Context

MEDIA: directives are intended for explicit media attachment delivery (images/audio/video), but the parser currently accepts overly broad path tokens.
This creates a trust-boundary issue: model-generated text can influence which local files are sent as platform attachments.

What’s wrong (concrete exploit path)

A crafted response such as:

• MEDIA:'/etc/passwd'
• MEDIA:/tmp/secrets.env
• MEDIA:"/home/user/.ssh/config"

can be parsed as a valid attachment candidate and routed into native send flows (send_document / send_image_file / send_video), depending on adapter behavior.

That means non-media host files can be exfiltrated through normal chat output delivery.

Behavioral change in this PR

MEDIA: extraction is now strict and intentionally conservative:

Implementation overview

gateway/platforms/base.py

• Added _normalize_media_tag_path() as a single validation gate for MEDIA: values.
• Added media extension allowlist for extracted attachment paths.
• Added explicit remote-scheme and path-shape checks (local absolute paths only).
• Updated extract_media() to use normalized/validated output only.

Regression coverage

tests/gateway/test_platform_base.py

Added:

• test_media_tag_ignores_non_media_file_paths

This test verifies that sensitive/non-media files are not extracted from MEDIA: tags and therefore are not eligible for attachment routing.

Why this fix is scoped correctly

• No adapter-specific refactor.
• No protocol/UX changes for valid media paths.
• No new dependencies.
• Keeps existing MEDIA: contract for real media outputs intact.

Validation status

• Regression test added
• No new dependencies