orbit-codex-bridge 0.1.2 → 0.1.3

package/README.md

@@ -34,6 +34,15 @@ orbit login
 
 授权信息保存在电脑本地，下次启动会自动复用。连接器默认在当前用户的后台运行，可以关闭安装终端；断网后自动重连，工作进程异常退出后自动恢复。电脑需要保持开机、联网，Codex 桌面需要保持运行。电脑重启后运行 `orbit start` 恢复连接。
 
+## 会话输入
+
+- `普通`：按原会话的 Codex 模型、权限和设置继续。
+- `计划`：使用 Codex 原生 Plan 协作模式开始新一轮；不会改动正在运行的轮次。
+- `目标（本轮）`：将本轮消息作为明确目标继续推进。本版桌面 IPC 尚未开放持久 Goal 状态 API，因此不会伪装成 Codex 侧的长期目标追踪。
+- `添加文件`：每次最多 5 个、每个最多 8 MiB。文件经账号设备中继传到本机，并暂存在项目内 `.orbit-attachments`；Codex 读取原路径。待发送文件 30 分钟清理，已发送文件保留最多 24 小时，任务完成后会提前删除。
+- `电脑文件`：浏览当前会话项目并下载文件；限制在项目根目录内，排除 `.git`、`.codex`、密钥/环境文件和符号链接，单文件最大 8 MiB。
+- 文件附件仅支持已登录账号、在线的自有电脑，以及已加载并已自动热接管的 Codex 桌面原会话。归档会话、子代理和独立续接不支持。
+
 ## 常用命令
 
 | 命令 | 用途 |

package/lib/desktop.mjs

@@ -1,5 +1,7 @@
 import net from 'node:net';
 import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
 import { EventEmitter } from 'node:events';
 import { messageFromItem } from './store.mjs';
 
@@ -261,6 +263,13 @@ export class DesktopRpc extends EventEmitter {
       permissionMode: state?.currentPermissions?.sandboxPolicy?.type || state?.latestThreadSettings?.sandboxPolicy?.type || 'desktop-inherited',
       model: state?.latestThreadSettings?.model || state?.latestModel || null,
       effort: state?.latestThreadSettings?.effort ?? state?.latestReasoningEffort ?? null,
+      collaborationMode:state?.latestCollaborationMode?.mode||'default',
+      goal:state?.threadGoal?{
+        objective:state.threadGoal.objective,
+        status:state.threadGoal.status,
+        tokenBudget:state.threadGoal.tokenBudget??null,
+        tokensUsed:state.threadGoal.tokensUsed??0
+      }:null,
       context: desktopContext(state),
       messages: state ? desktopMessages(state) : [],
       approvals: [...this.approvals.values()].filter(request => request.params.threadId === id).map(request => ({ ...request.params, requestId: String(request.id), method: request.method }))
@@ -297,8 +306,8 @@ export class DesktopRpc extends EventEmitter {
     return thread;
   }
 
-  async startTurn(id, text) { return this.writeMessage(id, text, false); }
-  async steer(id, text, expectedTurnId) { return this.writeMessage(id, text, true, expectedTurnId); }
+  async startTurn(id, text, options = {}) { return this.writeMessage(id, text, false, null, options); }
+  async steer(id, text, expectedTurnId, options = {}) { return this.writeMessage(id, text, true, expectedTurnId, options); }
 
   async updateThreadSettings(id, model, effort, expectedModel, expectedEffort) {
     if (this.starting.has(id) || this.updatingSettings.has(id)) throw new Error('会话正在处理另一项操作，请稍后重试。');
@@ -322,21 +331,50 @@ export class DesktopRpc extends EventEmitter {
     } finally { this.updatingSettings.delete(id); }
   }
 
-  async writeMessage(id, text, steering, expectedTurnId) {
+  async writeMessage(id, text, steering, expectedTurnId, options = {}) {
     if (this.starting.has(id) || this.updatingSettings.has(id)) throw new Error('此会话正在处理其他操作，请勿并发提交。');
     this.starting.add(id);
     try {
       const thread = await this.assertOwner(id);
       if (steering ? !expectedTurnId || thread.turnId !== expectedTurnId : Boolean(thread.turnId)) throw new Error('任务状态已变化，请刷新后选择续聊或追加指令。');
+      const mode=options.mode||'default';
+      if(!['default','plan','goal'].includes(mode))throw new Error('Codex 轮次模式无效。');
+      const attachments=Array.isArray(options.attachments)?options.attachments:[];
+      if(attachments.length>5||attachments.some(file=>{
+        if(!file||typeof file.label!=='string'||typeof file.path!=='string'||!path.isAbsolute(file.path)||file.fsPath!==file.path||!thread.state.cwd)return true;
+        try{
+          const workspace=fs.realpathSync(thread.state.cwd);
+          const filename=path.resolve(file.path);
+          const relative=path.relative(workspace,filename);
+          const attachmentRoot=path.join(workspace,'.orbit-attachments');
+          const resolved=fs.realpathSync(filename);
+          const stat=fs.lstatSync(filename);
+          return !relative||relative==='..'||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative)
+            ||path.dirname(filename)!==attachmentRoot||resolved!==filename||stat.isSymbolicLink()||!stat.isFile()||stat.size>8*1024*1024;
+        }catch{return true}
+      }))throw new Error('文件附件无效、位于工作区外或数量超限。');
+      const baseMode=thread.state.latestCollaborationMode||{mode:'default',settings:{}};
+      const selectedMode=mode==='plan'?'plan':baseMode.mode==='plan'?'default':baseMode.mode||'default';
+      const developerInstructions=baseMode.settings?.developer_instructions??null;
+      const collaborationMode={
+        mode:selectedMode,
+        settings:{
+          ...baseMode.settings,
+          model:baseMode.settings?.model||thread.state.latestThreadSettings?.model||thread.state.latestModel||'',
+          reasoning_effort:baseMode.settings?.reasoning_effort??thread.state.latestThreadSettings?.effort??thread.state.latestReasoningEffort??null,
+          developer_instructions:developerInstructions
+        }
+      };
       const messageId = crypto.randomUUID();
       const input = [{ type: 'text', text, text_elements: [] }];
-      const restoreMessage = { id: messageId, text, cwd: thread.state.cwd, createdAt: Date.now(), context: { prompt: text, addedFiles: [], fileAttachments: [], imageAttachments: [], ideContext: null, workspaceRoots: [thread.state.cwd] } };
+      const fileAttachments=attachments.map(({label,path:filename})=>({label,path:filename,fsPath:filename}));
+      const restoreMessage = { id: messageId, text, cwd: thread.state.cwd, createdAt: Date.now(), context: { prompt: text, addedFiles: [], fileAttachments, uploadedFileAttachments:[], imageAttachments: [], ideContext: null, workspaceRoots: [thread.state.cwd] } };
       let result;
-      if (steering) result = await this.request('thread-follower-steer-turn', { conversationId: id, input, restoreMessage, clientUserMessageId: messageId, attachments: [] }, thread.ownerClientId);
-      else result = await this.request('thread-follower-start-turn', { conversationId: id, turnStart: { request: { threadId: id, input, clientUserMessageId: messageId, turnTrigger: 'composer' }, context: { restoreMessage } } }, thread.ownerClientId);
+      if (steering) result = await this.request('thread-follower-steer-turn', { conversationId: id, input, restoreMessage, clientUserMessageId: messageId, attachments:fileAttachments }, thread.ownerClientId);
+      else result = await this.request('thread-follower-start-turn', { conversationId: id, turnStart: { request: { threadId: id, input, clientUserMessageId: messageId, turnTrigger: 'composer',collaborationMode }, context: { restoreMessage,attachments:fileAttachments,collaborationMode } } }, thread.ownerClientId);
       const response = result.result || result;
       const turnId = response.turnId || response.turn?.id || this.threads.get(id)?.turnId || null;
-      return { threadId: id, turnId, completed: typeof response.completed === 'boolean' ? response.completed : Boolean(!steering && !turnId), steering, sharedExecution: true };
+      return { threadId:id,turnId,completed:typeof response.completed==='boolean'?response.completed:Boolean(!steering&&!turnId),steering,sharedExecution:true,mode,attachments:attachments.map(file=>file.label) };
     } finally { this.starting.delete(id); }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-codex-bridge",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "description": "Connect your original Codex desktop conversations to Orbit on the web.",
   "engines": {

