fix(daemon): seed Claude image attachments

Author: YOMXXX

server/internal/daemon/client.go

@@ -670,6 +670,60 @@ func (c *Client) postJSONViaWithRetry(ctx context.Context, httpClient *http.Clie
 	}
 }
 
+type AttachmentResponse struct {
+	ID          string `json:"id"`
+	DownloadURL string `json:"download_url"`
+	Filename    string `json:"filename"`
+	ContentType string `json:"content_type"`
+	SizeBytes   int64  `json:"size_bytes"`
+}
+
+func (c *Client) DownloadAttachment(ctx context.Context, attachmentID string) (*AttachmentResponse, []byte, error) {
+	var att AttachmentResponse
+	if err := c.getJSON(ctx, fmt.Sprintf("/api/attachments/%s", attachmentID), &att); err != nil {
+		return nil, nil, err
+	}
+	if att.DownloadURL == "" {
+		return nil, nil, fmt.Errorf("attachment %s has no download_url", attachmentID)
+	}
+	data, err := c.downloadFile(ctx, att.DownloadURL)
+	if err != nil {
+		return nil, nil, err
+	}
+	return &att, data, nil
+}
+
+func (c *Client) downloadFile(ctx context.Context, downloadURL string) ([]byte, error) {
+	isRelative := !strings.HasPrefix(downloadURL, "http://") && !strings.HasPrefix(downloadURL, "https://")
+	if isRelative {
+		if c.baseURL == "" {
+			return nil, fmt.Errorf("download URL %q is relative but client has no base URL", downloadURL)
+		}
+		downloadURL = c.baseURL + downloadURL
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	if isRelative && c.token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.token)
+		c.setIdentityHeaders(req)
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		data, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return nil, &requestError{Method: http.MethodGet, Path: downloadURL, StatusCode: resp.StatusCode, Body: strings.TrimSpace(string(data))}
+	}
+	return io.ReadAll(io.LimitReader(resp.Body, 100*1024*1024+1))
+}
+
 func (c *Client) postJSON(ctx context.Context, path string, reqBody any, respBody any) error {
 	return c.postJSONVia(ctx, c.client, path, reqBody, respBody)
 }

server/internal/daemon/client_test.go

@@ -255,6 +255,74 @@ func TestDefaultTerminalRetrySchedule_MatchesAgreedPlan(t *testing.T) {
 	}
 }
 
+func TestClient_DownloadAttachmentDownloadsRelativeURLWithAuthHeaders(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/attachments/att-1":
+			if got := r.Header.Get("Authorization"); got != "Bearer tok" {
+				t.Errorf("metadata request Authorization = %q, want Bearer tok", got)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{
+				"id":           "att-1",
+				"download_url": "/download/att-1",
+				"filename":     "shot.png",
+				"content_type": "image/png",
+			})
+		case "/download/att-1":
+			if got := r.Header.Get("Authorization"); got != "Bearer tok" {
+				t.Errorf("download request Authorization = %q, want Bearer tok", got)
+			}
+			if got := r.Header.Get("X-Client-Platform"); got != "daemon" {
+				t.Errorf("download request X-Client-Platform = %q, want daemon", got)
+			}
+			w.Write([]byte("png-bytes"))
+		default:
+			t.Errorf("unexpected path: %s", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL)
+	c.SetToken("tok")
+
+	meta, data, err := c.DownloadAttachment(context.Background(), "att-1")
+	if err != nil {
+		t.Fatalf("DownloadAttachment: %v", err)
+	}
+	if meta.Filename != "shot.png" || meta.ContentType != "image/png" {
+		t.Fatalf("unexpected attachment metadata: %+v", meta)
+	}
+	if string(data) != "png-bytes" {
+		t.Fatalf("downloaded data = %q, want png-bytes", string(data))
+	}
+}
+
+func TestClient_DownloadFileAbsoluteURLOmitsAuthHeaders(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "" {
+			t.Errorf("absolute download Authorization = %q, want empty", got)
+		}
+		if got := r.Header.Get("X-Client-Platform"); got != "" {
+			t.Errorf("absolute download X-Client-Platform = %q, want empty", got)
+		}
+		w.Write([]byte("image-data"))
+	}))
+	defer srv.Close()
+
+	c := NewClient("https://api.example.test")
+	c.SetToken("tok")
+
+	data, err := c.downloadFile(context.Background(), srv.URL+"/signed")
+	if err != nil {
+		t.Fatalf("downloadFile: %v", err)
+	}
+	if string(data) != "image-data" {
+		t.Fatalf("downloaded data = %q, want image-data", string(data))
+	}
+}
+
 func TestNormalizeGOOS(t *testing.T) {
 	cases := map[string]string{
 		"darwin":  "macos",

server/internal/daemon/daemon.go

@@ -3262,6 +3262,56 @@ func providerNeedsInlineSystemPrompt(provider string) bool {
 	}
 }
 
