Prepare 1.16.0 release

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/workflow.yml

@@ -16,8 +16,8 @@ jobs:
     name: Unit testing and linting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@1.93.0
       - name: Install SQLite3
         run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
       - run: cargo test --all-features
@@ -30,7 +30,7 @@ jobs:
     steps:
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/${{ github.repository }}
@@ -56,16 +56,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Log in to the GitHub Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           tags: |
             type=raw,value=latest,enable=${{ github.ref_name == 'main' }}
@@ -77,7 +77,7 @@ jobs:
             ghcr.io/${{ github.repository }}
 
       - name: Build and push Docker images
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
@@ -95,7 +95,7 @@ jobs:
 
     steps:
       - name: Log in to the GitHub Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

CHANGELOG.md

@@ -1,3 +1,36 @@
+# (2026-03-20) Version 1.16.0
+
+- (**Feature**) Add support for file attachments (`m.file` Matrix messages) in conversations. Files like PDFs, text documents, spreadsheets, code files, etc. are now downloaded and forwarded to the LLM alongside the conversation context, similar to how images (`m.image`) are already handled. See the [💬 Text Generation](./docs/features.md#-text-generation) documentation for details and known limitations.
+
+- (**Improvement**) Use the [mime_guess](https://crates.io/crates/mime_guess) crate for MIME type detection from file extensions, replacing a hand-maintained mapping. This covers hundreds of file extensions out of the box.
+
+
+
+# (2026-03-07) Version 1.15.0
+
+- (**Feature**) Add support for authentication via access tokens (for [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service)/OIDC-enabled homeservers) as an alternative to password authentication. See [🔐 Authentication](./docs/configuration/authentication.md) for setup details. Thanks to [Taylor Southwick](https://github.com/twsouthwick) for the contribution in [#83](https://github.com/etkecc/baibot/pull/83)!
+
+- (**Internal Improvement**) Pin the Rust toolchain to `1.93.0` in both CI and local development to avoid `matrix-sdk` build failures on newer stable toolchains.
+
+- (**Internal Improvement**) Documentation updates.
+
+- (**Internal Improvement**) Dependency updates.
+
+
+# (2026-02-18) Version 1.14.3
+
+- (**Internal Improvement**) Add [Renovate](https://docs.renovatebot.com/) configuration for automated dependency updates
+
+- (**Internal Improvement**) Dependency updates
+
+
+# (2026-02-18) Version 1.14.2
+
+- (**Internal Improvement**) Dependency updates
+
+- (**Internal Improvement**) Reorganize the development environment to support [Continuwuity](https://continuwuity.org/) as a homeserver choice (in addition to [Synapse](https://github.com/element-hq/synapse)). Continuwuity is now the default for its lighter footprint (no external database required). See [development docs](./docs/development.md) for details.
+
+
 # (2026-02-10) Version 1.14.1
 
 - (**Security**) Dependency updates to fix security vulnerabilities ([time](https://crates.io/crates/time) stack exhaustion DoS, [bytes](https://crates.io/crates/bytes) integer overflow), via [mxlink](https://crates.io/crates/mxlink) 1.12.0

Cargo.toml

@@ -7,7 +7,7 @@ license = "AGPL-3.0-or-later"
 readme = "README.md"
 keywords = ["matrix", "chat", "bot", "AI", "LLM"]
 include = ["/etc/assets/baibot-torso-768.png", "/src", "/README.md", "/CHANGELOG.md", "/LICENSE"]
-version = "1.14.1"
+version = "1.16.0"
 edition = "2024"
 
 [lib]
@@ -17,7 +17,7 @@ path = "src/lib.rs"
 [dependencies]
 anthropic = { git = "https://github.com/etkecc/anthropic-rs.git", branch = "fix-content-block-image" }
 anyhow = "1.0.*"
-async-openai = { version = "0.32.4", features = ["audio", "chat-completion", "image", "responses"] }
+async-openai = { version = "0.33.0", features = ["audio", "chat-completion", "image", "responses"] }
 base64 = "0.22.*"
 chrono = { version = "0.4.*", default-features = false, features = ["std", "now"] }
 # We'd rather not depend on this, but we cannot use the ruma-events EventContent macro without it.
@@ -25,16 +25,16 @@ chrono = { version = "0.4.*", default-features = false, features = ["std", "now"
 matrix-sdk = { version = "0.16.0", default-features = false, features = ["native-tls"] }
 mime_guess = "2.0.*"
 mxidwc = "1.0.*"
-mxlink = ">=1.12.0"
+mxlink = ">=1.13.0"
 etke_openai_api_rust = "0.1.*"
 quick_cache = "0.6.*"
 regex = "1.12.*"
 serde = { version = "1.0.*", features = ["derive"], default-features = false }
 serde_json = "1.0.*"
 serde_yaml_ng = "0.10.*"
-tempfile = "3.25.*"
+tempfile = "3.27.*"
 tiktoken-rs = { version = "0.9.*", default-features = false }
-tokio = { version = "1.49.*", features = ["rt", "rt-multi-thread", "macros"] }
+tokio = { version = "1.50.*", features = ["rt", "rt-multi-thread", "macros"] }
 tracing = "0.1.*"
 tracing-subscriber = { version = "0.3.*", features = ["env-filter"] }
 url = "2.5.*"

Dockerfile

@@ -4,7 +4,7 @@
 #                                     #
 #######################################
 
-FROM docker.io/rust:1.93.0-slim-trixie AS build
+FROM docker.io/rust:1.93.1-slim-trixie AS build
 
 RUN apt-get update && apt-get install -y build-essential pkg-config libssl-dev libsqlite3-dev
 

Dockerfile.ci

@@ -4,7 +4,7 @@
 #                                     #
 #######################################
 
-FROM docker.io/rust:1.93.0-slim-trixie AS build
+FROM docker.io/rust:1.93.1-slim-trixie AS build
 
 RUN apt-get update && apt-get install -y build-essential pkg-config libssl-dev libsqlite3-dev
 

docs/configuration/README.md

@@ -22,6 +22,8 @@ You can see the list of supported environment variables in the [🦀 src/entity/
 > [!WARNING]
 > The static configuration contains an `initial_global_config` key, which is used to populate the bot's global configuration (stored as [dynamic configuration](#dynamic-configuration)) the first time the bot starts. Modifying this subsequently will not have any effect. After initial global configuration creation, it's expected to be managed dynamically via chat commands.
 
+For Matrix-account authentication setup, see [🔐 Authentication](./authentication.md).
+
 
 ### Dynamic configuration
 

docs/configuration/authentication.md

@@ -0,0 +1,23 @@
+## 🔐 Authentication
+
+baibot supports 2 authentication modes for the Matrix account (`user.*` keys in config).
+
+Set **exactly one** mode. If both are set (or neither is set), startup validation fails.
+
+### Password authentication
+
+- Config key: `user.password`
+- Environment variable: `BAIBOT_USER_PASSWORD`
+
+### Access token authentication
+
+- Config keys: `user.access_token` + `user.device_id`
+- Environment variables: `BAIBOT_USER_ACCESS_TOKEN` + `BAIBOT_USER_DEVICE_ID`
+
+Access-token authentication is useful for OIDC-enabled homeservers (e.g. those using [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service)).
+
+Example token-generation command:
+
+```sh
+mas-cli manage issue-compatibility-token <username> [device_id]
+```

docs/configuration/handlers.md

@@ -8,7 +8,7 @@ You can also use **different models within the same room** (e.g. [💬 text-gene
 
 The bot supports the following use-purposes:
 
-- [💬 text-generation](../features.md#-text-generation): communicating with you via text (though certain models may "see" images as well)
+- [💬 text-generation](../features.md#-text-generation): communicating with you via text (though certain models may also process images and files)
 - [🦻 speech-to-text](../features.md#-speech-to-text): turning your voice messages into text
 - [🗣️ text-to-speech](../features.md#️-text-to-speech): turning bot or users text messages into voice messages
 - [🖌️ image-generation](../features.md#image-generation): generating images based on instructions

docs/development.md

@@ -18,6 +18,27 @@ For local development, we run all dependency services in [🐋 Docker](https://w
 - (Optional) an API key for some Large Language Model [☁️ provider](./providers.md) (e.g. [OpenAI](./providers.md#openai)), though we recommend using [LocalAI](#localai) or [Ollama](#ollama) for local development
 
