feat: WASM channel attachments with LLM pipeline integration (#596)

* feat: add inbound attachment support to WASM channel system Add attachment record to WIT interface and implement inbound media parsing across all four channel implementations (Telegram, Slack, WhatsApp, Discord). Attachments flow from WASM channels through EmittedMessage to IncomingMessage with validation (size limits, MIME allowlist, count caps) at the host boundary. - Add `attachment` record to `emitted-message` in wit/channel.wit - Add `IncomingAttachment` struct to channel.rs and re-export - Add host-side validation (20MB total, 10 max, MIME allowlist) - Telegram: parse photo, document, audio, video, voice, sticker - Slack: parse file attachments with url_private - WhatsApp: parse image, audio, video, document with captions - Discord: backward-compatible empty attachments - Update FEATURE_PARITY.md section 7 - Add fixture-based tests per channel and host integration tests [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: integrate outbound attachment support and reconcile WIT types (#409) Reconcile PR #409's outbound attachment work with our inbound attachment support into a unified design: WIT type split: - `inbound-attachment` in channel-host: metadata-only (id, mime_type, filename, size_bytes, source_url, storage_key, extracted_text) - `attachment` in channel: raw bytes (filename, mime_type, data) on agent-response for outbound sending Outbound features (from PR #409): - `on-broadcast` WIT export for proactive messages without prior inbound - Telegram: multipart sendPhoto/sendDocument with auto photo→document fallback for files >10MB - wrapper.rs: `call_on_broadcast`, `read_attachments` from disk, attachment params threaded through `call_on_respond` - HTTP tool: `save_to` param for binary downloads to /tmp/ (50MB limit, path traversal protection, SSRF-safe redirect following) - Message tool: allow /tmp/ paths for attachments alongside base_dir - Credential env var fallback in inject_channel_credentials Channel updates: - All 4 channels implement on_broadcast (Telegram full, others stub) - Telegram: polling_enabled config, adjusted poll timeout - Inbound attachment types renamed to InboundAttachment in all channels Tests: 1965 passing (9 new), 0 clippy warnings [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add audio transcription pipeline and extensible WIT attachment design Add host-side transcription middleware (OpenAI Whisper) that detects audio attachments with inline data on incoming messages and transcribes them automatically. Refactor WIT inbound-attachment to use extras-json and a store-attachment-data host function instead of typed fields, so future attachment properties (dimensions, codec, etc.) don't require WIT changes that invalidate all channel plugins. - Add src/transcription/ module: TranscriptionProvider trait, TranscriptionMiddleware, AudioFormat enum, OpenAI Whisper provider - Add src/config/transcription.rs: TRANSCRIPTION_ENABLED/MODEL/BASE_URL - Wire middleware into agent message loop via AgentDeps - WIT: replace data + duration-secs with extras-json + store-attachment-data - Host: parse extras-json for well-known keys, merge stored binary data - Telegram: download voice files via store-attachment-data, add duration to extras-json, add /file/bot to HTTP allowlist, voice-only placeholder - Add reqwest multipart feature for Whisper API uploads - 5 regression tests for transcription middleware Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: wire attachment processing into LLM pipeline with multimodal image support Attachments on incoming messages are now augmented into user text via XML tags before entering the turn system, and images with data are passed as multimodal content parts (base64 data URIs) to LLM providers. This enables audio transcripts, document text, and image content to reach the LLM without changes to ChatMessage serialization or provider interfaces. - Add src/agent/attachments.rs with augment_with_attachments() and 9 unit tests - Add ContentPart/ImageUrl types to llm::provider with OpenAI-compatible serde - Carry image_content_parts transiently on Turn (skipped in serialization) - Update nearai_chat and rig_adapter to serialize multimodal content - Add 3 e2e tests verifying attachments flow through the full agent loop Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: CI failures — formatting, version bumps, and Telegram voice test - Fix cargo fmt formatting in attachments.rs, nearai_chat.rs, rig_adapter.rs, e2e_attachments.rs - Bump channel registry versions 0.1.0 → 0.2.0 (discord, slack, telegram, whatsapp) to satisfy version-bump CI check - Fix Telegram test_extract_attachments_voice: add missing required `duration` field to voice fixture JSON Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: bump WIT channel version to 0.3.0, fix Telegram voice test, add pre-commit hook - Bump wit/channel.wit package version 0.2.0 → 0.3.0 (interface changed with store-attachment-data) - Update WIT_CHANNEL_VERSION constant and registry wit_version fields to match - Fix Telegram test_extract_attachments_voice: gate voice download behind #[cfg(target_arch = "wasm32")] so host functions aren't called in native tests, update assertions for generated filename and extras_json duration - Add @0.3.0 linker stubs in wit_compat.rs - Add .githooks/pre-commit hook that runs scripts/check-version-bumps.sh when WIT or extension sources are staged - Symlink commit-msg regression hook into .githooks/ [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * refactor: extract voice download from extract_attachments into handle_message Move download_voice_file + store_attachment_data calls out of extract_attachments into a separate download_and_store_voice function called from handle_message. This keeps extract_attachments as a pure data-mapping function with no host calls, making it fully testable in native unit tests without #[cfg(target_arch)] gates. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review comments — security, correctness, and code quality Security fixes: - Add path validation to read_attachments (restrict to /tmp/) preventing arbitrary file reads from compromised tools - Escape XML special characters in attachment filenames, MIME types, and extracted text to prevent prompt injection via tag spoofing - Percent-encode file_id in Telegram getFile URL to prevent query injection - Clone SecretString directly instead of expose_secret().to_string() Correctness fixes: - Fix store_attachment_data overwrite accounting: subtract old entry size before adding new to prevent inflated totals and false rejections - Use max(reported, stored_size) for attachment size accounting to prevent WASM channels from under-reporting size_bytes to bypass limits - Add application/octet-stream to MIME allowlist (channels default unknown types to this) Code quality: - Extract send_response helper in Telegram, deduplicating on_respond and on_broadcast - Rename misleading Discord test to test_parse_slash_command_interaction - Fix .githooks/commit-msg to use relative symlink (portable across machines) [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add tool_upgrade command + fix TOCTOU in save_to path validation Add `tool_upgrade` — a new extension management tool that automatically detects and reinstalls WASM extensions with outdated WIT versions. Preserves authentication secrets during upgrade. Supports upgrading a single extension by name or all installed WASM tools/channels at once. Fix TOCTOU in `validate_save_to_path`: validate the path *before* creating parent directories, so traversal paths like `/tmp/../../etc/` cannot cause filesystem mutations outside /tmp before being rejected. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: unify WIT package version to 0.3.0 across tool.wit and all capabilities tool.wit and channel.wit share the `near:agent` package namespace, so they must declare the same version. Bumps tool.wit from 0.2.0 to 0.3.0 and updates all capabilities files and registry entries to match. Fixes `cargo component build` failure: "package identifier near:[email protected] does not match previous package name of near:[email protected]" [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: move WIT file comments after package declaration WIT treats `//` comments before `package` as doc comments. When both tool.wit and channel.wit had header comments, the parser rejected them as "doc comments on multiple 'package' items". Move comments after the package declaration in both files. Also bumps tool registry versions to 0.2.0 to match the WIT 0.3.0 bump. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: display extension versions in gateway Extensions tab Add version field to InstalledExtension and RegistryEntry types, pipe through the web API (ExtensionInfo, RegistryEntryInfo), and render as a badge in the gateway UI for both installed and available extensions. For installed WASM extensions, version is read from the capabilities file with a fallback to the registry entry when the local file has no version (old installations). Bump all extension Cargo.toml and registry JSON versions from 0.1.0 to 0.2.0 to keep them in sync. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add document text extraction middleware for PDF, Office, and text files Extract text from document attachments (PDF, DOCX, PPTX, XLSX, RTF, plain text, code files) so the LLM can reason about uploaded documents. Uses pdf-extract for PDFs, zip+XML parsing for Office XML formats, and UTF-8 decode for text files. Wired into the agent loop after transcription middleware. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: download document files in Telegram channel for text extraction The DocumentExtractionMiddleware needs file bytes in the attachment `data` field, but only voice files were being downloaded. Document attachments (PDFs, DOCX, etc.) had empty `data` and a source_url with a credential placeholder that only works inside the WASM host's http_request. Add `download_and_store_documents()` that downloads non-voice, non-image, non-audio attachments via the existing two-step getFile→download flow and stores bytes via `store_attachment_data` for host-side extraction. Also rename `download_voice_file` → `download_telegram_file` since it's generic for any file_id. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: allow Office MIME types and increase file download limit for Telegram Two issues preventing document extraction from Telegram: 1. PPTX/DOCX/XLSX MIME types (application/vnd.*) were dropped by the WASM host attachment allowlist — add application/vnd., application/msword, and application/rtf prefixes. 2. Telegram file downloads over 10 MB failed with "Response body too large" — set max_response_bytes to 20 MB in Telegram capabilities. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: report document extraction errors back to user instead of silently skipping - Bump max_response_bytes to 50 MB for Telegram file downloads - When document extraction fails (too large, download error, parse error), set extracted_text to a user-friendly error message instead of leaving it None. This ensures the LLM tells the user what went wrong. - On Telegram download failure, set extracted_text with the error so the user sees feedback even when the file never reaches the extraction middleware. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: store extracted document text in workspace memory for search/recall After document extraction succeeds, write the extracted text to workspace memory at `documents/{date}/{filename}`. This enables: - Full-text and semantic search over past uploaded documents - Cross-conversation recall ("what did that PDF say?") - Automatic chunking and embedding via the workspace pipeline Documents are stored with metadata header (uploader, channel, date, MIME type). Error messages (extraction failures) are not stored — only successful extractions. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: CI failures — formatting, unused assignment warning - Run cargo fmt on document_extraction and agent_loop modules - Suppress unused_assignments warning on trace_llm_ref (used only behind #[cfg(feature = "libsql")]) [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review comments — security, correctness, and code quality Security fixes: - Remove SSRF-prone download() from DocumentExtractionMiddleware (#13) - Sanitize filenames in workspace path to prevent directory traversal (#11) - Pre-check file size before reading in WASM wrapper to prevent OOM (#2) - Percent-encode file_id in Telegram source URLs (#7) Correctness fixes: - Clear image_content_parts on turn end to prevent memory leak (#1) - Find first *successful* transcription instead of first overall (#3) - Enforce data.len() size limit in document extraction (#10) - Use UTF-8 safe truncation with char_indices() (#12) Robustness & code quality: - Add 120s timeout to OpenAI Whisper HTTP client (#5) - Trim trailing slash from Whisper base_url (#6) - Allow ~/.ironclaw/ paths in WASM wrapper (#8) - Return error from on_broadcast in Slack/Discord/WhatsApp (#9) - Fix doc comment in HTTP tool (#4) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: formatting — cargo fmt Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address latest PR review — doc comments, error messages, version bumps - Fix DocumentExtractionMiddleware doc comment (no longer downloads from source_url) - Fix error message: "no inline data" instead of "no download URL" - Log error + fallback instead of silent unwrap_or_default on Whisper HTTP client - Bump all capabilities.json versions from 0.1.0 to 0.2.0 to match Cargo.toml Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: remove unsupported profile: minimal from CI workflows [skip-regression-check] dtolnay/rust-toolchain@stable does not accept the 'profile' input (it was a parameter for the deprecated actions-rs/toolchain action). Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: merge with latest main — resolve compilation errors and PR review nits - Add version: None to RegistryEntry/InstalledExtension test constructors - Fix MessageContent type mismatches in nearai_chat tests (String → MessageContent::Text) - Fix .contains() calls on MessageContent — use .as_text().unwrap() - Remove redundant trace_llm_ref = None assignment in test_rig - Check data size before clone in document extraction to avoid unnecessary allocation [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
2026-08-26 15:40:18 +00:00 · 2026-03-07 18:01:40 +00:00
parent 30790439ee
commit d144484b06
106 changed files with 5638 additions and 419 deletions
@@ -496,6 +496,68 @@ impl Tool for ToolRemoveTool {
    }
 }

