orbit-codex-bridge 0.1.1 → 0.1.3

package/server.mjs

@@ -13,12 +13,139 @@ import { DesktopRpc } from './lib/desktop.mjs';
 const root = path.dirname(fileURLToPath(import.meta.url));
 const packageVersion = JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8')).version;
 const sessionLifetime = 12 * 60 * 60 * 1000;
+const attachmentLifetime = 30 * 60 * 1000;
+const attachmentRetention = 24 * 60 * 60 * 1000;
+const maxAttachmentBytes = 8 * 1024 * 1024;
+const maxPendingAttachments = 5;
 const safeError = error => String(error.message || error).replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]').replace(/(?:sk-|sk_)[\w-]{12,}/g, '[REDACTED]').slice(0, 700);
 
 export function lanAddresses() {
   return Object.values(os.networkInterfaces()).flat().filter(address => address && address.family === 'IPv4' && !address.internal).map(address => address.address);
 }
 
+function cleanupStaleAttachments(store) {
+  const now=Date.now();
+  for(const cwd of new Set(store.list().map(thread=>thread.cwd).filter(Boolean))){
+    let projectRoot;
+    try{projectRoot=fs.realpathSync(cwd)}catch{continue}
+    const directory=path.join(projectRoot,'.orbit-attachments');
+    let entries;
+    try{
+      const stat=fs.lstatSync(directory);
+      if(stat.isSymbolicLink()||!stat.isDirectory())continue;
+      entries=fs.readdirSync(directory);
+    }catch{continue}
+    for(const name of entries){
+      if(!/^[a-f0-9]{32}(?:\.[a-zA-Z0-9]{1,12})?$/.test(name))continue;
+      const filename=path.join(directory,name);
+      try{
+        const stat=fs.lstatSync(filename);
+        if(!stat.isSymbolicLink()&&stat.isFile()&&now-stat.mtimeMs>attachmentRetention)fs.unlinkSync(filename);
+      }catch{}
+    }
+  }
+}
+
+const excludedProjectEntries=new Set([
+  '.git','.codex','.orbit-attachments','node_modules','.venv','venv','dist','build',
+  '.ssh','.aws','.azure','.config','.npm','.docker','secrets','credentials'
+]);
+const excludedProjectFiles=/^(?:\.env(?:\..*)?|\.npmrc|\.pypirc|\.netrc|\.git-credentials|id_(?:rsa|ed25519)(?:\.pub)?|.*(?:secret|credential)(?:\..*)?|.*\.(?:pem|p12|pfx|key|keystore))$/i;
+
+function checkedProjectEntry(row,relativePath=''){
+  if(!row?.cwd||typeof relativePath!=='string'||relativePath.length>1024||relativePath.includes('\0'))throw new Error('项目文件路径无效。');
+  const root=fs.realpathSync(row.cwd);
+  if(!fs.statSync(root).isDirectory())throw new Error('会话工作目录不可用。');
+  const parts=relativePath?relativePath.split(/[\\/]/):[];
+  if(parts.some(part=>!part||part==='.'||part==='..'))throw new Error('不允许访问项目目录之外的路径。');
+  let current=root;
+  for(const part of parts){
+    if(excludedProjectEntries.has(part.toLowerCase())||excludedProjectFiles.test(part))throw new Error('此系统目录或凭证文件不开放传输。');
+    current=path.join(current,part);
+    const stat=fs.lstatSync(current);
+    if(stat.isSymbolicLink())throw new Error('不支持通过符号链接传输文件。');
+  }
+  const resolved=path.resolve(current);
+  const relative=path.relative(root,resolved);
+  if(relative==='..'||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw new Error('不允许访问项目目录之外的路径。');
+  return {root,path:resolved,stat:fs.statSync(resolved),relative:parts.join(path.sep)};
+}
+
+function projectFileList(row,relativePath=''){
+  const directory=checkedProjectEntry(row,relativePath);
+  if(!directory.stat.isDirectory())throw new Error('所选路径不是文件夹。');
+  const entries=[];
+  const visit=(current,relative,depth)=>{
+    if(depth>8||entries.length>=1000)return;
+    for(const name of fs.readdirSync(current)){
+      if(excludedProjectEntries.has(name.toLowerCase())||excludedProjectFiles.test(name))continue;
+      const target=path.join(current,name);
+      let stat;
+      try{stat=fs.lstatSync(target)}catch{continue}
+      if(stat.isSymbolicLink())continue;
+      const child=relative?`${relative}/${name}`:name;
+      if(stat.isDirectory())entries.push({name,path:child,type:'directory',size:null,updatedAt:stat.mtimeMs});
+      else if(stat.isFile())entries.push({name,path:child,type:'file',size:stat.size,updatedAt:stat.mtimeMs});
