validate every member first so a
+   * malformed member cannot leave earlier members as unreferenced objects.
+   * @param input - encoded bytes, declared media type, and optional display name.
+   */
+  abstract validateImage(input: SaveImageAttachment): void
+
   /**
    * Validate and durably commit one image before its owning session event is appended.
    * @param input - encoded bytes, declared media type, and optional display name.