diff --git a/internal/service/task_service.go b/internal/service/task_service.go
index 258c0aa..7a5f393 100644
--- a/internal/service/task_service.go
+++ b/internal/service/task_service.go
@@ -284,16 +284,43 @@ func (s *TaskService) ProcessTask(ctx context.Context, taskID int64) error {
 		}
 	}
 
+	// 16a. Auto-inject WORK_DIR if the app defines it as a parameter.
+	// The work directory is created by the server, not provided by the user.
+	for _, p := range params {
+		if p.Name == "WORK_DIR" {
+			values["WORK_DIR"] = workDir
+			break
+		}
+	}
+
+	// 16b. Map input_file_ids to file-type parameters by order.
+	// User selects files via FilePicker; we assign their IDs to file/directory
+	// params sequentially so the backend can resolve them to filenames later.
+	var inputFileIDs []int64
+	if len(task.InputFileIDs) > 0 {
+		if err := json.Unmarshal(task.InputFileIDs, &inputFileIDs); err != nil {
+			return fail(model.TaskStepSubmitting, fmt.Sprintf("parse input file ids: %v", err))
+		}
+	}
+	if len(inputFileIDs) > 0 {
+		fileParamIdx := 0
+		for _, p := range params {
+			if p.Type != model.ParamTypeFile && p.Type != model.ParamTypeDirectory {
+				continue
+			}
+			if fileParamIdx < len(inputFileIDs) {
+				values[p.Name] = strconv.FormatInt(inputFileIDs[fileParamIdx], 10)
+				fileParamIdx++
+			}
+		}
+	}
+
+	// 16c. Validate all params (WORK_DIR and file params now have values).
 	if err := ValidateParams(params, values); err != nil {
 		return fail(model.TaskStepSubmitting, err.Error())
 	}
 
-	if strings.Contains(app.ScriptTemplate, "$WORK_DIR") {
-		values["WORK_DIR"] = workDir
-	}
-
-	// Resolve file-type parameters: user sends file_id, we replace with filename.
-	// Only query the database if there are file/directory-type parameters with values.
+	// 16d. Resolve file-type parameter values: file_id → filename.
 	var fileLookupIDs []int64
 	for _, p := range params {
 		if p.Type != model.ParamTypeFile && p.Type != model.ParamTypeDirectory {