 
+### Choosing a homeserver
+
+The development environment supports two homeserver implementations:
+
+- **[Continuwuity](https://continuwuity.org/)** (default) — lightweight, no external database required. Good for most development needs.
+- **[Synapse](https://github.com/element-hq/synapse)** — the reference implementation, bundled with Postgres. Use this if you need Synapse-specific behavior.
+
+To choose a homeserver (optional — defaults to Continuwuity if skipped):
+
+```sh
+just homeserver-init continuwuity  # or: just homeserver-init synapse
+```
+
+The choice is stored in `var/homeserver` and affects all subsequent commands.
+
+> **Note:** If you switch homeservers after initial setup, you will need to:
+> - Delete `var/app/local/` and/or `var/app/container/` (app config and data)
+> - Delete `var/services/element-web/` (to regenerate its config)
+> - Re-run the prepare and user registration steps
+
+
 ### Getting started guide
 
 Developing [locally](#running-locally) is possible, but requires a [Rust](https://www.rust-lang.org/) toolchain.
@@ -28,11 +49,12 @@ In any case, you will need [🐋 Docker](https://www.docker.com/) as [dependency
 
 #### Running locally
 
-1. Start the core dependency services (Postgres, Synapse, Element Web): `just services-start`
-2. (Only the first time around) Prepare initial app configuration in `var/app/local/config.yml`: `just app-local-prepare`
-3. (Only the first time around) [Prepare your configuration file](#prepare-your-configuration-file)
-4. (Only the first time around) Prepare initial default Matrix user accounts (`admin` and `baibot`): `just users-prepare`
-5. (Optional) Start additional services depending on which [agent provider you've chosen](#choosing-an-agent-provider):
+1. (Optional) Choose a homeserver: `just homeserver-init continuwuity` (or `synapse`). Default is `continuwuity`.
+2. Start the homeserver and Element Web: `just services-start`
+3. (Only the first time around) Prepare initial app configuration in `var/app/local/config.yml`: `just app-local-prepare`
+4. (Only the first time around) [Prepare your configuration file](#prepare-your-configuration-file)
+5. (Only the first time around) Prepare initial default Matrix user accounts (`admin` and `baibot`): `just users-prepare`
+6. (Optional) Start additional services depending on which [agent provider you've chosen](#choosing-an-agent-provider):
   - for [LocalAI](#localai):
     - Start services: `just localai-start`
 	- Wait a while for LocalAI to start up. It has a lot of models to download. Monitor progress using `just localai-tail-logs`
@@ -40,12 +62,12 @@ In any case, you will need [🐋 Docker](https://www.docker.com/) as [dependency
   - for [Ollama](#ollama):
     - Start services: `just ollama-start`
     - (Only the first time around) Pull the model configured in `agents.static_definitions` in the configuration file: `just ollama-pull-model gemma2:2b`
-6. Start the bot: `just run-locally`
-7. Go to http://element.127.0.0.1.nip.io:42025/ and login with `admin` / `admin`
-8. Create a new room and invite `@baibot:synapse.127.0.0.1.nip.io`
-9. When done, stop the bot (`Ctrl` + `C`)
-10. Stop the core dependency services: `just services-stop`
-11. (Optional) Stop additional services:
+7. Start the bot: `just run-locally`
+8. Go to http://element.127.0.0.1.nip.io:42025/ and login with `admin` / `admin`
+9. Create a new room and invite `@baibot:continuwuity.127.0.0.1.nip.io` (or `@baibot:synapse.127.0.0.1.nip.io` if using Synapse)
+10. When done, stop the bot (`Ctrl` + `C`)
+11. Stop the services: `just services-stop`
+12. (Optional) Stop additional services:
   - for [LocalAI](#localai): `just localai-stop`
   - for [Ollama](#ollama): `just ollama-stop`
 
@@ -54,11 +76,12 @@ In any case, you will need [🐋 Docker](https://www.docker.com/) as [dependency
 
 You can avoid having a [Rust](https://www.rust-lang.org/) toolchain installed locally and build/run this in a container.
 
-1. Start the core dependency services (Postgres, Synapse, Element Web): `just services-start`
-2. (Only the first time around) Prepare initial app configuration in `var/app/container/config.yml`: `just app-container-prepare`
-3. (Only the first time around) [Prepare your configuration file](#prepare-your-configuration-file)
-4. (Only the first time around) Prepare initial default Matrix user accounts (`admin` and `baibot`): `just users-prepare`
-5. (Optional) Start additional services depending on which [agent provider you've chosen](#choosing-an-agent-provider):
+1. (Optional) Choose a homeserver: `just homeserver-init continuwuity` (or `synapse`). Default is `continuwuity`.
+2. Start the homeserver and Element Web: `just services-start`
+3. (Only the first time around) Prepare initial app configuration in `var/app/container/config.yml`: `just app-container-prepare`
+4. (Only the first time around) [Prepare your configuration file](#prepare-your-configuration-file)
+5. (Only the first time around) Prepare initial default Matrix user accounts (`admin` and `baibot`): `just users-prepare`
+6. (Optional) Start additional services depending on which [agent provider you've chosen](#choosing-an-agent-provider):
   - for [LocalAI](#localai):
     - Start services: `just localai-start`
 	- Wait a while for LocalAI to start up. It has a lot of models to download. Monitor progress using `just localai-tail-logs`
@@ -66,12 +89,12 @@ You can avoid having a [Rust](https://www.rust-lang.org/) toolchain installed lo
   - for [Ollama](#ollama):
     - Start services: `just ollama-start`
     - (Only the first time around) Pull the model configured in `agents.static_definitions` in the configuration file: `just ollama-pull-model gemma2:2b`
-6. Start the bot: `just run-in-container`
-7. Go to http://element.127.0.0.1.nip.io:42025/ and login with `admin` / `admin`
-8. Create a new room and invite `@baibot:synapse.127.0.0.1.nip.io`
-9. When done, stop the bot (`Ctrl` + `C`)
-10. Stop the dependency services: `just services-stop`
-11. (Optional) Stop additional services:
+7. Start the bot: `just run-in-container`
+8. Go to http://element.127.0.0.1.nip.io:42025/ and login with `admin` / `admin`
+9. Create a new room and invite `@baibot:continuwuity.127.0.0.1.nip.io` (or `@baibot:synapse.127.0.0.1.nip.io` if using Synapse)
+10. When done, stop the bot (`Ctrl` + `C`)
+11. Stop the services: `just services-stop`
+12. (Optional) Stop additional services:
   - for [LocalAI](#localai): `just localai-stop`
   - for [Ollama](#ollama): `just ollama-stop`
 

docs/features.md

@@ -8,7 +8,7 @@ You can also use **different models within the same room** (e.g. [💬 text-gene
 
 The bot supports the following use-purposes:
 
-- [💬 text-generation](#-text-generation): communicating with you via text (though certain models may "see" images as well)
+- [💬 text-generation](#-text-generation): communicating with you via text (though certain models may also process images and files)
 - [🦻 speech-to-text](#-speech-to-text): turning your voice messages into text
 - [🗣️ text-to-speech](#%EF%B8%8F-text-to-speech): turning bot or users text messages into voice messages
 - [🖌️ image-generation](#%EF%B8%8F-image-generation): generating images based on instructions
@@ -26,7 +26,7 @@ Text Generation is the bot's ability to **respond to users' messages with text**
 
 ![Screenshot of Text Generation - a user sends a message and the bot replies in a new conversation thread](./screenshots/text-generation.webp)
 
-Some models also support vision, so you may be able to mix text and images in the same conversation.
+Some models also support vision and document understanding, so you may be able to mix text, images, and files (PDFs, text documents, etc.) in the same conversation. Note that certain providers may not support all file types or may have issues with specific files (e.g. scanned/image-based PDFs). If a file is rejected by the provider, the conversation thread may become unusable — start a new thread to work around this.
 
