Return workspace images as model image content

[16francej]

Workspace image reads were decoded as UTF-8, and native harness bridges flattened tool results to text. Authorized files reads now return PNG, JPEG, GIF, and WebP as image content while preserving their original bytes, text reads, sharing boundaries, approval gates, and security screening.

Runtime workspace-image handling is limited to byte reads, basic format/dimension/5 MB validation, image blocks, and native transport. Preview rendering, resizing, and conversion live in skills; existing incoming-attachment conversion behavior is preserved. The document skill covers substantive content and graphic-logo preservation, immediate revisions, inspection of the exact export, and reconciliation of shared changes across audience variants.

Native bridges preserve model image blocks while redacting their bytes from stored capture payloads. OpenCode redacts its capture copy before posting it, Responses and Completions images share the existing request-byte budget, and dimension sniffing avoids repeated full-buffer copies. A small synthetic document scenario reuses the existing live Slack harness and provides a reproducible source fixture.

Validation:

• Affected runtime, adapter, attachment, and skill tests passed, along with typecheck, lint, formatting, and diff checks.
• All 20 GitHub checks passed on e282fe91.
• Independent adversarial code reviews covered runtime security, transport, budgets, document guidance, and the repeatable scenario; all code-review findings were fixed and rechecked.
• Three controlled live Firefox Slack runs used separate clean workspaces, the same real model/settings, identical synthetic input bytes, and the same ten ordered prompts. The baseline and both revised runs completed all ten turns; actual attachment bytes and prompt order were verified.
• The isolated image probe reproduced text-only bytes on the baseline. Both revised probes supplied actual image blocks whose decoded bytes matched the probe file at the QM-to-Codex boundary. Generated PDF previews also arrived as image blocks. The first revised probe identified the corners correctly; the final probe swapped two corners. This is bridge evidence, not a provider HTTP capture, and correct transport does not guarantee accurate perception.

The broader document-quality scenario has not fully passed. Initial redesigns still omitted the source graphic, and the final skill revision also omitted the comparison table until the next explicit correction. Both revised runs attached the general document instead of updating the requested audience variant. The final styled export added a vertical table border through the first letters in its second column; the earlier revision's horizontal body-line crossings were absent, but the visual checkpoint still failed. The complete skill body was present in Codex replay. These observed failures remain recorded; skill guidance is not a reliable document-quality guarantee.

The baseline also passed explicit content restoration, audience-variant delivery, and the final updated compliance attachment. Both revised runs restored the requested content and preserved the original graphic through the later targeted edit before the logo reminder. No stale contact or meeting-duration failure was observed in the final attachments. These results do not establish that the whole original experience is resolved.

Raw transcripts, identifiers, wire captures, rendered artifacts, and screenshots remain private outside Git. The committed scenario and fixture generator contain fictional content only.