The Custom Endpoint scanner no longer goes through API-based extensions.
A workspace enters the endpoint URL and an API key in the scanner dialog,
and the endpoint receives the file content directly instead of a signed
download link.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Add a shared file malware-scanning module and use it in the Classic
Knowledge Base, RAG Pipeline local files and the Agent Knowledge Base.
- core/file_scan: scanner adapters for ClamAV (deployment-configured),
Cloudmersive, Scanii, OPSWAT MetaDefender Cloud and API-based
extensions (new `file.malware_scan` extension point).
- services/file_scan: FileScanService is the single entry point other
modules call. Providers are workspace-wide; a policy belongs to a
scope (dataset, knowledge_fs_space), so further modules can adopt
scanning without schema changes.
- Each file is scanned on its own: a rejected file fails only its own
document. Malware always blocks and deletes the stored original;
invalid credentials and exhausted quota stop processing regardless of
the "allow" fallback.
- Console: workspace scanner management and a per-knowledge-base
policy section in both settings forms; the Agent Knowledge Base
upload keeps going after a rejected file and explains each failure.
- Off by default behind FILE_SCAN_ENABLED.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
JyongandClaude Fable 5.2
-LAN-
longbingljw
yihong
jiangbo721and刘江波
Bowen Liangand-LAN-
Jyong
Garfield Daiandtakatost