@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0-beta.1

package/dist/tool-system/builtin/drive-claude-code.js

@@ -2,7 +2,14 @@ import { runAgentOnce } from "../../cc-orchestrator/external-agent-driver.js";
 import { claudeAdapter, codexAdapter } from "../../cc-orchestrator/agent-adapter.js";
 import { backgroundJobRegistry } from "./background-jobs.js";
 import { readExternalChangedFiles } from "../../cc-orchestrator/external-agent-changes.js";
+import { isExistingDirectory, normalizeCwdPath } from "../../cc-orchestrator/cwd-normalize.js";
 import { notificationQueue } from "./agent-notifications.js";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve, sep } from "node:path";
+import { externalAgentSessionStore, } from "../../cc-orchestrator/external-agent-session-store.js";
+import { logger } from "../../logging/logger.js";
+export const DRIVE_AGENT_FOREGROUND_HANDOFF_MS = 110_000;
+export const DRIVE_AGENT_TOOL_TIMEOUT_MS = 1_800_000;
 const CLI_ADAPTERS = {
     claude: { adapter: claudeAdapter, command: "claude" },
     codex: { adapter: codexAdapter, command: "codex" },
@@ -35,32 +42,248 @@ export const driveAgentToolDef = {
     inputSchema: {
         type: "object",
         properties: {
-            prompt: { type: "string", description: "The task for the agent. Make it COMPLETE and self-contained: state the goal, a concrete definition of done, and (for open-ended work) an explicit scope bound so it finishes end-to-end and verifies its own work rather than sprawling or stopping half-way." },
-            cli: { type: "string", enum: ["claude", "codex"], description: "Which external CLI to drive. 'claude' = Claude Code (default), 'codex' = OpenAI Codex. resumeSessionId is only valid against the same cli that produced it." },
-            resumeSessionId: { type: "string", description: "Existing session id to resume (keeps context). Must come from a prior run of the SAME cli. Omit for a fresh session." },
+            prompt: {
+                type: "string",
+                description: "The task for the agent. Make it COMPLETE and self-contained: state the goal, a concrete definition of done, and (for open-ended work) an explicit scope bound so it finishes end-to-end and verifies its own work rather than sprawling or stopping half-way.",
+            },
+            cli: {
+                type: "string",
+                enum: ["claude", "codex"],
+                description: "Which external CLI to drive. 'claude' = Claude Code (default), 'codex' = OpenAI Codex. resumeSessionId is only valid against the same cli that produced it.",
+            },
+            resumeSessionId: {
+                type: "string",
+                description: "Existing session id to resume (keeps context). Must come from a prior run of the SAME cli. Omit for a fresh session.",
+            },
             cwd: { type: "string", description: "Working directory the run operates in." },
-            permissionMode: { type: "string", enum: ["default", "acceptEdits", "bypassPermissions"], description: "Permission/sandbox level. Defaults to 'bypassPermissions' (full auto — needed so the agent's tools run unattended; there is no interactive approval loop here). For codex: default→read-only sandbox, acceptEdits→workspace-write, bypassPermissions→no sandbox. Pass 'default'/'acceptEdits' to gate." },
-            background: { type: "boolean", description: "Defaults to TRUE: run in the background and notify you on completion (right for long tasks). Pass false to run in the foreground and get the result inline (only for quick tasks)." },
+            attachmentPaths: {
+                type: "array",
+                items: { type: "string" },
+                description: "Optional local file paths to hand to the driven agent. Paths must resolve inside cwd. Images are also passed to Codex with -i when the installed Codex CLI supports it; otherwise all paths are listed in the prompt.",
+            },
+            permissionMode: {
+                type: "string",
+                enum: ["default", "acceptEdits", "bypassPermissions"],
+                description: "Permission/sandbox level. Defaults to 'bypassPermissions' (full auto — needed so the agent's tools run unattended; there is no interactive approval loop here). For codex: default→read-only sandbox, acceptEdits→workspace-write, bypassPermissions→no sandbox. Pass 'default'/'acceptEdits' to gate.",
