@desplega.ai/agent-swarm 1.82.0 → 1.83.1

package/src/http/tasks.ts

@@ -10,6 +10,7 @@ import {
   getLeadAgent,
   getLogsByTaskId,
   getPausedTasksForAgent,
+  getTaskAttachments,
   getTaskById,
   getTasksCount,
   getUserById,
@@ -140,7 +141,9 @@ const getTask = route({
   method: "get",
   path: "/api/tasks/{id}",
   pattern: ["api", "tasks", null],
-  summary: "Get task details with logs",
+  summary: "Get task details with logs and attachments",
+  description:
+    "Returns the full `AgentTask` row decorated with `logs` (capped by `logsLimit`) and `attachments` (pointer-based artifacts stored on the task, ordered by `created_at`).",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
   query: z.object({
@@ -148,7 +151,7 @@ const getTask = route({
     logsLimit: z.coerce.number().int().min(1).max(1000).optional(),
   }),
   responses: {
-    200: { description: "Task with logs" },
+    200: { description: "Task with logs and attachments" },
     404: { description: "Task not found" },
   },
 });
@@ -523,7 +526,8 @@ export async function handleTasks(
     }
 
     const logs = getLogsByTaskId(parsed.params.id, parsed.query.logsLimit ?? 200);
-    json(res, { ...task, logs });
+    const attachments = getTaskAttachments(parsed.params.id);
+    json(res, { ...task, logs, attachments });
     return true;
   }
 

package/src/providers/pi-mono-adapter.ts

@@ -72,17 +72,34 @@ function modelToCredKeys(modelStr: string | undefined): string[] | null {
 
 /**
  * Pi-mono is satisfied by ANY of:
- *   1. `~/.pi/agent/auth.json` exists.
- *   2. `MODEL_OVERRIDE` is set to a provider-prefixed model — only the
+ *   1. `MODEL_OVERRIDE` selects the `amazon-bedrock` provider — credential
+ *      resolution is delegated to the AWS SDK's default chain at first
+ *      inference call. agent-swarm does no presence check; if creds are
+ *      missing the SDK error surfaces in the session log.
+ *   2. `~/.pi/agent/auth.json` exists.
+ *   3. `MODEL_OVERRIDE` is set to a provider-prefixed model — only the
  *      matching provider's key is required.
- *   3. `MODEL_OVERRIDE` is empty / unprefixed — any one of the supported
+ *   4. `MODEL_OVERRIDE` is empty / unprefixed — any one of the supported
  *      keys (ANTHROPIC_API_KEY / OPENROUTER_API_KEY / OPENAI_API_KEY) is
  *      enough.
+ *
+ * Bedrock is checked first so a stale `auth.json` (Anthropic / OpenRouter
+ * creds from a previous login) doesn't get falsely reported as the
+ * satisfying source when the model is actually going to AWS.
  */
 export function checkPiMonoCredentials(
   env: Record<string, string | undefined>,
   opts: CredCheckOptions = {},
 ): CredStatus {
+  if (env.MODEL_OVERRIDE?.toLowerCase().startsWith("amazon-bedrock/")) {
+    return {
+      ready: true,
+      missing: [],
+      satisfiedBy: "sdk-delegated",
+      hint: "AWS SDK will resolve credentials at first Bedrock call (env, ~/.aws/*, SSO, IMDS, etc.).",
+    };
+  }
+
   const homeDir = opts.homeDir ?? env.HOME ?? "/root";
   const probe = opts.fs?.existsSync ?? existsSync;
   const authFile = `${homeDir}/.pi/agent/auth.json`;

package/src/providers/types.ts

@@ -163,11 +163,15 @@ export interface ProviderAdapter {
  *   (e.g. `codex login --with-api-key`) still needs to run before the
  *   adapter can use them. Workers should treat this as "ready" for the
  *   purposes of the boot loop — the side-effect is the entrypoint's job.
+ * - `'sdk-delegated'` — the harness's underlying SDK owns credential
+ *   resolution at runtime (e.g. AWS SDK default chain for pi-mono +
+ *   `MODEL_OVERRIDE=amazon-bedrock/...`); agent-swarm does no presence check
+ *   and any error surfaces from the first inference call.
  */
 export interface CredStatus {
   ready: boolean;
   missing: string[];
-  satisfiedBy?: "env" | "file" | "side-effect-pending";
+  satisfiedBy?: "env" | "file" | "side-effect-pending" | "sdk-delegated";
   hint?: string;
 }
 

package/src/slack/blocks.ts

@@ -5,7 +5,8 @@
  * across responses.ts, handlers.ts, thread-buffer.ts).
  */
 
-import { getAppUrl } from "../utils/constants";
+import type { TaskAttachment } from "../types";
+import { buildAgentFsLiveUrl, getAppUrl } from "../utils/constants";
 