package/public/app.js

@@ -25,7 +25,7 @@ const paths = {
 const icon = name => `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${paths[name] || paths.inbox}</svg>`;
 function decorate(parent = document) { parent.querySelectorAll('[data-icon]').forEach(element => { element.innerHTML = icon(element.dataset.icon); }); }
 function markdown(text) { return DOMPurify.sanitize(marked.parse(String(text || ''), { breaks: true }), { ALLOWED_TAGS: ['p','br','strong','b','em','i','s','del','ul','ol','li','blockquote','pre','code','h1','h2','h3','h4','h5','h6','hr','a','table','thead','tbody','tr','th','td','sup','sub','kbd','details','summary'], ALLOWED_ATTR: ['href','title','start','colspan','rowspan'], ALLOW_DATA_ATTR: false, ALLOW_ARIA_ATTR: false }); }
-const state = { threads: [], status: null, selected: null, selectionVersion: 0, historyStatus: 'idle', historyError: '', filter: 'all', project: null, search: '', view: 'sessions', socket: null, pending: new Map(), enabled: new Map(), baseMessages: [], olderMessages: [], cursor: null, liveMessages: new Map(), desktopMessages: [], desktopRuntime: null, selectedSettings: null, models: [], contextUsage: null, settingsBusy: false, reopenModelAfterGrant: false, pendingModelChoice: null, cloudMode: false, cloudUser: null, cloudDevices: [], cloudDeviceId: null, approvals: new Map(), reconnect: 0, loggedOut: false, busy: false, turnId: null };
+const state = { threads: [], status: null, selected: null, selectionVersion: 0, historyStatus: 'idle', historyError: '', filter: 'all', project: null, search: '', view: 'sessions', socket: null, pending: new Map(), enabled: new Map(), baseMessages: [], olderMessages: [], cursor: null, liveMessages: new Map(), desktopMessages: [], desktopRuntime: null, selectedSettings: null, models: [], contextUsage: null, settingsBusy: false, reopenModelAfterGrant: false, pendingModelChoice: null, cloudMode: false, cloudUser: null, cloudDevices: [], cloudDeviceId: null, approvals: new Map(), pendingAttachments: [], reconnect: 0, loggedOut: false, busy: false, turnId: null };
 let refreshTimer;
 let toastTimer;
 let reconnectTimer;
@@ -377,6 +377,7 @@ function connectSocket() {
     setConnection(false);
     for (const pending of state.pending.values()) { clearTimeout(pending.timer); pending.reject(new Error('连接中断，消息不会自动重发。请先检查会话记录。')); }
     state.pending.clear();
+    state.pendingAttachments=[];
     scheduleReconnect();
   });
   socket.addEventListener('error', () => {});
@@ -416,6 +417,8 @@ async function subscribeThread(id) {
     state.turnId = result.turnId;
     state.busy = Boolean(result.turnId);
     state.approvals = new Map((result.approvals || []).map(approval => [approval.requestId, approval]));
+    state.pendingAttachments=result.attachments||[];
+    renderComposerAttachments();
     if (desktop && result.control) {
       controlRenewTimer = setTimeout(() => {
         if (state.selected?.id === id && state.socket?.readyState === WebSocket.OPEN && state.desktopRuntime?.attached) {
@@ -492,6 +495,8 @@ async function openThread(id) {
   if (select('#model-dialog').open) select('#model-dialog').close();
   const selectionVersion = ++state.selectionVersion;
   state.pendingModelChoice = null;
+  state.pendingAttachments=[];
+  select('#turn-mode').value='default';
   state.historyStatus = 'loading'; state.historyError = '';
   state.selected = thread; state.baseMessages = []; state.olderMessages = []; state.liveMessages.clear(); state.desktopMessages = []; state.desktopRuntime = null; state.selectedSettings = null; state.contextUsage = null; state.approvals.clear(); state.cursor = null; state.busy = false; state.turnId = null;
   select('#welcome').hidden = true; select('#chat').hidden = false; select('#workspace').classList.add('chat-open');
@@ -500,7 +505,7 @@ async function openThread(id) {
   select('#chat-details').innerHTML = `<dl><dt>原生会话 ID</dt><dd>${escapeHtml(id)}</dd><dt>工作目录</dt><dd>${escapeHtml(thread.cwd)}</dd><dt>记录来源 / 分支</dt><dd>${escapeHtml(thread.source)} / ${escapeHtml(thread.branch || '—')}</dd></dl>`;
   select('#chat-details').hidden = true;
   select('#messages').replaceChildren(); renderMessages();
-  renderList(); updateMode(); renderApprovals();
+  renderComposerAttachments();renderList();updateMode();renderApprovals();
   subscribeThread(id).catch(error => { if (selectionVersion === state.selectionVersion) toast(error.message); });
   try { await loadMessages(true); } catch (error) { if (selectionVersion === state.selectionVersion) toast(error.message); }
 }
@@ -742,9 +747,107 @@ function updateMode() {
   select('#send-message').title = state.busy && desktop ? '追加指令到当前桌面任务' : '沿用原会话发送';
   select('#stop-turn').hidden = !state.busy || !state.turnId || !control;
   select('#message-input').placeholder = state.busy && desktop ? '追加指令给电脑上正在运行的任务…' : control ? '沿着原来的上下文继续…' : desktop ? '连接原桌面会话后继续…' : '先确认接续方式，再沿着这条会话继续…';
-  select('#composer-note').textContent = control ? desktop ? '消息进入原 Codex 桌面会话；任务不会迁移或重启。断线不会自动重发。' : '原会话 ID 不变；断线不会自动重发消息。' : '只读查看不会唤醒或打断电脑上的执行。';
+  select('#turn-mode').disabled=!control||!desktop||desktopConnecting||state.busy;
+  select('#attach-files').disabled=!control||!desktop||desktopConnecting||state.pendingAttachments.length>=5||state.settingsBusy;
+  select('#file-input').disabled=select('#attach-files').disabled;
+  select('#turn-mode').title=state.busy?'当前桌面任务中无法切换模式。':!desktop?'仅 Codex 桌面原会话支持模式选择。':'模式仅作用于新一轮消息。';
+  const mode=select('#turn-mode').value;
+  select('#composer-note').textContent=mode==='plan'
+    ? '计划模式先分析并列出步骤，等待你确认后再执行。只影响下一轮。'
+    : mode==='goal'
+      ? '目标模式将本轮消息作为明确目标；Codex 桌面 IPC 暂不提供持久目标状态设置。'
+      : control ? desktop ? '消息进入原 Codex 桌面会话；任务不会迁移或重启。文件暂存 30 分钟。断线不会自动重发。' : '原会话 ID 不变；断线不会自动重发消息。'
+        : '只读查看不会唤醒或打断电脑上的执行。';
   renderModelStatus();
 }
+function renderComposerAttachments() {
+  select('#composer-attachments').innerHTML=state.pendingAttachments.map(file=>
+    `<span class="composer-attachment" data-attachment="${escapeHtml(file.id)}">${icon(file.mimeType?.startsWith('image/')?'image':'file')}<span>${escapeHtml(file.label)} · ${escapeHtml((file.size/1024).toFixed(file.size<1024*1024?0:1))} KB</span><button type="button" data-remove-attachment="${escapeHtml(file.id)}" aria-label="移除 ${escapeHtml(file.label)}">×</button></span>`
+  ).join('');
+}
+
+async function uploadFiles(fileList) {
+  if(!state.selected||!state.enabled.has(state.selected.id)||!state.desktopRuntime?.attached)return toast('请先连接并接管原 Codex 会话。');
+  const files=[...fileList];
+  if(state.pendingAttachments.length+files.length>5)return toast('单条消息最多添加 5 个文件。');
+  for(const file of files)if(file.size===0||file.size>8*1024*1024)return toast(`“${file.name}”为空或超过 8 MiB 限制。`);
+  const threadId=state.selected.id,selectionVersion=state.selectionVersion;
+  const button=select('#attach-files');
+  button.disabled=true;
+  try{
+    for(const file of files){
+      const headers={'Content-Type':file.type||'application/octet-stream'};
+      if(state.cloudMode&&state.cloudDeviceId)headers['X-Orbit-Device-Id']=state.cloudDeviceId;
+      const response=await fetch(`/api/threads/${encodeURIComponent(threadId)}/attachments?name=${encodeURIComponent(file.name)}`,{
+        method:'POST',headers,body:file,credentials:'same-origin',signal:AbortSignal.timeout(30000)
+      });
+      const result=await response.json().catch(()=>({}));
+      if(!response.ok)throw new Error(result.error||'文件上传失败。');
+      if(threadId!==state.selected?.id||selectionVersion!==state.selectionVersion){
+        await api(`/api/threads/${encodeURIComponent(threadId)}/attachments/remove`,{attachmentId:result.id});
+        return;
+      }
+      state.pendingAttachments.push(result);
+      renderComposerAttachments();updateMode();
+    }
+    toast(files.length===1?'文件已附加到待发送消息。':`已附加 ${files.length} 个文件。`);
+  }catch(error){toast(error.name==='TimeoutError'?'文件上传超时，请确认网络后重试。':error.message)}
