@pheem49/mint 1.16.0 → 1.17.0

package/crates/mint-cli/tests/mods_testing.rs

@@ -62,7 +62,11 @@ fn mod_export_requires_replace_and_preserves_quoted_paths() {
     );
     assert!(root.join("sample.mintmod").exists());
     assert!(!root.join("--replace").exists());
-    let outside = root.with_extension("outside.mintmod");
+    let outside = if cfg!(windows) {
+        std::path::PathBuf::from(r"C:\mint_disallowed_outside\sample.mintmod")
+    } else {
+        std::path::PathBuf::from("/mint_disallowed_outside/sample.mintmod")
+    };
     assert!(
         !run(&["mods", "export", "sample", outside.to_str().unwrap()])
             .status

package/crates/mint-companion-protocol/src/lib.rs

@@ -11,6 +11,9 @@ pub struct HostDescriptor {
     pub name: String,
     pub endpoint: String,
     pub token: String,
+    /// Stable executable and launch-directory identity; absent on older hosts.
+    #[serde(default)]
+    pub identity: Option<String>,
 }
 
 pub fn hosts_dir() -> Option<std::path::PathBuf> {
@@ -31,6 +34,22 @@ pub enum Status {
     Interrupted,
 }
 
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Surface {
+    Desktop,
+    Web,
+    Tui,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum NavigationOutcome {
+    Opened,
+    NeedsTerminal,
+    MissingSession,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Session {
@@ -52,10 +71,79 @@ pub struct Turn {
     pub prompt: String,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(
+    tag = "operation",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum SpeechRequest {
+    Prefer {
+        owner: String,
+        chat_id: String,
+        enabled: bool,
+    },
+    Prepare {
+        owner: String,
+        chat_id: String,
+        turn_id: Option<i64>,
+        text: Option<String>,
+        #[serde(default)]
+        automatic: bool,
+        #[serde(default)]
+        audio_only: bool,
+        #[serde(default)]
+        route_owner: Option<String>,
+    },
+    Audio {
+        owner: String,
+        index: usize,
+    },
+    Renew {
+        owner: String,
+    },
+    Release {
+        owner: String,
+    },
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(
+    tag = "kind",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase"
+)]
+pub enum SpeechReply {
+    Prepared {
+        text: String,
+        provider: String,
+        volume: f64,
+        speed: f64,
+        pitch: f64,
+        chunks: usize,
+    },
+    Audio {
+        data: String,
+    },
+    Lease {
+        active: bool,
+    },
+    Released,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
 pub enum Command {
     ListSessions,
+    Speech {
+        request: SpeechRequest,
+    },
+    OpenChat {
+        #[serde(rename = "chatId")]
+        chat_id: String,
+        #[serde(default, rename = "newTerminal")]
+        new_terminal: bool,
+    },
     Subscribe {
         #[serde(rename = "chatId")]
         chat_id: String,
@@ -79,10 +167,22 @@ pub enum Command {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Event {
+    Speech {
+        reply: SpeechReply,
+    },
+    Navigation {
+        outcome: NavigationOutcome,
+    },
     Snapshot {
         #[serde(rename = "hostId")]
         host_id: String,
         version: u32,
+        #[serde(default)]
+        surface: Option<Surface>,
+        #[serde(default)]
+        speech: bool,
+        #[serde(default, rename = "chatId")]
+        chat_id: Option<String>,
         sessions: Vec<Session>,
         turns: Vec<Turn>,
     },
@@ -161,3 +261,16 @@ mod tests {
         assert!(serde_json::from_str::<Command>(wire).is_err());
     }
 }
+
+#[cfg(test)]
+mod navigation_tests {
+    use super::*;
+    #[test]
+    fn open_chat_is_an_explicit_navigation_request_without_chat_submission() {
+        let request =
+            serde_json::json!({"type":"open_chat","chatId":"cli::saved","newTerminal":false});
+        assert!(serde_json::from_value::<Command>(request).is_ok());
+        let injected = serde_json::json!({"type":"open_chat","chatId":"cli::saved","newTerminal":false,"executable":"evil"});
+        assert!(serde_json::from_value::<Command>(injected).is_err());
+    }
+}

package/crates/mint-core/src/agent/chat.rs

@@ -993,11 +993,108 @@ async fn send_openai_style_request(
 // with {} would silently turn a requested directory into the workspace root.
 fn decode_tool_arguments(arguments: &Value) -> Value {
     match arguments.as_str() {
-        Some(raw) => serde_json::from_str(raw).unwrap_or_else(|_| arguments.clone()),
+        Some(raw) => sanitize_and_parse_tool_arguments(raw).unwrap_or_else(|| arguments.clone()),
         None => arguments.clone(),
     }
 }
 