 // Slack limits section text to 3000 chars; we use 2900 for safety
 const MAX_SECTION_LENGTH = 2900;
@@ -127,6 +128,62 @@ function cancelActionBlock(taskId: string): SlackBlock {
 
 // --- Utilities ---
 
+// Mirrors the `store-progress` input cap so a misbehaving agent can't fill
+// the Slack card with hundreds of lines.
+const SLACK_ATTACHMENTS_MAX = 20;
+
+/**
+ * Resolve an attachment to a Slack-friendly display string — a plain URL
+ * when one can be derived, otherwise a `<kind>:<pointer>` fallback. We use
+ * *plain* URLs (no `<URL|text>` mrkdwn shortcut) because Slack auto-unfurls
+ * them and the shortcut form has historically triggered `invalid_blocks`.
+ *
+ * `agent-fs` attachments emit a public live-host URL when the row carries
+ * `orgId` and `driveId` (or when the operator-set
+ * `AGENT_FS_DEFAULT_ORG_ID` / `AGENT_FS_DEFAULT_DRIVE_ID` env-vars provide
+ * a fallback). Without either, we keep the `agent-fs:<path>` raw fallback so
+ * the link is at least copy-pasteable.
+ */
+function resolveAttachmentDisplay(a: TaskAttachment): string {
+  switch (a.kind) {
+    case "url":
+      return a.url ?? "";
+    case "page":
+      return a.pageId ? `${getAppUrl()}/pages/${a.pageId}` : "page:";
+    case "agent-fs": {
+      const url = buildAgentFsLiveUrl({
+        path: a.path,
+        orgId: a.orgId,
+        driveId: a.driveId,
+      });
+      return url ?? `agent-fs:${a.path ?? ""}`;
+    }
+    case "shared-fs":
+      return `shared-fs:${a.path ?? ""}`;
+  }
+}
+
+/**
+ * Build a compact "Attachments (N):" block in Slack mrkdwn for the completion
+ * card. Returns empty string when there are no attachments so callers can
+ * blindly concat without worrying about a stray label.
+ *
+ * Per-line format: `• <name> — _<intent>_ — <plain URL>` where the italic
+ * descriptor falls back to `description` and is omitted when both are empty.
+ */
+export function formatAttachmentsBlockForSlack(attachments: TaskAttachment[]): string {
+  if (attachments.length === 0) return "";
+  const capped = attachments.slice(0, SLACK_ATTACHMENTS_MAX);
+  const lines = capped.map((a) => {
+    const descriptor = a.intent || a.description;
+    const middle = descriptor ? ` — _${descriptor}_` : "";
+    const display = resolveAttachmentDisplay(a);
+    const tail = display ? ` — ${display}` : "";
+    return `• *${a.name}*${middle}${tail}`;
+  });
+  return `\n\n*Attachments (${attachments.length}):*\n${lines.join("\n")}`;
+}
+
 /**
  * Format a duration between two dates in a compact human-readable form.
  * Examples: "45s", "2m 14s", "1h 30m"
@@ -154,6 +211,14 @@ export interface TreeNode {
   slackReplySent?: boolean;
   output?: string; // Only used when !slackReplySent on completion
   failureReason?: string; // Always shown on failure
+  /**
+   * Pointer-based attachments to surface on the tree-message render. The
+   * watcher populates this for completed/terminal nodes so links survive on
+   * the tree path (`buildTreeBlocks`) — not just the DM completion card
+   * (`buildCompletedBlocks` / `responses.ts`). Optional so unit tests and
+   * non-attachment paths stay terse.
+   */
+  attachments?: TaskAttachment[];
   children: TreeNode[];
 }
 