+  finally{button.disabled=false;select('#file-input').value='';updateMode()}
+}
+
+async function browseProjectFiles(relativePath='') {
+  if(!state.selected)return;
+  const threadId=state.selected.id,selectionVersion=state.selectionVersion;
+  const list=select('#file-browser-list');
+  select('#file-browser-error').textContent='';
+  list.innerHTML='<p class="file-browser-empty">正在读取项目文件…</p>';
+  try{
+    const query=relativePath?`?path=${encodeURIComponent(relativePath)}`:'';
+    const result=await api(`/api/threads/${encodeURIComponent(threadId)}/files${query}`);
+    if(threadId!==state.selected?.id||selectionVersion!==state.selectionVersion)return;
+    select('#file-browser-path').textContent=result.path||'项目根目录';
+    const rows=[];
+    if(result.path){
+      const parent=result.path.split(/[\\/]/).slice(0,-1).join('/');
+      rows.push(`<button class="file-browser-entry file-browser-parent" type="button" data-file-directory="${escapeHtml(parent)}"><span>↰</span><strong>上一级</strong></button>`);
+    }
+    for(const entry of result.entries||[]){
+      rows.push(entry.type==='directory'
+        ? `<button class="file-browser-entry" type="button" data-file-directory="${escapeHtml(entry.path)}"><span>▸</span><strong>${escapeHtml(entry.name)}</strong></button>`
+        : `<button class="file-browser-entry" type="button" data-file-download="${escapeHtml(entry.path)}"><span>${icon('file')}</span><strong>${escapeHtml(entry.name)}</strong><small>${escapeHtml((entry.size/1024).toFixed(entry.size<1024*1024?0:1))} KB</small></button>`);
+    }
+    if(result.truncated)rows.push('<p class="file-browser-empty">列表已达到 1000 项上限，请打开子文件夹细看。</p>');
+    list.innerHTML=rows.join('')||'<p class="file-browser-empty">此文件夹为空。</p>';
+  }catch(error){
+    list.replaceChildren();
+    select('#file-browser-error').textContent=error.message;
+  }
+}
+
+async function downloadProjectFile(relativePath){
+  if(!state.selected)return;
+  const threadId=state.selected.id;
+  const headers={};
+  if(state.cloudMode&&state.cloudDeviceId)headers['X-Orbit-Device-Id']=state.cloudDeviceId;
+  try{
+    const response=await fetch(`/api/threads/${encodeURIComponent(threadId)}/file?path=${encodeURIComponent(relativePath)}`,{
+      headers,credentials:'same-origin',cache:'no-store',signal:AbortSignal.timeout(35000)
+    });
+    if(!response.ok){
+      const result=await response.json().catch(()=>({}));
+      if(response.status===401&&state.cloudMode){showCloudLogin(result.error);return}
+      throw new Error(result.error||'无法下载此项目文件。');
+    }
+    const disposition=response.headers.get('content-disposition')||'';
+    const encoded=disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];
+    const filename=encoded?decodeURIComponent(encoded):relativePath.split(/[\\/]/).at(-1)||'project-file';
+    const url=URL.createObjectURL(await response.blob());
+    const anchor=document.createElement('a');
+    anchor.href=url;anchor.download=filename;anchor.click();
+    setTimeout(()=>URL.revokeObjectURL(url),30000);
+  }catch(error){toast(error.name==='TimeoutError'?'项目文件下载超时。':error.message)}
+}
+
 function renderApprovals() {
   select('#approvals').innerHTML = [...state.approvals.values()].map(approval => `<section class="approval-card" data-approval="${escapeHtml(approval.requestId)}"><strong>${approval.method === 'item/tool/requestUserInput' ? 'Codex 需要你的回答' : '等待你的审批'}</strong><p>${escapeHtml(approval.reason || '请核对操作范围后决定。')}</p>${approval.command ? `<pre>${escapeHtml(approval.command)}</pre>` : ''}${approval.method !== 'item/tool/requestUserInput' ? `<details><summary>查看完整审批范围</summary><pre>${escapeHtml(JSON.stringify(approval, null, 2))}</pre></details>` : ''}${approval.method === 'item/tool/requestUserInput' ? (approval.questions || []).map(question => `<label>${escapeHtml(question.question)}${question.options ? `<small> ${question.options.map(option => escapeHtml(option.label)).join(' / ')}</small>` : ''}<input data-question="${escapeHtml(question.id)}" placeholder="输入你的回答" maxlength="4000"></label>`).join('') + '<button class="button small" data-decision="answers">提交回答</button>' : `<button class="button small" data-decision="decline">拒绝</button>${approval.method !== 'item/permissions/requestApproval' ? '<button class="button small" data-decision="accept">仅允许本次</button>' : '<p>扩大环境权限请在本机处理，首版仅支持拒绝。</p>'}`}</section>`).join('');
 }
@@ -1087,18 +1190,57 @@ select('#model-form').addEventListener('submit', async event => {
   finally { button.disabled = false; state.settingsBusy = false; updateMode(); }
 });
 select('#message-input').addEventListener('input', updateMode);
+select('#turn-mode').addEventListener('change',updateMode);
+select('#browse-files').onclick=()=>{
+  if(!state.selected)return;
+  browseProjectFiles();
+  select('#file-browser-dialog').showModal();
+};
+select('#close-file-browser').onclick=()=>select('#file-browser-dialog').close();
+select('#file-browser-list').addEventListener('click',event=>{
+  const folder=event.target.closest('[data-file-directory]');
+  if(folder){browseProjectFiles(folder.dataset.fileDirectory);return}
+  const file=event.target.closest('[data-file-download]');
+  if(file)downloadProjectFile(file.dataset.fileDownload);
+});
+select('#attach-files').onclick=()=>select('#file-input').click();
+select('#file-input').addEventListener('change',event=>uploadFiles(event.target.files));
+select('#composer-attachments').addEventListener('click',async event=>{
+  const button=event.target.closest('[data-remove-attachment]');
+  if(!button||!state.selected)return;
+  const id=button.dataset.removeAttachment;
+  const threadId=state.selected.id;
+  try{
+    await api(`/api/threads/${encodeURIComponent(threadId)}/attachments/remove`,{attachmentId:id});
+    state.pendingAttachments=state.pendingAttachments.filter(file=>file.id!==id);
+    renderComposerAttachments();updateMode();
+  }catch(error){toast(error.message)}
+});
 select('#message-input').addEventListener('keydown', event => {
   if (event.key === 'Enter' && !event.shiftKey && !event.isComposing && !matchMedia('(max-width:760px)').matches) { event.preventDefault(); if (!select('#send-message').disabled) select('#composer').requestSubmit(); }
 });
 select('#composer').addEventListener('submit', async event => {
   event.preventDefault(); if (select('#send-message').disabled) return;
-  const id = state.selected.id; const text = select('#message-input').value; const wasBusy = state.busy;
+  const id = state.selected.id; const inputText = select('#message-input').value.trim(); const wasBusy = state.busy;
   const turnId = state.turnId;
   const steering = wasBusy && state.status.execution.mode === 'desktop';
+  const mode=select('#turn-mode').value;
+  const attachmentIds=state.pendingAttachments.map(file=>file.id);
+  const text=inputText|| (attachmentIds.length?`请查看并处理以下附件：${state.pendingAttachments.map(file=>file.label).join('、')}`:'');
   state.busy = true; updateMode();
   try {
-    const result = await rpc(steering ? 'turn.steer' : 'turn.start', { threadId:id, text, ...(steering ? { turnId } : {}) });
-    if (state.selected?.id === id) { state.turnId = result.completed ? null : result.turnId || (steering ? turnId : null); state.busy = !result.completed; select('#message-input').value = ''; scheduleRefresh(); }
+    const result = await rpc(steering ? 'turn.steer' : 'turn.start', {
+      threadId:id,text,attachmentIds,mode,...(steering?{turnId}:{})
+    });
+    if (state.selected?.id === id) {
+      state.turnId = result.completed ? null : result.turnId || (steering ? turnId : null);
+      state.busy = !result.completed;
+      select('#message-input').value = '';
+      state.pendingAttachments=[];
+      renderComposerAttachments();
+      if(!steering)select('#turn-mode').value='default';
+      scheduleRefresh();
+    }
   } catch (error) { if (state.selected?.id === id) state.busy = wasBusy; toast(error.message); }
   updateMode();
 });

package/public/index.html

@@ -47,11 +47,12 @@
 <header class="topbar"><div class="breadcrumbs"><button id="menu-button" class="icon-button mobile-only" aria-label="展开导航"><span data-icon="menu"></span></button><span data-icon="orbit"></span><span>工作空间</span><span class="slash">/</span><strong id="breadcrumb-current">所有会话</strong></div><div class="top-actions"><span class="live-pill" id="connection-pill"><i class="tiny-dot"></i> 正在连接</span><button id="connect-device" class="button small"><span data-icon="devices"></span><span class="desktop-label">连接设备</span></button><button id="cloud-device-switcher" class="button small" type="button" hidden></button><button id="logout" class="avatar-button" title="断开当前设备" aria-label="断开当前设备">O</button></div></header>
 <section id="sessions-view" class="sessions-view">
 <section class="thread-pane"><div class="pane-heading"><span class="eyebrow">YOUR CONVERSATIONS</span><div><h1 id="list-title">所有会话</h1><span id="thread-count" class="count-badge">—</span><button id="refresh" class="icon-button" aria-label="刷新会话"><span data-icon="refresh"></span></button></div><p>原来的项目，原来的上下文。</p></div><div class="search-box"><span data-icon="search"></span><input id="search" type="search" placeholder="搜索会话或项目" aria-label="搜索会话或项目"><kbd>⌘ K</kbd></div><div class="filters" role="group" aria-label="会话筛选"><button class="active" data-filter="all" aria-pressed="true">全部</button><button data-filter="locked" aria-pressed="false">已占用</button><button data-filter="pinned" aria-pressed="false">已置顶</button><button data-filter="archived" aria-pressed="false">已归档</button></div><div id="thread-list" class="thread-list" aria-label="原生会话列表"></div><div class="list-footer"><span data-icon="database"></span><span id="list-footer-text">读取 Codex 原生记录</span><i class="tiny-dot"></i></div></section>
-<section id="conversation" class="conversation"><div id="welcome" class="welcome"></div><div id="chat" class="chat" hidden><header class="chat-header"><button id="back" class="icon-button mobile-only" aria-label="返回会话列表"><span data-icon="back"></span></button><div class="chat-title"><h2 id="chat-title"></h2><p id="chat-subtitle"></p></div><button id="details-toggle" class="icon-button" aria-label="查看会话详情"><span data-icon="info"></span></button><button id="enable-control" class="button small">接续会话</button></header><div id="chat-details" class="chat-details" hidden></div><div id="mode-banner" class="mode-banner"></div><div id="messages" class="messages" aria-live="polite"></div><div id="approvals" class="approvals"></div><div class="composer-wrap"><div class="session-settings-bar"><button id="model-settings-button" class="model-settings-button" type="button" title="选择模型和推理级别" aria-label="选择模型和推理级别" disabled><span data-icon="settings"></span><span id="model-settings-label">当前模型</span></button><div id="context-meter" class="context-meter" title="暂无准确的上下文用量"><span>上下文</span><strong id="context-label">暂无用量</strong><span class="context-track" role="progressbar" aria-label="上下文已用比例" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0" hidden><span id="context-fill"></span></span></div></div><form id="composer" class="composer"><textarea id="message-input" placeholder="先确认接续方式，再沿着这条会话继续…" rows="2" aria-label="发送消息"></textarea><div class="composer-toolbar"><span id="composer-mode"><span data-icon="shield"></span>只读镜像</span><button id="stop-turn" class="button small" type="button" hidden>停止任务</button><button id="send-message" class="send-button" aria-label="发送消息" disabled><span data-icon="arrow"></span></button></div></form><p class="composer-note" id="composer-note">查看不会唤醒会话，也不会打断电脑上的执行。</p></div></div></section>
+<section id="conversation" class="conversation"><div id="welcome" class="welcome"></div><div id="chat" class="chat" hidden><header class="chat-header"><button id="back" class="icon-button mobile-only" aria-label="返回会话列表"><span data-icon="back"></span></button><div class="chat-title"><h2 id="chat-title"></h2><p id="chat-subtitle"></p></div><button id="details-toggle" class="icon-button" aria-label="查看会话详情"><span data-icon="info"></span></button><button id="enable-control" class="button small">接续会话</button></header><div id="chat-details" class="chat-details" hidden></div><div id="mode-banner" class="mode-banner"></div><div id="messages" class="messages" aria-live="polite"></div><div id="approvals" class="approvals"></div><div class="composer-wrap"><div class="session-settings-bar"><button id="model-settings-button" class="model-settings-button" type="button" title="选择模型和推理级别" aria-label="选择模型和推理级别" disabled><span data-icon="settings"></span><span id="model-settings-label">当前模型</span></button><button id="browse-files" class="button small" type="button" aria-label="浏览电脑项目文件">电脑文件</button><div id="context-meter" class="context-meter" title="暂无准确的上下文用量"><span>上下文</span><strong id="context-label">暂无用量</strong><span class="context-track" role="progressbar" aria-label="上下文已用比例" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0" hidden><span id="context-fill"></span></span></div></div><form id="composer" class="composer"><textarea id="message-input" placeholder="沿着这条会话继续…" rows="2" aria-label="发送消息"></textarea><div id="composer-attachments" class="composer-attachments" aria-live="polite"></div><div class="composer-toolbar"><label class="turn-mode-label" for="turn-mode">模式</label><select id="turn-mode" class="turn-mode-select" aria-label="本轮对话模式"><option value="default">普通</option><option value="plan">计划</option><option value="goal">目标（本轮）</option></select><input id="file-input" type="file" multiple hidden><button id="attach-files" class="button small" type="button" aria-label="添加附件">添加文件</button><span id="composer-mode"><span data-icon="shield"></span>只读镜像</span><button id="stop-turn" class="button small" type="button" hidden>停止任务</button><button id="send-message" class="send-button" aria-label="发送消息" disabled><span data-icon="arrow"></span></button></div></form><p class="composer-note" id="composer-note">查看不会唤醒会话，也不会打断电脑上的执行。</p></div></div></section>
 </section><section id="devices-view" class="devices-view" hidden></section>
 </main>
 </div>
 <dialog id="control-dialog"><form id="control-form"><span class="mini-badge">CONTINUE, NOT FORK</span><h2 id="control-title">授权热接管</h2><p id="control-description">保持原会话与桌面执行实例，不创建新会话或独立执行器。</p><div class="notice"><span data-icon="shield"></span><span id="control-notice">指令会交给原 Codex 桌面会话执行，并沿用其权限与审批策略。</span></div><label class="check-row" id="allow-write-row"><input id="allow-write" type="checkbox"><span>允许修改此会话的工作区文件<small>默认只读。扩大权限仍需要审批；不会启用无限制执行。</small></span></label><label class="check-row"><input id="control-confirm" type="checkbox" required><span id="control-confirm-copy">我确认授权此设备控制这条原生会话。</span></label><div class="dialog-actions"><button type="button" id="cancel-control" class="button">先只读查看</button><button class="primary" id="confirm-control-button" type="submit">授权热接管 <span>↗</span></button></div><p id="control-error" class="error" role="alert"></p></form></dialog>
 <dialog id="model-dialog"><form id="model-form"><h2>会话参数</h2><p id="model-description">更改将在这条会话的下一轮生效。</p><label for="model-select">模型</label><select id="model-select" required></select><label for="effort-select">推理级别</label><select id="effort-select"></select><p id="model-note" class="model-note"></p><p id="model-error" class="error" role="alert"></p><div class="dialog-actions"><button id="cancel-model" type="button" class="button">取消</button><button id="authorize-model" type="button" class="primary" hidden>先授权热接管</button><button id="apply-model" type="submit" class="primary">应用到下一轮</button></div></form></dialog>
+<dialog id="file-browser-dialog" class="file-browser-dialog"><section class="file-browser-panel"><header><div><h2>电脑项目文件</h2><p id="file-browser-path">项目根目录</p></div><button id="close-file-browser" class="button small" type="button">关闭</button></header><p class="file-browser-notice">仅浏览当前会话工作目录；系统目录、凭证文件及符号链接不会开放。单个文件最大 8 MiB。</p><div id="file-browser-list" class="file-browser-list" aria-live="polite"></div><p id="file-browser-error" class="error" role="alert"></p></section></dialog>
 <div id="toast" class="toast" role="status" hidden></div>
 </body></html>

