From 9c023e2590f93dd848bf943febc7243c0da34ebc Mon Sep 17 00:00:00 2001
From: Hunter Phillips <hunterphillips@mac.lan>
Date: Sun, 14 Dec 2025 20:03:51 -0600
Subject: [PATCH 1/4] attachments

---
 client/src/App.tsx                            | 135 +------
 client/src/components/Sidebar.tsx             |   7 +-
 .../src/components/chat/AttachmentPreview.tsx |  67 ++++
 client/src/components/chat/ChatListItem.tsx   |   6 +-
 client/src/components/chat/ChatView.tsx       | 132 +++++++
 client/src/components/chat/FilePicker.tsx     |  63 ++++
 client/src/components/chat/InputArea.tsx      | 179 ++++-----
 .../src/components/chat/MessageAttachment.tsx |  53 +++
 client/src/components/chat/MessageBubble.tsx  |  21 +-
 client/src/components/chat/ToolMenu.tsx       |  11 +-
 .../src/components/chat/ToolPillContainer.tsx |  58 +++
 .../src/components/tools/attachments/index.ts |   4 +
 .../components/tools/instructions/index.ts    |   2 +-
 client/src/components/ui/toast.tsx            |  10 +-
 client/src/hooks/useChatPersistence.ts        |  41 ++
 client/src/hooks/useChatSession.ts            | 144 +++----
 client/src/hooks/useFileUpload.ts             |  60 +++
 client/src/lib/icon-utils.ts                  |   2 +
 client/src/lib/types.ts                       |  19 +
 client/src/store/config-store.ts              |  19 +
 package-lock.json                             | 356 +++++++++++++++++-
 server/package.json                           |   3 +
 server/src/db/chats.ts                        |  14 +
 server/src/index.ts                           |  84 ++++-
 server/src/lib/message-converter.ts           | 103 +++++
 server/src/lib/workflow-router.ts             |  25 ++
 server/src/providers.ts                       |  77 ++++
 server/src/routes/uploads.ts                  | 149 ++++++++
 server/src/types.ts                           |  27 ++
 server/src/workflows/consensus.ts             | 178 +++++----
 30 files changed, 1628 insertions(+), 421 deletions(-)
 create mode 100644 client/src/components/chat/AttachmentPreview.tsx
 create mode 100644 client/src/components/chat/ChatView.tsx
 create mode 100644 client/src/components/chat/FilePicker.tsx
 create mode 100644 client/src/components/chat/MessageAttachment.tsx
 create mode 100644 client/src/components/chat/ToolPillContainer.tsx
 create mode 100644 client/src/components/tools/attachments/index.ts
 create mode 100644 client/src/hooks/useChatPersistence.ts
 create mode 100644 client/src/hooks/useFileUpload.ts
 create mode 100644 server/src/lib/message-converter.ts
 create mode 100644 server/src/lib/workflow-router.ts
 create mode 100644 server/src/routes/uploads.ts

diff --git a/client/src/App.tsx b/client/src/App.tsx
index 01cafb8..91d4c1a 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -1,137 +1,8 @@
-import { useEffect, useState } from 'react';
-import { Routes, Route, useParams, useNavigate } from 'react-router-dom';
-import { ChatContainer } from './components/chat/ChatContainer';
-import { InputArea } from './components/chat/InputArea';
-import { ModelSelector } from './components/chat/ModelSelector';
-import { Sidebar } from './components/Sidebar';
-import { Toast, useToast } from './components/ui/toast';
+import { useEffect } from 'react';
+import { Routes, Route } from 'react-router-dom';
+import { ChatView } from './components/chat/ChatView';
 import { useConfigStore } from './store/config-store';
 import { initializeToolRegistry } from './components/tools';
-import { useChatSession } from './hooks/useChatSession';
-
-function ChatView() {
-  const [sidebarOpen, setSidebarOpen] = useState(true);
-  const { id } = useParams();
-  const navigate = useNavigate();
-  const { toast, showToast, hideToast } = useToast();
-
-  // Get all chat state and handlers from custom hook
-  const {
-    messages,
-    input,
-    handleInputChange,
-    handleSubmit,
-    isLoading,
-    error,
-    stop,
-    handleNewChat,
-    handleSelectChat,
-  } = useChatSession();
-
-  // Load chat when URL changes
-  useEffect(() => {
-    const loadChatById = async (chatId: string) => {
-      try {
-        await handleSelectChat(chatId);
-      } catch (error) {
-        showToast('Chat not found', 'error');
-        navigate('/');
-      }
-    };
-
-    if (id) {
-      loadChatById(id);
-    } else {
-      handleNewChat();
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [id]);
-
-  // Show toast on error
-  useEffect(() => {
-    if (error) {
-      showToast(error.message, 'error');
-    }
-  }, [error, showToast]);
-
-  // Navigation handlers (passed as props to children)
-  const onSelectChat = (chatId: string) => {
-    navigate(`/c/${chatId}`);
-  };
-
-  const onNewChat = () => {
-    navigate('/');
-  };
-
-  const onDeleteCurrentChat = () => {
-    navigate('/');
-  };
-
-  // Wrap handleSubmit to navigate to new chats
-  const onSubmit = async (e: React.FormEvent) => {
-    const result = await handleSubmit(e);
-    if (result?.newChatId) {
-      navigate(`/c/${result.newChatId}`);
-    }
-  };
-
-  return (
-    <div className="flex h-screen bg-background text-foreground">
-      {/* Sidebar */}
-      <Sidebar
-        isOpen={sidebarOpen}
-        onToggle={() => setSidebarOpen(!sidebarOpen)}
-        onNewChat={onNewChat}
-        onSelectChat={onSelectChat}
-        onDeleteCurrentChat={onDeleteCurrentChat}
-        currentChatId={id || null}
-      />
-
-      {/* Main Content Area */}
-      <div className="flex flex-col flex-1 overflow-hidden">
-        <ModelSelector />
-
-        {messages.length === 0 ? (
-          // Empty state: centered input
-          <div className="flex-1 flex flex-col items-center justify-center p-4">
-            <div className="w-full max-w-3xl">
-              <h2 className="text-3xl font-normal text-center mb-8 text-foreground">
-                What can I help you with?
-              </h2>
-              <InputArea
-                input={input}
-                handleInputChange={handleInputChange as any}
-                handleSubmit={onSubmit}
-                isLoading={isLoading}
-                onStop={stop}
-              />
-            </div>
-          </div>
-        ) : (
-          // Chat view: normal layout
-          <>
-            <ChatContainer messages={messages} />
-            <InputArea
-              input={input}
-              handleInputChange={handleInputChange as any}
-              handleSubmit={onSubmit}
-              isLoading={isLoading}
-              onStop={stop}
-            />
-          </>
-        )}
-
-        {toast && (
-          <Toast
-            message={toast.message}
-            variant={toast.variant}
-            onClose={hideToast}
-          />
-        )}
-      </div>
-    </div>
-  );
-}
 
 function App() {
   const { loadConfig } = useConfigStore();
diff --git a/client/src/components/Sidebar.tsx b/client/src/components/Sidebar.tsx
index 2b8863c..50eb584 100644
--- a/client/src/components/Sidebar.tsx
+++ b/client/src/components/Sidebar.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from 'react';
+import { useEffect, useState } from 'react';
 import { PenSquare, PanelLeft, Pencil, Trash2 } from 'lucide-react';
 import { cn } from '@/lib/utils';
 import { useConfigStore } from '@/store/config-store';
@@ -24,7 +24,7 @@ export function Sidebar({
   onDeleteCurrentChat,
   currentChatId,
 }: SidebarProps) {
-  const [isHovering, setIsHovering] = React.useState(false);
+  const [isHovering, setIsHovering] = useState(false);
   const [chatToDelete, setChatToDelete] = useState<string | null>(null);
   const [dropdownMenu, setDropdownMenu] = useState<{
     chatId: string;
@@ -148,7 +148,8 @@ export function Sidebar({
 
         {/* Chat List */}
         {isOpen && (
-          <div className="flex-1 overflow-y-auto p-2 space-y-1">
+          // space-y-1
+          <div className="flex-1 overflow-y-auto p-2">
             {chats.map((chat) => (
               <ChatListItem
                 key={chat.id}
diff --git a/client/src/components/chat/AttachmentPreview.tsx b/client/src/components/chat/AttachmentPreview.tsx
new file mode 100644
index 0000000..a17b4d3
--- /dev/null
+++ b/client/src/components/chat/AttachmentPreview.tsx
@@ -0,0 +1,67 @@
+import { X, File, FileText, FileCode, Image } from 'lucide-react';
+import type { Attachment } from '@/lib/types';
+
+interface AttachmentPreviewProps {
+  attachment: Attachment;
+  onRemove: () => void;
+}
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
+
+export function AttachmentPreview({
+  attachment,
+  onRemove,
+}: AttachmentPreviewProps) {
+  const isImage = attachment.mimeType.startsWith('image/');
+  const isPdf = attachment.mimeType === 'application/pdf';
+  const isCode =
+    attachment.mimeType.includes('javascript') ||
+    attachment.mimeType.includes('typescript') ||
+    attachment.mimeType === 'application/json';
+  const isText = attachment.mimeType.startsWith('text/');
+
+  const fileUrl = `${API_URL}/api/uploads/${attachment.path}`;
+
+  const getIcon = () => {
+    if (isImage) return Image;
+    if (isPdf) return File;
+    if (isCode) return FileCode;
+    if (isText) return FileText;
+    return File;
+  };
+
+  const Icon = getIcon();
+
+  return (
+    <div className="relative group inline-flex items-center gap-2 p-2 bg-accent border border-border rounded-lg">
+      {isImage ? (
+        <img
+          src={fileUrl}
+          alt={attachment.name}
+          className="w-12 h-12 object-cover rounded"
+        />
+      ) : (
+        <div className="w-12 h-12 flex items-center justify-center bg-background rounded">
+          <Icon className="h-6 w-6 text-muted-foreground" />
+        </div>
+      )}
+
+      <div className="flex flex-col min-w-0">
+        <span className="text-xs text-foreground truncate max-w-[150px]">
+          {attachment.name}
+        </span>
+        <span className="text-xs text-muted-foreground">
+          {(attachment.size / 1024).toFixed(1)} KB
+        </span>
+      </div>
+
+      <button
+        type="button"
+        onClick={onRemove}
+        className="absolute -top-2 -right-2 p-1 bg-destructive text-destructive-foreground rounded-full opacity-0 group-hover:opacity-100 transition-opacity"
+      >
+        <X className="h-3 w-3" />
+      </button>
+    </div>
+  );
+}
diff --git a/client/src/components/chat/ChatListItem.tsx b/client/src/components/chat/ChatListItem.tsx
index 62af8cb..390be73 100644
--- a/client/src/components/chat/ChatListItem.tsx
+++ b/client/src/components/chat/ChatListItem.tsx
@@ -1,4 +1,4 @@
-import { MessageSquare, MoreHorizontal } from 'lucide-react';
+import { MoreHorizontal } from 'lucide-react';
 import { useState, useRef, useEffect } from 'react';
 import { cn } from '@/lib/utils';
 import type { ChatListItem } from '@/lib/types';
@@ -58,13 +58,11 @@ export function ChatListItem({
     <div
       onClick={isEditing ? undefined : onClick}
       className={cn(
-        'group flex items-center gap-3 p-3 rounded-lg transition-colors',
+        'group flex items-center gap-3 p-2 rounded-lg transition-colors',
         !isEditing && 'cursor-pointer',
         isActive ? 'bg-accent/70' : 'hover:bg-border'
       )}
     >
-      <MessageSquare className="h-4 w-4 text-foreground flex-shrink-0" />
-
       {isEditing ? (
         <div className="flex-1 flex items-center gap-2">
           <input
diff --git a/client/src/components/chat/ChatView.tsx b/client/src/components/chat/ChatView.tsx
new file mode 100644
index 0000000..41f6cc8
--- /dev/null
+++ b/client/src/components/chat/ChatView.tsx
@@ -0,0 +1,132 @@
+import { useEffect, useState } from 'react';
+import { useParams, useNavigate } from 'react-router-dom';
+import { ChatContainer } from './ChatContainer';
+import { InputArea } from './InputArea';
+import { ModelSelector } from './ModelSelector';
+import { Sidebar } from '../Sidebar';
+import { Toast, useToast } from '../ui/toast';
+import { useChatSession } from '../../hooks/useChatSession';
+
+export function ChatView() {
+  const [sidebarOpen, setSidebarOpen] = useState(true);
+  const { id } = useParams();
+  const navigate = useNavigate();
+  const { toast, showToast, hideToast } = useToast();
+
+  // Get chat state and handlers from custom hook
+  const {
+    messages,
+    input,
+    handleInputChange,
+    handleSubmit,
+    isLoading,
+    error,
+    stop,
+    handleNewChat,
+    handleSelectChat,
+  } = useChatSession();
+
+  // Load chat when URL changes
+  useEffect(() => {
+    const loadChatById = async (chatId: string) => {
+      try {
+        await handleSelectChat(chatId);
+      } catch (error) {
+        showToast('Chat not found', 'error');
+        navigate('/');
+      }
+    };
+
+    if (id) {
+      loadChatById(id);
+    } else {
+      handleNewChat();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [id]);
+
+  // Show toast on error
+  useEffect(() => {
+    if (error) {
+      showToast(error.message, 'error');
+    }
+  }, [error, showToast]);
+
+  // Navigation handlers (passed as props to children)
+  const onSelectChat = (chatId: string) => {
+    navigate(`/c/${chatId}`);
+  };
+
+  const onNewChat = () => {
+    navigate('/');
+  };
+
+  const onDeleteCurrentChat = () => {
+    navigate('/');
+  };
+
+  // Wrap handleSubmit to navigate to new chats
+  const onSubmit = async (e: React.FormEvent) => {
+    const result = await handleSubmit(e);
+    if (result?.newChatId) {
+      navigate(`/c/${result.newChatId}`);
+    }
+  };
+
+  return (
+    <div className="flex h-screen bg-background text-foreground">
+      {/* Sidebar */}
+      <Sidebar
+        isOpen={sidebarOpen}
+        onToggle={() => setSidebarOpen(!sidebarOpen)}
+        onNewChat={onNewChat}
+        onSelectChat={onSelectChat}
+        onDeleteCurrentChat={onDeleteCurrentChat}
+        currentChatId={id || null}
+      />
+
+      {/* Main Content Area */}
+      <div className="flex flex-col flex-1 overflow-hidden">
+        <ModelSelector />
+
+        {messages.length === 0 ? (
+          // Empty state: centered input
+          <div className="flex-1 flex flex-col items-center justify-center p-4">
+            <div className="w-full max-w-3xl">
+              <h2 className="text-3xl font-normal text-center mb-8 text-foreground">
+                What can I help you with?
+              </h2>
+              <InputArea
+                input={input}
+                handleInputChange={handleInputChange as any}
+                handleSubmit={onSubmit}
+                isLoading={isLoading}
+                onStop={stop}
+              />
+            </div>
+          </div>
+        ) : (
+          // Chat view: normal layout
+          <>
+            <ChatContainer messages={messages} />
+            <InputArea
+              input={input}
+              handleInputChange={handleInputChange as any}
+              handleSubmit={onSubmit}
+              isLoading={isLoading}
+              onStop={stop}
+            />
+          </>
+        )}
+
+        {toast && (
+          <Toast
+            message={toast.message}
+            variant={toast.variant}
+            onClose={hideToast}
+          />
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/client/src/components/chat/FilePicker.tsx b/client/src/components/chat/FilePicker.tsx
new file mode 100644
index 0000000..0781a3a
--- /dev/null
+++ b/client/src/components/chat/FilePicker.tsx
@@ -0,0 +1,63 @@
+import { useRef } from 'react';
+import { Paperclip } from 'lucide-react';
+
+interface FilePickerProps {
+  onFilesSelected: (files: FileList) => void;
+  disabled?: boolean;
+}
+
+const ACCEPTED_FILE_TYPES = [
+  'image/png',
+  'image/jpeg',
+  'image/gif',
+  'image/webp',
+  // 'image/svg+xml',
+  'application/pdf',
+  'text/plain',
+  'text/markdown',
+  'text/javascript',
+  'application/javascript',
+  'text/x-javascript',
+  'application/x-javascript',
+  'text/typescript',
+  'application/x-typescript',
+  'application/json',
+].join(',');
+
+export function FilePicker({ onFilesSelected, disabled }: FilePickerProps) {
+  const inputRef = useRef<HTMLInputElement>(null);
+
+  const handleClick = () => {
+    inputRef.current?.click();
+  };
+
+  const handleChange = (e: React.ChangeEvent<HTMLInputElement>) => {
+    if (e.target.files && e.target.files.length > 0) {
+      onFilesSelected(e.target.files);
+      // Reset input so same file can be selected again
+      e.target.value = '';
+    }
+  };
+
+  return (
+    <>
+      <button
+        type="button"
+        onClick={handleClick}
+        disabled={disabled}
+        className="p-2 hover:bg-accent rounded transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+        title="Attach files"
+      >
+        <Paperclip className="h-5 w-5 text-foreground" />
+      </button>
+      <input
+        ref={inputRef}
+        type="file"
+        multiple
+        accept={ACCEPTED_FILE_TYPES}
+        onChange={handleChange}
+        className="hidden"
+      />
+    </>
+  );
+}
diff --git a/client/src/components/chat/InputArea.tsx b/client/src/components/chat/InputArea.tsx
index 6a65039..99bfc11 100644
--- a/client/src/components/chat/InputArea.tsx
+++ b/client/src/components/chat/InputArea.tsx
@@ -1,16 +1,19 @@
-import React from 'react';
+import { useState, ChangeEvent, FormEvent, KeyboardEvent } from 'react';
 import { Button } from '@/components/ui/button';
 import { Square } from 'lucide-react';
 import { ToolMenu } from './ToolMenu';
-import { ToolPill } from './ToolPill';
+import { AttachmentPreview } from './AttachmentPreview';
+import { FilePicker } from './FilePicker';
+import { ToolPillContainer } from './ToolPillContainer';
 import { toolRegistry } from '@/lib/tool-registry';
 import { useConfigStore } from '@/store/config-store';
+import { useFileUpload } from '@/hooks/useFileUpload';
 import birdIcon from '@/assets/bird.png';
 
