geny-executor 2.40.0__tar.gz → 2.41.0__tar.gz

{geny_executor-2.40.0 → geny_executor-2.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: geny-executor
-Version: 2.40.0
+Version: 2.41.0
 Summary: Harness-engineered agent pipeline library with 21-stage dual-abstraction architecture, built on the Anthropic API
 Project-URL: Homepage, https://github.com/CocoRoF/geny-executor
 Project-URL: Repository, https://github.com/CocoRoF/geny-executor

{geny_executor-2.40.0 → geny_executor-2.41.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "geny-executor"
-version = "2.40.0"
+version = "2.41.0"
 description = "Harness-engineered agent pipeline library with 21-stage dual-abstraction architecture, built on the Anthropic API"
 readme = "README.md"
 license = "Apache-2.0"

{geny_executor-2.40.0 → geny_executor-2.41.0}/src/geny_executor/stages/s01_input/artifact/default/normalizers.py

@@ -210,25 +210,36 @@ class MultimodalNormalizer(InputNormalizer):
             block["_meta"] = meta
         return block
 
+    # Anthropic PDF limit is ~32MB request size; stay safely under it.
+    _PDF_MAX_BYTES = 24 * 1024 * 1024
+
     def _make_file_block(self, file: Dict[str, Any]) -> Dict[str, Any]:
         """Convert any accepted shape into a canonical file block.
 
-        TODO (P1+): PDF 등을 Anthropic ``document`` 블록으로 직접 매핑.
-        텍스트 추출 / OCR / 청크 분할 등 본격적인 파일 파이프라인 구현.
-        지금은 metadata 만 보존하고 ``to_message_content()`` 에서 메타데이터
-        텍스트로 노출된다.
+        PDFs referenced by a local ``file://`` URI (or absolute path) are
+        loaded and base64-attached here so ``to_blocks()`` can emit a native
+        Anthropic ``document`` block — the model reads the actual PDF instead
+        of a ``[attached file: …]`` placeholder. Other formats keep the
+        metadata-only shape (hosts hand those to the agent's file tools).
         """
+        mime = (
+            file.get("mime_type")
+            or file.get("media_type")
+            or file.get("mimeType")
+            or "application/octet-stream"
+        )
+        data = file.get("data") or file.get("base64")
+        url = file.get("url")
+        if mime == "application/pdf" and not data and url:
+            resolved = _resolve_local_image_source(url)  # generic local-file reader
+            if resolved is not None and len(resolved[0]) <= self._PDF_MAX_BYTES:
+                data = base64.b64encode(resolved[0]).decode("ascii")
         return {
             "type": "file",
             "name": file.get("name") or file.get("filename"),
-            "mime_type": (
-                file.get("mime_type")
-                or file.get("media_type")
-                or file.get("mimeType")
-                or "application/octet-stream"
-            ),
-            "url": file.get("url"),
-            "data": file.get("data") or file.get("base64"),
+            "mime_type": mime,
+            "url": url,
+            "data": data,
             "size": file.get("size"),
             "sha256": file.get("sha256"),
             "attachment_id": file.get("attachment_id"),

{geny_executor-2.40.0 → geny_executor-2.41.0}/src/geny_executor/stages/s01_input/types.py

@@ -78,11 +78,25 @@ class NormalizedInput:
         for img in self.images:
             blocks.append(img)
         for f in self.files:
-            # TODO: PDF 등을 Anthropic ``document`` block 으로 매핑하고
-            # 본문 추출 (PyPDF, OCR 등) 후 text 블록으로 인라인하는 경로
-            # 추가. 현재는 메타데이터를 텍스트로 노출만 한다.
             name = f.get("name") or f.get("filename") or "unnamed"
             mime = f.get("mime_type") or f.get("media_type") or "application/octet-stream"
+            data = f.get("data")
+            if mime == "application/pdf" and data:
+                # Native Anthropic ``document`` block — the model reads the PDF
+                # itself (the normalizer base64-loads local PDFs).
+                blocks.append(
+                    {
+                        "type": "document",
+                        "source": {
+                            "type": "base64",
+                            "media_type": "application/pdf",
+                            "data": data,
+                        },
+                    }
+                )
+                continue
+            # Other formats: metadata placeholder — hosts route the real bytes
+            # to the agent's file tools (e.g. a staged workspace copy).
             blocks.append(
                 {
                     "type": "text",