+      if(stat.isDirectory())visit(target,child,depth+1);
+      if(entries.length>=1000)break;
+    }
+  };
+  visit(directory.path,directory.relative,0);
+  entries.sort((left,right)=>left.type===right.type?left.name.localeCompare(right.name):left.type==='directory'?-1:1);
+  return {path:directory.relative,entries:entries.slice(0,1000),truncated:entries.length>=1000};
+}
+
+const projectMimeTypes=new Map([
+  ['.txt','text/plain; charset=utf-8'],['.md','text/markdown; charset=utf-8'],['.json','application/json'],
+  ['.csv','text/csv; charset=utf-8'],['.html','text/html; charset=utf-8'],['.css','text/css; charset=utf-8'],
+  ['.js','text/javascript; charset=utf-8'],['.ts','text/plain; charset=utf-8'],['.xml','application/xml'],
+  ['.pdf','application/pdf'],['.png','image/png'],['.jpg','image/jpeg'],['.jpeg','image/jpeg'],['.gif','image/gif'],
+  ['.webp','image/webp'],['.svg','image/svg+xml'],['.zip','application/zip']
+]);
+
+function sendFileRange(request,response,row,relativePath){
+  const file=checkedProjectEntry(row,relativePath);
+  if(!file.stat.isFile())throw new Error('所选路径不是文件。');
+  if(file.stat.size>8*1024*1024)throw Object.assign(new Error('单个文件下载不得超过 8 MiB。'),{status:413});
+  const filename=path.basename(file.path);
+  const fallback=filename.replace(/[^\x20-\x7e]|["\\;]/g,'_');
+  const encoded=encodeURIComponent(filename).replace(/[!'()*]/g,character=>`%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+  const etag=`"orbit-${file.stat.size}-${Math.trunc(file.stat.mtimeMs)}"`;
+  const headers={
+    'Content-Type':projectMimeTypes.get(path.extname(filename).toLowerCase())||'application/octet-stream',
+    'Accept-Ranges':'bytes',
+    'ETag':etag,
+    'Content-Disposition':`attachment; filename="${fallback}"; filename*=UTF-8''${encoded}`,
+    'X-Content-Type-Options':'nosniff'
+  };
+  if(request.headers['if-none-match']===etag){response.writeHead(304,headers);return response.end()}
+  const ifRange=request.headers['if-range'];
+  const range=ifRange&&ifRange!==etag?null:request.headers.range;
+  if(!range){
+    response.writeHead(200,{...headers,'Content-Length':file.stat.size});
+    if(request.method==='HEAD')return response.end();
+    return fs.createReadStream(file.path).pipe(response);
+  }
+  const match=String(range).match(/^bytes=(\d*)-(\d*)$/);
+  if(!match||(!match[1]&&!match[2])){response.writeHead(416,{...headers,'Content-Range':`bytes */${file.stat.size}`});return response.end()}
+  let start,end;
+  if(!match[1]){
+    const suffix=Number(match[2]);
+    if(!Number.isSafeInteger(suffix)||suffix<=0)return response.writeHead(416,{'Content-Range':`bytes */${file.stat.size}`}).end();
+    start=Math.max(0,file.stat.size-suffix);end=file.stat.size-1;
+  }else{
+    start=Number(match[1]);end=match[2]?Number(match[2]):file.stat.size-1;
+  }
+  if(!Number.isSafeInteger(start)||!Number.isSafeInteger(end)||start<0||start>=file.stat.size||end<start){
+    response.writeHead(416,{...headers,'Content-Range':`bytes */${file.stat.size}`});return response.end();
+  }
+  end=Math.min(end,file.stat.size-1);
+  const length=end-start+1;
+  response.writeHead(206,{...headers,'Content-Length':length,'Content-Range':`bytes ${start}-${end}/${file.stat.size}`});
+  if(request.method==='HEAD')return response.end();
+  fs.createReadStream(file.path,{start,end}).pipe(response);
+}
+
 export function createOrbitServer(options = {}) {
   const home = options.home || process.env.ORBIT_CODEX_HOME || process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
   const dataDir = options.dataDir || path.join(root, '.runtime');
@@ -27,6 +154,7 @@ export function createOrbitServer(options = {}) {
   let pairingKey = fs.existsSync(credentialPath) ? fs.readFileSync(credentialPath, 'utf8').trim() : crypto.randomBytes(24).toString('base64url');
   fs.writeFileSync(credentialPath, pairingKey, { mode: 0o600 });
   const store = options.store || new NativeStore(home);