 interface InputAreaProps {
   input: string;
-  handleInputChange: (e: React.ChangeEvent<HTMLTextAreaElement>) => void;
-  handleSubmit: (e: React.FormEvent<HTMLFormElement>) => void;
+  handleInputChange: (e: ChangeEvent<HTMLTextAreaElement>) => void;
+  handleSubmit: (e: FormEvent<HTMLFormElement>) => void;
   isLoading: boolean;
   onStop: () => void;
 }
@@ -22,120 +25,104 @@ export function InputArea({
   isLoading,
   onStop,
 }: InputAreaProps) {
-  const [activePanelToolId, setActivePanelToolId] = React.useState<
-    string | null
-  >(null);
-  const [activeConfigToolId, setActiveConfigToolId] = React.useState<
-    string | null
-  >(null);
-  const { tools, toggleTool } = useConfigStore();
+  const [activePanelToolId, setActivePanelToolId] = useState<string | null>(
+    null
+  );
+  const { tools, currentChatId, pendingAttachments, removeAttachment } =
+    useConfigStore();
+  const { uploadFiles } = useFileUpload(currentChatId);
 
-  const enabledTools = tools.filter((t) => t.enabled);
+  const hasAttachments = pendingAttachments.length > 0;
 
-  const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+  const handleKeyDown = (e: KeyboardEvent<HTMLTextAreaElement>) => {
     if (e.key === 'Enter' && !e.shiftKey) {
       e.preventDefault();
       handleSubmit(e as any);
     }
   };
 
-  const handleRemoveTool = (toolId: string) => {
-    toggleTool(toolId, false);
-  };
-
-  const handleOpenConfig = (toolId: string) => {
-    setActiveConfigToolId(toolId);
+  const handleFilesSelected = async (files: FileList) => {
+    await uploadFiles(files);
   };
 
   return (
     <>
       <form onSubmit={handleSubmit} className="p-4 bg-background">
         <div className="max-w-3xl mx-auto space-y-2">
-          <div className="flex gap-2 bg-accent/50 rounded-lg p-4 items-end">
-            {/* Plus Menu */}
-            <ToolMenu onOpenPanel={setActivePanelToolId} />
-
-            <textarea
-              value={input}
-              onChange={handleInputChange}
-              onKeyDown={handleKeyDown}
-              placeholder="Type your message..."
-              disabled={isLoading}
-              rows={1}
-              className="flex-1 leading-none resize-none border-0 bg-transparent focus-visible:outline-none text-sm placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50 min-h-[24px] max-h-[200px] overflow-y-auto"
-              style={{
-                height: 'auto',
-                minHeight: '24px',
-              }}
-              onInput={(e) => {
-                const target = e.target as HTMLTextAreaElement;
-                target.style.height = 'auto';
-                target.style.height = `${Math.min(target.scrollHeight, 200)}px`;
-              }}
-            />
-            {isLoading ? (
-              <Button
-                type="button"
-                onClick={onStop}
-                variant="outline"
-                className="px-3"
-              >
-                <Square className="h-4 w-4" />
-              </Button>
-            ) : (
-              <Button
-                type="submit"
-                disabled={!input.trim()}
-                className="rounded-full p-0"
-              >
-                <img
-                  src={birdIcon}
-                  alt="Send"
-                  className="opacity-90 w-[38px]"
-                />
-              </Button>
+          <div className="flex flex-col gap-2 bg-accent/50 rounded-lg p-4">
+            {/* Attachment Previews */}
+            {hasAttachments && (
+              <div className="flex flex-wrap gap-2 pb-2">
+                {pendingAttachments.map((att) => (
+                  <AttachmentPreview
+                    key={att.id}
+                    attachment={att}
+                    onRemove={() => removeAttachment(att.id)}
+                  />
+                ))}
+              </div>
             )}
-          </div>
+            <div className="flex gap-2 items-end">
+              {/* Tool Menu and File Picker */}
+              <div className="flex">
+                <FilePicker
+                  onFilesSelected={handleFilesSelected}
+                  disabled={isLoading}
+                />
+                <ToolMenu onOpenPanel={setActivePanelToolId} />
+              </div>
 
-          {/* Active Tools Pills */}
-          <div className="flex gap-2">
-            {enabledTools.map((tool) => {
-              const PillComponent =
-                toolRegistry.getPillComponent(tool.id) || ToolPill;
-              const hasConfig = !!toolRegistry.getConfigComponent(tool.id);
+              <textarea
+                value={input}
+                onChange={handleInputChange}
+                onKeyDown={handleKeyDown}
+                placeholder="Type your message..."
+                disabled={isLoading}
+                rows={1}
+                className={`${
+                  hasAttachments && 'mt-2'
+                } flex-1 leading-none resize-none border-0 bg-transparent focus-visible:outline-none text-sm placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50 min-h-[24px] max-h-[200px] overflow-y-auto`}
+                onInput={(e) => {
+                  const target = e.target as HTMLTextAreaElement;
+                  target.style.height = 'auto';
+                  target.style.height = `${Math.min(
+                    target.scrollHeight,
+                    200
+                  )}px`;
+                }}
+              />
 
-              return (
-                <div key={tool.id} className="relative">
-                  <PillComponent
-                    tool={tool}
-                    onRemove={() => handleRemoveTool(tool.id)}
-                    onConfigClick={
-                      hasConfig ? () => handleOpenConfig(tool.id) : undefined
-                    }
+              {isLoading ? (
+                <Button
+                  type="button"
+                  onClick={onStop}
+                  variant="outline"
+                  className="px-3"
+                >
+                  <Square className="h-4 w-4" />
+                </Button>
+              ) : (
+                <Button
+                  type="submit"
+                  disabled={!input.trim() && !hasAttachments}
+                  className="rounded-full p-0"
+                >
+                  <img
+                    src={birdIcon}
+                    alt="Send"
+                    className="opacity-90 w-[38px]"
                   />
-
-                  {/* Render config dropdown if active */}
-                  {activeConfigToolId === tool.id &&
-                    (() => {
-                      const ConfigComponent = toolRegistry.getConfigComponent(
-                        tool.id
-                      );
-                      return ConfigComponent ? (
-                        <ConfigComponent
-                          tool={tool}
-                          isOpen={true}
-                          onClose={() => setActiveConfigToolId(null)}
-                        />
-                      ) : null;
-                    })()}
-                </div>
-              );
-            })}
+                </Button>
+              )}
+            </div>
           </div>
+
+          {/* Active Tools Pills */}
+          <ToolPillContainer />
         </div>
       </form>
 
-      {/* Render active panel */}
+      {/* Render selected tool panel (popup) */}
       {activePanelToolId &&
         (() => {
           const tool = tools.find((t) => t.id === activePanelToolId);
diff --git a/client/src/components/chat/MessageAttachment.tsx b/client/src/components/chat/MessageAttachment.tsx
new file mode 100644
index 0000000..d989467
--- /dev/null
+++ b/client/src/components/chat/MessageAttachment.tsx
@@ -0,0 +1,53 @@
+import { File, FileText, FileCode } from 'lucide-react';
+import type { Attachment } from '@/lib/types';
+
+interface MessageAttachmentProps {
+  attachment: Attachment;
+}
+
+export function MessageAttachment({ attachment }: MessageAttachmentProps) {
+  const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
+  const fileUrl = `${API_URL}/api/uploads/${attachment.path}`;
+  const isImage = attachment.mimeType.startsWith('image/');
+
+  const getFileIcon = (mimeType: string) => {
+    if (mimeType.startsWith('text/')) return FileText;
+    if (
+      mimeType.includes('javascript') ||
+      mimeType.includes('typescript') ||
+      mimeType.includes('json')
+    )
+      return FileCode;
+    return File;
+  };
+
+  if (isImage) {
+    return (
+      <a
+        href={fileUrl}
+        target="_blank"
+        rel="noopener noreferrer"
+        className="block"
+      >
+        <img
+          src={fileUrl}
+          alt={attachment.name}
+          className="max-w-xs rounded border border-border hover:opacity-90 transition-opacity"
+        />
+      </a>
+    );
+  }
+
+  const IconComponent = getFileIcon(attachment.mimeType);
+  return (
+    <a
+      href={fileUrl}
+      target="_blank"
+      rel="noopener noreferrer"
+      className="flex items-center gap-2 px-3 py-2 rounded border border-border hover:bg-accent/30 transition-colors"
+    >
+      <IconComponent className="h-4 w-4 flex-shrink-0" />
+      <span className="text-sm truncate max-w-[200px]">{attachment.name}</span>
+    </a>
+  );
+}
diff --git a/client/src/components/chat/MessageBubble.tsx b/client/src/components/chat/MessageBubble.tsx
index 057e810..a4f2644 100644
--- a/client/src/components/chat/MessageBubble.tsx
+++ b/client/src/components/chat/MessageBubble.tsx
@@ -4,22 +4,39 @@ import { Prism as SyntaxHighlighter } from 'react-syntax-highlighter';
 import { vscDarkPlus } from 'react-syntax-highlighter/dist/esm/styles/prism';
 import { cn } from '@/lib/utils';
 import type { Message } from '@ai-sdk/react';
+import type { Attachment } from '@/lib/types';
+import { MessageAttachment } from './MessageAttachment';
 
 interface MessageBubbleProps {
-  message: Message;
+  message: Message & { attachments?: Attachment[] };
 }
 
 export function MessageBubble({ message }: MessageBubbleProps) {
   const isUser = message.role === 'user';
 
   return (
-    <div className={cn('flex w-full mb-4', isUser ? 'justify-end' : 'justify-start')}>
+    <div
+      className={cn(
+        'flex w-full mb-4',
+        isUser ? 'justify-end' : 'justify-start'
+      )}
+    >
       <div
         className={cn(
           'max-w-[80%] rounded-lg px-4 py-3',
           isUser ? 'bg-accent/50 text-foreground' : 'text-foreground'
         )}
       >
+        {/* Attachments */}
+        {message.attachments && message.attachments.length > 0 && (
+          <div className="flex flex-wrap gap-2 mb-3">
+            {message.attachments.map((att) => (
+              <MessageAttachment key={att.id} attachment={att} />
+            ))}
+          </div>
+        )}
+
+        {/* Message content */}
         {isUser ? (
           <p className="whitespace-pre-wrap">{message.content}</p>
         ) : (
diff --git a/client/src/components/chat/ToolMenu.tsx b/client/src/components/chat/ToolMenu.tsx
index 92d9759..e63c123 100644
--- a/client/src/components/chat/ToolMenu.tsx
+++ b/client/src/components/chat/ToolMenu.tsx
@@ -35,9 +35,7 @@ export function ToolMenu({ onOpenPanel }: ToolMenuProps) {
       onOpenPanel(toolId);
     } else {
       // Enable the tool if not already enabled
-      if (!tool?.enabled) {
-        toggleTool(toolId, true);
-      }
+      if (!tool?.enabled) toggleTool(toolId, true);
 
