Name the existing attachment in the duplicate-paste flash and prove the hash source

The rejection flash was reporting the rejected paste's own name, which
the operator never saw -- every clipboard read gets a fresh
clipboard-<timestamp>.png, so the message pointed at a filename that
didn't match the chip already in their prompt. Report the attachment
already in the pending set instead.

Also add a producer-level test against imageAttachmentFromPath with an
oversized fixture, so the pre-cap hashing is pinned by more than the
comment above it; make the hash helper module-private since nothing
outside this file needs it.

Author: TheGreatAxios

src/tui-opentui/prompt-features.test.ts

@@ -171,7 +171,11 @@ describe("image attachments", () => {
       expect(await attachClipboardImage(shell)).toBe(false)
       expect(shell.pendingAttachments).toHaveLength(1)
       expect(shell.pendingAttachments[0]?.id).toBe("clip-1")
-      expect(shell.statusFlash).toContain("already attached")
+      // Names the attachment already sitting in the pending set (CLIP), not
+      // the rejected paste (CLIP_SAME_CONTENT) -- the operator never saw the
+      // rejected paste's filename, so naming it would read as a bug.
+      expect(shell.statusFlash).toContain(`${CLIP.name} is already attached`)
+      expect(shell.statusFlash).not.toContain(CLIP_SAME_CONTENT.name)
     })
   })
 

src/tui-opentui/shell.ts

@@ -932,11 +932,11 @@ export async function attachClipboardImage(shell: AppShell): Promise<boolean> {
     setStatusFlash(shell, `image attach failed: ${result.reason}`)
     return false
   }
-  const isDuplicate = shell.pendingAttachments.some(
+  const duplicate = shell.pendingAttachments.find(
     (attachment) => attachment.contentHash === result.attachment.contentHash,
   )
-  if (isDuplicate) {
-    setStatusFlash(shell, `${result.attachment.name} is already attached`)
+  if (duplicate !== undefined) {
+    setStatusFlash(shell, `${duplicate.name} is already attached`)
     return false
   }
   addPendingAttachment(shell, result.attachment)

src/tui/image-attachments.test.ts

@@ -1,11 +1,14 @@
 import { describe, expect, test } from "bun:test";
 import { deflateSync } from "node:zlib";
 import { unlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   extractPastedImagePaths,
   findImagePathMentions,
   imageMimeTypeForPath,
   capImageForIngestion,
+  imageAttachmentFromPath,
   MAX_IMAGE_DIMENSION,
 } from "./image-attachments.js";
 
@@ -150,4 +153,31 @@ describe("image attachment helpers", () => {
     expect(result.data).toBe(large);
     expect(result.contentType).toBe("image/png");
   });
+
+  // The dedupe fix (see shell.ts attachClipboardImage) rests entirely on this:
+  // two ingests of identical source bytes must hash identically even though
+  // capImageForIngestion re-encodes oversized images through `sips`, whose
+  // JPEG output is not byte-stable across runs. Sizing the fixture above
+  // DOWNSCALE_THRESHOLD_BYTES (300 KB) exercises that re-encode path -- a
+  // small fixture would pass even if the hash were taken after capping.
+  test("hashes identical source bytes the same regardless of filename, even through the sips recompression path", async () => {
+    const bytes = buildTestPng(1200, 1200);
+    expect(bytes.byteLength).toBeGreaterThan(300 * 1024);
+
+    const pathA = join(tmpdir(), `corbits-hash-test-a-${process.pid}-${Date.now()}.png`);
+    const pathB = join(tmpdir(), `corbits-hash-test-b-${process.pid}-${Date.now()}.png`);
+    await Bun.write(pathA, bytes);
+    await Bun.write(pathB, bytes);
+    try {
+      const resultA = await imageAttachmentFromPath(pathA);
+      const resultB = await imageAttachmentFromPath(pathB);
+      if (!resultA.ok || !resultB.ok) throw new Error("expected both ingests to succeed");
+
+      expect(resultA.attachment.contentHash).toBe(resultB.attachment.contentHash);
+      expect(resultA.attachment.id).not.toBe(resultB.attachment.id);
+    } finally {
+      await unlink(pathA).catch(() => undefined);
+      await unlink(pathB).catch(() => undefined);
+    }
+  });
 });

src/tui/image-attachments.ts

@@ -27,7 +27,7 @@ const IMAGE_MIME_BY_EXT: Readonly<Record<string, string>> = {
 export type PendingImageAttachment = MessageAttachment & {
   id: string;
   path?: string;
-  /** SHA-256 of the decoded image bytes, used to dedupe repeat pastes. */
+  /** SHA-256 of the source image file's bytes, used to dedupe repeat pastes. */
   contentHash: string;
 };
 
@@ -110,9 +110,12 @@ export async function imageAttachmentFromPath(path: string): Promise<AttachImage
   };
 }
 
-/** SHA-256 of decoded image bytes, used to identify identical pastes regardless of filename or timing. */
-export async function hashImageBytes(bytes: Uint8Array): Promise<string> {
-  const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+/** SHA-256 of the source image file's bytes, used to identify identical pastes regardless of filename or timing. */
+async function hashImageBytes(bytes: Buffer): Promise<string> {
+  // Buffer's type parameter is the looser ArrayBufferLike (it may back onto a
+  // pooled allocation), but readFile never actually hands back a
+  // SharedArrayBuffer-backed view, so this is a type-only cast, not a copy.
+  const digest = await crypto.subtle.digest("SHA-256", bytes as BufferSource);
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }