SaladDay · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/apps/daemon/internal/agent/claudesdk/functions.go b/apps/daemon/internal/agent/claudesdk/functions.go
@@ -104,14 +104,6 @@ func (s *session) SubmitFunctionResult(ctx context.Context, result proto.Functio
 	if err := result.ValidateContent(); err != nil {
 		return err
 	}
-	for _, part := range result.Content {
-		if part.Type == "input_image" && !result.Success {
-			return fmt.Errorf("claudesdk: native error results cannot retain images")
-		}
-	}
-	if err := (proto.MessageInput{{Content: result.Content}}).ValidateInlineImages(); err != nil {
-		return err
-	}
 	data, err := json.Marshal(struct {
 		Type   string `json:"type"`
 		TurnID string `json:"turn_id"`

diff --git a/apps/daemon/internal/agent/claudesdk/functions_test.go b/apps/daemon/internal/agent/claudesdk/functions_test.go
@@ -51,11 +51,6 @@ func TestFunctionFactoryNativeReceipts(t *testing.T) {
 					if err := submitter.SubmitFunctionResult(ctx, invalid); err == nil {
 						t.Fatal("missing content consumed call")
 					}
-					image := "https://example.invalid/image"
-					invalid.Content = []proto.InputContent{{Type: "input_image", ImageURL: &image}}
-					if err := submitter.SubmitFunctionResult(ctx, invalid); err == nil {
-						t.Fatal("image should fail before delivery")
-					}
 					first, second := "first-"+call.CallID, "second-"+call.CallID
 					value := proto.FunctionResultPayload{DeliveryID: "delivery-" + call.CallID, CallID: call.CallID, Success: call.CallID == "b", Content: []proto.InputContent{{Type: "input_text", Text: &first}, {Type: "input_text", Text: &second}}}
 					go func() { submissions <- submitter.SubmitFunctionResult(ctx, value) }()

diff --git a/contracts/agents-api/harness-capabilities.md b/contracts/agents-api/harness-capabilities.md
@@ -21,8 +21,7 @@ Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted
 | Text Turns, active input, cancellation, restart and continuation | Verified on all placements | Verified on all placements | Verified on all placements |
 | [Files and Artifacts](./environment-files.md) | Verified: hosted, self-hosted | Verified: hosted, self-hosted | Verified: hosted, self-hosted |
 | [Whitespace-only message text](./message-content.md) | Admitted; delivered unchanged | Rejected | Rejected |
-| [Inline PNG and JPEG message images](./message-content.md) | Verified on all placements | Verified on all placements | Rejected |
-| Remote image URLs | Rejected | Rejected | Rejected |
+| [Message images](./message-content.md#images) | PNG and JPEG data URLs: verified on all placements; other data URLs: admitted; remote URLs: rejected | PNG and JPEG data URLs: verified on all placements; remote URLs and GIF and WebP data URLs: admitted | Rejected |
 | `reasoning.effort` | `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`: admitted | `low`, `medium`, `high`, `xhigh`, `max`: admitted | Rejected |
 | `reasoning.summary` | `concise`, `detailed`, `auto`: admitted | Rejected | Rejected |
 | `service_tier` other than `auto` | `default`, `flex`, `priority`: admitted | Rejected | Rejected |
@@ -36,7 +35,7 @@ Native model parameters and provider protocols per Harness are in [model executi
 | Operation | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | [Public functions](./execution-tools.md#functions) with text results | Verified: `none`, hosted; admitted: self-hosted | Verified on all placements; object-root schemas only | Rejected |
-| [Function results with images](./message-content.md#function-results) | Verified: `none`, hosted; admitted: self-hosted | Verified on all placements; successful inline PNG or JPEG results only | Rejected |
+| [Function results with images](./message-content.md#function-results) | Verified: `none`, hosted; admitted: self-hosted; remote URLs: rejected | Successful results only; PNG and JPEG data URLs: verified on all placements; GIF and WebP: admitted | Rejected |
 | [Structured output](./execution-tools.md#structured-output) | Admitted on all placements | Verified on all placements | Rejected |
 | [Deferred function discovery](./execution-tools.md#deferred-function-discovery) | Rejected | Verified: `none`, self-hosted; admitted: hosted | Rejected |
 | [Disabled web search and programmatic tool calling](./execution-tools.md#web-search-and-programmatic-tool-calling) | Verified: `none`; admitted: hosted, self-hosted | Verified: `none`; admitted: hosted, self-hosted | Verified: `none`; admitted: hosted, self-hosted |

diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
@@ -189,7 +189,7 @@ The declaration holds:
 - `Capabilities`, a `proto.AgentKindCapabilities` that states the most the Harness can do on a capable host, with every field `Supported` or `Unsupported` and the zero value invalid ([Capability declarations](../../docs/runtime-protocol.md#capability-declarations));
 - the supported `Placements` and public `MCPOrigins`, and whether whitespace-only text is accepted;
 - `Execution`, the official execution option values the adapter maps to native settings: web search modes and whether search settings are accepted, reasoning efforts and summaries, service tiers, programmatic-tool-calling values and text verbosities. Core admission and the Runtime reject an undeclared value with the same check ([tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling)). Core always sends the official default text verbosity, so `TextVerbosities` must include `medium`;
-- optional pure restrictions, `ValidateConfiguration`, `ValidateTools` and `ValidateFunctionResult`, that add native limits to the common checks. A nil validator means the common checks suffice. They cannot query business data, decrypt credentials or control native processes, Configuration restrictions run first. With a `ValidateConfiguration` callback, tool-decoding errors precede `ValidateTools` errors; without one, `ValidateTools` errors precede a decoding error.
+- optional pure restrictions, `ValidateConfiguration`, `ValidateTools`, `ValidateMessageInput` and `ValidateFunctionResult`, that add native limits to the common checks. `ValidateMessageInput` runs only for messages that carry images, after the `MessageImages` capability check and before anything is stored, and decides which `image_url` values the Harness accepts; Core checks only that the reference is nonempty. A nil validator means the common checks suffice. They cannot query business data, decrypt credentials or control native processes, Configuration restrictions run first. With a `ValidateConfiguration` callback, tool-decoding errors precede `ValidateTools` errors; without one, `ValidateTools` errors precede a decoding error.
 
 `harnessconfig.NewRegistry` validates every declaration and panics on an invalid or duplicate one: kinds and labels must be nonempty, placements must list at least one supported placement, MCP origins must be a non-nil list, unknown or duplicate choices and origins without a corresponding placement are rejected, and bearer support requires an MCP origin, and `Execution` must declare text verbosity `medium`. Shared dispatch checks capability combinations, never engine names.
 

diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
@@ -28,7 +28,7 @@ Evidence for a status comes from the pinned official SDK and raw HTTP against th
 | --- | --- | --- | --- |
 | Agents | create, retrieve, update, list, delete | Implemented. Every pinned setting is saved; Session admission runs a subset | [Agents](./wire-semantics.md#agents) |
 | Sessions | create (JSON or stream), retrieve, update, list, delete | Implemented. Update takes `metadata` only; deletion requires an idle or failed Session | [Sessions](./wire-semantics.md#sessions), [creation streaming](./sessions-events.md#creation-streaming) |
-| Session events | create, stream | Partial: messages with text and inline images, cancellation, function results; the stream is live only | [Sessions, events and history](./sessions-events.md), [message content](./message-content.md) |
+| Session events | create, stream | Partial: messages with text and images, cancellation, function results; the stream is live only | [Sessions, events and history](./sessions-events.md), [message content](./message-content.md) |
 | Turns | retrieve, list | Implemented; Session Turn routes hold root Turns only | [Turns and Items](./sessions-events.md#turns-and-items) |
 | Items | list | Partial: messages, commands, MCP calls, functions, web search, reasoning and Subagent coordination Items; other native variants are not projected | [Turns and Items](./sessions-events.md#turns-and-items) |
 | Artifacts | retrieve, list, delete, content | Implemented | [Environment files and Artifacts](./environment-files.md) |
@@ -120,7 +120,7 @@ Each item is Core's deliberate or native behavior where the official service beh
 - Pinned Codex can lose command output emitted before its stream subscription.
 - Claude Code and MiniMax Code report no public usage.
 - Core gives no crash-safe or exactly-once guarantee for native side effects; claimed work fails on restart without replay.
-- Images must be inline PNG or JPEG data URIs; remote URLs, `file_id` and `detail` are rejected.
+- `file_id` and `detail` on images are rejected; each Harness declares which `image_url` values it accepts ([message content](./message-content.md#images)).
 
