mercury-agent 0.16.2 → 0.17.0

package/src/cli/mercury.ts

@@ -17,7 +17,11 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
-import { loadConfig, resolveProjectPath } from "../config.js";
+import {
+  DEFAULT_AGENT_CONTAINER_IMAGE,
+  loadConfig,
+  resolveProjectPath,
+} from "../config.js";
 import { mergeRawMercuryConfig } from "../config-file.js";
 import { reapProcessTree } from "../core/process-tree.js";
 import { getCatalogEntryByName } from "../extensions/catalog.js";
@@ -31,6 +35,10 @@ import {
 import { RESERVED_EXTENSION_NAMES } from "../extensions/reserved.js";
 import { Db } from "../storage/db.js";
 import { removeSpaceWorkspace } from "../storage/memory.js";
+import {
+  LOCAL_BUILD_IMAGE_TAG,
+  resolveBuildImageTags,
+} from "./build-image-tags.js";
 import {
   buildGlobalInstallArgs,
   formatLockedDllMessage,
@@ -360,6 +368,29 @@ async function runAction(): Promise<void> {
 
 function buildAction(): void {
   // Build from package sources using a temp context — no files needed in user project
+  //
+  // The image is tagged with whatever `agentContainerImage` resolves to, not a
+  // fixed name: the runtime only ever looks for the configured reference, so a
+  // build under any other name is invisible to it. Config load is best-effort
+  // because this command is documented to run outside a project directory --
+  // there may be no .env and no mercury.yaml, and that is not an error.
+  let configuredImage: string = DEFAULT_AGENT_CONTAINER_IMAGE;
+  try {
+    // Inside the guard on purpose: loadEnvFile is a bare readFileSync, and an
+    // unreadable .env must not abort the one command that has to keep working
+    // in a degraded environment.
+    const buildEnvPath = join(CWD, ".env");
+    if (existsSync(buildEnvPath)) {
+      Object.assign(process.env, loadEnvFile(buildEnvPath));
+    }
+    configuredImage = loadConfig().agentContainerImage;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`⚠️  Could not read configuration (${msg}).`);
+    console.warn("   Tagging the default image name instead.");
+  }
+  const imageTags = resolveBuildImageTags(configuredImage);
+
   const tmpDir = join(tmpdir(), "mercury-build-context");
   rmSync(tmpDir, { recursive: true, force: true });
   mkdirSync(tmpDir, { recursive: true });
@@ -374,6 +405,7 @@ function buildAction(): void {
       "src/agent/pi-failure-class.ts",
       "src/agent/pi-jsonl-parser.ts",
       "src/agent/preferences-prompt.ts",
+      "src/text/sanitize-text.ts",
       "src/cli/mrctl.ts",
       "src/cli/mrctl-http.ts",
       "src/extensions/reserved.ts",
@@ -414,13 +446,13 @@ function buildAction(): void {
 
     console.log(`📦 Building container image...`);
     console.log(`   Package root: ${PACKAGE_ROOT}`);
-    console.log(`   Build context: ${tmpDir}\n`);
+    console.log(`   Build context: ${tmpDir}`);
+    console.log(`   Tags: ${imageTags.join(", ")}\n`);
     const result = spawnSync(
       "docker",
       [
         "build",
-        "-t",
-        "mercury-agent:latest",
+        ...imageTags.flatMap((tag) => ["-t", tag]),
         "-f",
         join(tmpDir, "container/Dockerfile"),
         tmpDir,
@@ -431,6 +463,21 @@ function buildAction(): void {
     if (result.status !== 0) {
       process.exit(result.status ?? 1);
     }
+
+    console.log(`
+✓ Built ${imageTags.join(" and ")}`);
+    console.log(
+      `   Mercury runs ${imageTags[0]} — no registry pull needed for it.`,
+    );
+    if (imageTags[0] !== LOCAL_BUILD_IMAGE_TAG) {
+      console.log(
+        `   Note: this shadows the registry copy. Docker only pulls a reference`,
+      );
+      console.log(
+        `   that is absent locally, so re-run 'mercury build' after upgrading,`,
+      );
+      console.log(`   or 'docker rmi' it to go back to pulling.`);
+    }
   } finally {
     // Clean up temp context
     rmSync(tmpDir, { recursive: true, force: true });

