- Shipped
- September 29, 2026 at 2:18 AM UTC
- Author
- Kamo
- Commit
- eb69c93
A workstation screenshot is an MCP image block of about 250 KB of base64. The untrusted wrap serialized it into the result text, so the text budget held base64 cut off mid-way and a model never read the words beside the image, such as get_app_state's accessibility tree. Image blocks of an untrusted result now follow the text as MCP image content blocks, for a client that shows images to its model, and keep their place in the wrap as a marker {type:image, mimeType, attached:true}. The image travels once, as before.