mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-13 03:13:41 +08:00
594880bd64
WebChat had no file support: the /stream body carried only text, and agent-produced files had no visitor-reachable download path (the JWT /chat/files endpoint is unreachable for API-key visitors). Add webchat-authenticated file transfer, reusing MessageContentPart + the existing upload dir + agent multimodal injection: - WebChatFileService: validate (size cap, extension whitelist, filename sanitize), store under the conversation's upload dir, stage by opaque fileId, traversal-safe resolve. Untrusted-uploader hardening lives here. - POST /upload (multipart) and GET /files, both authed by API key + visitor token with a server-derived conversationId (never client paths). Downloads send non-images as attachment + X-Content-Type-Options:nosniff. - /stream gains attachmentIds; the server resolves each id from the staging registry (client metadata is never trusted), builds parts, and persists them on the user message so the agent's multimodal/file tools pick them up from history — same path as the JWT web chat. - Strip server-side file paths from the visitor-facing message view (listMessageViewsExternal + includePath flag) so the filesystem layout is not disclosed. Refs matevip/mateclaw#342 |
||
|---|---|---|
| .. | ||
| src | ||
| Dockerfile | ||
| pom.xml | ||
| settings.xml | ||