+// ── tool_upgrade ─────────────────────────────────────────────────────
+
+pub struct ToolUpgradeTool {
+    manager: Arc<ExtensionManager>,
+}
+
+impl ToolUpgradeTool {
+    pub fn new(manager: Arc<ExtensionManager>) -> Self {
+        Self { manager }
+    }
+}
+
+#[async_trait]
+impl Tool for ToolUpgradeTool {
+    fn name(&self) -> &str {
+        "tool_upgrade"
+    }
+
+    fn description(&self) -> &str {
+        "Upgrade installed WASM extensions (channels and tools) to match the current \
+         host WIT version. If name is omitted, checks and upgrades all installed WASM \
+         extensions. Authentication and secrets are preserved."
+    }
+
+    fn parameters_schema(&self) -> serde_json::Value {
+        serde_json::json!({
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "Extension name to upgrade (omit to upgrade all)"
+                }
+            }
+        })
+    }
+
+    async fn execute(
+        &self,
+        params: serde_json::Value,
+        _ctx: &JobContext,
+    ) -> Result<ToolOutput, ToolError> {
+        let start = std::time::Instant::now();
+
+        let name = params.get("name").and_then(|v| v.as_str());
+
+        let result = self
+            .manager
+            .upgrade(name)
+            .await
+            .map_err(|e| ToolError::ExecutionFailed(e.to_string()))?;
+
+        let output = serde_json::to_value(&result)
+            .unwrap_or_else(|_| serde_json::json!({"error": "serialization failed"}));
+
+        Ok(ToolOutput::success(output, start.elapsed()))
+    }
+
+    fn requires_approval(&self, _params: &serde_json::Value) -> ApprovalRequirement {
+        ApprovalRequirement::UnlessAutoApproved
+    }
+}
+
 // ── extension_info ────────────────────────────────────────────────────

 pub struct ExtensionInfoTool {
@@ -643,6 +705,26 @@ mod tests {
        );
    }

+    #[test]
+    fn test_tool_upgrade_schema() {
+        use crate::tools::tool::ApprovalRequirement;
+        let tool = ToolUpgradeTool {
+            manager: test_manager_stub(),
+        };
+        assert_eq!(tool.name(), "tool_upgrade");
+        assert_eq!(
+            tool.requires_approval(&serde_json::json!({})),
+            ApprovalRequirement::UnlessAutoApproved
+        );
+        let schema = tool.parameters_schema();
+        // name is optional (omit to upgrade all)
+        assert!(schema["properties"].get("name").is_some());
+        assert!(
+            schema.get("required").is_none(),
+            "tool_upgrade should have no required params"
+        );
+    }
+
    #[test]
    fn test_extension_info_schema() {
        let tool = ExtensionInfoTool {
@@ -1,12 +1,4 @@
 //! HTTP request tool.
-//!
-//! Unified HTTP tool that handles both simple page/API fetches (GET, no auth)
-//! and full API calls (any method, custom headers, credential injection).
-//!
-//! - Plain GET without auth headers/body → no approval needed, follows redirects
-//! - Everything else → requires approval
-//!
-//! Replaces the former `web_fetch` tool which was a separate GET-only tool.

 use std::collections::HashMap;
 use std::net::{IpAddr, ToSocketAddrs};
@@ -26,22 +18,18 @@ use crate::tools::wasm::{InjectedCredentials, SharedCredentialRegistry, inject_c
 #[cfg(feature = "html-to-markdown")]
 use crate::tools::builtin::convert_html_to_markdown;

-/// Maximum response body size (5 MB).
+/// Maximum response body size for text responses (5 MB).
 ///
 /// 5 MB is large enough for typical JSON API responses and moderate HTML pages,
 /// but small enough to prevent OOM from malicious or runaway servers.  The WASM
 /// HTTP wrapper uses the same limit for consistency.
 const MAX_RESPONSE_SIZE: usize = 5 * 1024 * 1024;