 **Environments and Templates**
 

diff --git a/contracts/agents-api/message-content.md b/contracts/agents-api/message-content.md
@@ -17,12 +17,12 @@ An empty text part beside other content, such as `["", "text"]`, is accepted and
 
 ## Images
 
-An `input_image` part carries `image_url` as an inline data URI: `data:image/png;base64,…` or `data:image/jpeg;base64,…`. The base64 must be canonical and the decoded image must match the declared type. Core accepts no remote URL, `file_id` or `detail`.
+An `input_image` part carries a nonempty `image_url`, a remote URL or a base64 data URL as the official API allows. Core accepts no `file_id` or `detail` and otherwise checks only the Harness's declared rule below; it never downloads or rewrites an image, and the model provider's own error for an image it cannot read returns unchanged.
 
 | Harness | Message images |
 | --- | --- |
-| Codex | Accepted on every placement the Harness supports: `none`, `openai_hosted` and `self_hosted` |
-| Claude Code | Accepted on `none`, `openai_hosted` and `self_hosted` |
+| Codex | Any data URL, passed unchanged, on `none`, `openai_hosted` and `self_hosted`. An `http` or `https` URL returns 400, because native Codex rejects remote image URLs |
+| Claude Code | A reference that is not a data URL becomes a native URL source; a data URL must be canonical base64 of `image/png`, `image/jpeg`, `image/gif` or `image/webp`, and any other returns 400. On `none`, `openai_hosted` and `self_hosted` |
 | MiniMax Code | Rejected |
 
 Admission checks the Harness before anything is written; an image the Harness cannot take returns 400. The Runtime must also report message image support: Core binds a Session whose input carries images only to such a Runtime, and delivery to a Runtime without it fails. Use a model that accepts images.
@@ -49,8 +49,8 @@ An `agent.session.input.tool_result` event carries `success`, an optional nullab
 
 | Harness | Function results |
 | --- | --- |
-| Codex | Text and ordered text/image output. Core checks only that each part is well formed and passes image references to the Harness unchanged |
-| Claude Code | Text output. Images only in successful results and only as inline PNG or JPEG; an image in a failed result or a remote reference returns 400 before anything is stored, and the pending call stays open. The Harness may resize or re-encode images in its own history; public Items keep the submitted bytes |
+| Codex | Text and ordered text/image output, passed to the Harness unchanged. An `http` or `https` image URL returns 400, because native Codex rejects remote image URLs |
+| Claude Code | Text output. Images only in successful results and only as canonical base64 data URLs of `image/png`, `image/jpeg`, `image/gif` or `image/webp`, because a native tool result carries no URL; an image in a failed result or a remote reference returns 400 before anything is stored, and the pending call stays open. The Harness may resize or re-encode an image, or replace one it cannot process with a text note, in its own history; public Items keep the submitted bytes |
 | MiniMax Code | No public functions |
 
 ### Application receipts

diff --git a/contracts/agents-api/zh/harness-capabilities.md b/contracts/agents-api/zh/harness-capabilities.md
@@ -1,7 +1,7 @@
 ---
 title: "Harness 能力"
 source: contracts/agents-api/harness-capabilities.md
-source_hash: 818fecdaf4bca14f5d37b6135af4eed6c13b48c801e4dd1034317a86ef5a247c
+source_hash: c31a323311129a5d005cec014003634c0e4e30ed824798cdda3ee10f2902efd9
 ---
 
 本页列出每个 Harness 在每种部署位置支持的能力。Core 根据 `internal/harnessconfig/<package>/declaration.go` 中 Harness 的声明决定准入，运行 Session 的 Runtime 也必须声明操作。所链接契约定义各操作；[Harness 接入](harness-onboarding.md#qualify-the-adapter)说明资格验证方法。
@@ -23,8 +23,7 @@ source_hash: 818fecdaf4bca14f5d37b6135af4eed6c13b48c801e4dd1034317a86ef5a247c
 | 文本 Turn、活动输入、取消、重启与继续 | 所有位置已验证 | 所有位置已验证 | 所有位置已验证 |
 | [文件与 Artifact](environment-files.md) | 已验证：托管、自托管 | 已验证：托管、自托管 | 已验证：托管、自托管 |
 | [仅空白消息文本](message-content.md) | 已准入；原样交付 | 已拒绝 | 已拒绝 |
-| [内联 PNG、JPEG 消息图像](message-content.md) | 所有位置已验证 | 所有位置已验证 | 已拒绝 |
-| 远程图像 URL | 已拒绝 | 已拒绝 | 已拒绝 |
+| [消息图像](message-content.md#images) | PNG、JPEG data URL：所有位置已验证；其他 data URL：已准入；远程 URL：已拒绝 | PNG、JPEG data URL：所有位置已验证；远程 URL 及 GIF、WebP data URL：已准入 | 已拒绝 |
 | `reasoning.effort` | `none`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`：已准入 | `low`、`medium`、`high`、`xhigh`、`max`：已准入 | 已拒绝 |
 | `reasoning.summary` | `concise`、`detailed`、`auto`：已准入 | 已拒绝 | 已拒绝 |
 | 非 `auto` 的 `service_tier` | `default`、`flex`、`priority`：已准入 | 已拒绝 | 已拒绝 |
@@ -38,7 +37,7 @@ source_hash: 818fecdaf4bca14f5d37b6135af4eed6c13b48c801e4dd1034317a86ef5a247c
 | 操作 | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | 文本结果的[公开函数](execution-tools.md#functions) | 已验证：`none`、托管；已准入：自托管 | 所有位置已验证；仅对象根 schema | 已拒绝 |
-| [含图像函数结果](message-content.md#function-results) | 已验证：`none`、托管；已准入：自托管 | 所有位置已验证；仅成功结果中的内联 PNG 或 JPEG | 已拒绝 |
+| [含图像函数结果](message-content.md#function-results) | 已验证：`none`、托管；已准入：自托管；远程 URL：已拒绝 | 仅成功结果；PNG、JPEG data URL：所有位置已验证；GIF、WebP：已准入 | 已拒绝 |
 | [结构化输出](execution-tools.md#structured-output) | 所有位置已准入 | 所有位置已验证 | 已拒绝 |
 | [延迟函数发现](execution-tools.md#deferred-function-discovery) | 已拒绝 | 已验证：`none`、自托管；已准入：托管 | 已拒绝 |
 | [禁用 Web 搜索与程序化工具调用](execution-tools.md#web-search-and-programmatic-tool-calling) | 已验证：`none`；已准入：托管、自托管 | 已验证：`none`；已准入：托管、自托管 | 已验证：`none`；已准入：托管、自托管 |