 In multi-user (group) rooms, to avoid disturbing the normal conversation between people, the bot is auto-configured to only respond to messages starting with the command prefix (`!bai`) or direct mentions via the [💬 Text Generation / 🗟 Prefix Requirement Type](./configuration/text-generation.md#-prefix-requirement-type) setting.
 

docs/sample-provider-configs/openai.yml

@@ -1,7 +1,7 @@
 base_url: https://api.openai.com/v1
 api_key: YOUR_API_KEY_HERE
 text_generation:
-  model_id: gpt-5.2
+  model_id: gpt-5.4
   prompt: "You are a brief, but helpful bot called {{ baibot_name }} powered by the {{ baibot_model_id }} model. The date/time of this conversation's start is: {{ baibot_conversation_start_time_utc }}."
   temperature: 1.0
   # Reasoning models need to use `max_completion_tokens` instead of `max_response_tokens`.

docs/usage.md

@@ -11,7 +11,7 @@ This is related to the [💬 Text Generation](./features.md#-text-generation) fe
 
 If there's a text-generation handler agent configured, the bot **may** respond to messages sent in the room.
 
-Some models also support vision, so you may be able to mix text and images in the same conversation.
+Some models also support vision and document understanding, so you may be able to mix text, images, and files (PDFs, text documents, etc.) in the same conversation.
 
 See screenshots of:
 

etc/app/config.yml.dist

@@ -1,12 +1,21 @@
 homeserver:
   # The canonical homeserver domain name
-  server_name: synapse.127.0.0.1.nip.io
-  url: http://synapse.127.0.0.1.nip.io:42020
+  server_name: __HOMESERVER_SERVER_NAME__
+  url: __HOMESERVER_URL__
 
 user:
   mxid_localpart: baibot
+
+  # Authentication: set EITHER password OR access_token + device_id.
+  #
+  # Password-based login (traditional homeservers):
   password: baibot
 
+  # Access token login (for Matrix Authentication Service/OIDC-enabled homeservers):
+  # Generate a token via: mas-cli manage issue-compatibility-token <username> [device_id]
+  # access_token: null
+  # device_id: null
+
   # The name the bot uses as a display name and when it refers to itself.
   # Leave empty to use the default (baibot).
   name: baibot
@@ -45,7 +54,7 @@ room:
 access:
   # Space-separated list of MXID patterns which specify who is an admin.
   admin_patterns:
-    - "@admin:synapse.127.0.0.1.nip.io"
+    - "@admin:__HOMESERVER_SERVER_NAME__"
 
 persistence:
   # This is unset here, because we expect the configuration to come from an environment variable (BAIBOT_PERSISTENCE_DATA_DIR_PATH).
@@ -82,7 +91,7 @@ agents:
     #     base_url: https://api.openai.com/v1
     #     api_key: ""
     #     text_generation:
-    #       model_id: gpt-5.2
+    #       model_id: gpt-5.4
     #       prompt: "You are a brief, but helpful bot called {{ baibot_name }} powered by the {{ baibot_model_id }} model. The date/time of this conversation's start is: {{ baibot_conversation_start_time_utc }}."
     #       temperature: 1.0
     #       # Reasoning models need to use `max_completion_tokens` instead of `max_response_tokens`.
@@ -157,7 +166,7 @@ initial_global_config:
   # Space-separated list of MXID patterns which specify who can use the bot.
   # By default, we let anyone on the homeserver use the bot.
   user_patterns:
-    - "@*:synapse.127.0.0.1.nip.io"
+    - "@*:__HOMESERVER_SERVER_NAME__"
 
 # Controls logging.
 #

etc/services/continuwuity/compose.yml

@@ -0,0 +1,23 @@
+services:
+  continuwuity:
+    image: forgejo.ellis.link/continuwuation/continuwuity:v0.5.6
+    user: "${UID}:${GID}"
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    environment:
+      CONDUWUIT_CONFIG: /etc/continuwuity/continuwuity.toml
+      CONDUWUIT_DATABASE_PATH: /var/lib/continuwuity
+    ports:
+      - "${SERVICE_CONTINUWUITY_BIND_PORT_CLIENT_API}:6167"
+    volumes:
+      - ../../etc/services/continuwuity/config:/etc/continuwuity:ro
+      - ./continuwuity/data:/var/lib/continuwuity
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=500m
+
+networks:
+  default:
+    name: ${NETWORK_NAME}
+    external: true

etc/services/continuwuity/config/continuwuity.toml

@@ -0,0 +1,19 @@
+[global]
+server_name = "continuwuity.127.0.0.1.nip.io"
+
+address = "0.0.0.0"
+port = 6167
+
+database_path = "/var/lib/continuwuity"
+
+allow_registration = true
+yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
+
+new_user_displayname_suffix = ""
+
+max_request_size = 20_000_000
+
+allow_federation = false
+trusted_servers = ["matrix.org"]
+
+log = "info,state_res=warn,rocket=off,_=off,sled=off"

etc/services/continuwuity/register-user.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+set -eu
+
+if [ $# -ne 3 ]; then
+	echo "Usage: $0 <env-file> <username> <password>"
+	exit 1
+fi
+
+ENV_FILE="$1"
+USERNAME="$2"
+PASSWORD="$3"
+
+SERVER="http://$(grep '^SERVICE_CONTINUWUITY_BIND_PORT_CLIENT_API=' "${ENV_FILE}" | cut -d= -f2)"
+REGISTER_URL="${SERVER}/_matrix/client/v3/register"
+
+echo "Registering user '${USERNAME}' on ${SERVER}..."
+
+SESSION_RESPONSE=$(curl -s -X POST "${REGISTER_URL}" \
+	-H 'Content-Type: application/json' \
+	-d "{\"username\": \"${USERNAME}\", \"password\": \"${PASSWORD}\"}")
+
+SESSION_ID=$(echo "${SESSION_RESPONSE}" | grep -o '"session":"[^"]*"' | head -1 | cut -d'"' -f4)
+if [ -z "${SESSION_ID}" ]; then
+	echo "Error: Could not get session ID. Response: ${SESSION_RESPONSE}"
+	exit 1
+fi
+
+# Determine the required auth flow from the server response.
+# The first user requires m.login.registration_token (bootstrap token from logs).
+# Subsequent users use m.login.dummy (open registration).
+if echo "${SESSION_RESPONSE}" | grep -q 'm.login.registration_token'; then
+	CONTAINER_ID=$(docker ps -q --filter name=baibot-continuwuity-continuwuity)
+	REG_TOKEN=$(docker logs "${CONTAINER_ID}" 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | grep 'using the registration token' | grep -oP 'registration token \K[A-Za-z0-9]+' | head -1)
+	AUTH_BODY="{\"type\": \"m.login.registration_token\", \"token\": \"${REG_TOKEN}\", \"session\": \"${SESSION_ID}\"}"
+else
+	AUTH_BODY="{\"type\": \"m.login.dummy\", \"session\": \"${SESSION_ID}\"}"
+fi
+
+RESULT=$(curl -s -X POST "${REGISTER_URL}" \
+	-H 'Content-Type: application/json' \
+	-d "{\"username\": \"${USERNAME}\", \"password\": \"${PASSWORD}\", \"auth\": ${AUTH_BODY}}")
+
+if echo "${RESULT}" | grep -q '"user_id"'; then
+	echo "Successfully registered user: $(echo "${RESULT}" | grep -o '"user_id":"[^"]*"' | cut -d'"' -f4)"
+else
+	echo "Registration failed. Response: ${RESULT}"
+	exit 1
+fi

etc/services/element-web/compose.yml

@@ -0,0 +1,21 @@
+services:
+  element-web:
+    image: ghcr.io/element-hq/element-web:v1.12.12
+    user: "${UID}:${GID}"
+    restart: unless-stopped
+    environment:
+      ELEMENT_WEB_PORT: 8080
+    ports:
+      - "${SERVICE_ELEMENT_WEB_BIND_PORT_HTTP}:8080"
+    volumes:
+    - ./element-web/config.json:/app/config.json:ro
+    tmpfs:
+      - /var/cache/nginx:rw,mode=777
+      - /var/run:rw,mode=777
+      - /tmp/element-web-config:rw,mode=777
+      - /etc/nginx/conf.d:rw,mode=777
+
+networks:
+  default:
+    name: ${NETWORK_NAME}
+    external: true

etc/services/element-web/config.json.dist

@@ -1,5 +1,5 @@
 {
-    "default_hs_url": "http://synapse.127.0.0.1.nip.io:42020",
+    "default_hs_url": "__HOMESERVER_CLIENT_URL__",
     "default_is_url": "https://vector.im",
     "integrations_ui_url": "https://scalar.vector.im/",
     "integrations_rest_url": "https://scalar.vector.im/api",

