mulmoclaude 2.9.0 → 2.10.0

package/server/utils/files/sendFileHandle.ts

@@ -0,0 +1,115 @@
+// Serve an already-opened file. `express.static` re-opens by path after the caller's check, so a
+// path swapped in between is followed; serving from the verified handle closes that window.
+
+import path from "node:path";
+import type { Stats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+import type { Request, Response } from "express";
+
+const HEX = 16;
+const RANGE_NOT_SATISFIABLE = -1;
+
+export interface ByteRange {
+  start: number;
+  end: number;
+}
+
+/** What `req.range(size, { combine: true })` returns: ranges, -1 (unsatisfiable), -2 (malformed) or nothing. */
+export type ParsedRange = number | readonly ByteRange[] | undefined;
+
+export type RangeChoice = { kind: "whole" } | { kind: "unsatisfiable" } | { kind: "part"; range: ByteRange };
+
+const WHOLE: RangeChoice = { kind: "whole" };
+
+/** Several ranges, a malformed header or none at all get the whole file, as `send` does. */
+export function chooseByteRange(parsed: ParsedRange): RangeChoice {
+  if (parsed === RANGE_NOT_SATISFIABLE) return { kind: "unsatisfiable" };
+  const only = typeof parsed === "object" && parsed.length === 1 ? parsed[0] : undefined;
+  return only === undefined ? WHOLE : { kind: "part", range: only };
+}
+
+const weakEtag = (stats: Stats): string => `W/"${stats.size.toString(HEX)}-${Math.floor(stats.mtimeMs).toString(HEX)}"`;
+
+/** The validators a conditional request is judged against, as headers carry them. */
+export interface Validators {
+  etag: string;
+  lastModified: string;
+}
+
+const parseHttpDate = (value: string | undefined): number => (value === undefined ? Number.NaN : Date.parse(value));
+
+const tokenList = (header: string): string[] =>
+  header
+    .split(",")
+    .map((token) => token.trim())
+    .filter((token) => token !== "");
+
+const etagMatches = (token: string, etag: string): boolean => token === etag || `W/${token}` === etag || token === `W/${etag}`;
+
+/** A Range is honoured without If-Range, or when If-Range names the current entity tag or a date no older than it — as `send` does. */
+export function rangeApplies(ifRange: string | undefined, validators: Validators): boolean {
+  if (ifRange === undefined || ifRange === "") return true;
+  if (ifRange.includes('"')) return ifRange.includes(validators.etag);
+  return parseHttpDate(validators.lastModified) <= parseHttpDate(ifRange);
+}
+
+/** If-Match / If-Unmodified-Since that the current entity fails, answered 412 as `send` does. */
+export function preconditionFailed(ifMatch: string | undefined, ifUnmodifiedSince: string | undefined, validators: Validators): boolean {
+  if (ifMatch !== undefined && ifMatch !== "") return ifMatch !== "*" && !tokenList(ifMatch).some((token) => etagMatches(token, validators.etag));
+  const unmodifiedSince = parseHttpDate(ifUnmodifiedSince);
