feat(jira): include Jira attachments and recent comments in task context (#577)

[ayushtr-aws]

What

Closes #577. Jira-origin tasks now receive the same practical issue context Linear-origin tasks can use — attached files and recent comments, not just the summary/description. Because the Atlassian Remote MCP can't run headlessly (see the parent tracker #580 design note), the context is fetched authenticated at task-admission time in the webhook processor rather than on demand by the agent.

How

• cdk/src/handlers/shared/jira-attachments.ts (new) —
  • downloadScreenAndStoreJiraAttachments: resolves Jira media attachments via the gateway attachment-content endpoint (api.atlassian.com/ex/jira/{cloudId}/rest/api/3/attachment/content/{id} — the only host the 3LO token is valid against), refresh-and-retry-once on 401/403, enforces the size cap while streaming, validates magic bytes, screens each through the existing Bedrock Guardrail pipeline, uploads cleaned bytes to S3, and returns passed AttachmentRecords. Fail-closed: a selected attachment that can't be safely fetched/screened throws and the task is rejected with a Jira comment. Unsupported/oversized/over-cap attachments are silently skipped. Filenames sanitized + ids validated to prevent S3-key / on-disk path traversal.
  • fetchRecentHumanComments: recent human (accountType: atlassian) comments, ADF→markdown, oldest-first. Fail-open: any failure proceeds without them.
• cdk/src/handlers/shared/jira-adf.ts (new) — extracted the ADF→markdown walker so the processor and comment helper share it without a circular import (behavior-preserving).
• cdk/src/handlers/shared/create-task-core.ts — TaskCreationContext gains optional taskId (so processor-uploaded S3 keys match the eventual record) and preScreenedAttachments (merged verbatim, never re-screened; a non-passed record fails closed).
• cdk/src/handlers/jira-webhook-processor.ts — wires both in; comments fold under a ## Recent comments heading, bounded so they never push task_description past the 10k limit (advisory context must not become a hard gate).
• cdk/src/constructs/jira-integration.ts + agent.ts — pass the attachments bucket to the processor, grant ReadWrite + ATTACHMENTS_BUCKET_NAME, bump the async processor timeout to 60s for serial download+screen. No new OAuth scopes (read:jira-work covers reading attachments + comments).
• cdk/src/constructs/task-api.ts — exempt /v1/jira/webhook from the WAF SizeRestrictions_BODY managed rule (mirrors the existing Linear/GitHub webhook exemptions). Jira issue payloads carrying attachment metadata exceed the 8 KB body limit and were being blocked at the edge (403) before the receiver Lambda ran — so this is required for feat(jira): include Jira attachments and recent comments in task context #577 to function. The receiver still HMAC-verifies the raw body and the rate-limit rule still applies.

Docs

docs/guides/JIRA_SETUP_GUIDE.md gets an "Issue context: attachments and comments" section (supported types, limits, skip-vs-reject behavior, comment behavior) + regenerated Starlight mirror.

Tests

• jira-attachments.test.ts (new): download/filter/screen/upload, filename sanitization + unsafe-id rejection, 401 refresh-and-retry, size cap, magic-byte reject, screen-blocked → throw, comment human/app filtering + ADF→markdown + fail-open.
• jira-webhook-processor.test.ts: comment folding + truncation, fail-closed attachment rejection, remaining-slots math, no-attachments path.
• create-task-core.test.ts: preScreenedAttachments merge without re-screening, caller-supplied taskId, non-passed fail-closed.
• task-api.test.ts: WAF exemption present in both the exclusion scope-down and the full-CRS scope-down.

mise run build green (cdk 2357 tests, cli 605, agent + docs pass, synth clean).

Validated end-to-end

Deployed to a dev stack and triggered from a real Jira Cloud tenant: a SCRUM issue with 2 image attachments + a comment triggered a task → comments fetched → both attachments authenticated-downloaded, Bedrock-screened, and stored to S3 → agent hydrated them → committed the images → opened a PR. Confirmed the full path works.

Out of scope

Atlassian Remote MCP support; Confluence/project documents; fetching full historical comment threads; new attachment limits or file types beyond what ABCA already screens.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 95.61224% with 43 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@22705e8). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
cdk/src/handlers/shared/jira-attachments.ts	95.54%	26 Missing ⚠️
cdk/src/handlers/shared/jira-adf.ts	89.80%	16 Missing ⚠️
cdk/src/handlers/jira-webhook-processor.ts	99.25%	1 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #619   +/-   ##
=======================================
  Coverage        ?   89.44%           
=======================================
  Files           ?      226           
  Lines           ?    55205           
  Branches        ?     5587           
=======================================
  Hits            ?    49376           
  Misses          ?     5829           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.