package/public/style.css

@@ -37,4 +37,34 @@
 .activity-diff .diff-added{color:#a8d89a;background:#47614845}
 .activity-diff .diff-removed{color:#edb0a7;background:#70474445}
 .activity-empty{margin:8px 0;color:#9ba38e;font-size:10px}
+.turn-mode-label{font-size:10px;color:#8b9785}
+.turn-mode-select{max-width:95px;border:1px solid #e2e7dc;background:#f7f8f4;border-radius:6px;padding:5px 7px;color:#506045;font-size:10px}
+.turn-mode-select:disabled{opacity:.55}
+.composer-toolbar .turn-mode-label,.composer-toolbar .turn-mode-select,.composer-toolbar #attach-files{flex:none}
+.composer-toolbar #composer-mode{min-width:0;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}
+.composer-attachments{display:flex;flex-wrap:wrap;gap:6px;margin-top:8px}
+.composer-attachment{display:inline-flex;align-items:center;gap:6px;max-width:100%;padding:5px 7px;border:1px solid #dfe6d5;border-radius:6px;background:#f7f9f2;color:#68795a;font-size:9px}
+.composer-attachment>span{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.composer-attachment svg{width:13px;height:13px}
+.composer-attachment button{width:20px;height:20px;border-radius:4px;color:#8b9785;font-size:16px;line-height:1}
+.composer-attachment button:hover{background:#e8eddf}
+.composer-attachment button:disabled{opacity:.5}
+.file-browser-dialog{width:min(560px,calc(100vw - 28px));max-width:560px;max-height:min(78dvh,760px);padding:0;border:1px solid #dfe5d7;border-radius:13px;background:#fbfcf8;color:#354536;box-shadow:0 20px 80px #17251a40}
+.file-browser-dialog::backdrop{background:#1b2c22a8;backdrop-filter:blur(3px)}
+.file-browser-panel{display:flex;flex-direction:column;max-height:min(78dvh,760px);padding:20px}
+.file-browser-panel>header{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;border-bottom:1px solid var(--line);padding-bottom:12px}
+.file-browser-panel h2{margin:0;font-size:17px;font-weight:550}
+.file-browser-panel header p{margin:5px 0 0;max-width:360px;overflow-wrap:anywhere;color:#7d8a72;font-size:10px}
+.file-browser-notice{font-size:10px;line-height:1.7;color:#899380}
+.file-browser-list{overflow:auto;min-height:100px;max-height:52dvh;border:1px solid var(--line);border-radius:8px;background:#fff}
+.file-browser-entry{width:100%;min-height:43px;display:flex;align-items:center;gap:10px;padding:8px 12px;border-bottom:1px solid #eef0e9;text-align:left}
+.file-browser-entry:last-child{border-bottom:0}
+.file-browser-entry:hover{background:#f3f6ed}
+.file-browser-entry>span{color:#80916d;flex:none}
+.file-browser-entry svg{width:15px;height:15px}
+.file-browser-entry strong{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px;font-weight:450}
+.file-browser-entry small{margin-left:auto;flex:none;color:#929d88;font-size:9px}
+.file-browser-parent{background:#f8faf4;color:#647653}
+.file-browser-empty{padding:16px;color:#909b84;font-size:10px}
+@media(max-width:760px){.composer-toolbar{flex-wrap:wrap}.composer-toolbar #composer-mode{flex:1 1 65px}.turn-mode-select{max-width:92px}.composer-attachment{max-width:100%}.file-browser-panel{padding:16px}.session-settings-bar{gap:5px}.session-settings-bar #browse-files{padding:6px 8px;font-size:9px}}
 @media(max-width:760px){.message-head .message-copy,.copy-code{opacity:1}.activity-message{margin-left:0}.activity-content{padding-left:14px}.activity-meta{max-width:40%;white-space:normal}.message-attachments{margin-left:0}.message-body pre{padding-top:38px}}

package/relay-agent.mjs

@@ -69,7 +69,9 @@ export function createRelayAgent(options = {}) {
           requests.delete(request);
           resolve({statusCode:response.statusCode || 502,headers:{
             'content-type':response.headers['content-type'] || 'application/json',
-            ...(response.headers['set-cookie'] ? {'set-cookie':response.headers['set-cookie']} : {})
+            ...(response.headers['set-cookie'] ? {'set-cookie':response.headers['set-cookie']} : {}),
+            ...Object.fromEntries(['content-disposition','content-length','accept-ranges','content-range','etag']
+              .filter(name=>typeof response.headers[name]==='string').map(name=>[name,response.headers[name]]))
           },body:Buffer.concat(chunks)});
         });
       });
@@ -97,7 +99,7 @@ export function createRelayAgent(options = {}) {
     const body = Buffer.from(message.body || '', 'base64');
     if (body.length > maxBody) return;
     const headers = {};
-    for (const name of ['accept','content-type','cookie','user-agent']) {
+    for (const name of ['accept','content-type','cookie','user-agent','range','if-range','if-none-match']) {
       const value = message.headers?.[name];
       if (typeof value === 'string') headers[name] = value;
     }

package/relay-server.mjs

@@ -71,13 +71,24 @@ function responseHeaders(headers, deviceId, secureCookie) {
     const token = paired.split(';')[0].slice('orbit_session='.length);
     safe['Set-Cookie'] = `${deviceCookieName(deviceId)}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${token ? 43200 : 0}${secureCookie ? '; Secure' : ''}`;
   }
+  const contentType=headers?.['content-type'];
+  if(typeof contentType==='string'&&/^(?:application\/(?:json|pdf|zip|octet-stream)|text\/[a-z0-9.+-]+(?:;\s*charset=utf-8)?|image\/(?:png|jpeg|gif|webp|svg\+xml))$/i.test(contentType))safe['Content-Type']=contentType;
+  const disposition=headers?.['content-disposition'];
+  if(typeof disposition==='string'&&disposition.length<=1000
+    &&/^attachment;\s*filename="[^"\r\n]{1,180}";\s*filename\*=UTF-8''[a-zA-Z0-9%._~-]{1,600}$/.test(disposition))safe['Content-Disposition']=disposition;
+  const length=headers?.['content-length'];
+  if(/^\d{1,8}$/.test(String(length||'')))safe['Content-Length']=length;
+  if(/^(?:bytes \d+-\d+\/\d+|bytes \*\/\d+)$/.test(headers?.['content-range']||''))safe['Content-Range']=headers['content-range'];
+  if(headers?.['accept-ranges']==='bytes')safe['Accept-Ranges']='bytes';
+  if(typeof headers?.etag==='string'&&/^"orbit-\d+-\d+"$/.test(headers.etag))safe.ETag=headers.etag;
   return safe;
 }
 
 function isLocalApi(pathname, method) {
   if (method === 'GET') return ['/api/status','/api/threads','/api/models'].includes(pathname)
-    || /^\/api\/threads\/[a-zA-Z0-9_-]{8,120}\/messages$/.test(pathname);
-  return method === 'POST' && ['/api/pair','/api/logout','/api/pair/qr'].includes(pathname);
+    || /^\/api\/threads\/[a-zA-Z0-9_-]{8,120}\/(?:messages|files|file)$/.test(pathname);
+  return method === 'POST' && (['/api/pair','/api/logout','/api/pair/qr'].includes(pathname)
+    || /^\/api\/threads\/[a-zA-Z0-9_-]{8,120}\/attachments(?:\/remove)?$/.test(pathname));
 }
 
