feat(thread-chat): support text, code, and image attachments

[hifizz]

Summary

This PR delivers the first production-ready slice of the attachment roadmap tracked in #82.

• upload attachments directly from the browser to private R2 through presigned URLs
• persist stable /api/attachments/{id} references instead of base64, R2 keys, or expiring URLs
• support pasted text plus common plaintext/source extensions, including Markdown, JavaScript/TypeScript, JSON, HTML/XML/SVG source, stylesheets, shell scripts, and other common languages
• normalize source files to safe UTF-8 text/plain, preserve filenames/content/whitespace, and reject invalid UTF-8 during ingest
• inject text attachments into model context under the shared character budget
• support PNG/JPEG/WebP input for explicitly verified vision models and reject unsupported image sends before paid generation
• constrain message image thumbnails to 288px and open images in an in-app lightbox
• render non-image attachments as file cards instead of bare links
• preview text/code attachments through the authenticated same-origin /api/attachments/{id}/content endpoint, with skeleton, empty, error/retry, and download states
• force explicit downloads with Content-Disposition: attachment
• preserve sent attachments after refresh and across edit/retry flows
• record the accepted attachment workflow and UI preferences in project Command Code taste

Verified models

• DeepSeek V4 Flash: reads text/code attachments; image input is rejected
• Ark Kimi K2.6: image input verified
• AIBerm Claude Opus 5: image input verified with Anthropic and OpenAI-compatible request formats
• OpenRouter GPT-5.6 Sol: provider metadata confirms image support; end-to-end verification remains blocked by missing account credits

Attachment limits

• at most 5 images per message
• 10 MB per image
• 2048px longest edge
• oversized JPEG/WebP images become WebP at 80% quality
• oversized PNG images remain lossless PNG
• smaller images are not enlarged or recompressed

Validation

• pnpm typecheck
• node --import tsx e2e/thread-chat/text-attachment-slice.test.mjs
• node --import tsx e2e/thread-chat/image-attachment-slice.test.mjs
• node --import tsx e2e/thread-chat/ui-message-parts-rendering.test.mjs
• pnpm test:thread-chat:gate2-pipeline
• pnpm test:thread-chat:gate3-client
• pnpm lint — 0 errors, 2 pre-existing warnings
• pnpm build
• manual acceptance: constrained image thumbnails, image lightbox, file cards, Markdown/code preview, skeleton loading state, and explicit download

Not included

• PDF attachment support in the Thread Chat composer or OCR
• CSV/Excel/PPT parsing
• ZIP/video parsing
• attachment-only messages
• upload retry in place
• unsent draft persistence
• abandoned/orphan attachment cleanup
• query-based retrieval for long text and multiple files

Tracking

Part of #82. This PR intentionally does not close the tracking issue.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 98d4b9a3-6758-4c7f-876e-a5c874c2730f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
thread-chatbot	Error		Sep 4, 2026 5:04pm UTC

[hifizz]

最新检查状态：

• deterministic 已在提交 a1d69dc 转绿；同时显式刷新了 ci／scheduled／release fixture baselines，并在本地通过完整 eval-loop 与 CI baseline comparison。
• Vercel 仍失败，但失败发生在 vercel-build 的 drizzle-kit migrate 阶段，尚未进入 next build。
• 本 PR 没有数据库 schema 或 migration 改动，本地 pnpm build 已通过。
• Vercel 连续三次日志均停在共享数据库迁移，需要单独检查预览环境数据库连接／迁移执行状态；未通过跳过迁移或修改部署流水线规避。