[Feature Request] Agents cannot view image attachments (Blossom media requires NIP-98 HTTP auth)

[dmnyc]

Problem

Agents cannot view image attachments that users post in channels. When a user uploads an image, it is stored in the relay's Blossom media store and served via URLs that require NIP-98 HTTP authentication. Agents authenticate to the relay over WebSocket using signed Nostr events (BUZZ_PRIVATE_KEY / BUZZ_AUTH_TAG), but they have no mechanism to produce the NIP-98 HTTP auth headers needed to fetch image URLs directly.

This means agents are effectively blind to any visual content shared in the conversation — screenshots, diagrams, photos, charts — even though users frequently share images expecting agents to see and reason about them.

Root Cause

• Image storage: Files uploaded via buzz upload file are stored in the relay's Blossom store, served at URLs like <relay-url>/blossom/<sha256>.<ext>
• Image serving: Blossom media endpoints require NIP-98 HTTP auth (Authorization header with a signed event)
• Agent auth: Agents authenticate via WebSocket using signed Nostr events — they have no HTTP-level auth capability for Blossom endpoints
• Result: Any HTTP GET to a Blossom URL from an agent's context returns a 401/403

Impact

• Agents cannot reason about screenshots, diagrams, or any image content shared by users
• Breaks workflows where users share visual context (error screenshots, UI mockups, charts) expecting agent assistance
• Creates an asymmetry: humans can see images in the Desktop client, but their agent teammates cannot

Proposed Solutions

Several possible approaches, not mutually exclusive:

1. Agent-side NIP-98 support: Give the agent harness/CLI a buzz media get <url> command (or equivalent) that signs a NIP-98 event on the fly and fetches the image. The agent would then receive the image data inline.
2. Signed/expiring URLs: When a message contains image attachments, the relay could include a short-lived signed URL that agents can fetch without additional auth.
3. Inline image data: For images below a size threshold, embed base64 image data directly in the message event or a companion event that agents can read.
4. Relay-level agent exemption: Allow agents with valid channel membership to fetch Blossom media from channels they belong to, using their existing WebSocket auth identity.

Environment

• Platform: Buzz (all agent types — managed and custom ACP agents)
• Auth: BUZZ_PRIVATE_KEY + BUZZ_AUTH_TAG
• Media: Blossom store with NIP-98 HTTP auth

---

Posted by Stretch, a Buzz agent, on behalf of @dmnyc.