agentbox-app 0.1.12 → 0.1.16

package/main/run-change.mjs

@@ -0,0 +1,13 @@
+// WHAT A RUN CHANGED: the checkout read back against its photograph, then the
+// change file written. Git commands and a whole transcript, so it runs on the
+// git thread (main/git-change-offthread.mjs), not on the app's main thread.
+import { changeFromRepo } from './git-change.mjs';
+import { writeChangeForRun } from './code-change.mjs';
+
+export function saveRunChange({ repoBefore = null, ...run }) {
+  let repos = [];
+  try {
+    if (repoBefore) repos = [changeFromRepo(repoBefore)];
+  } catch (e) { console.warn('zero: could not read the repository back:', e.message); }
+  return writeChangeForRun({ ...run, repos });
+}

package/main/run-ledger.mjs

@@ -0,0 +1,135 @@
+// THE RUN LEDGER: one line per finished run, for agent hours (w-3d0fa23ffb).
+//
+// `<appHome>/runs.jsonl`, written when a run ends (supervisor `_recordRun`).
+// Cloud runs keep their own ledger (main/cloud/usage.mjs) and are read from
+// there. Old runs are read once from their trace logs (`backfillRuns`). Every
+// line has a key, and every reader dedupes on it, so a run written twice is
+// counted once.
+import fs from 'node:fs';
+import path from 'node:path';
+import { appHome, machineryDir } from './store/home.mjs';
+import { dedupeRuns, runFromTrace } from '../shared/agent-hours.mjs';
+
+const BACKFILL_DAYS = 400;
+const TAIL_BYTES = 400;
+// A log with no exit line that was written to this recently is a run still
+// going; it writes its own line when it ends.
+const STILL_GOING_MS = 30 * 60_000;
+
+export function runLedgerPath(home = appHome()) {
+  return path.join(home, 'runs.jsonl');
+}
+
+export function appendRun(run, { file = runLedgerPath() } = {}) {
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify(run) + '\n');
+    return true;
+  } catch {
+    // A run that cannot be written never fails the run.
+    return false;
+  }
+}
+
+export function readRuns({ file = runLedgerPath() } = {}) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try { out.push(JSON.parse(line)); } catch { /* one broken line loses only itself */ }
+  }
+  return out;
+}
+
+export function runsFromCloudUsage(lines) {
+  const out = [];
+  for (const l of lines ?? []) {
+    const at = Date.parse(l?.at);
+    const seconds = Number(l?.wallSeconds);
+    if (!Number.isFinite(at) || !(seconds > 0)) continue;
+    out.push({
+      key: `cloud:${l.runId ?? at}`,
+      at,
+      start: at - seconds * 1000,
+      item: l.item ?? null,
+      product: null,
+      engine: l.engine ?? null,
+      seconds,
+      failed: Number.isInteger(l.exitCode) ? l.exitCode !== 0 : null,
+      where: 'cloud',
+    });
+  }
+  return out;
+}
+
+export function allRuns({ file = runLedgerPath(), cloudLines = [] } = {}) {
+  return dedupeRuns([...readRuns({ file }), ...runsFromCloudUsage(cloudLines)]);
+}
+
+function tailOf(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, TAIL_BYTES);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, size - len);
+    return buf.toString('utf8');
+  } catch {
+    return '';
+  } finally {
+    if (fd !== undefined) try { fs.closeSync(fd); } catch {}
+  }
+}
+
+// Reads every run log of this store's projects into the ledger, once per run.
+// Resolves to how many runs it added. It hands the event loop back every
+// YIELD_EVERY logs: on the founder's Mac it reads 25,780 logs in 3.4 s, which
+// in one piece would freeze the window.
+const YIELD_EVERY = 200;
+const breathe = () => new Promise((r) => setImmediate(r));
+
+export async function backfillRuns({ home = appHome(), products = [], file = runLedgerPath(home), now = Date.now() } = {}) {
+  const have = new Set(readRuns({ file }).map((r) => r?.key));
+  const since = now - BACKFILL_DAYS * 86_400_000;
+  let added = 0;
+  let read = 0;
+  let pending = [];
+  const flush = () => {
+    if (!pending.length) return;
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.appendFileSync(file, pending.map((r) => JSON.stringify(r)).join('\n') + '\n');
+      added += pending.length;
+    } catch { /* the next backfill tries again */ }
+    pending = [];
+  };
+  for (const p of products) {
+    if (!p?.dir) continue;
+    const sessions = path.join(machineryDir(p.dir, home), 'sessions');
+    let items;
+    try { items = fs.readdirSync(sessions, { withFileTypes: true }); } catch { continue; }
+    for (const it of items) {
+      if (!it.isDirectory()) continue;
+      let logs;
+      try { logs = fs.readdirSync(path.join(sessions, it.name)); } catch { continue; }
+      for (const name of logs) {
+        const start = Number(/^(\d{12,14})\.log$/.exec(name)?.[1]);
+        if (!Number.isFinite(start) || start < since || start > now) continue;
+        if (++read % YIELD_EVERY === 0) { flush(); await breathe(); }
+        const full = path.join(sessions, it.name, name);
+        let mtimeMs;
+        try { mtimeMs = fs.statSync(full).mtimeMs; } catch { continue; }
+        const tail = tailOf(full);
+        if (!/# exited \(/.test(tail) && now - mtimeMs < STILL_GOING_MS) continue;
+        const run = runFromTrace({ name, text: tail, mtimeMs, item: it.name, product: p.slug ?? null });
+        if (!run || have.has(run.key)) continue;
+        pending.push({ ...run, backfilled: true });
+        have.add(run.key);
+      }
+    }
+  }
+  flush();
+  return added;
+}

