feat(static-file): add conversation workspace file serving with pluggable access guard

Introduces a framework-agnostic static file service (aionui-static-file) with:
- Pluggable async access guard for authorization decisions
- HTTP Range request support for video/PDF seeking
- Path traversal prevention with canonicalize sandbox
- 256MB file size limit
- ETag generation from mtime + file size

Exposes endpoint: GET /api/conversations/{id}/files/{*path}
Extracts has_traversal to aionui-common for single source of truth.
Includes 9 E2E integration tests and 17 unit tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zhuqingyu-netizen

Cargo.lock

@@ -10,6 +10,7 @@ members = [
     "crates/aionui-auth",
     "crates/aionui-system",
     "crates/aionui-file",
+    "crates/aionui-static-file",
     "crates/aionui-office",
     "crates/aionui-shell",
     "crates/aionui-ai-agent",
@@ -39,6 +40,7 @@ aionui-runtime = { path = "crates/aionui-runtime" }
 aionui-auth = { path = "crates/aionui-auth" }
 aionui-system = { path = "crates/aionui-system" }
 aionui-file = { path = "crates/aionui-file" }
+aionui-static-file = { path = "crates/aionui-static-file" }
 aionui-office = { path = "crates/aionui-office" }
 aionui-shell = { path = "crates/aionui-shell" }
 aionui-ai-agent = { path = "crates/aionui-ai-agent" }
@@ -118,6 +120,9 @@ dirs = "6"
 # Regex
 regex = "1"
 
+# Async stream utilities
+tokio-util = { version = "0.7", features = ["io"] }
+
 # File system
 include_dir = "0.7"
 notify = "8"

Cargo.toml

@@ -28,6 +28,7 @@ aionui-shell.workspace = true
 aionui-ai-agent.workspace = true
 aionui-mcp.workspace = true
 aionui-conversation.workspace = true
+aionui-static-file.workspace = true
 aionui-extension.workspace = true
 aionui-channel.workspace = true
 aionui-team.workspace = true

crates/aionui-app/Cargo.toml

@@ -32,7 +32,10 @@ use aionui_auth::{
 use aionui_channel::weixin_login_route;
 use aionui_channel::{ChannelRouterState, channel_routes};
 use aionui_common::OnConversationDelete;
-use aionui_conversation::{ConversationRouterState, conversation_ops_routes, conversation_routes};
+use aionui_conversation::{
+    ConversationRouterState, StaticFileRouterState, conversation_ops_routes, conversation_routes,
+    conversation_static_file_routes,
+};
 use aionui_cron::{CronRouterState, cron_routes};
 use aionui_db::{
     Database, IAcpSessionRepository, IAgentMetadataRepository, IConversationRepository, IUserRepository,
@@ -341,6 +344,7 @@ pub struct ModuleStates {
     pub cron: CronRouterState,
     pub office: OfficeRouterState,
     pub shell: ShellRouterState,
+    pub static_file: StaticFileRouterState,
     pub assistant: AssistantRouterState,
 }
 
@@ -529,6 +533,10 @@ pub fn create_router_with_all_state(services: &AppServices, states: ModuleStates
     let assistant_authenticated =
         assistant_routes(states.assistant).route_layer(from_fn_with_state(auth_mw_state.clone(), auth_middleware));
 
+    // Static file serving for conversation workspaces, protected by auth
+    let static_file_authenticated = conversation_static_file_routes(states.static_file)
+        .route_layer(from_fn_with_state(auth_mw_state.clone(), auth_middleware));
+
     // Guide MCP diagnostic endpoint protected by auth middleware
     let guide_mcp_authenticated = Router::new()
         .route("/api/system/guide-mcp", get(guide_mcp_status))
@@ -563,6 +571,7 @@ pub fn create_router_with_all_state(services: &AppServices, states: ModuleStates
         .merge(office_authenticated)
         .merge(shell_authenticated)
         .merge(assistant_authenticated)
+        .merge(static_file_authenticated)
         .merge(guide_mcp_authenticated);
 
     // Conditionally merge WeChat login SSE route (feature-gated)

crates/aionui-app/src/lib.rs

@@ -4,7 +4,8 @@ use aionui_ai_agent::{AgentRouterState, AgentService, RemoteAgentRouterState, Re
 use aionui_assistant::{AssistantRouterState, AssistantService, BuiltinAssistantRegistry};
 use aionui_auth::extract_token_from_ws_headers;
 use aionui_channel::ChannelRouterState;
-use aionui_conversation::{ConversationRouterState, ConversationService};
+use aionui_conversation::{ConversationRouterState, ConversationService, StaticFileRouterState};
+use aionui_static_file::StaticFileService;
 use aionui_cron::{CronEventEmitter, CronRouterState};
 use aionui_db::{
     IAcpSessionRepository, IAgentMetadataRepository, IAssistantOverrideRepository, IAssistantRepository,
@@ -85,9 +86,15 @@ pub async fn build_module_states(services: &AppServices) -> (ModuleStates, Chann
 
     let agent_service = AgentService::new(services.agent_registry.clone(), services.data_dir.clone());
 
+    let conversation_state = build_conversation_state(services, Some(cron.cron_service.clone()));
+    let static_file = StaticFileRouterState {
+        conversation_service: conversation_state.service.clone(),
+        static_file_service: Arc::new(StaticFileService::permissive()),
+    };
+
     let states = ModuleStates {
         system: build_system_state(services),
-        conversation: build_conversation_state(services, Some(cron.cron_service.clone())),
+        conversation: conversation_state,
         remote_agent: build_remote_agent_state(services),
         agent: AgentRouterState {
             agent_registry: services.agent_registry.clone(),
@@ -110,6 +117,7 @@ pub async fn build_module_states(services: &AppServices) -> (ModuleStates, Chann
         office: build_office_state(services),
         shell: build_shell_state(services),
         assistant,
+        static_file,
     };
 
     (states, channel_components)