package/src/config-file.ts

@@ -147,6 +147,7 @@ const mercuryFileSchema = z
           .max(60 * 60 * 1000)
           .optional(),
         container_bwrap_docker_compat: z.boolean().optional(),
+        allow_unconfined: z.boolean().optional(),
         override_pi_system_prompt: z.boolean().optional(),
         env_passthrough: z.enum(["all", "claimed"]).optional(),
         trace_runs: z.boolean().optional(),
@@ -284,6 +285,7 @@ const KNOWN_SECTION_KEYS: Record<string, Set<string>> = {
     "image",
     "container_timeout_ms",
     "container_bwrap_docker_compat",
+    "allow_unconfined",
     "override_pi_system_prompt",
     "env_passthrough",
     "trace_runs",
@@ -444,6 +446,9 @@ function flattenMercuryFile(f: MercuryFile): RawMercuryConfigInput {
   if (f.agent?.container_bwrap_docker_compat != null) {
     o.containerBwrapDockerCompat = f.agent.container_bwrap_docker_compat;
   }
+  if (f.agent?.allow_unconfined != null) {
+    o.containerAllowUnconfined = f.agent.allow_unconfined;
+  }
   if (f.agent?.override_pi_system_prompt != null) {
     o.overridePiSystemPrompt = f.agent.override_pi_system_prompt;
   }
@@ -532,6 +537,7 @@ const CAMEL_TO_ENV: Record<string, string> = {
   containerNetwork: "MERCURY_CONTAINER_NETWORK",
   containerApiHost: "MERCURY_CONTAINER_API_HOST",
   containerBwrapDockerCompat: "MERCURY_CONTAINER_BWRAP_DOCKER_COMPAT",
+  containerAllowUnconfined: "MERCURY_CONTAINER_ALLOW_UNCONFINED",
   containerEnvPassthrough: "MERCURY_CONTAINER_ENV_PASSTHROUGH",
   overridePiSystemPrompt: "MERCURY_OVERRIDE_PI_SYSTEM_PROMPT",
   maxConcurrency: "MERCURY_MAX_CONCURRENCY",

package/src/config.ts

@@ -51,6 +51,10 @@ const booleanFromEnv = z.union([z.boolean(), z.string()]).transform((val) => {
   return lower === "true" || lower === "1";
 });
 
+/** Base agent image used when nothing overrides `agent.image`. */
+export const DEFAULT_AGENT_CONTAINER_IMAGE =
+  "ghcr.io/avishai-tsabari/mercury-agent:latest";
+
 const schema = z.object({
   // ─── API Key Mode ───────────────────────────────────────────────────
   apiKeyMode: z.enum(["platform", "byok"]).default("platform"),
@@ -136,9 +140,7 @@ const schema = z.object({
   whatsappAuthDir: z.string().optional(),
 
