fix(assistants): fix silent zero-attachment bug in Claude session upload detection

docs/superpowers/tasks/2026-08-04-epmcdme-13907/actual-complexity.json

@@ -0,0 +1,68 @@
+{
+  "task": "Fix two bugs in claudeUploadsDetector.ts: wrong JSONL structure assumption and RECENT_MESSAGES_LIMIT too small; replace multi-function two-pass extraction with a single turn-boundary backward scan.",
+  "generated": "2026-08-04T00:00:00Z",
+  "dimensions": {
+    "component_scope": {
+      "score": 2,
+      "label": "S",
+      "affected": "claudeUploadsDetector (extractFileContentFromMessages, buildAttachmentMap, extractFileNamesFromMetaMessage, getRecentUserMessages)",
+      "layers": "Service"
+    },
+    "requirements_clarity": {
+      "score": 1,
+      "label": "XS",
+      "status": "Clear",
+      "gaps": null
+    },
+    "technical_risk": {
+      "score": 2,
+      "label": "S",
+      "risk_factors": "Algorithm replacement: two-pass extraction replaced with backward turn-boundary scan; no prior pattern for this exact scan strategy in the component",
+      "mitigation": "11 pre-existing tests updated plus 3 new regression tests covering the previously broken position-3 scenario; straightforward rollback"
+    },
+    "file_change_estimate": {
+      "score": 1,
+      "label": "XS",
+      "modified_files": 2,
+      "modified_file_list": [
+        "src/cli/commands/assistants/chat/claudeUploadsDetector.ts",
+        "src/cli/commands/assistants/chat/__tests__/claudeUploadsDetector.test.ts"
+      ],
+      "new_files": 0,
+      "new_file_list": [],
+      "affected_dirs": [
+        "src/cli/commands/assistants/chat"
+      ]
+    },
+    "dependencies": {
+      "score": 1,
+      "label": "XS",
+      "new_packages": [],
+      "version_changes": []
+    },
+    "affected_layers": {
+      "score": 1,
+      "label": "XS",
+      "layers_changed": ["Service"],
+      "schema_migration": false,
+      "cross_system": false
+    }
+  },
+  "total": 8,
+  "size": "XS",
+  "band_range": "6-9",
+  "files_changed": 2,
+  "routing": "writing-plans",
+  "key_reasoning": [
+    {
+      "dimension": "component_scope",
+      "reason": "Four private functions restructured inside a single file (claudeUploadsDetector.ts); public API (detectFileUploadsFromSession, readFilesFromPaths) left unchanged; test file updated but adds no new architectural component"
+    },
+    {
+      "dimension": "technical_risk",
+      "reason": "Turn-boundary backward scan is a new algorithmic approach without an exact prior pattern in this component, but the logic is simple and fully covered by updated + new test fixtures including the exact EPMCDME-13907 repro scenario"
+    }
+  ],
+  "red_flags_applied": [],
+  "split_recommendation": null
+}

docs/superpowers/tasks/2026-08-04-epmcdme-13907/code-review-final.json

@@ -0,0 +1,25 @@
+{
+  "decision": "approve",
+  "rationale": "Both review lenses ran successfully. All findings from the blind lens were dismissed: they assume attachments live in non-meta parent messages, the premise the fix explicitly corrects (confirmed by codebase evidence, real session data from EPMCDME-13907, and the test suite). The edge-case lens raised one deferred concern (EC-001): the two-pass filename-to-attachment pairing may mis-assign filenames when attachment items appear before text annotation items in the content array. This non-canonical ordering does not occur in real Claude Code JSONL output, and the concern is not a regression (the old code returned zero files entirely). No blocking findings remain. No spec or story artifact exists (no-spec mode); acceptance lens skipped; confidence is low per no-spec rule. One deferred finding (EC-001) and two dismissed lens concerns are logged in rationale but do not block.",
+  "confidence": "low",
+  "risk_flags": [],
+  "business_review": [],
+  "standards_review": [
+    {
+      "standard": "code-quality",
+      "status": "pass",
+      "notes": "Private function extractFileContentFromMessages has no explicit return type annotation. Code-quality guide requires explicit return types only on exported functions — not blocking. All naming, import, and async conventions followed."
+    },
+    {
+      "standard": "security",
+      "status": "pass",
+      "notes": "No credential handling, no user input executed as commands, no unsafe file operations. Regex matching on JSONL message content is safe."
+    },
+    {
+      "standard": "acceptance-criteria",
+      "status": "na",
+      "notes": "No spec or story artifact was provided (no-spec mode). Acceptance criteria could not be audited automatically."
+    }
+  ],
+  "findings": []
+}