-/// Maximum number of redirects to follow for simple GET requests.
-const MAX_REDIRECTS: usize = 3;
-
-/// Descriptive User-Agent so public APIs don't reject bare requests.
-const USER_AGENT: &str = concat!(
-    "IronClaw-Agent/",
-    env!("CARGO_PKG_VERSION"),
-    " (https://github.com/nearai/ironclaw)"
-);
+/// Maximum response body size when saving to disk via `save_to` (50 MB).
+///
+/// Larger limit for file downloads since the body is written to disk, not held
+/// in memory for LLM context. Matches the WASM attachment size cap.
+const MAX_SAVE_TO_SIZE: usize = 50 * 1024 * 1024;

 /// Tool for making HTTP requests.
 pub struct HttpTool {
@@ -55,8 +43,45 @@ impl HttpTool {
    pub fn new() -> Self {
        let client = Client::builder()
            .timeout(Duration::from_secs(30))
-            .redirect(reqwest::redirect::Policy::none())
-            .user_agent(USER_AGENT)
+            .redirect(reqwest::redirect::Policy::custom(|attempt| {
+                if attempt.previous().len() >= 10 {
+                    return attempt.error("too many redirects");
+                }
+                // Reject scheme downgrades (https → http)
+                if attempt.url().scheme() != "https" {
+                    return attempt.error("redirect to non-HTTPS URL is not allowed");
+                }
+                // Extract host info before consuming attempt
+                let host_owned = attempt.url().host_str().map(|h| h.to_owned());
+                let port = attempt.url().port_or_known_default().unwrap_or(443);
+
+                if let Some(host) = host_owned {
+                    let host_lower = host.to_lowercase();
+                    if host_lower == "localhost" || host_lower.ends_with(".localhost") {
+                        return attempt.error("redirect to localhost is not allowed");
+                    }
+                    if let Ok(ip) = host.parse::<IpAddr>()
+                        && is_disallowed_ip(&ip)
+                    {
+                        return attempt.error("redirect to private/local IP is not allowed");
+                    }
+                    // Resolve hostname and check all IPs
+                    let socket_addr = format!("{}:{}", host, port);
+                    if let Ok(addrs) = socket_addr.to_socket_addrs() {
+                        for addr in addrs {
+                            if is_disallowed_ip(&addr.ip()) {
+                                let msg = format!(
+                                    "redirect target '{}' resolves to disallowed IP {}",
+                                    host,
+                                    addr.ip()
+                                );
+                                return attempt.error(msg);
+                            }
+                        }
+                    }
+                }
+                attempt.follow()
+            }))
            .build()
            .expect("Failed to create HTTP client");

@@ -79,6 +104,31 @@ impl HttpTool {
    }
 }

+/// Validate and resolve a `save_to` path, ensuring it stays under `/tmp/`.
+///
+/// Uses `path_utils::validate_path` with `/tmp` as the base directory to catch
+/// traversal attacks like `/tmp/../../etc/passwd` and symlink escapes.
+/// Creates parent directories only after validation succeeds.
+fn validate_save_to_path(save_to: &str) -> Result<std::path::PathBuf, ToolError> {
+    // Quick prefix check before doing any fs work
+    if !save_to.starts_with("/tmp/") {
+        return Err(ToolError::InvalidParameters(
+            "save_to path must be under /tmp/".to_string(),
+        ));
+    }
+    // Validate path BEFORE creating directories to prevent traversal-based
+    // directory creation outside /tmp (e.g. `/tmp/../../etc/passwd`).
+    let tmp_base = std::path::Path::new("/tmp");
+    let validated = crate::tools::builtin::path_utils::validate_path(save_to, Some(tmp_base))?;
+    // Only create parent directories for the validated (safe) path
+    if let Some(parent) = validated.parent() {
+        std::fs::create_dir_all(parent).map_err(|e| {
+            ToolError::ExecutionFailed(format!("failed to create directory: {}", e))
+        })?;
+    }
+    Ok(validated)
+}
+
 pub(crate) fn validate_url(url: &str) -> Result<reqwest::Url, ToolError> {
    let parsed = reqwest::Url::parse(url)
        .map_err(|e| ToolError::InvalidParameters(format!("invalid URL: {}", e)))?;
@@ -220,10 +270,9 @@ impl Tool for HttpTool {
    }

    fn description(&self) -> &str {
-        "Make HTTP requests. Simple GET requests (no auth, no custom headers) run without \
-         approval and follow redirects — use for fetching weather, public JSON APIs, web pages, \
-         and documentation. Requests with authentication, custom headers, or non-GET methods \
-         (POST, PUT, DELETE, PATCH) require user approval."
+        "Make HTTP requests to external APIs. Supports GET, POST, PUT, DELETE methods. \
+         Use save_to to download binary files (images, PDFs, etc.) to a local path, \
+         e.g. {\"method\":\"GET\",\"url\":\"https://picsum.photos/800/600\",\"save_to\":\"/tmp/photo.jpg\"}."
    }

    fn parameters_schema(&self) -> serde_json::Value {
@@ -258,6 +307,10 @@ impl Tool for HttpTool {
                "timeout_secs": {
                    "type": "integer",
                    "description": "Request timeout in seconds (default: 30)"
+                },
+                "save_to": {
+                    "type": "string",
+                    "description": "Save response body as raw bytes to this file path instead of returning it. Use for binary downloads (images, PDFs, etc.). The path must be under /tmp/."
                }
            },
            "required": ["method", "url"]
@@ -390,130 +443,50 @@ impl Tool for HttpTool {
            return Ok(ToolOutput::success(result, start.elapsed()).with_raw(recorded.body));
        }