+  cleanupStaleAttachments(store);
   const endpoint = options.endpoint ?? process.env.ORBIT_APP_SERVER_URL ?? '';
   const rpc = options.rpc || options.desktopRpc || (endpoint ? new CodexRpc({ home, endpoint, tokenFile: process.env.ORBIT_APP_SERVER_TOKEN_FILE }) : new DesktopRpc());
   const executionMode = rpc.mode || (endpoint ? 'endpoint' : 'cold-resume');
@@ -70,6 +198,7 @@ export function createOrbitServer(options = {}) {
   const sessions = new Map();
   const attempts = new Map();
   const dedup = new Map();
+  const consumedAttachments = new Map();
   const sockets = new Set();
   const desktopWatchers = new Map();
   const queuedSettingsInFlight = new Set();
@@ -78,6 +207,7 @@ export function createOrbitServer(options = {}) {
   let revision = store.revision();
   let timer;
   let lastDesktopConnect = 0;
+  let lastAttachmentCleanup=Date.now();
 
   function requestOrigin(request) {
     const hostname = new URL(`http://${request.headers.host || 'invalid'}`).hostname;
@@ -99,6 +229,65 @@ export function createOrbitServer(options = {}) {
     return { ...session, key };
   }
 
+  function removeAttachment(session,id){
+    const attachment=session?.attachments?.get(id)||consumedAttachments.get(id);
+    if(!attachment)return false;
+    session?.attachments?.delete(id);
+    consumedAttachments.delete(id);
+    const filename=path.resolve(attachment.path);
+    if(path.dirname(filename)===path.join(path.resolve(attachment.projectRoot),'.orbit-attachments')
+      &&/^[a-f0-9]{32}(?:\.[a-zA-Z0-9]{1,12})?$/.test(path.basename(filename))){
+      try{if(fs.lstatSync(filename).isFile())fs.unlinkSync(filename)}catch{}
+    }
+    return true;
+  }
+
+  function removeSessionAttachments(session){
+    for(const [id,attachment] of session.attachments||[]){
+      if(attachment.consumed){consumedAttachments.set(id,attachment);session.attachments.delete(id);}
+      else removeAttachment(session,id);
+    }
+  }
+
+  function attachmentPath(row,id,label){
+    const extension=path.extname(label).slice(1).toLowerCase();
+    const projectRoot=fs.realpathSync(row.cwd);
+    if(!fs.statSync(projectRoot).isDirectory())throw new Error('会话工作目录不可用。');
+    const directory=path.join(projectRoot,'.orbit-attachments');
+    try{
+      const existing=fs.lstatSync(directory);
+      if(existing.isSymbolicLink()||!existing.isDirectory())throw new Error('附件暂存目录不安全。');
+    }catch(error){if(error.code!=='ENOENT')throw error;fs.mkdirSync(directory,{mode:0o700});}
+    return path.join(directory,`${id}${/^[a-z0-9]{1,12}$/.test(extension)?`.${extension}`:''}`);
+  }
+
+  async function uploadAttachment(request,response,session,threadId,url){
+    const row=store.row(threadId);
+    if(!row||row.archived||String(row.source).startsWith('{'))return json(response,400,{error:'归档会话或子代理不能接收文件。'});
+    if(executionMode!=='desktop'||!rpc.connected)return json(response,409,{error:'文件传输仅支持已连接的 Codex 桌面原会话。'});
+    if(!controlFor(session,threadId))return json(response,403,{error:'请先连接并接管这条原会话。'});
+    if(!rpc.runtime(threadId)?.attached)return json(response,409,{error:'请先在 Codex 桌面打开此会话并重新连接。'});
+    for(const [id,attachment]of session.attachments)if(attachment.expires<Date.now())removeAttachment(session,id);
+    if([...session.attachments.values()].filter(item=>item.threadId===threadId&&!item.consumed).length>=maxPendingAttachments)return json(response,429,{error:`这条会话最多可暂存 ${maxPendingAttachments} 个待发送文件。`});
+    const rawName=url.searchParams.get('name')||'';
+    const label=rawName.replace(/[\\/]/g,'_').replace(/[\u0000-\u001f\u007f<>:"|?*]/g,'_').trim().slice(0,160);
+    if(!label||label==='.'||label==='..')return json(response,400,{error:'文件名无效。'});
+    const chunks=[];
+    let size=0;
+    for await(const chunk of request){
+      size+=chunk.length;
+      if(size>maxAttachmentBytes)return json(response,413,{error:'单个文件不得超过 8 MiB。'});
+      chunks.push(chunk);
+    }
+    if(!size)return json(response,400,{error:'不能发送空文件。'});
+    const id=crypto.randomBytes(16).toString('hex');