{geny_executor-2.40.0 → geny_executor-2.41.0}/src/geny_executor/tools/built_in/__init__.py

@@ -52,6 +52,12 @@ from geny_executor.tools.built_in.operator_tools import (
     SendUserFileTool,
 )
 from geny_executor.tools.built_in.read_tool import ReadTool
+from geny_executor.tools.built_in.workspace_tools import (
+    SandboxFetchTool,
+    SandboxInfoTool,
+    SandboxPutTool,
+    WorkspaceInfoTool,
+)
 from geny_executor.tools.built_in.cron_tools import (
     CronCreateTool,
     CronDeleteTool,
@@ -123,6 +129,10 @@ BUILT_IN_TOOL_CLASSES: Dict[str, Type[Tool]] = {
     "Config": ConfigTool,
     "Monitor": MonitorTool,
     "SendUserFile": SendUserFileTool,
+    "WorkspaceInfo": WorkspaceInfoTool,
+    "SandboxInfo": SandboxInfoTool,
+    "SandboxPut": SandboxPutTool,
+    "SandboxFetch": SandboxFetchTool,
     "SendMessage": SendMessageTool,
     "CronCreate": CronCreateTool,
     "CronDelete": CronDeleteTool,
@@ -173,6 +183,9 @@ BUILT_IN_TOOL_FEATURES: Dict[str, List[str]] = {
     "worktree": ["EnterWorktree", "ExitWorktree"],
     "dev": ["LSP", "REPL", "Brief"],
     "operator": ["Config", "Monitor", "SendUserFile"],
+    # The session's two file spaces: inspect the host-side files workspace,
+    # check the sandbox, and move files between them.
+    "workspace": ["WorkspaceInfo", "SandboxInfo", "SandboxPut", "SandboxFetch"],
     "messaging": ["SendMessage"],
     "cron": ["CronCreate", "CronDelete", "CronList"],
     "environment": ["env"],
@@ -280,6 +293,10 @@ __all__ = [
     "ExitPlanModeTool",
     "EnvTool",
     "SandboxExecTool",
+    "WorkspaceInfoTool",
+    "SandboxInfoTool",
+    "SandboxPutTool",
+    "SandboxFetchTool",
     "BUILT_IN_TOOL_CLASSES",
     "BUILT_IN_TOOL_FEATURES",
     "get_builtin_tools",