   // ─── Container / Agent ──────────────────────────────────────────────
-  agentContainerImage: z
-    .string()
-    .default("ghcr.io/avishai-tsabari/mercury-agent:latest"),
+  agentContainerImage: z.string().default(DEFAULT_AGENT_CONTAINER_IMAGE),
   containerTimeoutMs: z.coerce
     .number()
     .int()
@@ -188,6 +190,29 @@ const schema = z.object({
    * Ignored when containerRuntime is "runsc". See docs/container-lifecycle.md.
    */
   containerBwrapDockerCompat: booleanFromEnv.default(false),
+  /**
+   * Permits the auto-detected Docker Desktop sandbox relaxation
+   * (`seccomp=unconfined`, `apparmor=unconfined`, `--cap-add SYS_ADMIN`), which
+   * bubblewrap needs in order to nest inside the agent container.
+   *
+   * Default false, and that refuses the spawn rather than quietly weakening it.
+   * The relaxation used to be applied automatically on every Mac and Windows
+   * host and announced only at `info`, so a self-hoster ran a materially weaker
+   * sandbox than the Linux deployment without ever being asked — while the
+   * container it protects executes model-directed shell commands against
+   * attacker-influenced input. This project's own rule is that a limit the
+   * actor cannot read is a trap; a *relaxation* the operator cannot see is
+   * worse, because the operator is the only one who can weigh it.
+   *
+   * Set MERCURY_CONTAINER_ALLOW_UNCONFINED=true to accept the trade knowingly (it is then
+   * logged at `warn` on every spawn), or MERCURY_CONTAINER_RUNTIME=runsc to
+   * avoid it entirely — gVisor needs no relaxation, but is Linux-only.
+   *
+   * Ignored when containerRuntime is "runsc" (no relaxation is requested) and
+   * when containerBwrapDockerCompat is set (that flag is already an explicit
+   * operator choice).
+   */
+  containerAllowUnconfined: booleanFromEnv.default(false),
   /**
    * Docker network to attach inner (pi) containers to. When set, inner containers join this
    * network and can reach the Mercury host container by its container name rather than via

package/src/core/attachment-notes.ts

@@ -34,6 +34,10 @@ function describe(d: DroppedAttachment): string {
       return `a ${what} was not downloaded because the storage quota is exhausted.`;
     case "download_failed":
       return `a ${what} failed to download.`;
+    case "unsupported_type":
+      return `a ${what} was not accepted because its file type is not one this bot handles.`;
+    case "executable_content":
+      return `a ${what} was not accepted because its contents are executable code, whatever the filename said.`;
   }
 }
 

package/src/core/confirmation.ts

@@ -16,8 +16,10 @@
  * make the match fail; typing a bare `yes` was the only thing that worked.
  */
 
+import { REPLY_TO_BLOCK_RE } from "./reply-context.js";
+
 /** Context blocks adapters append to inbound text. Order-independent. */
-const APPENDED_BLOCKS = [/<reply_to\b[\s\S]*?<\/reply_to>/gi];
+const APPENDED_BLOCKS = [REPLY_TO_BLOCK_RE];
 
 /**
  * Strip adapter-appended context blocks and normalize for comparison.

package/src/core/handler.ts

@@ -13,6 +13,7 @@ import {
   resolveConversation,
 } from "./conversation.js";
 import { getDefaultDebounceMs, MessageDebouncer } from "./debounce.js";
+import { deliverySuffix } from "./reply-context.js";
 import { chatCommandWord } from "./router.js";
 import type { MercuryCoreRuntime } from "./runtime.js";
 import { formatSystemMessage, resolveLocale } from "./system-messages.js";
@@ -194,7 +195,7 @@ export function createMessageHandler(opts: MessageHandlerOptions) {
       const elapsed = Math.round((Date.now() - startTime) / 1000);
       const finalReply =
         hadStatusMessage && reply
-          ? `${reply}\n\n_(responded in ${elapsed}s)_`
+          ? `${reply}\n\n${deliverySuffix(elapsed)}`
           : reply;
       if (finalReply || files.length > 0) {
         // Guarded, because this await used to be the one unprotected step

package/src/core/media.ts

@@ -8,7 +8,12 @@
 import fs from "node:fs";
 import path from "node:path";
 import { logger } from "../logger.js";
-import type { MediaType, MessageAttachment } from "../types.js";
+import { stripInvisibleUnicode } from "../text/sanitize-text.js";
+import type {
+  DroppedAttachment,
+  MediaType,
+  MessageAttachment,
+} from "../types.js";
 
 // ─── MIME Maps ──────────────────────────────────────────────────────────
 
@@ -96,6 +101,62 @@ export function mimeToMediaType(mimeType: string): MediaType {
   return "document";
 }
 