+  const lastModified = parseHttpDate(validators.lastModified);
+  return !Number.isNaN(unmodifiedSince) && (Number.isNaN(lastModified) || lastModified > unmodifiedSince);
+}
+
+function setEntityHeaders(res: Response, stats: Stats, relPath: string): Validators {
+  const validators = { etag: weakEtag(stats), lastModified: stats.mtime.toUTCString() };
+  if (res.getHeader("Content-Type") === undefined) res.type(path.extname(relPath) || "application/octet-stream");
+  res.setHeader("Accept-Ranges", "bytes");
+  res.setHeader("Cache-Control", "public, max-age=0");
+  res.setHeader("Last-Modified", validators.lastModified);
+  res.setHeader("ETag", validators.etag);
+  return validators;
+}
+
+// Only a byte range is served; any other unit gets the whole file, as `send` does.
+const BYTES_RANGE_RE = /^ *bytes=/;
+
+function requestedRange(req: Request, size: number, validators: Validators): RangeChoice {
+  if (!BYTES_RANGE_RE.test(req.get("Range") ?? "") || !rangeApplies(req.get("If-Range"), validators)) return WHOLE;
+  return chooseByteRange(req.range(size, { combine: true }));
+}
+
+/** 412 / 304 / 416 carry no body, like the 404s these mounts answer. True when one was sent. */
+function answeredWithoutBody(req: Request, res: Response, size: number, validators: Validators, choice: RangeChoice): boolean {
+  if (preconditionFailed(req.get("If-Match"), req.get("If-Unmodified-Since"), validators)) res.status(412);
+  else if (req.fresh) res.status(304);
+  else if (choice.kind === "unsatisfiable") res.status(416).setHeader("Content-Range", `bytes */${size}`);
+  else return false;
+  res.end();
+  return true;
+}
+
+async function streamBytes(req: Request, res: Response, handle: FileHandle, size: number, choice: RangeChoice): Promise<void> {
+  const { start, end } = choice.kind === "part" ? choice.range : { start: 0, end: size - 1 };
+  if (choice.kind === "part") res.status(206).setHeader("Content-Range", `bytes ${start}-${end}/${size}`);
+  res.setHeader("Content-Length", String(end - start + 1));
+  if (req.method === "HEAD" || size === 0) {
+    res.end();
+    return;
+  }
+  // A client that goes away mid-body rejects the pipeline; the response is already torn down then.
+  await pipeline(handle.createReadStream({ start, end, autoClose: false }), res).catch(() => res.destroy());
+}
+
+/** Serves `handle` as `relPath` (its extension picks the Content-Type unless one is set) and closes it. */
+export async function sendFileHandle(req: Request, res: Response, handle: FileHandle, relPath: string): Promise<void> {
+  try {
+    const stats = await handle.stat();
+    const validators = setEntityHeaders(res, stats, relPath);
+    const choice = requestedRange(req, stats.size, validators);
+    if (!answeredWithoutBody(req, res, stats.size, validators, choice)) await streamBytes(req, res, handle, stats.size, choice);
+  } finally {
+    await handle.close();
+  }
+}