+/// Sanitizes LLM tool call argument string: strips markdown fences, DeepSeek DSML tokens,
+/// thinking tags, extracts inner JSON objects, and handles trailing commas before failing.
+fn sanitize_and_parse_tool_arguments(raw: &str) -> Option<Value> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+    if let Ok(val) = serde_json::from_str::<Value>(trimmed) {
+        return Some(val);
+    }
+
+    // 1. Strip markdown code fences if wrapped in ```json ... ```
+    let without_fences = if let Some(stripped) = trimmed.strip_prefix("```json") {
+        stripped.strip_suffix("```").unwrap_or(stripped).trim()
+    } else if let Some(stripped) = trimmed.strip_prefix("```") {
+        stripped.strip_suffix("```").unwrap_or(stripped).trim()
+    } else {
+        trimmed
+    };
+    if let Ok(val) = serde_json::from_str::<Value>(without_fences) {
+        return Some(val);
+    }
+
+    // 2. Strip known special tokens (DeepSeek DSML markers, thinking tags, end of sentence markers)
+    let cleaned = without_fences
+        .replace("</｜｜DSML｜｜", "")
+        .replace("<｜｜DSML｜｜", "")
+        .replace("<｜end of sentence｜>", "")
+        .replace("</think>", "");
+
+    if let Ok(val) = serde_json::from_str::<Value>(&cleaned) {
+        return Some(val);
+    }
+
+    // 3. Extract JSON object boundary between first '{' and last '}'
+    if let (Some(start), Some(end)) = (cleaned.find('{'), cleaned.rfind('}')) {
+        if start < end {
+            let slice = &cleaned[start..=end];
+            if let Ok(val) = serde_json::from_str::<Value>(slice) {
+                return Some(val);
+            }
+            // 4. Strip trailing commas before closing braces/brackets
+            let without_trailing_commas = strip_json_trailing_commas(slice);
+            if let Ok(val) = serde_json::from_str::<Value>(&without_trailing_commas) {
+                return Some(val);
+            }
+        }
+    }
+
+    None
+}
+
+/// Simple non-destructive removal of trailing commas before closing braces/brackets
+fn strip_json_trailing_commas(input: &str) -> String {
+    let mut out = String::with_capacity(input.len());
+    let mut chars = input.chars().peekable();
+    let mut in_str = false;
+    let mut escape = false;
+
+    while let Some(ch) = chars.next() {
+        if in_str {
+            if escape {
+                escape = false;
+            } else if ch == '\\' {
+                escape = true;
+            } else if ch == '"' {
+                in_str = false;
+            }
+            out.push(ch);
+        } else {
+            if ch == '"' {
+                in_str = true;
+                out.push(ch);
+            } else if ch == ',' {
+                // Check if following non-whitespace character is '}' or ']'
+                let mut peek_chars = chars.clone();
+                let mut is_trailing = false;
+                while let Some(next_ch) = peek_chars.next() {
+                    if next_ch.is_whitespace() {
+                        continue;
+                    }
+                    if next_ch == '}' || next_ch == ']' {
+                        is_trailing = true;
+                    }
+                    break;
+                }
+                if !is_trailing {
+                    out.push(ch);
+                }
+            } else {
+                out.push(ch);
+            }
+        }
+    }
+    out
+}
+
 /// Parses an OpenAI Chat Completions-shaped response (`choices[0].message`),
 /// extracting both plain text and any native `tool_calls`. Shared by OpenAI,
 /// custom OpenAI-compatible providers, and (for its response shape only) reused
@@ -2791,6 +2888,10 @@ fn openai_native_messages(messages: &[ChatMessage]) -> Result<Vec<Value>, ChatEr
                 };
                 if !tool_calls.is_empty() {
                     entry["tool_calls"] = json!(tool_calls);
+                    // DeepSeek and other reasoning-enabled OpenAI-compatible APIs enforce that
+                    // any assistant message containing `tool_calls` must include `reasoning_content`
+                    // when reasoning/thinking mode is active. Providing `""` prevents HTTP 400 rejection.
+                    entry["reasoning_content"] = json!("");
                 }
                 result.push(entry);
             }
@@ -3421,6 +3522,124 @@ mod tests {
         );
     }
 