geny_executor-2.41.0/src/geny_executor/tools/built_in/workspace_tools.py

@@ -0,0 +1,336 @@
+"""Workspace ↔ Sandbox tools — inspect the session's two file spaces and move
+files between them.
+
+Every session has up to two distinct spaces:
+
+* **Files workspace** — the host-side session storage (``ToolContext.
+  storage_path``). Owned by the framework/host built-in tools (file reads,
+  document editing, user file delivery). It is NOT an execution environment —
+  agents must not treat it as a system to configure.
+* **Sandbox** — an optional isolated container (``ToolContext.sandbox``,
+  mounted at a workdir, conventionally ``/workspace``). The agent's free
+  environment: install packages, run services, build projects.
+
+The system prompt carries only a short manifest of these spaces; the tools
+here provide the concrete state on demand (progressive disclosure):
+
+* ``WorkspaceInfo``  — list the files workspace (summary or subtree)
+* ``SandboxInfo``    — is a sandbox attached? workdir + top-level contents
+* ``SandboxPut``     — copy a file: files workspace → sandbox
+* ``SandboxFetch``   — copy a file: sandbox → files workspace
+
+Transfers stream through the existing ``_sandbox`` primitives (docker exec,
+binary-safe) and are path-guarded to the session storage on the host side.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from geny_executor.tools.base import Tool, ToolCapabilities, ToolResult
+
+DEFAULT_SANDBOX_WORKDIR = "/workspace"
+MAX_TRANSFER_BYTES = 50 * 1024 * 1024  # docker-exec stdin/stdout transfers
+_MAX_ENTRIES = 300
+
+
+def _err(code: str, message: str) -> ToolResult:
+    return ToolResult(content={"error": code, "message": message}, is_error=True)
+
+
+def _storage_root(context) -> Optional[Path]:
+    sp = getattr(context, "storage_path", None)
+    return Path(sp).resolve() if sp else None
+
+
+def _guarded(root: Path, path: str) -> Path:
+    p = Path(path)
+    target = (p if p.is_absolute() else root / p).resolve()
+    target.relative_to(root)  # raises ValueError on escape
+    return target
+
+
+class WorkspaceInfoTool(Tool):
+    """Inspect the session's files workspace (host-side session storage)."""
+
+    @property
+    def name(self) -> str:
+        return "WorkspaceInfo"
+
+    @property
+    def description(self) -> str:
+        return (
+            "List the session's files workspace (host-side storage for user "
+            "uploads, document drafts, and delivered outputs — not an execution "
+            "environment). No path → top-level summary; pass path (e.g. "
+            "'workspace/uploads') for a subtree listing."
+        )
+
+    @property
+    def input_schema(self) -> Dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string", "description": "Subdirectory to list (default: top-level summary)"},
+                "max_entries": {"type": "integer", "description": "Cap on listed files (default 100)"},
+            },
+        }
+
+    def capabilities(self, input):
+        return ToolCapabilities(concurrency_safe=True)
+
+    async def execute(self, input, context):
+        root = _storage_root(context)
+        if root is None or not root.is_dir():
+            return _err("NO_STORAGE", "This session has no storage_path.")
+        sub = (input.get("path") or "").strip()
+        cap = min(int(input.get("max_entries") or 100), _MAX_ENTRIES)
+        try:
+            base = _guarded(root, sub) if sub else root
+        except ValueError:
+            return _err("PATH_ESCAPE", f"Path escapes the session storage: {sub}")
+        if not base.exists():
+            return _err("NOT_FOUND", f"No such directory: {sub or '/'}")
+
+        if not sub:
+            # Top-level summary: per-directory file count + size, root files.
+            dirs: List[Dict[str, Any]] = []
+            files: List[Dict[str, Any]] = []
+            for entry in sorted(base.iterdir()):
+                if entry.name.startswith("."):
+                    continue
+                if entry.is_dir():
+                    count = 0
+                    size = 0
+                    for f in entry.rglob("*"):
+                        if f.is_file():
+                            count += 1
+                            try:
+                                size += f.stat().st_size