package/server/utils/files/store-files.ts

@@ -0,0 +1,86 @@
+// The image and attachment stores read and write only inside the workspace: the store folder is
+// re-resolved under it on every call, so a store folder replaced by a link out is refused rather
+// than becoming the root, and contents go through the verified open / write
+// (plans/fix-3573-store-files.md).
+
+import { readdir, type FileHandle } from "node:fs/promises";
+import type { Dirent } from "node:fs";
+import { resolveExistingWithinRoot, scopeRealpath } from "@mulmoclaude/core/files";
+import { makeConfinedFileOps } from "../../plugins/confined-file-ops.js";
+import { artifactScope, openArtifactFile } from "./artifactMount.js";
+import { storeRelativePath, storeTrustedRoot } from "./storePaths.js";
+
+export interface StoreFiles {
+  /** Bytes of a regular file in the store; throws when it is missing, a directory, or outside. */
+  read: (relativePath: string) => Promise<Buffer>;
+  /** Atomic write. Creates the store folder and partitions; `mode` is applied through the verified handle. */
+  write: (relativePath: string, content: Uint8Array, options?: { mode?: number }) => Promise<void>;
+  /** Never throws: anything but a regular file inside the store is false. */
+  isFile: (relativePath: string) => Promise<boolean>;
+  /** Entries of a folder in the store ("" for the store itself); empty when it is missing or outside. Names only:
+   *  a folder swapped for a link mid-call can name outside entries, so read contents through `read`, never by path. */
+  listDir: (relativeDir: string) => Promise<Dirent[]>;
+}
+
+const rejected = (relativePath: string): Error => new Error(`path traversal rejected: ${relativePath}`);
+
+// `getRoot()` is re-read per call because tests repoint `WORKSPACE_PATHS.<dir>` mid-run.
+function storeLocation(getRoot: () => string, dirPrefix: string, relativePath: string): { root: string; trustedRoot: string; inStore: string } {
+  const root = getRoot();
+  const trustedRoot = storeTrustedRoot(root, dirPrefix);
+  const inStore = storeRelativePath(relativePath, dirPrefix);
+  if (trustedRoot === null || inStore === null) throw rejected(relativePath);
+  return { root, trustedRoot, inStore };
+}
+
+async function openStoreFile(getRoot: () => string, dirPrefix: string, relativePath: string): Promise<FileHandle | null> {
+  const { trustedRoot, inStore } = storeLocation(getRoot, dirPrefix, relativePath);
+  const scope = await artifactScope(trustedRoot, dirPrefix);
+  return scope === null ? null : openArtifactFile(scope, inStore);
+}
+
+// Only the names are check-then-use: every content read goes back through `openStoreFile`.
+async function listStoreDir(getRoot: () => string, dirPrefix: string, relativeDir: string): Promise<Dirent[]> {
+  const trustedRoot = storeTrustedRoot(getRoot(), dirPrefix);
+  const inStore = relativeDir === "" ? "" : storeRelativePath(relativeDir, dirPrefix);
+  const scope = trustedRoot === null || inStore === null ? null : await artifactScope(trustedRoot, dirPrefix);
+  const scopeReal = scope === null ? null : await scopeRealpath(scope);
+  const dirReal = scopeReal === null || inStore === null ? null : await resolveExistingWithinRoot(scopeReal, inStore);
+  return dirReal === null ? [] : readdir(dirReal, { withFileTypes: true });
+}
+
+async function chmodStoreFile(getRoot: () => string, dirPrefix: string, relativePath: string, mode: number): Promise<void> {
+  const handle = await openStoreFile(getRoot, dirPrefix, relativePath);
+  if (handle === null) throw rejected(relativePath);
+  try {
+    await handle.chmod(mode);
+  } finally {
+    await handle.close();
+  }
+}
+
+export function makeStoreFiles(getRoot: () => string, dirPrefix: string): StoreFiles {
+  return {
+    read: async (relativePath) => {
+      const handle = await openStoreFile(getRoot, dirPrefix, relativePath);
+      if (handle === null) throw rejected(relativePath);
+      try {
+        return await handle.readFile();
+      } finally {
+        await handle.close();
+      }
+    },
+    write: async (relativePath, content, options = {}) => {
+      const { root, trustedRoot, inStore } = storeLocation(getRoot, dirPrefix, relativePath);
+      await makeConfinedFileOps({ root, trustedRoot }).write(inStore, content);
+      if (options.mode !== undefined) await chmodStoreFile(getRoot, dirPrefix, relativePath, options.mode);
+    },
+    isFile: async (relativePath) => {
+      const handle = await openStoreFile(getRoot, dirPrefix, relativePath).catch(() => null);
+      if (handle === null) return false;
+      await handle.close();
+      return true;
+    },
+    listDir: (relativeDir) => listStoreDir(getRoot, dirPrefix, relativeDir).catch(() => []),
+  };
+}

package/server/utils/files/storePaths.ts

@@ -0,0 +1,23 @@
+// Path rules for the image / attachment stores, kept free of fs so both directions can be tested.
+
+import path from "node:path";
+
+// `C:foo` is relative to drive C:'s cwd, so `path.isAbsolute` misses it.
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:/;
+
+/** The workspace a store root `<workspace>/<dirPrefix>` lives in; null when the root does not end in `dirPrefix`. */
+export function storeTrustedRoot(absRoot: string, dirPrefix: string): string | null {
+  const segments = dirPrefix.split("/");
+  const anchor = path.resolve(absRoot, ...segments.map(() => ".."));
+  return path.join(anchor, ...segments) === path.resolve(absRoot) ? anchor : null;
+}
+
+/** `relativePath` (workspace-relative, optionally under `dirPrefix/`) as a path inside the store; null when it
+ *  is empty, absolute, drive-qualified, carries a NUL, or leads out of the store. */
+export function storeRelativePath(relativePath: string, dirPrefix: string): string | null {
+  const slashed = relativePath.replace(/\\/g, "/");
+  const inStore = slashed.startsWith(`${dirPrefix}/`) ? slashed.slice(dirPrefix.length + 1) : slashed;
+  if (inStore === "" || inStore.includes("\0") || path.posix.isAbsolute(inStore) || path.isAbsolute(inStore) || WINDOWS_DRIVE_RE.test(inStore)) return null;
+  const normalised = path.posix.normalize(inStore);
+  return normalised === "." || normalised === ".." || normalised.startsWith("../") ? null : normalised;
+}

package/server/utils/files/thumbnail-store.ts

@@ -5,12 +5,12 @@
 // host produces here. Kept a leaf util (no collection/remote-view imports) so
 // the builder in remoteView.ts is the only wiring point.
 //
-// Reads are workspace-containment-guarded (resolveWithinRoot, same discipline as
-// image-store.ts). Results are cached by (path, mtime, maxEdge) so repeated
+// Reads go through the verified handle (#3573), so a path swapped mid-call cannot
+// reach outside the workspace. Results are cached by (path, mtime, maxEdge) so repeated
 // pages / "load more" scrolls never re-decode the same source.
-import { readFile, realpath, stat } from "fs/promises";
+import type { FileHandle } from "fs/promises";
 import { workspacePath } from "../../workspace/paths.js";
-import { resolveWithinRoot } from "./safe.js";
+import { artifactScope, openArtifactFile } from "./artifactMount.js";
 import { log } from "../../system/logger/index.js";
 
 /** Decode → downscale to fit `maxEdge` (never enlarge) → re-encode JPEG.
@@ -62,6 +62,21 @@ export function clearThumbnailCache(): void {
   cache.clear();
 }
 
+async function thumbnailFromHandle(handle: FileHandle, relPath: string, maxEdge: number, resize: ResizeToJpeg): Promise<string | null> {
+  try {
+    const info = await handle.stat();
+    const cached = cacheGet(relPath, info.mtimeMs, maxEdge);
+    if (cached) return cached;
+    const out = await resize(await handle.readFile(), maxEdge);
+    const dataUrl = `data:image/jpeg;base64,${out.toString("base64")}`;
+    cacheSet(relPath, { mtimeMs: info.mtimeMs, maxEdge, dataUrl });
+    return dataUrl;
+  } catch (err) {
+    log.warn("thumbnail", "resolve failed", { relPath, error: String(err) });
+    return null;
+  }
+}
+
 /** Resolve a workspace-relative image path to a downscaled JPEG `data:` URL, or
  *  `null` when the path escapes the workspace, is missing, or can't be decoded —
  *  the caller then leaves the field as its original path (rendered as a
@@ -70,26 +85,13 @@ export function clearThumbnailCache(): void {
 export function createThumbnailResolver(resize: ResizeToJpeg = sharpResize) {
   return async function resolveThumbnail(relPath: string, maxEdge: number): Promise<string | null> {
     if (typeof relPath !== "string" || relPath.length === 0) return null;
-    let root: string;
-    try {
-      root = await realpath(workspacePath);
-    } catch {
-      return null;
-    }
-    const abs = resolveWithinRoot(root, relPath);
-    if (!abs) return null;
-    const info = await stat(abs).catch(() => null);
-    if (!info?.isFile()) return null;
-    const cached = cacheGet(relPath, info.mtimeMs, maxEdge);
-    if (cached) return cached;
+    const scope = await artifactScope(workspacePath, "").catch(() => null);
+    const handle = scope === null ? null : await openArtifactFile(scope, relPath).catch(() => null);
+    if (handle === null) return null;
     try {
-      const out = await resize(await readFile(abs), maxEdge);
-      const dataUrl = `data:image/jpeg;base64,${out.toString("base64")}`;
-      cacheSet(relPath, { mtimeMs: info.mtimeMs, maxEdge, dataUrl });
-      return dataUrl;
-    } catch (err) {
-      log.warn("thumbnail", "resolve failed", { relPath, error: String(err) });
-      return null;
+      return await thumbnailFromHandle(handle, relPath, maxEdge, resize);
+    } finally {
+      await handle.close();
     }
   };
 }

package/server/utils/files/upload-io.ts

@@ -1,18 +1,19 @@
-// Exclusive-create write for dropped-file uploads (#2270).
+// Exclusive-create write for new files: dropped-file uploads (#2270) and the File Explorer's "New file".
 //
 // Route handlers don't call raw `fs` — this is the domain module for that
 // write. It deliberately does NOT go through `writeFileAtomic`: that writes a
 // temp file and renames over the destination, which would silently clobber an
 // existing file. The upload route's non-clobbering rename loop is built on the
-// `wx` flag failing with EEXIST instead.
+// create failing with EEXIST instead.
 
-import { mkdir, writeFile } from "fs/promises";
+import { mkdir } from "fs/promises";
 import path from "path";
+import { createFileVerifiedInScope } from "@mulmoclaude/core/files";
 
-/** Create `absPath` holding `bytes`, creating parents as needed. Throws with
- *  `code: "EEXIST"` when the file is already there — the caller's cue to try
- *  the next `name (n).ext` candidate. */
-export async function writeNewFileExclusive(absPath: string, bytes: Buffer): Promise<void> {
+/** Create `absPath` holding `content`, creating parents as needed. `workspaceRoot` is the async realpath of the
+ *  workspace: the new file is proven to sit inside it before any byte is written (#3573). Throws with
+ *  `code: "EEXIST"` when the file is already there — the caller's cue to try the next `name (n).ext` candidate. */
+export async function writeNewFileExclusive(workspaceRoot: string, absPath: string, content: string | Uint8Array): Promise<void> {
   await mkdir(path.dirname(absPath), { recursive: true });
-  await writeFile(absPath, bytes, { flag: "wx" });
+  await createFileVerifiedInScope({ trustedReal: workspaceRoot, scopeWithinTrusted: "" }, path.dirname(absPath), path.basename(absPath), content);
 }

package/server/utils/html/htmlArtifactSplicer.ts

@@ -16,22 +16,27 @@
 // startup as an import side effect.
 
 import { readFile as fsReadFile } from "fs/promises";
-import { resolveWithinRoot } from "../files/safe.js";
+import type { VerifiedScope } from "@mulmoclaude/core/files";
+import { openArtifactFile } from "../files/artifactMount.js";
 import { injectImageRepairScript } from "../../../src/utils/image/imageRepairInlineScript.js";
 import { injectHeightReporterScript } from "../../../src/utils/html/iframeHeightReporterScript.js";
 
-/** Read an HTML artifact file (under `htmlsRoot`) and splice the
- *  image-self-repair script before its closing `</body>`. Returns
- *  the spliced HTML on success, `null` when the file can't be
- *  resolved (escapes the root) or read (missing / unreadable).
- *
- *  `htmlsRoot` MUST already be a realpath — `resolveWithinRoot`
- *  compares against it strictly. The middleware in `server/index.ts`
- *  passes the cached `getHtmlsDirReal()` result, which is a realpath. */
-export async function readAndInjectHtmlArtifact(htmlsRoot: string, relPath: string): Promise<string | null> {
-  const abs = resolveWithinRoot(htmlsRoot, relPath);
-  if (!abs) return null;
-  return readAndInjectHtmlFile(abs);
+const spliceHelperScripts = (raw: string): string => injectHeightReporterScript(injectImageRepairScript(raw));
+
+/** Read an HTML artifact under `scope` through a verified handle and splice the helper scripts.
+ *  Null when the file is missing, outside the scope, not a regular file, or unreadable. */
+export async function readAndInjectHtmlArtifact(scope: VerifiedScope, relPath: string): Promise<string | null> {
+  try {
+    const handle = await openArtifactFile(scope, relPath);
+    if (handle === null) return null;
+    try {
+      return spliceHelperScripts(await handle.readFile("utf8"));
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return null;
+  }
 }
 
