daemon: align run-source validation with the attachments contract (#7040)

attachments is a list of file-path strings; commentAttachments is a list of
objects. Accept well-formed non-empty lists of either kind for empty-message
turns, and add specs covering the attachments-only case + malformed lists.

Author: Val

apps/daemon/src/routes/runs.ts

@@ -1246,9 +1246,17 @@ export function registerRunRoutes(app: Express, ctx: RegisterRunRoutesDeps) {
     const hasPrompt =
       (typeof requestBody.message === 'string' && requestBody.message.trim().length > 0)
       || (typeof requestBody.currentPrompt === 'string' && requestBody.currentPrompt.trim().length > 0);
-    const hasAttachments = Array.isArray(requestBody.attachments)
-      && requestBody.attachments.length > 0
-      && requestBody.attachments.every((entry) => entry !== null && typeof entry === 'object');
+    // Attachments mirror the seed predicate: attachments is a list of
+    // non-empty file-path strings and commentAttachments is a list of
+    // objects. Either list, when well-formed and non-empty, legitimizes an
+    // empty-message turn (attachments-only sends seed the user message).
+    const hasAttachments =
+      (Array.isArray(requestBody.attachments)
+        && requestBody.attachments.length > 0
+        && requestBody.attachments.every((entry) => typeof entry === 'string' && entry.trim().length > 0))
+      || (Array.isArray(requestBody.commentAttachments)
+        && requestBody.commentAttachments.length > 0
+        && requestBody.commentAttachments.every((entry) => entry !== null && typeof entry === 'object'));
     const hasPluginBriefSource =
       (typeof requestBody.pluginId === 'string'
         && requestBody.pluginId.length > 0

apps/daemon/tests/run-create-validation.test.ts

@@ -43,6 +43,7 @@ describe('run creation input validation (#7040)', () => {
       { message: {} },
       { message: 42 },
       { attachments: [null, 42] },
+      { commentAttachments: [42] },
       { pluginId: 'definitely-not-installed' },
     ];
     for (const body of cases) {
@@ -55,6 +56,29 @@ describe('run creation input validation (#7040)', () => {
     }
   });
 
+  it('accepts attachments-only turns with an empty message', async () => {
+    const id = 'att-only-' + Date.now();
+    const create = await fetch(baseUrl + '/api/projects', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id, name: 'Attachments Only' }),
+    });
+    expect(create.status).toBe(200);
+    const convId = ((await create.json()) as { conversationId: string }).conversationId;
+    const resp = await fetch(baseUrl + '/api/runs', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        agentId: 'missing-agent-' + Date.now(),
+        projectId: id,
+        conversationId: convId,
+        message: '',
+        attachments: ['assets/no-prompt.png'],
+      }),
+    });
+    expect(resp.status).toBe(202);
+  });
+
   it('still accepts a normal prompt', async () => {
     const resp = await fetch(baseUrl + '/api/runs', {
       method: 'POST',