fix(gateway,context): 修复 ACL 方法名互换和 nil source 保护

- 修复 handleSessionAssetRead 中 ACL 检查使用了 sessionAssetDeleteMethod 的 bug
- 修复 handleSessionAssetDelete 中 ACL 检查使用了 sessionAssetReadMethod 的 bug
- 为 newStablePromptSources 添加 nil source 过滤，防止 collectPromptSections panic
- 补充 ACL 独立生效测试（read-only 和 delete-only ACL 场景）
- 补充 nil source 和 mixed nil/valid source 测试
- 补充 multi_workspace Delete 不支持 SessionAssetPort 的错误返回测试
- 补充图片投影空消息和混合消息的边界测试

Author: wynxing

internal/context/builder.go

@@ -19,7 +19,9 @@ func newStablePromptSources(extra ...SectionSource) []promptSectionSource {
 		newRulesPromptSource(nil),
 	}
 	for _, src := range extra {
-		sources = append(sources, src)
+		if src != nil {
+			sources = append(sources, src)
+		}
 	}
 	return sources
 }

internal/context/builder_test.go

@@ -645,6 +645,40 @@ func TestNewConfiguredBuilder(t *testing.T) {
 		}
 	})
 
+	t.Run("nil extra source is safely ignored", func(t *testing.T) {
+		t.Parallel()
+		builder := NewConfiguredBuilder(nil)
+		input := BuildInput{
+			Messages: []providertypes.Message{{Role: "user", Parts: []providertypes.ContentPart{providertypes.NewTextPart("hello")}}},
+			Metadata: testMetadata(t.TempDir()),
+		}
+		result, err := builder.Build(stdcontext.Background(), input)
+		if err != nil {
+			t.Fatalf("Build() with nil source error = %v", err)
+		}
+		if result.SystemPrompt == "" {
+			t.Fatal("expected non-empty system prompt even with nil extra source")
+		}
+	})
+
+	t.Run("mixed nil and valid extra sources", func(t *testing.T) {
+		t.Parallel()
+		builder := NewConfiguredBuilder(nil, stubPromptSectionSource{
+			sections: []promptSection{{Title: "Valid", Content: "valid section"}},
+		}, nil)
+		input := BuildInput{
+			Messages: []providertypes.Message{{Role: "user", Parts: []providertypes.ContentPart{providertypes.NewTextPart("hello")}}},
+			Metadata: testMetadata(t.TempDir()),
+		}
+		result, err := builder.Build(stdcontext.Background(), input)
+		if err != nil {
+			t.Fatalf("Build() with mixed nil/valid sources error = %v", err)
+		}
+		if !strings.Contains(result.SystemPrompt, "## Valid") {
+			t.Fatal("expected valid section to be present while nil sources are ignored")
+		}
+	})
+
 	t.Run("multiple extra section sources are appended", func(t *testing.T) {
 		builder := NewConfiguredBuilder(stubPromptSectionSource{
 			sections: []promptSection{{Title: "First", Content: "first body"}},

internal/gateway/multi_workspace_runtime_test.go

@@ -864,6 +864,36 @@ var _ SessionAssetPort = (*MultiWorkspaceRuntime)(nil)
 var _ ManagementRuntimePort = (*MultiWorkspaceRuntime)(nil)
 var _ PlanApprovalRuntimePort = (*MultiWorkspaceRuntime)(nil)
 
+// recordingPortWithoutSessionAsset 嵌套 recordingPort 但不实现 SessionAssetPort，
+// 用于验证 MultiWorkspaceRuntime 在底层 runtime 不支持附件时的降级处理。
+type recordingPortWithoutSessionAsset struct{ *recordingPort }
+
+func TestMultiWorkspaceRuntime_DeleteSessionAssetUnsupportedRuntime(t *testing.T) {
+	idx, alpha, _ := setupIndex(t)
+	builder := newTestBuilder()
+	// 将 alpha 的 port 替换为不支持 SessionAssetPort 的版本
+	alphaPort := newRecordingPort("alpha-no-asset")
+	builder.ports[alpha.Path] = alphaPort
+	mw := NewMultiWorkspaceRuntime(idx, alpha.Hash, func(ctx context.Context, workdir string) (RuntimePort, func() error, error) {
+		port, cleanup, err := builder.build(ctx, workdir)
+		if err != nil {
+			return nil, nil, err
+		}
+		rp := port.(*recordingPort)
+		return &recordingPortWithoutSessionAsset{rp}, cleanup, nil
+	})
+	t.Cleanup(func() { _ = mw.Close() })
+
+	alphaCtx := ctxWithHash(t, alpha.Hash)
+	err := mw.DeleteSessionAsset(alphaCtx, DeleteSessionAssetInput{SessionID: "s-1", AssetID: "a-1"})
+	if err == nil {
+		t.Fatal("expected error when runtime does not implement SessionAssetPort")
+	}
+	if !errors.Is(err, ErrRuntimeUnavailable) {
+		t.Fatalf("error = %v, want ErrRuntimeUnavailable", err)
+	}
+}
+
 // guard helper: ensure recordingPort builds correctly under sync access.
 func TestRecordingPort_Concurrent(t *testing.T) {
 	p := newRecordingPort("c")