+            },
+            background: {
+                type: "boolean",
+                description: "Defaults to TRUE: run in the background and notify you on completion (right for long tasks). Pass false to run in the foreground and get the result inline (only for quick tasks).",
+            },
         },
         required: ["prompt", "cwd"],
     },
 };
 const defaultRunner = (opts) => {
     const { adapter, command } = CLI_ADAPTERS[opts.cli];
-    return runAgentOnce(adapter, { command, prompt: opts.prompt, resumeSessionId: opts.resumeSessionId, cwd: opts.cwd, permissionMode: opts.permissionMode ?? "default" });
+    return runAgentOnce(adapter, {
+        command,
+        prompt: opts.prompt,
+        resumeSessionId: opts.resumeSessionId,
+        cwd: opts.cwd,
+        permissionMode: opts.permissionMode ?? "default",
+        imagePaths: opts.imagePaths,
+    }, opts.signal);
 };
+function newDriveJobId() {
+    return `cc-${process.hrtime.bigint().toString(36)}`;
+}
+function isValidSessionId(sessionId) {
+    return typeof sessionId === "string" && sessionId.length > 0;
+}
+function argSignal(args) {
+    const signal = args.__signal;
+    return signal &&
+        typeof signal === "object" &&
+        typeof signal.aborted === "boolean" &&
+        typeof signal.addEventListener === "function"
+        ? signal
+        : undefined;
+}
+function startRun(runner, opts) {
+    return Promise.resolve().then(() => runner(opts));
+}
+function resolveAttachmentPaths(raw, cwd) {
+    if (raw === undefined)
+        return { paths: [] };
+    if (!Array.isArray(raw))
+        return { paths: [], error: "attachmentPaths must be an array of strings" };
+    const cwdReal = realpathSync(cwd);
+    const paths = [];
+    for (const item of raw) {
+        if (typeof item !== "string" || !item.trim()) {
+            return { paths: [], error: "attachmentPaths must contain only non-empty strings" };
+        }
+        const candidate = isAbsolute(item) ? item : resolve(cwd, item);
+        if (!existsSync(candidate))
+            return { paths: [], error: `attachment path not found: ${item}` };
+        const real = realpathSync(candidate);
+        const rel = relative(cwdReal, real);
+        if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`)) {
+            return { paths: [], error: `attachment path is outside cwd: ${item}` };
+        }
+        const info = statSync(real);
+        if (!info.isFile())
+            return { paths: [], error: `attachment path is not a file: ${item}` };
+        paths.push(real);
+    }
+    return { paths };
+}
+const DRIVE_IMAGE_EXTS = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp"]);
+function appendAttachmentPrompt(prompt, paths) {
+    if (paths.length === 0)
+        return prompt;
+    const lines = ["", "Attached files:"];
+    for (const path of paths) {
+        const kind = DRIVE_IMAGE_EXTS.has(extname(path).toLowerCase()) ? "image" : "file";
+        lines.push(`- ${path} (${kind})`);
+    }
+    return `${prompt}\n${lines.join("\n")}`;
+}
+function recordSuccessfulSession(store, cli, cwd, result) {
+    if (result.isError || !result.sessionId)
+        return;
+    try {
+        store.record({ cli, sessionId: result.sessionId, cwd });
+    }
+    catch (err) {
+        logger.warn("drive_agent.session_binding_record_failed", {
+            cat: "cc",
+            cli,
+            sessionId: result.sessionId,
+            cwd,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+function duplicateCwdWarning(cwd, writable) {
+    if (!writable)
+        return undefined;
+    const running = backgroundJobRegistry.listRunningByCwd(cwd);
+    if (running.length === 0)
+        return undefined;
+    const ids = running.map((j) => j.jobId).join(", ");
+    return `Warning: another DriveAgent job is already running in cwd ${cwd} (jobId ${ids}). Concurrent writable agents in the same directory can overwrite each other's work.`;
+}
+function attachDriveCompletion(params) {
+    const { jobId, sessionId, label, cli, cwd, run, sessionStore } = params;
+    void run
+        .then((r) => {
+        recordSuccessfulSession(sessionStore, cli, cwd, r);
+        // Deliver the result back so the woken agent actually sees the answer
+        // (not just "a job finished"). Mirrors the video/sub-agent completion
+        // path — enqueue lands in the same notificationQueue the wakeup drains.
+        notificationQueue.enqueue(r.isError
+            ? {
+                agentId: jobId,
+                description: label,
+                status: "failed",
+                workKind: "cc",
+                error: r.finalText || "(no output)",
+                ccSessionId: r.sessionId || undefined,
+                enqueuedAt: Date.now(),
+            }
+            : {
+                agentId: jobId,
+                description: label,
+                status: "completed",
+                workKind: "cc",
+                finalText: r.finalText,
+                ccSessionId: r.sessionId || undefined,
+                enqueuedAt: Date.now(),
+            }, sessionId);
+        // Attribute the files the external agent changed by parsing its own
+        // transcript (#6) — those Edit/Write calls are invisible to the host's
+        // in-session aggregator. Best-effort; [] on any failure.
+        const changedFiles = r.sessionId ? readExternalChangedFiles(cli, cwd, r.sessionId) : [];
+        // Retain the job in the panel with its result + the external CLI
+        // session id + changed files.
+        backgroundJobRegistry.finish(jobId, {
+            status: r.isError ? "failed" : "completed",
+            finalText: r.finalText || undefined,
+            ccSessionId: r.sessionId || undefined,
+            ...(changedFiles.length ? { changedFiles } : {}),
+        });
+    })
+        .catch((err) => {
+        const msg = err?.message ?? String(err);
+        notificationQueue.enqueue({
+            agentId: jobId,
+            description: label,
+            status: "failed",
+            workKind: "cc",
+            error: msg,
+            enqueuedAt: Date.now(),
+        }, sessionId);
+        backgroundJobRegistry.finish(jobId, { status: "failed", finalText: msg });
+    });
+}
+function trackBackgroundRun(params) {
+    const warning = duplicateCwdWarning(params.cwd, params.writable);
+    const jobId = newDriveJobId();
+    backgroundJobRegistry.start(jobId, params.sessionId, params.label, { cwd: params.cwd });
+    attachDriveCompletion({ ...params, jobId });
+    return { jobId, ...(warning ? { warning } : {}) };
+}
+async function waitForForegroundOrHandoff(run, handoffMs) {
+    if (handoffMs < 0) {
+        return { kind: "completed", result: await run };
+    }
+    let timer;
+    try {
+        return await Promise.race([
+            run.then((result) => ({ kind: "completed", result })),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve({ kind: "handoff" }), handoffMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 /** Factory so tests can inject a fake runner. `fixedCli` (back-compat) forces a
  *  cli and hides the `cli` arg — that's how DriveClaudeCode stays a thin alias. */
-export function makeDriveAgentTool(runner = defaultRunner, fixedCli) {
+export function makeDriveAgentTool(runner = defaultRunner, fixedCli, options = {}) {
     return async (args, ctx) => {
         const prompt = typeof args.prompt === "string" ? args.prompt : "";
-        const cwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
+        const rawRequestedCwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
+        const requestedCwd = normalizeCwdPath(rawRequestedCwd);
         if (!prompt)
             return "Error: prompt is required";
-        const cli = fixedCli ?? (args.cli === "codex" ? "codex" : args.cli === "claude" || args.cli === undefined ? "claude" : "invalid");
+        const cli = fixedCli ??
+            (args.cli === "codex"
+                ? "codex"
+                : args.cli === "claude" || args.cli === undefined
+                    ? "claude"
+                    : "invalid");
         if (cli === "invalid")
             return `Error: unknown cli "${String(args.cli)}" (expected "claude" or "codex")`;
         const resumeSessionId = typeof args.resumeSessionId === "string" ? args.resumeSessionId : undefined;
+        const sessionStore = options.sessionStore ?? externalAgentSessionStore;
+        let cwd = requestedCwd;
+        let resumeNote = "";
+        if (resumeSessionId) {
+            const binding = sessionStore.get(cli, resumeSessionId);
+            if (binding) {
+                const storedCwd = normalizeCwdPath(binding.cwd);
+                if (!isExistingDirectory(storedCwd)) {
+                    return `Error: cannot resume ${cli} session ${resumeSessionId}: stored cwd no longer exists or is not a directory: ${storedCwd}`;
+                }
+                if (storedCwd !== requestedCwd) {
+                    cwd = storedCwd;
+                    resumeNote = `Note: resume session ${resumeSessionId} is bound to stored cwd ${storedCwd}; ignoring requested cwd ${requestedCwd}.`;
+                    logger.info("drive_agent.resume_forced_stored_cwd", {
+                        cat: "cc",
+                        cli,
+                        sessionId: resumeSessionId,
+                        requestedCwd,
+                        storedCwd,
+                    });
+                }
+            }
+        }
         // Default to bypassPermissions: this tool is a fire-one-turn delegation to
         // an external CLI with nobody watching for approvals, and there is no
         // interactive approval loop here — so under "default" a tool that needs
@@ -73,8 +296,27 @@ export function makeDriveAgentTool(runner = defaultRunner, fixedCli) {
             args.permissionMode === "bypassPermissions"
             ? args.permissionMode
             : "bypassPermissions";
+        const resolvedAttachmentPaths = resolveAttachmentPaths(args.attachmentPaths, cwd);
+        if (resolvedAttachmentPaths.error)
+            return `Error: ${resolvedAttachmentPaths.error}`;
+        const attachmentPaths = resolvedAttachmentPaths.paths;
+        const promptWithAttachments = appendAttachmentPrompt(prompt, attachmentPaths);
+        const imagePaths = cli === "codex"
+            ? attachmentPaths.filter((path) => DRIVE_IMAGE_EXTS.has(extname(path).toLowerCase()))
+            : [];
         const cliName = cli === "codex" ? "Codex" : "Claude Code";
         const label = `DriveAgent(${cli}): ${prompt.slice(0, 40)}`;
+        const runOpts = {
+            cli,
+            prompt: promptWithAttachments,
+            resumeSessionId,
+            cwd,
+            permissionMode,
+            signal: ctx?.signal ?? argSignal(args),
+            imagePaths,
+        };
+        const foregroundHandoffMs = options.foregroundHandoffMs ?? DRIVE_AGENT_FOREGROUND_HANDOFF_MS;
+        const isWritableRun = permissionMode !== "default";
         // Background by default (these tasks are typically long). Only an explicit
         // background:false runs in the foreground and returns the result inline.
         const background = args.background !== false;
@@ -87,42 +329,49 @@ export function makeDriveAgentTool(runner = defaultRunner, fixedCli) {
             if (typeof sessionId !== "string" || sessionId.length === 0) {
                 return `Error: cannot start a background ${cliName} job without a session — its result notification would be dropped. Retry with background:false, or ensure the tool runs inside a session.`;
             }
-            const jobId = `cc-${process.hrtime.bigint().toString(36)}`;
-            backgroundJobRegistry.start(jobId, sessionId, label);
-            void runner({ cli, prompt, resumeSessionId, cwd, permissionMode })
-                .then((r) => {
-                // Deliver the result back so the woken agent actually sees the answer
-                // (not just "a job finished"). Mirrors the video/sub-agent completion
-                // path — enqueue lands in the same notificationQueue the wakeup drains.
