Skip to content

FLT-150 — File attachments for command bar and follow-ups

Implemented authenticated file attachments for command-bar dispatches and card follow-ups.

Implementation

  • Added base64 JSON upload contracts and generated client models.
  • Added AttachmentStore, which validates single-segment filenames, rejects traversal and invalid names, enforces 10 MiB per-file / 20 MiB total limits, stores files under {DispatchRoot}/attachments/{jobId}/, and records SHA-256, size, filename, and path.
  • Added attachment metadata to AgentRunRequest; the signed run payload carries the stored paths to the launched agent. Follow-ups preserve parent attachments and append newly uploaded files.
  • Added picker controls, accessible buttons, removable filename chips, and base64 POST payloads to both Angular composers.
  • Regenerated openapi/FleetMissionControl.Api.json and frontend/src/app/api/fleet-api.generated.ts.

Gates

  • dotnet build -warnaserror — PASS; 0 warnings, 0 errors.
  • dotnet test — PASS; 556 passed, 0 failed, 0 skipped.
  • cd frontend; npm install — PASS; 680 packages installed. npm reported 3 low-severity audit findings.
  • npx ng build — PASS.
  • npx ng lint — PASS; all files pass linting.
  • npx vitest run — PASS; 266 tests passed across 25 files.
  • npm run generate:client — PASS.
  • npm run check:drift — PASS after the regenerated client was explicitly staged; the initial pre-staging run correctly reported the expected contract diff.

Tests added

  • Attachment store roundtrip/hash, size cap, and traversal/non-segment filename rejection tests.
  • Follow-up attachment contract/composition test.
  • Command-bar and follow-up Angular specs asserting attachments are included in POST requests.

No push was performed.