feat(agent): 完善权限与结果引用安全

src/server.ts

@@ -37,6 +37,7 @@ import {
   markRuntimeSessionAuthExpired,
   type RuntimeSessionContext,
 } from "./runtime/sessionContext.js";
+import { ensureDirectory } from "./utils/fileStore.js";
 import { SkillStore } from "./skills/store.js";
 
 const app = express();
@@ -55,7 +56,11 @@ const learningOrchestrator = new LearningOrchestrator(
   skillStore,
 );
 const resultReferenceStore = new ResultReferenceStore();
-const resultReferenceResolver = new ResultReferenceResolver(resultReferenceStore);
+const resultReferenceResolver = new ResultReferenceResolver(
+  resultReferenceStore,
+  config.RESULT_REF_IMPORT_DIR,
+  config.RESULT_REF_IMPORT_MAX_BYTES,
+);
 const internalToken = config.AGENT_INTERNAL_TOKEN ?? randomUUID();
 const credentialRefreshCoordinator = new CredentialRefreshCoordinator();
 
@@ -660,6 +665,7 @@ const bootstrap = async () => {
     learningOrchestrator.initialize(),
     memoryStore.initialize(),
     resultReferenceStore.initialize(),
+    ensureDirectory(config.RESULT_REF_IMPORT_DIR),
     sessionTranscriptStore.initialize(),
   ]);
 };