fix(runtime): provenance-gate media markers in the dispatcher + turn-loop result path

The provenance-aware canonicalization helper
(`canonicalize_tool_result_media_markers_for`) was previously applied only in
the old monolithic `run_tool_call_loop`. After the turn-engine refactor (#7969)
the loop's canonicalization moved to `turn::results_collect`, and the
`ToolDispatcher::format_results` path (XmlToolDispatcher / NativeToolDispatcher)
still used the provenance-blind `canonicalize_tool_result_media_markers`.

Route every tool-name-aware canonicalization site through the single shared
helper so a search/listing tool (content_search, glob_search) that merely lists
a local image path is never rewritten into a routable `[IMAGE:…]` marker — which
falsely triggers vision routing and a provider-capability error on a text-only
provider — while a genuine image-producing tool (image_gen) is still
canonicalized.

- turn::results_collect::collect_tool_results: canonicalize via `_for(tool_name)`
- XmlToolDispatcher::format_results: canonicalize via `_for(result.name)`
- NativeToolDispatcher::format_results: canonicalize via `_for(result.name)`

Adds dispatcher regression tests asserting content_search/glob_search image
paths are not promoted in either dispatcher, and that image_gen output still is.

See PR #7345.

Author: Nillth

crates/zeroclaw-runtime/src/agent/dispatcher.rs

@@ -1,4 +1,6 @@
-use super::history::canonicalize_tool_result_media_markers;
+use super::history::{
+    canonicalize_tool_result_media_markers, canonicalize_tool_result_media_markers_for,
+};
 use crate::tools::{Tool, ToolSpec};
 use serde_json::Value;
 use std::fmt::Write;
@@ -129,7 +131,12 @@ impl ToolDispatcher for XmlToolDispatcher {
         let mut content = String::new();
         for result in results {
             let status = if result.success { "ok" } else { "error" };
-            let output = canonicalize_tool_result_media_markers(&result.output);
+            // Provenance-gated: search/listing tools (content_search,
+            // glob_search) must not have incidental image paths promoted to
+            // routable [IMAGE:...] markers (PR #7345). The producing tool name is
+            // known here, so canonicalize through the same shared helper the
+            // turn loop uses.
+            let output = canonicalize_tool_result_media_markers_for(&result.name, &result.output);
             let _ = writeln!(
                 content,
                 "<tool_result name=\"{}\" status=\"{}\">\n{}\n</tool_result>",
@@ -212,7 +219,8 @@ impl ToolDispatcher for NativeToolDispatcher {
                     .tool_call_id
                     .clone()
                     .unwrap_or_else(|| "unknown".to_string()),
-                content: canonicalize_tool_result_media_markers(&result.output),
+                // Provenance-gated (PR #7345): see the XML dispatcher above.
+                content: canonicalize_tool_result_media_markers_for(&result.name, &result.output),
             })
             .collect();
         ConversationMessage::ToolResults(messages)
@@ -386,6 +394,137 @@ mod tests {
         }
     }
 
+    // ═══════════════════════════════════════════════════════════════════════
+    // provenance-gated media-marker canonicalization (PR #7345)
+    // ═══════════════════════════════════════════════════════════════════════
+    // The dispatcher result-formatting path is reachable from `Agent::turn`
+    // / `Agent::turn_streamed` (ACP, gateway WebSocket + RPC). A search/listing
+    // tool that merely *lists* a local image path must NOT have that path
+    // rewritten into a routable `[IMAGE:...]` marker - otherwise it falsely
+    // triggers vision routing and a provider-capability error on a text-only
+    // provider. A genuine image-producing tool (e.g. `image_gen`) MUST still be
+    // canonicalized. Both dispatchers gate via the shared
+    // `canonicalize_tool_result_media_markers_for(tool_name, ...)` helper.
+
+    /// Write a throwaway PNG and return its absolute path string. An existing
+    /// local image path is required for canonicalization to fire at all.
+    fn write_temp_image(dir: &std::path::Path, name: &str) -> String {
+        let image = dir.join(name);
+        std::fs::write(&image, [0x89, b'P', b'N', b'G', b'\r', b'\n', 0x1a, b'\n']).unwrap();
+        image.display().to_string()
+    }
+
+    fn xml_format_results_text(
+        dispatcher: &XmlToolDispatcher,
+        result: ToolExecutionResult,
+    ) -> String {
+        match dispatcher.format_results(&[result]) {
+            ConversationMessage::Chat(chat) => chat.content,
+            _ => panic!("XmlToolDispatcher::format_results must return a Chat message"),
+        }
+    }
+
+    fn native_format_results_content(
+        dispatcher: &NativeToolDispatcher,
+        result: ToolExecutionResult,
+    ) -> String {
+        match dispatcher.format_results(&[result]) {
+            ConversationMessage::ToolResults(results) => results[0].content.clone(),
+            _ => panic!("NativeToolDispatcher::format_results must return ToolResults"),
+        }
+    }
+
+    #[test]
+    fn xml_format_results_does_not_promote_search_tool_image_paths() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_temp_image(dir.path(), "hit.png");
+        let xml = XmlToolDispatcher;
+
+        for tool in ["content_search", "glob_search"] {
+            let rendered = xml_format_results_text(
+                &xml,
+                ToolExecutionResult {
+                    name: tool.into(),
+                    output: format!("match: {path}"),
+                    success: true,
+                    tool_call_id: None,
+                },
+            );
+            assert!(
+                !rendered.contains("[IMAGE:"),
+                "{tool} output must not be promoted to an image marker"
+            );
+            assert!(
+                rendered.contains(&path),
+                "{tool} output must still carry the literal path text"
+            );
+        }
+    }
+
+    #[test]
+    fn native_format_results_does_not_promote_search_tool_image_paths() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_temp_image(dir.path(), "hit.png");
+        let native = NativeToolDispatcher;
+
+        for tool in ["content_search", "glob_search"] {
+            let content = native_format_results_content(
+                &native,
+                ToolExecutionResult {
+                    name: tool.into(),
+                    output: format!("found: {path}"),
+                    success: true,
+                    tool_call_id: Some("tc1".into()),
+                },
+            );
+            assert!(
+                !content.contains("[IMAGE:"),
+                "{tool} output must not be promoted to an image marker"
+            );
+            assert!(content.contains(&path));
+        }
+    }
+
+    #[test]
+    fn format_results_still_promotes_image_producing_tool_paths() {
+        // Default-allow: a genuinely image-producing tool keeps canonicalization
+        // in BOTH dispatchers, so real tool-produced images still route to a
+        // vision provider.
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_temp_image(dir.path(), "generated.png");
+        let expected = format!("[IMAGE:{path}]");
+
+        let xml = XmlToolDispatcher;
+        let rendered = xml_format_results_text(
+            &xml,
+            ToolExecutionResult {
+                name: "image_gen".into(),
+                output: format!("saved to {path}"),
+                success: true,
+                tool_call_id: None,
+            },
+        );
+        assert!(
+            rendered.contains(&expected),
+            "image_gen output must be canonicalized into a marker (XML)"
+        );
+
+        let native = NativeToolDispatcher;
+        let content = native_format_results_content(
+            &native,
+            ToolExecutionResult {
+                name: "image_gen".into(),
+                output: format!("saved to {path}"),
+                success: true,
+                tool_call_id: Some("tc1".into()),
+            },
+        );
+        assert!(
+            content.contains(&expected),
+            "image_gen output must be canonicalized into a marker (native)"
+        );
+    }
+
     // ═══════════════════════════════════════════════════════════════════════
     // reasoning_content pass-through tests
     // ═══════════════════════════════════════════════════════════════════════

