Add session-owned file attachments and require remote protocol 7

apps/maple-agent/README.md

@@ -271,7 +271,7 @@ the same selection state.
 The preview includes `j/k`, `gg/G`, counts, `Enter`, `h/l`, `y`, `/`, `ga`,
 `[a`/`]a`, `gi`, and `Ctrl-W h/j/k/l`. `Ctrl-W j` from the composer reaches its
 button row, where `h/l` (or `j/k`) and `gg/G` move between the model, thinking,
-integrations, web, image, and dictation controls and `Enter` presses one; a menu
+integrations, web, attachment, and dictation controls and `Enter` presses one; a menu
 opens on its current choice. `Space s n` starts a task and `Space ,`
 opens Settings. The Settings page itself is navigable, including its shortcut
 search and editable binding rows. Annotation motions are registered and report

apps/maple-agent/app/src/backend.rs

@@ -6,8 +6,12 @@
 
 #[cfg_attr(not(feature = "desktop"), allow(unused_imports))]
 pub use local::*;
+pub(crate) mod attachments;
 pub(crate) mod local;
 pub(crate) mod paging;
+#[cfg(any(feature = "desktop", test))]
+pub use attachments::AttachmentUploadRequest;
+pub use attachments::ImportAttachmentRequest;
 #[cfg(feature = "desktop")]
 pub use paging::*;
 mod mcp;
@@ -558,6 +562,9 @@ async fn dispatch_special(
     backend: &LocalBackend,
     request: Request,
 ) -> Result<serde_json::Value, String> {
+    if attachments::handles(&request.method) {
+        return attachments::dispatch(backend, request).await;
+    }
     if paging::is_paging(&request.method) {
         return paging::dispatch(backend, request, maple_agent::store::PageTransport::Local).await;
     }
@@ -670,7 +677,10 @@ pub(crate) async fn dispatch(
     // validation must not prevent local history, configuration, or stop calls.
     // The restore mutex still serializes credential validation/publication.
     // Cancelling an OAuth wait must remain independent.
-    if request.method == "cancel_oauth" {
+    if matches!(
+        request.method.as_str(),
+        "cancel_oauth" | "import_attachment"
+    ) {
         return dispatch_inner(backend, request).await;
     }
     if matches!(