+// ─── Ingest Gates ───────────────────────────────────────────────────────
+
+/**
+ * Is this filename's extension one the bot knows about?
+ *
+ * `EXT_TO_MIME` is the single source of truth — there is deliberately no
+ * parallel allowlist config, because that would be two sources of truth for
+ * one question. Anything the table does not name yields
+ * `application/octet-stream`, which is what this reports on.
+ *
+ * Ships **warn-only**: callers log what they would have rejected and accept
+ * the file anyway. Flipping to a rejection is a separate, deliberate change
+ * once the log shows the table matches real traffic.
+ */
+export function isAllowedExtension(filename: string): boolean {
+  // `extToMime` splits on "." and takes the last part, which is the whole
+  // string when there is no dot — so a file named literally `pdf` would
+  // otherwise read as allowed. This predicate is what the deferred flip to
+  // rejection will consume, so the hole is closed here rather than there.
+  if (!filename.includes(".")) return false;
+  return extToMime(filename) !== "application/octet-stream";
+}
+
+/**
+ * Known executable headers, matched against the first bytes of the file.
+ *
+ * A denylist, not a content/extension match: `.txt`, `.csv` and friends have
+ * no signature at all, and the whole OOXML family shares `PK\x03\x04`, so a
+ * positive identification is not available for the formats that matter. This
+ * asserts only that the bytes are *not* one of the shapes below.
+ *
+ * It does not prevent code execution — nothing in the container executes an
+ * attachment. It is blast-radius containment against a future parser, and the
+ * correct posture for the relay case where a file reaches a human. A payload
+ * with `GIF89a` or `%PDF-` prepended defeats it entirely; this targets crude
+ * mislabelling, not a motivated attacker.
+ */
+const EXECUTABLE_HEADERS: readonly (readonly number[])[] = [
+  [0x4d, 0x5a], // MZ — DOS/Windows PE
+  [0x7f, 0x45, 0x4c, 0x46], // \x7fELF — Linux/BSD
+  [0xfe, 0xed, 0xfa, 0xce], // Mach-O 32-bit BE
+  [0xce, 0xfa, 0xed, 0xfe], // Mach-O 32-bit LE
+  [0xfe, 0xed, 0xfa, 0xcf], // Mach-O 64-bit BE
+  [0xcf, 0xfa, 0xed, 0xfe], // Mach-O 64-bit LE
+  [0xca, 0xfe, 0xba, 0xbe], // Java class / Mach-O fat binary
+  [0x23, 0x21], // #! — shebang script
+];
+
+/** Do the first bytes of this buffer match a known executable header? */
+export function hasExecutableHeader(buffer: Buffer): boolean {
+  return EXECUTABLE_HEADERS.some(
+    (sig) =>
+      buffer.length >= sig.length && sig.every((byte, i) => buffer[i] === byte),
+  );
+}
+
 // ─── URL-based Media Downloader ─────────────────────────────────────────
 
 /**
@@ -114,10 +175,35 @@ export async function downloadMediaFromUrl(
     maxSizeBytes: number;
     outputDir: string;
     headers?: Record<string, string>;
+    /**
+     * Called when this function drops the file instead of returning it, so the
+     * caller can tell the agent why. Same shape `downloadWhatsAppMedia` uses.
+     * Currently fired only for the ingest gates below — the size and
+     * download-failure paths still return a bare `null`. Closing that is
+     * tracked in `docs/ideas/url-download-drops-not-reported-to-agent.md`.
+     */
+    onSkipped?: (info: DroppedAttachment) => void;
   },
 ): Promise<MessageAttachment | null> {
   const { maxSizeBytes, outputDir, headers } = options;
 
+  // Part A — extension allowlist, WARN-ONLY. Runs before the fetch so the log
+  // reflects what a rejection would have skipped downloading. Deliberately
+  // does not drop, does not call onSkipped, and changes nothing the sender or
+  // the agent sees; the flip to rejection is a separate change gated on this
+  // log. Only meaningful when the sender supplied a filename — without one the
+  // stored name is derived from the MIME type and there is no extension to judge.
+  if (options.filename && !isAllowedExtension(options.filename)) {
+    logger.warn(
+      "Attachment extension not in EXT_TO_MIME (warn-only, accepted)",
+      {
+        filename: options.filename,
+        mimeType: options.mimeType,
+        type: options.type,
+      },
+    );
+  }
+
   // Check expected size before downloading
   if (options.expectedSizeBytes && options.expectedSizeBytes > maxSizeBytes) {
     logger.warn("Skipping large media file", {
@@ -164,6 +250,19 @@ export async function downloadMediaFromUrl(
       return null;
     }
 