+const (
+	maxClaudeInitialImages     = 4
+	maxClaudeInitialImageBytes = 10 * 1024 * 1024
+)
+
+func (d *Daemon) claudeInitialImages(ctx context.Context, task Task, taskLog *slog.Logger) []agent.InputImage {
+	attachments := make([]AttachmentMeta, 0, len(task.IssueAttachments)+len(task.ChatMessageAttachments))
+	attachments = append(attachments, task.IssueAttachments...)
+	attachments = append(attachments, task.ChatMessageAttachments...)
+	if len(attachments) == 0 {
+		return nil
+	}
+
+	images := make([]agent.InputImage, 0, min(len(attachments), maxClaudeInitialImages))
+	for _, attachment := range attachments {
+		if len(images) >= maxClaudeInitialImages {
+			break
+		}
+		if attachment.ID == "" || !strings.HasPrefix(strings.ToLower(attachment.ContentType), "image/") {
+			continue
+		}
+		meta, data, err := d.client.DownloadAttachment(ctx, attachment.ID)
+		if err != nil {
+			taskLog.Warn("claude initial image download failed", "attachment_id", attachment.ID, "error", err)
+			continue
+		}
+		if len(data) == 0 || len(data) > maxClaudeInitialImageBytes {
+			taskLog.Warn("claude initial image skipped due to size", "attachment_id", attachment.ID, "bytes", len(data))
+			continue
+		}
+		mediaType := attachment.ContentType
+		if meta != nil && meta.ContentType != "" {
+			mediaType = meta.ContentType
+		}
+		if !strings.HasPrefix(strings.ToLower(mediaType), "image/") {
+			continue
+		}
+		filename := attachment.Filename
+		if meta != nil && meta.Filename != "" {
+			filename = meta.Filename
+		}
+		images = append(images, agent.InputImage{
+			Filename:  filename,
+			MediaType: mediaType,
+			Data:      data,
+		})
+	}
+	return images
+}
+
 // gateResumeToReusedWorkdir clears the task's prior session unless the task
 // runs in the exact workdir the session was recorded against, and reports
 // whether that workdir was reused. CLI backends key their session stores to
@@ -3922,6 +3972,9 @@ func (d *Daemon) runTask(ctx context.Context, task Task, provider string, slot i
 		ThinkingLevel:             thinkingLevel,
 		OpenclawMode:              openclawMode,
 	}
+	if provider == "claude" {
+		execOpts.InitialImages = d.claudeInitialImages(ctx, task, taskLog)
+	}
 	// Some providers do not reliably load the per-task runtime config files we
 	// write into the task workdir:
 	//   - openclaw is pinned to the task workdir via the per-task config we

server/internal/daemon/daemon_test.go

@@ -903,6 +903,44 @@ func TestWatchTaskCancellation_RunningTaskNotInterrupted(t *testing.T) {
 	}
 }
 
+func TestClaudeInitialImagesDownloadsImageAttachments(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/attachments/img-1":
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{
+				"id":           "img-1",
+				"download_url": "/files/img-1",
+				"filename":     "server-shot.png",
+				"content_type": "image/png",
+			})
+		case "/files/img-1":
+			w.Write([]byte("image-bytes"))
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	d := &Daemon{client: NewClient(srv.URL), logger: slog.Default()}
+	images := d.claudeInitialImages(context.Background(), Task{
+		IssueAttachments: []AttachmentMeta{
+			{ID: "img-1", Filename: "client-shot.png", ContentType: "image/png"},
+			{ID: "txt-1", Filename: "notes.txt", ContentType: "text/plain"},
+		},
+	}, slog.New(slog.NewTextHandler(io.Discard, nil)))
+
+	if len(images) != 1 {
+		t.Fatalf("initial images length = %d, want 1", len(images))
+	}
+	got := images[0]
+	if got.Filename != "server-shot.png" || got.MediaType != "image/png" || string(got.Data) != "image-bytes" {
+		t.Fatalf("unexpected initial image: %+v data=%q", got, string(got.Data))
+	}
+}
+
 func TestMergeUsage(t *testing.T) {
 	t.Parallel()
 