+    #[test]
+    fn openai_native_messages_attaches_reasoning_content_for_tool_calls() {
+        let messages = vec![ChatMessage {
+            role: ChatRole::Assistant,
+            content: vec![ContentBlock::ToolUse {
+                id: "call_abc".into(),
+                name: "read_file".into(),
+                input: json!({"path": "src/main.rs"}),
+                thought_signature: None,
+            }],
+        }];
+        let built = openai_native_messages(&messages).unwrap();
+        assert_eq!(built.len(), 1);
+        assert_eq!(built[0]["role"], "assistant");
+        assert_eq!(built[0]["reasoning_content"], json!(""));
+        assert_eq!(built[0]["tool_calls"][0]["function"]["name"], "read_file");
+    }
+
+    #[test]
+    fn openai_serializes_compacted_history_with_role_alternation() {
+        let messages = vec![
+            ChatMessage::text(ChatRole::User, "Fix the bug"),
+            ChatMessage::text(
+                ChatRole::Assistant,
+                "Summary of earlier steps:\n- read file.rs\n- found syntax error",
+            ),
+            ChatMessage::text(
+                ChatRole::User,
+                "Please continue the task from where you left off based on the summary above.",
+            ),
+            ChatMessage {
+                role: ChatRole::Assistant,
+                content: vec![ContentBlock::ToolUse {
+                    id: "call_1".into(),
+                    name: "apply_patch".into(),
+                    input: json!({"path": "file.rs", "patch": "..."}),
+                    thought_signature: None,
+                }],
+            },
+            ChatMessage {
+                role: ChatRole::Tool,
+                content: vec![ContentBlock::ToolResult {
+                    tool_use_id: "call_1".into(),
+                    content: "Patch applied".into(),
+                    is_error: false,
+                }],
+            },
+        ];
+        let built = openai_native_messages(&messages).unwrap();
+        assert_eq!(built.len(), 5);
+        assert_eq!(built[0]["role"], "user");
+        assert_eq!(built[1]["role"], "assistant");
+        assert_eq!(built[2]["role"], "user");
+        assert_eq!(built[3]["role"], "assistant");
+        assert_eq!(built[4]["role"], "tool");
+    }
+
+    #[test]
+    fn anthropic_serializes_compacted_history_with_role_alternation() {
+        let messages = vec![
+            ChatMessage::text(ChatRole::User, "Fix the bug"),
+            ChatMessage::text(ChatRole::Assistant, "Summary of earlier steps"),
+            ChatMessage::text(ChatRole::User, "Please continue"),
+            ChatMessage {
+                role: ChatRole::Assistant,
+                content: vec![ContentBlock::ToolUse {
+                    id: "toolu_1".into(),
+                    name: "read_file".into(),
+                    input: json!({"path": "file.rs"}),
+                    thought_signature: None,
+                }],
+            },
+            ChatMessage {
+                role: ChatRole::Tool,
+                content: vec![ContentBlock::ToolResult {
+                    tool_use_id: "toolu_1".into(),
+                    content: "Code content".into(),
+                    is_error: false,
+                }],
+            },
+        ];
+        let built = anthropic_messages(&messages).unwrap();
+        assert_eq!(built.len(), 5);
+        assert_eq!(built[0]["role"], "user");
+        assert_eq!(built[1]["role"], "assistant");
+        assert_eq!(built[2]["role"], "user");
+        assert_eq!(built[3]["role"], "assistant");
+        assert_eq!(built[4]["role"], "user");
+    }
+
+    #[test]
+    fn gemini_serializes_compacted_history_with_role_alternation() {
+        let messages = vec![
+            ChatMessage::text(ChatRole::User, "Fix the bug"),
+            ChatMessage::text(ChatRole::Assistant, "Summary of earlier steps"),
+            ChatMessage::text(ChatRole::User, "Please continue"),
+            ChatMessage {
+                role: ChatRole::Assistant,
+                content: vec![ContentBlock::ToolUse {
+                    id: "call_1".into(),
+                    name: "read_file".into(),
+                    input: json!({"path": "file.rs"}),
+                    thought_signature: None,
+                }],
+            },
+            ChatMessage {
+                role: ChatRole::Tool,
+                content: vec![ContentBlock::ToolResult {
+                    tool_use_id: "call_1".into(),
+                    content: "Code content".into(),
+                    is_error: false,
+                }],
+            },
+        ];
+        let built = gemini_native_contents(&messages).unwrap();
+        assert!(built.len() >= 4);
+    }
+
     #[test]
     fn openai_allows_audio_attachments() {
         let request = ChatRequest {
@@ -4152,4 +4371,24 @@ mod tests {
             Some("Ollama internal thinking trace...")
         );
     }
+
+    #[test]
+    fn decode_tool_arguments_sanitizes_fences_tokens_and_trailing_commas() {
+        // 1. Markdown fences
+        let fenced =
+            Value::String("```json\n{\"command\": \"curl -s https://example.com\"}\n```".into());
+        let decoded = decode_tool_arguments(&fenced);
+        assert_eq!(decoded["command"], "curl -s https://example.com");
+
+        // 2. DeepSeek DSML token
+        let dsml = Value::String("{\"command\": \"ls -la\"}</｜｜DSML｜｜".into());
+        let decoded_dsml = decode_tool_arguments(&dsml);
+        assert_eq!(decoded_dsml["command"], "ls -la");
+
+        // 3. Trailing commas
+        let trailing = Value::String("{\"command\": \"echo ok\", \"flag\": true, }".into());
+        let decoded_trailing = decode_tool_arguments(&trailing);
+        assert_eq!(decoded_trailing["command"], "echo ok");
+        assert_eq!(decoded_trailing["flag"], true);
+    }
 }

