Review only: Amy patch stack on v2026.6.19

agent/anthropic_adapter.py

@@ -1767,18 +1767,15 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
     # dropped, leaving thinking signatures and tool_use id/name/input intact.
     ordered_blocks = m.get("anthropic_content_blocks")
     if isinstance(ordered_blocks, list) and ordered_blocks:
-        # Re-source each tool_use input from the stored tool_calls map rather
-        # than the captured block. The ordered-blocks list captures tool_use
-        # input from the RAW API response (normalize_response), which is NOT
-        # credential-redacted; tool_calls[].function.arguments IS redacted at
-        # storage time (build_assistant_message, #19798). Replaying the raw
-        # block input would resurrect a secret the model inlined into a tool
-        # call (e.g. terminal(command="curl -H 'Authorization: Bearer sk-...'")
-        # onto the wire, even though the same value is redacted everywhere else
-        # in history. Keying by sanitized tool id preserves interleave order
-        # (the reason this channel exists) while swapping in the redacted
-        # input. Adapted from #36071 (replay-time tool-input re-sourcing).
-        redacted_input_by_id: Dict[str, Any] = {}
+        # Re-source each tool_use input from the canonical replayable
+        # tool_calls map rather than the separately captured ordered block.
+        # build_assistant_message preserves these arguments byte-exactly because
+        # masking them poisons subsequent turns and resumed sessions. This means
+        # credentials in tool arguments are also persisted raw; at-rest security
+        # belongs to state-file permissions/encryption, not destructive replay
+        # mutation. Keying by sanitized tool id preserves interleave order while
+        # keeping one canonical argument copy (upstream #43083 / PR #54136).
+        replay_input_by_id: Dict[str, Any] = {}
         for tc in m.get("tool_calls", []) or []:
             if not isinstance(tc, dict):
                 continue
@@ -1788,19 +1785,16 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
                 parsed_args = json.loads(raw_args) if isinstance(raw_args, str) else raw_args
             except (json.JSONDecodeError, ValueError):
                 parsed_args = {}
-            redacted_input_by_id[_sanitize_tool_id(tc.get("id", ""))] = parsed_args
+            replay_input_by_id[_sanitize_tool_id(tc.get("id", ""))] = parsed_args
         replayed: List[Dict[str, Any]] = []
         for b in ordered_blocks:
             clean = _sanitize_replay_block(b)
             if clean is None:
                 continue
             if clean.get("type") == "tool_use":
-                # Override raw (un-redacted) input with the redacted copy when
-                # we have one for this id; fall back to the sanitized block
-                # input only if the tool_call is missing (shape mismatch).
-                redacted = redacted_input_by_id.get(clean.get("id", ""))
-                if redacted is not None:
-                    clean["input"] = redacted
+                canonical_input = replay_input_by_id.get(clean.get("id", ""))
+                if canonical_input is not None:
+                    clean["input"] = canonical_input
             replayed.append(clean)
         if replayed:
             return {"role": "assistant", "content": replayed}
@@ -1894,6 +1888,32 @@ def _convert_tool_message_to_result(
                 if text_content else list(stashed)
             )
 
+    # inject_image returns a JSON marker containing base64 image bytes.  Native
+    # Anthropic can receive that as an image block inside the tool_result while
+    # still keeping a compact textual status around it.
+    if multimodal_blocks is None and isinstance(content, str) and '"_inject_image"' in content:
+        try:
+            parsed_result = json.loads(content)
+            if isinstance(parsed_result, dict) and isinstance(parsed_result.get("_inject_image"), dict):
+                img = parsed_result["_inject_image"]
+                media_type = img.get("media_type")
+                data = img.get("data")
+                if isinstance(media_type, str) and media_type.startswith("image/") and isinstance(data, str) and data:
+                    text = parsed_result.get("message") or "Image injected into native multimodal context."
+                    multimodal_blocks = [
+                        {"type": "text", "text": str(text)},
+                        {
+                            "type": "image",
+                            "source": {
+                                "type": "base64",
+                                "media_type": media_type,
+                                "data": data,
+                            },
+                        },
+                    ]
+        except (json.JSONDecodeError, TypeError, KeyError):
+            pass
+
     if multimodal_blocks:
         result_content: Any = multimodal_blocks
     elif isinstance(content, str):