Add a shared file malware-scanning module and use it in the Classic
Knowledge Base, RAG Pipeline local files and the Agent Knowledge Base.
- core/file_scan: scanner adapters for ClamAV (deployment-configured),
Cloudmersive, Scanii, OPSWAT MetaDefender Cloud and API-based
extensions (new `file.malware_scan` extension point).
- services/file_scan: FileScanService is the single entry point other
modules call. Providers are workspace-wide; a policy belongs to a
scope (dataset, knowledge_fs_space), so further modules can adopt
scanning without schema changes.
- Each file is scanned on its own: a rejected file fails only its own
document. Malware always blocks and deletes the stored original;
invalid credentials and exhausted quota stop processing regardless of
the "allow" fallback.
- Console: workspace scanner management and a per-knowledge-base
policy section in both settings forms; the Agent Knowledge Base
upload keeps going after a rejected file and explains each failure.
- Off by default behind FILE_SCAN_ENABLED.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
JyongandClaude Fable 5.2
FFXNandautofix-ci[bot]
yyhandClaude
Jyong
Stephen Zhouandautofix-ci[bot]