+    const filename=attachmentPath(row,id,label);
+    fs.writeFileSync(filename,Buffer.concat(chunks),{flag:'wx',mode:0o600});
+    const projectRoot=fs.realpathSync(row.cwd);
+    session.attachments.set(id,{id,threadId,label,size,projectRoot,mimeType:String(request.headers['content-type']||'application/octet-stream').split(';')[0],path:filename,expires:Date.now()+attachmentLifetime});
+    return json(response,201,{id,threadId,label,size,mimeType:session.attachments.get(id).mimeType});
+  }
+
   function json(response, status, body, extra = {}) {
     response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', ...extra });
     response.end(JSON.stringify(body));
@@ -223,7 +412,7 @@ export function createOrbitServer(options = {}) {
         previous.count = 0;
         if (sessions.size >= 64) return json(response, 429, { error: '已连接设备过多，请重启桥接服务后重新配对。' });
         const key = crypto.randomBytes(32).toString('base64url');
-        sessions.set(key, { expires: Date.now() + sessionLifetime, enabled: new Map(), preferences: new Map() });
+        sessions.set(key, { expires: Date.now() + sessionLifetime, enabled: new Map(), preferences: new Map(), attachments:new Map() });
         const secure = publicUrl ? '; Secure' : '';
         return json(response, 200, { ok: true }, { 'Set-Cookie': `orbit_session=${key}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200${secure}` });
       }
@@ -235,6 +424,7 @@ export function createOrbitServer(options = {}) {
         if (request.method === 'GET' && url.pathname === '/api/models') return json(response, 200, { models: await modelCatalog() });
         if (request.method === 'POST' && url.pathname === '/api/logout') {
           sessions.delete(session.key);
+          removeSessionAttachments(session);
           for (const socket of sockets) if (socket.sessionKey === session.key) socket.close(1008, 'Logged out');
           return json(response, 200, { ok: true }, { 'Set-Cookie': 'orbit_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0' });
         }
@@ -244,6 +434,29 @@ export function createOrbitServer(options = {}) {
           if (!connection) return json(response, 400, { error: '请选择桥接服务提供的连接地址。' });
           return json(response, 200, { image: await QRCode.toDataURL(`${connection}/#pair=${encodeURIComponent(pairingKey)}`, { width: 280, margin: 2 }), warning: '扫码者将能查看本机会话。仅向可信设备展示。' });
         }
+        const uploadMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/attachments$/);
+        if(request.method==='POST'&&uploadMatch)return await uploadAttachment(request,response,session,uploadMatch[1],url);
+        const removeAttachmentMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/attachments\/remove$/);
+        if(request.method==='POST'&&removeAttachmentMatch){
+          const body=await readBody(request);
+          if(Object.keys(body).some(key=>key!=='attachmentId')||typeof body.attachmentId!=='string')return json(response,400,{error:'附件移除请求无效。'});
+          const attachment=session.attachments.get(body.attachmentId);
+          if(!attachment||attachment.threadId!==removeAttachmentMatch[1])return json(response,404,{error:'待发送附件不存在或已过期。'});
+          removeAttachment(session,body.attachmentId);
+          return json(response,200,{removed:true});
+        }
+        const filesMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/files$/);
+        if(request.method==='GET'&&filesMatch){
+          const row=store.row(filesMatch[1]);
+          if(!row)return json(response,404,{error:'会话不存在。'});
+          return json(response,200,projectFileList(row,url.searchParams.get('path')||''));
+        }
+        const fileMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/file$/);
+        if(request.method==='GET'&&fileMatch){
+          const row=store.row(fileMatch[1]);
+          if(!row)return json(response,404,{error:'会话不存在。'});
+          return sendFileRange(request,response,row,url.searchParams.get('path')||'');
+        }
