The read_image poisoning fix had no end-to-end guard because scenarios could
only send text. Add an upload_images step that renders and uploads visually
distinct images, let chat steps attach them the same way the WeChat channel
does, and assert the generated page actually embeds every upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Image turns already get a vision-model description injected into the prompt,
but the agent kept calling read_image to "confirm" the pictures. Those tool
results carry base64 image parts that Goose persists, so every later turn
against the text-only chat provider failed with `unknown variant image_url`
before the agent could write the page. WeChat page requests therefore fell
through to the fail-closed delivery message.
Drop read_image for the turn whenever a vision model handles the images, say
so explicitly in the injected prompt, and teach the poison scan to recognise
tool image parts so already-polluted sessions rotate instead of failing again.
Co-authored-by: Cursor <cursoragent@cursor.com>
john