server/internal/daemon/prompt_test.go

@@ -253,7 +253,7 @@ func TestBuildChatPromptAttachmentIDsCanBeBoundToCreatedIssues(t *testing.T) {
 	task := Task{
 		ChatSessionID: "sess-1",
 		ChatMessage:   "please create an issue with this screenshot",
-		ChatMessageAttachments: []ChatAttachmentMeta{
+		ChatMessageAttachments: []AttachmentMeta{
 			{ID: "019ec09d-6222-722b-bdfa-427b105d80be", Filename: "shot.png", ContentType: "image/png"},
 		},
 	}

server/internal/daemon/types.go

@@ -79,11 +79,12 @@ type Task struct {
 	TriggerAuthorName        string                `json:"trigger_author_name,omitempty"`         // display name of the triggering comment author
 	NewCommentCount          int                   `json:"new_comment_count,omitempty"`           // issue-wide comments since this agent's last run (excludes its own and the injected trigger); 0/omitted for old daemons or cold start
 	NewCommentsSince         string                `json:"new_comments_since,omitempty"`          // RFC3339 anchor (last run's started_at) the count is measured from; empty on cold start
+	IssueAttachments         []AttachmentMeta      `json:"issue_attachments,omitempty"`           // attachments linked to the issue; Claude embeds image attachments directly when possible
 	ChatSessionID            string                `json:"chat_session_id,omitempty"`             // non-empty for chat tasks
 	ChatChannelType          string                `json:"chat_channel_type,omitempty"`           // "slack" when the chat session is backed by an IM channel; empty for a web-only chat. Drives the channel-awareness block in the prompt
 	ChatInThread             bool                  `json:"chat_in_thread,omitempty"`              // true when the latest @mention was a thread reply; selects which read command the prompt tells the agent to start with
 	ChatMessage              string                `json:"chat_message,omitempty"`                // user message content for chat tasks
-	ChatMessageAttachments   []ChatAttachmentMeta  `json:"chat_message_attachments,omitempty"`    // attachments linked to the chat message; agent uses these to `multica attachment download <id>`
+	ChatMessageAttachments   []AttachmentMeta      `json:"chat_message_attachments,omitempty"`    // attachments linked to the chat message; agent uses these to `multica attachment download <id>`
 	ChatIntro                bool                  `json:"chat_intro,omitempty"`                  // true for the agent's proactive self-introduction chat (no user message); selects the self-introduction prompt in buildChatPrompt
 	AutopilotRunID           string                `json:"autopilot_run_id,omitempty"`            // non-empty for autopilot run_only tasks
 	AutopilotID              string                `json:"autopilot_id,omitempty"`                // autopilot that spawned this run
@@ -130,12 +131,11 @@ type Task struct {
 	AuthToken string `json:"auth_token,omitempty"`
 }
 
-// ChatAttachmentMeta is the structured attachment metadata the daemon
-// hands to the agent for chat tasks. We pass id + filename + content_type
-// so the chat prompt can list them explicitly and instruct the agent to
-// run `multica attachment download <id>` instead of guessing from a
-// signed CDN URL (which expires).
-type ChatAttachmentMeta struct {
+// AttachmentMeta is the structured attachment metadata the daemon receives
+// in claim responses. We pass id + filename + content_type so prompts can
+// list attachments explicitly, and Claude can embed image files directly in
+// the initial user message instead of going through the Read tool_result path.
+type AttachmentMeta struct {
 	ID          string `json:"id"`
 	Filename    string `json:"filename"`
 	ContentType string `json:"content_type,omitempty"`

