feat(server): agents can now open the images you paste into chat

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}

[t3dotgg]

Pasting an image into chat (especially over a remote connection) let the agent see the pixels, but gave it no way to touch the file. Ask it to "include this screenshot in the PR" and it starts spelunking /tmp hoping to find a file that matches. The file was on disk the whole time; nobody told the agent where.

Two changes:

1. ProviderService.sendTurn now appends each attachment's on-disk path to the turn input text. This is the single choke point every adapter (Claude, Codex, Cursor, Grok, OpenCode) flows through, so they all inherit it with no adapter edits. The inline image block is unchanged, so the model still sees the image immediately.
2. The Claude adapter adds the attachments directory to additionalDirectories, so reading or copying the file does not cost an approval prompt. The grant is scoped to the attachments leaf directory only; secrets/ and state.sqlite stay ungranted.

No contract changes. Paths never reach clients; they exist only in the provider-bound turn text.

Notably, neither Claude Code (anthropics/claude-code#54062) nor Codex (openai/codex#25983) has solved this for their own pasted images. Since our pastes already land on the host the agent runs on, T3 Code gets to be first.

---

Written by Claude Fable 5 via Claude Code, reviewed by Opus 5 and GPT 5.6 Sol subagents.

---

Note

Medium Risk
Changes the central sendTurn pipeline every provider uses and expands Claude’s directory grant scope; bounded to the attachments dir but affects tool file access behavior.

Overview
Pasted chat images can be inlined for the model but agents had no stable on-disk path to read or copy those files into a repo. This PR wires that through the shared provider turn path.

ProviderService.sendTurn now resolves each attachment under serverConfig.attachmentsDir and appends lines like [Attached image "…" is saved at: …] to the turn text (after schema decode, so char limits don’t block the hints). Attachment-only turns are allowed—the injected lines become the full input. All adapters inherit this without per-driver changes.

For Claude, additionalDirectories always includes the attachments leaf directory (plus cwd when set) so those paths are readable without extra approval prompts, while sibling server dirs stay ungranted.

Tests add ServerConfig to provider service layers and assert the Codex mock receives the augmented turn text.

^{Reviewed by Cursor Bugbot for commit 19c4e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow agents to read pasted images by appending attachment file paths to chat turn input

• ProviderService.sendTurn now resolves each attachment's on-disk path via serverConfig.attachmentsDir and appends the paths to the input text before routing the turn to the provider.
• ClaudeAdapter grants serverConfig.attachmentsDir as an additional directory in ClaudeQueryOptions, giving the Claude SDK file-system access to uploaded attachments.
• Attachment-only turns (no text) are now valid; the injected path lines serve as the full input.
• Behavioral Change: callers of ProviderService and ClaudeAdapter now require a ServerConfig layer to be provided.

^{Macroscope summarized 19c4e75.}