> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formation.texturehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Conversation images

> Inspect authorized image uploads and restore visual input across durable inference steps.

Images on the message being answered already reach a vision model through the
connector's authenticated attachment fetcher. Historical uploads need an
explicit visual reader alongside `list_documents`. Durable checkpoints omit
pixels, so subsequent inference activities rebuild visual input from authorized
sources rather than relying on a picture sent to an earlier model call.

## Implementation plan

1. Offer `view_images` alongside the attachment listing and document reader. It
   accepts up to four attachment IDs from this conversation, never a URL or a
   credential. PNG and JPEG files within the existing 8 MiB per-file limit are
   delivered as native model image input; filenames alone are never visual proof.
   Inputs are decoded before use and limited to 32 megapixels, a 16,384-pixel
   edge, and 32 MiB of conservative decoded pixel storage. The storage limit
   accounts for eight-byte 16-bit PNG pixels and padded JPEG planes, so it can
   reject a highly compressed file below the encoded-size/pixel-count limits.
   Full validation decodes run one at a time per process; waiting honors turn
   cancellation. Decoder buffers and interlace passes still add overhead beyond
   the pixel-storage limit. An explicit selection replaces automatic current-message image input;
   the prompt names exactly the selected images actually shown.
   The reader is not offered to models known to reject image input; routing
   requires that capability when the tool is offered.
2. Reuse the existing same-agent, same-conversation, current-audience attachment
   queries. Fetch bytes with the connector belonging to that agent. Retain each
   source message in disclosure provenance before exposing derived content.
3. Keep the selected attachment IDs, source message IDs, and content digests in
   trusted tool receipts and execution checkpoints. Recheck authorization and
   reload pixels before every inference that uses the selection. Raw pixels,
   base64 data and connector download URLs do not enter those receipts.
4. Restore current-message image input after transcript recovery, so resumed
   tool/inference activities do not silently lose the original picture. Keep
   reconstructed visual input separate from the durable working transcript.
5. Explain unsupported formats, missing files and text-only models explicitly.
   `read_document` directs image uploads to `view_images`; it must not suggest
   converting a normal picture into a text document. Missing or unreadable
   images never justify substituting guessed content.

## Import original files into a workspace

When enabled for the agent, `import_attachment` copies an authorized attachment
directly into the current run's sandbox. Find its ID with `list_documents`, then
provide `attachment_id` and an absolute destination `path`. Parent directories
are created and existing contents at that path are replaced. The response names
the path, original content type, byte count, and SHA-256 checksum; binary content
and connector credentials never pass through the model's tool arguments or result.

For example, call `import_attachment` with:

```json theme={null}
{"attachment_id": "<ID from list_documents>", "path": "/tmp/assets/logo.png"}
```

Imports preserve original bytes without decoding or conversion, including SVGs,
PDFs, and other formats a vision model cannot inspect. The existing 8 MiB transfer
bound still applies. The agent can then use `workspace_exec` to manipulate the
file. Importing a file does not mean the model has visually inspected it.
Uploads outside the native PNG/JPEG/WebP/GIF formats, including SVGs and TIFFs,
are listed with import guidance rather than sent as unsupported vision input.
Convert or rasterize them in the sandbox before attempting visual inspection.

The transfer repeats the same agent, conversation, and audience checks as visual
reading and retains the source message in disclosure provenance. It uses the
current agent's connector and the current run's workspace. Workspace enablement,
ownership checks, and effectful-tool recovery apply; an uncertain write must be
inspected before retrying rather than automatically overwriting subsequent edits.

Vector rasterization and scanned-document OCR remain separate capabilities.

## Validation

Regression coverage must show an older image reaching the actual next model
request, current-message images surviving multiple durable steps, replay after
tool settlement and before inference, and no pixels in stored checkpoints or
request audit bodies. Authorization tests must refuse foreign agents,
conversations and audiences before fetching bytes. Invalid images, unsupported
formats, size limits, content changes, and missing source files require explicit
limitations rather than fabricated visual observations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.