+                            except OSError:
+                                pass
+                    dirs.append({"dir": entry.name + "/", "files": count, "bytes": size})
+                elif entry.is_file():
+                    files.append({"file": entry.name, "bytes": entry.stat().st_size})
+            return ToolResult(content={
+                "root": str(root),
+                "directories": dirs,
+                "files": files[:cap],
+                "hint": "Pass path='<dir>' for a subtree listing.",
+            })
+
+        listing: List[Dict[str, Any]] = []
+        truncated = False
+        for f in sorted(base.rglob("*")):
+            if not f.is_file() or f.name.startswith("."):
+                continue
+            if len(listing) >= cap:
+                truncated = True
+                break
+            try:
+                listing.append({
+                    "path": f.relative_to(root).as_posix(),
+                    "bytes": f.stat().st_size,
+                })
+            except OSError:
+                continue
+        return ToolResult(content={
+            "root": str(root), "path": sub, "files": listing, "truncated": truncated,
+        })
+
+
+class SandboxInfoTool(Tool):
+    """Report whether an isolated sandbox is attached + its top-level contents."""
+
+    @property
+    def name(self) -> str:
+        return "SandboxInfo"
+
+    @property
+    def description(self) -> str:
+        return (
+            "Check the session's sandbox (isolated container — your free "
+            "environment for installs/builds/services). Reports whether one is "
+            "attached and lists the top of its workdir."
+        )
+
+    @property
+    def input_schema(self) -> Dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "workdir": {"type": "string", "description": f"Sandbox workdir (default {DEFAULT_SANDBOX_WORKDIR})"},
+            },
+        }
+
+    def capabilities(self, input):
+        return ToolCapabilities(concurrency_safe=True)
+
+    async def execute(self, input, context):
+        sandbox = getattr(context, "sandbox", None)
+        if sandbox is None:
+            return ToolResult(content={
+                "attached": False,
+                "note": "No sandbox is bound to this session — only the files "
+                        "workspace is available (see WorkspaceInfo).",
+            })
+        workdir = (input.get("workdir") or DEFAULT_SANDBOX_WORKDIR).strip()
+        from geny_executor.tools._sandbox import sb_run
+
+        try:
+            rc, out, err = await sb_run(sandbox, "ls -la", workdir=workdir, timeout_s=20)
+        except Exception as exc:  # noqa: BLE001
+            return ToolResult(content={
+                "attached": True, "workdir": workdir, "reachable": False,
+                "error": str(exc)[:300],
+            })
+        return ToolResult(content={
+            "attached": True,
+            "workdir": workdir,
+            "reachable": rc == 0,
+            "listing": (out if rc == 0 else err)[:2000],
+        })
+
+
+class SandboxPutTool(Tool):
+    """Copy a file from the files workspace into the sandbox."""
+
+    @property
+    def name(self) -> str:
+        return "SandboxPut"
+
+    @property
+    def description(self) -> str:
+        return (
+            "Copy a file from the session's files workspace (host storage) INTO "
+            "the sandbox container. source is relative to the session storage "
+            "(e.g. 'workspace/uploads/data.csv'); dest is a sandbox path "
+            "(default: same basename in the sandbox workdir)."
+        )
+
+    @property
+    def input_schema(self) -> Dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "source": {"type": "string", "description": "File path in the files workspace"},
+                "dest": {"type": "string", "description": "Target path inside the sandbox (optional)"},
+                "workdir": {"type": "string", "description": f"Sandbox workdir (default {DEFAULT_SANDBOX_WORKDIR})"},
+            },
+            "required": ["source"],
+        }
+
+    def capabilities(self, input):
+        return ToolCapabilities(concurrency_safe=False)
+
+    async def execute(self, input, context):
+        sandbox = getattr(context, "sandbox", None)
+        if sandbox is None:
+            return _err("NO_SANDBOX", "No sandbox is bound to this session.")
+        root = _storage_root(context)
+        if root is None:
+            return _err("NO_STORAGE", "This session has no storage_path.")
+        try:
+            src = _guarded(root, input["source"])
+        except ValueError:
+            return _err("PATH_ESCAPE", f"source escapes the session storage: {input['source']}")
+        if not src.is_file():
+            return _err("NOT_FOUND", f"source not found: {input['source']}")
+        size = src.stat().st_size
+        if size > MAX_TRANSFER_BYTES:
+            return _err("TOO_LARGE", f"{size} bytes exceeds the {MAX_TRANSFER_BYTES}-byte transfer cap.")
+
+        workdir = (input.get("workdir") or DEFAULT_SANDBOX_WORKDIR).strip()
+        dest = (input.get("dest") or src.name).strip()
+        from geny_executor.tools._sandbox import container_path, sb_write_bytes
+
+        try:
+            written = await sb_write_bytes(sandbox, dest, src.read_bytes(), workdir=workdir)
+        except Exception as exc:  # noqa: BLE001
+            return _err("TRANSFER_FAILED", str(exc)[:300])
+        return ToolResult(content={
+            "copied": True,
+            "source": src.relative_to(root).as_posix(),
+            "sandbox_path": container_path(dest, workdir),
+            "bytes": written,
+        })
+
+
+class SandboxFetchTool(Tool):
+    """Copy a file from the sandbox into the files workspace."""
+
+    @property
+    def name(self) -> str:
+        return "SandboxFetch"
+
+    @property
+    def description(self) -> str:
+        return (
+            "Copy a file FROM the sandbox container into the session's files "
+            "workspace (host storage) — e.g. to deliver a build artifact to the "
+            "user (SendUserFile) or preview it in the Canvas. source is a sandbox "
+            "path; dest is relative to the session storage (default: "
+            "'workspace/outputs/<basename>')."
+        )
+
+    @property
+    def input_schema(self) -> Dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "source": {"type": "string", "description": "File path inside the sandbox"},
+                "dest": {"type": "string", "description": "Target path in the files workspace (optional)"},
+                "workdir": {"type": "string", "description": f"Sandbox workdir (default {DEFAULT_SANDBOX_WORKDIR})"},
+            },
+            "required": ["source"],
+        }
+
+    def capabilities(self, input):
+        return ToolCapabilities(concurrency_safe=False)
+
+    async def execute(self, input, context):
+        sandbox = getattr(context, "sandbox", None)
+        if sandbox is None:
+            return _err("NO_SANDBOX", "No sandbox is bound to this session.")
+        root = _storage_root(context)
+        if root is None:
+            return _err("NO_STORAGE", "This session has no storage_path.")
+
+        workdir = (input.get("workdir") or DEFAULT_SANDBOX_WORKDIR).strip()
+        source = input["source"]
+        from geny_executor.tools._sandbox import sb_read_bytes
+
+        try:
+            data = await sb_read_bytes(sandbox, source, workdir=workdir)
+        except FileNotFoundError:
+            return _err("NOT_FOUND", f"sandbox file not found: {source}")
+        except Exception as exc:  # noqa: BLE001
+            return _err("TRANSFER_FAILED", str(exc)[:300])
+        if len(data) > MAX_TRANSFER_BYTES:
+            return _err("TOO_LARGE", f"{len(data)} bytes exceeds the {MAX_TRANSFER_BYTES}-byte transfer cap.")
+
+        basename = Path(source).name or "fetched"
+        dest_rel = (input.get("dest") or f"workspace/outputs/{basename}").strip()
+        try:
+            dest = _guarded(root, dest_rel)
+        except ValueError:
+            return _err("PATH_ESCAPE", f"dest escapes the session storage: {dest_rel}")
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_bytes(data)
+        return ToolResult(content={
+            "copied": True,
+            "source": source,
+            "workspace_path": dest.relative_to(root).as_posix(),
+            "bytes": len(data),
+        })
+
+
+__all__ = [
+    "WorkspaceInfoTool",
+    "SandboxInfoTool",
+    "SandboxPutTool",
+    "SandboxFetchTool",
+    "DEFAULT_SANDBOX_WORKDIR",
+    "MAX_TRANSFER_BYTES",
+]