package/crates/mint-core/src/agent/memory.rs

@@ -55,6 +55,8 @@ pub fn subagent_name(chat_id: &str) -> Option<&str> {
 pub enum MemoryError {
     #[error("library error: {0}")]
     Library(String),
+    #[error("trajectory error: {0}")]
+    Trajectory(String),
     #[error("unable to determine the user config directory")]
     ConfigDirectoryUnavailable,
     #[error("unable to create database directory {path}: {source}")]
@@ -336,8 +338,8 @@ impl MemoryStore {
         Ok(())
     }
 
-    fn expire_abandoned_turns(&self, chat_id: &str) -> Result<(), MemoryError> {
-        self.connection()?.execute(
+    fn expire_abandoned_turns(connection: &Connection, chat_id: &str) -> Result<(), MemoryError> {
+        connection.execute(
             "UPDATE interaction_memories SET status = 'interrupted', lease_until = 0
              WHERE chat_id = ?1 AND status IN ('queued', 'running') AND lease_until < unixepoch()",
             params![normalized_chat_id(chat_id)],
@@ -385,8 +387,8 @@ impl MemoryStore {
         limit: usize,
     ) -> Result<ConversationChanges, MemoryError> {
         let chat_id = normalized_chat_id(chat_id);
-        self.expire_abandoned_turns(&chat_id)?;
         let connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, &chat_id)?;
         let mut statement = connection.prepare(
             "SELECT c.sequence, c.interaction_id,
                     m.id, m.chat_id, m.user_text, m.ai_text, m.provider, m.model,
@@ -441,8 +443,8 @@ impl MemoryStore {
     }
 