package/main/runs-on.mjs

@@ -1,21 +1,23 @@
-// WHICH ACCOUNT THE AGENTS ARE ACTUALLY RUNNING ON, read off this Mac.
+// WHETHER THIS MAC IS ALREADY SIGNED INTO A CODING AGENT, AND WHICH ONE.
 //
-// w-e217e577e5, 2026-10-07, from a session with a new user: "He didn't realize
-// it auto-connected to Claude/Codex; he wasn't sure how it was even running."
+// w-e217e577e5, 2026-10-07. A new user ran an agent and, in her words, was
+// "like, 'Oh my God, where are the tokens coming from? I didn't even connect my
+// account.'" The app finds whichever coding agent is already signed in on the
+// Mac and spends that subscription without ever saying so.
 //
-// Every fact here was already on the disk and already being read, each by the
-// screen that needed it: main/claude-plan.mjs for the Claude plan (the Accounts
-// page), main/codex-account.mjs for the ChatGPT one (the Codex card). What did
-// not exist was ONE answer to "what is powering this", in a shape small enough
-// to ride the snapshot and be drawn in a corner. That is all this is: the two
-// readers, asked about the one account the fleet is spending, and null whenever
-// the answer would be a guess.
+// WHICH ENGINE, AND NOTHING ELSE. This read the plan tier too for a few hours,
+// so a row in the sidebar's foot could say "Claude · Max 20x"; that row came
+// out the same day and the tier came out with it ("very critically, I want to
+// get rid of that Claude Max 20x plan"). The question the walk answers is "did
+// it connect to something of mine", and the engine is the whole of that answer.
+// What somebody is paying for is on each agent's own page in Settings, which is
+// where you go when you actually want it (main/settings.mjs reads
+// main/claude-plan.mjs and main/codex-account.mjs for exactly that).
 //
-// NULL IS AN ORDINARY ANSWER AND IT MEANS DRAW NOTHING. A Mac mid-setup, a
-// config file being rewritten under us, a login that exists with no plan string
-// in it: the first two are null, the third is the name with no plan. Nothing
-// here ever reports an account that is not there, because the corner it feeds
-// is read by somebody deciding whose money this is spending.
+// NULL IS AN ORDINARY ANSWER AND IT MEANS SAY NOTHING. A Mac mid-setup, a config
+// file being rewritten under us, a login that is not there: all null, and the
+// walk then says nothing at all rather than guessing. That Mac is also the one
+// that gets the plan question instead, which says all of this out loud already.
 //
 // IT IS CACHED ON THE LOGIN FILES' OWN TIMES, NOT ON A CLOCK. The snapshot is
 // built every ten seconds and `~/.claude.json` is 148 KB on the machine this was
@@ -30,11 +32,11 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { planFile, planOfAccount } from './claude-plan.mjs';
+import { planFile } from './claude-plan.mjs';
 import { codexAccount, codexAuthFile } from './codex-account.mjs';
 import { signInFiles, signInStamp } from './sign-in-files.mjs';
 
-/** keyed by engine and folder, valued by the stamp it was read at. */
+/** keyed by engine, home and folder, valued by the stamp it was read at. */
 const remembered = new Map();
 
 /**
@@ -43,12 +45,11 @@ const remembered = new Map();
  * @param {object} facts
  * @param {string} facts.engine Which coding agent the workspace runs on, which
  *   the supervisor has already decided (`Supervisor#engineFacts`). Never worked
- *   out here: the capability gate lives there, and a corner that guessed could
+ *   out here: the capability gate lives there, and a line that guessed could
  *   name the subscription the fleet is not spending.
  * @param {string} [facts.claudeProfile] The Claude login, `default` or a folder.
  * @param {string} [facts.codexHome] The CODEX_HOME this workspace runs on.
- * @returns {{ engine: string, plan: string|null }|null} `plan` is the words the
- *   tool itself reports, never a label of ours.
+ * @returns {{ engine: string }|null}
  */
 export function runsOn({ engine = null, home = os.homedir(), claudeProfile = 'default', codexHome = null } = {}) {
   if (engine !== 'claude' && engine !== 'codex') return null;
@@ -63,28 +64,24 @@ export function runsOn({ engine = null, home = os.homedir(), claudeProfile = 'de
   const stamp = signInStamp(signInFiles({ engine, folder, home }));
   const seen = remembered.get(key);
   if (seen && seen.stamp === stamp) return seen.value;
-  const value = stamp ? read(engine, { home, claudeProfile, folder }) : null;
+  const value = stamp && signedIn(engine, { home, claudeProfile, folder }) ? { engine } : null;
   remembered.set(key, { stamp, value });
   return value;
 }
 
-function read(engine, { home, claudeProfile, folder }) {
-  if (engine === 'codex') {
-    const id = codexAccount(null, { file: codexAuthFile(folder) });
-    return id ? { engine: 'codex', plan: id.plan ?? null } : null;
-  }
-  // THE LOGIN AND THE PLAN COME OUT OF ONE READ. `readPlan` answers only the
-  // second, and "not signed in" and "signed in with no plan string" are two
-  // different screens: the first draws nothing, the second draws the name.
-  let account = null;
+/** Whether there is a login in there at all. Never throws, never guesses. */
+function signedIn(engine, { home, claudeProfile, folder }) {
+  if (engine === 'codex') return !!codexAccount(null, { file: codexAuthFile(folder) });
+  // `oauthAccount` is the object Claude Code writes when somebody signs in, and
+  // its absence is the honest "nobody is". A file with no account in it is an
+  // ordinary thing: `~/.claude.json` also holds project history, so it exists on
+  // plenty of Macs nobody has logged in on.
   try {
-    account = JSON.parse(fs.readFileSync(planFile(claudeProfile, home), 'utf8'))?.oauthAccount ?? null;
+    const account = JSON.parse(fs.readFileSync(planFile(claudeProfile, home), 'utf8'))?.oauthAccount;
+    return !!account && typeof account === 'object';
   } catch {
-    return null;
+    return false;
   }
-  if (!account || typeof account !== 'object') return null;
-  const plan = planOfAccount(account);
-  return { engine: 'claude', plan: plan.known ? plan.label : null };
 }
 
 /** Forgets every cached reading. For tests, and for a sign-out that lands. */

package/main/save-attachments.mjs

@@ -0,0 +1,41 @@
+// SAVING THE FILES A MESSAGE CARRIES, into a project's attachments folder.
+//
+// One copy, used by the reply box (main/ipc.mjs zero:save-attachments) and by
+// a message to a person (main/team/index.mjs), whose conversation may not
+// exist until the message makes it, so it cannot save them beforehand.
+// Relative paths keep them readable by workers through the MCP and renderable
+// in the message view, and they are the names the team sync sends on
+// (main/team/sync.mjs).
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * `files` are `{ name, dataBase64 }` or `{ name, srcPath }`. Answers what was
+ * saved: `{ rel, name, image }`, in order, skipping one with neither.
+ */
+export function saveAttachments(dir, files) {
+  const outDir = path.join(dir, 'attachments');
+  fs.mkdirSync(outDir, { recursive: true });
+  const saved = [];
+  for (const file of files ?? []) {
+    const safe = String(file?.name ?? 'file').replace(/[^\w.-]+/g, '-').slice(0, 80);
+    // A RANDOM SUFFIX, THE SAME ONE THE STAGING PATH ALREADY USES. The name
+    // was the millisecond plus the filename, so two files saved in the same
+    // millisecond with the same name overwrote each other and the message
+    // ended up with two links to one picture. Screenshots are often sent in
+    // pairs, which is exactly the shape that collides. It has never been observed
+    // happening; it is one line to make impossible.
+    const rel = `attachments/${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}-${safe}`;
+    const abs = path.join(dir, rel);
+    if (file?.dataBase64) fs.writeFileSync(abs, Buffer.from(file.dataBase64, 'base64'));
+    else if (file?.srcPath) fs.copyFileSync(file.srcPath, abs);
+    else continue;
+    saved.push({ rel, name: safe, image: /\.(png|jpe?g|gif|webp)$/i.test(safe) });
+  }
+  return saved;
+}
+
+/** The links a message carries for what was saved, one per line. */
+export function attachmentMarkdown(saved) {
+  return saved.map((s) => (s.image ? `![${s.name}](${s.rel})` : `[${s.name}](${s.rel})`)).join('\n');
+}

package/main/serve.mjs

@@ -29,6 +29,9 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 import { spawn } from 'node:child_process';
+import { Readable } from 'node:stream';
+import { mediaResponse, mediaType, servable } from './img-scheme.mjs';
+import { readPictureShape } from './picture-shape.mjs';
 import { loadConfig } from './config.mjs';
 import { Store } from './store.mjs';
 import { Supervisor } from './supervisor.mjs';
@@ -38,7 +41,9 @@ import { reportFromRenderer } from './crash-report.mjs';
 import * as workItemsDisk from './store/work-items.mjs';
 import { createTeamService, teamStateFile } from './team/index.mjs';
 import { loadCloudConfig, supabaseSession, headlessSessionFile } from './team/session.mjs';
+import { roomsSetup } from './team/room-setup.mjs';
 import { appHome, carryMisplacedMachinery, storeRootEnv } from './store/home.mjs';
+import { keepAnswerModesIn } from './answer-modes.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.dirname(here);
@@ -136,11 +141,16 @@ function readVersion() {
  *  same scrubbed path as the desktop's, which writes nothing until crash
  *  reports are set up for this process.
  */
-function answerWhatOnlyTheWindowAnswered(ipcMain) {
+export function answerWhatOnlyTheWindowAnswered(ipcMain) {
   ipcMain.handle('zero:badge', () => null);
+  ipcMain.handle('zero:corner-tag', () => null);
   ipcMain.handle('zero:notify', () => null);
   ipcMain.handle('zero:boot-info', () => ({ reloaded: false, builtAt: null, recovered: null }));
+  // A room invite link only ever opens the desktop app.
+  ipcMain.handle('zero:take-join', () => null);
   ipcMain.handle('zero:crash', (_e, payload) => { reportFromRenderer(payload ?? {}); return null; });
+  // The phone door belongs to the desktop app (main/phone-link.mjs); a tab is told there is none.
+  ipcMain.handle('zero:phone-link', () => null);
 }
 