       // If tool has a panel, open it explicitly
       if (hasPanel && onOpenPanel) {
@@ -48,9 +46,6 @@ export function ToolMenu({ onOpenPanel }: ToolMenuProps) {
     setIsOpen(false);
   };
 
-  // Show all available tools in menu
-  const availableTools = tools;
-
   return (
     <div className="relative" ref={menuRef}>
       <button
@@ -62,8 +57,8 @@ export function ToolMenu({ onOpenPanel }: ToolMenuProps) {
       </button>
 
       {isOpen && (
-        <div className="absolute bottom-full left-0 mb-2 w-48 bg-secondary border border-border rounded-lg shadow-lg">
-          {availableTools.map((tool) => (
+        <div className="absolute bottom-full left-0 z-50 mb-2 w-48 bg-secondary border border-border rounded-lg shadow-lg">
+          {tools.map((tool) => (
             <ToolMenuItem
               key={tool.id}
               tool={tool}
diff --git a/client/src/components/chat/ToolPillContainer.tsx b/client/src/components/chat/ToolPillContainer.tsx
new file mode 100644
index 0000000..26e6d6c
--- /dev/null
+++ b/client/src/components/chat/ToolPillContainer.tsx
@@ -0,0 +1,58 @@
+import { useState } from 'react';
+import { ToolPill } from './ToolPill';
+import { toolRegistry } from '@/lib/tool-registry';
+import { useConfigStore } from '@/store/config-store';
+
+export function ToolPillContainer() {
+  const [activeConfigToolId, setActiveConfigToolId] = useState<string | null>(
+    null
+  );
+
+  const { tools, toggleTool } = useConfigStore();
+  const enabledTools = tools.filter((t) => t.enabled);
+
+  const handleRemoveTool = (toolId: string) => {
+    toggleTool(toolId, false);
+  };
+
+  const handleOpenConfig = (toolId: string) => {
+    setActiveConfigToolId(toolId);
+  };
+
+  return (
+    <div className="flex gap-2">
+      {enabledTools.map((tool) => {
+        const PillComponent =
+          toolRegistry.getPillComponent(tool.id) || ToolPill;
+        const hasConfig = !!toolRegistry.getConfigComponent(tool.id);
+
+        return (
+          <div key={tool.id} className="relative">
+            <PillComponent
+              tool={tool}
+              onRemove={() => handleRemoveTool(tool.id)}
+              onConfigClick={
+                hasConfig ? () => handleOpenConfig(tool.id) : undefined
+              }
+            />
+
+            {/* Render config dropdown if active */}
+            {activeConfigToolId === tool.id &&
+              (() => {
+                const ConfigComponent = toolRegistry.getConfigComponent(
+                  tool.id
+                );
+                return ConfigComponent ? (
+                  <ConfigComponent
+                    tool={tool}
+                    isOpen={true}
+                    onClose={() => setActiveConfigToolId(null)}
+                  />
+                ) : null;
+              })()}
+          </div>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/client/src/components/tools/attachments/index.ts b/client/src/components/tools/attachments/index.ts
new file mode 100644
index 0000000..9a632d2
--- /dev/null
+++ b/client/src/components/tools/attachments/index.ts
@@ -0,0 +1,4 @@
+export const attachmentsMetadata = {
+  icon: 'Paperclip',
+  description: 'Upload images, documents, and code files',
+};
diff --git a/client/src/components/tools/instructions/index.ts b/client/src/components/tools/instructions/index.ts
index 7330ccb..81cb4b3 100644
--- a/client/src/components/tools/instructions/index.ts
+++ b/client/src/components/tools/instructions/index.ts
@@ -2,5 +2,5 @@ export { InstructionsPanel } from './InstructionsPanel';
 
 export const instructionsMetadata = {
   icon: 'FileText',
-  description: 'Add custom instructions',
+  description: 'Add custom instructions to the current chat',
 };
diff --git a/client/src/components/ui/toast.tsx b/client/src/components/ui/toast.tsx
index 87d50d0..3b3f4cd 100644
--- a/client/src/components/ui/toast.tsx
+++ b/client/src/components/ui/toast.tsx
@@ -1,4 +1,4 @@
-import * as React from 'react';
+import { useState, useCallback, useEffect } from 'react';
 import { cn } from '@/lib/utils';
 import { X } from 'lucide-react';
 
@@ -9,7 +9,7 @@ interface ToastProps {
 }
 
 export function Toast({ message, onClose, variant = 'error' }: ToastProps) {
-  React.useEffect(() => {
+  useEffect(() => {
     const timer = setTimeout(onClose, 5000);
     return () => clearTimeout(timer);
   }, [onClose]);
@@ -37,19 +37,19 @@ export function Toast({ message, onClose, variant = 'error' }: ToastProps) {
 }
 
 export function useToast() {
-  const [toast, setToast] = React.useState<{
+  const [toast, setToast] = useState<{
     message: string;
     variant: 'error' | 'success' | 'info';
   } | null>(null);
 
-  const showToast = React.useCallback(
+  const showToast = useCallback(
     (message: string, variant: 'error' | 'success' | 'info' = 'error') => {
       setToast({ message, variant });
     },
     []
   );
 
-  const hideToast = React.useCallback(() => {
+  const hideToast = useCallback(() => {
     setToast(null);
   }, []);
 
diff --git a/client/src/hooks/useChatPersistence.ts b/client/src/hooks/useChatPersistence.ts
new file mode 100644
index 0000000..f1b9ab7
--- /dev/null
+++ b/client/src/hooks/useChatPersistence.ts
@@ -0,0 +1,41 @@
+import { useEffect, useRef } from 'react';
+import type { Chat } from '@/lib/types';
+
+interface UseChatPersistenceOptions {
+  currentChatId: string | null;
+  messages: any[];
+  saveMessages: (chatId: string, messages: any[]) => Promise<void>;
+  updateChat: (chatId: string, updates: Partial<Chat>) => Promise<void>;
+}
+
+export function useChatPersistence({
+  currentChatId,
+  messages,
+  saveMessages,
+  updateChat,
+}: UseChatPersistenceOptions) {
+  const autoTitledRef = useRef<Set<string>>(new Set());
+
+  useEffect(() => {
+    if (currentChatId && messages.length > 0) {
+      const timeoutId = setTimeout(async () => {
+        // Save messages
+        await saveMessages(currentChatId, messages);
+
+        // Auto-title if needed
+        if (!autoTitledRef.current.has(currentChatId)) {
+          const firstUserMsg = messages.find((m) => m.role === 'user');
+          if (firstUserMsg) {
+            autoTitledRef.current.add(currentChatId);
+            const title = firstUserMsg.content.trim().substring(0, 50);
+            await updateChat(currentChatId, {
+              title: title.length < 50 ? title : title + '...',
+            });
+          }
+        }
+      }, 750);
+
+      return () => clearTimeout(timeoutId);
+    }
+  }, [currentChatId, messages, saveMessages, updateChat]);
+}
diff --git a/client/src/hooks/useChatSession.ts b/client/src/hooks/useChatSession.ts
index 487dc97..c3bb0c0 100644
--- a/client/src/hooks/useChatSession.ts
+++ b/client/src/hooks/useChatSession.ts
@@ -1,7 +1,7 @@
-import { useEffect, useCallback, useRef } from 'react';
+import { useCallback } from 'react';
 import { useChat } from '@ai-sdk/react';
-import type { Message } from '@ai-sdk/react';
 import { useConfigStore } from '../store/config-store';
+import { useChatPersistence } from './useChatPersistence';
 
 export function useChatSession() {
   const {
@@ -14,11 +14,10 @@ export function useChatSession() {
     loadChat,
     saveMessages,
     updateChat,
+    pendingAttachments,
+    clearAttachments,
   } = useConfigStore();
 
-  // Track if we've auto-generated a title for this chat
-  const autoTitledRef = useRef<Set<string>>(new Set());
-
   const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
 
   // 1. Identify Workflow Tool (Target Endpoint)
@@ -31,117 +30,129 @@ export function useChatSession() {
     .map((t) => t.config.prompt)
     .join('\n\n');
 
-  // 3. Construct Dynamic Endpoint
-  const apiEndpoint = workflowTool
-    ? `${API_URL}/api/${workflowTool.endpoint}`
-    : `${API_URL}/api/chat`;
-
-  // 4. Construct Request Body
-  const requestBody = {
-    toolConfig: (workflowTool || {})?.config,
-    systemContext: systemContext,
-    provider: currentProvider,
-    model: currentModel,
-  };
+  // 3. Always use /api/chat endpoint (server routes internally based on workflowId)
+  const apiEndpoint = `${API_URL}/api/chat`;
 
   const {
     messages,
     input,
     handleInputChange,
-    handleSubmit: originalHandleSubmit,
     isLoading,
     error,
     stop,
     setMessages,
+    append,
+    setInput,
   } = useChat({
     api: apiEndpoint,
-    body: requestBody,
+    body: {
+      toolConfig: (workflowTool || {})?.config,
+      systemContext: systemContext,
+      provider: currentProvider,
+      model: currentModel,
+      attachments: pendingAttachments, // Server will attach to last user message
+      workflowId: workflowTool?.id, // Server uses this to route to workflow handler
+    },
     id: currentChatId || undefined,
   });
 
-  // Auto-save messages when they change
-  useEffect(() => {
-    if (currentChatId && messages.length > 0) {
-      const timeoutId = setTimeout(() => {
-        saveMessages(currentChatId, messages);
-
-        // Auto-generate title from first user message (once per chat)
-        if (messages.length >= 1 && !autoTitledRef.current.has(currentChatId)) {
-          const firstUserMsg = messages.find((m) => m.role === 'user');
-          if (firstUserMsg) {
-            autoTitledRef.current.add(currentChatId);
-            const title = firstUserMsg.content.trim().substring(0, 50);
-            updateChat(currentChatId, {
-              title: title.length < 50 ? title : title + '...',
-            });
-          }
-        }
-      }, 1000);
-
-      return () => clearTimeout(timeoutId);
-    }
-  }, [messages, currentChatId, saveMessages, updateChat]);
+  // Handle persistence (auto-save and auto-title)
+  useChatPersistence({
+    currentChatId,
+    messages,
+    saveMessages,
+    updateChat,
+  });
 
   // Handle new chat
   const handleNewChat = useCallback(() => {
     setMessages([]);
     setCurrentChat(null);
-  }, [setMessages, setCurrentChat, currentChatId, messages]);
+  }, [setMessages, setCurrentChat]);
 
   // Handle chat selection
   const handleSelectChat = useCallback(
     async (id: string) => {
+      // dont reload if already viewing this chat
+      if (id === currentChatId) return;
+
       const chat = await loadChat(id);
       if (!chat) {
         throw new Error('Chat not found');
       }
 
-      const loadedMessages: Message[] = chat.messages.map((msg) => ({
+      // Map DB messages to SDK format, preserving attachments
+      const loadedMessages = chat.messages.map((msg) => ({
         id: msg.id,
         role: msg.role,
         content: msg.content,
         createdAt: new Date(msg.createdAt),
+        ...(msg.attachments &&
+          msg.attachments.length > 0 && {
+            attachments: msg.attachments,
+          }),
       }));
 
       setCurrentChat(id);
-      // set messages after a delay so useChat has processed the id change
+      // Delay to allow useChat to process id change
       setTimeout(() => {
         setMessages(loadedMessages);
       }, 0);
     },
-    [loadChat, setMessages, setCurrentChat, currentChatId]
+    [loadChat, setMessages, setCurrentChat, currentChatId, messages.length]
   );
 
