feat: implement file upload feature

backend/src/agents/lead_agent/agent.py

@@ -6,6 +6,7 @@ from src.agents.lead_agent.prompt import apply_prompt_template
 from src.agents.middlewares.clarification_middleware import ClarificationMiddleware
 from src.agents.middlewares.thread_data_middleware import ThreadDataMiddleware
 from src.agents.middlewares.title_middleware import TitleMiddleware
+from src.agents.middlewares.uploads_middleware import UploadsMiddleware
 from src.agents.thread_state import ThreadState
 from src.config.summarization_config import get_summarization_config
 from src.models import create_chat_model
@@ -170,6 +171,7 @@ Being proactive with task management demonstrates thoroughness and ensures all r
 
 
 # ThreadDataMiddleware must be before SandboxMiddleware to ensure thread_id is available
+# UploadsMiddleware should be after ThreadDataMiddleware to access thread_id
 # SummarizationMiddleware should be early to reduce context before other processing
 # TodoListMiddleware should be before ClarificationMiddleware to allow todo management
 # ClarificationMiddleware should be last to intercept clarification requests after model calls
@@ -182,7 +184,7 @@ def _build_middlewares(config: RunnableConfig):
     Returns:
         List of middleware instances.
     """
-    middlewares = [ThreadDataMiddleware(), SandboxMiddleware()]
+    middlewares = [ThreadDataMiddleware(), UploadsMiddleware(), SandboxMiddleware()]
 
     # Add summarization middleware if enabled
     summarization_middleware = _create_summarization_middleware()

backend/src/agents/lead_agent/prompt.py

@@ -104,12 +104,16 @@ You have access to skills that provide optimized workflows for specific tasks. E
 </skill_system>
 
 <working_directory existed="true">
-- User uploads: `/mnt/user-data/uploads`
-- User workspace: `/mnt/user-data/workspace`
-  - subagents: `/mnt/user-data/workspace/subagents`
-- Output files: `/mnt/user-data/outputs`
+- User uploads: `/mnt/user-data/uploads` - Files uploaded by the user (automatically listed in context)
+- User workspace: `/mnt/user-data/workspace` - Working directory for temporary files
+- Output files: `/mnt/user-data/outputs` - Final deliverables must be saved here
 
-All temporary work happens in `/mnt/user-data/workspace`. Final deliverables must be copied to `/mnt/user-data/outputs`.
+**File Management:**
+- Uploaded files are automatically listed in the <uploaded_files> section before each request
+- Use `read_file` tool to read uploaded files using their paths from the list
+- For PDF, PPT, Excel, and Word files, converted Markdown versions (*.md) are available alongside originals
+- All temporary work happens in `/mnt/user-data/workspace`
+- Final deliverables must be copied to `/mnt/user-data/outputs` and presented using `present_file` tool
 </working_directory>
 
