feat(upload): allow PDF attachments

docs/API-REFERENCE.md

@@ -378,7 +378,7 @@ Validate a session token.
 
 ### `POST /api/upload`
 
-Upload a file (images or markdown, max 20MB).
+Upload a file (images, markdown or PDF, max 20MB). Binary types are checked against their magic bytes.
 
 **Content-Type:** `multipart/form-data`
 **Form field:** `file`

server/upload-routes.test.ts

@@ -310,6 +310,21 @@ describe('POST /api/upload — magic-byte validation (M2)', () => {
     expect(body.success).toBe(true)
   })
 
+  it('accepts a valid PDF file', async () => {
+    const pdf = Buffer.from('%PDF-1.4\n1 0 obj\n<<>>\nendobj\ntrailer\n<<>>\n%%EOF\n')
+    const res = await uploadFile('doc.pdf', 'application/pdf', pdf)
+    expect(res.status).toBe(200)
+    const body = await res.json() as { success: boolean }
+    expect(body.success).toBe(true)
+  })
+
+  it('rejects a .pdf whose bytes are not a PDF (signature mismatch)', async () => {
+    const res = await uploadFile('fake.pdf', 'application/pdf', VALID_PNG)
+    expect(res.status).toBe(400)
+    const body = await res.json() as { error: string }
+    expect(body.error).toContain('signature mismatch')
+  })
+
   it('rejects a file with unknown binary signature claiming to be PNG', async () => {
     const garbage = Buffer.from('not a real image file at all')
     const res = await uploadFile('bad.png', 'image/png', garbage)

server/upload-routes.ts

@@ -328,9 +328,10 @@ export function createUploadRouter(
     '.gif': ['image/gif'],
     '.webp': ['image/webp'],
     '.md': ['text/markdown'],
+    '.pdf': ['application/pdf'],
   }
   /** Binary MIME types that have detectable file signatures (magic bytes). */
-  const BINARY_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp'])
+  const BINARY_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'application/pdf'])
   const upload = multer({
     storage,
     limits: { fileSize: 20 * 1024 * 1024 },

src/components/DropZone.tsx

@@ -93,7 +93,7 @@ export function DropZone({ onUpload, disabled }: Props) {
     <div className="absolute inset-0 z-50 flex items-center justify-center rounded-control border-2 border-dashed border-primary-7 bg-primary-11/60 backdrop-blur-sm pointer-events-none">
       <div className="text-center">
         <IconUpload className="mx-auto mb-2 text-primary-6" size={40} stroke={1.5} />
-        <p className="text-body font-medium text-primary-5">Drop images or markdown here</p>
+        <p className="text-body font-medium text-primary-5">Drop images, markdown or PDFs here</p>
       </div>
     </div>
   )

src/components/InputBar.tsx

@@ -58,11 +58,11 @@ function ToolbarAction({ onClick, disabled, title, accent = false, children }: {
 /**
  * Attach-files button. A `+` rather than a paperclip, matching the convention
  * other LLM composers have settled on; the title still says what it takes,
- * since the picker only accepts images and markdown.
+ * since the picker only accepts images, markdown and PDFs.
  */
 function AttachButton({ onClick, disabled, accent = false }: { onClick: () => void; disabled: boolean; accent?: boolean }) {
   return (
-    <ToolbarAction onClick={onClick} disabled={disabled} title="Attach images or markdown" accent={accent}>
+    <ToolbarAction onClick={onClick} disabled={disabled} title="Attach images, markdown or PDFs" accent={accent}>
       <IconPlus className="density-icon" stroke={2} />
     </ToolbarAction>
   )
@@ -773,7 +773,7 @@ export const InputBar = forwardRef<InputBarHandle, InputBarProps>(function Input
               ref={fileInputRef}
               type="file"
               multiple
-              accept="image/png,image/jpeg,image/gif,image/webp,text/markdown,.md"
+              accept="image/png,image/jpeg,image/gif,image/webp,text/markdown,.md,application/pdf,.pdf"
               onChange={handleFileChange}
               className="hidden"
             />