+    // Part B — binary-header denylist, enforced. Checked on the bytes already
+    // in memory, before anything reaches disk: never write-then-unlink.
+    if (hasExecutableHeader(buffer)) {
+      logger.warn("Dropping attachment with executable header", {
+        filename: options.filename,
+        mimeType: options.mimeType,
+        type: options.type,
+        sizeBytes: buffer.length,
+      });
+      options.onSkipped?.({ type: options.type, reason: "executable_content" });
+      return null;
+    }
+
     // Ensure output directory exists
     fs.mkdirSync(outputDir, { recursive: true });
 
@@ -190,7 +289,10 @@ export async function downloadMediaFromUrl(
       path: filePath,
       type: options.type,
       mimeType: options.mimeType,
-      filename: options.filename,
+      // The stored path is already ASCII-only via `safeName`; this is the
+      // display name that reaches the prompt, so it is stripped rather than
+      // rewritten — the sender's real filename stays readable.
+      filename: stripInvisibleUnicode(options.filename),
       sizeBytes: buffer.length,
     };
   } catch (error) {

package/src/core/outbox.ts

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { logger } from "../logger.js";
+import { stripOutboundTagCarriers } from "../text/sanitize-text.js";
 import type { EgressFile } from "../types.js";
 import { extToMime } from "./media.js";
 
@@ -38,8 +39,23 @@ export function scanOutbox(
 
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    if (entry.name.startsWith(".")) continue;
 
+    // The display name is the only string here a human ever sees, and the agent
+    // inside the container chose it — so it is remote-supplied text on the way
+    // out, and every bridge hands it to its platform API verbatim. Strip the
+    // Tags Block carriers for the same reason `consumeResult` strips the reply:
+    // an invisible payload rides out looking like `report.pdf`.
+    //
+    // Derived BEFORE the dotfile guard so one value drives both the filter and
+    // what ships. Stripping afterwards let a name like `\u{E0001}.env` pass a
+    // check reading the raw name and then be presented as `.env` — the guard and
+    // the emitted filename disagreeing about which string is the filename is the
+    // same shape as the bug this fixes.
+    const displayName = stripOutboundTagCarriers(entry.name) || "attachment";
+    if (displayName.startsWith(".")) continue;
+
+    // The real on-disk path, always the raw name: every bridge reads the bytes
+    // from it and a stripped path would not exist.
     const filePath = path.join(outboxDir, entry.name);
 
     let stat: fs.Stats;
@@ -64,10 +80,14 @@ export function scanOutbox(
       continue;
     }
 
+    // `extToMime` reads the stripped name on purpose: it takes the segment after
+    // the last dot, so a payload appended to `report.pdf` used to yield an
+    // extension of `pdf` + 40 invisible characters and a mime of
+    // `application/octet-stream`.
     files.push({
       path: filePath,
-      filename: entry.name,
-      mimeType: extToMime(entry.name),
+      filename: displayName,
+      mimeType: extToMime(displayName),
       sizeBytes: stat.size,
     });
   }

