fix(skills,daemon): forward sanitized MCP image result blocks to the model

[anconina]

Description

The MCP tool bridge kept only text content from a tool result, so a server that returns a screenshot (or any image block) left the agent with "Tool returned no text content" and no image. This forwards MCP image result blocks to the model, sanitized and bounded.

• Route image content blocks from MCP tool results through the same sharp-backed sanitizer that browser screenshots use.
• Consider at most four image blocks per call — bounding sanitizer work, not just kept output — and keep text parts first.
• Prefix a runtime-authored notice that the frames are untrusted tool output.
• Report every dropped block (sanitizer rejection, limit, unreadable data, no image policy configured) content-free and by name in the result, so the agent never mistakes a dropped frame for an empty result.
• The daemon wires the image policy through a small helper (setup-tools-mcp-images.ts) so the composition root stays under the file-size cap and the errorKind literal resolves for the log-payload gate.
• Documented under "Image results" in the MCP guide.

Commits are test-first and this PR is intended for rebase-merge to keep the pair:

1. test(skills): expose MCP image result blocks dropped by the tool bridge — failing tests on the pre-patch bridge.
2. fix(skills,daemon): forward sanitized MCP image result blocks to the model — the production patch.

Related Issue

N/A: no tracking issue exists — the defect was found while designing the computer-use integration (MCP servers that return screenshots were silently reduced to "Tool returned no text content"). This PR is the first record of it.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactor

Checklist

• Targeted checks for the changed area pass (packages/skills bridge tests 88/88; packages/daemon setup-tools-mcp-images.test.ts 2/2)
• Full repository validation passes (pnpm validate — ran green as the pre-push hook on the rebased head 9959e0b4)
• New or changed behavior has a test that demonstrated the RED state before the production change
• Documentation updated (MCP guide, "Image results")
• No secrets or credentials committed
• Security implications considered (images pass through the existing screenshot sanitizer; frames are labelled untrusted tool output; per-call block cap bounds sanitizer work; drops are reported content-free)
• The change is focused on one concern and states the allowed N/A reason above

RED Test Proof

Run at the test-only commit 8a469dee (before the production patch), packages/skills:

 FAIL  src/skills/bridge/mcp-tool-bridge.test.ts > mcpToolsToAgentTools > execute() replaces the silent image drop with a disabled-images notice when no image policy is configured
AssertionError: expected 'Tool returned no text content' to be '1 image block not attached: 1 image t…' // Object.is equality
 FAIL  src/skills/bridge/mcp-tool-bridge.test.ts > mcpToolsToAgentTools image results > execute() attaches a sanitized image block after the notice when the server returns only an image
AssertionError: expected [ { type: 'text', …(1) } ] to deeply equal [ { type: 'text', …(1) }, …(1) ]
 FAIL  src/skills/bridge/mcp-tool-bridge.test.ts > mcpToolsToAgentTools image results > execute() keeps wrapped text first, then the notice, then the image block for mixed results
AssertionError: expected [ 'text' ] to deeply equal [ 'text', 'text', 'image' ]
 FAIL  src/skills/bridge/mcp-tool-bridge.test.ts > mcpToolsToAgentTools image results > execute() drops images the sanitizer rejects and reports content-free facts through onImageDropped
AssertionError: expected [ { type: 'text', …(1) } ] to deeply equal [ { type: 'text', …(1) } ]
 FAIL  src/skills/bridge/mcp-tool-bridge.test.ts > mcpToolsToAgentTools image results > execute() records the attached image block count in the result-shape diagnostic
AssertionError: expected "vi.fn()" to be called with arguments: [ ObjectContaining{…}, …(1) ]

 Test Files  1 failed (1)
      Tests  5 failed | 75 passed (80)

After the production patch (9959e0b4): Test Files 2 passed (2), Tests 88 passed (88).

Evidence and Residual Risk

• Contribution path: integration (MCP tool results → model context)
• Evidence level: deterministic test (unit tests over the bridge and the daemon wiring helper)
• Tested profile: macOS, unit tests only; no live MCP server or provider run in this PR
• Residual risk: not proven live against a real screenshot-returning MCP server or against a provider's actual image-input limits; the four-block cap and sanitizer limits are asserted in tests, not measured under a live session.

Additional Notes

ci.yml only runs for PRs into main, so the gate for this PR into release/1.0.64-prep is the local pnpm validate pre-push hook (green on the pushed head).

🤖 Generated with Claude Code