Skip to main content
Images on the message being answered already reach a vision model through the connector’s authenticated attachment fetcher. Historical uploads need an explicit visual reader alongside list_documents. Durable checkpoints omit pixels, so subsequent inference activities rebuild visual input from authorized sources rather than relying on a picture sent to an earlier model call.

​
Implementation plan

  1. Offer view_images alongside the attachment listing and document reader. It accepts up to four attachment IDs from this conversation, never a URL or a credential. PNG and JPEG files within the existing 8 MiB per-file limit are delivered as native model image input; filenames alone are never visual proof. Inputs are decoded before use and limited to 32 megapixels, a 16,384-pixel edge, and 32 MiB of conservative decoded pixel storage. The storage limit accounts for eight-byte 16-bit PNG pixels and padded JPEG planes, so it can reject a highly compressed file below the encoded-size/pixel-count limits. Full validation decodes run one at a time per process; waiting honors turn cancellation. Decoder buffers and interlace passes still add overhead beyond the pixel-storage limit. An explicit selection replaces automatic current-message image input; the prompt names exactly the selected images actually shown. The reader is not offered to models known to reject image input; routing requires that capability when the tool is offered.
  2. Reuse the existing same-agent, same-conversation, current-audience attachment queries. Fetch bytes with the connector belonging to that agent. Retain each source message in disclosure provenance before exposing derived content.
  3. Keep the selected attachment IDs, source message IDs, and content digests in trusted tool receipts and execution checkpoints. Recheck authorization and reload pixels before every inference that uses the selection. Raw pixels, base64 data and connector download URLs do not enter those receipts.
  4. Restore current-message image input after transcript recovery, so resumed tool/inference activities do not silently lose the original picture. Keep reconstructed visual input separate from the durable working transcript.
  5. Explain unsupported formats, missing files and text-only models explicitly. read_document directs image uploads to view_images; it must not suggest converting a normal picture into a text document. Missing or unreadable images never justify substituting guessed content.

​
Import original files into a workspace

When enabled for the agent, import_attachment copies an authorized attachment directly into the current run’s sandbox. Find its ID with list_documents, then provide attachment_id and an absolute destination path. Parent directories are created and existing contents at that path are replaced. The response names the path, original content type, byte count, and SHA-256 checksum; binary content and connector credentials never pass through the model’s tool arguments or result. For example, call import_attachment with:
Imports preserve original bytes without decoding or conversion, including SVGs, PDFs, and other formats a vision model cannot inspect. The existing 8 MiB transfer bound still applies. The agent can then use workspace_exec to manipulate the file. Importing a file does not mean the model has visually inspected it. Uploads outside the native PNG/JPEG/WebP/GIF formats, including SVGs and TIFFs, are listed with import guidance rather than sent as unsupported vision input. Convert or rasterize them in the sandbox before attempting visual inspection. The transfer repeats the same agent, conversation, and audience checks as visual reading and retains the source message in disclosure provenance. It uses the current agent’s connector and the current run’s workspace. Workspace enablement, ownership checks, and effectful-tool recovery apply; an uncertain write must be inspected before retrying rather than automatically overwriting subsequent edits. Vector rasterization and scanned-document OCR remain separate capabilities.

​
Validation

Regression coverage must show an older image reaching the actual next model request, current-message images surviving multiple durable steps, replay after tool settlement and before inference, and no pixels in stored checkpoints or request audit bodies. Authorization tests must refuse foreign agents, conversations and audiences before fetching bytes. Invalid images, unsupported formats, size limits, content changes, and missing source files require explicit limitations rather than fabricated visual observations.