[chengyongru]

Summary

• extend the WebUI picker, paste, and drop flows from images to supported document attachments
• render document chips and optimistic/history media consistently while preserving safe original filename stems
• move MIME, count, size, and persistence policy out of the WebSocket channel into the WebUI media ingress layer
• publish structured text, attachment, and transport limits through bootstrap so the Composer can reject invalid input before send

Supported documents

PDF, DOCX, XLSX, PPTX, TXT, Markdown, CSV, JSON, XML, HTML, YAML, TOML, LOG, INI, and CFG files are normalized to server-approved MIME types. SVG and unapproved archive/binary MIME types remain rejected.

Limits and transport behavior

• message text: 64 KiB, counted as UTF-8 bytes
• attachments: up to 4 per message, 6 MiB per image/document, 24 MiB decoded total
• legacy video ingress remains capped separately at 1 file / 20 MiB
• the WebSocket frame limit remains an independent transport guard (36 MiB by default)

Attachments are still sent as Base64 data URLs inside one WebSocket message. A lower configured maxMessageBytes can therefore become the effective transport ceiling even when an attachment satisfies the 6 MiB business policy; the Composer now detects that condition while adding the file and reports it separately. Chunked or out-of-band upload is intentionally not part of this PR.

Wire protocol change

Attachment validation errors now use detail: "attachment_rejected" for both images and documents. The previous image_rejected detail is intentionally not preserved as a compatibility alias; WebSocket clients that branch on this field must update to the new generic value. Stable reason values continue to describe the rejection cause.

Safety

• allowlist MIME types and force persisted extensions from the normalized MIME
• sanitize and bound original filename stems before writing to the media directory
• reject malformed, unsupported, oversized, and over-count batches before publishing to the agent
• roll back files already written when a later attachment makes the batch invalid
• keep the WebSocket channel responsible for envelope transport while the media gateway owns attachment policy

Verification

• GitHub Actions: 5/5 checks passing (WebUI plus Ubuntu/Windows on Python 3.13 and 3.14)
• related Python suite: 264 passed
• complete WebUI suite: 549 passed
• ruff check, WebUI lint, and WebUI production build passed
• real gateway + Playwright: verified PDF attachment UI, add-time rejection under a 1 MiB transport limit, and pre-send rejection of a 65,537-byte text message without a WebSocket 1009 close

[chengyongru]

Automated PR review by nanobot. This is not a human maintainer review or approval.

Found 1 consistency issue that should be addressed.

[chengyongru]