2500e3e779
- store.addAttachments:按 path 去重(later-wins),消除重传产生的悬空元数据 - store.removeAttachment:按磁盘文件名(basename(path))移除元数据,返回 removed - GET /api/tasks/:id/attachments/:name:inline 预览,?download=1 触发下载(RFC5987 文件名) - DELETE /api/tasks/:id/attachments/:name:先删元数据再尽力删磁盘文件 - 只服务元数据登记过的附件 + resolve/startsWith 前缀校验,杜绝目录穿越 - 新增 test/attachments.test.ts(去重/读取/下载/删除/穿越/丢失/端到端上传去重) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>