         const match = url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/messages$/);
         if (request.method === 'GET' && match) {
           const history = store.historyFor(match[1], url.searchParams.get('before'), url.searchParams.get('limit') || 60);
@@ -335,7 +548,7 @@ export function createOrbitServer(options = {}) {
       }
       const control = controlFor(session, id);
       const approvals = control ? (executionMode === 'desktop' ? runtime?.approvals || [] : [...rpc.approvals.values()].filter(request => request.params.threadId === id).map(request => ({ ...request.params, requestId: String(request.id), method: request.method }))) : [];
-      return { subscribed: id || null, control, runtime, settings: control ? session.preferences.get(id) || null : null, turnId: runtime?.turnId || rpc.threads.get(id)?.turnId || null, approvals };
+      return { subscribed: id || null, control, runtime, settings: control ? session.preferences.get(id) || null : null, turnId: runtime?.turnId || rpc.threads.get(id)?.turnId || null, approvals, attachments:[...session.attachments.values()].filter(item=>item.threadId===id&&!item.consumed&&item.expires>Date.now()).map(({id,label,size,mimeType})=>({id,label,size,mimeType})) };
     }
     if (message.method === 'thread.enable') {
       const row = store.row(id);
@@ -365,10 +578,28 @@ export function createOrbitServer(options = {}) {
     if (message.method === 'turn.start') {
       const approval = controlFor(session, id);
       if (!approval) throw new Error('请先确认这条会话的接续方式。');
-      if (typeof body.text !== 'string' || !body.text.trim() || body.text.length > 20000) throw new Error('消息必须为 1–20000 个字符。');
-      if (executionMode === 'desktop') return rpc.startTurn(id, body.text.trim());
+      const mode=body.mode??'default';
+      if(!['default','plan','goal'].includes(mode))throw new Error('对话模式无效。');
+      const attachmentIds=body.attachmentIds===undefined?[]:body.attachmentIds;
+      if(!Array.isArray(attachmentIds)||attachmentIds.length>maxPendingAttachments||new Set(attachmentIds).size!==attachmentIds.length
+        ||attachmentIds.some(attachmentId=>typeof attachmentId!=='string'))throw new Error('文件附件列表无效。');
+      if(typeof body.text!=='string'||(!body.text.trim()&&!attachmentIds.length)||body.text.length>20000)throw new Error('消息或附件必须至少提供一项；文本不得超过 20000 个字符。');
+      const attachments=attachmentIds.map(attachmentId=>{
+        const attachment=session.attachments.get(attachmentId);
+        if(!attachment||attachment.threadId!==id||attachment.consumed||attachment.expires<Date.now())throw new Error('文件附件不存在、属于其他会话或已过期。请重新添加。');
+        return attachment;
+      });
+      let text=body.text.trim()||(attachments.length?`请查看并处理以下附件：${attachments.map(file=>file.label).join('、')}`:'');
+      if(mode==='goal')text=`请将本轮请求作为需要完成的目标，主动推进直到完成，并汇报结果；如果受阻，请明确说明原因。\n\n本轮目标：\n${text}`;
+      if(body.mode==='plan')text=`请先分析任务并制定清晰的分步计划，说明后等待我确认；在我确认前不要执行任何修改。\n\n任务：\n${text}`;
+      if (executionMode === 'desktop') {
+        const result=await rpc.startTurn(id,text,{mode,attachments});
+        for(const attachment of attachments){attachment.consumed=true;attachment.expires=Date.now()+attachmentRetention;consumedAttachments.set(attachment.id,attachment);}
+        return result;
+      }
+      if(mode!=='default'||attachments.length)throw new Error('计划/目标模式和文件附件仅支持 Codex 桌面热接管。');
       if (!rpc.threads.has(id) && !endpoint && store.locked(id)) throw new Error('会话已被其他进程占用，未发送消息。');
-      return rpc.startTurn(id, body.text.trim(), approval.writable, session.preferences.get(id) || null);
+      return rpc.startTurn(id,text,approval.writable,session.preferences.get(id)||null);
     }
     if (message.method === 'thread.settings') {
       if (!controlFor(session, id) || !store.row(id)) throw new Error('没有此会话的控制授权。');
@@ -399,9 +630,20 @@ export function createOrbitServer(options = {}) {
     if (message.method === 'turn.steer') {
       if (!controlFor(session, id)) throw new Error('没有此会话的控制授权。');