@@ -169,6 +234,11 @@ export function buildCompletedBlocks(opts: {
   body: string;
   duration?: string;
   minimal?: boolean; // true = suppress body (agent already replied via slack-reply)
+  /**
+   * Optional trailer rendered even when `minimal` is true. Used for the
+   * attachments block so links survive on the compact completion card.
+   */
+  trailer?: string;
 }): SlackBlock[] {
   const taskLink = getTaskLink(opts.taskId);
   let line = `✅ *${opts.agentName}* (${taskLink})`;
@@ -181,6 +251,10 @@ export function buildCompletedBlocks(opts: {
     for (const chunk of splitText(opts.body)) {
       blocks.push(sectionBlock(chunk));
     }
+  } else if (opts.trailer && opts.trailer.length > 0) {
+    for (const chunk of splitText(opts.trailer)) {
+      blocks.push(sectionBlock(chunk));
+    }
   }
   return blocks;
 }
@@ -375,6 +449,34 @@ function isTreeActive(node: TreeNode): boolean {
   return node.children.some(isTreeActive);
 }
 
+// Cap on completed-task attachment blocks rendered per tree-message. Slack's
+// API enforces 50-block / 40KB ceilings; the existing tree section + cancel
+// buttons already consume a few blocks, and each attachment block can carry
+// up to SLACK_ATTACHMENTS_MAX (=20) lines. 10 keeps us well inside both
+// limits even on wide trees while preserving the most-recent completions.
+const SLACK_TREE_ATTACHMENT_BLOCKS_MAX = 10;
+
+/**
+ * Flatten a tree (in render order: root first, then children) and collect
+ * every completed node whose `attachments` array is non-empty. The tree
+ * walks roots → children, mirroring `renderTree` so the attachment ordering
+ * matches what the reader sees in the main tree section.
+ */
+function collectAttachmentNodes(roots: TreeNode[]): TreeNode[] {
+  const out: TreeNode[] = [];
+  for (const root of roots) {
+    const stack: TreeNode[] = [root];
+    while (stack.length > 0) {
+      const node = stack.shift() as TreeNode;
+      if (node.status === "completed" && node.attachments && node.attachments.length > 0) {
+        out.push(node);
+      }
+      for (const child of node.children) stack.push(child);
+    }
+  }
+  return out;
+}
+
 /**
  * Build Slack blocks for a tree-based status message.
  *
@@ -383,6 +485,11 @@ function isTreeActive(node: TreeNode): boolean {
  *
  * For in-progress trees, includes a cancel button per active root.
  *
+ * Completed nodes that carry `attachments` (populated by the watcher from
+ * `task_attachments`) emit one extra section block per node listing the
+ * pointer-based artifacts. Capped at {@link SLACK_TREE_ATTACHMENT_BLOCKS_MAX}
+ * per tree-message; overflow becomes a `… and M more …` context footer.
+ *
  * @param roots - Array of root TreeNode objects (one per assigned task in a round)
  * @returns SlackBlock[] suitable for chat.postMessage / chat.update
  */
@@ -394,6 +501,30 @@ export function buildTreeBlocks(roots: TreeNode[]): SlackBlock[] {
   const treeTexts = roots.map(renderTree);
   const blocks: SlackBlock[] = [sectionBlock(treeTexts.join("\n\n"))];
 
+  // Attachment blocks for completed nodes, with per-tree-message cap.
+  const attachmentNodes = collectAttachmentNodes(roots);
+  const visibleAttachmentNodes = attachmentNodes.slice(0, SLACK_TREE_ATTACHMENT_BLOCKS_MAX);
+  for (const node of visibleAttachmentNodes) {
+    const body = formatAttachmentsBlockForSlack(node.attachments ?? []);
+    if (!body) continue;
+    // `formatAttachmentsBlockForSlack` returns a string starting with two
+    // newlines so it can be appended directly to a completion body. In tree
+    // mode we render the block on its own, prefixed by a header that ties
+    // the attachments back to the right child node.
+    const header = `*${node.agentName}* (${getTaskLink(node.taskId)})`;
+    blocks.push(sectionBlock(`${header}${body}`));
+  }
+  const hiddenAttachmentNodes = attachmentNodes.length - visibleAttachmentNodes.length;
+  if (hiddenAttachmentNodes > 0) {
+    blocks.push(
+      contextBlock(
+        `_… and ${hiddenAttachmentNodes} more completed task${
+          hiddenAttachmentNodes === 1 ? "" : "s"
+        } with attachments_`,
+      ),
+    );
+  }
+
   // Add cancel buttons for active roots
   for (const root of roots) {
     if (isTreeActive(root)) {