     pub fn latest_conversation_sequence(&self, chat_id: &str) -> Result<i64, MemoryError> {
-        self.expire_abandoned_turns(chat_id)?;
         let connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, chat_id)?;
         Ok(connection.query_row(
             "SELECT coalesce(max(sequence), 0) FROM conversation_changes WHERE chat_id = ?1",
             params![normalized_chat_id(chat_id)],
@@ -457,8 +459,8 @@ impl MemoryStore {
         limit: usize,
     ) -> Result<ConversationSnapshot, MemoryError> {
         let chat_id = normalized_chat_id(chat_id);
-        self.expire_abandoned_turns(&chat_id)?;
         let mut connection = self.connection()?;
+        Self::expire_abandoned_turns(&connection, &chat_id)?;
         let tx = connection.transaction()?;
         let cursor: i64 = tx.query_row(
             "SELECT coalesce(max(sequence), 0) FROM conversation_changes WHERE chat_id = ?1",
@@ -553,6 +555,68 @@ impl MemoryStore {
         rows.collect::<Result<Vec<_>, _>>().map_err(Into::into)
     }
 
+    /// Exports the execution trajectory for a given chat and optional run/interaction ID
+    /// formatted according to the SWE-bench / Agent Protocol StandardTrajectoryRun v1.0.
+    pub fn export_trajectory_json(
+        &self,
+        chat_id: &str,
+        run_id_or_interaction_id: Option<&str>,
+    ) -> Result<String, MemoryError> {
+        let interactions = self.recent_interactions_for_chat(chat_id, 50)?;
+        if interactions.is_empty() {
+            return Err(MemoryError::Trajectory(format!(
+                "No interactions found for chat '{chat_id}'"
+            )));
+        }
+
+        let target = if let Some(id_query) = run_id_or_interaction_id {
+            interactions.into_iter().find(|im| {
+                if im.id.to_string() == id_query {
+                    return true;
+                }
+                if let Some(act) = &im.agent_activity {
+                    let act_str = act.to_string();
+                    if act_str.contains(id_query) {
+                        return true;
+                    }
+                }
+                false
+            })
+        } else {
+            interactions.into_iter().next()
+        };
+
+        let interaction = target.ok_or_else(|| {
+            MemoryError::Trajectory(format!(
+                "No interaction matching identifier '{:?}' found for chat '{}'",
+                run_id_or_interaction_id, chat_id
+            ))
+        })?;
+
+        let activity_val = interaction.agent_activity.as_ref().ok_or_else(|| {
+            MemoryError::Trajectory("No agent activity recorded for this interaction".into())
+        })?;
+
+        let events: Vec<crate::orchestration::AgentProgress> =
+            serde_json::from_value(activity_val.clone()).map_err(|e| {
+                MemoryError::Trajectory(format!("Failed to parse agent activity events: {e}"))
+            })?;
+
+        let fallback_run_id = format!("run-{}", interaction.id);
+        let run =
+            crate::orchestration::trajectory_schema::StandardTrajectoryRun::from_agent_activity(
+                &interaction.chat_id,
+                &fallback_run_id,
+                &interaction.user_text,
+                &interaction.model,
+                &interaction.provider,
+                &events,
+            );
+
+        run.to_json_pretty()
+            .map_err(|e| MemoryError::Trajectory(format!("Failed to serialize trajectory: {e}")))
+    }
+
     /// Full-text search over `chat_id`'s past interactions for the turns most
     /// relevant to `query` (BM25 ranked), skipping the `exclude_recent` newest
     /// rows since those are already injected verbatim elsewhere. Returns
@@ -796,6 +860,9 @@ impl MemoryStore {
         let deleted =
             transaction.execute("DELETE FROM chat_sessions WHERE id = ?1", params![chat_id])?;
         transaction.commit()?;
+        if let Err(error) = crate::mcp_result::delete_chat_artifacts(&chat_id) {
+            eprintln!("Could not remove conversation artifacts: {error}");
+        }
         Ok(deleted)
     }
 