   // Wrap handleSubmit to create chat if needed
   const handleSubmit = useCallback(
     async (e: React.FormEvent): Promise<{ newChatId?: string }> => {
-      if (!currentChatId && input.trim()) {
+      e.preventDefault();
+
+      // Allow submission if there's either text or an attachment
+      if (!input.trim() && pendingAttachments.length < 1) return {};
+
+      let chatId = currentChatId;
+      let newChatId: string | undefined;
+
+      // Create chat if this is the first message
+      if (!chatId) {
         const newChat = await createChat('New Chat');
-        setCurrentChat(newChat.id);
-        autoTitledRef.current.delete(newChat.id);
-
-        // Save initial user message before submitting
-        const userMessage = {
-          id: crypto.randomUUID(),
-          role: 'user' as const,
-          content: input,
-          createdAt: new Date().toISOString(),
-        };
-        await saveMessages(newChat.id, [userMessage]);
-
-        // Submit the message (adds to useChat state and starts API call)
-        originalHandleSubmit(e);
-
-        return { newChatId: newChat.id };
+        chatId = newChat.id;
+        newChatId = newChat.id;
+        setCurrentChat(chatId);
       }
-      originalHandleSubmit(e);
-      return {};
+
+      // Construct complete user message with attachments
+      const userMessage = {
+        role: 'user' as const,
+        content: input,
+        ...(pendingAttachments.length > 0 && {
+          attachments: [...pendingAttachments],
+        }),
+      };
+
+      // Append triggers API call with complete message
+      await append(userMessage);
+
+      // Clear input and attachments after successful append
+      setInput('');
+      clearAttachments();
+
+      return { newChatId };
     },
-    [currentChatId, input, createChat, setCurrentChat, saveMessages, originalHandleSubmit]
+    [
+      input,
+      currentChatId,
+      pendingAttachments,
+      createChat,
+      setCurrentChat,
+      append,
+      setInput,
+      clearAttachments,
+    ]
   );
 
   return {
-    // From useChat
+    // From useChat (attachments naturally included)
     messages,
     input,
     handleInputChange,
@@ -156,6 +167,5 @@ export function useChatSession() {
 
     // Computed values (for debugging/reference)
     apiEndpoint,
-    requestBody,
   };
 }
diff --git a/client/src/hooks/useFileUpload.ts b/client/src/hooks/useFileUpload.ts
new file mode 100644
index 0000000..b3e5079
--- /dev/null
+++ b/client/src/hooks/useFileUpload.ts
@@ -0,0 +1,60 @@
+import { useState } from 'react';
+import { useConfigStore } from '@/store/config-store';
+import type { Attachment } from '@/lib/types';
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
+
+export function useFileUpload(chatId: string | null) {
+  const [isUploading, setIsUploading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const addAttachment = useConfigStore((state) => state.addAttachment);
+
+  const uploadFile = async (file: File): Promise<Attachment | null> => {
+    setIsUploading(true);
+    setError(null);
+
+    try {
+      const formData = new FormData();
+      // IMPORTANT: Append chatId BEFORE file so it's available in multer's destination callback
+      if (chatId) {
+        formData.append('chatId', chatId);
+      }
+      formData.append('file', file);
+
+      const response = await fetch(`${API_URL}/api/uploads`, {
+        method: 'POST',
+        body: formData,
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json();
+        throw new Error(errorData.error || 'Upload failed');
+      }
+
+      const attachment: Attachment = await response.json();
+      addAttachment(attachment);
+      return attachment;
+    } catch (err) {
+      const errorMessage = err instanceof Error ? err.message : 'Upload failed';
+      setError(errorMessage);
+      return null;
+    } finally {
+      setIsUploading(false);
+    }
+  };
+
+  const uploadFiles = async (files: FileList): Promise<Attachment[]> => {
+    const uploads = Array.from(files).map((file) => uploadFile(file));
+    const results = await Promise.all(uploads);
+    return results.filter(
+      (attachment): attachment is Attachment => attachment !== null
+    );
+  };
+
+  return {
+    uploadFile,
+    uploadFiles,
+    isUploading,
+    error,
+  };
+}
diff --git a/client/src/lib/icon-utils.ts b/client/src/lib/icon-utils.ts
index 33f3638..d130196 100644
--- a/client/src/lib/icon-utils.ts
+++ b/client/src/lib/icon-utils.ts
@@ -4,6 +4,7 @@ import {
   Settings,
   Plus,
   X,
+  Paperclip,
   type LucideIcon,
 } from 'lucide-react';
 
@@ -13,6 +14,7 @@ const iconMap: Record<string, LucideIcon> = {
   Settings,
   Plus,
   X,
+  Paperclip,
 };
 
 export function getIconComponent(iconName: string): LucideIcon {
diff --git a/client/src/lib/types.ts b/client/src/lib/types.ts
index e319ca0..23395ec 100644
--- a/client/src/lib/types.ts
+++ b/client/src/lib/types.ts
@@ -48,11 +48,22 @@ export type ToolPillComponent = React.ComponentType<ToolPillProps>;
 export type ToolPanelComponent = React.ComponentType<ToolPanelProps>;
 export type ToolConfigComponent = React.ComponentType<ToolConfigProps>;
 
+export interface Attachment {
+  id: string;
+  name: string;
+  path: string; // Relative path from data/uploads/
+  mimeType: string;
+  size: number;
+  createdAt: string;
+  extractedText?: string; // For PDFs/docs
+}
+
 export interface ChatMessage {
   id: string;
   role: 'system' | 'user' | 'assistant' | 'data';
   content: string;
   createdAt: string;
+  attachments?: Attachment[];
 }
 
 export interface Chat {
@@ -84,6 +95,9 @@ export interface ConfigState {
   chats: ChatListItem[];
   currentChatId: string | null;
 
+  // Attachment state (transient, per-message)
+  pendingAttachments: Attachment[];
+
   setProvider: (provider: string) => void;
   setModel: (model: string) => void;
   setAvailableModels: (models: AvailableModels) => void;
@@ -111,4 +125,9 @@ export interface ConfigState {
   deleteChat: (id: string) => Promise<void>;
   setCurrentChat: (id: string | null) => void;
   saveMessages: (chatId: string, messages: any[]) => Promise<void>;
+
+  // Attachment methods
+  addAttachment: (attachment: Attachment) => void;
+  removeAttachment: (id: string) => void;
+  clearAttachments: () => void;
 }
diff --git a/client/src/store/config-store.ts b/client/src/store/config-store.ts
index 92d1d3b..ddd448b 100644
--- a/client/src/store/config-store.ts
+++ b/client/src/store/config-store.ts
@@ -11,6 +11,7 @@ export const useConfigStore = create<ConfigState>((set, get) => ({
   tools: [],
   chats: [],
   currentChatId: null,
+  pendingAttachments: [],
 
   setProvider: (provider) => {
     set({ currentProvider: provider });
@@ -241,6 +242,7 @@ export const useConfigStore = create<ConfigState>((set, get) => ({
         role: msg.role,
         content: msg.content,
         createdAt: msg.createdAt?.toISOString?.() || new Date().toISOString(),
+        attachments: msg.attachments,
       }));
 
       await get().updateChat(chatId, { messages: chatMessages });
@@ -248,4 +250,21 @@ export const useConfigStore = create<ConfigState>((set, get) => ({
       console.error('Failed to save messages:', error);
     }
   },
+
+  // Attachment methods
+  addAttachment: (attachment) => {
+    set((state) => ({
+      pendingAttachments: [...state.pendingAttachments, attachment],
+    }));
+  },
+
+  removeAttachment: (id) => {
+    set((state) => ({
+      pendingAttachments: state.pendingAttachments.filter((a) => a.id !== id),
+    }));
+  },
+
+  clearAttachments: () => {
+    set({ pendingAttachments: [] });
+  },
 }));
diff --git a/package-lock.json b/package-lock.json
index c520e2c..f996fb3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -958,6 +958,190 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@napi-rs/canvas": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas/-/canvas-0.1.80.tgz",
+      "integrity": "sha512-DxuT1ClnIPts1kQx8FBmkk4BQDTfI5kIzywAaMjQSXfNnra5UFU9PwurXrl+Je3bJ6BGsp/zmshVVFbCmyI+ww==",
+      "license": "MIT",
+      "workspaces": [
+        "e2e/*"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "optionalDependencies": {
+        "@napi-rs/canvas-android-arm64": "0.1.80",
+        "@napi-rs/canvas-darwin-arm64": "0.1.80",
+        "@napi-rs/canvas-darwin-x64": "0.1.80",
+        "@napi-rs/canvas-linux-arm-gnueabihf": "0.1.80",
+        "@napi-rs/canvas-linux-arm64-gnu": "0.1.80",
+        "@napi-rs/canvas-linux-arm64-musl": "0.1.80",
+        "@napi-rs/canvas-linux-riscv64-gnu": "0.1.80",
+        "@napi-rs/canvas-linux-x64-gnu": "0.1.80",
+        "@napi-rs/canvas-linux-x64-musl": "0.1.80",
+        "@napi-rs/canvas-win32-x64-msvc": "0.1.80"
+      }
+    },
+    "node_modules/@napi-rs/canvas-android-arm64": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-android-arm64/-/canvas-android-arm64-0.1.80.tgz",
+      "integrity": "sha512-sk7xhN/MoXeuExlggf91pNziBxLPVUqF2CAVnB57KLG/pz7+U5TKG8eXdc3pm0d7Od0WreB6ZKLj37sX9muGOQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-darwin-arm64": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-arm64/-/canvas-darwin-arm64-0.1.80.tgz",
+      "integrity": "sha512-O64APRTXRUiAz0P8gErkfEr3lipLJgM6pjATwavZ22ebhjYl/SUbpgM0xcWPQBNMP1n29afAC/Us5PX1vg+JNQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-darwin-x64": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-x64/-/canvas-darwin-x64-0.1.80.tgz",
+      "integrity": "sha512-FqqSU7qFce0Cp3pwnTjVkKjjOtxMqRe6lmINxpIZYaZNnVI0H5FtsaraZJ36SiTHNjZlUB69/HhxNDT1Aaa9vA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm-gnueabihf": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm-gnueabihf/-/canvas-linux-arm-gnueabihf-0.1.80.tgz",
+      "integrity": "sha512-eyWz0ddBDQc7/JbAtY4OtZ5SpK8tR4JsCYEZjCE3dI8pqoWUC8oMwYSBGCYfsx2w47cQgQCgMVRVTFiiO38hHQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm64-gnu": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-gnu/-/canvas-linux-arm64-gnu-0.1.80.tgz",
+      "integrity": "sha512-qwA63t8A86bnxhuA/GwOkK3jvb+XTQaTiVML0vAWoHyoZYTjNs7BzoOONDgTnNtr8/yHrq64XXzUoLqDzU+Uuw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm64-musl": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-musl/-/canvas-linux-arm64-musl-0.1.80.tgz",
+      "integrity": "sha512-1XbCOz/ymhj24lFaIXtWnwv/6eFHXDrjP0jYkc6iHQ9q8oXKzUX1Lc6bu+wuGiLhGh2GS/2JlfORC5ZcXimRcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-riscv64-gnu": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-riscv64-gnu/-/canvas-linux-riscv64-gnu-0.1.80.tgz",
+      "integrity": "sha512-XTzR125w5ZMs0lJcxRlS1K3P5RaZ9RmUsPtd1uGt+EfDyYMu4c6SEROYsxyatbbu/2+lPe7MPHOO/0a0x7L/gw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-x64-gnu": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-0.1.80.tgz",
+      "integrity": "sha512-BeXAmhKg1kX3UCrJsYbdQd3hIMDH/K6HnP/pG2LuITaXhXBiNdh//TVVVVCBbJzVQaV5gK/4ZOCMrQW9mvuTqA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-x64-musl": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-musl/-/canvas-linux-x64-musl-0.1.80.tgz",
+      "integrity": "sha512-x0XvZWdHbkgdgucJsRxprX/4o4sEed7qo9rCQA9ugiS9qE2QvP0RIiEugtZhfLH3cyI+jIRFJHV4Fuz+1BHHMg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/canvas-win32-x64-msvc": {
+      "version": "0.1.80",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-x64-msvc/-/canvas-win32-x64-msvc-0.1.80.tgz",
+      "integrity": "sha512-Z8jPsM6df5V8B1HrCHB05+bDiCxjE9QA//3YrkKIdVDEwn5RKaqOxCJDRJkl48cJbylcrJbW4HxZbTte8juuPg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@noble/hashes": {
       "version": "1.8.0",
       "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
@@ -1415,7 +1599,6 @@
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
       "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/connect": "*",
@@ -1437,7 +1620,6 @@
       "version": "3.4.38",
       "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
       "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1501,7 +1683,6 @@
       "version": "4.17.25",
       "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz",
       "integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
@@ -1514,7 +1695,6 @@
       "version": "4.19.7",
       "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.7.tgz",
       "integrity": "sha512-FvPtiIf1LfhzsaIXhv/PHan/2FeQBbtBDtfX2QfvPxdUelMDEckK08SM6nqo1MIZY3RUlfA+HV8+hFUSio78qg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -1536,7 +1716,6 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
       "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/mdast": {
@@ -1559,7 +1738,6 @@
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
       "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/ms": {
@@ -1568,11 +1746,19 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/multer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@types/multer/-/multer-2.0.0.tgz",
+      "integrity": "sha512-C3Z9v9Evij2yST3RSBktxP9STm6OdMc5uR1xF1SGr98uv8dUlAL2hqwrZ3GVB3uyMyiegnscEK6PGtYvNrjTjw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/express": "*"
+      }
+    },
     "node_modules/@types/node": {
       "version": "20.19.25",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.25.tgz",
       "integrity": "sha512-ZsJzA5thDQMSQO788d7IocwwQbI8B5OPzmqNvpf3NY/+MHDAS759Wo0gd2WQeXYt5AAAQjzcrTVC6SKCuYgoCQ==",
-      "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -1589,14 +1775,12 @@
       "version": "6.14.0",
       "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.14.0.tgz",
       "integrity": "sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
       "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/react": {
@@ -1634,7 +1818,6 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
       "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1644,7 +1827,6 @@
       "version": "1.15.10",
       "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.10.tgz",
       "integrity": "sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/http-errors": "*",
@@ -1656,7 +1838,6 @@
       "version": "0.17.6",
       "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.6.tgz",
       "integrity": "sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mime": "^1",
@@ -1887,6 +2068,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/append-field": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/append-field/-/append-field-1.0.0.tgz",
+      "integrity": "sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==",
+      "license": "MIT"
+    },
     "node_modules/arg": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
@@ -2082,6 +2269,23 @@
         "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
       }
     },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "license": "MIT"
+    },
+    "node_modules/busboy": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
+      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+      "dependencies": {
+        "streamsearch": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -2329,6 +2533,21 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/concat-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-2.0.0.tgz",
+      "integrity": "sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==",
+      "engines": [
+        "node >= 6.0"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.0.2",
+        "typedarray": "^0.0.6"
+      }
+    },
     "node_modules/content-disposition": {
       "version": "0.5.4",
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
@@ -4557,6 +4776,27 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/mkdirp": {
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+      "license": "MIT",
+      "dependencies": {
+        "minimist": "^1.2.6"
+      },
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      }
+    },
     "node_modules/mrmime": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
@@ -4573,6 +4813,24 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/multer": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.0.2.tgz",
+      "integrity": "sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==",
+      "license": "MIT",
+      "dependencies": {
+        "append-field": "^1.0.0",
+        "busboy": "^1.6.0",
+        "concat-stream": "^2.0.0",
+        "mkdirp": "^0.5.6",
+        "object-assign": "^4.1.1",
+        "type-is": "^1.6.18",
+        "xtend": "^4.0.2"
+      },
+      "engines": {
+        "node": ">= 10.16.0"
+      }
+    },
     "node_modules/mz": {
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
@@ -4757,6 +5015,38 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/pdf-parse": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/pdf-parse/-/pdf-parse-2.4.5.tgz",
+      "integrity": "sha512-mHU89HGh7v+4u2ubfnevJ03lmPgQ5WU4CxAVmTSh/sxVTEDYd1er/dKS/A6vg77NX47KTEoihq8jZBLr8Cxuwg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@napi-rs/canvas": "0.1.80",
+        "pdfjs-dist": "5.4.296"
+      },
+      "bin": {
+        "pdf-parse": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": ">=20.16.0 <21 || >=22.3.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/mehmet-kozan"
+      }
+    },
+    "node_modules/pdfjs-dist": {
+      "version": "5.4.296",
+      "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-5.4.296.tgz",
+      "integrity": "sha512-DlOzet0HO7OEnmUmB6wWGJrrdvbyJKftI1bhMitK7O2N8W2gc757yyYBbINy9IDafXAV9wmKr9t7xsTaNKRG5Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=20.16.0 || >=22.3.0"
+      },
+      "optionalDependencies": {
+        "@napi-rs/canvas": "^0.1.80"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -5176,6 +5466,20 @@
         "pify": "^2.3.0"
       }
     },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -5841,6 +6145,23 @@
         "url": "https://github.com/sponsors/typicode"
       }
     },
+    "node_modules/streamsearch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
+      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/stringify-entities": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
@@ -6222,6 +6543,12 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/typedarray": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
+      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
+      "license": "MIT"
+    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
@@ -6240,7 +6567,6 @@
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/unified": {
@@ -6383,7 +6709,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/utils-merge": {
@@ -7724,11 +8049,14 @@
         "@ai-sdk/anthropic": "^1.2.12",
         "@ai-sdk/google": "^1.2.22",
         "@ai-sdk/openai": "^1.3.24",
+        "@types/multer": "^2.0.0",
         "ai": "^4.3.16",
         "cors": "^2.8.5",
         "dotenv": "^16.3.1",
         "express": "^4.22.1",
         "lowdb": "^7.0.1",
+        "multer": "^2.0.2",
+        "pdf-parse": "^2.4.5",
         "zod": "^3.23.8"
       },
       "devDependencies": {
diff --git a/server/package.json b/server/package.json
index 930f8f6..32da224 100644
--- a/server/package.json
+++ b/server/package.json
@@ -15,11 +15,14 @@
     "@ai-sdk/anthropic": "^1.2.12",
     "@ai-sdk/google": "^1.2.22",
     "@ai-sdk/openai": "^1.3.24",
+    "@types/multer": "^2.0.0",
     "ai": "^4.3.16",
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.22.1",
     "lowdb": "^7.0.1",
+    "multer": "^2.0.2",
+    "pdf-parse": "^2.4.5",
     "zod": "^3.23.8"
   },
   "devDependencies": {
diff --git a/server/src/db/chats.ts b/server/src/db/chats.ts
index a9fe8de..56b2b39 100644
--- a/server/src/db/chats.ts
+++ b/server/src/db/chats.ts
@@ -1,5 +1,11 @@
 import type { Chat } from '../types.js';
 import { db } from './core.js';
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const UPLOADS_BASE = path.join(__dirname, '../../data/uploads');
 
