feat: 添加 Agent 步骤事件与图片附件功能

- 新增 stepStarted/stepFinished 事件类型支持
- 前端实现图片附件上传和预览功能
- 后端增强工具结果存储和事件处理
- 完善相关单元测试和集成测试

backend/tests/unit/core/agentscope/events/test_agui_codec.py

@@ -40,3 +40,34 @@ def test_reserved_keys_in_data_cannot_override_wire_fields() -> None:
     assert result["threadId"] == "thread-1"
     assert result["runId"] == "run-1"
     assert result["message"] == "ok"
+
+
+def test_tool_result_wire_event_filters_sensitive_fields() -> None:
+    internal = {
+        "type": "tool.result",
+        "threadId": "thread-1",
+        "runId": "run-1",
+        "data": {
+            "messageId": "tool-result-1",
+            "toolCallId": "call-1",
+            "callId": "call-1",
+            "toolName": "calendar_write",
+            "content": "summary",
+            "ui": {"type": "calendar_operation.v1", "data": {"ok": True}},
+            "args": {"token": "secret"},
+            "result": {"raw": "secret"},
+            "error": "stack trace",
+        },
+    }
+
+    result = to_agui_wire_event(internal)
+
+    assert result["type"] == "TOOL_CALL_RESULT"
+    assert result["messageId"] == "tool-result-1"
+    assert result["toolCallId"] == "call-1"
+    assert result["toolName"] == "calendar_write"
+    assert result["content"] == "summary"
+    assert isinstance(result.get("ui"), dict)
+    assert "args" not in result
+    assert "result" not in result
+    assert "error" not in result

backend/tests/unit/core/agentscope/events/test_store.py

@@ -28,6 +28,27 @@ class _FakeSessionCtx:
         del exc_type, exc, tb
 
 
+class _FakeToolResultStorage:
+    def __init__(self) -> None:
+        self.upload_calls: list[dict[str, object]] = []
+
+    async def upload_json(
+        self,
+        *,
+        bucket: str,
+        path: str,
+        payload: dict[str, object],
+    ) -> str:
+        self.upload_calls.append(
+            {
+                "bucket": bucket,
+                "path": path,
+                "payload": payload,
+            }
+        )
+        return path
+
+
 @pytest.mark.asyncio
 async def test_store_marks_session_running_on_run_started(
     monkeypatch: pytest.MonkeyPatch,
@@ -300,7 +321,12 @@ async def test_store_persists_tool_call_result_as_tool_message(
     monkeypatch.setattr(store_module, "MessageRepository", _FakeMessageRepository)
     monkeypatch.setattr(store_module, "AgentChatSessionStatus", _SessionStatus)
 
-    store = store_module.SqlAlchemyEventStore(session_factory=lambda: _FakeSessionCtx())
+    fake_storage = _FakeToolResultStorage()
+    store = store_module.SqlAlchemyEventStore(
+        session_factory=lambda: _FakeSessionCtx(),
+        tool_result_storage=fake_storage,
+        tool_result_bucket="agent-tool-results",
+    )
     await store.persist(
         {
             "type": "TOOL_CALL_RESULT",
@@ -310,7 +336,7 @@ async def test_store_persists_tool_call_result_as_tool_message(
             "taskId": "t1",
             "stage": "execution",
             "args": {"title": "A"},
-            "result": {"event_id": "evt-1"},
+            "result": {"event_id": "evt-1", "token": "secret"},
         }
     )
 
@@ -318,9 +344,94 @@ async def test_store_persists_tool_call_result_as_tool_message(
     assert getattr(append_kwargs["role"], "value", None) == "tool"
     assert append_kwargs["tool_name"] == "calendar_write"
     assert append_kwargs["metadata"]["task_id"] == "t1"
+    tool_call_id = append_kwargs["metadata"]["tool_call_id"]
+    assert isinstance(tool_call_id, str)
+    assert tool_call_id.startswith("run-1-t1-")
+    assert append_kwargs["metadata"]["storage_bucket"] == "agent-tool-results"
+    assert isinstance(append_kwargs["metadata"]["storage_path"], str)
+    assert append_kwargs["content"].startswith("已创建日程")
+    assert len(fake_storage.upload_calls) == 1
+    uploaded = fake_storage.upload_calls[0]
+    assert uploaded["bucket"] == "agent-tool-results"
+    payload = cast(dict[str, Any], uploaded["payload"])
+    assert payload["toolName"] == "calendar_write"
+    assert "args" not in payload
+    assert isinstance(payload.get("result"), dict)
+    assert payload["result"]["token"] == "[REDACTED]"
     assert captured["message_delta"] == 1
 