diff --git a/contracts/agents-api/zh/harness-onboarding.md b/contracts/agents-api/zh/harness-onboarding.md
@@ -1,7 +1,7 @@
 ---
 title: "Harness 协议"
 source: contracts/agents-api/harness-onboarding.md
-source_hash: 23717fd39df7a88a93bb12a7b4e68862f6ea7d514054d4765673df3b3ea98b96
+source_hash: 47fd08f050420acbf5c89ef886ddf3d9de7b3d43d28e4ffd1249f1550e1cbfef
 ---
 
 **Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）；**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。Harness 协议是 Runtime 与适配器之间的契约：适配器接口及其生命周期义务、声明、注册和验收。本文面向添加或维护 Harness 的开发者。
@@ -191,7 +191,7 @@ Runtime 统一解析[状态目录](../../../docs/zh/configuration.md#runtime-res
 - `Capabilities`，即 `proto.AgentKindCapabilities`，表示 Harness 在能力完备的主机上最多能做什么；每个字段都是 `Supported` 或 `Unsupported`，零值无效（[能力声明](../../../docs/zh/runtime-protocol.md#capability-declarations)）；
 - 受支持的 `Placements` 和公共 `MCPOrigins`，以及是否接受仅含空白的文本；
 - `Execution`，即适配器映射到原生设置的官方执行选项取值：web search 模式及是否接受搜索设置、推理强度和摘要、服务层级、程序化工具调用取值和文本详细程度。Core 准入和 Runtime 用同一检查拒绝未声明的取值（[工具策略](execution-tools.md#web-search-and-programmatic-tool-calling)）。Core 总会发送官方默认文本详细程度，因此 `TextVerbosities` 必须包含 `medium`；
-- 可选的纯限制 `ValidateConfiguration`、`ValidateTools` 和 `ValidateFunctionResult`，在通用检查之外添加原生限制。验证函数为 nil 表示通用检查已足够。它们不能查询业务数据、解密凭据或控制原生进程，配置限制最先执行。存在 `ValidateConfiguration` 回调时，工具解码错误先于 `ValidateTools` 错误；不存在时，`ValidateTools` 错误先于解码错误。
+- 可选的纯限制 `ValidateConfiguration`、`ValidateTools`、`ValidateMessageInput` 和 `ValidateFunctionResult`，在通用检查之外添加原生限制。`ValidateMessageInput` 仅对携带图像的消息运行，在 `MessageImages` 能力检查之后、任何存储之前执行，决定 Harness 接受哪些 `image_url`；Core 只检查引用非空。验证函数为 nil 表示通用检查已足够。它们不能查询业务数据、解密凭据或控制原生进程，配置限制最先执行。存在 `ValidateConfiguration` 回调时，工具解码错误先于 `ValidateTools` 错误；不存在时，`ValidateTools` 错误先于解码错误。
 
 `harnessconfig.NewRegistry` 会验证每个声明，对无效或重复的声明触发 panic：kind 和 label 必须非空，放置位置必须至少列出一个受支持的位置，MCP 来源必须是非 nil 列表，未知或重复的选项以及没有对应放置位置的来源会被拒绝，bearer 支持要求存在 MCP 来源，`Execution` 必须声明文本详细程度 `medium`。共享调度检查能力组合，绝不检查引擎名称。