-        // Determine if this is a simple GET (eligible for redirect following).
-        let is_simple_get =
-            method.eq_ignore_ascii_case("GET") && headers_vec.is_empty() && body_bytes.is_none();
-
-        // Execute request, optionally following redirects for simple GETs.
-        let response = if is_simple_get {
-            let mut redirects_remaining = MAX_REDIRECTS;
-            loop {
-                let resp = self
-                    .client
-                    .get(parsed_url.clone())
-                    .header(
-                        reqwest::header::ACCEPT,
-                        "text/markdown, text/html;q=0.9, application/json;q=0.9, */*;q=0.8",
-                    )
-                    .send()
-                    .await
-                    .map_err(|e| {
-                        if e.is_timeout() {
-                            ToolError::Timeout(Duration::from_secs(30))
-                        } else {
-                            ToolError::ExternalService(e.to_string())
-                        }
-                    })?;
-
-                let status = resp.status().as_u16();
-                if (300..400).contains(&status) {
-                    if redirects_remaining == 0 {
-                        return Err(ToolError::ExecutionFailed(format!(
-                            "too many redirects (max {})",
-                            MAX_REDIRECTS
-                        )));
-                    }
-
-                    let location = resp
-                        .headers()
-                        .get(reqwest::header::LOCATION)
-                        .and_then(|v| v.to_str().ok())
-                        .ok_or_else(|| {
-                            ToolError::ExecutionFailed(format!(
-                                "redirect (HTTP {}) has no Location header",
-                                status
-                            ))
-                        })?;
-
-                    let next_url_str =
-                        if location.starts_with("http://") || location.starts_with("https://") {
-                            location.to_string()
-                        } else {
-                            parsed_url
-                                .join(location)
-                                .map(|u| u.to_string())
-                                .map_err(|e| {
-                                    ToolError::ExecutionFailed(format!(
-                                        "could not resolve relative redirect '{}': {}",
-                                        location, e
-                                    ))
-                                })?
-                        };
-
-                    // SSRF re-validation on every hop.
-                    parsed_url = validate_url(&next_url_str)?;
-                    let detector = LeakDetector::new();
-                    detector
-                        .scan_http_request(parsed_url.as_str(), &[], None)
-                        .map_err(|e| ToolError::NotAuthorized(e.to_string()))?;
-
-                    redirects_remaining -= 1;
-                    tracing::debug!(
-                        to = %parsed_url,
-                        hops_left = redirects_remaining,
-                        "http tool following redirect"
-                    );
-                    continue;
-                }
-
-                break resp;
+        // Execute request
+        let response = request.send().await.map_err(|e| {
+            if e.is_timeout() {
+                ToolError::Timeout(Duration::from_secs(30))
+            } else {
+                ToolError::ExternalService(e.to_string())
            }
-        } else {
-            let resp = request.send().await.map_err(|e| {
-                if e.is_timeout() {
-                    ToolError::Timeout(Duration::from_secs(30))
-                } else {
-                    ToolError::ExternalService(e.to_string())
-                }
-            })?;
-
-            let status = resp.status().as_u16();
-
-            // Block redirects for non-simple requests (potential SSRF)
-            if (300..400).contains(&status) {
-                return Err(ToolError::NotAuthorized(format!(
-                    "request returned redirect (HTTP {}), which is blocked to prevent SSRF",
-                    status
-                )));
-            }
-
-            resp
-        };
+        })?;

        let status = response.status().as_u16();

+        // Redirects are followed automatically (up to 10 hops).
+        // If we still see a 3xx here, the chain was too long.
+
        let headers: HashMap<String, String> = response
            .headers()
            .iter()
            .filter_map(|(k, v)| v.to_str().ok().map(|v| (k.to_string(), v.to_string())))
            .collect();

+        // Use a larger size limit when saving to disk (file downloads)
+        let saving_to_disk = params.get("save_to").is_some();
+        let max_size = if saving_to_disk {
+            MAX_SAVE_TO_SIZE
+        } else {
+            MAX_RESPONSE_SIZE
+        };
+
        // Pre-check Content-Length header to reject obviously oversized responses
        // before downloading anything, preventing OOM from malicious servers.
        if let Some(content_length) = response.headers().get(reqwest::header::CONTENT_LENGTH)
            && let Ok(s) = content_length.to_str()
            && let Ok(len) = s.parse::<usize>()
-            && len > MAX_RESPONSE_SIZE
+            && len > max_size
        {
            tracing::warn!(
                url = %parsed_url,
                content_length = len,
-                max = MAX_RESPONSE_SIZE,
+                max = max_size,
                "Rejected HTTP response: Content-Length exceeds limit"
            );
            return Err(ToolError::ExecutionFailed(format!(
                "Response Content-Length ({} bytes) exceeds maximum allowed size ({} bytes)",
-                len, MAX_RESPONSE_SIZE
+                len, max_size
            )));
        }

