feat: add bounded file byte reads

internal/api/app.go

@@ -876,6 +876,21 @@ func (a *App) ReadVaultTextFile(pluginID, relativePath string) (string, string)
 	return text, ""
 }
 
+// ReadVaultFileBytes reads a bounded regular file as base64 for a plugin with files.read.
+func (a *App) ReadVaultFileBytes(pluginID, relativePath string) (corefiles.FileBytes, string) {
+	if _, err := a.requirePluginAccess(pluginID, "files.read"); err != nil {
+		return corefiles.FileBytes{}, err.Error()
+	}
+	if a.files == nil {
+		return corefiles.FileBytes{}, "files service not initialized"
+	}
+	data, err := a.files.ReadVaultFileBytes(relativePath)
+	if err != nil {
+		return corefiles.FileBytes{}, err.Error()
+	}
+	return data, ""
+}
+
 // WriteVaultTextFile atomically writes a UTF-8 text file for a plugin with files.write.
 func (a *App) WriteVaultTextFile(pluginID, relativePath string, content string, options corefiles.WriteOptions) string {
 	if _, err := a.requirePluginAccess(pluginID, "files.write"); err != nil {

internal/api/app_test.go

@@ -360,11 +360,29 @@ func TestFilesBridgeReadWriteListMoveTrash(t *testing.T) {
 		t.Fatalf("text = %q", text)
 	}
 
+	if err := os.WriteFile(filepath.Join(root, "Docs", "image.png"), []byte{0x89, 0x50, 0x4e, 0x47}, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	bytesResult, errStr := app.ReadVaultFileBytes("files.plugin", "Docs/image.png")
+	if errStr != "" {
+		t.Fatalf("ReadVaultFileBytes: %s", errStr)
+	}
+	if bytesResult.RelativePath != "Docs/image.png" || bytesResult.MimeHint != "image/png" || bytesResult.DataBase64 != "iVBORw==" {
+		t.Fatalf("bytes result = %+v", bytesResult)
+	}
+
 	entries, errStr := app.ListVaultFiles("files.plugin", "Docs")
 	if errStr != "" {
 		t.Fatalf("ListVaultFiles: %s", errStr)
 	}
-	if len(entries) != 1 || entries[0].RelativePath != "Docs/one.txt" {
+	hasOne := false
+	for _, entry := range entries {
+		if entry.RelativePath == "Docs/one.txt" {
+			hasOne = true
+			break
+		}
+	}
+	if !hasOne {
 		t.Fatalf("entries = %+v", entries)
 	}
 
@@ -594,6 +612,12 @@ func TestFilesBridgePermissions(t *testing.T) {
 			call:       func(app *App) string { _, errStr := app.ReadVaultTextFile("files.plugin", "one.txt"); return errStr },
 			wantPhrase: "files.read",
 		},
+		{
+			name:       "read bytes requires read",
+			perms:      []string{"files.write", "files.delete"},
+			call:       func(app *App) string { _, errStr := app.ReadVaultFileBytes("files.plugin", "one.txt"); return errStr },
+			wantPhrase: "files.read",
+		},
 		{
 			name:  "write requires write",
 			perms: []string{"files.read", "files.delete"},