agentbox-app 0.1.13 → 0.1.16

package/main/team/session.mjs

@@ -8,6 +8,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { nameSlug } from '../../shared/product-name.mjs';
 import { runningAsAFreshUser } from '../../shared/fresh-user-home.mjs';
 import { supabaseBackend } from './supabase-backend.mjs';
@@ -52,31 +53,49 @@ export function teamConfigOnThisMac(home = os.homedir()) {
 // points at another file from a checkout only, and is first because that is
 // what the tests run on.
 //
-// AN INSTALLED BUILD IS ALWAYS THE SINGLE-PERSON APP (2026-10-06). The first
-// download from agentbox.ac opened on the team's sign-in page, because the Mac
-// it ran on kept a team key. The founder: "users are no longer using the
-// multiplayer version so this should never be visible." The team version still
-// runs from a checkout (npm run app). See
-// tests/the-installed-app-is-the-single-person-app.test.mjs.
+// AN INSTALLED BUILD SIGNS IN ONLY TO THE CLOUD BAKED INTO IT at release
+// (`bakedTeam` in its package.json), never to a key on the Mac: the first
+// download opened on a team's sign-in page because its Mac kept one
+// (tests/the-installed-app-is-the-single-person-app). The sign-in is for the
+// phone; the team version shows only with Alpha features › Multiplayer on
+// (tests/multiplayer-is-an-alpha-feature-in-the-installed-app).
 // AND SO IS ⌘K's NEW-USER WINDOW (w-9f6975906c, 2026-10-05). It runs from her
 // checkout, which holds a team key, so it opened on the same sign-in page:
 // "when i run this command i got the login screen again ... this was the
 // critical thing to fix". A new user is a new user of the single-person app.
+// A FRESH COPY HANDED A TEAM FILE IS A SECOND PERSON ON THAT TEAM (2026-10-21):
+// a power tester in her room. It loads that file and no other, so the ⌘K
+// window, which is handed none, stays the single-person app.
 export function loadCloudConfig(appDir, { packaged = isPackagedElectron(), home = os.homedir(), env = process.env } = {}) {
-  if (packaged || runningAsAFreshUser(env)) return null;
-  const tries = [
-    !packaged && process.env.AGENTBOX_TEAM_CONFIG,
+  if (packaged) return bakedTeam(appDir);
+  if (runningAsAFreshUser(env) && !env.AGENTBOX_TEAM_CONFIG) return null;
+  const tries = runningAsAFreshUser(env) ? [env.AGENTBOX_TEAM_CONFIG] : [
+    env.AGENTBOX_TEAM_CONFIG,
     path.join(appDir, 'cloud', 'team.config.json'),
     teamConfigOnThisMac(home),
   ];
+  let found = null;
   for (const file of tries) {
     if (!file) continue;
     try {
       const c = JSON.parse(fs.readFileSync(file, 'utf8'));
-      if (typeof c.url === 'string' && typeof c.anonKey === 'string') return c;
+      if (typeof c.url !== 'string' || typeof c.anonKey !== 'string') continue;
+      // A field the winning file lacks (phoneSite, added later) comes from a
+      // file further down for the same cloud, never from another cloud's.
+      if (!found) found = c;
+      else if (c.url === found.url) found = { ...c, ...found };
     } catch { /* try the next place; none of them is the single-person app */ }
   }
-  return null;
+  return found;
+}
+
+function bakedTeam(appDir) {
+  try {
+    const b = JSON.parse(fs.readFileSync(path.join(appDir, 'package.json'), 'utf8')).bakedTeam;
+    if (typeof b?.url !== 'string' || typeof b.anonKey !== 'string') return null;
+    const site = typeof b.phoneSite === 'string' && /^https:\/\/[^\s/]+(\/\S*)?$/.test(b.phoneSite) ? { phoneSite: b.phoneSite } : {};
+    return { url: b.url, anonKey: b.anonKey, ...site };
+  } catch { return null; }
 }
 
 function fileStorage(file, { encrypt, decrypt }) {
@@ -97,10 +116,18 @@ function fileStorage(file, { encrypt, decrypt }) {
   return {
     getItem: (key) => read()[key] ?? null,
     setItem: (key, value) => { const d = read(); d[key] = value; write(d); },
-    removeItem: (key) => { const d = read(); delete d[key]; write(d); },
+    // Nothing to remove writes nothing, so a Mac never signed in never asks the keychain.
+    removeItem: (key) => { const d = read(); if (!(key in d)) return; delete d[key]; write(d); },
   };
 }
 
+// A request to the account database that never answers is ended: its
+// library waits for ever, and the phone's and the team's sync wait on it.
+// Long enough for a file going up on a slow network.
+const DATABASE_DEADLINE_MS = 5 * 60_000;
+export const withDeadline = (ms = DATABASE_DEADLINE_MS) => (url, init = {}) =>
+  fetch(url, { ...init, signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(ms)]) : AbortSignal.timeout(ms) });
+
 export function supabaseSession({ cloudConfig, sessionFile, encrypt = null, decrypt = null, openExternal, packaged = isPackagedElectron(), testLogin = process.env.AGENTBOX_TEAM_TEST_LOGIN }) {
   const configured = !!cloudConfig;
   if (packaged) testLogin = null;
@@ -110,6 +137,7 @@ export function supabaseSession({ cloudConfig, sessionFile, encrypt = null, decr
     if (client) return client;
     const { createClient } = await import('@supabase/supabase-js');
     client = createClient(cloudConfig.url, cloudConfig.anonKey, {
+      global: { fetch: withDeadline() },
       auth: {
         flowType: 'pkce',
         storage: fileStorage(sessionFile, { encrypt, decrypt }),
@@ -163,14 +191,28 @@ export function supabaseSession({ cloudConfig, sessionFile, encrypt = null, decr
     // answers { confirm: true } and the page says to check the inbox.
     async signUp({ email, password, name }) {
       if (!configured) throw new Error('this build has no team cloud configured');
-      const c = await getClient();
-      const { data, error } = await c.auth.signUp({
+      // The plain kind of email link, which the phone website can finish; this
+      // Mac's own client would ask for a code only this Mac could spend.
+      const { createClient } = await import('@supabase/supabase-js');
+      const plain = createClient(cloudConfig.url, cloudConfig.anonKey, {
+        global: { fetch: withDeadline() },
+        auth: { flowType: 'implicit', persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
+      });
+      const { data, error } = await plain.auth.signUp({
         email: String(email ?? '').trim(),
         password: String(password ?? ''),
-        options: { data: { full_name: String(name ?? '').trim() || undefined } },
+        options: {
+          data: { full_name: String(name ?? '').trim() || undefined },
+          // Else the email's link goes to the database's default, this Mac's sign-in listener, dead outside a sign-in.
+          emailRedirectTo: typeof cloudConfig.phoneSite === 'string' ? cloudConfig.phoneSite : undefined,
+        },
       });
       if (error) throw new Error(plainAuthError(error.message));
-      return data?.session ? { backend: supabaseBackend(c) } : { confirm: true };
+      if (!data?.session) return { confirm: true };
+      const c = await getClient();
+      const { error: kept } = await c.auth.setSession(data.session);
+      if (kept) throw new Error(plainAuthError(kept.message));
+      return { backend: supabaseBackend(c) };
     },
 
     cancelSignIn: () => cancelGoogleSignIn(),
@@ -194,23 +236,51 @@ export function plainAuthError(message) {
   return m || 'That did not work. Try again.';
 }
 
-// WHERE THE HEADLESS APP KEEPS ITS SIGN-IN: in its own data folder, readable by
-// this user only, never in the store root. The store is the folder people
-// copy, sync and hand to agents, and this file holds a refresh token in plain
-// JSON (review, 2026-10-01). One left in the store by an older copy is moved.
-export function headlessSessionFile({ userDir, storeRoot }) {
-  const file = path.join(userDir, 'team-session.json');
-  const old = path.join(storeRoot, '.team-session');
+// THE SIGN-IN NEVER LANDS IN THE STORE ROOT. The store is in every worker's
+// granted directories, and this file holds a refresh token in plain JSON, so it
+// resolves to a path OUTSIDE the store. A dir inside the store moves to a
+// per-store folder under the config home; if even that is inside the store
+// there is nowhere safe and it throws, because writing the token where a worker
+// reads it is worse than a sign-in to do again. A copy an older version left in
+// the store, under either name, is carried across.
+const isInside = (file, root) => {
+  const f = path.resolve(file);
+  const r = path.resolve(root);
+  return f === r || f.startsWith(r + path.sep);
+};
+
+function configHome({ home, env }) {
+  const given = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
+  return given && path.isAbsolute(given) ? given : path.join(home, '.config');
+}
+
+function sessionFileOutsideStore({ dir, name, storeRoot, home = os.homedir(), env = process.env }) {
+  let file = path.join(dir, name);
+  if (isInside(file, storeRoot)) {
+    const tag = crypto.createHash('sha256').update(path.resolve(storeRoot)).digest('hex').slice(0, 16);
+    file = path.join(configHome({ home, env }), nameSlug, 'sessions', tag, name);
+    if (isInside(file, storeRoot)) throw new Error(`no place outside the store root for the team session: ${storeRoot}`);
+  }
+  const olds = [path.join(storeRoot, '.team-session'), path.join(storeRoot, 'team-session.json')];
   try {
-    if (!fs.existsSync(file) && fs.existsSync(old)) {
-      fs.mkdirSync(userDir, { recursive: true });
-      fs.renameSync(old, file);
+    if (!fs.existsSync(file)) {
+      for (const old of olds) {
+        if (path.resolve(old) === path.resolve(file) || !fs.existsSync(old)) continue;
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.renameSync(old, file);
+        break;
+      }
     }
     if (fs.existsSync(file)) fs.chmodSync(file, 0o600);
   } catch { /* a session that cannot be moved is a sign-in to do again */ }
   return file;
 }
 
+// The headless app keeps its sign-in as plain JSON readable by this user only.
+export function headlessSessionFile({ userDir, storeRoot, home, env }) {
+  return sessionFileOutsideStore({ dir: userDir, name: 'team-session.json', storeRoot, home, env });
+}
+
 // The same session shape over the in-memory cloud, for tests.
 export function memorySession(backendFor) {
   let signedIn = null;

package/main/team/supabase-backend.mjs

@@ -4,6 +4,7 @@
 // actually keeps people apart; nothing here is trusted to.
 import { asPulled } from '../../shared/team-rules.mjs';
 import { cleanStatus } from '../../shared/team-status.mjs';
+import { roomsSupabase } from './rooms-supabase.mjs';
 
 const PAGE = 500;
 const PUSH_BATCH = 200;
@@ -19,8 +20,26 @@ function must({ data, error }, what) {
   return data;
 }
 
+const COMMAND_COLUMNS = 'id,owner,device,project,item,kind,payload,created_at,claimed_at,taken_at,outcome';
+// Who claimed (`cloud:<run>`, 20261026000000_phone_carries_on_in_the_cloud.sql),
+// asked for only once the database has the column, so a computer that runs
+// before the migration is applied still reads its phone.
+const CLOUD_COLUMNS = `${COMMAND_COLUMNS},claimed_by`;
+const noCloudColumn = (error) => /claimed_by|column .*cloud|cloud.* column/i.test(String(error?.message ?? ''));
+const commandOut = (r) => ({ id: r.id, owner: r.owner, device: r.device, project: r.project, item: r.item, kind: r.kind, payload: r.payload ?? {}, createdAt: r.created_at, claimedAt: r.claimed_at ?? null, claimedBy: r.claimed_by ?? null, takenAt: r.taken_at ?? null, outcome: r.outcome ?? null });
+
 export function supabaseBackend(client) {
   let personId = null;
+  // Whether the database has the cloud's columns yet; the first refusal says not.
+  let cloudColumns = true;
+  const commandsWith = async (query, base = COMMAND_COLUMNS) => {
+    if (cloudColumns) {
+      const out = await query(`${base},claimed_by`);
+      if (!out.error || !noCloudColumn(out.error)) return out;
+      cloudColumns = false;
+    }
+    return query(base);
+  };
   async function myId() {
     if (personId) return personId;
     const { data, error } = await client.auth.getUser();
@@ -219,13 +238,174 @@ export function supabaseBackend(client) {
       }));
     },
 
+    // THE FILES A CONVERSATION'S MESSAGES LINK TO (w-140ac855b1). Row level
+    // security decides who may read and add one (20261013000000_message_files.sql).
+    async hasFiles(projectId, names) {
+      if (!names.length) return [];
+      const rows = must(await client.from('message_files').select('name').eq('project_id', projectId).in('name', names), 'asking which pictures your team has');
+      return rows.map((r) => r.name);
+    },
+
+    async getFile(projectId, name) {
+      const rows = must(await client.from('message_files').select('data').eq('project_id', projectId).eq('name', name).limit(1), 'taking a picture a teammate sent');
+      return rows[0]?.data ?? null;
+    },
+
+    async putFile(projectId, name, data) {
+      const me = await myId();
+      const rows = must(await client.from('message_files').upsert({ project_id: projectId, name, by_person: me, data }, { onConflict: 'project_id,name', ignoreDuplicates: true }).select('name'), 'sending a picture');
+      return (rows?.length ?? 0) > 0;
+    },
+
+    // HER OWN ROWS FOR HER PHONE (20261014000200_phone_inbox.sql). The owner
+    // column defaults to her, and row level security keeps every row hers.
+    // Every row names the computer it belongs to (`device`).
+    // Each write names who it is for, so a write begun before a sign-out
+    // that lands after somebody else signed in is refused by the database
+    // (`owner = auth.uid()`) rather than written into their account.
+    async putPhoneProject({ owner, device, project, name, cloud }) {
+      await myId();
+      const row = { ...(owner ? { owner } : {}), device, project, name, updated_at: new Date().toISOString() };
+      const put = (r) => client.from('phone_projects').upsert(r, { onConflict: 'owner,device,project' });
+      let out = cloud === undefined || !cloudColumns ? await put(row) : await put({ ...row, cloud: !!cloud });
+      if (out.error && cloud !== undefined && cloudColumns && noCloudColumn(out.error)) { cloudColumns = false; out = await put(row); }
+      must(out, 'putting a project on your phone');
+    },
+    async dropPhoneProject(device, project, owner) {
+      const me = await myId();
+      // Its threads go with it (the database cascades).
+      must(await client.from('phone_projects').delete().eq('owner', owner ?? me).eq('device', device).eq('project', project), 'taking a project off your phone');
+    },
+    async putPhoneThreads(device, project, rows, owner) {
+      await myId();
+      const at = new Date().toISOString();
+      for (let i = 0; i < rows.length; i += 50) {
+        const batch = rows.slice(i, i + 50).map((r) => ({ ...(owner ? { owner } : {}), device, project, item: r.item, snapshot: r.snapshot, updated_at: at }));
+        must(await client.from('phone_threads').upsert(batch, { onConflict: 'owner,device,project,item' }), 'sending threads to your phone');
+      }
+    },
+    // Her files for the phone, in her own folder of a private bucket
+    // (20261017000000_phone_files.sql). Named by what is in them, so one
+    // already there is the same file and is left as it is.
+    async putPhoneFile({ owner, device, name, data, type }) {
+      const me = await myId();
+      const { error } = await client.storage.from('phone-files').upload(`${owner ?? me}/${device}/${name}`, data, { contentType: type ?? 'application/octet-stream', upsert: false });
+      if (error && !/exists|duplicate/i.test(`${error.message} ${error.statusCode ?? ''}`) && String(error.statusCode) !== '409') throw new Error(`sending a file to your phone: ${error.message}`);
+    },
+    // A picture her phone put in this computer's folder for a reply; null when it is not there.
+    async getPhoneFile({ owner, device, name }) {
+      const me = await myId();
+      const { data, error } = await client.storage.from('phone-files').download(`${owner ?? me}/${device}/${name}`);
+      if (error) {
+        if (/not.?found/i.test(`${error.message} ${error.error ?? ''}`) || [400, 404].includes(Number(error.statusCode ?? error.status))) return null;
+        throw new Error(`taking a picture from your phone: ${error.message}`);
+      }
+      return Buffer.from(await data.arrayBuffer());
+    },
+    async dropPhoneFiles({ owner, device, names }) {
+      const me = await myId();
+      for (let i = 0; i < names.length; i += 100) {
+        const { error } = await client.storage.from('phone-files').remove(names.slice(i, i + 100).map((n) => `${owner ?? me}/${device}/${n}`));
+        if (error) throw new Error(`clearing old files from your phone: ${error.message}`);
+      }
+    },
+    async dropPhoneThreads(device, project, items, owner) {
+      const me = await myId();
+      for (let i = 0; i < items.length; i += 100) {
+        must(await client.from('phone_threads').delete().eq('owner', owner ?? me).eq('device', device).eq('project', project).in('item', items.slice(i, i + 100)), 'taking threads off your phone');
+      }
+    },
+    // What her phone reads and sends.
+    async phoneProjects() {
+      const me = await myId();
+      const rows = must(await client.from('phone_projects').select('owner,device,project,name').order('name'), 'reading the projects on your phone');
+      return (rows ?? []).filter((r) => r.owner === me);
+    },
+    async phoneThreads() {
+      const me = await myId();
+      const rows = must(await client.from('phone_threads').select('owner,device,project,item,snapshot,updated_at').order('updated_at', { ascending: false }).limit(1000), 'reading the threads on your phone');
+      return (rows ?? []).filter((r) => r.owner === me).map((r) => ({ owner: r.owner, device: r.device, project: r.project, item: r.item, snapshot: r.snapshot, updatedAt: Date.parse(r.updated_at) }));
+    },
+    // One row per computer (20261023000000_phone_settings.sql).
+    async putPhoneSettings({ owner, device, name, settings }) {
+      await myId();
+      must(await client.from('phone_settings').upsert({ ...(owner ? { owner } : {}), device, name, settings, updated_at: new Date().toISOString() }, { onConflict: 'owner,device' }), 'sending your settings to your phone');
+    },
+    async phoneSettings() {
+      const me = await myId();
+      const rows = must(await client.from('phone_settings').select('owner,device,name,settings,updated_at').order('updated_at', { ascending: false }), 'reading your computer\'s settings');
+      return (rows ?? []).filter((r) => r.owner === me).map((r) => ({ owner: r.owner, device: r.device, name: r.name, settings: r.settings, updatedAt: Date.parse(r.updated_at) }));
+    },
+    // The phones her alerts go to (20261025000000_push_devices.sql). The phone writes its own row; this is for tests.
+    async putPushDevice({ token, platform, appVersion = null }) {
+      await myId();
+      must(await client.from('push_devices').upsert({ token, platform, app_version: appVersion, updated_at: new Date().toISOString() }, { onConflict: 'owner,token' }), 'turning on alerts');
+    },
+    async pushDevices(owner) {
+      const me = await myId();
+      const rows = must(await client.from('push_devices').select('owner,token,platform,app_version,updated_at').eq('owner', owner ?? me), 'reading the phones to alert');
+      return (rows ?? []).map((r) => ({ owner: r.owner, token: r.token, platform: r.platform, appVersion: r.app_version ?? null, updatedAt: Date.parse(r.updated_at) }));
+    },
+    async dropPushDevice(token, owner) {
+      const me = await myId();
+      must(await client.from('push_devices').delete().eq('owner', owner ?? me).eq('token', token), 'forgetting a phone');
+    },
+    async addPhoneCommand({ device, project = null, item = null, kind, payload = {} }) {
+      await myId();
+      const row = must(await client.from('phone_commands').insert({ device, project, item, kind, payload }).select(COMMAND_COLUMNS).single(), 'sending that to your computer');
+      return commandOut(row);
+    },
+    async phoneCommands() {
+      await myId();
+      const rows = must(await client.from('phone_commands').select(COMMAND_COLUMNS).order('created_at', { ascending: true }).limit(500), 'reading what your phone sent');
+      return (rows ?? []).map(commandOut);
+    },
+    // This computer's, every one still waiting, oldest first, a page at a time.
+    async waitingPhoneCommands(device) {
+      await myId();
+      const out = [];
+      for (let from = 0; ; from += 200) {
+        const rows = must(await commandsWith((cols) => client.from('phone_commands').select(cols).eq('device', device).is('taken_at', null).order('created_at', { ascending: true }).range(from, from + 199)), 'reading what your phone sent');
+        out.push(...(rows ?? []).map(commandOut));
+        if (!rows || rows.length < 200) return out;
+      }
+    },
+    // This computer's commands the cloud claimed since `since`, taken or not,
+    // so a computer waking up joins the runs it started (Supervisor#adoptCloudRun).
+    async cloudPhoneCommands(device, since) {
+      await myId();
+      if (!cloudColumns) return [];
+      const out = await client.from('phone_commands').select(CLOUD_COLUMNS).eq('device', device).not('claimed_by', 'is', null).gte('created_at', since).order('created_at', { ascending: true }).limit(200);
+      if (out.error && noCloudColumn(out.error)) { cloudColumns = false; return []; }
+      return (must(out, 'reading what the cloud took from your phone') ?? []).map(commandOut);
+    },
+    // THE COMPUTER CLAIMS ONE BEFORE IT DOES IT; the phone takes one back only
+    // while nobody has (renderer/src/cloud-bridge.ts). The database lets one win.
+    async claimPhoneCommand(id, owner) {
+      const me = await myId();
+      const who = owner ?? me;
+      const won = must(await client.from('phone_commands').update({ claimed_at: new Date().toISOString() }).eq('id', id).eq('owner', who).is('taken_at', null).is('claimed_at', null).select('id'), 'starting what your phone sent');
+      if (won?.length) return 'claimed';
+      const row = must(await commandsWith((cols) => client.from('phone_commands').select(cols).eq('id', id).eq('owner', who).maybeSingle(), 'taken_at,claimed_at'), 'reading what your phone sent');
+      // The cloud's claim is the cloud's run: never done here as if it were ours.
+      if (row?.claimed_by) return 'cloud';
+      return row && !row.taken_at && row.claimed_at ? 'ours' : 'gone';
+    },
+    async markPhoneCommand(id, outcome, owner) {
+      const me = await myId();
+      must(await client.from('phone_commands').update({ taken_at: new Date().toISOString(), outcome }).eq('id', id).eq('owner', owner ?? me).is('taken_at', null), 'marking what your phone sent as done');
+    },
+
     subscribe(onChange) {
       const channel = client.channel(`team-${Math.random().toString(36).slice(2)}`)
+        .on('postgres_changes', { event: 'INSERT', schema: 'public', table: 'phone_commands' }, () => onChange())
         .on('postgres_changes', { event: 'INSERT', schema: 'public', table: 'lines' }, () => onChange())
         .on('postgres_changes', { event: '*', schema: 'public', table: 'thread_cards' }, () => onChange())
         .on('postgres_changes', { event: 'UPDATE', schema: 'public', table: 'people' }, () => onChange())
         .subscribe();
       return () => { client.removeChannel(channel); };
     },
+
+    ...roomsSupabase(client, myId, must),
   };
 }

package/main/team/sync.mjs

@@ -20,9 +20,13 @@
 //   4. PRIVATE WORK. One title-free line per open task in a private project
 //      (who, what state, when it moved), and only when that set changed.
 //
+//   And in a conversation, the files its messages link to (below, FILES).
+//
 // Everything outside this file is passed in, so two "Macs" can run in one test
 // over an in-memory cloud. The app wires the real ones in main/team/index.mjs.
 import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
 import { whatATeammateMaySet, whatYourOtherCopyMaySet } from '../../shared/team-rules.mjs';
 
 const PAGE = 500;
@@ -31,6 +35,49 @@ const PAGE = 500;
 // joins no more, so a teammate cannot fill this disk with folders.
 export const MAX_SHARED_PROJECTS = 50;
 
+// FILES: A PICTURE IN A MESSAGE GOES WITH IT (w-140ac855b1, 2026-10-13).
+//
+// A picture pasted into a message is saved in the project's attachments folder
+// and the message links to it, `![…](attachments/…)`. Only the line used to
+// cross, so every picture sent to a teammate arrived as "missing image". Now
+// the sender's Mac puts each file it links to in the cloud BEFORE pushing the
+// line, and the reader's Mac takes the file down BEFORE the line lands, so a
+// message is never drawn without its picture (a picture drawn as missing stays
+// missing until the thread is reopened).
+//
+// Only in a conversation: an ordinary shared project's words never cross
+// (shared/team-rules.mjs), so nothing they link to does either. And every file
+// call is best effort. A cloud without the table, or one file that will not
+// come, must never stop a message.
+export const MAX_MESSAGE_FILE_BYTES = 10 * 1024 * 1024;
+// A file named in a message the cloud does not have yet, which is a sender who
+// has not updated. Asked about again at most once a minute, for two weeks.
+const WANTED_MAX = 200;
+const WANTED_EVERY_MS = 60_000;
+const WANTED_FOR_MS = 14 * 24 * 60 * 60 * 1000;
+// A PLAIN NAME and nothing else: no slash, no leading dot. The reader writes
+// what a teammate's line names, so a name is all a line may hand it.
+const NAMED = /\]\(attachments\/([A-Za-z0-9][\w.-]{0,159})\)/g;
+
+/** The files a ledger line's message links to, by name, each once. */
+export function filesNamedIn(line) {
+  if (!line || typeof line !== 'object' || !line.patch) return [];
+  return [...new Set([...JSON.stringify(line.patch).matchAll(NAMED)].map((m) => m[1]))];
+}
+
+// The attachments folder of a project on this Mac.
+export const diskFiles = {
+  size(dir, name) {
+    try { const st = fs.statSync(path.join(dir, 'attachments', name)); return st.isFile() ? st.size : null; } catch { return null; }
+  },
+  read: (dir, name) => fs.readFileSync(path.join(dir, 'attachments', name)),
+  // `wx`: a file already here under that name is never replaced.
+  write(dir, name, bytes) {
+    fs.mkdirSync(path.join(dir, 'attachments'), { recursive: true });
+    try { fs.writeFileSync(path.join(dir, 'attachments', name), bytes, { flag: 'wx' }); } catch (err) { if (err.code !== 'EEXIST') throw err; }
+  },
+};
+
 // Where each shared project's cursors stand, kept between runs.
 export function memorySyncState() {
   const map = new Map();
@@ -78,8 +125,65 @@ function adopt(line, me) {
   return { ...line, by: line.by || me, uid };
 }
 
-export function createTeamSync({ backend, disk, state, listShared, joinProject, listCards = () => [], teamIdOf = () => null }) {
+export function createTeamSync({ backend, disk, state, listShared, joinProject, listCards = () => [], teamIdOf = () => null, files = diskFiles, now = Date.now, log = () => {} }) {
   let running = null;
+  const quietly = async (what, fn, fallback) => {
+    try { return await fn(); } catch (err) { log(`team files: ${what}: ${err?.message ?? err}`); return fallback; }
+  };
+
+  // Takes down whichever of `names` the cloud has and this Mac does not.
+  // Answers the names still missing.
+  async function takeFiles(project, names) {
+    const missing = [...new Set(names)].filter((n) => files.size(project.dir, n) == null);
+    if (!missing.length || !backend.hasFiles) return missing;
+    const there = new Set(await quietly('asking', () => backend.hasFiles(project.projectId, missing), []));
+    for (const name of missing.filter((n) => there.has(n))) {
+      // One at a time: each can be ten megabytes.
+      const data = await quietly(`taking ${name}`, () => backend.getFile(project.projectId, name), null);
+      const bytes = typeof data === 'string' ? Buffer.from(data, 'base64') : null;
+      if (bytes && bytes.length <= MAX_MESSAGE_FILE_BYTES) await quietly(`saving ${name}`, () => files.write(project.dir, name, bytes));
+    }
+    return missing.filter((n) => files.size(project.dir, n) == null);
+  }
+
+  // Every line written here since the last look: the files your messages name
+  // go up, and the files anyone's name that are not here are wanted. The first
+  // look after updating starts at the top of the ledger, which is what sends a
+  // picture from before this existed.
+  async function sendFiles(project, me) {
+    if (!backend.putFile) return;
+    const cursor = state.get(project.projectId);
+    const { lines, end } = disk.readLinesFrom(project.dir, cursor.filesFrom ?? 0);
+    const mine = new Set();
+    const wanted = new Map((cursor.wanted ?? []).map((w) => [w.name, w]));
+    for (const line of lines) {
+      for (const name of filesNamedIn(line)) {
+        const size = files.size(project.dir, name);
+        if (size == null) { if (!wanted.has(name)) wanted.set(name, { name, since: now(), checked: 0 }); }
+        else if ((!line.by || line.by === me) && size <= MAX_MESSAGE_FILE_BYTES) mine.add(name);
+      }
+    }
+    if (mine.size) {
+      const there = await quietly('asking', () => backend.hasFiles(project.projectId, [...mine]), null);
+      if (!there) return; // Not now; this stretch of the ledger is looked at again next pass.
+      for (const name of [...mine].filter((n) => !there.includes(n))) {
+        const sent = await quietly(`sending ${name}`, async () => { await backend.putFile(project.projectId, name, files.read(project.dir, name).toString('base64')); return true; }, false);
+        if (!sent) return;
+      }
+    }
+    state.set(project.projectId, { ...state.get(project.projectId), filesFrom: end, wanted: [...wanted.values()].slice(-WANTED_MAX) });
+  }
+
+  async function takeWanted(project) {
+    const cursor = state.get(project.projectId);
+    const at = now();
+    const wanted = (cursor.wanted ?? []).filter((w) => at - w.since < WANTED_FOR_MS && files.size(project.dir, w.name) == null);
+    const due = wanted.filter((w) => at - w.checked >= WANTED_EVERY_MS).map((w) => w.name);
+    const still = new Set(due.length ? await takeFiles(project, due) : []);
+    const kept = wanted.filter((w) => !due.includes(w.name) || still.has(w.name))
+      .map((w) => (due.includes(w.name) ? { ...w, checked: at } : w));
+    if (kept.length !== (cursor.wanted ?? []).length || due.length) state.set(project.projectId, { ...state.get(project.projectId), wanted: kept });
+  }
 
   async function pushProject(project, me) {
     const cursor = state.get(project.projectId);
@@ -103,6 +207,8 @@ export function createTeamSync({ backend, disk, state, listShared, joinProject,
         // teammate's keeps only what they may set here (shared/team-rules.mjs).
         .map((l) => (l.by === me ? whatYourOtherCopyMaySet(l, { direct }) : whatATeammateMaySet(l, { direct })))
         .filter(Boolean);
+      // The pictures first, so no message lands without its own.
+      if (direct) await takeFiles(project, bring.flatMap(filesNamedIn));
       pulled += disk.appendForeignLines(project.dir, bring);
       // Lines pulled in move the file's end, but they were never ours to push,
       // and a push cursor left behind them would only re-read and skip them.
@@ -143,8 +249,10 @@ export function createTeamSync({ backend, disk, state, listShared, joinProject,
     for (const project of cloudProjects) {
       const here = local.get(project.id);
       if (!here) continue;
+      if (here.direct === true) await sendFiles(here, me);
       report.pushed += await pushProject(here, me);
       report.pulled += await pullProject(here, me);
+      if (here.direct === true) await takeWanted(here);
     }
 
     report.cards = await publishCards();