@@ -525,16 +498,39 @@ impl Tool for HttpTool {
            let chunk = chunk.map_err(|e| {
                ToolError::ExternalService(format!("failed to read response body: {}", e))
            })?;
-            if body.len() + chunk.len() > MAX_RESPONSE_SIZE {
+            if body.len() + chunk.len() > max_size {
                return Err(ToolError::ExecutionFailed(format!(
                    "Response body exceeds maximum allowed size ({} bytes)",
-                    MAX_RESPONSE_SIZE
+                    max_size
                )));
            }
            body.extend_from_slice(&chunk);
        }
        let body_bytes = bytes::Bytes::from(body);

+        // If save_to is specified, write raw bytes to file and return metadata.
+        if let Some(save_to) = params.get("save_to").and_then(|v| v.as_str()) {
+            let save_to_owned = save_to.to_string();
+            let bytes_clone = body_bytes.clone();
+            tokio::task::spawn_blocking(move || {
+                let canonical = validate_save_to_path(&save_to_owned)?;
+                std::fs::write(&canonical, &bytes_clone).map_err(|e| {
+                    ToolError::ExecutionFailed(format!("failed to write file: {}", e))
+                })?;
+                Ok::<_, ToolError>(canonical)
+            })
+            .await
+            .map_err(|e| ToolError::ExecutionFailed(format!("spawn_blocking failed: {}", e)))?
+            .map_err(|e: ToolError| e)?;
+            let result = serde_json::json!({
+                "status": status,
+                "saved_to": save_to,
+                "size_bytes": body_bytes.len(),
+                "headers": headers,
+            });
+            return Ok(ToolOutput::success(result, start.elapsed()));
+        }
+
        let body_text = String::from_utf8_lossy(&body_bytes).into_owned();

        // Record the HTTP exchange if interceptor is present (recording mode)
@@ -601,25 +597,6 @@ impl Tool for HttpTool {
        {
            return ApprovalRequirement::Always;
        }
-        // 3. Plain GET without headers or body → no approval needed
-        let method = params
-            .get("method")
-            .and_then(|v| v.as_str())
-            .unwrap_or("GET");
-        let has_headers = params
-            .get("headers")
-            .map(|h| match h {
-                serde_json::Value::Array(a) => !a.is_empty(),
-                serde_json::Value::Object(o) => !o.is_empty(),
-                _ => false,
-            })
-            .unwrap_or(false);
-        let has_body = params.get("body").is_some();
-
-        if method.eq_ignore_ascii_case("GET") && !has_headers && !has_body {
-            return ApprovalRequirement::Never;
-        }
-
        // Default: outbound HTTP still needs approval unless auto-approved
        ApprovalRequirement::UnlessAutoApproved
    }
@@ -746,37 +723,12 @@ mod tests {
    // ── Approval requirement tests ──────────────────────────────────────

    #[test]
-    fn test_plain_get_returns_never() {
+    fn test_no_auth_headers_returns_unless_auto_approved() {
        let tool = HttpTool::new();
        let params = serde_json::json!({
            "method": "GET",
            "url": "https://api.example.com/data"
        });
-        assert_eq!(tool.requires_approval(&params), ApprovalRequirement::Never);
-    }
-
-    #[test]
-    fn test_post_returns_unless_auto_approved() {
-        let tool = HttpTool::new();
-        let params = serde_json::json!({
-            "method": "POST",
-            "url": "https://api.example.com/data",
-            "body": {"key": "value"}
-        });
-        assert_eq!(
-            tool.requires_approval(&params),
-            ApprovalRequirement::UnlessAutoApproved
-        );
-    }
-
-    #[test]
-    fn test_get_with_headers_returns_unless_auto_approved() {
-        let tool = HttpTool::new();
-        let params = serde_json::json!({
-            "method": "GET",
-            "url": "https://api.example.com/data",
-            "headers": [{"name": "X-Custom", "value": "test"}]
-        });
        assert_eq!(
            tool.requires_approval(&params),
            ApprovalRequirement::UnlessAutoApproved
@@ -874,24 +826,30 @@ mod tests {
    }

    #[test]
-    fn test_empty_headers_get_returns_never() {
+    fn test_empty_headers_return_unless_auto_approved() {
        let tool = HttpTool::new();

-        // Empty object — still a plain GET
+        // Empty object
        let params = serde_json::json!({
            "method": "GET",
            "url": "https://example.com",
            "headers": {}
        });
-        assert_eq!(tool.requires_approval(&params), ApprovalRequirement::Never);
+        assert_eq!(
+            tool.requires_approval(&params),
+            ApprovalRequirement::UnlessAutoApproved
+        );

-        // Empty array — still a plain GET
+        // Empty array
        let params = serde_json::json!({
            "method": "GET",
            "url": "https://example.com",
            "headers": []
        });
-        assert_eq!(tool.requires_approval(&params), ApprovalRequirement::Never);
+        assert_eq!(
+            tool.requires_approval(&params),
+            ApprovalRequirement::UnlessAutoApproved
+        );
    }

    // ── Credential registry approval tests ─────────────────────────────
@@ -926,7 +884,7 @@ mod tests {
    }

