fix: isolate visual tool failures from agent runs

tkmind-proxy.mjs

@@ -7,7 +7,10 @@ import { Agent, fetch as undiciFetch } from 'undici';
 import { resolveBillingTokenState } from './billing-token-state.mjs';
 import { appendBalanceEvent, createSseBillingTransform } from './sse-billing.mjs';
 import { finalizeSessionStreamEvent, writeSseErrorAndEnd } from './sse-event-taxonomy.mjs';
-import { developerToolsFromPolicy } from './capabilities.mjs';
+import {
+  developerToolsFromPolicy,
+  withoutSessionImageRead,
+} from './capabilities.mjs';
 import { evaluateProxyRequest, isNativeH5ApiPath } from './policies.mjs';
 import {
   buildPublicUrl,
@@ -1426,10 +1429,14 @@ export function createTkmindProxy({
       workingDir,
       sessionPolicy = null,
       recipe = null,
+      disableImageReading = false,
     } = {},
   ) {
     const resolvedWorkingDir = workingDir ?? await userAuth.resolveWorkingDir(userId);
-    const resolvedSessionPolicy = sessionPolicy ?? await userAuth.getAgentSessionPolicy(userId);
+    const baseSessionPolicy = sessionPolicy ?? await userAuth.getAgentSessionPolicy(userId);
+    const resolvedSessionPolicy = disableImageReading
+      ? withoutSessionImageRead(baseSessionPolicy)
+      : baseSessionPolicy;
     const startTarget = await pickTarget();
     const upstream = await apiFetch(startTarget, apiSecret, '/agent/start', {
       method: 'POST',
@@ -1452,7 +1459,7 @@ export function createTkmindProxy({
     }
     await rememberSessionTarget(session.id, startTarget);
     await sessionStore.registerAgentSession(userId, session.id, startTarget);
-    const sessionScopedPolicy =
+    const baseSessionScopedPolicy =
       typeof userAuth.getAgentSessionPolicy ===
       'function'
         ? await userAuth.getAgentSessionPolicy(
@@ -1466,6 +1473,9 @@ export function createTkmindProxy({
             },
           )
         : resolvedSessionPolicy;
+    const sessionScopedPolicy = disableImageReading
+      ? withoutSessionImageRead(baseSessionScopedPolicy)
+      : baseSessionScopedPolicy;
     if (sessionScopedPolicy?.gooseMode) {
       const modeRes = await apiFetch(startTarget, apiSecret, '/agent/update_session', {
         method: 'POST',
@@ -1622,17 +1632,25 @@ export function createTkmindProxy({
   async function reconcileSessionPolicyForUser(
     userId,
     sessionId,
-    { toolMode = 'chat', query = null, forceDeepReasoning = false } = {},
+    {
+      toolMode = 'chat',
+      query = null,
+      forceDeepReasoning = false,
+      disableImageReading = false,
+    } = {},
   ) {
     if (!userId || !sessionId) return;
     const target = await resolveTarget(sessionId);
     const workingDir = await userAuth.resolveWorkingDir(userId);
-    const sessionPolicy =
+    const baseSessionPolicy =
       await getSessionPolicyForToolMode(
         userId,
         toolMode,
         sessionId,
       );
+    const sessionPolicy = disableImageReading
+      ? withoutSessionImageRead(baseSessionPolicy)
+      : baseSessionPolicy;
     const publishLayout = await userAuth.getUserPublishLayout(userId);
     const userMemories = await resolveUserMemories(userId, {
       sessionId,
@@ -1769,6 +1787,7 @@ export function createTkmindProxy({
       toolMode = 'chat',
       forceDeepReasoning = false,
       requireHistoricalImageIsolation = false,
+      disableImageReading = false,
     } = {},
   ) {
     if (!userId || !sessionId) throw new Error('缺少会话信息');
@@ -1813,6 +1832,7 @@ export function createTkmindProxy({
       toolMode,
       query: firstUserText(userMessage),
       forceDeepReasoning,
+      disableImageReading,
     });
     await applySessionLlmProvider(sessionId);
     await repairSessionToolHistory(sessionId);
@@ -1929,14 +1949,19 @@ export function createTkmindProxy({
     sessionId,
     requestId,
     userMessage,
-    { toolMode = 'chat', forceDeepReasoning = false, timeoutMs = 15 * 60 * 1000 } = {},
+    {
+      toolMode = 'chat',
+      forceDeepReasoning = false,
+      timeoutMs = 15 * 60 * 1000,
+      disableImageReading = false,
+    } = {},
   ) {
     const { body, target } = await prepareSessionReplyBody(
       userId,
       sessionId,
       requestId,
       userMessage,
-      { toolMode, forceDeepReasoning },
+      { toolMode, forceDeepReasoning, disableImageReading },
     );
     const eventsResponse = await apiFetch(
       target,