feat: create user files from scoped MCP tool artifacts

apps/web/i18n/messages/en-US/errors.json

@@ -268,6 +268,12 @@
     "modelCatalogFetchFailed": "Failed to sync models.dev. The last synced data is kept."
   },
   "mcp": {
+    "fileCreate": {
+      "unauthorized": "The file creation capability is invalid, expired, or revoked.",
+      "conflict": "This capability is bound to another file, or existing content is unavailable.",
+      "resultGone": "The original file creation result is no longer available.",
+      "invalidInput": "Exactly one bounded file is required."
+    },
     "clientUnavailable": "MCP client is unavailable.",
     "imageProcessingFailed": "The MCP image processing tool failed.",
     "invalidAttachmentConfiguration": "Invalid MCP tool attachment configuration.",

apps/web/i18n/messages/zh-CN/errors.json

@@ -268,6 +268,12 @@
     "modelCatalogFetchFailed": "同步 models.dev 失败，已保留上次同步的数据。"
   },
   "mcp": {
+    "fileCreate": {
+      "unauthorized": "文件创建授权无效、已过期或已撤销。",
+      "conflict": "此授权已绑定其他文件，或已有内容不可用。",
+      "resultGone": "原文件创建结果已不可用。",
+      "invalidInput": "必须且只能提交一个符合大小限制的文件。"
+    },
     "clientUnavailable": "MCP 客户端不可用。",
     "imageProcessingFailed": "MCP 图片处理工具执行失败。",
     "invalidAttachmentConfiguration": "MCP 工具附件配置无效。",

backend/README.md

@@ -55,6 +55,7 @@ backend/
 - [项目主 README](../README.md)
 - [前端 README](../apps/web/README.md)
 - `docs/README.md`：后端文档索引
+- [MCP 文件创建委托（Draft 评审契约）](../docs/MCP_FILE_CREATE.md)：默认关闭、每次工具调用一文件的受限上传能力
 - `docs/swagger.json` / `docs/swagger.yaml`：Swagger API 文档
 
 ## 核心约束

backend/docs/docs.go

@@ -14765,6 +14765,94 @@ const docTemplate = `{
                 }
             }
         },
+        "/mcp/servers/{id}/files": {
+            "post": {
+                "description": "仅接受 DEEIX 在 tools/call 签发的一文件 capability，不接受用户 JWT 或 MCP 共享 HMAC 上下文。重复相同文件返回同一 file_id；创建不代表提取或向量化已完成。",
+                "consumes": [
+                    "multipart/form-data"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "mcp"
+                ],
+                "summary": "创建 MCP 工具产物文件",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "登记的 MCP 服务 ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "Bearer \u003cDEEIX-issued file-create token\u003e",
+                        "name": "Authorization",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "file",
+                        "description": "唯一文件，不接受其他字段",
+                        "name": "file",
+                        "in": "formData",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/FileCreateResponseDoc"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "404": {
+                        "description": "Not Found",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "409": {
+                        "description": "Conflict",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "413": {
+                        "description": "Request Entity Too Large",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "429": {
+                        "description": "Too Many Requests",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/McpErrorDoc"
+                        }
+                    }
+                }
+            }
+        },
         "/mcp/tools": {
             "get": {
                 "security": [
@@ -22763,6 +22851,10 @@ const docTemplate = `{
                 "baseURL": {
                     "type": "string"
                 },
+                "fileCreateEnabled": {
+                    "description": "FileCreateEnabled authorizes automatic creation of one user file per persistent tool call.",
+                    "type": "boolean"
+                },
                 "headersJSON": {
                     "type": "string"
                 },
@@ -23727,6 +23819,68 @@ const docTemplate = `{
                 }
             }
         },
+        "FileCreateResponse": {
+            "type": "object",
+            "required": [
+                "embed_status",
+                "extract_status",
+                "file_id",
+                "file_name",
+                "processing_ready",
+                "processing_status",
+                "replayed",
+                "reused",
+                "sha256",
+                "size_bytes"
+            ],
+            "properties": {
+                "embed_status": {
+                    "type": "string"
+                },
+                "extract_status": {
+                    "type": "string"
+                },
+                "file_id": {
+                    "type": "string"
+                },
+                "file_name": {
+                    "type": "string"
+                },
+                "processing_ready": {
+                    "type": "boolean"
+                },
+                "processing_status": {
+                    "type": "string"
+                },
+                "replayed": {
+                    "type": "boolean"
+                },
+                "reused": {
+                    "type": "boolean"
+                },
+                "sha256": {
+                    "type": "string"
+                },
+                "size_bytes": {
+                    "type": "integer"
+                }
+            }
+        },
+        "FileCreateResponseDoc": {
+            "type": "object",
+            "required": [
+                "data",
+                "errorMsg"
+            ],
+            "properties": {
+                "data": {
+                    "$ref": "#/definitions/FileCreateResponse"
+                },
+                "errorMsg": {
+                    "type": "string"
+                }
+            }
+        },
         "FileEmbeddingSkipResponse": {
             "type": "object",
             "required": [
@@ -31062,6 +31216,7 @@ const docTemplate = `{
                 "activeToolCount",
                 "baseURL",
                 "createdAt",
+                "fileCreateEnabled",
                 "headersJSON",
                 "id",
                 "lastError",
@@ -31083,6 +31238,9 @@ const docTemplate = `{
                 "createdAt": {
                     "type": "string"
                 },
+                "fileCreateEnabled": {
+                    "type": "boolean"
+                },
                 "headersJSON": {
                     "type": "string"
                 },