 /** Same splice, for a page the caller has ALREADY resolved to an absolute path.
@@ -45,5 +50,5 @@ export async function readAndInjectHtmlFile(absPath: string): Promise<string | n
   } catch {
     return null;
   }
-  return injectHeightReporterScript(injectImageRepairScript(raw));
+  return spliceHelperScripts(raw);
 }

package/server/utils/share/packHtml.ts

@@ -1,9 +1,8 @@
-import { readFile } from "fs/promises";
-import { realpathSync } from "fs";
 import path from "path";
 import JSZip from "jszip";
+import type { VerifiedScope } from "@mulmoclaude/core/files";
 import { resolveWorkspacePath } from "../files/workspace-io.js";
-import { resolveWithinRoot } from "../files/safe.js";
+import { artifactScope, lexicallyInside, openArtifactFile, readArtifactFile } from "../files/artifactMount.js";
 import { rewriteHtmlAssets } from "./rewriteAssets.js";
 import { log } from "../../system/logger/index.js";
 
@@ -22,32 +21,29 @@ export interface PackedBundle {
   files: PackedFile[];
 }
 
-// `resolveWithinRoot` requires an already-realpath'd root. Resolved
-// lazily (not at import) so loading this module never depends on the
-// workspace dir existing yet; the location doesn't change during a run.
-let workspaceRealCache: string | null = null;
-function workspaceReal(): string {
-  if (workspaceRealCache === null) workspaceRealCache = realpathSync(resolveWorkspacePath("."));
-  return workspaceRealCache;
-}
-
 function stripQueryHash(ref: string): string {
   const cut = ref.search(/[?#]/);
   return cut === -1 ? ref : ref.slice(0, cut);
 }
 
-// Resolve a workspace-relative path to a contained absolute path, or
-// null if it escapes the workspace / doesn't exist. `resolveWithinRoot`
-// already realpath-checks containment; the extra `path.relative` guard
-// is the form CodeQL's js/path-injection analysis recognizes as a
-// sanitizer (its `startsWith` form isn't), and is redundant at runtime.
-function safeWorkspaceAbs(relFromRoot: string): string | null {
-  const root = workspaceReal();
-  const abs = resolveWithinRoot(root, relFromRoot);
-  if (!abs) return null;
-  const rel = path.relative(root, abs);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
-  return abs;
+// Reads go through the verified handle (#3573). The lexical check is the form CodeQL's js/path-injection recognises.
+async function workspaceTarget(relFromRoot: string): Promise<{ scope: VerifiedScope; inside: string } | null> {
+  const root = resolveWorkspacePath(".");
+  const inside = lexicallyInside(root, relFromRoot);
+  const scope = inside === null ? null : await artifactScope(root, "");
+  return scope === null || inside === null ? null : { scope, inside };
+}
+
+// The page's own read errors (EACCES …) propagate; only missing, outside or not a regular file is "not found".
+async function readPage(htmlRelPath: string): Promise<string> {
+  const target = await workspaceTarget(htmlRelPath);
+  const handle = target === null ? null : await openArtifactFile(target.scope, target.inside);
+  if (handle === null) throw new Error(`HTML not found or outside workspace: ${htmlRelPath}`);
+  try {
+    return await handle.readFile("utf-8");
+  } finally {
+    await handle.close();
+  }
 }
 