-                notificationQueue.enqueue(r.isError
-                    ? { agentId: jobId, description: label, status: "failed", workKind: "cc", error: r.finalText || "(no output)", ccSessionId: r.sessionId || undefined, enqueuedAt: Date.now() }
-                    : { agentId: jobId, description: label, status: "completed", workKind: "cc", finalText: r.finalText, ccSessionId: r.sessionId || undefined, enqueuedAt: Date.now() }, sessionId);
-                // Attribute the files the external agent changed by parsing its own
-                // transcript (#6) — those Edit/Write calls are invisible to the host's
-                // in-session aggregator. Best-effort; [] on any failure.
-                const changedFiles = r.sessionId
-                    ? readExternalChangedFiles(cli, cwd, r.sessionId)
-                    : [];
-                // Retain the job in the panel with its result + the external CLI
-                // session id + changed files.
-                backgroundJobRegistry.finish(jobId, {
-                    status: r.isError ? "failed" : "completed",
-                    finalText: r.finalText || undefined,
-                    ccSessionId: r.sessionId || undefined,
-                    ...(changedFiles.length ? { changedFiles } : {}),
-                });
-            })
-                .catch((err) => {
-                const msg = err?.message ?? String(err);
-                notificationQueue.enqueue({ agentId: jobId, description: label, status: "failed", workKind: "cc", error: msg, enqueuedAt: Date.now() }, sessionId);
-                backgroundJobRegistry.finish(jobId, { status: "failed", finalText: msg });
+            const tracked = trackBackgroundRun({
+                sessionId,
+                label,
+                cli,
+                cwd,
+                run: startRun(runner, runOpts),
+                sessionStore,
+                writable: isWritableRun,
+            });
+            return [
+                resumeNote,
+                `已在后台启动 ${cliName}（jobId ${tracked.jobId}）。完成后会通知你结果，无需轮询。`,
+                tracked.warning,
+            ]
+                .filter(Boolean)
+                .join("\n");
+        }
+        const run = startRun(runner, runOpts);
+        const result = await waitForForegroundOrHandoff(run, foregroundHandoffMs);
+        if (result.kind === "handoff" && isValidSessionId(ctx?.sessionId)) {
+            const tracked = trackBackgroundRun({
+                sessionId: ctx.sessionId,
+                label,
+                cli,
+                cwd,
+                run,
+                sessionStore,
+                writable: isWritableRun,
             });
-            return `已在后台启动 ${cliName}（jobId ${jobId}）。完成后会通知你结果，无需轮询。`;
+            return [
+                resumeNote,
+                `${cliName} foreground run exceeded ${foregroundHandoffMs}ms; moved it to background (jobId ${tracked.jobId}). Completion will notify this session, so do not poll.`,
+                tracked.warning,
+            ]
+                .filter(Boolean)
+                .join("\n");
         }
-        const r = await runner({ cli, prompt, resumeSessionId, cwd, permissionMode });
+        const r = result.kind === "completed" ? result.result : await run;
+        recordSuccessfulSession(sessionStore, cli, cwd, r);
+        const prefix = resumeNote ? `${resumeNote}\n` : "";
         if (r.isError)
-            return `${cliName} 运行出错（session ${r.sessionId}）：\n${r.finalText}`;
-        return `${cliName} 完成（session ${r.sessionId}）：\n${r.finalText}`;
+            return `${prefix}${cliName} 运行出错（session ${r.sessionId}）：\n${r.finalText}`;
+        return `${prefix}${cliName} 完成（session ${r.sessionId}）：\n${r.finalText}`;
     };
 }
 export const driveAgentTool = makeDriveAgentTool();
@@ -134,24 +383,29 @@ export const driveClaudeCodeToolDef = {