    #[test]
-    fn test_host_without_credential_mapping_get_returns_never() {
+    fn test_host_without_credential_mapping_returns_unless_auto_approved() {
        use crate::tools::wasm::SharedCredentialRegistry;

        let registry = Arc::new(SharedCredentialRegistry::new());
@@ -942,19 +900,10 @@ mod tests {
            ))),
        );

-        // Plain GET with no credentials → Never
        let params = serde_json::json!({
            "method": "GET",
            "url": "https://api.example.com/data"
        });
-        assert_eq!(tool.requires_approval(&params), ApprovalRequirement::Never);
-
-        // POST with no credentials → UnlessAutoApproved
-        let params = serde_json::json!({
-            "method": "POST",
-            "url": "https://api.example.com/data",
-            "body": {"key": "value"}
-        });
        assert_eq!(
            tool.requires_approval(&params),
            ApprovalRequirement::UnlessAutoApproved
@@ -1038,4 +987,60 @@ mod tests {
        });
        let _ = tool.requires_approval(&params_with_auth);
    }
+
+    // ── save_to path validation tests ─────────────────────────────────────
+
+    #[test]
+    fn test_save_to_rejects_path_outside_tmp() {
+        let err = validate_save_to_path("/etc/passwd").unwrap_err();
+        assert!(err.to_string().contains("must be under /tmp/"));
+    }
+
+    #[test]
+    fn test_save_to_rejects_home_dir() {
+        let err = validate_save_to_path("/home/user/file.txt").unwrap_err();
+        assert!(err.to_string().contains("must be under /tmp/"));
+    }
+
+    #[test]
+    fn test_save_to_rejects_traversal_via_dotdot() {
+        let err = validate_save_to_path("/tmp/../../etc/passwd").unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            msg.contains("escapes") || msg.contains("resolves outside"),
+            "expected path traversal rejection, got: {}",
+            msg
+        );
+    }
+
+    #[test]
+    fn test_save_to_rejects_deep_traversal() {
+        let err = validate_save_to_path("/tmp/a/b/../../../../etc/shadow").unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            msg.contains("escapes") || msg.contains("resolves outside"),
+            "expected path traversal rejection, got: {}",
+            msg
+        );
+    }
+
+    #[test]
+    fn test_save_to_accepts_simple_tmp_path() {
+        let path = validate_save_to_path("/tmp/test_ironclaw_photo.jpg").unwrap();
+        assert!(path.starts_with("/tmp"));
+        let _ = std::fs::remove_file(&path);
+    }
+
+    #[test]
+    fn test_save_to_accepts_nested_tmp_path() {
+        let path = validate_save_to_path("/tmp/ironclaw_test_subdir/nested/file.png").unwrap();
+        assert!(path.starts_with("/tmp"));
+        let _ = std::fs::remove_dir_all("/tmp/ironclaw_test_subdir");
+    }
+
+    #[test]
+    fn test_save_to_rejects_bare_tmp() {
+        let err = validate_save_to_path("/tmp").unwrap_err();
+        assert!(err.to_string().contains("must be under /tmp/"));
+    }
 }
@@ -68,6 +68,9 @@ impl Tool for MessageTool {
    fn description(&self) -> &str {
        "Send a message to a channel. If channel/target omitted, uses the current conversation's \
         channel and sender/group. Use to proactively message users on any connected channel. \
+         Supports file attachments: first download the file with the http tool using save_to \
+         (e.g., http GET https://picsum.photos/800/600 save_to=/tmp/photo.jpg), then pass \
+         the file path in the attachments array. Images are sent as photos on Telegram. \
         - Signal: target accepts E.164 (+1234567890) or group ID \
         - Telegram: target accepts username or chat ID \
         - Slack: target accepts channel (#general) or user ID"
@@ -149,13 +152,18 @@ impl Tool for MessageTool {

        let attachment_count = attachments.len();

-        // Validate all attachment paths against the sandbox and verify existence
+        // Validate all attachment paths against the sandbox and verify existence.
+        // Allow paths under the base_dir (~/.ironclaw) or /tmp/.
        for path in &attachments {
+            let tmp_dir = PathBuf::from("/tmp");
            let resolved =
                crate::tools::builtin::path_utils::validate_path(path, Some(&self.base_dir))
+                    .or_else(|_| {
+                        crate::tools::builtin::path_utils::validate_path(path, Some(&tmp_dir))
+                    })
                    .map_err(|e| {
                        ToolError::ExecutionFailed(format!(
-                            "Attachment path must be within {}: {}",
+                            "Attachment path must be within {} or /tmp/: {}",
                            self.base_dir.display(),
                            e
                        ))
@@ -325,22 +333,24 @@ mod tests {
        tool.set_context(Some("signal".to_string()), Some("+1234567890".to_string()))
            .await;

-        // Execute with attachments outside sandbox
+        // Execute with attachments outside both sandbox (~/.ironclaw) and /tmp/
        let ctx = crate::context::JobContext::new("test", "test description");
        let result = tool
            .execute(
                serde_json::json!({
                    "content": "hello",
-                    "attachments": ["/tmp/file1.txt", "/tmp/file2.png"]
+                    "attachments": ["/etc/passwd", "/var/log/syslog"]
                }),
                &ctx,
            )
            .await;