 <response_style>

backend/src/agents/middlewares/uploads_middleware.py

@@ -0,0 +1,142 @@
+"""Middleware to inject uploaded files information into agent context."""
+
+import os
+from pathlib import Path
+from typing import NotRequired, override
+
+from langchain.agents import AgentState
+from langchain.agents.middleware import AgentMiddleware
+from langchain_core.messages import SystemMessage
+from langgraph.runtime import Runtime
+
+from src.agents.middlewares.thread_data_middleware import THREAD_DATA_BASE_DIR
+
+
+class UploadsMiddlewareState(AgentState):
+    """State schema for uploads middleware."""
+
+    uploaded_files: NotRequired[list[dict] | None]
+
+
+class UploadsMiddleware(AgentMiddleware[UploadsMiddlewareState]):
+    """Middleware to inject uploaded files information into the agent context.
+
+    This middleware lists all files in the thread's uploads directory and
+    adds a system message with the file list before the agent processes the request.
+    """
+
+    state_schema = UploadsMiddlewareState
+
+    def __init__(self, base_dir: str | None = None):
+        """Initialize the middleware.
+
+        Args:
+            base_dir: Base directory for thread data. Defaults to the current working directory.
+        """
+        super().__init__()
+        self._base_dir = base_dir or os.getcwd()
+
+    def _get_uploads_dir(self, thread_id: str) -> Path:
+        """Get the uploads directory for a thread.
+
+        Args:
+            thread_id: The thread ID.
+
+        Returns:
+            Path to the uploads directory.
+        """
+        return Path(self._base_dir) / THREAD_DATA_BASE_DIR / thread_id / "user-data" / "uploads"
+
+    def _list_uploaded_files(self, thread_id: str) -> list[dict]:
+        """List all files in the uploads directory.
+
+        Args:
+            thread_id: The thread ID.
+
+        Returns:
+            List of file information dictionaries.
+        """
+        uploads_dir = self._get_uploads_dir(thread_id)
+
+        if not uploads_dir.exists():
+            return []
+
+        files = []
+        for file_path in sorted(uploads_dir.iterdir()):
+            if file_path.is_file():
+                stat = file_path.stat()
+                files.append(
+                    {
+                        "filename": file_path.name,
+                        "size": stat.st_size,
+                        "path": f"/mnt/user-data/uploads/{file_path.name}",
+                        "extension": file_path.suffix,
+                    }
+                )
+
+        return files
+
+    def _create_files_message(self, files: list[dict]) -> str:
+        """Create a formatted message listing uploaded files.
+
+        Args:
+            files: List of file information dictionaries.
+
+        Returns:
+            Formatted string listing the files.
+        """
+        if not files:
+            return "<uploaded_files>\nNo files have been uploaded yet.\n</uploaded_files>"
+
+        lines = ["<uploaded_files>", "The following files have been uploaded and are available for use:", ""]
+
+        for file in files:
+            size_kb = file["size"] / 1024
+            if size_kb < 1024:
+                size_str = f"{size_kb:.1f} KB"
+            else:
+                size_str = f"{size_kb / 1024:.1f} MB"
+
+            lines.append(f"- {file['filename']} ({size_str})")
+            lines.append(f"  Path: {file['path']}")
+            lines.append("")
+
+        lines.append("You can read these files using the `read_file` tool with the paths shown above.")
+        lines.append("</uploaded_files>")
+
+        return "\n".join(lines)
+
+    @override
+    def before_agent(self, state: UploadsMiddlewareState, runtime: Runtime) -> dict | None:
+        """Inject uploaded files information before agent execution.
+
+        Args:
+            state: Current agent state.
+            runtime: Runtime context containing thread_id.
+
+        Returns:
+            State updates including uploaded files list.
+        """
+        thread_id = runtime.context.get("thread_id")
+        if thread_id is None:
+            return None
+
+        # List uploaded files
+        files = self._list_uploaded_files(thread_id)
+
+        # Create system message with file list
+        files_message = self._create_files_message(files)
+        system_message = SystemMessage(content=files_message)
+
+        # Inject the message into the message history
+        # This will be added after the system prompt but before user messages
+        messages = list(state.get("messages", []))
+
+        # Insert after the first system message (the main prompt)
+        insert_index = 1 if messages and hasattr(messages[0], "type") and messages[0].type == "system" else 0
+        messages.insert(insert_index, system_message)
+
+        return {
+            "uploaded_files": files,
+            "messages": messages,
+        }

backend/src/agents/thread_state.py

@@ -19,3 +19,4 @@ class ThreadState(AgentState):
     title: NotRequired[str | None]
     artifacts: NotRequired[list[str] | None]
     todos: NotRequired[list | None]
+    uploaded_files: NotRequired[list[dict] | None]

backend/src/gateway/app.py

@@ -5,7 +5,7 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI
 
 from src.gateway.config import get_gateway_config
-from src.gateway.routers import artifacts, mcp, models, skills
+from src.gateway.routers import artifacts, mcp, models, skills, uploads
 
