fix(gui): address ds-review-bot findings on image attachments

- dsh web gains --provider/--model: a non-deepseek provider mounts the
  matching pi-ai catalog route (ambient credentials), making image input
  reachable from the shipped Web assembly; requires an explicit --model
- attachment-local syncs the publication directories after the hard-link
  publish so a reported durable reference survives a crash (POSIX; Windows
  relies on filesystem metadata journaling)
- the attachment seam gains storage-free validateImage; the host validates a
  complete multi-image prompt before persisting any member, so one malformed
  image cannot strand valid members as unreferenced objects
- startSession sends before navigating: a rejected first send keeps the empty
  state, its error strip, and the complete draft mounted
- the webserver rejects an undeclared-length body the moment it crosses the
  configured limit instead of draining a potentially endless stream to EOF

packages/attachment/attachment-local/src/index.ts

@@ -6,10 +6,10 @@ import z from 'schemastery'
 import { AttachmentStore } from '@deepseek-ai/dsh-attachment'
 import type { ImageAttachmentLimits, ImageAttachmentRef, SaveImageAttachment, StoredImageAttachment } from '@deepseek-ai/dsh-attachment'
 import { resolveDshHome } from '@deepseek-ai/dsh-paths'
-import { readImageFile, saveImageFile } from './store.ts'
+import { readImageFile, saveImageFile, validateImageFile } from './store.ts'
 
 export { detectImage } from './image.ts'
-export { readImageFile, saveImageFile } from './store.ts'
+export { readImageFile, saveImageFile, validateImageFile } from './store.ts'
 export { AttachmentError } from '@deepseek-ai/dsh-attachment'
 export type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment'
 
@@ -62,6 +62,10 @@ export class LocalAttachmentStore extends AttachmentStore {
     })
   }
 
+  validateImage(input: SaveImageAttachment): void {
+    validateImageFile(input, this.imageLimits)
+  }
+
   async saveImage(input: SaveImageAttachment): Promise<ImageAttachmentRef> {
     return saveImageFile(this.root, input, this.imageLimits)
   }

packages/attachment/attachment-local/src/store.ts

@@ -52,6 +52,32 @@ function validateAdmission(metadata: Omit<ImageAttachmentRef, 'attachmentId' | '
   }
 }
 
+/**
+ * Run the full admission policy for one image without touching storage.
+ * @param input - encoded bytes and declared metadata.
+ * @param limits - resolved storage policy.
+ */
+export function validateImageFile(input: SaveImageAttachment, limits: ImageAttachmentLimits): void {
+  validateAdmission(inspectMetadata(input.data, input.mediaType), limits)
+}
+
+/**
+ * Make a directory's entries durable (fsync on a read-only directory handle).
+ * A synced file alone does not survive a crash when its directory entry never
+ * reached storage, so the publication directory is synced before a durable
+ * reference is reported.
+ */
+async function syncDirectory(path: string): Promise<void> {
+  /* v8 ignore next -- Windows cannot open directory handles; NTFS metadata journaling owns entry durability there. */
+  if (process.platform === 'win32') return
+  const handle = await open(path, constants.O_RDONLY)
+  try {
+    await handle.sync()
+  } finally {
+    await handle.close()
+  }
+}
+
 /**
  * Save and verify immutable image bytes below a versioned attachment root.
  * @param root - absolute `DSH_HOME/attachments/v1` root.
@@ -86,6 +112,13 @@ export async function saveImageFile(root: string, input: SaveImageAttachment, li
       const existing = new Uint8Array(await readFile(target))
       if (digest(existing) !== sha256) throw new AttachmentError('Stored attachment failed integrity verification.', 'ATTACHMENT_CORRUPT')
     }
+    // The synced file becomes durable only once its directory entries are: sync
+    // the bucket (the new object entry) and its parent (the possibly new bucket
+    // entry) before this reference can reach a session checkpoint. The dedup
+    // path syncs too — the earlier save that created the entry may have crashed
+    // before its own directory sync.
+    await syncDirectory(bucket)
+    await syncDirectory(join(root, 'objects'))
     await unlink(temporary)
   } catch (error) {
     /* v8 ignore next -- A descriptor can remain open only when the underlying write/sync/close operation fails. */