etc/services/env.dist

@@ -3,6 +3,8 @@ SERVICE_SYNAPSE_BIND_PORT_FEDERATION_API=127.0.0.1:42028
 
 SERVICE_ELEMENT_WEB_BIND_PORT_HTTP=127.0.0.1:42025
 
+SERVICE_CONTINUWUITY_BIND_PORT_CLIENT_API=127.0.0.1:42030
+
 SERVICE_OLLAMA_BIND_PORT_HTTP=127.0.0.1:42026
 
 # See https://localai.io/basics/container/#all-in-one-images for the list of available images

etc/services/ollama/compose.yml

@@ -1,6 +1,6 @@
 services:
   ollama:
-    image: docker.io/ollama/ollama:0.15.4
+    image: docker.io/ollama/ollama:0.18.2
     restart: unless-stopped
     ports:
       - "${SERVICE_OLLAMA_BIND_PORT_HTTP}:11434"

etc/services/synapse/compose.yml

@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: docker.io/postgres:18.1-alpine
+    image: docker.io/postgres:18.3-alpine
     user: ${UID}:${GID}
     restart: unless-stopped
     environment:
@@ -14,7 +14,7 @@ services:
     - /etc/passwd:/etc/passwd:ro
 
   synapse:
-    image: ghcr.io/element-hq/synapse:v1.146.0
+    image: ghcr.io/element-hq/synapse:v1.149.1
     user: "${UID}:${GID}"
     restart: unless-stopped
     entrypoint: python
@@ -23,25 +23,9 @@ services:
     - "${SERVICE_SYNAPSE_BIND_PORT_CLIENT_API}:8008"
     - "${SERVICE_SYNAPSE_BIND_PORT_FEDERATION_API}:8008"
     volumes:
-    - ../../etc/services/core/synapse/config:/config:ro
+    - ../../etc/services/synapse/config:/config:ro
     - ./synapse/media-store:/media-store
 
-  element-web:
-    image: ghcr.io/element-hq/element-web:v1.12.9
-    user: "${UID}:${GID}"
-    restart: unless-stopped
-    environment:
-      ELEMENT_WEB_PORT: 8080
-    ports:
-      - "${SERVICE_ELEMENT_WEB_BIND_PORT_HTTP}:8080"
-    volumes:
-    - ../../etc/services/core/element-web/config.json:/app/config.json:ro
-    tmpfs:
-      - /var/cache/nginx:rw,mode=777
-      - /var/run:rw,mode=777
-      - /tmp/element-web-config:rw,mode=777
-      - /etc/nginx/conf.d:rw,mode=777
-
 networks:
   default:
     name: ${NETWORK_NAME}

justfile

@@ -2,6 +2,13 @@ project_name := "baibot"
 container_image_name := "localhost/baibot"
 project_container_network := "baibot"
 
+admin_username := "admin"
+admin_password := "admin"
+bot_username := "baibot"
+bot_password := "baibot"
+
+homeserver := `cat var/homeserver 2>/dev/null || echo continuwuity`
+
 mise_data_dir := env("MISE_DATA_DIR", justfile_directory() / "var/mise")
 mise_trusted_config_paths := justfile_directory() / "mise.toml"
 
@@ -9,6 +16,19 @@ mise_trusted_config_paths := justfile_directory() / "mise.toml"
 default:
 	@just --list --justfile {{ justfile() }}
 
+# Selects which homeserver implementation to use (continuwuity or synapse)
+homeserver-init value:
+	#!/bin/sh
+	mkdir -p {{ justfile_directory() }}/var
+	echo {{ value }} > {{ justfile_directory() }}/var/homeserver
+	echo ""
+	echo "⚠️  If you had already prepared your app configuration (var/app/local/config.yml or var/app/container/config.yml),"
+	echo "    you will need to update it manually or delete it and re-run the prepare step."
+	echo "    You should also delete var/app/local/data and/or var/app/container/data,"
+	echo "    as old application state is not compatible across homeserver implementations."
+	echo ""
+	echo "⚠️  If Element Web was already prepared, delete var/services/element-web/ to regenerate its config."
+
 # Builds and runs a development binary
 run-locally *extra_args: app-local-prepare
 	RUST_BACKTRACE=1 \
@@ -68,9 +88,13 @@ docker-compose services_type *extra_args:
 	-p {{ project_name }}-{{ services_type }} \
 	{{ extra_args }}
 
-# Runs a docker-compose command against the core services
-docker-compose-core *extra_args:
-	just docker-compose core {{ extra_args }}
+# Runs a docker-compose command against the synapse services
+docker-compose-synapse *extra_args:
+	just docker-compose synapse {{ extra_args }}
+
+# Runs a docker-compose command against the element-web services
+docker-compose-element-web *extra_args:
+	just docker-compose element-web {{ extra_args }}
 
 # Runs a docker-compose command against the localai services
 docker-compose-localai *extra_args:
@@ -80,17 +104,52 @@ docker-compose-localai *extra_args:
 docker-compose-ollama *extra_args:
 	just docker-compose ollama {{ extra_args }}
 
-# Runs all core dependency components (in the background)
-services-start: services-prepare (docker-compose-core "up" "-d")
+# Runs a docker-compose command against the continuwuity services
+docker-compose-continuwuity *extra_args:
+	just docker-compose continuwuity {{ extra_args }}
 
-# Stops all core dependency components
-services-stop: (docker-compose-core "down")
+# Runs the homeserver and Element Web (in the background)
+services-start: services-prepare
+	just -f {{ justfile_directory() }}/justfile {{ homeserver }}-start
+	just -f {{ justfile_directory() }}/justfile element-web-start
 
-# Tails the logs for all running core services
-services-tail-logs: (docker-compose-core "logs" "-f")
+# Stops Element Web and the homeserver
+services-stop:
+	just -f {{ justfile_directory() }}/justfile element-web-stop
+	just -f {{ justfile_directory() }}/justfile {{ homeserver }}-stop
 
-# Prepares the core services for running
-services-prepare: _prepare-var-services-env _prepare-var-services-postgres _prepare-var-services-synapse _prepare-container-network
+# Tails the logs for the homeserver and Element Web
+services-tail-logs:
+	just -f {{ justfile_directory() }}/justfile {{ homeserver }}-tail-logs
+
+# Prepares the homeserver and Element Web for running
+services-prepare:
+	just -f {{ justfile_directory() }}/justfile {{ homeserver }}-prepare
+	just -f {{ justfile_directory() }}/justfile element-web-prepare
+
+# Runs Synapse (in the background)
+synapse-start: synapse-prepare (docker-compose-synapse "up" "-d")
+
+# Stops Synapse
+synapse-stop: (docker-compose-synapse "down")
+
+# Tails the logs for Synapse
+synapse-tail-logs: (docker-compose-synapse "logs" "-f")
+
+# Prepares Synapse for running
+synapse-prepare: _prepare-var-services-env _prepare-var-services-postgres _prepare-var-services-synapse _prepare-container-network
+
+# Runs Element Web (in the background)
+element-web-start: element-web-prepare (docker-compose-element-web "up" "-d")
+
+# Stops Element Web
+element-web-stop: (docker-compose-element-web "down")
+
+# Tails the logs for Element Web
+element-web-tail-logs: (docker-compose-element-web "logs" "-f")
+
+# Prepares Element Web for running
+element-web-prepare: _prepare-var-services-env _prepare-var-services-element-web _prepare-container-network
 
 # Runs LocalAI (in the background)
 localai-start: localai-prepare (docker-compose-localai "up" "-d")
@@ -116,6 +175,27 @@ ollama-tail-logs: (docker-compose-ollama "logs" "-f")
 # Prepares Ollama for running
 ollama-prepare: _prepare-var-services-env _prepare-var-services-ollama _prepare-container-network
 
