ios: bound assistant image sets and keep output tools quiet

ios/Packages/Sybil/Sources/Sybil/SybilAgentAttachments.swift

@@ -105,9 +105,10 @@ extension Message {
               let info = metadata?.objectValue,
               let entries = info["agentAttachments"]?.arrayValue else { return [] }
         if role == .assistant {
-            guard info["kind"]?.stringValue == "message", info["status"]?.stringValue == "complete" else { return [] }
+            guard info["kind"]?.stringValue == "message", info["status"]?.stringValue == "complete",
+                  entries.count <= 8 else { return [] }
         }
-        return entries.compactMap { entry in
+        let attachments: [AgentAttachment] = entries.compactMap { entry in
             // Inspect the original JSON before Codable can discard unknown fields. Output
             // descriptors are deliberately path/URL-free; legacy user uploads stay compatible.
             if role == .assistant {
@@ -120,6 +121,14 @@ extension Message {
                   (try? attachment.validate()) != nil else { return nil }
             return attachment
         }
+        if role == .assistant {
+            // Reject the entire output set, including partially invalid arrays. The
+            // count and per-image bounds above also bound this aggregate calculation.
+            guard attachments.count == entries.count,
+                  Set(attachments.map(\.id)).count == attachments.count,
+                  attachments.reduce(0, { $0 + $1.sizeBytes }) <= 32 * 1024 * 1024 else { return [] }
+        }
+        return attachments
     }
 }
 

ios/Packages/Sybil/Sources/Sybil/SybilAgentModels.swift

@@ -239,7 +239,7 @@ struct AgentPresentation {
     private(set) var suppressed = false
     private(set) var busySince: Date?
     private var seenTools: Set<String> = []
-    static let quietTools: Set<String> = ["user_message", "notify_parent", "clock_wait", "event_decision"]
+    static let quietTools: Set<String> = ["user_message", "output_image", "notify_parent", "clock_wait", "event_decision"]
 
     mutating func receive(_ event: AgentEvent, before: AgentRoomState, after: AgentRoomState, replay: Bool, now: Date) {
         switch event {