@@ -1780,7 +1847,7 @@ fn interaction_row(row: &rusqlite::Row<'_>) -> Result<InteractionMemory, rusqlit
 
 fn normalized_chat_id(chat_id: &str) -> String {
     let trimmed = chat_id.trim();
-    if trimmed.is_empty() {
+    if trimmed.is_empty() || trimmed == "default" {
         DEFAULT_CONVERSATION_ID.to_owned()
     } else {
         trimmed.to_owned()

package/crates/mint-core/src/agent/safety.rs

@@ -331,10 +331,11 @@ pub fn assert_path_capability(
         Capability::Read => &config.allowed_read_paths,
         Capability::Write => &config.allowed_write_paths,
     };
-    if !allowed_paths
-        .iter()
-        .map(|path| resolve_path(path))
-        .any(|path| resolved.starts_with(path))
+    if !is_temp_path(&resolved)
+        && !allowed_paths
+            .iter()
+            .map(|path| resolve_path(path))
+            .any(|path| resolved.starts_with(path))
     {
         return Err(SafetyError::PathDenied {
             capability: capability.as_str(),
@@ -344,6 +345,31 @@ pub fn assert_path_capability(
     Ok(resolved)
 }
 
+fn is_temp_path(path: &Path) -> bool {
+    let temp = std::env::temp_dir();
+    if path.starts_with(&temp) {
+        return true;
+    }
+    if let Ok(canonical_temp) = temp.canonicalize() {
+        if path.starts_with(&canonical_temp) {
+            return true;
+        }
+    }
+    #[cfg(unix)]
+    {
+        let slash_tmp = Path::new("/tmp");
+        if path.starts_with(slash_tmp) {
+            return true;
+        }
+        if let Ok(canonical_slash_tmp) = slash_tmp.canonicalize() {
+            if path.starts_with(&canonical_slash_tmp) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
 fn resolve_path(path: &Path) -> PathBuf {
     let expanded = expand_home(path);
     let absolute = if expanded.is_absolute() {
@@ -476,4 +502,30 @@ mod tests {
             assert_path_capability(Path::new("/var/lib/private"), Capability::Read, &config);
         assert!(matches!(result, Err(SafetyError::PathDenied { .. })));
     }
+
+    #[test]
+    fn allows_temp_directory_paths_even_when_allowed_paths_is_empty() {
+        let config = MintConfig {
+            allowed_read_paths: vec![],
+            allowed_write_paths: vec![],
+            ..MintConfig::default()
+        };
+        let temp_file = std::env::temp_dir().join("some_image.png");
+        let result = assert_path_capability(&temp_file, Capability::Read, &config);
+        assert!(result.is_ok());
+        let write_result = assert_path_capability(&temp_file, Capability::Write, &config);
+        assert!(write_result.is_ok());
+    }
+
+    #[test]
+    fn blocks_sensitive_files_even_inside_temp_directory() {
+        let config = MintConfig {
+            allowed_read_paths: vec![],
+            blocked_file_names: vec![".env".into()],
+            ..MintConfig::default()
+        };
+        let temp_env = std::env::temp_dir().join(".env");
+        let result = assert_path_capability(&temp_env, Capability::Read, &config);
+        assert!(matches!(result, Err(SafetyError::BlockedFileName { .. })));
+    }
 }

package/crates/mint-core/src/agent/skill_inventory.rs

@@ -96,7 +96,9 @@ fn discover_from(
             discovered.push(entry);
         }
     };
-    add_layer(memory.learned_skills(100)?, SkillLocation::Database);
+    if let Ok(learned) = memory.learned_skills(100) {
+        add_layer(learned, SkillLocation::Database);
+    }
     if let Some(home) = home {
         let mut rules = Vec::new();
         load_agent_rules_file(&home.join(".gemini/config/AGENTS.md"), &mut rules);

package/crates/mint-core/src/agent/skills.rs

@@ -504,6 +504,7 @@ mod tests {
         );
         let denied = crate::MintConfig {
             allowed_read_paths: vec![],
+            blocked_paths: vec![root.clone()],
             ..config.clone()
         };
         assert!(read_skill_file(&memory, &skills[0], "denied", &denied).is_err());

package/crates/mint-core/src/api_server/routes/auth.rs

@@ -128,10 +128,7 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
                 "gif" => "image/gif",
                 _ => "image/png",
             };
-            let file_path = profile_pictures_dir()
-                .ok()
-                .filter(|_| !filename.is_empty())
-                .map(|dir| dir.join(&filename));
+            let file_path = resolve_avatar_file_path(&filename);
             match file_path.and_then(|path| std::fs::read(path).ok()) {
                 Some(bytes) => send_binary_response(socket, "200 OK", content_type, &bytes).await,
                 None => {