Spec
See specs/072-multimodal-mcp-passthrough/plan.md §"P3 — Config Surface, CLI, TUI, Migration, Docs (PR 4)". Parent issue: #6229. Depends on P2 (#6240) merging first.
Summary
Complete the mandatory integration points (CLAUDE.md "Development Rules" / invariant #12) for the MCP image passthrough feature: --init wizard, --migrate-config step, TUI status indicator, playbook + coverage-status rows, docs, CHANGELOG.
Scope (from plan.md, full deliverable list has exact file references)
src/init/mcp.rs — per-server wizard prompt: "Enable image passthrough for this server?", default No.crates/zeph-config/src/migrate/mod.rs — new migration step adding media_passthrough = false and [mcp.media] defaults to existing configs (use the next available step number — check current max at implementation time, do not hardcode from the spec).- TUI status indicator — per CLAUDE.md's mandatory "TUI Rules", a spinner during
MediaSanitizer::sanitize_image's spawn_blocking decode (e.g. "Decoding MCP image…") and a source-labeled indicator when a tool-result image is attached to the outgoing request.
- Optional (
should priority): global --no-mcp-media CLI kill-switch for incident response.
.local/testing/playbooks/mcp-media-passthrough.md — new playbook: opt-in round-trip, Sandboxed-override check, oversized/malformed rejection, cascade vision-tier routing (mirroring P2's mandatory live-session test), persistence-exclusion verification, --migrate-config idempotency, --init walkthrough..local/testing/coverage-status.md — new rows (all Untested initially) for: MCP media opt-in gating, MediaSanitizer validation classes, ephemeral persistence strip, vision-tier routing gate, migrate/init wiring.CHANGELOG.md [Unreleased] — entry for the opt-in feature and the config-shape change.docs/src/ — if a user-facing MCP configuration chapter exists, document media_passthrough and [mcp.media].- A separate follow-up (do not do it in this PR): add an MCP-media asset/attack-tree entry to
specs/069-threat-model/spec.md — spec-069 is a living document with its own review cadence, out of scope here. File this as its own P3/P4 research-tier issue when P3 lands, referencing this line.
Acceptance criteria
AC-10, AC-11 (full, spec.md §6). --migrate-config and --init covered by golden-file/integration tests. Playbook + coverage-status rows exist and are linked from the PR description. Full "Before Creating a PR" checklist (.claude/rules/branching.md) passes.
Suggested next step
Run /rust-agents:team-develop new-feature on this issue after #6240 (P2) merges — this phase is purely additive config/CLI/TUI/docs surface, no security-critical logic, likely a good candidate for the reduced chain (skip architect, start at developer) once the concrete config-shape from P2 is known.
Spec
See
specs/072-multimodal-mcp-passthrough/plan.md§"P3 — Config Surface, CLI, TUI, Migration, Docs (PR 4)". Parent issue: #6229. Depends on P2 (#6240) merging first.Summary
Complete the mandatory integration points (CLAUDE.md "Development Rules" / invariant #12) for the MCP image passthrough feature:
--initwizard,--migrate-configstep, TUI status indicator, playbook + coverage-status rows, docs, CHANGELOG.Scope (from plan.md, full deliverable list has exact file references)
src/init/mcp.rs— per-server wizard prompt: "Enable image passthrough for this server?", default No.crates/zeph-config/src/migrate/mod.rs— new migration step addingmedia_passthrough = falseand[mcp.media]defaults to existing configs (use the next available step number — check current max at implementation time, do not hardcode from the spec).MediaSanitizer::sanitize_image'sspawn_blockingdecode (e.g. "Decoding MCP image…") and a source-labeled indicator when a tool-result image is attached to the outgoing request.shouldpriority): global--no-mcp-mediaCLI kill-switch for incident response..local/testing/playbooks/mcp-media-passthrough.md— new playbook: opt-in round-trip, Sandboxed-override check, oversized/malformed rejection, cascade vision-tier routing (mirroring P2's mandatory live-session test), persistence-exclusion verification,--migrate-configidempotency,--initwalkthrough..local/testing/coverage-status.md— new rows (allUntestedinitially) for: MCP media opt-in gating,MediaSanitizervalidation classes, ephemeral persistence strip, vision-tier routing gate, migrate/init wiring.CHANGELOG.md [Unreleased]— entry for the opt-in feature and the config-shape change.docs/src/— if a user-facing MCP configuration chapter exists, documentmedia_passthroughand[mcp.media].specs/069-threat-model/spec.md— spec-069 is a living document with its own review cadence, out of scope here. File this as its own P3/P4 research-tier issue when P3 lands, referencing this line.Acceptance criteria
AC-10, AC-11 (full, spec.md §6).
--migrate-configand--initcovered by golden-file/integration tests. Playbook + coverage-status rows exist and are linked from the PR description. Full "Before Creating a PR" checklist (.claude/rules/branching.md) passes.Suggested next step
Run
/rust-agents:team-develop new-featureon this issue after #6240 (P2) merges — this phase is purely additive config/CLI/TUI/docs surface, no security-critical logic, likely a good candidate for the reduced chain (skip architect, start at developer) once the concrete config-shape from P2 is known.