feat(server): add guarded attachment download - #11
Merged
Conversation
plusky
force-pushed
the
feat/attachment-download
branch
from
July 27, 2026 14:41
094ef91 to
9d40009
Compare
Expose download_attachment: the attachment metadata is fetched first, never the blob, so guard assessment on the owning bug (I8) and the new pre-download gate both run before any content is pulled. Private attachments need the same double opt-in as private comments, and on download a missing privacy flag counts as private (I4) — the blob is the payload the guard protects. A new global.max_attachment_bytes policy key (default 2 MiB, 0 removes it) bounds what may be embedded in a tool result; it is enforced on the reported size and re-checked against the decoded length of the payload that actually arrived. Hardened per pre-PR adversarial review: every refusal is the uniform attachment denial (I2) including blob-fetch failures, the upstream request count is constant so latency cannot reveal which attachment ids exist, the gate and owning-bug check re-run on the blob response to close the TOCTOU between the two fetches, size refusals disclose neither the size nor the configured cap (I1), the resource uri carries only the attachment id instead of the uploader-chosen file name, and only allowlisted raster types reach the model's image channel so image/svg+xml cannot smuggle script-bearing markup into client renderers. Also rework examples/policy.toml to the documented scenario — embargoed bugs invisible at any age, security-labelled bugs invisible only while fresher than five days, everything else fully visible — and align the capability and private-content documentation with the widened attachments capability.
plusky
force-pushed
the
feat/attachment-download
branch
from
July 27, 2026 14:49
9d40009 to
eb9f82c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
download_attachment, the last non-packaging roadmap item. Metadata is fetched first — never the blob — so guard assessment on the owning bug (I8) and a new pre-download gate both run before any content is pulled.Policy: new
global.max_attachment_bytes(default 2 MiB,0removes the cap) bounds what may be embedded in a tool result, enforced on the reported size and re-checked against the actual base64 payload. Private attachments need the same double opt-in as private comments (I5), and on download a missing privacy flag counts as private (I4).Hardened per pre-PR adversarial review (findings against DESIGN.md invariants, all addressed in this branch):
file_nameinterpolated into the resource uri (../traversal for clients persisting by uri)image/*went to the model's image channel, incl. script-bearingimage/svg+xmlVerified:
cargo fmt --check,clippy --workspace --all-targets -D warnings,cargo test --workspace(105 tests, incl. new gate and media-type cases),typos.