 # Configure logging
 logging.basicConfig(
@@ -84,6 +84,10 @@ This gateway provides custom endpoints for models, MCP configuration, skills, an
                 "name": "artifacts",
                 "description": "Access and download thread artifacts and generated files",
             },
+            {
+                "name": "uploads",
+                "description": "Upload and manage user files for threads",
+            },
             {
                 "name": "health",
                 "description": "Health check and system status endpoints",
@@ -106,6 +110,9 @@ This gateway provides custom endpoints for models, MCP configuration, skills, an
     # Artifacts API is mounted at /api/threads/{thread_id}/artifacts
     app.include_router(artifacts.router)
 
+    # Uploads API is mounted at /api/threads/{thread_id}/uploads
+    app.include_router(uploads.router)
+
     @app.get("/health", tags=["health"])
     async def health_check() -> dict:
         """Health check endpoint.

backend/src/gateway/routers/__init__.py

@@ -1,3 +1,3 @@
-from . import artifacts, mcp, models
+from . import artifacts, mcp, models, skills, uploads
 
-__all__ = ["artifacts", "mcp", "models"]
+__all__ = ["artifacts", "mcp", "models", "skills", "uploads"]

backend/src/gateway/routers/uploads.py

@@ -0,0 +1,210 @@
+"""Upload router for handling file uploads."""
+
+import logging
+import os
+from pathlib import Path
+
+from fastapi import APIRouter, File, HTTPException, UploadFile
+from pydantic import BaseModel
+
+from src.agents.middlewares.thread_data_middleware import THREAD_DATA_BASE_DIR
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/threads/{thread_id}/uploads", tags=["uploads"])
+
+# File extensions that should be converted to markdown
+CONVERTIBLE_EXTENSIONS = {
+    ".pdf",
+    ".ppt",
+    ".pptx",
+    ".xls",
+    ".xlsx",
+    ".doc",
+    ".docx",
+}
+
+
+class UploadResponse(BaseModel):
+    """Response model for file upload."""
+
+    success: bool
+    files: list[dict[str, str]]
+    message: str
+
+
+def get_uploads_dir(thread_id: str) -> Path:
+    """Get the uploads directory for a thread.
+
+    Args:
+        thread_id: The thread ID.
+
+    Returns:
+        Path to the uploads directory.
+    """
+    base_dir = Path(os.getcwd()) / THREAD_DATA_BASE_DIR / thread_id / "user-data" / "uploads"
+    base_dir.mkdir(parents=True, exist_ok=True)
+    return base_dir
+
+
+async def convert_file_to_markdown(file_path: Path) -> Path | None:
+    """Convert a file to markdown using markitdown.
+
+    Args:
+        file_path: Path to the file to convert.
+
+    Returns:
+        Path to the markdown file if conversion was successful, None otherwise.
+    """
+    try:
+        from markitdown import MarkItDown
+
+        md = MarkItDown()
+        result = md.convert(str(file_path))
+
+        # Save as .md file with same name
+        md_path = file_path.with_suffix(".md")
+        md_path.write_text(result.text_content, encoding="utf-8")
+
+        logger.info(f"Converted {file_path.name} to markdown: {md_path.name}")
+        return md_path
+    except Exception as e:
+        logger.error(f"Failed to convert {file_path.name} to markdown: {e}")
+        return None
+
+
+@router.post("", response_model=UploadResponse)
+async def upload_files(
+    thread_id: str,
+    files: list[UploadFile] = File(...),
+) -> UploadResponse:
+    """Upload multiple files to a thread's uploads directory.
+
+    For PDF, PPT, Excel, and Word files, they will be converted to markdown using markitdown.
+    All files (original and converted) are saved to /mnt/user-data/uploads.
+
+    Args:
+        thread_id: The thread ID to upload files to.
+        files: List of files to upload.
+
+    Returns:
+        Upload response with success status and file information.
+    """
+    if not files:
+        raise HTTPException(status_code=400, detail="No files provided")
+
+    uploads_dir = get_uploads_dir(thread_id)
+    uploaded_files = []
+
+    for file in files:
+        if not file.filename:
+            continue
+
+        try:
+            # Save the original file
+            file_path = uploads_dir / file.filename
+            content = await file.read()
+            file_path.write_bytes(content)
+
