dsh-media-guard

In a multimodal agent loop, image attachments are often the largest and most unpredictable part of the request payload. DSH 0.1.0-rc.8 already ships an offloadRequestImages safety net that caps aggregate Base64 at 20 MiB by dropping the oldest images first, but that policy is blunt: either a full image is removed or the request overflows. dsh-media-guard layers a finer-grained optimization and retention policy on top so the provider-bound view is shaped before the request leaves the process.

The core capabilities are threefold. First, oversized images are compressed to WebP via sharp and written back through the DSH immutable attachment store; the durable session log and original files are never modified. Second, identical images are deduplicated by their sha256 content address, and later copies become deterministic Evidence Notes carrying hash, size, dimensions, origin, and reason. Third, the plugin registers on the llm/stream waterfall and acts only on agent-loop requests, leaving hand-built calls, compaction, replay, and its own projected re-dispatch untouched. In protect mode the serialized budget is mirrored to the adapter ceiling so the official oldest-first offload normally becomes a no-op.

This plugin is for developers and teams running multimodal agents on DSH who hit image request size limits or want predictable, auditable payload behaviour. It works out of the box with zero configuration, and a compact live status row appears under the DSH home composer showing current pressure, images kept, budget headroom, and compression, deduplication, or externalization counts.