# File Attachments

Drag-and-drop or click to attach files to your messages. **35+ file types** supported with up to **10 files per message** and **50 MB each**. PDFs have text extracted in the default install. DOCX files have text automatically extracted when the document extraction extras are installed, and can be saved to the knowledge base for semantic search.

## Supported File Types

| Category | Extensions |
|---|---|
| **Code** | `.py` `.js` `.ts` `.java` `.c` `.cpp` `.h` `.hpp` `.rs` `.go` `.rb` `.php` `.sh` `.bat` `.ps1` `.sql` `.css` |
| **Data** | `.json` `.yaml` `.yml` `.csv` `.xml` `.toml` `.ini` `.cfg` `.log` |
| **Documents** | `.txt` `.md` `.pdf` `.docx` `.pptx` `.xlsx` `.rtf` |
| **Images** | `.png` `.jpg` `.jpeg` `.gif` `.webp` |

## PDF and Office Text Extraction

PDF text extraction works in the default install. Install DOCX extraction support with:

```bash
pip install anteroom[docs]
```

When extraction succeeds, the extracted text is included directly in the current chat message and the model is told to use that included content. If PDF extraction fails because the install is stale, the file is corrupt, or the PDF is scanned/image-only with no extractable text, Anteroom reports that text could not be extracted automatically. Uploaded attachments are not workspace file paths, so file tools such as `read_file` or `docx` cannot recover the uploaded PDF content.

## Security

Every file is verified with **magic-byte detection** --- a renamed `.exe` won't sneak through as a `.png`. Files must pass both MIME type allowlist and magic-byte verification.

- Image attachments show inline thumbnails with file size
- Non-image files force-download (never rendered in-browser)
- Filenames are sanitized: path components stripped, special characters replaced
- Path traversal attempts are blocked