geny_executor-2.41.0/tests/unit/test_workspace_tools.py

@@ -0,0 +1,153 @@
+"""Unit tests for the Workspace ↔ Sandbox tools + s01 PDF document blocks."""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+import geny_executor.tools._sandbox as sb_mod
+from geny_executor.stages.s01_input.artifact.default.normalizers import MultimodalNormalizer
+from geny_executor.tools.built_in.workspace_tools import (
+    SandboxFetchTool,
+    SandboxInfoTool,
+    SandboxPutTool,
+    WorkspaceInfoTool,
+)
+
+
+def _ctx(storage: str | None, sandbox=None):
+    return SimpleNamespace(storage_path=storage, sandbox=sandbox, working_dir=storage or ".")
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+# ── WorkspaceInfo ────────────────────────────────────────────────────
+
+
+def test_workspace_info_summary_and_subtree(tmp_path):
+    (tmp_path / "workspace/uploads").mkdir(parents=True)
+    (tmp_path / "workspace/uploads/a.txt").write_text("hello")
+    (tmp_path / "workspace/outputs").mkdir(parents=True)
+    (tmp_path / "workspace/outputs/b.bin").write_bytes(b"12345678")
+    (tmp_path / "note.md").write_text("root file")
+
+    tool = WorkspaceInfoTool()
+    summary = _run(tool.execute({}, _ctx(str(tmp_path)))).content
+    assert any(d["dir"] == "workspace/" for d in summary["directories"])
+    assert any(f["file"] == "note.md" for f in summary["files"])
+
+    sub = _run(tool.execute({"path": "workspace"}, _ctx(str(tmp_path)))).content
+    paths = {f["path"] for f in sub["files"]}
+    assert paths == {"workspace/uploads/a.txt", "workspace/outputs/b.bin"}
+
+
+def test_workspace_info_guards(tmp_path):
+    tool = WorkspaceInfoTool()
+    res = _run(tool.execute({"path": "../../etc"}, _ctx(str(tmp_path))))
+    assert res.is_error and res.content["error"] == "PATH_ESCAPE"
+    res2 = _run(tool.execute({}, _ctx(None)))
+    assert res2.is_error and res2.content["error"] == "NO_STORAGE"
+
+
+# ── Sandbox transfer (fake sandbox via monkeypatched primitives) ────
+
+
+class _FakeSandboxFS:
+    """In-memory 'container' filesystem keyed by resolved container path."""
+
+    def __init__(self):
+        self.files: dict[str, bytes] = {}
+
+
+@pytest.fixture()
+def fake_sandbox(monkeypatch):
+    fs = _FakeSandboxFS()
+
+    async def fake_write(sandbox, path, data, *, workdir):
+        fs.files[sb_mod.container_path(path, workdir)] = data
+        return len(data)
+
+    async def fake_read(sandbox, path, *, workdir):
+        cpath = sb_mod.container_path(path, workdir)
+        if cpath not in fs.files:
+            raise FileNotFoundError(path)
+        return fs.files[cpath]
+
+    monkeypatch.setattr(sb_mod, "sb_write_bytes", fake_write)
+    monkeypatch.setattr(sb_mod, "sb_read_bytes", fake_read)
+    return fs
+
+
+def test_sandbox_put_and_fetch_roundtrip(tmp_path, fake_sandbox):
+    (tmp_path / "workspace/uploads").mkdir(parents=True)
+    src = tmp_path / "workspace/uploads/data.csv"
+    src.write_bytes(b"a,b\n1,2\n")
+    ctx = _ctx(str(tmp_path), sandbox=object())
+
+    put = _run(SandboxPutTool().execute({"source": "workspace/uploads/data.csv"}, ctx))
+    assert not put.is_error, put.content
+    assert put.content["sandbox_path"] == "/workspace/data.csv"
+    assert fake_sandbox.files["/workspace/data.csv"] == b"a,b\n1,2\n"
+
+    # mutate in the "sandbox", then fetch back to the default outputs path
+    fake_sandbox.files["/workspace/result.csv"] = b"a,b\n9,9\n"
+    fetch = _run(SandboxFetchTool().execute({"source": "result.csv"}, ctx))
+    assert not fetch.is_error, fetch.content
+    assert fetch.content["workspace_path"] == "workspace/outputs/result.csv"
+    assert (tmp_path / "workspace/outputs/result.csv").read_bytes() == b"a,b\n9,9\n"
+
+
+def test_sandbox_tools_require_sandbox(tmp_path):
+    ctx = _ctx(str(tmp_path), sandbox=None)
+    assert _run(SandboxPutTool().execute({"source": "x"}, ctx)).content["error"] == "NO_SANDBOX"
+    assert _run(SandboxFetchTool().execute({"source": "x"}, ctx)).content["error"] == "NO_SANDBOX"
+    info = _run(SandboxInfoTool().execute({}, ctx)).content
+    assert info["attached"] is False
+
+
+def test_sandbox_fetch_dest_guard(tmp_path, fake_sandbox):
+    fake_sandbox.files["/workspace/evil"] = b"x"
+    ctx = _ctx(str(tmp_path), sandbox=object())
+    res = _run(SandboxFetchTool().execute({"source": "evil", "dest": "../../etc/passwd"}, ctx))
+    assert res.is_error and res.content["error"] == "PATH_ESCAPE"
+
+
+# ── s01 PDF → Anthropic document block ──────────────────────────────
+
+
+def test_pdf_file_becomes_document_block(tmp_path):
+    pdf = tmp_path / "doc.pdf"
+    pdf_bytes = b"%PDF-1.4 fake"
+    pdf.write_bytes(pdf_bytes)
+
+    norm = MultimodalNormalizer().normalize({
+        "text": "read this",
+        "attachments": [{
+            "kind": "file", "name": "doc.pdf",
+            "mime_type": "application/pdf", "url": f"file://{pdf}",
+        }],
+    })
+    blocks = norm.to_message_content()
+    doc = [b for b in blocks if b.get("type") == "document"]
+    assert len(doc) == 1
+    assert doc[0]["source"]["media_type"] == "application/pdf"
+    assert base64.b64decode(doc[0]["source"]["data"]) == pdf_bytes
+    # no placeholder text block for the PDF
+    assert not any("[attached file" in b.get("text", "") for b in blocks if b.get("type") == "text")
+
+
+def test_non_pdf_file_keeps_placeholder(tmp_path):
+    norm = MultimodalNormalizer().normalize({
+        "text": "hi",
+        "files": [{"name": "deck.pptx",
+                   "mime_type": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+                   "url": "file:///nonexistent/deck.pptx"}],
+    })
+    blocks = norm.to_message_content()
+    assert any("[attached file: deck.pptx" in b.get("text", "") for b in blocks if b.get("type") == "text")