 export async function getChats() {
   return db.data.chats || [];
@@ -28,6 +34,14 @@ export async function updateChat(id: string, updates: Partial<Chat>) {
 export async function deleteChat(id: string) {
   const index = db.data.chats.findIndex((chat) => chat.id === id);
   if (index !== -1) {
+    // Delete associated files
+    const chatUploadDir = path.join(UPLOADS_BASE, id);
+    try {
+      await fs.rm(chatUploadDir, { recursive: true, force: true });
+    } catch (error) {
+      console.warn(`Failed to delete files for chat ${id}:`, error);
+    }
+
     db.data.chats.splice(index, 1);
     await db.write();
     return true;
diff --git a/server/src/index.ts b/server/src/index.ts
index 43bb56a..6f55575 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -2,8 +2,16 @@ import express from 'express';
 import cors from 'cors';
 import { streamText } from 'ai';
 import { config, validateProviderConfig } from './config.js';
-import { getProvider, AVAILABLE_MODELS } from './providers.js';
+import {
+  getProvider,
+  AVAILABLE_MODELS,
+  getModelCapabilities,
+} from './providers.js';
 import type { ChatRequest } from './types.js';
+import {
+  convertMessagesForAI,
+  validateMessageAttachments,
+} from './lib/message-converter.js';
 import {
   initializeDatabase,
   getConfig,
@@ -11,8 +19,11 @@ import {
   getTools,
   updateTools,
 } from './db/index.js';
+import { getWorkflowHandler } from './lib/workflow-router.js';
 import { handleConsensusChat } from './workflows/consensus.js';
+import './workflows/consensus.js'; // Import to trigger workflow registration
 import chatsRouter from './routes/chats.js';
+import uploadsRouter from './routes/uploads.js';
 
 export const app = express();
 
@@ -78,11 +89,21 @@ app.post('/api/config', async (req, res) => {
 // Mount chat routes
 app.use('/api/chats', chatsRouter);
 
+// Mount uploads routes
+app.use('/api/uploads', uploadsRouter);
+
 // Main chat endpoint with streaming
 app.post('/api/chat', async (req, res) => {
   try {
-    const { provider, model, messages, systemContext } =
-      req.body as ChatRequest;
+    const {
+      provider,
+      model,
+      messages,
+      systemContext,
+      attachments,
+      toolConfig,
+      workflowId,
+    } = req.body as ChatRequest;
 
     // Validation
     if (!provider || !model || !messages) {
@@ -99,15 +120,56 @@ app.post('/api/chat', async (req, res) => {
       return;
     }
 
-    // Get provider instance
-    const providerInstance = getProvider(provider, model);
+    // Attach pending attachments to last user message
+    if (attachments && attachments.length > 0) {
+      // Find last user message
+      for (let i = messages.length - 1; i >= 0; i--) {
+        if (messages[i].role === 'user') {
+          messages[i].attachments = attachments;
+          break;
+        }
+      }
+    }
+
+    // Check model capabilities for attachments
+    const capabilities = getModelCapabilities(provider, model);
+    for (const message of messages) {
+      const validation = validateMessageAttachments(
+        message,
+        capabilities.supportsVision
+      );
+      if (!validation.valid) {
+        res.status(400).json({ error: validation.error });
+        return;
+      }
+    }
+
+    // incorporate attachment content (if any) in messages
+    const multimodalMessages = await convertMessagesForAI(messages);
+
+    // Check for workflow handler
+    const workflowHandler = getWorkflowHandler(workflowId);
+
+    let result;
 
-    // Stream response using Vercel AI SDK
-    const result = await streamText({
-      model: providerInstance,
-      messages: messages,
-      ...(systemContext && { system: systemContext }),
-    });
+    if (workflowHandler) {
+      result = await workflowHandler({
+        messages: multimodalMessages,
+        toolConfig: toolConfig || {},
+        systemContext,
+        provider,
+        model,
+      });
+    } else {
+      // Standard chat flow
+      const providerInstance = getProvider(provider, model);
+
+      result = await streamText({
+        model: providerInstance,
+        messages: multimodalMessages as any,
+        ...(systemContext && { system: systemContext }),
+      });
+    }
 
     // Use Vercel Data Stream Protocol (compatible with useChat hook)
     result.pipeDataStreamToResponse(res);
diff --git a/server/src/lib/message-converter.ts b/server/src/lib/message-converter.ts
new file mode 100644
index 0000000..df0cd0c
--- /dev/null
+++ b/server/src/lib/message-converter.ts
@@ -0,0 +1,103 @@
+import type {
+  Message,
+  ChatMessage,
+  MultimodalMessage,
+  MessagePart,
+  Attachment,
+} from '../types.js';
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const UPLOADS_BASE = path.join(__dirname, '../../data/uploads');
+
+type MessageWithAttachments = Message | ChatMessage;
+
+export async function convertToMultimodalMessage(
+  message: MessageWithAttachments
+): Promise<MultimodalMessage> {
+  // No attachments - return simple format
+  if (!message.attachments || message.attachments.length === 0) {
+    return {
+      role: message.role as 'user' | 'assistant' | 'system',
+      content: message.content,
+    };
+  }
+
+  // Has attachments - build parts array
+  const parts: MessagePart[] = [];
+
+  // Add text content if present
+  if (message.content.trim()) {
+    parts.push({
+      type: 'text',
+      text: message.content,
+    });
+  }
+
+  // Add attachments
+  for (const attachment of message.attachments) {
+    const filePath = path.join(UPLOADS_BASE, attachment.path);
+
+    if (attachment.mimeType.startsWith('image/')) {
+      // Read image and convert to base64 data URL
+      try {
+        const imageBuffer = await fs.readFile(filePath);
+        const base64 = imageBuffer.toString('base64');
+        const dataUrl = `data:${attachment.mimeType};base64,${base64}`;
+
+        parts.push({
+          type: 'image',
+          image: dataUrl,
+        });
+      } catch (error) {
+        console.error(`Failed to read image file ${filePath}:`, error);
+        // Add error message as text
+        parts.push({
+          type: 'text',
+          text: `[Error loading image: ${attachment.name}]`,
+        });
+      }
+    } else if (attachment.extractedText) {
+      // For documents with extracted text
+      parts.push({
+        type: 'text',
+        text: `[${attachment.name}]\n${attachment.extractedText}`,
+      });
+    }
+  }
+
+  return {
+    role: message.role as 'user' | 'assistant' | 'system',
+    content: parts,
+  };
+}
+
+export async function convertMessagesForAI(
+  messages: MessageWithAttachments[]
+): Promise<MultimodalMessage[]> {
+  return Promise.all(messages.map(convertToMultimodalMessage));
+}
+
+// Validate if model supports attachments in message
+export function validateMessageAttachments(
+  message: MessageWithAttachments,
+  supportsVision: boolean
+): { valid: boolean; error?: string } {
+  if (!message.attachments || message.attachments.length === 0) {
+    return { valid: true };
+  }
+
+  for (const attachment of message.attachments) {
+    if (attachment.mimeType.startsWith('image/') && !supportsVision) {
+      return {
+        valid: false,
+        error: `Model does not support image attachments. Please select a vision-capable model.`,
+      };
+    }
+    // Note: Document attachments (PDF, TXT, MD, code files) are converted to text
+  }
+
+  return { valid: true };
+}
diff --git a/server/src/lib/workflow-router.ts b/server/src/lib/workflow-router.ts
new file mode 100644
index 0000000..ef2d792
--- /dev/null
+++ b/server/src/lib/workflow-router.ts
@@ -0,0 +1,25 @@
+import { StreamTextResult } from 'ai';
+
+// Workflow handler function signature
+// Note: messages are pre-converted to multimodal format by the router
+export type WorkflowHandler = (params: {
+  messages: any[];  // Already converted via convertMessagesForAI()
+  toolConfig: Record<string, unknown>;
+  systemContext?: string;
+  provider: string;
+  model: string;
+}) => Promise<StreamTextResult<any, any>>;
+
+// Workflow registry
+const workflowRegistry = new Map<string, WorkflowHandler>();
+
+// Register a workflow handler
+export function registerWorkflow(id: string, handler: WorkflowHandler): void {
+  workflowRegistry.set(id, handler);
+}
+
+// Get workflow handler by ID
+export function getWorkflowHandler(workflowId?: string): WorkflowHandler | null {
+  if (!workflowId) return null;
+  return workflowRegistry.get(workflowId) || null;
+}
diff --git a/server/src/providers.ts b/server/src/providers.ts
index 1a5eef6..4ae5f7b 100644
--- a/server/src/providers.ts
+++ b/server/src/providers.ts
@@ -44,3 +44,80 @@ export const AVAILABLE_MODELS = {
     'gemini-2.5-flash-lite',
   ],
 };
+
+export interface ModelCapabilities {
+  supportsVision: boolean;
+  maxFileSize: number; // in bytes
+}
+
+export const MODEL_CAPABILITIES: Record<
+  string,
+  Record<string, ModelCapabilities>
+> = {
+  openai: {
+    'gpt-5.1': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+    'gpt-5-mini': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+    'gpt-4.1': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+    'gpt-4.1-mini': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+  },
+  anthropic: {
+    'claude-opus-4-5': {
+      supportsVision: true,
+      maxFileSize: 10_000_000,
+    },
+    'claude-opus-4-1': {
+      supportsVision: true,
+      maxFileSize: 10_000_000,
+    },
+    'claude-sonnet-4': {
+      supportsVision: true,
+      maxFileSize: 10_000_000,
+    },
+    'claude-haiku-4-5': {
+      supportsVision: true,
+      maxFileSize: 10_000_000,
+    },
+  },
+  google: {
+    'gemini-3-pro-preview': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+    'gemini-2.5-pro': {
+      supportsVision: true,
+      maxFileSize: 20_000_000,
+    },
+    'gemini-2.5-flash': {
+      supportsVision: true,
+      maxFileSize: 10_000_000,
+    },
+    'gemini-2.5-flash-lite': {
+      supportsVision: false,
+      maxFileSize: 0,
+    },
+  },
+};
+
+export function getModelCapabilities(
+  provider: string,
+  model: string
+): ModelCapabilities {
+  return (
+    MODEL_CAPABILITIES[provider]?.[model] || {
+      supportsVision: false,
+      maxFileSize: 0,
+    }
+  );
+}
diff --git a/server/src/routes/uploads.ts b/server/src/routes/uploads.ts
new file mode 100644
index 0000000..3233ea7
--- /dev/null
+++ b/server/src/routes/uploads.ts
@@ -0,0 +1,149 @@
+import { Router } from 'express';
+import multer from 'multer';
+import path from 'path';
+import fs from 'fs/promises';
+import { fileURLToPath } from 'url';
+import crypto from 'crypto';
+import { createRequire } from 'module';
+import type { Attachment } from '../types.js';
+
+const require = createRequire(import.meta.url);
+const pdfParse = require('pdf-parse');
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const UPLOADS_BASE = path.join(__dirname, '../../data/uploads');
+
+// Ensure uploads directory exists
+await fs.mkdir(UPLOADS_BASE, { recursive: true });
+
+// Configure multer for file uploads
+const storage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const chatId = req.body.chatId || 'temp';
+    const chatDir = path.join(UPLOADS_BASE, chatId);
+    await fs.mkdir(chatDir, { recursive: true });
+    cb(null, chatDir);
+  },
+  filename: (req, file, cb) => {
+    const uniqueSuffix = `${Date.now()}-${crypto.randomUUID()}`;
+    const ext = path.extname(file.originalname);
+    cb(null, `${uniqueSuffix}${ext}`);
+  },
+});
+
+const upload = multer({
+  storage,
+  limits: {
+    fileSize: 20_000_000, // 20MB max
+  },
+  fileFilter: (req, file, cb) => {
+    const allowedTypes = [
+      'image/png',
+      'image/jpeg',
+      'image/gif',
+      'image/webp',
+      // 'image/svg+xml',
+      'application/pdf',
+      'text/plain',
+      'text/markdown',
+      'text/javascript',
+      'application/javascript',
+      'text/x-javascript',
+      'application/x-javascript',
+      'text/typescript',
+      'application/x-typescript',
+      'application/json',
+    ];
+
+    if (allowedTypes.includes(file.mimetype)) {
+      cb(null, true);
+    } else {
+      cb(new Error(`File type ${file.mimetype} not supported`));
+    }
+  },
+});
+
+const router = Router();
+
+// Upload single file
+router.post('/', upload.single('file'), async (req, res) => {
+  try {
+    if (!req.file) {
+      res.status(400).json({ error: 'No file uploaded' });
+      return;
+    }
+
+    const chatId = req.body.chatId || 'temp';
+    const relativePath = `${chatId}/${req.file.filename}`;
+
+    // Extract text for documents if needed
+    let extractedText: string | undefined;
+
+    if (req.file.mimetype === 'application/pdf') {
+      // Extract text from PDFs
+      try {
+        const dataBuffer = await fs.readFile(req.file.path);
+        const pdfData = await pdfParse(dataBuffer);
+        extractedText = pdfData.text;
+      } catch (error) {
+        console.warn('PDF text extraction failed:', error);
+        // Continue without extracted text
+      }
+    } else if (
+      req.file.mimetype.startsWith('text/') ||
+      req.file.mimetype.includes('javascript') ||
+      req.file.mimetype.includes('typescript') ||
+      req.file.mimetype === 'application/json' ||
+      req.file.mimetype === 'application/xml'
+    ) {
+      // Extract text from all text-based files (text/*, code files, json, xml)
+      try {
+        extractedText = await fs.readFile(req.file.path, 'utf-8');
+      } catch (error) {
+        console.warn('Text extraction failed:', error);
+      }
+    }
+
+    const attachment: Attachment = {
+      id: crypto.randomUUID(),
+      name: req.file.originalname,
+      path: relativePath,
+      mimeType: req.file.mimetype,
+      size: req.file.size,
+      createdAt: new Date().toISOString(),
+      extractedText,
+    };
+
+    res.json(attachment);
+  } catch (error) {
+    console.error('Upload error:', error);
+    res.status(500).json({
+      error: error instanceof Error ? error.message : 'Upload failed',
+    });
+  }
+});
+
+// Get file (serve uploaded files)
+router.get('/:chatId/:filename', async (req, res) => {
+  try {
+    const filePath = path.join(
+      UPLOADS_BASE,
+      req.params.chatId,
+      req.params.filename
+    );
+
+    // Security check: ensure path is within uploads directory
+    const normalizedPath = path.normalize(filePath);
+    if (!normalizedPath.startsWith(UPLOADS_BASE)) {
+      res.status(403).json({ error: 'Access denied' });
+      return;
+    }
+
+    await fs.access(filePath); // Check if file exists
+    res.sendFile(filePath);
+  } catch (error) {
+    res.status(404).json({ error: 'File not found' });
+  }
+});
+
+export default router;
diff --git a/server/src/types.ts b/server/src/types.ts
index c074a1d..f7cbd27 100644
--- a/server/src/types.ts
+++ b/server/src/types.ts
@@ -1,6 +1,7 @@
 export interface Message {
   role: 'user' | 'assistant' | 'system';
   content: string;
+  attachments?: Attachment[];
 }
 
