# image_get.py DOX

## Purpose

- Own the `image_get.py` API endpoint.
- This module serves allowed image references and fallback file-type icons.
- Keep this file-level DOX profile synchronized with `image_get.py` because this directory is intentionally flat.

## Ownership

- `image_get.py` owns the runtime implementation.
- `image_get.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation.
- Classes:
- `ImageGet` (`ApiHandler`)
  - `get_methods(cls) -> list[str]`
  - `async process(self, input: dict, request: Request) -> dict | Response`
- Top-level functions:
- `_resolve_allowed_image_path(path: str) -> str`: Resolve a requested image path and keep it inside Agent Zero's base dir.
- `_set_image_headers(response: Response, filename: str, file_ext: str) -> None`
- `_send_file_type_icon(file_ext, filename=...)`: Return appropriate icon for file type
- `_send_fallback_icon(icon_name)`: Return fallback icon from public directory
- Notable constants/configuration names: `IMAGE_EXTENSIONS`, `SVG_EXTENSIONS`, `SVG_CONTENT_SECURITY_POLICY`.

## Runtime Contracts

- HTTP handlers must derive from `helpers.api.ApiHandler`; WebSocket handlers must derive from `helpers.ws.WsHandler`.
- Update this file whenever request payloads, authentication or CSRF requirements, response shapes, route side effects, or WebSocket event contracts change.
- `ImageGet` is an `ApiHandler`.
- `ImageGet` defines `process(...)`.
- `ImageGet` defines `get_methods(...)`.
- Observed side-effect areas: filesystem reads, network calls, subprocess/runtime control, settings/state persistence.
- Imported dependency areas include: `base64`, `helpers`, `helpers.api`, `io`, `mimetypes`, `os`, `pathlib`, `urllib.parse`.

## Key Concepts

- Important called helpers/classes observed in the source: `runtime.is_development`, `Path.resolve`, `candidate.resolve`, `quote`, `_send_fallback_icon`, `files.get_abs_path`, `send_file`, `os.path.splitext.lower`, `os.path.basename`, `Path`, `candidate.is_absolute`, `resolved.relative_to`, `os.path.exists`, `ValueError`, `_set_image_headers`, `_send_file_type_icon`, `files.fix_dev_path`, `_resolve_allowed_image_path`, `files.exists`, `files.get_base_dir`.
- Keep request/response, tool, or helper semantics documented here at the same time as source changes.

## Work Guidance

- Preserve authentication, CSRF, loopback, and API-key checks unless the endpoint contract explicitly changes.
- Update frontend callers, plugin callers, and tests together when payload shape changes.
- Use `helpers.api.Response` for non-JSON responses, files, redirects, or status-specific replies.

## Verification

- Run endpoint-specific or API/WebSocket tests for changed behavior; smoke-test browser callers when no focused test exists.
- Related tests observed by source search:
  - `tests/test_image_get_security.py`

## Child DOX Index

No child DOX files.