+# Runs Continuwuity (in the background)
+continuwuity-start: continuwuity-prepare (docker-compose-continuwuity "up" "-d")
+
+# Stops Continuwuity
+continuwuity-stop: (docker-compose-continuwuity "down")
+
+# Tails the logs for Continuwuity
+continuwuity-tail-logs: (docker-compose-continuwuity "logs" "-f")
+
+# Prepares Continuwuity for running
+continuwuity-prepare: _prepare-var-services-env _prepare-var-services-continuwuity _prepare-container-network
+
+# Registers a user on Continuwuity via the Matrix Client-Server API
+continuwuity-register-user username password:
+	{{ justfile_directory() }}/etc/services/continuwuity/register-user.sh {{ justfile_directory() }}/var/services/env {{ username }} {{ password }}
+
+# Prepares the Continuwuity user accounts
+continuwuity-users-prepare: continuwuity-prepare
+	just -f {{ justfile_directory() }}/justfile continuwuity-register-user "{{ admin_username }}" "{{ admin_password }}"
+	just -f {{ justfile_directory() }}/justfile continuwuity-register-user "{{ bot_username }}" "{{ bot_password }}"
+
 # Pulls an Ollama model
 ollama-pull-model model_id:
 	just -f {{ justfile_directory() }}/justfile docker-compose-ollama \
@@ -129,16 +209,20 @@ app-local-prepare: _prepare-var-app-local-config_yml _prepare-var-app-local-data
 app-container-prepare: _prepare-var-app-container-config_yml _prepare-var-app-container-data
 
 # Prepares the user accounts
-users-prepare: services-prepare
-	just -f {{ justfile_directory() }}/justfile synapse-register-admin-user "admin" "admin"
-	just -f {{ justfile_directory() }}/justfile synapse-register-regular-user "baibot" "baibot"
+users-prepare:
+	just -f {{ justfile_directory() }}/justfile {{ homeserver }}-users-prepare
+
+# Prepares the Synapse user accounts
+synapse-users-prepare: synapse-prepare
+	just -f {{ justfile_directory() }}/justfile synapse-register-admin-user "{{ admin_username }}" "{{ admin_password }}"
+	just -f {{ justfile_directory() }}/justfile synapse-register-regular-user "{{ bot_username }}" "{{ bot_password }}"
 
 # Starts a Postgres CLI (psql)
-postgres-cli: services-prepare (docker-compose-core "exec" "postgres" "/bin/sh" "-c" "'PGUSER=synapse PGPASSWORD=synapse-password PGDATABASE=homeserver psql -h postgres'")
+postgres-cli: synapse-prepare (docker-compose-synapse "exec" "postgres" "/bin/sh" "-c" "'PGUSER=synapse PGPASSWORD=synapse-password PGDATABASE=homeserver psql -h postgres'")
 
-# Creates an administrator user
-synapse-register-admin-user username password: services-prepare
-	just -f {{ justfile_directory() }}/justfile docker-compose-core \
+# Creates an administrator user on Synapse
+synapse-register-admin-user username password: synapse-prepare
+	just -f {{ justfile_directory() }}/justfile docker-compose-synapse \
 		exec synapse \
 		register_new_matrix_user \
 		--admin \
@@ -147,9 +231,9 @@ synapse-register-admin-user username password: services-prepare
 		-c /config/homeserver.yaml \
 		http://localhost:8008
 
-# Create a regular user
-synapse-register-regular-user username password: services-prepare
-	just -f {{ justfile_directory() }}/justfile docker-compose-core \
+# Creates a regular user on Synapse
+synapse-register-regular-user username password: synapse-prepare
+	just -f {{ justfile_directory() }}/justfile docker-compose-synapse \
 		exec synapse \
 		register_new_matrix_user \
 		--no-admin \
@@ -229,6 +313,22 @@ _prepare-var-services-synapse:
 		mkdir -p var/services/synapse/media-store
 	fi
 
+_prepare-var-services-element-web:
+	#!/bin/sh
+	cd {{ justfile_directory() }};
+
+	if [ ! -f var/services/element-web/config.json ]; then
+		mkdir -p var/services/element-web
+		cp {{ justfile_directory() }}/etc/services/element-web/config.json.dist var/services/element-web/config.json
+
+		homeserver="{{ homeserver }}"
+		if [ "$homeserver" = "continuwuity" ]; then
+			sed --in-place 's|__HOMESERVER_CLIENT_URL__|http://continuwuity.127.0.0.1.nip.io:42030|g' var/services/element-web/config.json
+		elif [ "$homeserver" = "synapse" ]; then
+			sed --in-place 's|__HOMESERVER_CLIENT_URL__|http://synapse.127.0.0.1.nip.io:42020|g' var/services/element-web/config.json
+		fi
+	fi
+
 _prepare-var-services-ollama:
 	#!/bin/sh
 	cd {{ justfile_directory() }};
@@ -237,6 +337,14 @@ _prepare-var-services-ollama:
 		mkdir -p var/services/ollama
 	fi
 
+_prepare-var-services-continuwuity:
+	#!/bin/sh
+	cd {{ justfile_directory() }};
+
+	if [ ! -f var/services/continuwuity ]; then
+		mkdir -p var/services/continuwuity/data
+	fi
+
 _prepare-var-services-localai:
 	#!/bin/sh
 	cd {{ justfile_directory() }};
@@ -260,6 +368,15 @@ _prepare-var-app-local-config_yml:
 	if [ ! -f var/app/local/config.yml ]; then
 		mkdir -p var/app/local
 		cp {{ justfile_directory() }}/etc/app/config.yml.dist var/app/local/config.yml
+
+		homeserver="{{ homeserver }}"
+		if [ "$homeserver" = "continuwuity" ]; then
+			sed --in-place 's/__HOMESERVER_SERVER_NAME__/continuwuity.127.0.0.1.nip.io/g' var/app/local/config.yml
+			sed --in-place 's|__HOMESERVER_URL__|http://continuwuity.127.0.0.1.nip.io:42030|g' var/app/local/config.yml
+		elif [ "$homeserver" = "synapse" ]; then
+			sed --in-place 's/__HOMESERVER_SERVER_NAME__/synapse.127.0.0.1.nip.io/g' var/app/local/config.yml
+			sed --in-place 's|__HOMESERVER_URL__|http://synapse.127.0.0.1.nip.io:42020|g' var/app/local/config.yml
+		fi
 	fi
 
 _prepare-var-app-local-data:
@@ -277,7 +394,18 @@ _prepare-var-app-container-config_yml:
 	if [ ! -f var/app/container/config.yml ]; then
 		mkdir -p var/app/container
 		cp {{ justfile_directory() }}/etc/app/config.yml.dist var/app/container/config.yml
-		sed --in-place 's/synapse.127.0.0.1.nip.io:42020/synapse:8008/g' var/app/container/config.yml
+
+		homeserver="{{ homeserver }}"
+		if [ "$homeserver" = "continuwuity" ]; then
+			sed --in-place 's/__HOMESERVER_SERVER_NAME__/continuwuity.127.0.0.1.nip.io/g' var/app/container/config.yml
+			sed --in-place 's|__HOMESERVER_URL__|http://continuwuity.127.0.0.1.nip.io:42030|g' var/app/container/config.yml
+			sed --in-place 's/continuwuity.127.0.0.1.nip.io:42030/continuwuity:6167/g' var/app/container/config.yml
+		elif [ "$homeserver" = "synapse" ]; then
+			sed --in-place 's/__HOMESERVER_SERVER_NAME__/synapse.127.0.0.1.nip.io/g' var/app/container/config.yml
+			sed --in-place 's|__HOMESERVER_URL__|http://synapse.127.0.0.1.nip.io:42020|g' var/app/container/config.yml
+			sed --in-place 's/synapse.127.0.0.1.nip.io:42020/synapse:8008/g' var/app/container/config.yml
+		fi
+
 		sed --in-place 's/127.0.0.1:42026/ollama:11434/g' var/app/container/config.yml
 		sed --in-place 's/127.0.0.1:42027/localai:8080/g' var/app/container/config.yml
 	fi

renovate.json

@@ -0,0 +1,9 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": [
+		"config:recommended"
+	],
+	"labels": [
+		"dependencies"
+	]
+}