package/src/slack/responses.ts

@@ -1,5 +1,5 @@
 import type { WebClient } from "@slack/web-api";
-import { getAgentById } from "../be/db";
+import { getAgentById, getTaskAttachments } from "../be/db";
 import type { Agent, AgentTask } from "../types";
 import { getSlackApp } from "./app";
 import {
@@ -7,6 +7,7 @@ import {
   buildCompletedBlocks,
   buildFailedBlocks,
   buildProgressBlocks,
+  formatAttachmentsBlockForSlack,
   formatDuration,
   markdownToSlack,
 } from "./blocks";
@@ -50,6 +51,8 @@ export async function sendTaskResponse(task: AgentTask): Promise<boolean> {
     if (task.status === "completed") {
       const output = task.output || "Task completed.";
       const slackOutput = markdownToSlack(output);
+      const attachmentsBlock = formatAttachmentsBlockForSlack(getTaskAttachments(task.id));
+      const body = slackOutput + attachmentsBlock;
       const duration =
         task.finishedAt && task.createdAt
           ? formatDuration(new Date(task.createdAt), new Date(task.finishedAt))
@@ -60,14 +63,18 @@ export async function sendTaskResponse(task: AgentTask): Promise<boolean> {
       const blocks = buildCompletedBlocks({
         agentName,
         taskId: task.id,
-        body: slackOutput,
+        body,
         duration,
+        // When the agent already posted output via slack-reply, the header
+        // card stays minimal. We still surface the attachments block as a
+        // trailing addendum so links are visible without expanding the card.
         minimal: !!task.slackReplySent,
+        trailer: task.slackReplySent ? attachmentsBlock : undefined,
       });
       await sendWithPersona(client, {
         channel: task.slackChannelId,
         thread_ts: task.slackThreadTs,
-        text: task.slackReplySent ? `✅ ${agentName} completed` : slackOutput,
+        text: task.slackReplySent ? `✅ ${agentName} completed` : body,
         username: getAgentDisplayName(agent),
         icon_emoji: getAgentEmoji(agent),
         blocks,
@@ -175,6 +182,8 @@ export async function updateToFinal(task: AgentTask, messageTs: string): Promise
   if (task.status === "completed") {
     const output = task.output || "Task completed.";
     const slackOutput = markdownToSlack(output);
+    const attachmentsBlock = formatAttachmentsBlockForSlack(getTaskAttachments(task.id));
+    const body = slackOutput + attachmentsBlock;
     const duration =
       task.finishedAt && task.createdAt
         ? formatDuration(new Date(task.createdAt), new Date(task.finishedAt))
@@ -185,11 +194,12 @@ export async function updateToFinal(task: AgentTask, messageTs: string): Promise
     blocks = buildCompletedBlocks({
       agentName,
       taskId: task.id,
-      body: slackOutput,
+      body,
       duration,
       minimal: !!task.slackReplySent,
+      trailer: task.slackReplySent ? attachmentsBlock : undefined,
     });
-    text = task.slackReplySent ? `✅ ${agentName} completed` : slackOutput;
+    text = task.slackReplySent ? `✅ ${agentName} completed` : body;
   } else if (task.status === "cancelled") {
     blocks = buildCancelledBlocks({ agentName, taskId: task.id });
     text = "Task cancelled";

package/src/slack/watcher.ts

@@ -3,6 +3,7 @@ import {
   getChildTasks,
   getCompletedSlackTasks,
   getInProgressSlackTasks,
+  getTaskAttachments,
   getTaskById,
 } from "../be/db";
 import type { AgentTask } from "../types";
@@ -133,6 +134,13 @@ export function buildTreeNodes(tree: TreeMessageState): TreeNode[] {
           childDuration = formatDuration(new Date(child.createdAt), new Date(child.finishedAt));
         }
 