package/src/core/reply-context.ts

@@ -0,0 +1,61 @@
+/**
+ * Transport decoration that rides inside an inbound prompt.
+ *
+ * Two pieces of text arrive glued to what the person typed and are not part
+ * of it:
+ *
+ * - the `<reply_to …>…</reply_to>` block an adapter appends when the message
+ *   is a swipe-reply (`adapters/whatsapp.ts` `buildReplyContext`,
+ *   `bridges/telegram.ts` `buildTelegramReplyContext`) — the platform's own
+ *   rendering of the quoted message;
+ * - the `_(responded in Ns)_` suffix `handler.ts` adds to a delivered reply
+ *   after the reply is stored, which therefore comes back inside a quote of
+ *   that reply but never existed in the bot's history.
+ *
+ * One regex, one place. `confirmation.ts`, the reply-isolation branch and the
+ * quote de-duplication in `runtime.ts` all used to carry their own copy of the
+ * block pattern; a fix to one was invisible to the others.
+ */
+
+/**
+ * An adapter-appended quote block. Global and case-insensitive — safe with
+ * `String.replace`, stateful with `RegExp.test`/`exec` (reset `lastIndex` or
+ * clone before using it that way).
+ */
+export const REPLY_TO_BLOCK_RE = /<reply_to\b[\s\S]*?<\/reply_to>/gi;
+
+/** The block together with the blank lines the adapter put before it. */
+const REPLY_TO_BLOCK_WITH_LEAD_RE = /\n*<reply_to\b[\s\S]*?<\/reply_to>/gi;
+
+/**
+ * The delivery suffix, when it is the last thing inside a quote block. Only a
+ * trailing one is matched: a person quoting a message that *mentions* the
+ * phrase mid-body keeps it.
+ */
+const TRAILING_DELIVERY_SUFFIX_RE =
+  /\s*_\(responded in \d+s\)_[ \t]*(?=\r?\n?\s*<\/reply_to>)/i;
+
+/** The suffix `handler.ts` appends when a status message was shown. */
+export function deliverySuffix(elapsedSeconds: number): string {
+  return `_(responded in ${elapsedSeconds}s)_`;
+}
+
+/** Remove every quote block, with the newlines that led into it. */
+export function stripReplyToBlocks(text: string): string {
+  return text.replace(REPLY_TO_BLOCK_WITH_LEAD_RE, "");
+}
+
+/** True when the text carries at least one quote block. */
+export function hasReplyToBlock(text: string): boolean {
+  return new RegExp(REPLY_TO_BLOCK_RE.source, "i").test(text);
+}
+
+/**
+ * Drop a trailing delivery suffix from inside each quote block. The block
+ * itself, and everything the person actually quoted, is left as it was.
+ */
+export function scrubDeliverySuffix(text: string): string {
+  return text.replace(REPLY_TO_BLOCK_RE, (block) =>
+    block.replace(TRAILING_DELIVERY_SUFFIX_RE, ""),
+  );
+}

package/src/core/routes/chat.ts

@@ -3,10 +3,20 @@ import path from "node:path";
 import { Hono } from "hono";
 import { logger } from "../../logger.js";
 import { ensureSpaceWorkspace } from "../../storage/memory.js";
-import type { IngressMessage, MessageAttachment } from "../../types.js";
+import { stripInvisibleUnicode } from "../../text/sanitize-text.js";
+import type {
+  DroppedAttachment,
+  IngressMessage,
+  MessageAttachment,
+} from "../../types.js";
 import { authorizeApiSecret } from "../auth.js";
 import { type AutoSpaceConfig, resolveConversation } from "../conversation.js";
-import { extToMime, mimeToMediaType } from "../media.js";
+import {
+  extToMime,
+  hasExecutableHeader,
+  isAllowedExtension,
+  mimeToMediaType,
+} from "../media.js";
 import type { MercuryCoreRuntime } from "../runtime.js";
 import { isOverQuota } from "../storage-guard.js";
 
@@ -130,6 +140,7 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
 
     // Save incoming files to inbox/
     const attachments: MessageAttachment[] = [];
+    const dropped: DroppedAttachment[] = [];
     if (Array.isArray(body.files)) {
       if (body.files.length > 20) {
         return c.json({ error: "Too many files (max 20)" }, 400);
@@ -141,10 +152,65 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
       const inboxDir = path.join(workspace, "inbox");
       fs.mkdirSync(inboxDir, { recursive: true });
 