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.93.0"
+components = ["rustfmt", "clippy"]
+profile = "default"

src/agent/provider/anthropic/utils.rs

@@ -28,6 +28,13 @@ pub(super) fn create_anthropic_message_request(llm_messages: Vec<LLMMessage>) ->
                     },
                 }]
             }
+            LLMMessageContent::File(file_details) => {
+                tracing::warn!(
+                    "The Anthropic provider's library does not support file/document content. This file message ({}) will be skipped.",
+                    file_details.filename(),
+                );
+                continue;
+            }
         };
 
         let message = Message { role, content };

src/agent/provider/openai/config.rs

@@ -84,7 +84,7 @@ impl Default for TextGenerationConfig {
 }
 
 fn default_text_model_id() -> String {
-    "gpt-5.2".to_owned()
+    "gpt-5.4".to_owned()
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]

src/agent/provider/openai/utils.rs

@@ -1,6 +1,6 @@
 use async_openai::types::responses::{
-    EasyInputContent, EasyInputMessage, ImageDetail, InputContent, InputImageContent, InputItem,
-    InputParam, MessageType, Role,
+    EasyInputContent, EasyInputMessage, ImageDetail, InputContent, InputFileArgs,
+    InputImageContent, InputItem, InputParam, MessageType, Role,
 };
 
 use crate::conversation::llm::{
@@ -35,6 +35,21 @@ pub fn convert_llm_messages_to_openai_response_input(
                     file_id: None,
                 })])
             }
+            LLMMessageContent::File(file_details) => {
+                let file_data = format!(
+                    "data:{};base64,{}",
+                    file_details.mime,
+                    base64_encode(&file_details.data)
+                );
+
+                let file_content = InputFileArgs::default()
+                    .file_data(file_data)
+                    .filename(file_details.filename())
+                    .build()
+                    .expect("Failed to build InputFileContent");
+
+                EasyInputContent::ContentList(vec![InputContent::InputFile(file_content)])
+            }
         };
 
         items.push(InputItem::EasyMessage(EasyInputMessage {

src/agent/provider/openai_compat/utils.rs

@@ -40,6 +40,12 @@ fn convert_llm_message_to_openai_message(llm_message: LLMMessage) -> Option<Mess
             );
             None
         }
+        LLMMessageContent::File(_file_details) => {
+            tracing::warn!(
+                "The OpenAI-compat provider's library does not support file content. This file message will be skipped."
+            );
+            None
+        }
     }
 }
 

src/bot/implementation.rs

@@ -25,7 +25,7 @@ use crate::agent::Manager as AgentManager;
 use crate::entity::catch_up_marker::{
     CatchUpMarker, CatchUpMarkerManager, DelayedCatchUpMarkerManager,
 };
-use crate::entity::cfg::{Avatar, Config};
+use crate::entity::cfg::{Avatar, Config, ConfigUserAuth};
 use crate::entity::globalconfig::{GlobalConfig, GlobalConfigurationManager};
 use crate::entity::roomconfig::{RoomConfig, RoomConfigurationManager};
 
@@ -395,10 +395,22 @@ async fn create_matrix_link(config: &Config) -> anyhow::Result<MatrixLink> {
     let session_encryption_key = config.persistence.session_encryption_key()?;
     let db_dir_path: std::path::PathBuf = config.persistence.db_dir_path()?;
 
-    let login_creds = LoginCredentials::UserPassword(
-        config.user.mxid_localpart.to_owned(),
-        config.user.password.to_owned(),
-    );
+    let user_auth = config.user.auth_config(&config.homeserver.server_name)?;
+
+    let login_creds = match user_auth {
+        ConfigUserAuth::UserPassword { username, password } => {
+            LoginCredentials::UserPassword(username, password)
+        }
+        ConfigUserAuth::AccessToken {
+            user_id,
+            device_id,
+            access_token,
+        } => LoginCredentials::AccessToken {
+            user_id,
+            device_id,
+            access_token,
+        },
+    };
 
     let login_encryption = LoginEncryption::new(
         config.user.encryption.recovery_passphrase.clone(),

src/bot/load_config.rs

@@ -29,7 +29,15 @@ pub fn load() -> anyhow::Result<Config> {
             cfg_env::BAIBOT_HOMESERVER_SERVER_NAME => config.homeserver.server_name = value,
             cfg_env::BAIBOT_HOMESERVER_URL => config.homeserver.url = value,
             cfg_env::BAIBOT_USER_MXID_LOCALPART => config.user.mxid_localpart = value,
-            cfg_env::BAIBOT_USER_PASSWORD => config.user.password = value,
+            cfg_env::BAIBOT_USER_PASSWORD => {
+                config.user.password = optional_non_empty(value);
+            }
+            cfg_env::BAIBOT_USER_ACCESS_TOKEN => {
+                config.user.access_token = optional_non_empty(value);
+            }
+            cfg_env::BAIBOT_USER_DEVICE_ID => {
+                config.user.device_id = optional_non_empty(value);
+            }
             cfg_env::BAIBOT_USER_ENCRYPTION_RECOVERY_PASSPHRASE => {
                 config.user.encryption.recovery_passphrase = Some(value);
             }
@@ -120,3 +128,7 @@ pub fn load() -> anyhow::Result<Config> {
 
     Ok(config)
 }
+
+fn optional_non_empty(value: String) -> Option<String> {
+    if value.is_empty() { None } else { Some(value) }
+}

src/controller/chat_completion/mod.rs

@@ -41,6 +41,8 @@ pub enum ChatCompletionControllerType {
 
     Image,
 
+    File,
+
     ThreadMention,
     ReplyMention,
 }
@@ -419,7 +421,8 @@ async fn handle_stage_text_generation(
         | ChatCompletionControllerType::TextMention
         | ChatCompletionControllerType::TextDirect
         | ChatCompletionControllerType::Audio
-        | ChatCompletionControllerType::Image => {
+        | ChatCompletionControllerType::Image
+        | ChatCompletionControllerType::File => {
             Some(message_context.combined_admin_and_user_regexes())
         }
 

src/controller/determination/mod.rs

@@ -58,6 +58,18 @@ pub fn determine_controller(
                 )
             }
         }
+        MessagePayload::File(_file_message_content) => {
+            let prefix_requirement_type = message_context
+                .room_config_context()
+                .text_generation_prefix_requirement_type();
+
+            match prefix_requirement_type {
+                TextGenerationPrefixRequirementType::CommandPrefix => ControllerType::Ignore,
+                TextGenerationPrefixRequirementType::No => {
+                    ControllerType::ChatCompletion(ChatCompletionControllerType::File)
+                }
+            }
+        }
         MessagePayload::Audio(_) => {
             ControllerType::ChatCompletion(ChatCompletionControllerType::Audio)
         }

src/conversation/llm/entity.rs

@@ -1,5 +1,7 @@
 use chrono::{DateTime, Utc};
-use mxlink::matrix_sdk::ruma::events::room::message::ImageMessageEventContent;
+use mxlink::matrix_sdk::ruma::events::room::message::{
+    FileMessageEventContent, ImageMessageEventContent,
+};
 use mxlink::mime::Mime;
 
 use crate::agent::provider::ImageSource;
@@ -48,10 +50,35 @@ impl From<ImageDetails> for ImageSource {
     }
 }
 
+#[derive(Debug, Clone)]
+pub struct FileDetails {
+    pub event_content: FileMessageEventContent,
+    pub mime: Mime,
+    pub data: Vec<u8>,
+}
+
+impl FileDetails {
+    pub fn new(event_content: FileMessageEventContent, mime: Mime, data: Vec<u8>) -> Self {
+        Self {
+            event_content,
+            mime,
+            data,
+        }
+    }
+
+    pub fn filename(&self) -> String {
+        self.event_content
+            .filename
+            .clone()
+            .unwrap_or(self.event_content.body.clone())
+    }
+}
+
 #[derive(Debug, Clone)]
 pub enum MessageContent {
     Text(String),
     Image(ImageDetails),
+    File(FileDetails),
 }
 
 impl PartialEq for MessageContent {
@@ -62,6 +89,7 @@ impl PartialEq for MessageContent {
                 // We can probably do better than this by inspecting `.event_conten1t.source`, but for now this is good enough.
                 a.filename() == b.filename()
             }
+            (MessageContent::File(a), MessageContent::File(b)) => a.filename() == b.filename(),
             _ => false,
         }
     }

src/conversation/llm/tokenization.rs

@@ -74,6 +74,7 @@ fn calculate_token_size_for_message(bpe: &CoreBPE, model: &str, message: &Messag
     let text_length = match &message.content {
         MessageContent::Text(text) => bpe.encode_with_special_tokens(text).len() as i32,
         MessageContent::Image(..) => 0,
+        MessageContent::File(..) => 0,
     };
 
     (text_length + role_length + tokens_per_message + tokens_per_name) as u32

src/conversation/llm/utils.rs

@@ -1,6 +1,6 @@
 use mxlink::matrix_sdk::ruma::OwnedUserId;
 
