feat(web): safely attach HEIC photos as JPEG images

[t3dotgg]

HEIC and HEIF photos cannot be attached in the web or desktop composer. Browsers also reject some otherwise valid images when a misleading .heic filename overrides their actual MIME type.

Convert dropped and pasted HEIC photos to JPEG, compress JPEG intermediates that grow beyond the original source limit, and trust concrete image MIME types before falling back to a HEIC filename. Full-resolution 24 MP and 48 MP photos remain supported. Based on #8156.

Verification:

• vp test run apps/web/src/lib/imageCompression.test.ts apps/web/src/components/chat/workspaceFileDrop.test.ts (23 passing tests)
• vp lint apps/web/src/lib/imageCompression.ts apps/web/src/lib/imageCompression.test.ts apps/web/src/components/chat/ChatComposer.tsx
• vp run --filter @t3tools/web typecheck

Model: GPT-5.6 Sol
Harness: Codex

---

Note

Medium Risk
Client-side HEIC decode and re-encode runs on user-selected files with OOM guards, but malformed metadata or decoder failures surface as attachment errors; new dependency loads only when HEIC is attached.

Overview
Enables HEIC/HEIF photos in the web composer on paste and drag by converting them to JPEG before upload, since providers do not accept Apple’s format.

prepareImageForAttachment detects HEIC via MIME or extension (including empty/octet-stream from Finder), parses ISO BMFF metadata to reject unsafe dimensions before loading heic-to, converts to JPEG, then reuses the existing byte-limit compression with JPEG forced and source-size checks so bloated JPEG intermediates do not bypass the 50MB decode ceiling. ChatComposer routes attachments through this pipeline and updates validation/error copy; user docs note automatic conversion.

Adds heic-to@^1.5.2 and unit tests for detection, conversion, compression, and early rejection paths.

^{Reviewed by Cursor Bugbot for commit 1a9d391. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add HEIC photo conversion to JPEG for web composer attachments

• Adds prepareImageForAttachment to detect HEIC/HEIF files (including those with missing MIME types), validate ISO BMFF metadata for dimensions, and convert them to JPEG via the heic-to library before compression
• Updates ChatComposer.tsx to route image attachments through the new pipeline and expand paste/drag-drop and error logic to recognize HEIC/HEIF extensions
• Extends compressImageToByteLimit with optional preferredMimeType to force JPEG output and sourceSizeBytes to enforce the original source file size limit during conversion
• Risk: validateHeicImageDimensions rejects HEICs with missing or corrupt ISO BMFF metadata, or those exceeding MAX_HEIC_DECODE_PIXELS, as unreadable instead of attempting to decode

^{Macroscope summarized 1a9d391.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b5c101f7-2a52-4f44-8f45-8414c1b30716

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+29 B (+0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+28 B (+0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	11	+1 (+10.0%)	21	✅

Baseline: 2394998 · PR result: 1a9d391 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This introduces a new HEIC/HEIF attachment workflow with a third-party client-side decoder, metadata validation, JPEG conversion, and changed upload behavior. The browser-side decoding and resource usage make this a substantive runtime feature requiring human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eaa7b1c. Configure here.}