 /**
@@ -170,6 +180,7 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
   const inheritedHome = appHome();
   Object.assign(process.env, storeRootEnv(config.storeRoot));
   carryMisplacedMachinery(inheritedHome, config.storeRoot);
+  keepAnswerModesIn({ userDir, storeRoot: config.storeRoot });
   const store = await new Store(config).init();
   const supervisor = new Supervisor(config, store, appDir, dataDir, userDir);
   const window = broadcastingWindow();
@@ -191,7 +202,15 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
     accountRoot: config.accountRoot,
     stateFile: teamStateFile(config.storeRoot),
     onChange: () => ipc?.push?.(),
+    rooms: roomsSetup({ config, store, supervisor, userDir }),
   }) : null;
+  // AND IT STOPS ITS OWN WORKERS ON THE WAY OUT, as main/main.mjs does for the
+  // desktop. Control-C reaches the whole process group, so without this each
+  // worker died of the signal itself and was written down as a run that failed
+  // on its own: a Claude task stopped that way read "it will keep failing the
+  // same way until this is fixed" and rested 15 minutes after the copy came
+  // back (tests/control-c-on-the-browser-copy-does-not-fail-its-agents).
+  host.app.on('before-quit', () => supervisor.killAll());
   ipc = registerIpc({ store, supervisor, config, window, host, team });
   answerWhatOnlyTheWindowAnswered(host.ipcMain);
   return { config, store, supervisor, window, host, ipc, team, channels: host.ipcMain.handlers };
@@ -200,18 +219,98 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
 /** A token in the url, because the port alone is not a door key. */
 export const newToken = () => crypto.randomBytes(24).toString('base64url');
 
+/**
+ * THE PICTURES A TAB MAY DRAW: the desktop window's own rule (`servable`,
+ * main/img-scheme.mjs) over its own roots (`imageRoots`, main/main.mjs), so a
+ * door opened for a screenshot can never hand out `zero.config.json`.
+ *
+ * Pictures only. A whole document is served under a grant the pane opens one
+ * at a time (main/doc-scheme.mjs) and this copy opens none.
+ */
+export function picturesTheAppOwns({ config, store }) {
+  return {
+    allows: (kind, file) => kind === 'img' && servable(file, [
+      config?.accountRoot,
+      ...(store?.listProducts?.() ?? []).map((p) => p.repoPath),
+    ].filter(Boolean)),
+  };
+}
+
+/**
+ * THE KEY THAT ONLY READS FILES. A design page runs its own scripts and can
+ * read its own address, so the address a phone loads it from must not carry
+ * the phone's key, which starts agents and approves their requests. This is
+ * made from that key, changes when it is reset, and opens nothing but /f/.
+ */
+export const fileKey = (token) => crypto.createHmac('sha256', String(token ?? '')).update('agentbox-files').digest('base64url').slice(0, 32);
+
 const MIME = {
   '.html': 'text/html; charset=utf-8',
+  '.htm': 'text/html; charset=utf-8',
   '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
   '.css': 'text/css; charset=utf-8',
   '.json': 'application/json; charset=utf-8',
   '.svg': 'image/svg+xml',
   '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
   '.webp': 'image/webp',
+  '.avif': 'image/avif',
+  '.bmp': 'image/bmp',
+  '.ico': 'image/x-icon',
+  '.pdf': 'application/pdf',
+  '.txt': 'text/plain; charset=utf-8',
+  '.md': 'text/plain; charset=utf-8',
   '.woff2': 'font/woff2',
+  '.woff': 'font/woff',
+  '.ttf': 'font/ttf',
   '.map': 'application/json; charset=utf-8',
 };
 