internal/gateway/network_server.go

@@ -496,8 +496,8 @@ func (s *NetworkServer) handleSessionAssetRead(writer http.ResponseWriter, reque
 		http.Error(writer, "unauthorized", http.StatusUnauthorized)
 		return
 	}
-	if !s.isHTTPControlPlaneMethodAllowed(sessionAssetDeleteMethod) {
-		s.writeHTTPAccessDenied(writer, sessionAssetDeleteMethod)
+	if !s.isHTTPControlPlaneMethodAllowed(sessionAssetReadMethod) {
+		s.writeHTTPAccessDenied(writer, sessionAssetReadMethod)
 		return
 	}
 	assetPort, ok := runtimePort.(SessionAssetPort)
@@ -539,8 +539,8 @@ func (s *NetworkServer) handleSessionAssetDelete(writer http.ResponseWriter, req
 		http.Error(writer, "unauthorized", http.StatusUnauthorized)
 		return
 	}
-	if !s.isHTTPControlPlaneMethodAllowed(sessionAssetReadMethod) {
-		s.writeHTTPAccessDenied(writer, sessionAssetReadMethod)
+	if !s.isHTTPControlPlaneMethodAllowed(sessionAssetDeleteMethod) {
+		s.writeHTTPAccessDenied(writer, sessionAssetDeleteMethod)
 		return
 	}
 	assetPort, ok := runtimePort.(SessionAssetPort)

internal/gateway/network_server_test.go

@@ -747,6 +747,95 @@ func TestNetworkServerSessionAssetDeleteMissingIsIdempotent(t *testing.T) {
 	}
 }
 
+// TestNetworkServerSessionAssetACLIndependent 验证 GET 和 DELETE 的 ACL 检查相互独立：
+// 只允许 read 时 GET 通过但 DELETE 被拒；只允许 delete 时 DELETE 通过但 GET 被拒。
+func TestNetworkServerSessionAssetACLIndependent(t *testing.T) {
+	t.Run("read allowed delete denied", func(t *testing.T) {
+		readOnlyACL := &ControlPlaneACL{
+			mode:    ACLModeStrict,
+			allow:   map[RequestSource]map[string]struct{}{RequestSourceHTTP: {sessionAssetReadMethod: {}}},
+			enabled: true,
+		}
+		runtimePort := &runtimePortEventStub{
+			openAssetFn: func(context.Context, OpenSessionAssetInput) (OpenSessionAssetResult, error) {
+				return OpenSessionAssetResult{
+					Reader: io.NopCloser(bytes.NewReader(gatewayMinimalPNGBytes())),
+					Meta:   SessionAssetMeta{SessionID: "session-1", AssetID: "asset-1", MimeType: "image/png"},
+				}, nil
+			},
+			deleteAssetFn: func(context.Context, DeleteSessionAssetInput) error {
+				t.Fatal("DeleteSessionAsset should not be called when ACL denies delete")
+				return nil
+			},
+		}
+		server := &NetworkServer{
+			authenticator: staticTokenAuthenticator{token: "gateway-token"},
+			acl:           readOnlyACL,
+			metrics:       NewGatewayMetrics(),
+		}
+		handler := server.buildHandler(runtimePort)
+
+		// GET should succeed (read allowed)
+		readRequest := httptest.NewRequest(http.MethodGet, "/api/session-assets/session-1/asset-1", nil)
+		readRequest.Header.Set("Authorization", "Bearer gateway-token")
+		readRecorder := httptest.NewRecorder()
+		handler.ServeHTTP(readRecorder, readRequest)
+		if readRecorder.Code != http.StatusOK {
+			t.Fatalf("read status = %d, want %d", readRecorder.Code, http.StatusOK)
+		}
+
+		// DELETE should be forbidden (delete denied)
+		deleteRequest := httptest.NewRequest(http.MethodDelete, "/api/session-assets/session-1/asset-1", nil)
+		deleteRequest.Header.Set("Authorization", "Bearer gateway-token")
+		deleteRecorder := httptest.NewRecorder()
+		handler.ServeHTTP(deleteRecorder, deleteRequest)
+		if deleteRecorder.Code != http.StatusForbidden {
+			t.Fatalf("delete status = %d, want %d", deleteRecorder.Code, http.StatusForbidden)
+		}
+	})
+
+	t.Run("delete allowed read denied", func(t *testing.T) {
+		deleteOnlyACL := &ControlPlaneACL{
+			mode:    ACLModeStrict,
+			allow:   map[RequestSource]map[string]struct{}{RequestSourceHTTP: {sessionAssetDeleteMethod: {}}},
+			enabled: true,
+		}
+		runtimePort := &runtimePortEventStub{
+			openAssetFn: func(context.Context, OpenSessionAssetInput) (OpenSessionAssetResult, error) {
+				t.Fatal("OpenSessionAsset should not be called when ACL denies read")
+				return OpenSessionAssetResult{}, nil
+			},
+			deleteAssetFn: func(context.Context, DeleteSessionAssetInput) error {
+				return nil
+			},
+		}
+		server := &NetworkServer{
+			authenticator: staticTokenAuthenticator{token: "gateway-token"},
+			acl:           deleteOnlyACL,
+			metrics:       NewGatewayMetrics(),
+		}
+		handler := server.buildHandler(runtimePort)
+
+		// DELETE should succeed (delete allowed)
+		deleteRequest := httptest.NewRequest(http.MethodDelete, "/api/session-assets/session-1/asset-1", nil)
+		deleteRequest.Header.Set("Authorization", "Bearer gateway-token")
+		deleteRecorder := httptest.NewRecorder()
+		handler.ServeHTTP(deleteRecorder, deleteRequest)
+		if deleteRecorder.Code != http.StatusOK {
+			t.Fatalf("delete status = %d, want %d", deleteRecorder.Code, http.StatusOK)
+		}
+
+		// GET should be forbidden (read denied)
+		readRequest := httptest.NewRequest(http.MethodGet, "/api/session-assets/session-1/asset-1", nil)
+		readRequest.Header.Set("Authorization", "Bearer gateway-token")
+		readRecorder := httptest.NewRecorder()
+		handler.ServeHTTP(readRecorder, readRequest)
+		if readRecorder.Code != http.StatusForbidden {
+			t.Fatalf("read status = %d, want %d", readRecorder.Code, http.StatusForbidden)
+		}
+	})
+}
+
 func TestNetworkServerSessionAssetsRequireAssetPort(t *testing.T) {
 	runtimePort := &runtimePortWithoutSessionAsset{RuntimePort: &runtimePortEventStub{}}
 	server := &NetworkServer{authenticator: staticTokenAuthenticator{token: "gateway-token"}}

