v0.38.0 — Attachments work, and a failed launch is no longer silent
Attachments
amp-send.sh --attach has existed for a long time and has been getting 404 the whole time: the client implemented the full flow, the endpoints were never built, and the skill advertised it. An agent asked to send a file followed our own documentation into a dead end.
Implemented against agentmessaging/protocol spec/attachment-guide.md v0.1.2. No client change needed.
Why there is no S3 — the spec says content is stored "externally by the provider (e.g., in S3 or equivalent object storage)". Equivalent is the operative word: it constrains the metadata and the flow, never the backend. Files stay inside the tailnet, with no third party in the data path.
basic_clean, not clean — the spec provides a status for a provider that runs the required checks and no antivirus, and requires it to declare av_scanning: false. Returning clean would claim a scan we do not perform. The client already understands it and tells the receiving agent so.
Three MUST checks, applied to local delivery too (the spec has no carve-out): size and digest, blocked types and executables, and magic bytes against the declared type at primary-type level.
Verified with the real client — --attach → routed message → --all → byte-identical file, digest checked on the way in and again on the way out. And it refuses virus.exe, ../../etc/passwd, oversized files and non-sha256 digests with the spec's own error codes.
A program that never started reported success
send-keys returning proves tmux accepted the keystrokes, not that the program exists. An agent whose program was missing, unauthenticated or off PATH came up looking healthy with a bare shell — #426, and the reason configuring an uninstalled framework was indistinguishable from a working agent.
Measured, not predicted: a preflight command -v cannot reproduce the pane's environment (tmux runs an interactive non-login shell; a server-spawned check is non-interactive), so it would disagree with the pane it describes. We look at what happened and quote the shell's own diagnosis.
Any doubt counts as started — a false "did not start" is worse than silence.
1243 tests passing, 76 new — 59 asserting the attachment spec's own MUSTs.
Not implemented and not claimed: AV/injection scanning, the 2-hour orphan sweep, single-use attachment ids at /route.