Module api_upload 

POST /api/upload?agent=<alias> — web dashboard image upload.

Accepts raw image bytes in the request body, types them by magic bytes (never the client-declared Content-Type or filename), and writes them to <agent workspace>/webui_uploads/. The response carries the saved path and the [IMAGE:<path>] marker the dashboard embeds in the next chat message, which the multimodal provider path resolves into image content at request time (zeroclaw_providers::multimodal).

Acceptance is decided by zeroclaw_api::media::image_mime_from_magic filtered through zeroclaw_api::media::is_provider_image_mime — the same canonical contract channels consult — so this endpoint can never save an image the provider loader would then drop. The saved filename’s extension is derived from the sniffed MIME, so name and payload agree by construction.

Structs

UploadQuery

UploadResponse

Enums

UploadReject

Why an upload payload was refused. Carries everything the HTTP layer needs so the decision itself stays pure and unit-testable.

Constants

UPLOAD_BODY_CEILING_BYTES

Hard ceiling for the route’s body limit, matching the upper clamp of MultimodalConfig::effective_limits (20 MB). The configured limit is enforced per-request inside the handler; this only bounds what axum will buffer.

Functions

classify_upload

The whole acceptance decision: which extension the payload earns, or why it is refused. Pure — sniffs magic bytes only, so a client-supplied name or Content-Type can never widen acceptance.

handle_upload