+      // Same per-file cap the five platform bridges apply in
+      // downloadMediaFromUrl — /chat enforced it zero times. Skip-and-log
+      // matches downloadMediaFromUrl returning null: one oversized file must
+      // not fail the whole turn.
+      // `|| 10` mirrors the zod default in config.ts: an AppConfig assembled
+      // without it would otherwise yield NaN, and `length > NaN` is always
+      // false — a cap that silently does not apply, which is the exact shape
+      // of the bug this fix exists to close.
+      const maxFileBytes = (core.config.mediaMaxSizeMb || 10) * 1024 * 1024;
+
       for (const file of body.files as ChatFileInput[]) {
         if (!file.name || !file.data) continue;
         try {
+          // Measured after decoding, not from the encoded length: base64 with
+          // embedded newlines inflates that estimate, which would reject files
+          // that are actually under the cap. The decode is safe to run because
+          // the global body limit already bounds how much can arrive at all.
           const buffer = Buffer.from(file.data, "base64");
+          if (buffer.length > maxFileBytes) {
+            logger.warn("Skipping oversized chat file", {
+              name: file.name,
+              sizeBytes: buffer.length,
+              maxBytes: maxFileBytes,
+            });
+            // Tell the agent the file is missing and why. Without this the
+            // caller sees a normal reply and the agent invents an explanation
+            // for the gap — the failure attachment-notes.ts was written for.
+            dropped.push({
+              type: mimeToMediaType(extToMime(file.name)),
+              reason: "too_large",
+              sizeBytes: buffer.length,
+              maxBytes: maxFileBytes,
+            });
+            continue;
+          }
+          // Part A — extension allowlist, WARN-ONLY. Logs what a rejection
+          // would have dropped and accepts the file regardless; the flip is a
+          // separate change gated on this log.
+          if (!isAllowedExtension(file.name)) {
+            logger.warn(
+              "Attachment extension not in EXT_TO_MIME (warn-only, accepted)",
+              { name: file.name },
+            );
+          }
+
+          // Part B — binary-header denylist, enforced. Checked on the decoded
+          // bytes, before anything reaches disk.
+          if (hasExecutableHeader(buffer)) {
+            logger.warn("Dropping chat file with executable header", {
+              name: file.name,
+              sizeBytes: buffer.length,
+            });
+            dropped.push({
+              type: mimeToMediaType(extToMime(file.name)),
+              reason: "executable_content",
+            });
+            continue;
+          }
+
           const safeName = path
             .basename(file.name)
             .replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -157,7 +223,7 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
             path: filePath,
             type: mimeToMediaType(mimeType),
             mimeType,
-            filename: file.name,
+            filename: stripInvisibleUnicode(file.name),
             sizeBytes: buffer.length,
           });
         } catch (err) {
@@ -189,6 +255,7 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
       isDM: true,
       isReplyToBot: false,
       attachments,
+      droppedAttachments: dropped.length > 0 ? dropped : undefined,
     };
 
     logger.info("API chat inbound", {

package/src/core/routes/config-builtin.ts

@@ -16,6 +16,7 @@ export const BUILTIN_CONFIG_KEYS = new Set([
   "rate_limit.admin",
   "debounce.idle_timeout_ms",
   "messages.locale",
+  "persona.exclusive",
 ]);
 
 /**
@@ -55,6 +56,8 @@ export const BUILTIN_CONFIG_DESCRIPTIONS: Record<string, string> = {
     "Milliseconds to wait for additional messages before processing a batch. 0 disables debounce. Platform default: 2000 for WhatsApp/Telegram, 0 for others.",
   "messages.locale":
     "Language for Mercury-generated system messages (rate limits, errors, denials) in this space: 'en' or 'he'. Unset falls back to the deployment default.",
+  "persona.exclusive":
+    "When true, this space's AGENTS.md is the only persona the model hears: the owner's global character and the global AGENTS.md are left out of its prompt. Unset/false keeps both (the default).",
 };
 
 const BUILTIN_VALIDATORS: Record<string, (v: string) => string | null> = {
@@ -126,6 +129,10 @@ const BUILTIN_VALIDATORS: Record<string, (v: string) => string | null> = {
     ["en", "he"].includes(v)
       ? null
       : "Invalid messages.locale value. Valid: en, he",
+  "persona.exclusive": (v) =>
+    ["true", "false"].includes(v)
+      ? null
+      : "Invalid persona.exclusive value. Valid: true, false",
 };
 
 export function isBuiltinConfigKey(key: string): boolean {