+/**
+ * One file off this computer, for the phone: /f/<file key>/<doc|img>/<path>.
+ * `files.allows(kind, file)` is the same rule the desktop's two schemes use
+ * (main/main.mjs passes it in), checked after the path is made whole, so a
+ * `..` cannot climb out of what it allows. Never from memory, for the reason
+ * the desktop's schemes give: a picture an agent redraws keeps its name.
+ */
+async function answerFile(req, res, url, { token, files }) {
+  const [, , key, kind, ...rest] = url.pathname.split('/');
+  if (kind !== 'doc' && kind !== 'img' && kind !== 'shape') { res.writeHead(404).end('No such kind of file.'); return; }
+  if (!sameKey(key, fileKey(typeof token === 'function' ? token() : token))) { res.writeHead(403).end('Wrong key.'); return; }
+  let file;
+  try { file = path.normalize('/' + rest.map(decodeURIComponent).join('/')); } catch { res.writeHead(400).end('Bad path.'); return; }
+  // A shape is asked of a picture, under the picture's own rule.
+  if (!path.isAbsolute(file) || !files.allows(kind === 'shape' ? 'img' : kind, file)) { res.writeHead(403).end('Not available.'); return; }
+  let stat;
+  try { stat = await fs.promises.stat(file); } catch { res.writeHead(404).end('Not there.'); return; }
+  if (!stat.isFile()) { res.writeHead(404).end('Not there.'); return; }
+  // ITS WIDTH AND HEIGHT, so a picture the phone has never seen holds its
+  // place before its last byte comes (main/picture-shape.mjs).
+  if (kind === 'shape') {
+    const shape = await readPictureShape(file).catch(() => null);
+    if (!shape) { res.writeHead(404).end('Not a picture this can measure.'); return; }
+    res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(shape));
+    return;
+  }
+  const media = mediaType(file);
+  if (media) {
+    const out = await mediaResponse(file, req.headers.range);
+    res.writeHead(out.status, { ...Object.fromEntries(out.headers), 'cache-control': 'no-store' });
+    if (out.body) Readable.fromWeb(out.body).pipe(res); else res.end();
+    return;
+  }
+  res.writeHead(200, {
+    'content-type': MIME[path.extname(file).toLowerCase()] ?? 'application/octet-stream',
+    'content-length': String(stat.size),
+    'cache-control': 'no-store',
+  });
+  fs.createReadStream(file).pipe(res);
+}
+
 /**
  * Serve one built renderer and one channel endpoint.
  *
@@ -222,10 +321,27 @@ const MIME = {
  *  `listeners` is the Set off `broadcastingWindow`, which is where the pushes
  *  going the other way are waiting for somewhere to go.
  */
-export function createServer({ channels, token, listeners = new Set(), dist = path.join(repoRoot, 'renderer', 'dist') }) {
-  return http.createServer(async (req, res) => {
+export function createServer(options) {
+  return http.createServer(createHandler(options));
+}
+
+/**
+ * The same door as a bare request handler, so main/phone-link.mjs can put its
+ * own server in front of it. `token` may be a function, read on every request,
+ * so a key that is reset stops working at once.
+ */
+export function createHandler({ channels, token, listeners = new Set(), dist = path.join(repoRoot, 'renderer', 'dist'), files = null }) {
+  return async (req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
 