+        // Only completed nodes get attachments — that's the only path
+        // `buildTreeBlocks` renders them, and the lookup is one query per
+        // completed task per tree render. Skipping non-completed avoids
+        // hot-path queries for every in-progress poll tick.
+        const childAttachments =
+          child.status === "completed" ? getTaskAttachments(child.id) : undefined;
+
         childNodes.push({
           taskId: child.id,
           agentName: childAgentName,
@@ -142,6 +150,7 @@ export function buildTreeNodes(tree: TreeMessageState): TreeNode[] {
           slackReplySent: child.slackReplySent,
           output: child.output ?? undefined,
           failureReason: child.failureReason ?? undefined,
+          attachments: childAttachments,
           children: [],
         });
 
@@ -150,6 +159,8 @@ export function buildTreeNodes(tree: TreeMessageState): TreeNode[] {
       }
     }
 
+    const rootAttachments = task.status === "completed" ? getTaskAttachments(task.id) : undefined;
+
     nodes.push({
       taskId: task.id,
       agentName,
@@ -159,6 +170,7 @@ export function buildTreeNodes(tree: TreeMessageState): TreeNode[] {
       slackReplySent: task.slackReplySent,
       output: task.output ?? undefined,
       failureReason: task.failureReason ?? undefined,
+      attachments: rootAttachments,
       children: childNodes,
     });
   }

package/src/tests/credential-check.test.ts

@@ -224,6 +224,53 @@ describe("checkPiMonoCredentials", () => {
       ).toBe(true);
     }
   });
+
+  // ─── amazon-bedrock: AWS SDK delegates credential resolution ───────────────
+  // When MODEL_OVERRIDE selects amazon-bedrock, pi-mono routes through the AWS
+  // SDK's default credential chain (env, ~/.aws/*, SSO, IMDS, assume-role,
+  // web-identity, …). agent-swarm does no presence check beyond detecting the
+  // `amazon-bedrock/` prefix — the SDK validates at first inference call.
+  // Mirrors the codex auth.json "presence-only" pattern.
+
+  test("amazon-bedrock: ready (sdk-delegated) with no env vars and no auth.json", () => {
+    const env = { MODEL_OVERRIDE: "amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0" };
+    const status = checkPiMonoCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(status.ready).toBe(true);
+    expect(status.satisfiedBy).toBe("sdk-delegated");
+    expect(status.missing).toEqual([]);
+  });
+
+  test("amazon-bedrock: stays sdk-delegated even when ANTHROPIC_API_KEY is also set", () => {
+    // The Anthropic-shape key is irrelevant here — the model is routed through
+    // AWS Bedrock, not Anthropic. Reporting satisfiedBy="env" would mislead.
+    const env = {
+      MODEL_OVERRIDE: "amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0",
+      ANTHROPIC_API_KEY: "x",
+    };
+    const status = checkPiMonoCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(status.ready).toBe(true);
+    expect(status.satisfiedBy).toBe("sdk-delegated");
+  });
+
+  test("amazon-bedrock: stays sdk-delegated even when auth.json exists", () => {
+    // auth.json holds Anthropic/OpenRouter/OpenAI creds — none used by Bedrock.
+    // Bedrock branch must win over the file probe.
+    const env = { MODEL_OVERRIDE: "amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0" };
+    const status = checkPiMonoCredentials(env, {
+      homeDir: HOME,
+      fs: fsWith(new Set([AUTH])),
+    });
+    expect(status.ready).toBe(true);
+    expect(status.satisfiedBy).toBe("sdk-delegated");
+  });
+
+  test("amazon-bedrock: provider-prefix match is case-insensitive", () => {
+    // Mirrors modelToCredKeys' .toLowerCase() at line 54 of pi-mono-adapter.
+    const env = { MODEL_OVERRIDE: "Amazon-Bedrock/anthropic.claude-sonnet-4-20250514-v1:0" };
+    const status = checkPiMonoCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(status.ready).toBe(true);
+    expect(status.satisfiedBy).toBe("sdk-delegated");
+  });
 });
 
 // ─── opencode ────────────────────────────────────────────────────────────────

package/src/tests/http-api-integration.test.ts

@@ -968,6 +968,42 @@ describe("Schedule CRUD", () => {
     expect(status).toBe(404);
   });
 