 // Resolve a ref (relative to the HTML file's dir) to workspace bytes.
@@ -55,19 +51,12 @@ function safeWorkspaceAbs(relFromRoot: string): string | null {
 // missing — the caller warns and leaves the (now dangling) link.
 async function readAsset(htmlDir: string, originalRef: string): Promise<Buffer | null> {
   const relFromRoot = path.posix.normalize(path.posix.join(htmlDir, stripQueryHash(originalRef)));
-  const abs = safeWorkspaceAbs(relFromRoot);
-  if (!abs) return null;
-  try {
-    return await readFile(abs);
-  } catch {
-    return null;
-  }
+  const target = await workspaceTarget(relFromRoot).catch(() => null);
+  return target === null ? null : readArtifactFile(target.scope, target.inside);
 }
 
 export async function packHtmlBundle(htmlRelPath: string): Promise<PackedBundle> {
-  const abs = safeWorkspaceAbs(htmlRelPath);
-  if (!abs) throw new Error(`HTML not found or outside workspace: ${htmlRelPath}`);
-  const html = await readFile(abs, "utf-8");
+  const html = await readPage(htmlRelPath);
 
   const { html: rewritten, assets } = rewriteHtmlAssets(html);
   const htmlDir = path.posix.dirname(htmlRelPath);

package/server/workspace/photo-locations/index.ts

@@ -14,11 +14,11 @@
 // auto-capture is enabled in `AppSettings.photoExif`.
 
 import path from "node:path";
-import { mkdir } from "node:fs/promises";
-import { writeFileAtomic } from "../../utils/files/atomic.js";
 import { WORKSPACE_PATHS, WORKSPACE_DIRS } from "../paths.js";
 import { isPhotoExifAutoCaptureEnabled, loadSettings } from "../../system/config.js";
-import { isExifSupportedMime, readPhotoExif, type ExifParser, type PhotoExif } from "../../utils/exif.js";
+import { isExifSupportedMime, parsePhotoExif, type ExifParser, type PhotoExif } from "../../utils/exif.js";
+import { loadAttachmentBytes } from "../../utils/files/attachment-store.js";
+import { locationsStore } from "./store.js";
 import { log } from "../../system/logger/index.js";
 import { publishPhotoLocationsChanged } from "../../events/photo-locations-change.js";
 
@@ -65,12 +65,16 @@ function partitionForAttachment(attachmentRelativePath: string): string {
   return path.posix.join(year, month);
 }
 
+/** The sidecar's path inside the locations store (`YYYY/MM/<id>.json`). */
+function sidecarStorePath(attachmentRelativePath: string): string | null {
+  const partition = partitionForAttachment(attachmentRelativePath);
+  return partition === "" ? null : path.posix.join(partition, `${sidecarIdForAttachment(attachmentRelativePath)}.json`);
+}
+
 /** Compute the absolute sidecar path for a saved attachment. */
 export function sidecarPathForAttachment(attachmentRelativePath: string): string | null {
-  const partition = partitionForAttachment(attachmentRelativePath);
-  if (partition === "") return null;
-  const sidecarId = sidecarIdForAttachment(attachmentRelativePath);
-  return path.join(WORKSPACE_PATHS.locations, partition, `${sidecarId}.json`);
+  const storePath = sidecarStorePath(attachmentRelativePath);
+  return storePath === null ? null : path.join(WORKSPACE_PATHS.locations, storePath);
 }
 
 /** Hook the attachment-store calls after every saved attachment.
@@ -81,8 +85,8 @@ export function sidecarPathForAttachment(attachmentRelativePath: string): string
  *
  *  Errors are swallowed and logged at warn — we never want a failed
  *  EXIF probe to fail the upload. */
-export function capturePhotoLocation(absPhotoPath: string, attachmentRelativePath: string, mimeType: string): Promise<void> {
-  return capturePhotoLocationWithParser(absPhotoPath, attachmentRelativePath, mimeType);
+export function capturePhotoLocation(attachmentRelativePath: string, mimeType: string): Promise<void> {
+  return capturePhotoLocationWithParser(attachmentRelativePath, mimeType);
 }
 
