feat(web): attach files of any type from the composer, beside images

[ericleepi314]

Why

The web composer's upload menu had an image option only. deepseek-harness offers generic file attachments beside images; this adds the same to ClawCodex.

What changed

Composer (ui-web)

• The Add menu gains File (paperclip) for every model, after Image (which stays gated on vision). Picking it opens a file picker with no type filter; a drop or a paste sorts its files — images the image way (refused with the reason on a model without vision), everything else as a file.
• An attached file becomes a [File #N] chip in the draft and a card under the text (type glyph, name, extension · size, remove ×, #N tag). Same contract as images: the draft is the truth, deleting the chip un-attaches, the strip shows only what the draft claims.
• The user row renders file cards before the caption; a reopened conversation rebuilds them from the agent's header lines and keeps the inlined contents out of the caption.
• Files are capped at 10 MB with the limit named before any upload. The card shows the name the backend kept. A dropped folder is skipped with a notice; a paste with files on the clipboard attaches them the same way a drop does.

Backend

• file.attach gateway RPC (twin of image.attach): base64 in, size refused before decode, temp file, agent control, temp removed.
• Agent attach_file control: copies the upload under its own (sanitized) name into the session's readable artifact directory (…/tool-results/attachments/file-<rand>/<name>, the place accepted image originals go, readable by the Read tool), queues it (cap 8), answers {id, name, path, size}.
• _drain_pending_files at submit: for each file whose chip survives, appends a block after the prompt — [File #N: name] saved at <path> (<size>), then the text contents (≤ 256 KB; larger files are pointed at without being read) or a Read-tool hint for binaries/PDFs/images, via a new read_file_attachment classifier that shares the @path mention rules. A literal </system-reminder> inside inlined contents is neutralised so a file cannot end the envelope early. /clear, resume and a deleted chip drop pending files and remove their persisted copies.
• The prompt's edge readers (the end-anchored +500k turn-budget shorthand, UserPromptSubmit hooks, the blocked-prompt echo) now read the first text block — the user's own words — instead of every text block joined; a trailing file block (or a resized image's metadata block) used to silently defeat the budget and hand hooks the file contents.
• Stored names: Windows reserved device names and Unicode format characters are neutralised; a relative path in the control resolves against the session directory.

Verification

• pytest: tests/server/test_file_attach_control.py (25 new: turn budget and hooks survive a file drain, ephemeral turns leave files queued, image → prompt → file block order, resume/clear/dropped-chip cleanup, failed copy and cap race leave nothing, persistence under the artifact dir, drain inlining, chip deletion drops, binary hint without mojibake, large-text pointer, size/pending caps, missing path, /clear, classifier, leaf sanitizing, gateway round trip / data URL / empty file / oversize / bad base64 / refused control).

• vitest: 718 green (new: chip kinds and labels, menu row order and vision gating, composer picker + card + remove, drop sorting, transcript hydration, message cards, captions, actions upload/refusal/limit).

• Browser e2e against clawcodex serve with the live model: attached a text file, asked for its content, got the code word back; after a reload the user row shows the file card and none of the inlined contents.

• Two critic review rounds: the first (REQUEST CHANGES) is answered by the second commit; the second (APPROVE with follow-ups) by the third — shutdown discards unsent copies, the file drain runs in a thread, stricter name filtering, any spelling of the closing reminder tag neutralised, uploads landing after more typing insert into the current draft, entry-based folder detection, and a user's own first block is never read as a file block.

• vitest: 719 green; pytest: 10,347 green locally; Windows CI fails only the four pre-existing tests plus one wall-clock-ordering memory test unrelated to this change.

🤖 Generated with Claude Code

[ericleepi314]

Follow-up noted during the e2e run (pre-existing, not changed here): _build_runtime constructs the session's ToolContext without a session_id, so resolve_tool_results_dir falls back to <tmp>/clawcodex_tool_results/<pid>/tool-results/ for every agent-server session. Accepted image originals already land there; attached files now do too. The inlined contents ride in the conversation regardless, so a reopened text attachment is intact, but a binary attachment's saved path (the Read-tool hint) is only as durable as the temp directory and is keyed by process id. Passing session_id=sess.session_id would move both to ~/.clawcodex/<workspace>/<session>/tool-results/attachments/; that also relocates spilled tool results, so it deserves its own change.

[github-actions]

Test Results

     5 files   1 021 suites   30m 51s ⏱️
15 996 tests 15 969 ✅ 22 💤 5 ❌
31 963 runs  31 887 ✅ 71 💤 5 ❌

For more details on these failures, see this check.

Results for commit 0fd555b.

♻️ This comment has been updated with latest results.

[ericleepi314]

Deferred follow-ups from the two review rounds (none loses an attachment, misroutes a prompt, or leaves files behind):

• Aggregate inline cap. Eight files × 256 KiB can put ~2 MiB of inlined text into one prompt; the existing prompt-too-long path then asks for /compact. Tighter than @path mentions (no cap at all), but a per-prompt cap (e.g. 512 KiB total, the rest pointed at the Read tool) would be cheap.
• Raw control callers with an empty prompt. attach_file with placeholder: False (not sent by the web client) and an empty user text makes the file block the first text block, so the turn budget and hooks would read its header. Reject an empty prompt that carries attachments, or have the drains mark their blocks.
• Client/server cap duplication. MAX_FILE_BYTES in attachments.ts mirrors MAX_ATTACHED_FILE_BYTES; a server bump desyncs the pre-upload notice (the server refusal still names the real cap). Carrying it on system/init would remove the copy.
• Wording. A file that vanished between attach and submit is described as "a binary file and was not inlined"; the model's Read then surfaces the real error. A pasted screenshot now carries the clipboard's name (image.png in Chrome) instead of pasted-image.png.
• Inherited from images. A file attached while an earlier prompt is queued client-side is dropped by that prompt's drain (its chip is absent), and the later prompt carries an orphan chip. Same behavior as image chips today.
• Artifact directory (noted above): agent-server sessions build their tool context without a session id, so copies land in the temp fallback keyed by process id.