internal/runtime/runtime_test.go

@@ -4932,6 +4932,69 @@ func TestProjectImagesForModelRequestCapabilityStates(t *testing.T) {
 	}
 }
 
+// TestProjectImagesForModelRequestEmptyMessages 验证空消息列表不会 panic 并正确返回空结果。
+func TestProjectImagesForModelRequestEmptyMessages(t *testing.T) {
+	t.Parallel()
+	models := []providertypes.ModelDescriptor{{ID: "model-a", CapabilityHints: providertypes.ModelCapabilityHints{
+		ImageInput: providertypes.ModelCapabilityStateUnsupported,
+	}}}
+	projected, err := projectImagesForModelRequest("model-a", models, nil, []providertypes.ContentPart{providertypes.NewTextPart("hello")})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(projected) != 0 {
+		t.Fatalf("expected empty projected messages, got %d", len(projected))
+	}
+}
+
+// TestProjectImagesForModelRequestMixedMessages 验证混合图片和文本的消息中只有图片被投影降级。
+func TestProjectImagesForModelRequestMixedMessages(t *testing.T) {
+	t.Parallel()
+	messages := []providertypes.Message{
+		{
+			Role:  providertypes.RoleUser,
+			Parts: []providertypes.ContentPart{providertypes.NewTextPart("text before image")},
+		},
+		{
+			Role:  providertypes.RoleUser,
+			Parts: []providertypes.ContentPart{providertypes.NewSessionAssetImagePart("asset-1", "image/png")},
+		},
+		{
+			Role:  providertypes.RoleAssistant,
+			Parts: []providertypes.ContentPart{providertypes.NewTextPart("response")},
+		},
+	}
+	models := []providertypes.ModelDescriptor{{ID: "model-a", CapabilityHints: providertypes.ModelCapabilityHints{
+		ImageInput: providertypes.ModelCapabilityStateUnsupported,
+	}}}
+	projected, err := projectImagesForModelRequest("model-a", models, messages, []providertypes.ContentPart{providertypes.NewTextPart("current text")})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(projected) != 3 {
+		t.Fatalf("expected 3 messages, got %d", len(projected))
+	}
+	// 第一条消息应保持纯文本不变
+	if projected[0].Parts[0].Kind != providertypes.ContentPartText {
+		t.Fatalf("first message should be text, got %s", projected[0].Parts[0].Kind)
+	}
+	// 第二条消息中的图片应被替换为占位文本
+	if messagesContainImages(projected) {
+		t.Fatal("expected no images in projected messages for unsupported model")
+	}
+	if !strings.Contains(renderPartsForTest(projected[1].Parts), historicalImageOmittedForModel) {
+		t.Fatal("expected historical image omitted placeholder in second message")
+	}
+	// 第三条消息应保持不变
+	if projected[2].Parts[0].Kind != providertypes.ContentPartText {
+		t.Fatalf("third message should be text, got %s", projected[2].Parts[0].Kind)
+	}
+	// 原始消息不应被修改
+	if !messagesContainImages(messages) {
+		t.Fatal("original messages should still contain images")
+	}
+}
+
 func newRuntimeConfigManager(t *testing.T) *config.Manager {
 	return newRuntimeConfigManagerWithProviderEnvs(t, nil)
 }