AI Can Now Add Images to the Online Whiteboard
The local CLI and stdio MCP can upload, download, and append real images in the current room. Production fixes now pass only exact image uploads and Yjs scene updates into full Agent authorization; other origins, paths, methods, and MIME types remain rejected, and remote MCP remains undeployed.
# AI Can Now Add Images to the Online Whiteboard
Phase five of the AI capability layer completes a real-image loop for Online Whiteboard. The local CLI and stdio MCP can upload and download current-room images, then append a verified asset through a high-level `image` element.
## Image operations
- Inputs are limited to PNG, JPEG, or WebP files up to 5 MiB whose container boundaries, critical chunks or segments, declared dimensions, and pixel limits pass strict checks; this does not claim full pixel decoding.
- Uploads use an operation ID plus the image SHA-256 for idempotency. Identical bytes can be retried safely; reusing the ID for different bytes conflicts.
- Downloads never overwrite an existing file by default. The stdio MCP also enforces allow-root, real-path, and regular-file checks, while tool output omits local paths and internal room identifiers.
## Authorization and room isolation
`whiteboard:assets` is a separate, non-default permission. Upload requires it together with `whiteboard:write`; raw image download requires it plus scene read, which write already satisfies. A token-bound room credential is still required in addition to the Agent Bearer. Images remain in the current room's private R2 namespace and cannot be referenced across rooms.
## Still append-only
The server accepts only current-room images whose storage commit is complete and whose metadata matches field by field. A write-only caller, pending asset, URL, Base64 data, SVG, HTML, forged metadata, orphan asset record, modification or deletion of existing data, link, binding, or arbitrary Yjs input is rejected. One canonical asset may be placed more than once. Simplified Agent SVG and PNG exports still omit image bytes and report a warning.
## Production entry-point fix
Initial production checks found that the Pages mutation gate omitted the Agent image-upload path, causing safe raster requests to return 415 before Bearer authorization. Version 1.0.6 passes only exact `POST /api/whiteboard/agent/assets` PNG, JPEG, and WebP requests into full Agent authorization.
The subsequent authorized production loop found that the same gate also omitted the Yjs media type used by Agent scene updates. Version 1.0.7 skips the JSON gate only for exact `POST /api/whiteboard/agent/scene` requests with `Content-Type: application/vnd.yjs-update`. Same-origin validation still runs first, followed by the existing Agent Bearer, write scope, token-bound room credential, operation ID, body limit, and append-only scene checks. As with the raster exception, cross-origin requests, adjacent paths, non-POST methods, and other MIME types remain fail-closed.
Online Whiteboard is now version 1.0.7. Quick Transfer remains 1.0.6 with no transfer-protocol change. The separate remote MCP Worker remains undeployed.
