Declared Session attachment carriers
Session 声明的附件载体
Session attachment authorization and ZIP export inferred attachment ownership from common payload field names. An unknown ignorable event could therefore authorize an image read or export file bytes. Compaction content under `summary` and `rawOutput` was outside that field-name scan.
English
Problem
Session attachment authorization and ZIP export inferred attachment ownership from common payload field names. An unknown ignorable event could therefore authorize an image read or export file bytes. Compaction content under summary and rawOutput was outside that field-name scan.
Decision
Both consumers select content fields by built-in event type. They inspect completed assistant blocks and direct content blocks, including flat V4 tool-role messages. Other content-block fields and unknown event payloads remain opaque, even when they contain objects resembling image or file references.
The controller applies this rule before reading image bytes. The exporter applies it before reading image or file bytes and retains the complete logical log. Historical logs reach these readers after persistence converts them to current logical events. Title requests are excluded because V4 requires a single text block. Compaction uses its declared content fields: the basic producer currently emits text, while other valid compaction producers may supply attachments there.
Alternatives considered
Scan common keys on every event. This lets a field name grant attachment access without a defined content meaning. It also misses valid content stored under other declared fields.
Interpret historical wrappers in attachment readers. Historical conversion belongs to the adjacent format packages. Current attachment readers use flat V4 content and do not maintain a second interpretation of old blocks.
Consequences
Plugins that store attachments only in custom events cannot use these built-in readers for those references. A plugin needs a supported content occurrence or its own reader. Adding a built-in content carrier requires updating both readers and their acceptance and refusal tests. Historical codec inventories remain version-owned; changing this policy must not change what a released decoder recognizes.
The change affects attachment lookup and archive membership, not Session encoding or the model-visible message history.
Verification
Controller and archive tests cover declared carriers, flat tool results, opaque plugin payloads, and misleading extra fields. Refusal tests assert that attachment storage is never read; archive tests also compare the exported log text.
中文
问题
Session 附件授权与 ZIP 导出按常见载荷字段名推断附件归属。因此，未知可忽略事件也能授权图片读取或导出文件字节。压缩事件的 summary 与 rawOutput 内容不在这套字段名扫描范围内。
决策
两个消费者均按内置事件类型选择内容字段。它们检查已完成的 assistant 块与直接内容块，包括扁平的 V4 tool 角色消息。其他内容块字段与未知事件载荷保持不透明，即使其中含有类似图片或文件引用的对象。
控制器在读取图片字节前应用此规则。导出器在读取图片或文件字节前应用此规则，并保留完整逻辑日志。历史日志由持久化层转换成当前逻辑事件后交给这些读取器。标题请求不在附件载体之列，因为 V4 要求它只含一个文本块。压缩事件使用其声明的内容字段：基础生产者目前输出文本，其他合法压缩生产者可以在这些位置提供附件。
考虑过的替代方案
扫描所有事件的常见键。 这使字段名在没有明确内容语义时授予附件访问权，也会遗漏其他已声明字段中的有效内容。
在附件读取器中解释历史包装块。 历史转换由相邻格式包负责。当前附件读取器使用扁平的 V4 内容，不维护第二套旧块解释。
影响
仅在自定义事件中存储附件的插件不能通过这些内置读取器读取相关引用。插件需要使用受支持的内容位置，或提供自己的读取器。新增内置内容载体时，需要同步更新两个读取器及其接纳和拒绝测试。历史编解码器的清单仍归各版本所有；调整此策略不能改变已发布解码器识别的内容。
此变更影响附件查找与归档成员，不影响 Session 编码或模型可见消息历史。
验证
控制器和归档测试覆盖声明的载体、扁平工具结果、不透明插件载荷及误导性额外字段。拒绝测试断言不会读取附件存储；归档测试还比较导出的日志文本。