Refactor media payload handling to persist base64 blobs as attachment refs and keep non-turn model paths safe by degrading risky payloads.

This preserves multimodal fidelity for the latest user turn while preventing historical/tool replay bloat, and adds admin UI support for referenced attachment preview/download flows.

Made-with: Cursor

tests/test_tool_runtime_attachments.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from oclaw.runtime.chat.tool_runtime import _attachments_from_tool_result
+
+
+def test_attachments_from_tool_result_preserves_non_image_ref_types() -> None:
+    result = {
+        "attachments": [
+            {
+                "type": "text_ref",
+                "attachment_id": "att-text-1",
+                "mime": "text/plain",
+                "name": "a.txt",
+                "bytes": 12,
+            },
+            {
+                "attachment_id": "att-video-1",
+                "mime": "video/mp4",
+                "name": "a.mp4",
+                "bytes": 1024,
+            },
+        ]
+    }
+
+    out = _attachments_from_tool_result(result)
+    by_id = {str(x.get("attachment_id")): x for x in out}
+
+    assert by_id["att-text-1"]["type"] == "text_ref"
+    assert by_id["att-video-1"]["type"] == "video_ref"
+