-        // Should fail due to sandbox rejection (paths outside ~/.ironclaw/)
+        // Should fail due to sandbox rejection (paths outside allowed directories)
        assert!(result.is_err());
        let err = result.unwrap_err().to_string();
-        assert!(err.contains("sandbox") || err.contains("escapes"));
+        assert!(
+            err.contains("sandbox") || err.contains("escapes") || err.contains("must be within"),
+        );
    }

    #[tokio::test]
@@ -376,6 +386,42 @@ mod tests {
        assert!(err.contains("channel") || err.contains("Channel"));
    }

+    #[tokio::test]
+    async fn message_tool_with_attachments_in_tmp_no_channel() {
+        use std::fs;
+
+        let tool = MessageTool::new(Arc::new(ChannelManager::new()));
+        tool.set_context(Some("telegram".to_string()), Some("12345".to_string()))
+            .await;
+
+        // Create temp files under /tmp (allowed as secondary attachment dir)
+        let temp_dir = tempfile::tempdir_in("/tmp").unwrap();
+        let file1 = temp_dir.path().join("photo.jpg");
+        let file2 = temp_dir.path().join("doc.pdf");
+        fs::write(&file1, "fake image data").unwrap();
+        fs::write(&file2, "fake pdf data").unwrap();
+
+        let ctx = crate::context::JobContext::new("test", "test description");
+        let result = tool
+            .execute(
+                serde_json::json!({
+                    "content": "here are the files",
+                    "attachments": [file1.to_string_lossy(), file2.to_string_lossy()]
+                }),
+                &ctx,
+            )
+            .await;
+
+        // Path validation passes for /tmp paths, fails at channel send (no real channel)
+        assert!(result.is_err());
+        let err = result.unwrap_err().to_string();
+        assert!(
+            err.contains("channel") || err.contains("Channel"),
+            "expected channel error (path validation should pass), got: {}",
+            err
+        );
+    }
+
    #[tokio::test]
    async fn message_tool_requires_content() {
        let tool = MessageTool::new(Arc::new(ChannelManager::new()));
@@ -19,7 +19,7 @@ mod time;
 pub use echo::EchoTool;
 pub use extension_tools::{
    ExtensionInfoTool, ToolActivateTool, ToolAuthTool, ToolInstallTool, ToolListTool,
-    ToolRemoveTool, ToolSearchTool,
+    ToolRemoveTool, ToolSearchTool, ToolUpgradeTool,
 };
 pub use file::{ApplyPatchTool, ListDirTool, ReadFileTool, WriteFileTool};
 pub use http::HttpTool;
@@ -21,7 +21,7 @@ use crate::tools::builtin::{
    MemoryReadTool, MemorySearchTool, MemoryTreeTool, MemoryWriteTool, PromptQueue, ReadFileTool,
    ShellTool, SkillInstallTool, SkillListTool, SkillRemoveTool, SkillSearchTool, TimeTool,
    ToolActivateTool, ToolAuthTool, ToolInstallTool, ToolListTool, ToolRemoveTool, ToolSearchTool,
-    WriteFileTool,
+    ToolUpgradeTool, WriteFileTool,
 };
 use crate::tools::rate_limiter::RateLimiter;
 use crate::tools::tool::{Tool, ToolDomain};
@@ -389,8 +389,9 @@ impl ToolRegistry {
        self.register_sync(Arc::new(ToolActivateTool::new(Arc::clone(&manager))));
        self.register_sync(Arc::new(ToolListTool::new(Arc::clone(&manager))));
        self.register_sync(Arc::new(ToolRemoveTool::new(Arc::clone(&manager))));
+        self.register_sync(Arc::new(ToolUpgradeTool::new(Arc::clone(&manager))));
        self.register_sync(Arc::new(ExtensionInfoTool::new(manager)));
-        tracing::info!("Registered 7 extension management tools");
+        tracing::info!("Registered 8 extension management tools");
    }

    /// Register skill management tools (list, search, install, remove).
@@ -328,7 +328,7 @@ impl WasmToolLoader {
 /// - Extension WIT version must not be greater than host version
 ///
 /// If `declared` is `None`, the check is skipped (pre-versioning extension).
-pub(crate) fn check_wit_version_compat(
+pub fn check_wit_version_compat(
    name: &str,
    declared: Option<&str>,
    host_version: &str,
@@ -77,10 +77,10 @@
 ///
 /// Extensions declaring a `wit_version` in their capabilities file are checked
 /// against this at load time: same major, not greater than host.
-pub const WIT_TOOL_VERSION: &str = "0.2.0";
+pub const WIT_TOOL_VERSION: &str = "0.3.0";

 /// Host WIT version for channel extensions.
-pub const WIT_CHANNEL_VERSION: &str = "0.2.0";
+pub const WIT_CHANNEL_VERSION: &str = "0.3.0";

 mod allowlist;
 mod capabilities;
@@ -131,8 +131,9 @@ pub use storage::{

 // Loader
 pub use loader::{
-    DiscoveredTool, LoadResults, WasmLoadError, WasmToolLoader, discover_dev_tools, discover_tools,
-    load_dev_tools, resolve_wasm_target_dir, wasm_artifact_path,
+    DiscoveredTool, LoadResults, WasmLoadError, WasmToolLoader, check_wit_version_compat,
+    discover_dev_tools, discover_tools, load_dev_tools, resolve_wasm_target_dir,
+    wasm_artifact_path,
 };

 // Capabilities schema (for parsing *.capabilities.json files)