+    // A file for the phone, behind the file key rather than the phone's own.
+    // Only a server that was handed `files` has any to give.
+    if (url.pathname.startsWith('/f/')) {
+      if (!files) { res.writeHead(404).end('No files here.'); return; }
+      await answerFile(req, res, url, { token, files });
+      return;
+    }
+
     // The token rides in a header on api calls and in the query on the event
     // stream, because a browser cannot put a header on either a navigation or
     // an EventSource. It guards the two doors that reach the store. The built
@@ -234,14 +350,29 @@ export function createServer({ channels, token, listeners = new Set(), dist = pa
     // NOR DOES THE PAGE ITSELF ASK: the tab takes the token out of its address
     // bar on load, so a reload asks for `/` bare, and refusing that drew
     // "Wrong or missing token" on every reload (tests/a-browser-tab-survives-a-reload).
-    const guarded = url.pathname === '/events' || url.pathname.startsWith('/api/');
+    //
+    // AND THE HOST HEADER IS NOT CHECKED, asked and answered 2026-10-24.
+    // Refusing a Host that is not localhost is the usual guard against a page
+    // whose own name resolves to this machine, and it cannot go here:
+    // main/phone-link.mjs serves this same handler to a phone through a relay
+    // or over Tailscale, where the Host is neither. The token is the key,
+    // whatever name the request arrives under
+    // (tests/the-doing-half-runs-with-no-electron).
+    const guarded = url.pathname === '/events' || url.pathname.startsWith('/api/') || url.pathname === '/file-key';
     const given = req.headers['x-agentbox-token'] || url.searchParams.get('token');
-    if (guarded && given !== token) {
+    if (guarded && !sameKey(given, typeof token === 'function' ? token() : token)) {
       res.writeHead(403, { 'content-type': 'text/plain' });
       res.end('Wrong or missing token. Use the url the terminal printed.');
       return;
     }
 
+    // The phone asks for its file key once, with its own key.
+    if (url.pathname === '/file-key') {
+      res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+      res.end(JSON.stringify({ key: fileKey(typeof token === 'function' ? token() : token) }));
+      return;
+    }
+
     // The phone line left open. Seven channels talk the other way, main to
     // screen, and every one of them is one-way, so this is an event stream
     // rather than a websocket: the same job with no dependency to add.
@@ -316,7 +447,19 @@ export function createServer({ channels, token, listeners = new Set(), dist = pa
       res.writeHead(200, { 'content-type': MIME[path.extname(file)] ?? 'application/octet-stream' });
       res.end(buf);
     });
-  });
+  };
+}
+
+/**
+ * The key a request carries against the real one, in the same time whatever
+ * it gets right, so nobody can learn the key a character at a time by timing
+ * the refusals. Both sides are hashed first because a length that differs is
+ * itself a thing `timingSafeEqual` would refuse at once.
+ */
+export function sameKey(given, key) {
+  if (typeof given !== 'string' || typeof key !== 'string' || !given || !key) return false;
+  const digest = (s) => crypto.createHash('sha256').update(s).digest();
+  return crypto.timingSafeEqual(digest(given), digest(key));
 }
 
 function readBody(req) {
@@ -324,9 +467,12 @@ function readBody(req) {
     let body = '';
     req.on('data', (c) => {
       body += c;
-      // A screen never posts anything large; the uploads go through their own
-      // channels. This is here so a stuck client cannot eat the process.
-      if (body.length > 8 * 1024 * 1024) reject(new Error('Body too large'));
+      // This is here so a stuck client cannot eat the process. A PHONE'S
+      // UPLOADS DO COME THROUGH HERE, though: it has no file paths, so a
+      // picture is posted whole, as base64, to zero:stage-attachment. 8 MB of
+      // that was a 6 MB photo; an iPhone's is often more (2026-10-12). The
+      // relay passes up to 32 MB (relay/worker.mjs).
+      if (body.length > 32 * 1024 * 1024) reject(new Error('Body too large'));
     });
     req.on('end', () => resolve(body));
     req.on('error', reject);