 
+@pytest.mark.asyncio
+async def test_store_sanitizes_nested_sensitive_fields_in_result_payload(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured: dict[str, object] = {}
+    fake_chat_session = SimpleNamespace(state_snapshot={}, message_count=0)
+
+    class _FakeSessionRepository:
+        def __init__(self, session: object) -> None:
+            del session
+
+        async def get_session(self, *, session_id):  # noqa: ANN001
+            del session_id
+            return fake_chat_session
+
+        async def lock_session_for_update(self, *, session_id):  # noqa: ANN001
+            del session_id
+            return fake_chat_session
+
+        async def update_runtime_state(self, **kwargs):  # noqa: ANN003
+            captured.update(kwargs)
+
+    class _FakeMessageRepository:
+        def __init__(self, session: object) -> None:
+            del session
+
+        async def append_message(self, **kwargs):  # noqa: ANN003
+            captured["append_kwargs"] = kwargs
+
+    monkeypatch.setattr(store_module, "SessionRepository", _FakeSessionRepository)
+    monkeypatch.setattr(store_module, "MessageRepository", _FakeMessageRepository)
+    monkeypatch.setattr(store_module, "AgentChatSessionStatus", _SessionStatus)
+
+    fake_storage = _FakeToolResultStorage()
+    store = store_module.SqlAlchemyEventStore(
+        session_factory=lambda: _FakeSessionCtx(),
+        tool_result_storage=fake_storage,
+        tool_result_bucket="agent-tool-results",
+    )
+    await store.persist(
+        {
+            "type": "TOOL_CALL_RESULT",
+            "threadId": "00000000-0000-0000-0000-000000000001",
+            "runId": "run-1",
+            "toolName": "calendar_write",
+            "result": {
+                "data": {
+                    "ok": True,
+                    "accessToken": "secret-a",
+                    "nested": {
+                        "refresh_token": "secret-b",
+                    },
+                    "items": [
+                        {"authorizationHeader": "secret-c"},
+                    ],
+                }
+            },
+        }
+    )
+
+    payload = cast(dict[str, Any], fake_storage.upload_calls[0]["payload"])
+    stored_result = cast(dict[str, Any], payload["result"])
+    data = cast(dict[str, Any], stored_result["data"])
+    assert data["accessToken"] == "[REDACTED]"
+    nested = cast(dict[str, Any], data["nested"])
+    assert nested["refresh_token"] == "[REDACTED]"
+    items = cast(list[Any], data["items"])
+    assert isinstance(items[0], dict)
+    assert items[0]["authorizationHeader"] == "[REDACTED]"
+
+
 @pytest.mark.asyncio
 async def test_store_drops_buffer_when_session_missing(
     monkeypatch: pytest.MonkeyPatch,

backend/tests/unit/core/agentscope/events/test_tool_result_summary.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+from core.agentscope.events.tool_result_summary import build_tool_content_summary
+
+
+def test_summary_prioritizes_error() -> None:
+    text = build_tool_content_summary(
+        tool_name="calendar_write",
+        args={"title": "A"},
+        result={"message": "ignored"},
+        error={"message": "denied"},
+    )
+    assert text == "calendar_write 执行失败：denied"
+
+
+def test_summary_for_calendar_write() -> None:
+    text = build_tool_content_summary(
+        tool_name="calendar_write",
+        args={"title": "项目评审"},
+        result={"startAt": "明天 10:00"},
+        error=None,
+    )
+    assert text == "已创建日程：项目评审（明天 10:00）"
+
+
+def test_summary_for_calendar_read() -> None:
+    text = build_tool_content_summary(
+        tool_name="calendar_read",
+        args={"query": "今天"},
+        result={"data": {"total": 3}},
+        error=None,
+    )
+    assert text == "查询到 3 条日程（今天）"
+
+
+def test_summary_falls_back_to_result_content() -> None:
+    text = build_tool_content_summary(
+        tool_name="unknown_tool",
+        args=None,
+        result={"content": "这是非常长的说明" * 20},
+        error=None,
+    )
+    assert text.startswith("这是非常长的说明")
+    assert len(text) <= 80
+
+
+def test_summary_default_done() -> None:
+    text = build_tool_content_summary(
+        tool_name="unknown_tool",
+        args=None,
+        result=None,
+        error=None,
+    )
+    assert text == "unknown_tool 执行完成"
+
+
+def test_summary_marks_business_failure_when_ok_false() -> None:
+    text = build_tool_content_summary(
+        tool_name="calendar_write",
+        args={"title": "上学"},
+        result={
+            "type": "calendar_operation.v1",
+            "data": {
+                "ok": False,
+                "code": "UNAUTHORIZED",
+                "message": "calendar.write requires validated user token",
+            },
+        },
+        error=None,
+    )
+    assert (
+        text == "calendar_write 执行失败：calendar.write requires validated user token"
+    )