 export interface ChatRequest {
@@ -9,6 +10,8 @@ export interface ChatRequest {
   messages: Message[];
   systemContext?: string;
   toolConfig?: Record<string, unknown>;
+  attachments?: Attachment[]; // Pending attachments for the last user message
+  workflowId?: string; // workflow identifier for routing
 }
 
 export interface Tool {
@@ -19,11 +22,22 @@ export interface Tool {
   endpoint?: string; // Relative path from API base (e.g., 'workflow/consensus')
 }
 
+export interface Attachment {
+  id: string;
+  name: string;
+  path: string; // Relative path from data/uploads/
+  mimeType: string;
+  size: number;
+  createdAt: string;
+  extractedText?: string; // For PDFs/docs
+}
+
 export interface ChatMessage {
   id: string;
   role: 'system' | 'user' | 'assistant' | 'data';
   content: string;
   createdAt: string;
+  attachments?: Attachment[];
 }
 
 export interface Chat {
@@ -41,3 +55,16 @@ export interface ProviderConfig {
   apiKey?: string;
   baseURL?: string;
 }
+
+export interface MessagePart {
+  type: 'text' | 'image' | 'file';
+  text?: string;
+  image?: string; // data URL or base64
+  mimeType?: string;
+  data?: string; // For file content
+}
+
+export interface MultimodalMessage {
+  role: 'user' | 'assistant' | 'system';
+  content: string | MessagePart[];
+}
diff --git a/server/src/workflows/consensus.ts b/server/src/workflows/consensus.ts
index 0ecee1d..1082727 100644
--- a/server/src/workflows/consensus.ts
+++ b/server/src/workflows/consensus.ts
@@ -1,5 +1,9 @@
 import { streamText } from 'ai';
 import { getProvider } from '../providers.js';
+import {
+  registerWorkflow,
+  type WorkflowHandler,
+} from '../lib/workflow-router.js';
 import type { Message, ChatRequest } from '../types.js';
 import type { Request, Response } from 'express';
 
@@ -33,89 +37,81 @@ async function queryModel(
 }
 
 /**
- * Handle consensus chat requests:
+ * Execute consensus workflow:
  * 1. Query multiple models in parallel
  * 2. Synthesize responses using one of the models
- * 3. Stream synthesized response back to client
+ * 3. Return streaming result
+ * Note: Messages are already converted to multimodal format by the router
  */
-export async function handleConsensusChat(req: Request, res: Response) {
-  try {
-    const { messages, toolConfig, systemContext, provider, model } =
-      req.body as ChatRequest;
-
-    // Extract models from tool config
-    const models = (toolConfig?.models as ModelConfig[]) || [];
-
-    // Validation
-    if (!messages || models.length < 2) {
-      res.status(400).json({
-        error:
-          'Missing required fields or insufficient models (minimum 2 required)',
-      });
-      return;
-    }
-
-    if (!provider || !model) {
-      res.status(400).json({
-        error: 'Missing synthesizer provider or model',
-      });
-      return;
-    }
+export async function executeConsensusWorkflow(params: {
+  messages: any[];
+  toolConfig: Record<string, unknown>;
+  systemContext?: string;
+  provider: string;
+  model: string;
+}) {
+  const { messages, toolConfig, systemContext, provider, model } = params;
 
-    // Prepend system context if provided
-    let finalMessages = messages;
-    if (systemContext) {
-      finalMessages = [{ role: 'system', content: systemContext }, ...messages];
-    }
+  // Extract models from tool config
+  const models = (toolConfig?.models as ModelConfig[]) || [];
 
-    console.log(
-      `Consensus query with ${models.length} models:`,
-      models.map((m) => `${m.provider}:${m.model}`).join(', ')
+  // Validation
+  if (!messages || models.length < 2) {
+    throw new Error(
+      'Missing required fields or insufficient models (minimum 2 required)'
     );
+  }
 
-    // 1. Query all selected models in parallel (with system context)
-    const queries = models.map(({ provider, model }) =>
-      queryModel(provider, model, finalMessages)
-    );
+  if (!provider || !model) {
+    throw new Error('Missing synthesizer provider or model');
+  }
 
-    const results = await Promise.allSettled(queries);
-
-    // 2. Extract successful responses
-    const responses = results
-      .map((result, index) => {
-        if (result.status === 'fulfilled') {
-          return {
-            provider: models[index].provider,
-            model: models[index].model,
-            content: result.value,
-          };
-        } else {
-          console.error(
-            `Model ${models[index].provider}:${models[index].model} failed:`,
-            result.reason
-          );
-          return null;
-        }
-      })
-      .filter((r) => r !== null);
-
-    // 3. Handle failures gracefully
-    if (responses.length === 0) {
-      res.status(500).json({
-        error: 'All models failed to respond',
-      });
-      return;
-    }
+  // Prepend system context if provided
+  let finalMessages = messages;
+  if (systemContext) {
+    finalMessages = [{ role: 'system', content: systemContext }, ...messages];
+  }
 
-    console.log(`${responses.length} models responded successfully`);
+  // 1. Query all selected models in parallel (with system context)
+  const queries = models.map(({ provider, model }) =>
+    queryModel(provider, model, finalMessages)
+  );
+
+  const results = await Promise.allSettled(queries);
+
+  // 2. Extract successful responses
+  const responses = results
+    .map((result, index) => {
+      if (result.status === 'fulfilled') {
+        return {
+          provider: models[index].provider,
+          model: models[index].model,
+          content: result.value,
+        };
+      } else {
+        console.error(
+          `Model ${models[index].provider}:${models[index].model} failed:`,
+          result.reason
+        );
+        return null;
+      }
+    })
+    .filter((r) => r !== null);
+
+  // 3. Handle failures gracefully
+  if (responses.length === 0) {
+    throw new Error('All models failed to respond');
+  }
 
-    // 4. Extract original user query for context
-    const userQuery =
-      messages.filter((m: Message) => m.role === 'user').slice(-1)[0]
-        ?.content || 'Unknown query';
+  console.log(`${responses.length} models responded successfully`);
 
-    // 5. Create synthesis prompt with enhanced guidelines
-    const synthesisPrompt = `You are synthesizing responses from multiple AI models to provide the best possible answer to the user's query.
+  // 4. Extract original user query for context
+  const userQuery =
+    messages.filter((m: Message) => m.role === 'user').slice(-1)[0]?.content ||
+    'Unknown query';
+
+  // 5. Create synthesis prompt with enhanced guidelines
+  const synthesisPrompt = `You are synthesizing responses from multiple AI models to provide the best possible answer to the user's query.
 