 function json(response, status, body, headers = {}) {
@@ -261,14 +272,14 @@ export function createRelayServer(options = {}) {
     const agent=agents.get(device.id);
     if(!agent||agent.socket.readyState!==WebSocket.OPEN)return json(response,503,{error:`电脑“${device.name}”当前不在线。`});
     if(accountConnect&&!agent.accountConnect)return json(response,409,{
-      error:'请在电脑上更新 Orbit 连接器到 0.1.2 或更高版本后重试。',code:'connector_upgrade_required'
+      error:'请在电脑上更新 Orbit 连接器到 0.1.3 或更高版本后重试。',code:'connector_upgrade_required'
     });
     const body=await readBody(request);
     if (!store.hasSession(authenticated.tokenHash,authenticated.user.id)) return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
     chooseDevice(request, store.getUser(authenticated.user.id));
     const requestId=crypto.randomUUID();
     const headers={};
-    for(const name of ['accept','content-type','host','origin','user-agent'])if(request.headers[name])headers[name]=request.headers[name];
+    for(const name of ['accept','content-type','host','origin','user-agent','range','if-range','if-none-match'])if(request.headers[name])headers[name]=request.headers[name];
     headers.cookie = localCookie(request,device.id);
     if(pendingHttp.size>=500)return json(response,429,{error:'请求过多，请稍后重试。'});
     const promise=new Promise((resolve,reject)=>{

package/server.mjs

@@ -13,12 +13,139 @@ import { DesktopRpc } from './lib/desktop.mjs';
 const root = path.dirname(fileURLToPath(import.meta.url));
 const packageVersion = JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8')).version;
 const sessionLifetime = 12 * 60 * 60 * 1000;
+const attachmentLifetime = 30 * 60 * 1000;
+const attachmentRetention = 24 * 60 * 60 * 1000;
+const maxAttachmentBytes = 8 * 1024 * 1024;
+const maxPendingAttachments = 5;
 const safeError = error => String(error.message || error).replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]').replace(/(?:sk-|sk_)[\w-]{12,}/g, '[REDACTED]').slice(0, 700);
 
 export function lanAddresses() {
   return Object.values(os.networkInterfaces()).flat().filter(address => address && address.family === 'IPv4' && !address.internal).map(address => address.address);
 }
 
+function cleanupStaleAttachments(store) {
+  const now=Date.now();
+  for(const cwd of new Set(store.list().map(thread=>thread.cwd).filter(Boolean))){
+    let projectRoot;
+    try{projectRoot=fs.realpathSync(cwd)}catch{continue}
+    const directory=path.join(projectRoot,'.orbit-attachments');
+    let entries;
+    try{
+      const stat=fs.lstatSync(directory);
+      if(stat.isSymbolicLink()||!stat.isDirectory())continue;
+      entries=fs.readdirSync(directory);
+    }catch{continue}
+    for(const name of entries){
+      if(!/^[a-f0-9]{32}(?:\.[a-zA-Z0-9]{1,12})?$/.test(name))continue;
+      const filename=path.join(directory,name);
+      try{
+        const stat=fs.lstatSync(filename);
+        if(!stat.isSymbolicLink()&&stat.isFile()&&now-stat.mtimeMs>attachmentRetention)fs.unlinkSync(filename);
+      }catch{}
+    }
+  }
+}
+
+const excludedProjectEntries=new Set([
+  '.git','.codex','.orbit-attachments','node_modules','.venv','venv','dist','build',
+  '.ssh','.aws','.azure','.config','.npm','.docker','secrets','credentials'
+]);
+const excludedProjectFiles=/^(?:\.env(?:\..*)?|\.npmrc|\.pypirc|\.netrc|\.git-credentials|id_(?:rsa|ed25519)(?:\.pub)?|.*(?:secret|credential)(?:\..*)?|.*\.(?:pem|p12|pfx|key|keystore))$/i;
+
+function checkedProjectEntry(row,relativePath=''){
+  if(!row?.cwd||typeof relativePath!=='string'||relativePath.length>1024||relativePath.includes('\0'))throw new Error('项目文件路径无效。');
+  const root=fs.realpathSync(row.cwd);
+  if(!fs.statSync(root).isDirectory())throw new Error('会话工作目录不可用。');
+  const parts=relativePath?relativePath.split(/[\\/]/):[];
+  if(parts.some(part=>!part||part==='.'||part==='..'))throw new Error('不允许访问项目目录之外的路径。');
+  let current=root;
+  for(const part of parts){
+    if(excludedProjectEntries.has(part.toLowerCase())||excludedProjectFiles.test(part))throw new Error('此系统目录或凭证文件不开放传输。');
+    current=path.join(current,part);
+    const stat=fs.lstatSync(current);
+    if(stat.isSymbolicLink())throw new Error('不支持通过符号链接传输文件。');
+  }
+  const resolved=path.resolve(current);
+  const relative=path.relative(root,resolved);
+  if(relative==='..'||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw new Error('不允许访问项目目录之外的路径。');
+  return {root,path:resolved,stat:fs.statSync(resolved),relative:parts.join(path.sep)};
+}
+
+function projectFileList(row,relativePath=''){
+  const directory=checkedProjectEntry(row,relativePath);
+  if(!directory.stat.isDirectory())throw new Error('所选路径不是文件夹。');
+  const entries=[];
+  const visit=(current,relative,depth)=>{
+    if(depth>8||entries.length>=1000)return;
+    for(const name of fs.readdirSync(current)){
+      if(excludedProjectEntries.has(name.toLowerCase())||excludedProjectFiles.test(name))continue;
+      const target=path.join(current,name);
+      let stat;
+      try{stat=fs.lstatSync(target)}catch{continue}
+      if(stat.isSymbolicLink())continue;
