LibreChat/api/server/services/Files
Danny Avila a21c7944ee
🏷️ fix: Record the Media Type of Saved Images, Not the Declared One (#15606)
`saveBase64Image` recorded the media type declared in the incoming data URL
while persisting bytes that sharp had re-encoded. Those are not always the same
format: sharp rasterizes SVG to PNG, so an image arriving as `image/svg+xml` was
stored as `<id>-<name>.svg`, typed `image/svg+xml`, holding PNG bytes.

That type is not cosmetic. `encode.js` hands `file.type` to providers verbatim —
`media_type` for Anthropic, `inlineData.mimeType` for Google, and the `data:`
prefix for OpenAI — so re-attaching such an image sends PNG bytes under a media
type the provider does not accept for images, and the request fails.

A declared type is also only ever a claim. The same mismatch arises whenever a
producer mislabels what it sends, which for MCP tool output means any connected
server can decide what the record says about bytes it did not have to match.

`resizeImageBuffer` already read the encoded output back to measure it, so it now
resolves that metadata to a media type and returns it, and `saveBase64Image`
records it in place of the declared one, falling back to the declared type only
when sharp reports a format that has no media type of its own. The upload paths
were already correct — they record `image/${imageOutputType}`, the format they
convert to — so this brings the tool-output path in line with them.

`resolveImageMimeType` lives in `packages/api` because AVIF and HEIC share the
heif container and are told apart by its compression, which is worth stating once
with tests rather than open-coding at each call site.
2026-09-04 11:51:28 -04:00
..
Audio 🛂 feat: Filter Model-Bound Content by Source (#14425) 2026-08-21 22:43:32 -04:00
Azure 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
Citations
Code 🌳 feat: List Attached Workspace Trees (#15527) 2026-09-04 10:52:34 -04:00
Firebase 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
images 🏷️ fix: Record the Media Type of Saved Images, Not the Declared One (#15606) 2026-09-04 11:51:28 -04:00
Local 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
OpenAI
VectorDB
index.js
permissions.js 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
permissions.spec.js 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
process.integration.spec.js 🧹 fix: Clean Up Orphaned Agent File Stubs After Deletion (#12781) 2026-04-22 11:35:48 -07:00
process.js 🏷️ fix: Record the Media Type of Saved Images, Not the Declared One (#15606) 2026-09-04 11:51:28 -04:00
process.spec.js 🛂 feat: Filter Model-Bound Content by Source (#14425) 2026-08-21 22:43:32 -04:00
retention.js 📨 feat: Continue Bound Child Agents from Events (#15112) 2026-08-23 01:15:57 -04:00
retention.spec.js 📨 feat: Continue Bound Child Agents from Events (#15112) 2026-08-23 01:15:57 -04:00
saveBase64Image.spec.js 🏷️ fix: Record the Media Type of Saved Images, Not the Declared One (#15606) 2026-09-04 11:51:28 -04:00
strategies.js 🗄️ refactor: Honor All-Data Retention for Agent Files (#13424) 2026-05-30 22:32:22 -04:00