server/internal/handler/agent.go

@@ -320,11 +320,12 @@ type AgentTaskResponse struct {
 	TriggerAuthorName        string                 `json:"trigger_author_name,omitempty"`         // display name of the triggering comment author
 	NewCommentCount          int                    `json:"new_comment_count,omitempty"`           // trigger-thread comments since last run; excludes injected trigger + own comments; omitempty so old daemons ignore it
 	NewCommentsSince         string                 `json:"new_comments_since,omitempty"`          // RFC3339 anchor (last run's started_at) the count is measured from; omitempty so old daemons ignore it
+	IssueAttachments         []AttachmentMeta       `json:"issue_attachments,omitempty"`           // attachments linked to the issue
 	ChatSessionID            string                 `json:"chat_session_id,omitempty"`             // non-empty for chat tasks
 	ChatChannelType          string                 `json:"chat_channel_type,omitempty"`           // "slack" when the chat session is backed by an IM channel; empty for a web-only chat. Makes the agent channel-aware (read history from the channel, not Multica)
 	ChatInThread             bool                   `json:"chat_in_thread,omitempty"`              // true when the latest @mention was a thread reply; tells the agent to start with `multica chat thread` vs `multica chat history`
 	ChatMessage              string                 `json:"chat_message,omitempty"`                // user message for chat tasks
-	ChatMessageAttachments   []ChatAttachmentMeta   `json:"chat_message_attachments,omitempty"`    // attachments on the user message — agent calls `multica attachment download <id>` per entry
+	ChatMessageAttachments   []AttachmentMeta       `json:"chat_message_attachments,omitempty"`    // attachments on the user message — agent calls `multica attachment download <id>` per entry
 	ChatIntro                bool                   `json:"chat_intro,omitempty"`                  // true for the agent's proactive self-introduction chat (is_agent_intro session, no user message); the daemon builds an intro prompt instead of a reply prompt
 	AutopilotRunID           string                 `json:"autopilot_run_id,omitempty"`            // non-empty for autopilot-spawned tasks
 	AutopilotID              string                 `json:"autopilot_id,omitempty"`                // autopilot that spawned this task
@@ -376,13 +377,13 @@ type AgentTaskResponse struct {
 	AuthToken string `json:"auth_token,omitempty"`
 }
 
-// ChatAttachmentMeta is the structured attachment metadata embedded in
-// claim responses for chat tasks. The agent uses these to run
-// `multica attachment download <id>` rather than guessing from the
-// markdown URL (which is signed and 30-min expiring on private CDN).
+// AttachmentMeta is the structured attachment metadata embedded in
+// claim responses. The daemon uses these to embed image attachments directly
+// for Claude or to tell agents which IDs they can download through the CLI
+// rather than guessing from signed markdown URLs.
 // The mirror struct on the daemon side lives in internal/daemon/types.go
 // and uses the same JSON field names.
-type ChatAttachmentMeta struct {
+type AttachmentMeta struct {
 	ID          string `json:"id"`
 	Filename    string `json:"filename"`
 	ContentType string `json:"content_type,omitempty"`

server/internal/handler/daemon.go

@@ -1651,6 +1651,20 @@ func (h *Handler) ClaimTaskByRuntime(w http.ResponseWriter, r *http.Request) {
 					resp.Repos = repos
 				}
 			}
+
+			if atts, attErr := h.Queries.ListAttachmentsByIssue(r.Context(), db.ListAttachmentsByIssueParams{
+				IssueID:     issue.ID,
+				WorkspaceID: issue.WorkspaceID,
+			}); attErr == nil && len(atts) > 0 {
+				resp.IssueAttachments = make([]AttachmentMeta, len(atts))
+				for j, a := range atts {
+					resp.IssueAttachments[j] = AttachmentMeta{
+						ID:          uuidToString(a.ID),
+						Filename:    a.Filename,
+						ContentType: a.ContentType,
+					}
+				}
+			}
 		}
 
 		// Load every planned input as one chronological, de-duplicated set.
@@ -1943,7 +1957,7 @@ func (h *Handler) ClaimTaskByRuntime(w http.ResponseWriter, r *http.Request) {
 					WorkspaceID:   parseUUID(resp.WorkspaceID),
 				}); attErr == nil && len(atts) > 0 {
 					for _, a := range atts {
-						resp.ChatMessageAttachments = append(resp.ChatMessageAttachments, ChatAttachmentMeta{
+						resp.ChatMessageAttachments = append(resp.ChatMessageAttachments, AttachmentMeta{
 							ID:          uuidToString(a.ID),
 							Filename:    a.Filename,
 							ContentType: a.ContentType,