       if (executionMode !== 'desktop') throw new Error('当前执行通道不支持向桌面任务追加指令。');
-      if (typeof body.text !== 'string' || !body.text.trim() || body.text.length > 20000) throw new Error('消息必须为 1–20000 个字符。');
+      const attachmentIds=body.attachmentIds===undefined?[]:body.attachmentIds;
+      if(!Array.isArray(attachmentIds)||attachmentIds.length>maxPendingAttachments||new Set(attachmentIds).size!==attachmentIds.length
+        ||attachmentIds.some(attachmentId=>typeof attachmentId!=='string'))throw new Error('文件附件列表无效。');
+      if(typeof body.text!=='string'||(!body.text.trim()&&!attachmentIds.length)||body.text.length>20000)throw new Error('消息或附件必须至少提供一项；文本不得超过 20000 个字符。');
       if (typeof body.turnId !== 'string' || !body.turnId) throw new Error('缺少当前任务标识，请刷新后重试。');
-      return rpc.steer(id, body.text.trim(), body.turnId);
+      const attachments=attachmentIds.map(attachmentId=>{
+        const attachment=session.attachments.get(attachmentId);
+        if(!attachment||attachment.threadId!==id||attachment.consumed||attachment.expires<Date.now())throw new Error('文件附件不存在、属于其他会话或已过期。请重新添加。');
+        return attachment;
+      });
+      const text=body.text.trim()||(attachments.length?`请查看并处理以下附件：${attachments.map(file=>file.label).join('、')}`:'');
+      const result=await rpc.steer(id,text,body.turnId,{attachments});
+      for(const attachment of attachments){attachment.consumed=true;attachment.expires=Date.now()+attachmentRetention;consumedAttachments.set(attachment.id,attachment);}
+      return result;
     }
     if (message.method === 'turn.interrupt') {
       if (!controlFor(session, id)) throw new Error('没有此会话的控制授权。');
@@ -418,6 +660,12 @@ export function createOrbitServer(options = {}) {
 
   const eventListener = event => {
     if (!/^(item\/|turn\/|thread\/status|orbit\/|serverRequest\/resolved|error$)/.test(event.method)) return;
+    if(event.method==='turn/completed'&&event.params?.threadId){
+      for(const session of sessions.values())for(const [id,attachment]of session.attachments){
+        if(attachment.threadId===event.params.threadId&&attachment.consumed)removeAttachment(session,id);
+      }
+      for(const [id,attachment]of consumedAttachments)if(attachment.threadId===event.params.threadId)removeAttachment(null,id);
+    }
     if (event.method === 'orbit/desktop' && event.params?.threadId) void applyQueuedDesktopSettings(event.params.threadId,event.params);
     for (const socket of sockets) {
       const threadId = event.params?.threadId;
@@ -453,7 +701,12 @@ export function createOrbitServer(options = {}) {
         }
         for (const [key, value] of dedup) if (Date.now() - value.created > 300000) dedup.delete(key);
         for (const [key, value] of attempts) if (value.reset < Date.now()) attempts.delete(key);
-        for (const [key, value] of sessions) if (value.expires < Date.now()) sessions.delete(key);
+        for (const [key, value] of sessions) if (value.expires < Date.now()) {removeSessionAttachments(value);sessions.delete(key);}
+        for(const session of sessions.values()){
+          for(const [id,attachment]of session.attachments)if(attachment.expires<Date.now())removeAttachment(session,id);
+        }
+        for(const [id,attachment]of consumedAttachments)if(attachment.expires<Date.now())removeAttachment(null,id);
+        if(Date.now()-lastAttachmentCleanup>60*60*1000){cleanupStaleAttachments(store);lastAttachmentCleanup=Date.now();}
       } catch {}
     }, 1200);
     timer.unref();
@@ -469,6 +722,7 @@ export function createOrbitServer(options = {}) {
   async function close() {
     clearInterval(timer); clearInterval(heartbeat);
     for (const socket of sockets) unwatchDesktop(socket);
+    for(const session of sessions.values())removeSessionAttachments(session);
     for (const socket of sockets) socket.terminate();
     rpc.off('event', eventListener); rpc.off('lost', lostListener); rpc.close();
     await new Promise(resolve => wss.close(resolve));