     name: "DriveClaudeCode",
     description: "(Alias of DriveAgent with cli:claude.) Delegate a task to the external Claude Code CLI " +
         "(drives `claude` for one turn). Prefer DriveAgent for new calls; this name is kept for " +
-        "compatibility. " + driveAgentToolDef.description,
+        "compatibility. " +
+        driveAgentToolDef.description,
     inputSchema: {
         type: "object",
         properties: {
             // intentionally omit `cli` — this alias is always claude
             prompt: driveAgentToolDef.inputSchema.properties.prompt,
-            resumeSessionId: { type: "string", description: "Existing CC session id to resume (keeps context). Omit for a fresh session." },
+            resumeSessionId: {
+                type: "string",
+                description: "Existing CC session id to resume (keeps context). Omit for a fresh session.",
+            },
             cwd: driveAgentToolDef.inputSchema.properties.cwd,
+            attachmentPaths: driveAgentToolDef.inputSchema.properties.attachmentPaths,
             permissionMode: driveAgentToolDef.inputSchema.properties.permissionMode,
             background: driveAgentToolDef.inputSchema.properties.background,
         },
         required: ["prompt", "cwd"],
     },
 };
-export function makeDriveClaudeCodeTool(runner) {
+export function makeDriveClaudeCodeTool(runner, options) {
     const generic = runner
-        ? ({ prompt, resumeSessionId, cwd, permissionMode }) => runner({ prompt, resumeSessionId, cwd, permissionMode })
+        ? ({ prompt, resumeSessionId, cwd, permissionMode, signal }) => runner({ prompt, resumeSessionId, cwd, permissionMode, signal })
         : undefined;
-    return makeDriveAgentTool(generic ?? defaultRunner, "claude");
+    return makeDriveAgentTool(generic ?? defaultRunner, "claude", options);
 }
 export const driveClaudeCodeTool = makeDriveClaudeCodeTool();

package/dist/tool-system/builtin/edit.js

@@ -3,6 +3,7 @@
  */
 import { readFile, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
 import { fileCache } from "./file-cache.js";
 import { detectEol, toLf, applyEol } from "./eol.js";
 export const editToolDef = {
@@ -32,11 +33,11 @@ export const editToolDef = {
     },
 };
 export async function editTool(args, ctx) {
-    const filePath = args.file_path;
+    const rawPath = args.file_path;
     const oldString = args.old_string;
     const newString = args.new_string;
     const replaceAll = args.replace_all ?? false;
-    if (!filePath)
+    if (!rawPath)
         return "Error: file_path is required";
     if (oldString === undefined)
         return "Error: old_string is required";
@@ -44,6 +45,8 @@ export async function editTool(args, ctx) {
         return "Error: new_string is required";
     if (oldString === newString)
         return "Error: old_string and new_string must be different";
+    const cwd = ctx?.cwd ?? process.cwd();
+    const filePath = isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
     if (!existsSync(filePath))
         return `Error: File not found: ${filePath}`;
     try {

package/dist/tool-system/builtin/generate-video.d.ts

@@ -18,6 +18,7 @@ import type { ToolDefinition } from "../../types.js";
 import type { ToolContext } from "../context.js";
 import { type VideoProvider, type VideoProviderCreds } from "./video-providers.js";
 import { type ImageUploader, type UploaderCreds } from "./image-uploader.js";
+export declare function __resolveLocalImageInputForTests(pathOrUrl: string, cwd: string): string;
 /**
  * Normalize image inputs (URLs or local paths) into public URLs the provider
  * can consume. `images[]` wins over the single `image`. Local paths are

package/dist/tool-system/builtin/generate-video.js

@@ -15,17 +15,22 @@
  * "no video provider configured" message) rather than half-working.
