This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryAdded ability to paste images into the board terminal via Ctrl+V.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Daemon validates MIME type by sniffing magic bytes, not trusting client claim. Daemon validates MIME type by sniffing magic bytes, not trusting client claim. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds ability to paste an image into board terminal via Ctrl+V. Adds ability to paste an image into board terminal via Ctrl+V. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Pastes image file path into terminal pane like a keystroke; requires manual Enter to submit. Pastes image file path into terminal pane like a keystroke; requires manual Enter to submit. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Writes pasted images to `tmp/fleetdeck-pastes/` with owner‑only permissions. Writes pasted images to `tmp/fleetdeck-pastes/` with owner‑only permissions. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Automatically deletes pasted image files after 24 hours. Automatically deletes pasted image files after 24 hours. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Refactor | Low |
Implements `/api/paste-image` endpoint for base64 image upload with CSRF protection. Implements `/api/paste-image` endpoint for base64 image upload with CSRF protection. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Paste a screenshot into the board terminal. Ctrl+V an image into a live pane and its file path lands in the agent's composer — you press Enter. This is the one image hand-off that works in a browser terminal, where the clipboard is yours and the shell is not: the board lifts the blob off the clipboard, the daemon writes it to disk, and the path is typed into the pane like any keystroke.
Nothing to configure. Copy an image, open a pane, Ctrl+V.
Added
- Paste an image into the board terminal. Ctrl+V a screenshot into a live pane and it lands in the agent's composer — something no terminal connection can do by itself, because the image lives in the browser's clipboard and the wire only carries text (and Claude Code has no Linux clipboard-image read to hand it to anyway). The board now does what a terminal cannot: it lifts the blob off the clipboard, ships it to the daemon (
POST /api/paste-image, base64-in-JSON so both CSRF walls keep standing), the daemon sniffs the magic bytes (png/jpeg/gif/webp — the client's mime claim is never trusted), writes the file owner-only undertmp/fleetdeck-pastes/, and the board types the path into the pane through the same stdin gate as every keystroke. Which means the grid's one-tile-types discipline governs pastes too, and the paste never submits on its own — you read the path, you press Enter. Text paste is untouched: a clipboard with no image falls through to xterm exactly as before. Pasted files are pruned after 24 hours; the image is read the moment you submit, so nothing of value lives there.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Fleet Deck
All releases →Related context
Beta — feedback welcome: [email protected]