-use super::entity::{Author, ImageDetails, Message, MessageContent};
+use super::entity::{Author, FileDetails, ImageDetails, Message, MessageContent};
 use crate::conversation::matrix::{MatrixMessage, MatrixMessageContent};
 use crate::utils::text_to_speech as text_to_speech_utils;
 
@@ -32,6 +32,15 @@ fn convert_bot_message(matrix_message: &MatrixMessage) -> Option<Message> {
             )),
             timestamp: matrix_message.timestamp.to_owned(),
         }),
+        MatrixMessageContent::File(file_content, mime_type, media_bytes) => Some(Message {
+            author: Author::Assistant,
+            content: MessageContent::File(FileDetails::new(
+                file_content.clone(),
+                mime_type.clone(),
+                media_bytes.clone(),
+            )),
+            timestamp: matrix_message.timestamp.to_owned(),
+        }),
     }
 }
 
@@ -90,5 +99,14 @@ fn convert_user_message(matrix_message: &MatrixMessage) -> Option<Message> {
             )),
             timestamp: matrix_message.timestamp.to_owned(),
         }),
+        MatrixMessageContent::File(file_content, mime_type, media_bytes) => Some(Message {
+            author: Author::User,
+            content: MessageContent::File(FileDetails::new(
+                file_content.clone(),
+                mime_type.clone(),
+                media_bytes.clone(),
+            )),
+            timestamp: matrix_message.timestamp.to_owned(),
+        }),
     }
 }

src/conversation/matrix/entity.rs

@@ -2,7 +2,9 @@ use chrono::{DateTime, Utc};
 use regex::Regex;
 
 use mxlink::matrix_sdk::ruma::OwnedUserId;
-use mxlink::matrix_sdk::ruma::events::room::message::ImageMessageEventContent;
+use mxlink::matrix_sdk::ruma::events::room::message::{
+    FileMessageEventContent, ImageMessageEventContent,
+};
 use mxlink::mime::Mime;
 
 #[derive(Clone)]
@@ -18,6 +20,7 @@ pub enum MatrixMessageContent {
     Text(String),
     Notice(String),
     Image(ImageMessageEventContent, Mime, Vec<u8>),
+    File(FileMessageEventContent, Mime, Vec<u8>),
 }
 
 #[derive(Clone)]

src/conversation/matrix/utils/mod.rs

@@ -234,6 +234,7 @@ pub async fn convert_matrix_native_event_to_matrix_message(
         MessageType::Text(text_content) => (text_content.body.clone(), false),
         MessageType::Notice(notice_content) => (notice_content.body.clone(), true),
         MessageType::Image(image_content) => (image_content.body.clone(), false),
+        MessageType::File(file_content) => (file_content.body.clone(), false),
         _ => return Ok(None),
     };
 
@@ -291,6 +292,67 @@ pub async fn convert_matrix_native_event_to_matrix_message(
         }));
     }
 
+    if let MessageType::File(file_content) = &room_message.msgtype {
+        let media_request = mxlink::matrix_sdk::media::MediaRequestParameters {
+            source: file_content.source.to_owned(),
+            format: mxlink::matrix_sdk::media::MediaFormat::File,
+        };
+
+        let file_name = file_content
+            .filename
+            .clone()
+            .unwrap_or(file_content.body.clone());
+
+        let mime_type = file_content
+            .info
+            .as_ref()
+            .and_then(|info| info.mimetype.clone())
+            .and_then(|mimetype| mimetype.parse::<mxlink::mime::Mime>().ok())
+            .unwrap_or_else(|| get_mime_type_from_file_name(&file_name));
+
+        tracing::debug!("Determined mime type {} for file {}", mime_type, file_name);
+
+        if mime_type == mxlink::mime::APPLICATION_OCTET_STREAM {
+            tracing::debug!(
+                "Skipping file {} with unsupported MIME type {}. It will be represented as a text message.",
+                file_name,
+                mime_type,
+            );
+
+            return Ok(Some(MatrixMessage {
+                sender_id: matrix_native_event.sender().to_owned(),
+                content: MatrixMessageContent::Text(format!(
+                    "[A file ({}) was attached but skipped because its content type ({}) is not supported. Let the user know.]",
+                    file_name, mime_type,
+                )),
+                mentioned_users,
+                timestamp,
+            }));
+        }
+
+        let span = tracing::debug_span!("get_media_content", file_name = %file_name, mime_type = %mime_type);
+
+        let media_bytes = matrix_link
+            .client()
+            .media()
+            .get_media_content(&media_request, true)
+            .instrument(span)
+            .await?;
+
+        tracing::debug!(
+            "Downloaded {} bytes for file {}",
+            media_bytes.len(),
+            file_name
+        );
+
+        return Ok(Some(MatrixMessage {
+            sender_id: matrix_native_event.sender().to_owned(),
+            content: MatrixMessageContent::File(file_content.clone(), mime_type, media_bytes),
+            mentioned_users,
+            timestamp,
+        }));
+    }
+
     Ok(Some(MatrixMessage {
         sender_id: matrix_native_event.sender().to_owned(),
         content: if is_notice {

src/entity/cfg/config.rs

@@ -1,6 +1,7 @@
 use std::path::PathBuf;
 
 use mxlink::helpers::encryption::EncryptionKey;
+use mxlink::matrix_sdk::ruma::{OwnedDeviceId, OwnedUserId};
 use serde::{Deserialize, Deserializer, Serialize};
 
 use crate::{
@@ -38,7 +39,7 @@ pub struct Config {
 impl Config {
     pub fn validate(&self) -> anyhow::Result<()> {
         self.homeserver.validate()?;
-        self.user.validate()?;
+        self.user.validate(&self.homeserver.server_name)?;
         self.persistence.validate()?;
         self.room.validate()?;
         self.access.validate()?;
@@ -57,6 +58,19 @@ impl Config {
     }
 }
 
+#[derive(Debug)]
+pub enum ConfigUserAuth {
+    UserPassword {
+        username: String,
+        password: String,
+    },
+    AccessToken {
+        user_id: OwnedUserId,
+        device_id: OwnedDeviceId,
+        access_token: String,
+    },
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ConfigHomeserver {
     pub server_name: String,
@@ -127,7 +141,15 @@ impl Avatar {
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ConfigUser {
     pub mxid_localpart: String,
-    pub password: String,
+
+    #[serde(default)]
+    pub password: Option<String>,
+
+    #[serde(default)]
+    pub access_token: Option<String>,
+
+    #[serde(default)]
+    pub device_id: Option<String>,
 
     #[serde(default = "super::defaults::name")]
     pub name: String,
@@ -140,7 +162,7 @@ pub struct ConfigUser {
 }
 
 impl ConfigUser {
-    pub fn validate(&self) -> anyhow::Result<()> {
+    pub fn validate(&self, homeserver_server_name: &str) -> anyhow::Result<()> {
         if self.mxid_localpart.is_empty() {
             return Err(anyhow::anyhow!(
                 "The user.mxid_localpart ({}) configuration must be set",
@@ -148,12 +170,7 @@ impl ConfigUser {
             ));
         }
 
-        if self.password.is_empty() {
-            return Err(anyhow::anyhow!(
-                "The user.password ({}) configuration must be set",
-                super::env::BAIBOT_USER_PASSWORD
-            ));
-        }
+        self.auth_config(homeserver_server_name)?;
 
         if self.name.is_empty() {
             return Err(anyhow::anyhow!(
@@ -166,6 +183,57 @@ impl ConfigUser {
 