 <user_query>
 ${userQuery}
@@ -147,13 +143,36 @@ Guidelines:
 
 Provide your synthesized response now.`;
 
-    // 6. Use configured synthesizer model (from ModelSelector)
-    const synthesizer = getProvider(provider, model);
+  // 6. Use configured synthesizer model (from ModelSelector)
+  const synthesizer = getProvider(provider, model);
+
+  // 7. Stream synthesized response
+  const result = await streamText({
+    model: synthesizer,
+    messages: [{ role: 'user', content: synthesisPrompt }],
+  });
+
+  return result;
+}
+
+/**
+ * Handle consensus chat requests (backward compatibility wrapper):
+ * 1. Query multiple models in parallel
+ * 2. Synthesize responses using one of the models
+ * 3. Stream synthesized response back to client
+ */
+export async function handleConsensusChat(req: Request, res: Response) {
+  try {
+    const { messages, toolConfig, systemContext, provider, model } =
+      req.body as ChatRequest;
 
-    // 7. Stream synthesized response
-    const result = await streamText({
-      model: synthesizer,
-      messages: [{ role: 'user', content: synthesisPrompt }],
+    // Use the workflow executor
+    const result = await executeConsensusWorkflow({
+      messages,
+      toolConfig: toolConfig || {},
+      systemContext,
+      provider,
+      model,
     });
 
     // Use Vercel Data Stream Protocol (compatible with useChat hook)
@@ -169,3 +188,6 @@ Provide your synthesized response now.`;
     }
   }
 }
+
+// Register the workflow
+registerWorkflow('consensus', executeConsensusWorkflow);

From 9a948efe3355a600ba203c558a089ed59c48903b Mon Sep 17 00:00:00 2001
From: Hunter Phillips <hunterphillips@mac.lan>
Date: Sun, 14 Dec 2025 22:10:08 -0600
Subject: [PATCH 2/4] path traversal fix

---
 server/src/routes/uploads.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/src/routes/uploads.ts b/server/src/routes/uploads.ts
index 3233ea7..cdded50 100644
--- a/server/src/routes/uploads.ts
+++ b/server/src/routes/uploads.ts
@@ -20,6 +20,10 @@ await fs.mkdir(UPLOADS_BASE, { recursive: true });
 const storage = multer.diskStorage({
   destination: async (req, file, cb) => {
     const chatId = req.body.chatId || 'temp';
+    // Sanitize: only allow alphanumeric, hyphens, underscores
+    if (!/^[a-zA-Z0-9_-]+$/.test(chatId)) {
+      return cb(new Error('Invalid chat ID'), '');
+    }
     const chatDir = path.join(UPLOADS_BASE, chatId);
     await fs.mkdir(chatDir, { recursive: true });
     cb(null, chatDir);

From 39651fd53a136c6c88c752df0b555640958af7a1 Mon Sep 17 00:00:00 2001
From: Hunter Phillips <hunterphillips@mac.lan>
Date: Mon, 15 Dec 2025 02:08:49 -0600
Subject: [PATCH 3/4] attachment ui fix, testing

---
 README.md                                     |   5 +-
 client/src/components/Sidebar.tsx             |   1 -
 .../src/components/chat/AttachmentPreview.tsx |  42 +++----
 client/src/components/chat/FilePicker.tsx     |   1 -
 client/src/components/chat/InputArea.tsx      |  28 ++---
 client/src/hooks/useChatSession.ts            |  58 ++++++----
 client/src/hooks/useFileUpload.ts             |  67 +++++------
 client/src/lib/types.ts                       |  18 ++-
 client/src/store/config-store.ts              |  26 +++--
 server/src/index.ts                           |   2 +-
 server/src/routes/uploads.ts                  |  18 ++-
 server/src/types.ts                           |   2 +-
 server/tests/message-converter.test.ts        | 104 ++++++++++++++++++
 server/tests/uploads.test.ts                  |  38 +++++++
 14 files changed, 303 insertions(+), 107 deletions(-)
 create mode 100644 server/tests/message-converter.test.ts
 create mode 100644 server/tests/uploads.test.ts

diff --git a/README.md b/README.md
index 79ea009..a4162fc 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,10 @@ VITE_API_URL=http://localhost:3001
 │   │   ├── index.ts        # Main server
 │   │   ├── providers.ts    # AI SDK provider registry
 │   │   ├── config.ts       # Environment config
-│   │   └── types.ts        # TypeScript interfaces
+│   │   ├── types.ts        # TypeScript interfaces
+│   │   ├── /routes         # API routes
+│   │   └── /lib            # Utilities
+│   ├── /data               # db.json, uploads
 │   ├── /tests              # Vitest tests
 │   └── package.json
 │
diff --git a/client/src/components/Sidebar.tsx b/client/src/components/Sidebar.tsx
index 50eb584..55a2c25 100644
--- a/client/src/components/Sidebar.tsx
+++ b/client/src/components/Sidebar.tsx
@@ -148,7 +148,6 @@ export function Sidebar({
 
         {/* Chat List */}
         {isOpen && (
-          // space-y-1
           <div className="flex-1 overflow-y-auto p-2">
             {chats.map((chat) => (
               <ChatListItem
diff --git a/client/src/components/chat/AttachmentPreview.tsx b/client/src/components/chat/AttachmentPreview.tsx
index a17b4d3..05018e0 100644
--- a/client/src/components/chat/AttachmentPreview.tsx
+++ b/client/src/components/chat/AttachmentPreview.tsx
@@ -1,26 +1,30 @@
+import { useEffect, useState } from 'react';
 import { X, File, FileText, FileCode, Image } from 'lucide-react';
-import type { Attachment } from '@/lib/types';
 
 interface AttachmentPreviewProps {
-  attachment: Attachment;
+  file: File;
   onRemove: () => void;
 }
 
-const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
+export function AttachmentPreview({ file, onRemove }: AttachmentPreviewProps) {
+  const [previewUrl, setPreviewUrl] = useState<string | null>(null);
 
-export function AttachmentPreview({
-  attachment,
-  onRemove,
-}: AttachmentPreviewProps) {
-  const isImage = attachment.mimeType.startsWith('image/');
-  const isPdf = attachment.mimeType === 'application/pdf';
+  const isImage = file.type.startsWith('image/');
+  const isPdf = file.type === 'application/pdf';
   const isCode =
-    attachment.mimeType.includes('javascript') ||
-    attachment.mimeType.includes('typescript') ||
-    attachment.mimeType === 'application/json';
-  const isText = attachment.mimeType.startsWith('text/');
+    file.type.includes('javascript') ||
+    file.type.includes('typescript') ||
+    file.type === 'application/json';
+  const isText = file.type.startsWith('text/');
 
-  const fileUrl = `${API_URL}/api/uploads/${attachment.path}`;
+  // Create object URL for image preview
+  useEffect(() => {
+    if (isImage) {
+      const url = URL.createObjectURL(file);
+      setPreviewUrl(url);
+      return () => URL.revokeObjectURL(url);
+    }
+  }, [file, isImage]);
 
   const getIcon = () => {
     if (isImage) return Image;
@@ -34,10 +38,10 @@ export function AttachmentPreview({
 
   return (
     <div className="relative group inline-flex items-center gap-2 p-2 bg-accent border border-border rounded-lg">
-      {isImage ? (
+      {isImage && previewUrl ? (
         <img
-          src={fileUrl}
-          alt={attachment.name}
+          src={previewUrl}
+          alt={file.name}
           className="w-12 h-12 object-cover rounded"
         />
       ) : (
@@ -48,10 +52,10 @@ export function AttachmentPreview({
 
       <div className="flex flex-col min-w-0">
         <span className="text-xs text-foreground truncate max-w-[150px]">
-          {attachment.name}
+          {file.name}
         </span>
         <span className="text-xs text-muted-foreground">
-          {(attachment.size / 1024).toFixed(1)} KB
+          {(file.size / 1024).toFixed(1)} KB
         </span>
       </div>
 
diff --git a/client/src/components/chat/FilePicker.tsx b/client/src/components/chat/FilePicker.tsx
index 0781a3a..5f64ca3 100644
--- a/client/src/components/chat/FilePicker.tsx
+++ b/client/src/components/chat/FilePicker.tsx
@@ -11,7 +11,6 @@ const ACCEPTED_FILE_TYPES = [
   'image/jpeg',
   'image/gif',
   'image/webp',
-  // 'image/svg+xml',
   'application/pdf',
   'text/plain',
   'text/markdown',
diff --git a/client/src/components/chat/InputArea.tsx b/client/src/components/chat/InputArea.tsx
index 99bfc11..1e9abe1 100644
--- a/client/src/components/chat/InputArea.tsx
+++ b/client/src/components/chat/InputArea.tsx
@@ -7,7 +7,6 @@ import { FilePicker } from './FilePicker';
 import { ToolPillContainer } from './ToolPillContainer';
 import { toolRegistry } from '@/lib/tool-registry';
 import { useConfigStore } from '@/store/config-store';
-import { useFileUpload } from '@/hooks/useFileUpload';
 import birdIcon from '@/assets/bird.png';
 
 interface InputAreaProps {
@@ -28,11 +27,10 @@ export function InputArea({
   const [activePanelToolId, setActivePanelToolId] = useState<string | null>(
     null
   );
-  const { tools, currentChatId, pendingAttachments, removeAttachment } =
+  const { tools, pendingFiles, addPendingFile, removePendingFile } =
     useConfigStore();
-  const { uploadFiles } = useFileUpload(currentChatId);
 
-  const hasAttachments = pendingAttachments.length > 0;
+  const hasFiles = pendingFiles.length > 0;
 
   const handleKeyDown = (e: KeyboardEvent<HTMLTextAreaElement>) => {
     if (e.key === 'Enter' && !e.shiftKey) {
@@ -41,23 +39,25 @@ export function InputArea({
     }
   };
 
-  const handleFilesSelected = async (files: FileList) => {
-    await uploadFiles(files);
+  const handleFilesSelected = (files: FileList) => {
+    Array.from(files).forEach((file) => addPendingFile(file));
   };
 
+  const getFileId = (file: File) => `${file.name}-${file.lastModified}`;
+
   return (
     <>
       <form onSubmit={handleSubmit} className="p-4 bg-background">
         <div className="max-w-3xl mx-auto space-y-2">
           <div className="flex flex-col gap-2 bg-accent/50 rounded-lg p-4">
-            {/* Attachment Previews */}
-            {hasAttachments && (
+            {/* File Previews */}
+            {hasFiles && (
               <div className="flex flex-wrap gap-2 pb-2">
-                {pendingAttachments.map((att) => (
+                {pendingFiles.map((file) => (
                   <AttachmentPreview
-                    key={att.id}
-                    attachment={att}
-                    onRemove={() => removeAttachment(att.id)}
+                    key={getFileId(file)}
+                    file={file}
+                    onRemove={() => removePendingFile(getFileId(file))}
                   />
                 ))}
               </div>
@@ -80,7 +80,7 @@ export function InputArea({
                 disabled={isLoading}
                 rows={1}
                 className={`${
-                  hasAttachments && 'mt-2'
+                  hasFiles && 'mt-2'
                 } flex-1 leading-none resize-none border-0 bg-transparent focus-visible:outline-none text-sm placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50 min-h-[24px] max-h-[200px] overflow-y-auto`}
                 onInput={(e) => {
                   const target = e.target as HTMLTextAreaElement;
@@ -104,7 +104,7 @@ export function InputArea({
               ) : (
                 <Button
                   type="submit"
-                  disabled={!input.trim() && !hasAttachments}
+                  disabled={!input.trim() && !hasFiles}
                   className="rounded-full p-0"
                 >
                   <img
diff --git a/client/src/hooks/useChatSession.ts b/client/src/hooks/useChatSession.ts
index c3bb0c0..165223b 100644
--- a/client/src/hooks/useChatSession.ts
+++ b/client/src/hooks/useChatSession.ts
@@ -2,6 +2,8 @@ import { useCallback } from 'react';
 import { useChat } from '@ai-sdk/react';
 import { useConfigStore } from '../store/config-store';
 import { useChatPersistence } from './useChatPersistence';
+import { useFileUpload } from './useFileUpload';
+import type { Attachment } from '@/lib/types';
 
 export function useChatSession() {
   const {
@@ -14,23 +16,23 @@ export function useChatSession() {
     loadChat,
     saveMessages,
     updateChat,
-    pendingAttachments,
-    clearAttachments,
+    pendingFiles,
+    clearPendingFiles,
+    currentAttachments,
+    setCurrentAttachments,
   } = useConfigStore();
 
+  const { uploadFilesToChat, isUploading: isUploadingFiles } = useFileUpload();
   const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
-
-  // 1. Identify Workflow Tool (Target Endpoint)
   const workflowTool = tools.find((tool) => tool.enabled && tool.endpoint);
 
-  // 2. Aggregate Context from Client-Side Tools
+  // Aggregate Context from Client-Side Tools
   // Find all enabled tools that do NOT have an endpoint but include additional context
   const systemContext = tools
     .filter((t) => t.enabled && !t.endpoint && t.config?.prompt)
     .map((t) => t.config.prompt)
     .join('\n\n');
 
-  // 3. Always use /api/chat endpoint (server routes internally based on workflowId)
   const apiEndpoint = `${API_URL}/api/chat`;
 
   const {
@@ -50,7 +52,7 @@ export function useChatSession() {
       systemContext: systemContext,
       provider: currentProvider,
       model: currentModel,
-      attachments: pendingAttachments, // Server will attach to last user message
+      attachments: currentAttachments, // Server will attach to last user message
       workflowId: workflowTool?.id, // Server uses this to route to workflow handler
     },
     id: currentChatId || undefined,
@@ -107,13 +109,13 @@ export function useChatSession() {
     async (e: React.FormEvent): Promise<{ newChatId?: string }> => {
       e.preventDefault();
 
-      // Allow submission if there's either text or an attachment
-      if (!input.trim() && pendingAttachments.length < 1) return {};
+      // Allow submission if there's either text or files
+      if (!input.trim() && pendingFiles.length < 1) return {};
 
       let chatId = currentChatId;
       let newChatId: string | undefined;
 
-      // Create chat if this is the first message
+      // Create chat FIRST if this is the first message
       if (!chatId) {
         const newChat = await createChat('New Chat');
         chatId = newChat.id;
@@ -121,33 +123,51 @@ export function useChatSession() {
         setCurrentChat(chatId);
       }
 
-      // Construct complete user message with attachments
+      // Upload files now that we have a chatId
+      let uploadedAttachments: Attachment[] = [];
+      if (pendingFiles.length > 0) {
+        uploadedAttachments = await uploadFilesToChat(pendingFiles, chatId);
+
+        // Warn if some files failed to upload
+        if (uploadedAttachments.length < pendingFiles.length) {
+          const failedCount = pendingFiles.length - uploadedAttachments.length;
+          console.warn(`${failedCount} file(s) failed to upload`);
+        }
+      }
+
+      // Set attachments in state so they're included in the next request body
+      setCurrentAttachments(uploadedAttachments);
+
+      // Note: AI SDK will strip attachments from HTTP request but keep them in client stat
       const userMessage = {
         role: 'user' as const,
         content: input,
-        ...(pendingAttachments.length > 0 && {
-          attachments: [...pendingAttachments],
+        ...(uploadedAttachments.length > 0 && {
+          attachments: uploadedAttachments,
         }),
       };
 
-      // Append triggers API call with complete message
+      // Append triggers API call with attachments in body
       await append(userMessage);
 
-      // Clear input and attachments after successful append
+      // Clear state after successful append
       setInput('');
-      clearAttachments();
+      clearPendingFiles();
+      setCurrentAttachments([]);
 
       return { newChatId };
     },
     [
       input,
       currentChatId,
-      pendingAttachments,
+      pendingFiles,
       createChat,
       setCurrentChat,
+      uploadFilesToChat,
       append,
       setInput,
-      clearAttachments,
+      clearPendingFiles,
+      setCurrentAttachments,
     ]
   );
 
