[JamieStivala]

Problem and change

An MCP download can return a text summary and owned interpreter references, but nested executeTools calls currently retain only text. This preserves the download's success summary while discarding the file inputs needed by the PTC script.

This change forwards invocation context and cancellation, retains normalized references separately from text, sends references with capability-advertised continuations, and retains host-only attachment metadata on the outer artifact. Ordinary tool input/text behavior stays compatible. Binary content and host attachment metadata are not sent in continuation results.

Fixes #644. Related host report: LibreChat-AI/LibreChat#17092. Coordinated backend change: LibreChat-AI/code-interpreter#371. Backends without that capability return an explicit same-script delivery limitation.

Verification

• Locked install, build, TypeScript and focused PTC/tracing regression tests: 317 passed, 9 existing skips on the refreshed SDK build.
• The focused PR branch passed TypeScript and the same PTC/tracing suites.
• Synthetic PDF/DOCX were exercised through real MCP transports, multipart upload and a real local Code API/NsJail stack. Python and Bash opened the original bytes inside the same PTC script. Browser tests also covered attachment persistence and a subagent PTC download followed by the parent's independent file read.
• MicroVM/OBO and blocking-mode same-script delivery were not verified; blocking mode remains unsupported by the coordinated backend.

References: LangChain tool artifacts, MCP embedded tool resources.

This is my first contribution to this repository, so any feedback is appreciated :) AI assistance was used; reproduction and verification limits are documented above.