+            # Build relative path from backend root
+            relative_path = f".deer-flow/threads/{thread_id}/user-data/uploads/{file.filename}"
+
+            file_info = {
+                "filename": file.filename,
+                "size": str(len(content)),
+                "path": relative_path,  # Actual filesystem path (relative to backend/)
+                "virtual_path": f"/mnt/user-data/uploads/{file.filename}",  # Path for Agent in sandbox
+                "artifact_url": f"/api/threads/{thread_id}/artifacts/mnt/user-data/uploads/{file.filename}",  # HTTP URL
+            }
+
+            logger.info(f"Saved file: {file.filename} ({len(content)} bytes) to {relative_path}")
+
+            # Check if file should be converted to markdown
+            file_ext = file_path.suffix.lower()
+            if file_ext in CONVERTIBLE_EXTENSIONS:
+                md_path = await convert_file_to_markdown(file_path)
+                if md_path:
+                    md_relative_path = f".deer-flow/threads/{thread_id}/user-data/uploads/{md_path.name}"
+                    file_info["markdown_file"] = md_path.name
+                    file_info["markdown_path"] = md_relative_path
+                    file_info["markdown_virtual_path"] = f"/mnt/user-data/uploads/{md_path.name}"
+                    file_info["markdown_artifact_url"] = f"/api/threads/{thread_id}/artifacts/mnt/user-data/uploads/{md_path.name}"
+
+            uploaded_files.append(file_info)
+
+        except Exception as e:
+            logger.error(f"Failed to upload {file.filename}: {e}")
+            raise HTTPException(status_code=500, detail=f"Failed to upload {file.filename}: {str(e)}")
+
+    return UploadResponse(
+        success=True,
+        files=uploaded_files,
+        message=f"Successfully uploaded {len(uploaded_files)} file(s)",
+    )
+
+
+@router.get("/list", response_model=dict)
+async def list_uploaded_files(thread_id: str) -> dict:
+    """List all files in a thread's uploads directory.
+
+    Args:
+        thread_id: The thread ID to list files for.
+
+    Returns:
+        Dictionary containing list of files with their metadata.
+    """
+    uploads_dir = get_uploads_dir(thread_id)
+
+    if not uploads_dir.exists():
+        return {"files": [], "count": 0}
+
+    files = []
+    for file_path in sorted(uploads_dir.iterdir()):
+        if file_path.is_file():
+            stat = file_path.stat()
+            relative_path = f".deer-flow/threads/{thread_id}/user-data/uploads/{file_path.name}"
+            files.append(
+                {
+                    "filename": file_path.name,
+                    "size": stat.st_size,
+                    "path": relative_path,  # Actual filesystem path (relative to backend/)
+                    "virtual_path": f"/mnt/user-data/uploads/{file_path.name}",  # Path for Agent in sandbox
+                    "artifact_url": f"/api/threads/{thread_id}/artifacts/mnt/user-data/uploads/{file_path.name}",  # HTTP URL
+                    "extension": file_path.suffix,
+                    "modified": stat.st_mtime,
+                }
+            )
+
+    return {"files": files, "count": len(files)}
+
+
+@router.delete("/{filename}")
+async def delete_uploaded_file(thread_id: str, filename: str) -> dict:
+    """Delete a file from a thread's uploads directory.
+
+    Args:
+        thread_id: The thread ID.
+        filename: The filename to delete.
+
+    Returns:
+        Success message.
+    """
+    uploads_dir = get_uploads_dir(thread_id)
+    file_path = uploads_dir / filename
+
+    if not file_path.exists():
+        raise HTTPException(status_code=404, detail=f"File not found: {filename}")
+
+    # Security check: ensure the path is within the uploads directory
+    try:
+        file_path.resolve().relative_to(uploads_dir.resolve())
+    except ValueError:
+        raise HTTPException(status_code=403, detail="Access denied")
+
+    try:
+        file_path.unlink()
+        logger.info(f"Deleted file: {filename}")
+        return {"success": True, "message": f"Deleted {filename}"}
+    except Exception as e:
+        logger.error(f"Failed to delete {filename}: {e}")
+        raise HTTPException(status_code=500, detail=f"Failed to delete {filename}: {str(e)}")