@@ -156,7 +176,7 @@ export function useChatSession() {
     messages,
     input,
     handleInputChange,
-    isLoading,
+    isLoading: isLoading || isUploadingFiles, // Combined busy state
     error,
     stop,
 
diff --git a/client/src/hooks/useFileUpload.ts b/client/src/hooks/useFileUpload.ts
index b3e5079..0a5f795 100644
--- a/client/src/hooks/useFileUpload.ts
+++ b/client/src/hooks/useFileUpload.ts
@@ -1,59 +1,60 @@
 import { useState } from 'react';
-import { useConfigStore } from '@/store/config-store';
 import type { Attachment } from '@/lib/types';
 
 const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3001';
 
-export function useFileUpload(chatId: string | null) {
+export function useFileUpload() {
   const [isUploading, setIsUploading] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const addAttachment = useConfigStore((state) => state.addAttachment);
 
-  const uploadFile = async (file: File): Promise<Attachment | null> => {
+  const uploadFilesToChat = async (
+    files: File[],
+    chatId: string
+  ): Promise<Attachment[]> => {
     setIsUploading(true);
     setError(null);
+    const attachments: Attachment[] = [];
 
     try {
-      const formData = new FormData();
-      // IMPORTANT: Append chatId BEFORE file so it's available in multer's destination callback
-      if (chatId) {
-        formData.append('chatId', chatId);
+      // Upload files sequentially
+      for (const file of files) {
+        try {
+          const formData = new FormData();
+          formData.append('chatId', chatId);
+          formData.append('file', file);
+
+          const response = await fetch(`${API_URL}/api/uploads`, {
+            method: 'POST',
+            body: formData,
+          });
+
+          if (!response.ok) {
+            const errorData = await response.json();
+            throw new Error(errorData.error || `Failed to upload ${file.name}`);
+          }
+
+          const attachment: Attachment = await response.json();
+          attachments.push(attachment);
+        } catch (err) {
+          const errorMessage =
+            err instanceof Error ? err.message : `Upload failed for ${file.name}`;
+          console.error(errorMessage);
+          // Continue with other files (partial success)
+        }
       }
-      formData.append('file', file);
 
-      const response = await fetch(`${API_URL}/api/uploads`, {
-        method: 'POST',
-        body: formData,
-      });
-
-      if (!response.ok) {
-        const errorData = await response.json();
-        throw new Error(errorData.error || 'Upload failed');
-      }
-
-      const attachment: Attachment = await response.json();
-      addAttachment(attachment);
-      return attachment;
+      return attachments;
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : 'Upload failed';
       setError(errorMessage);
-      return null;
+      return attachments; // Return whatever succeeded
     } finally {
       setIsUploading(false);
     }
   };
 
-  const uploadFiles = async (files: FileList): Promise<Attachment[]> => {
-    const uploads = Array.from(files).map((file) => uploadFile(file));
-    const results = await Promise.all(uploads);
-    return results.filter(
-      (attachment): attachment is Attachment => attachment !== null
-    );
-  };
-
   return {
-    uploadFile,
-    uploadFiles,
+    uploadFilesToChat,
     isUploading,
     error,
   };
diff --git a/client/src/lib/types.ts b/client/src/lib/types.ts
index 23395ec..d112582 100644
--- a/client/src/lib/types.ts
+++ b/client/src/lib/types.ts
@@ -95,8 +95,11 @@ export interface ConfigState {
   chats: ChatListItem[];
   currentChatId: string | null;
 
-  // Attachment state (transient, per-message)
-  pendingAttachments: Attachment[];
+  // File state (files selected but not yet uploaded)
+  pendingFiles: File[];
+
+  // Current attachments being submitted (uploaded files)
+  currentAttachments: Attachment[];
 
   setProvider: (provider: string) => void;
   setModel: (model: string) => void;
@@ -126,8 +129,11 @@ export interface ConfigState {
   setCurrentChat: (id: string | null) => void;
   saveMessages: (chatId: string, messages: any[]) => Promise<void>;
 
-  // Attachment methods
-  addAttachment: (attachment: Attachment) => void;
-  removeAttachment: (id: string) => void;
-  clearAttachments: () => void;
+  // File methods
+  addPendingFile: (file: File) => void;
+  removePendingFile: (fileId: string) => void;
+  clearPendingFiles: () => void;
+
+  // Current attachments methods (for active submission)
+  setCurrentAttachments: (attachments: Attachment[]) => void;
 }
diff --git a/client/src/store/config-store.ts b/client/src/store/config-store.ts
index ddd448b..0f98819 100644
--- a/client/src/store/config-store.ts
+++ b/client/src/store/config-store.ts
@@ -11,7 +11,8 @@ export const useConfigStore = create<ConfigState>((set, get) => ({
   tools: [],
   chats: [],
   currentChatId: null,
-  pendingAttachments: [],
+  pendingFiles: [],
+  currentAttachments: [],
 
   setProvider: (provider) => {
     set({ currentProvider: provider });
@@ -251,20 +252,29 @@ export const useConfigStore = create<ConfigState>((set, get) => ({
     }
   },
 
-  // Attachment methods
-  addAttachment: (attachment) => {
+  // File methods
+  addPendingFile: (file: File) => {
     set((state) => ({
-      pendingAttachments: [...state.pendingAttachments, attachment],
+      pendingFiles: [...state.pendingFiles, file],
     }));
   },
 
-  removeAttachment: (id) => {
+  removePendingFile: (fileId: string) => {
     set((state) => ({
-      pendingAttachments: state.pendingAttachments.filter((a) => a.id !== id),
+      pendingFiles: state.pendingFiles.filter((f) => {
+        // Use name + lastModified as unique identifier
+        const id = `${f.name}-${f.lastModified}`;
+        return id !== fileId;
+      }),
     }));
   },
 
-  clearAttachments: () => {
-    set({ pendingAttachments: [] });
+  clearPendingFiles: () => {
+    set({ pendingFiles: [] });
+  },
+
+  // Current attachments methods
+  setCurrentAttachments: (attachments) => {
+    set({ currentAttachments: attachments });
   },
 }));
diff --git a/server/src/index.ts b/server/src/index.ts
index 6f55575..66d22b1 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -100,8 +100,8 @@ app.post('/api/chat', async (req, res) => {
       model,
       messages,
       systemContext,
-      attachments,
       toolConfig,
+      attachments,
       workflowId,
     } = req.body as ChatRequest;
 
diff --git a/server/src/routes/uploads.ts b/server/src/routes/uploads.ts
index cdded50..1ee2e0d 100644
--- a/server/src/routes/uploads.ts
+++ b/server/src/routes/uploads.ts
@@ -19,11 +19,18 @@ await fs.mkdir(UPLOADS_BASE, { recursive: true });
 // Configure multer for file uploads
 const storage = multer.diskStorage({
   destination: async (req, file, cb) => {
-    const chatId = req.body.chatId || 'temp';
+    const chatId = req.body.chatId;
+
+    // Require chatId - no temp uploads allowed
+    if (!chatId || chatId === 'temp') {
+      return cb(new Error('chatId is required'), '');
+    }
+
     // Sanitize: only allow alphanumeric, hyphens, underscores
     if (!/^[a-zA-Z0-9_-]+$/.test(chatId)) {
       return cb(new Error('Invalid chat ID'), '');
     }
+
     const chatDir = path.join(UPLOADS_BASE, chatId);
     await fs.mkdir(chatDir, { recursive: true });
     cb(null, chatDir);
@@ -46,7 +53,6 @@ const upload = multer({
       'image/jpeg',
       'image/gif',
       'image/webp',
-      // 'image/svg+xml',
       'application/pdf',
       'text/plain',
       'text/markdown',
@@ -77,7 +83,13 @@ router.post('/', upload.single('file'), async (req, res) => {
       return;
     }
 
-    const chatId = req.body.chatId || 'temp';
+    const chatId = req.body.chatId;
+
+    if (!chatId) {
+      res.status(400).json({ error: 'chatId is required' });
+      return;
+    }
+
     const relativePath = `${chatId}/${req.file.filename}`;
 
     // Extract text for documents if needed
diff --git a/server/src/types.ts b/server/src/types.ts
index f7cbd27..49cbbc5 100644
--- a/server/src/types.ts
+++ b/server/src/types.ts
@@ -10,7 +10,7 @@ export interface ChatRequest {
   messages: Message[];
   systemContext?: string;
   toolConfig?: Record<string, unknown>;
-  attachments?: Attachment[]; // Pending attachments for the last user message
+  attachments?: Attachment[]; // Attachments for the last user message
   workflowId?: string; // workflow identifier for routing
 }
 
diff --git a/server/tests/message-converter.test.ts b/server/tests/message-converter.test.ts
new file mode 100644
index 0000000..82d1ef7
--- /dev/null
+++ b/server/tests/message-converter.test.ts
@@ -0,0 +1,104 @@
+import { describe, it, expect } from 'vitest';
+import type { Message } from '../src/types.js';
+import {
+  convertToMultimodalMessage,
+  validateMessageAttachments,
+} from '../src/lib/message-converter.js';
+
+describe('convertToMultimodalMessage', () => {
+  it('returns simple format for message without attachments', async () => {
+    const message: Message = {
+      role: 'user',
+      content: 'Hello world',
+    };
+
+    const result = await convertToMultimodalMessage(message);
+
+    expect(result).toEqual({
+      role: 'user',
+      content: 'Hello world',
+    });
+  });
+
+  it('converts document attachment with extractedText to text part', async () => {
+    const message: Message = {
+      role: 'user',
+      content: 'Review this file',
+      attachments: [
+        {
+          id: 'test-id',
+          name: 'document.txt',
+          path: 'test-chat/document.txt',
+          mimeType: 'text/plain',
+          size: 100,
+          createdAt: new Date().toISOString(),
+          extractedText: 'This is the document content.',
+        },
+      ],
+    };
+
+    const result = await convertToMultimodalMessage(message);
+
+    expect(result.role).toBe('user');
+    expect(Array.isArray(result.content)).toBe(true);
+    const parts = result.content as any[];
+    expect(parts).toHaveLength(2);
+    expect(parts[0]).toEqual({ type: 'text', text: 'Review this file' });
+    expect(parts[1]).toEqual({
+      type: 'text',
+      text: '[document.txt]\nThis is the document content.',
+    });
+  });
+});
+
+describe('validateMessageAttachments', () => {
+  it('returns valid for message without attachments', () => {
+    const message: Message = { role: 'user', content: 'Hello' };
+    const result = validateMessageAttachments(message, false);
+
+    expect(result.valid).toBe(true);
+  });
+
+  it('rejects image attachment when vision not supported', () => {
+    const message: Message = {
+      role: 'user',
+      content: 'What is this?',
+      attachments: [
+        {
+          id: 'test-id',
+          name: 'test.png',
+          path: 'test-chat/test.png',
+          mimeType: 'image/png',
+          size: 1024,
+          createdAt: new Date().toISOString(),
+        },
+      ],
+    };
+
+    const result = validateMessageAttachments(message, false);
+
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/does not support image attachments/i);
+  });
+
+  it('allows image attachment when vision is supported', () => {
+    const message: Message = {
+      role: 'user',
+      content: 'What is this?',
+      attachments: [
+        {
+          id: 'test-id',
+          name: 'test.png',
+          path: 'test-chat/test.png',
+          mimeType: 'image/png',
+          size: 1024,
+          createdAt: new Date().toISOString(),
+        },
+      ],
+    };
+
+    const result = validateMessageAttachments(message, true);
+
+    expect(result.valid).toBe(true);
+  });
+});
diff --git a/server/tests/uploads.test.ts b/server/tests/uploads.test.ts
new file mode 100644
index 0000000..b4d9886
--- /dev/null
+++ b/server/tests/uploads.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { app } from '../src/index.js';
+
+beforeAll(() => {
+  process.env.OPENAI_API_KEY = 'test-key';
+  process.env.ANTHROPIC_API_KEY = 'test-key';
+  process.env.GOOGLE_API_KEY = 'test-key';
+});
+
+describe('POST /api/uploads', () => {
+  it('rejects upload without chatId', async () => {
+    const res = await request(app)
+      .post('/api/uploads')
+      .attach('file', Buffer.from('test'), 'test.txt');
+
+    expect(res.status).toBe(500);
+  });
+
+  it('rejects chatId with path traversal attempt', async () => {
+    const res = await request(app)
+      .post('/api/uploads')
+      .field('chatId', '../../../etc')
+      .attach('file', Buffer.from('test'), 'test.txt');
+
+    expect(res.status).toBe(500);
+  });
+});
+
+describe('GET /api/uploads/:chatId/:filename', () => {
+  it('blocks path traversal in filename', async () => {
+    const res = await request(app).get(
+      '/api/uploads/test/../../etc/passwd'
+    );
+
+    expect(res.status).toBe(404);
+  });
+});

From cb10e9ca5ad8b44f3a19b4bffa02b86fedd3b59f Mon Sep 17 00:00:00 2001
From: Hunter Phillips <hunterphillips@mac.lan>
Date: Mon, 15 Dec 2025 02:19:26 -0600
Subject: [PATCH 4/4] use normalized file path

---
 server/src/routes/uploads.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/routes/uploads.ts b/server/src/routes/uploads.ts
index 1ee2e0d..79c1703 100644
--- a/server/src/routes/uploads.ts
+++ b/server/src/routes/uploads.ts
@@ -155,8 +155,8 @@ router.get('/:chatId/:filename', async (req, res) => {
       return;
     }
 
-    await fs.access(filePath); // Check if file exists
-    res.sendFile(filePath);
+    await fs.access(normalizedPath); // Check if file exists
+    res.sendFile(normalizedPath);
   } catch (error) {
     res.status(404).json({ error: 'File not found' });
   }