  */
 import { writeFile, mkdir } from "node:fs/promises";
-import { join } from "node:path";
+import { isAbsolute, join, resolve } from "node:path";
 import { SettingsManager } from "../../settings/manager.js";
 import { notificationQueue } from "./agent-notifications.js";
 import { backgroundJobRegistry } from "./background-jobs.js";
 import { logger } from "../../logging/logger.js";
 import { getVideoProvider, DEFAULT_VIDEO_MODEL, } from "./video-providers.js";
-import { getImageUploader } from "./image-uploader.js";
+import { getImageUploader, isHttpUrl } from "./image-uploader.js";
 import { effectiveApiKey } from "./generate-image.js";
 import { getMergedCatalog, findCatalogEntry } from "../../model-catalog/index.js";
 import { genInstancesFromConnections } from "../../model-catalog/gen-connections.js";
 const MAX_IMAGES = 9;
+export function __resolveLocalImageInputForTests(pathOrUrl, cwd) {
+    if (isHttpUrl(pathOrUrl))
+        return pathOrUrl;
+    return isAbsolute(pathOrUrl) ? pathOrUrl : resolve(cwd, pathOrUrl);
+}
 /**
  * Normalize image inputs (URLs or local paths) into public URLs the provider
  * can consume. `images[]` wins over the single `image`. Local paths are
@@ -230,9 +235,13 @@ export async function generateVideoTool(args, ctx) {
     const sessionId = ctx?.sessionId;
     const preferKind = typeof args.provider === "string" && args.provider ? args.provider : undefined;
     const overrideModel = typeof args.model === "string" && args.model ? args.model : undefined;
-    const image = typeof args.image === "string" && args.image ? args.image : undefined;
+    const image = typeof args.image === "string" && args.image
+        ? __resolveLocalImageInputForTests(args.image, cwd)
+        : undefined;
     const imagesArg = Array.isArray(args.images)
-        ? args.images.filter((x) => typeof x === "string")
+        ? args.images
+            .filter((x) => typeof x === "string")
+            .map((x) => __resolveLocalImageInputForTests(x, cwd))
         : undefined;
     // videos pass through verbatim to fal's video_urls (no upload) — http(s) only.
     const videosArg = Array.isArray(args.videos)

package/dist/tool-system/builtin/index.d.ts

@@ -19,13 +19,18 @@ import type { ToolVisibilityContext } from "../context.js";
  * registry 会把它放进 ToolResult.contentBlocks。可选的 `result` 字段是给
  * transcript / 摘要用的纯文本镜像。沙箱执行类工具(Bash 等)可返回
  * `{ result, sandbox }`,registry 把 sandbox 透传到 ToolResult.sandbox 供 UI 显示。
+ * 敏感结果可返回 `{ result, sensitive, displayResult, transcriptResult }`;
+ * `result` 仅供当前模型轮使用,显示/持久化路径必须使用占位字段。
  */
 export type BuiltinToolResult = string | {
     contentBlocks: import("../../types.js").ContentBlock[];
     result?: string;
 } | {
     result: string;
-    sandbox: import("../../types.js").ToolResult["sandbox"];
+    sandbox?: import("../../types.js").ToolResult["sandbox"];
+    sensitive?: boolean;
+    displayResult?: string;
+    transcriptResult?: string;
 };
 export type BuiltinToolFn = (args: Record<string, unknown>, ctx?: import("../context.js").ToolContext) => Promise<BuiltinToolResult>;
 export type BuiltinToolGuard = (ctx: ToolVisibilityContext) => boolean;
@@ -41,5 +46,5 @@ export declare const BUILTIN_TOOLS: BuiltinTool[];
  * Keyed by the tool's `name` (must match the toolDef name).
  */
 export declare const BUILTIN_TOOL_GUARDS: Map<string, BuiltinToolGuard>;
-/** UseCredential is available when the cwd's CredentialStore has ≥1 credential. */
-export declare function isUseCredentialAvailable(cwd: string): boolean;
+/** UseCredential is available when the cwd's credential metadata has ≥1 entry. */
+export declare function isUseCredentialAvailable(cwd: string, settingsScope?: import("../../settings/manager.js").SettingsScope): boolean;