         Ok(())
     }
+
+    pub fn auth_config(&self, homeserver_server_name: &str) -> anyhow::Result<ConfigUserAuth> {
+        let password = self.password.as_deref().filter(|value| !value.is_empty());
+        let access_token = self
+            .access_token
+            .as_deref()
+            .filter(|value| !value.is_empty());
+
+        match (password, access_token) {
+            (Some(_), Some(_)) => Err(anyhow::anyhow!(
+                "Set exactly one authentication method: either user.password ({}) OR user.access_token ({}) + user.device_id ({})",
+                super::env::BAIBOT_USER_PASSWORD,
+                super::env::BAIBOT_USER_ACCESS_TOKEN,
+                super::env::BAIBOT_USER_DEVICE_ID
+            )),
+            (None, None) => Err(anyhow::anyhow!(
+                "Set one authentication method: either user.password ({}) OR user.access_token ({}) + user.device_id ({})",
+                super::env::BAIBOT_USER_PASSWORD,
+                super::env::BAIBOT_USER_ACCESS_TOKEN,
+                super::env::BAIBOT_USER_DEVICE_ID
+            )),
+            (Some(password), None) => Ok(ConfigUserAuth::UserPassword {
+                username: self.mxid_localpart.to_owned(),
+                password: password.to_owned(),
+            }),
+            (None, Some(access_token)) => {
+                let device_id = self
+                    .device_id
+                    .as_deref()
+                    .filter(|value| !value.is_empty())
+                    .ok_or_else(|| {
+                        anyhow::anyhow!(
+                            "user.device_id ({}) must be set when using access token authentication",
+                            super::env::BAIBOT_USER_DEVICE_ID
+                        )
+                    })?;
+
+                let user_id = OwnedUserId::try_from(format!(
+                    "@{}:{}",
+                    self.mxid_localpart, homeserver_server_name
+                ))
+                .map_err(|e| anyhow::anyhow!("Invalid user ID: {e}"))?;
+
+                Ok(ConfigUserAuth::AccessToken {
+                    user_id,
+                    device_id: OwnedDeviceId::from(device_id),
+                    access_token: access_token.to_owned(),
+                })
+            }
+        }
+    }
 }
 
 #[derive(Debug, Default, Serialize, Deserialize)]
@@ -468,3 +536,7 @@ impl TryInto<GlobalConfig> for ConfigInitialGlobalConfig {
         Ok(entity)
     }
 }
+
+#[cfg(test)]
+#[path = "config_tests.rs"]
+mod config_tests;

src/entity/cfg/config_tests.rs

@@ -0,0 +1,117 @@
+use super::{Avatar, ConfigUser, ConfigUserAuth, ConfigUserEncryption};
+use crate::entity::cfg::env;
+
+fn base_user() -> ConfigUser {
+    ConfigUser {
+        mxid_localpart: "baibot".to_owned(),
+        password: None,
+        access_token: None,
+        device_id: None,
+        name: "baibot".to_owned(),
+        encryption: ConfigUserEncryption {
+            recovery_passphrase: None,
+            recovery_reset_allowed: false,
+        },
+        avatar: Avatar::Default,
+    }
+}
+
+#[test]
+fn auth_config_uses_password_mode() {
+    let mut user = base_user();
+    user.password = Some("secret".to_owned());
+
+    let auth = user
+        .auth_config("example.com")
+        .expect("password auth should be valid");
+
+    match auth {
+        ConfigUserAuth::UserPassword { username, password } => {
+            assert_eq!(username, "baibot");
+            assert_eq!(password, "secret");
+        }
+        ConfigUserAuth::AccessToken { .. } => {
+            panic!("expected password auth mode");
+        }
+    }
+}
+
+#[test]
+fn auth_config_uses_access_token_mode() {
+    let mut user = base_user();
+    user.access_token = Some("token123".to_owned());
+    user.device_id = Some("DEVICE1".to_owned());
+
+    let auth = user
+        .auth_config("example.com")
+        .expect("access token auth should be valid");
+
+    match auth {
+        ConfigUserAuth::AccessToken {
+            user_id,
+            device_id,
+            access_token,
+        } => {
+            assert_eq!(user_id.as_str(), "@baibot:example.com");
+            assert_eq!(device_id.as_str(), "DEVICE1");
+            assert_eq!(access_token, "token123");
+        }
+        ConfigUserAuth::UserPassword { .. } => {
+            panic!("expected access token auth mode");
+        }
+    }
+}
+
+#[test]
+fn auth_config_rejects_both_auth_methods() {
+    let mut user = base_user();
+    user.password = Some("secret".to_owned());
+    user.access_token = Some("token123".to_owned());
+    user.device_id = Some("DEVICE1".to_owned());
+
+    let err = user
+        .auth_config("example.com")
+        .expect_err("both auth methods should be rejected");
+
+    assert!(
+        err.to_string()
+            .contains("exactly one authentication method")
+    );
+}
+
+#[test]
+fn auth_config_rejects_missing_auth() {
+    let user = base_user();
+
+    let err = user
+        .auth_config("example.com")
+        .expect_err("missing auth should be rejected");
+
+    assert!(err.to_string().contains("Set one authentication method"));
+}
+
+#[test]
+fn auth_config_rejects_access_token_without_device_id() {
+    let mut user = base_user();
+    user.access_token = Some("token123".to_owned());
+
+    let err = user
+        .auth_config("example.com")
+        .expect_err("access token mode without device_id should be rejected");
+
+    assert!(err.to_string().contains(env::BAIBOT_USER_DEVICE_ID));
+}
+
+#[test]
+fn auth_config_treats_empty_strings_as_unset() {
+    let mut user = base_user();
+    user.password = Some(String::new());
+    user.access_token = Some(String::new());
+    user.device_id = Some(String::new());
+
+    let err = user
+        .auth_config("example.com")
+        .expect_err("empty auth values should be treated as unset");
+
+    assert!(err.to_string().contains("Set one authentication method"));
+}

src/entity/cfg/env.rs

@@ -5,6 +5,8 @@ pub const BAIBOT_HOMESERVER_URL: &str = "BAIBOT_HOMESERVER_URL";
 
 pub const BAIBOT_USER_MXID_LOCALPART: &str = "BAIBOT_USER_MXID_LOCALPART";
 pub const BAIBOT_USER_PASSWORD: &str = "BAIBOT_USER_PASSWORD";
+pub const BAIBOT_USER_ACCESS_TOKEN: &str = "BAIBOT_USER_ACCESS_TOKEN";
+pub const BAIBOT_USER_DEVICE_ID: &str = "BAIBOT_USER_DEVICE_ID";
 pub const BAIBOT_USER_NAME: &str = "BAIBOT_USER_NAME";
 pub const BAIBOT_USER_AVATAR: &str = "BAIBOT_USER_AVATAR";
 pub const BAIBOT_USER_ENCRYPTION_RECOVERY_PASSPHRASE: &str =

src/entity/cfg/mod.rs

@@ -2,4 +2,4 @@ mod config;
 pub mod defaults;
 pub mod env;
 
-pub use config::{Avatar, Config};
+pub use config::{Avatar, Config, ConfigUserAuth};

src/entity/message_payload.rs

@@ -1,5 +1,6 @@
 use mxlink::matrix_sdk::ruma::events::room::message::{
-    AudioMessageEventContent, ImageMessageEventContent, MessageType, TextMessageEventContent,
+    AudioMessageEventContent, FileMessageEventContent, ImageMessageEventContent, MessageType,
+    TextMessageEventContent,
 };
 use mxlink::matrix_sdk::ruma::{OwnedEventId, OwnedUserId};
 
@@ -30,6 +31,7 @@ pub enum MessagePayload {
     Text(TextMessageEventContent),
     Audio(AudioMessageEventContent),
     Image(ImageMessageEventContent),
+    File(FileMessageEventContent),
 
     Reaction {
         key: String,
@@ -57,6 +59,7 @@ impl TryInto<MessagePayload> for MessageType {
                 MessagePayload::Audio(audio_content)
             }
             MessageType::Image(image_content) => MessagePayload::Image(image_content),
+            MessageType::File(file_content) => MessagePayload::File(file_content),
             other => {
                 return Err(format!("Unsupported message type: {:?}", other));
             }

src/utils/mime.rs

@@ -17,18 +17,7 @@ pub fn get_file_extension(mime_type: &mime::Mime) -> String {
 }
 
 pub fn get_mime_type_from_file_name(file_name: &str) -> mime::Mime {
-    let extension = file_name.rsplit('.').next().unwrap_or("");
-
-    match extension.to_lowercase().as_str() {
-        "jpg" | "jpeg" => mime::IMAGE_JPEG,
-        "png" => mime::IMAGE_PNG,
-        "gif" => mime::IMAGE_GIF,
-        "webp" => "image/webp".parse().unwrap(),
-        "svg" => mime::IMAGE_SVG,
-        "tiff" | "tif" => "image/tiff".parse().unwrap(),
-        "bmp" => "image/bmp".parse().unwrap(),
-        "heic" | "heif" => "image/heic".parse().unwrap(),
-        "avif" => "image/avif".parse().unwrap(),
-        _ => mime::APPLICATION_OCTET_STREAM,
-    }
+    mime_guess::from_path(file_name)
+        .first()
+        .unwrap_or(mime::APPLICATION_OCTET_STREAM)
 }