HKUDS/Vibe-Trading · error · HTTPException

This file type is not allowed for upload.

Error message

This file type is not allowed for upload.

What it means

Uploads are filtered by extension blocklist (_BLOCKED_UPLOAD_EXT) and filename blocklist (_BLOCKED_UPLOAD_NAMES): executables, executable-adjacent source/config/template files, and archives are rejected with 400 before any bytes are stored.

Source

Thrown at agent/src/api/uploads_routes.py:132

            path,
            media_type=media_type,
            headers={"Content-Disposition": f'inline; filename="{shadow_id}.{format}"'},
        )

    @app.post("/upload", dependencies=[Depends(require_auth)])
    async def upload_file(file: UploadFile):
        """Upload any document or data file (max 50MB).

        Accepts most common formats: PDF, Word, Excel, PowerPoint, images,
        CSV/TSV, plain text, JSON, and TOML. Executables, executable-adjacent
        source/config/template files, and archives are rejected.
        """
        if not file.filename:
            raise HTTPException(status_code=400, detail="Missing filename")
        filename = Path(file.filename).name
        ext = Path(filename).suffix.lower()
        if ext in _BLOCKED_UPLOAD_EXT or filename.lower() in _BLOCKED_UPLOAD_NAMES:
            raise HTTPException(
                status_code=400,
                detail="This file type is not allowed for upload.",
            )

        uploads_dir = _host_uploads_dir()
        max_size = _host_max_upload_size()
        chunk_size = _host_chunk_size()

        safe_name = f"{uuid.uuid4().hex}{ext}"
        dest = uploads_dir / safe_name
        total_size = 0

        try:
            uploads_dir.mkdir(parents=True, exist_ok=True)
            with dest.open("wb") as handle:
                while True:
                    chunk = await file.read(chunk_size)
                    if not chunk:

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Upload an allowed document format: PDF, Word, Excel, PowerPoint, images, CSV/TSV, txt, JSON, TOML
2. Extract archives and upload the inner documents individually
3. If you control the deployment and truly need a type, review the blocklist before relaxing it

ALLOWED = {'.pdf','.doc','.docx','.xls','.xlsx','.ppt','.pptx','.png','.jpg','.jpeg','.csv','.tsv','.txt','.json','.toml'}
assert Path(name).suffix.lower() in ALLOWED, 'blocked upload type'

When it happens

Trigger: POST /uploads with a file like tool.exe, archive.zip, script.sh, Makefile, or any extension in the blocked set (e.g. .bat, .py, .j2, .tar.gz).

Common situations: Users trying to upload code or config for analysis, packaging documents into zip first, or double extensions (report.pdf.exe) — the final extension decides.

Related errors

• Missing filename
• Invalid or missing API key
• API_AUTH_KEY is required for non-local API access
• exit_threshold must be below enter_threshold
• invalid shadow_id

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/be2b74f30d3c1853. Report an issue: GitHub.