+      const child=relative?`${relative}/${name}`:name;
+      if(stat.isDirectory())entries.push({name,path:child,type:'directory',size:null,updatedAt:stat.mtimeMs});
+      else if(stat.isFile())entries.push({name,path:child,type:'file',size:stat.size,updatedAt:stat.mtimeMs});
+      if(stat.isDirectory())visit(target,child,depth+1);
+      if(entries.length>=1000)break;
+    }
+  };
+  visit(directory.path,directory.relative,0);
+  entries.sort((left,right)=>left.type===right.type?left.name.localeCompare(right.name):left.type==='directory'?-1:1);
+  return {path:directory.relative,entries:entries.slice(0,1000),truncated:entries.length>=1000};
+}
+
+const projectMimeTypes=new Map([
+  ['.txt','text/plain; charset=utf-8'],['.md','text/markdown; charset=utf-8'],['.json','application/json'],
+  ['.csv','text/csv; charset=utf-8'],['.html','text/html; charset=utf-8'],['.css','text/css; charset=utf-8'],
+  ['.js','text/javascript; charset=utf-8'],['.ts','text/plain; charset=utf-8'],['.xml','application/xml'],
+  ['.pdf','application/pdf'],['.png','image/png'],['.jpg','image/jpeg'],['.jpeg','image/jpeg'],['.gif','image/gif'],
+  ['.webp','image/webp'],['.svg','image/svg+xml'],['.zip','application/zip']
+]);
+
+function sendFileRange(request,response,row,relativePath){
+  const file=checkedProjectEntry(row,relativePath);
+  if(!file.stat.isFile())throw new Error('所选路径不是文件。');
+  if(file.stat.size>8*1024*1024)throw Object.assign(new Error('单个文件下载不得超过 8 MiB。'),{status:413});
+  const filename=path.basename(file.path);
+  const fallback=filename.replace(/[^\x20-\x7e]|["\\;]/g,'_');
+  const encoded=encodeURIComponent(filename).replace(/[!'()*]/g,character=>`%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+  const etag=`"orbit-${file.stat.size}-${Math.trunc(file.stat.mtimeMs)}"`;
+  const headers={
+    'Content-Type':projectMimeTypes.get(path.extname(filename).toLowerCase())||'application/octet-stream',
+    'Accept-Ranges':'bytes',
+    'ETag':etag,
+    'Content-Disposition':`attachment; filename="${fallback}"; filename*=UTF-8''${encoded}`,
+    'X-Content-Type-Options':'nosniff'
+  };
+  if(request.headers['if-none-match']===etag){response.writeHead(304,headers);return response.end()}
+  const ifRange=request.headers['if-range'];
+  const range=ifRange&&ifRange!==etag?null:request.headers.range;
+  if(!range){
+    response.writeHead(200,{...headers,'Content-Length':file.stat.size});
+    if(request.method==='HEAD')return response.end();
+    return fs.createReadStream(file.path).pipe(response);
+  }
+  const match=String(range).match(/^bytes=(\d*)-(\d*)$/);
+  if(!match||(!match[1]&&!match[2])){response.writeHead(416,{...headers,'Content-Range':`bytes */${file.stat.size}`});return response.end()}
+  let start,end;
+  if(!match[1]){
+    const suffix=Number(match[2]);
+    if(!Number.isSafeInteger(suffix)||suffix<=0)return response.writeHead(416,{'Content-Range':`bytes */${file.stat.size}`}).end();
+    start=Math.max(0,file.stat.size-suffix);end=file.stat.size-1;
+  }else{
+    start=Number(match[1]);end=match[2]?Number(match[2]):file.stat.size-1;
+  }
+  if(!Number.isSafeInteger(start)||!Number.isSafeInteger(end)||start<0||start>=file.stat.size||end<start){
+    response.writeHead(416,{...headers,'Content-Range':`bytes */${file.stat.size}`});return response.end();
+  }
+  end=Math.min(end,file.stat.size-1);
+  const length=end-start+1;
+  response.writeHead(206,{...headers,'Content-Length':length,'Content-Range':`bytes ${start}-${end}/${file.stat.size}`});
+  if(request.method==='HEAD')return response.end();
+  fs.createReadStream(file.path,{start,end}).pipe(response);
+}
+
 export function createOrbitServer(options = {}) {
   const home = options.home || process.env.ORBIT_CODEX_HOME || process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
   const dataDir = options.dataDir || path.join(root, '.runtime');
@@ -27,6 +154,7 @@ export function createOrbitServer(options = {}) {
   let pairingKey = fs.existsSync(credentialPath) ? fs.readFileSync(credentialPath, 'utf8').trim() : crypto.randomBytes(24).toString('base64url');
   fs.writeFileSync(credentialPath, pairingKey, { mode: 0o600 });
   const store = options.store || new NativeStore(home);
+  cleanupStaleAttachments(store);
   const endpoint = options.endpoint ?? process.env.ORBIT_APP_SERVER_URL ?? '';
   const rpc = options.rpc || options.desktopRpc || (endpoint ? new CodexRpc({ home, endpoint, tokenFile: process.env.ORBIT_APP_SERVER_TOKEN_FILE }) : new DesktopRpc());
   const executionMode = rpc.mode || (endpoint ? 'endpoint' : 'cold-resume');
@@ -70,6 +198,7 @@ export function createOrbitServer(options = {}) {
   const sessions = new Map();
   const attempts = new Map();
   const dedup = new Map();
+  const consumedAttachments = new Map();
   const sockets = new Set();
   const desktopWatchers = new Map();
   const queuedSettingsInFlight = new Set();
@@ -78,6 +207,7 @@ export function createOrbitServer(options = {}) {
   let revision = store.revision();
   let timer;
   let lastDesktopConnect = 0;
+  let lastAttachmentCleanup=Date.now();
 