 /** Gate check: should we even try to read EXIF for this MIME, given
@@ -92,13 +96,14 @@ function shouldCapture(mimeType: string): boolean {
   return isPhotoExifAutoCaptureEnabled(loadSettings());
 }
 
-/** Read EXIF, swallowing parser errors as `null`. The hook never
- *  fails the upload — a thrown parser is just "skip the sidecar". */
-async function readExifSafe(absPhotoPath: string, attachmentRelativePath: string, parser: ExifParser | undefined): Promise<PhotoExif | null> {
+/** Read EXIF from the stored photo, swallowing errors as `null`. The
+ *  hook never fails the upload — an unreadable photo or a thrown
+ *  parser is just "skip the sidecar". */
+async function readExifSafe(attachmentRelativePath: string, parser: ExifParser | undefined): Promise<PhotoExif | null> {
   try {
-    return await readPhotoExif(absPhotoPath, parser);
+    return await parsePhotoExif(await loadAttachmentBytes(attachmentRelativePath), parser);
   } catch (err) {
-    log.warn("photo-locations", "exif parse threw — skipping sidecar", { path: attachmentRelativePath, error: String(err) });
+    log.warn("photo-locations", "exif read failed — skipping sidecar", { path: attachmentRelativePath, error: String(err) });
     return null;
   }
 }
@@ -106,10 +111,9 @@ async function readExifSafe(absPhotoPath: string, attachmentRelativePath: string
 /** Write the sidecar JSON, creating parent dirs as needed. Failures
  *  are logged but never thrown — the photo upload already succeeded
  *  by the time this runs. */
-async function writeSidecarSafe(sidecarPath: string, payload: PhotoLocationSidecar): Promise<void> {
+async function writeSidecarSafe(storePath: string, payload: PhotoLocationSidecar): Promise<void> {
   try {
-    await mkdir(path.dirname(sidecarPath), { recursive: true });
-    await writeFileAtomic(sidecarPath, `${JSON.stringify(payload, null, 2)}\n`, { mode: SIDECAR_FILE_MODE });
+    await locationsStore.write(storePath, Buffer.from(`${JSON.stringify(payload, null, 2)}\n`), { mode: SIDECAR_FILE_MODE });
     log.info("photo-locations", "sidecar written", {
       attachment: payload.photo.relativePath,
       hasGps: payload.exif.lat !== undefined && payload.exif.lng !== undefined,
@@ -124,17 +128,12 @@ async function writeSidecarSafe(sidecarPath: string, payload: PhotoLocationSidec
 /** Parser-injectable variant. Production code uses
  *  `capturePhotoLocation`; tests reach for this overload to swap
  *  exifr for a stub so they don't need a JPEG fixture. */
-export async function capturePhotoLocationWithParser(
-  absPhotoPath: string,
-  attachmentRelativePath: string,
-  mimeType: string,
-  parser?: ExifParser,
-): Promise<void> {
+export async function capturePhotoLocationWithParser(attachmentRelativePath: string, mimeType: string, parser?: ExifParser): Promise<void> {
   if (!shouldCapture(mimeType)) return;
-  const exif = await readExifSafe(absPhotoPath, attachmentRelativePath, parser);
+  const exif = await readExifSafe(attachmentRelativePath, parser);
   if (!exif) return;
-  const sidecarPath = sidecarPathForAttachment(attachmentRelativePath);
-  if (!sidecarPath) {
+  const storePath = sidecarStorePath(attachmentRelativePath);
+  if (!storePath) {
     log.warn("photo-locations", "could not derive sidecar path — skipping", { attachmentRelativePath });
     return;
   }
@@ -144,7 +143,7 @@ export async function capturePhotoLocationWithParser(
     exif,
     capturedAt: new Date().toISOString(),
   };
-  await writeSidecarSafe(sidecarPath, payload);
+  await writeSidecarSafe(storePath, payload);
 }
 
 // `WORKSPACE_DIRS.locations` is referenced for typing-side