crates/zeroclaw-runtime/src/agent/history.rs

@@ -230,15 +230,15 @@ pub fn canonicalize_tool_result_media_markers(output: &str) -> String {
 /// Tools whose output merely *lists* or *quotes* local filesystem paths
 /// (search hits, glob matches) rather than presenting an image as visual
 /// content. Their incidental image-file paths must NOT be auto-promoted to
-/// `[IMAGE:…]` markers: the agent loop counts the current iteration's
+/// `[IMAGE:...]` markers: the agent loop counts the current iteration's
 /// tool-result markers (`multimodal::count_image_markers`) when deciding
 /// whether to switch to a vision provider, so a path echo here falsely
-/// triggers vision routing — producing a provider-capability error on a
+/// triggers vision routing - producing a provider-capability error on a
 /// text-only provider. See PR #7345.
 ///
-/// This is a denylist (default-allow): any other tool — including ones that
+/// This is a denylist (default-allow): any other tool - including ones that
 /// genuinely *generate* or *fetch* an image and print its path (e.g.
-/// `image_gen`, `file_download`) — keeps canonicalization, so real
+/// `image_gen`, `file_download`) - keeps canonicalization, so real
 /// tool-produced images still route to a configured vision provider.
 fn is_path_listing_tool(tool_name: &str) -> bool {
     matches!(
@@ -250,7 +250,7 @@ fn is_path_listing_tool(tool_name: &str) -> bool {
 /// Provenance-aware wrapper around [`canonicalize_tool_result_media_markers`].
 ///
 /// Returns the output unchanged for path-listing tools ([`is_path_listing_tool`])
-/// so their incidental image paths never become routable `[IMAGE:…]` markers;
+/// so their incidental image paths never become routable `[IMAGE:...]` markers;
 /// all other tools are canonicalized exactly as before.
 pub fn canonicalize_tool_result_media_markers_for(tool_name: &str, output: &str) -> String {
     if is_path_listing_tool(tool_name) {
@@ -567,7 +567,7 @@ mod tests {
     #[test]
     fn canonicalize_for_skips_path_listing_tools() {
         // A search/listing tool that surfaces a real image path must be left
-        // untouched — promoting it to [IMAGE:…] would falsely trigger vision
+        // untouched - promoting it to [IMAGE:...] would falsely trigger vision
         // routing (PR #7345).
         let dir = tempfile::tempdir().unwrap();
         let image = dir.path().join("hit.png");

crates/zeroclaw-runtime/src/agent/turn/results_collect.rs

@@ -3,7 +3,8 @@
 //! identical-output abort.
 
 use crate::agent::history::{
-    append_or_merge_system_message, canonicalize_tool_result_media_markers, truncate_tool_result,
+    append_or_merge_system_message, canonicalize_tool_result_media_markers_for,
+    truncate_tool_result,
 };
 use crate::agent::loop_detector::LoopDetector;
 use crate::agent::tool_execution::ToolExecutionOutcome;
@@ -112,7 +113,13 @@ pub(crate) fn collect_tool_results(
                 }
             }
         }
-        let canonical_output = canonicalize_tool_result_media_markers(&outcome.output);
+        // Provenance-gated: search/listing tools (content_search, glob_search)
+        // must not have incidental image paths promoted to routable [IMAGE:...]
+        // markers, or they falsely trigger vision routing on a text-only
+        // provider. Image-producing/fetching tools keep canonicalization.
+        // See PR #7345.
+        let canonical_output =
+            canonicalize_tool_result_media_markers_for(&tool_name, &outcome.output);
         let mut result_output = truncate_tool_result(&canonical_output, max_tool_result_chars);
         // Append HMAC receipt to tool result when receipts are enabled
         if let Some(ref receipt) = outcome.receipt {