feat: add attachment analysis access links

scripts/validate-attachment-analysis.mjs

@@ -57,6 +57,7 @@ async function startStandaloneServer(appRoot, runtimeDir, port) {
       ...process.env,
       PORT: String(port),
       HOSTNAME: "127.0.0.1",
+      BOSS_PUBLIC_BASE_URL: baseUrl,
       BOSS_RUNTIME_ROOT: runtimeDir,
       BOSS_STATE_FILE: path.join(runtimeDir, "data", "boss-state.json"),
       BOSS_AUTH_AUTO_LOGIN: "0",
@@ -197,6 +198,16 @@ try {
     "analysis-note.txt",
     "queued task should carry attachment file name",
   );
+  assert.ok(textUpload.analysisTask.attachmentDownloadUrl, "queued task should expose attachment download url");
+  const promptDownloadUrlMatch = textUpload.analysisTask.executionPrompt.match(/downloadUrl:\s+(http[^\s]+)/);
+  assert.ok(promptDownloadUrlMatch, "execution prompt should include attachment download url");
+  const unauthDownloadResponse = await fetch(textUpload.analysisTask.attachmentDownloadUrl);
+  assert.equal(unauthDownloadResponse.status, 200, "attachment download url should be readable with task token");
+  assert.equal(
+    await unauthDownloadResponse.text(),
+    "text attachment for automatic analysis",
+    "downloaded attachment content should match the uploaded text",
+  );
 
   const manualUpload = await uploadAttachment(
     currentServer.baseUrl,