+  test("PUT /api/schedules/:id — cron-based schedule accepts null intervalMs", async () => {
+    // Reproduces CAI-1283: dashboard sends null for unused timing field
+    const { status, body } = await put(`/api/schedules/${scheduleId}`, {
+      body: { cronExpression: "0 2 * * *", intervalMs: null },
+    });
+    expect(status).toBe(200);
+    expect(body.cronExpression).toBe("0 2 * * *");
+    // intervalMs omitted from response when not set (null serialized as undefined in JSON)
+    expect(body.intervalMs == null).toBe(true);
+  });
+
+  test("PUT /api/schedules/:id — interval-based schedule accepts null cronExpression", async () => {
+    // Create an interval-based schedule to test against
+    const { body: created } = await post("/api/schedules", {
+      body: {
+        name: "interval-test-cai-1283",
+        taskTemplate: "interval task",
+        intervalMs: 60000,
+      },
+    });
+    const { status, body } = await put(`/api/schedules/${created.id}`, {
+      body: { intervalMs: 60000, cronExpression: null },
+    });
+    expect(status).toBe(200);
+    expect(body.intervalMs).toBe(60000);
+    // Clean up
+    await del(`/api/schedules/${created.id}`);
+  });
+
+  test("PUT /api/schedules/:id — both intervalMs and cronExpression null returns 400", async () => {
+    const { status } = await put(`/api/schedules/${scheduleId}`, {
+      body: { cronExpression: null, intervalMs: null },
+    });
+    expect(status).toBe(400);
+  });
+
   test("POST /api/schedules/:id/run — run now creates a task", async () => {
     const { status, body } = await post(`/api/schedules/${scheduleId}/run`);
     expect(status).toBe(200);

package/src/tests/rest-api.test.ts

@@ -7,7 +7,9 @@ import {
   createTaskExtended,
   getAgentById,
   getDb,
+  getTaskAttachments,
   initDb,
+  insertTaskAttachment,
   updateAgentStatus,
 } from "../be/db";
 
@@ -137,7 +139,11 @@ async function handleRequest(
       return { status: 404, body: { error: "Task not found" } };
     }
 
-    return { status: 200, body: task };
+    // Mirror the real `GET /api/tasks/:id` handler in `src/http/tasks.ts`
+    // by decorating the row with `attachments`. The mock omits `logs` since
+    // those tests live elsewhere; attachments are cheap enough to inline.
+    const attachments = getTaskAttachments(taskId);
+    return { status: 200, body: { ...(task as object), attachments } };
   }
 
   // GET /api/stats - Dashboard summary stats
@@ -538,6 +544,50 @@ describe("REST API Endpoints", () => {
       expect(data.task).toBe("Test task for GET endpoint");
       expect(data.status).toBe("unassigned");
     });
+
+    test("should include attachments[] in the response", async () => {
+      const task = createTaskExtended("Task with attachments", {
+        creatorAgentId: "test-agent-attach",
+      });
+      insertTaskAttachment({
+        taskId: task.id,
+        kind: "url",
+        name: "report",
+        url: "https://example.com/r.pdf",
+        intent: "primary deliverable",
+        isPrimary: true,
+      });
+      insertTaskAttachment({
+        taskId: task.id,
+        kind: "agent-fs",
+        name: "doc",
+        path: "/thoughts/a.md",
+      });
+
+      const response = await fetch(`${baseUrl}/api/tasks/${task.id}`);
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as {
+        id: string;
+        attachments: Array<{ kind: string; name: string; url?: string; path?: string }>;
+      };
+      expect(data.attachments).toBeDefined();
+      expect(data.attachments.length).toBe(2);
+      expect(data.attachments[0]?.kind).toBe("url");
+      expect(data.attachments[0]?.name).toBe("report");
+      expect(data.attachments[1]?.kind).toBe("agent-fs");
+      expect(data.attachments[1]?.path).toBe("/thoughts/a.md");
+    });
+
+    test("should return an empty attachments[] when none are attached", async () => {
+      const task = createTaskExtended("Task without attachments", {
+        creatorAgentId: "test-agent-noattach",
+      });
+      const response = await fetch(`${baseUrl}/api/tasks/${task.id}`);
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as { attachments: unknown[] };
+      expect(Array.isArray(data.attachments)).toBe(true);
+      expect(data.attachments.length).toBe(0);
+    });
   });
 
   describe("GET /api/stats", () => {