   function requestOrigin(request) {
     const hostname = new URL(`http://${request.headers.host || 'invalid'}`).hostname;
@@ -99,6 +229,65 @@ export function createOrbitServer(options = {}) {
     return { ...session, key };
   }
 
+  function removeAttachment(session,id){
+    const attachment=session?.attachments?.get(id)||consumedAttachments.get(id);
+    if(!attachment)return false;
+    session?.attachments?.delete(id);
+    consumedAttachments.delete(id);
+    const filename=path.resolve(attachment.path);
+    if(path.dirname(filename)===path.join(path.resolve(attachment.projectRoot),'.orbit-attachments')
+      &&/^[a-f0-9]{32}(?:\.[a-zA-Z0-9]{1,12})?$/.test(path.basename(filename))){
+      try{if(fs.lstatSync(filename).isFile())fs.unlinkSync(filename)}catch{}
+    }
+    return true;
+  }
+
+  function removeSessionAttachments(session){
+    for(const [id,attachment] of session.attachments||[]){
+      if(attachment.consumed){consumedAttachments.set(id,attachment);session.attachments.delete(id);}
+      else removeAttachment(session,id);
+    }
+  }
+
+  function attachmentPath(row,id,label){
+    const extension=path.extname(label).slice(1).toLowerCase();
+    const projectRoot=fs.realpathSync(row.cwd);
+    if(!fs.statSync(projectRoot).isDirectory())throw new Error('会话工作目录不可用。');
+    const directory=path.join(projectRoot,'.orbit-attachments');
+    try{
+      const existing=fs.lstatSync(directory);
+      if(existing.isSymbolicLink()||!existing.isDirectory())throw new Error('附件暂存目录不安全。');
+    }catch(error){if(error.code!=='ENOENT')throw error;fs.mkdirSync(directory,{mode:0o700});}
+    return path.join(directory,`${id}${/^[a-z0-9]{1,12}$/.test(extension)?`.${extension}`:''}`);
+  }
+
+  async function uploadAttachment(request,response,session,threadId,url){
+    const row=store.row(threadId);
+    if(!row||row.archived||String(row.source).startsWith('{'))return json(response,400,{error:'归档会话或子代理不能接收文件。'});
+    if(executionMode!=='desktop'||!rpc.connected)return json(response,409,{error:'文件传输仅支持已连接的 Codex 桌面原会话。'});
+    if(!controlFor(session,threadId))return json(response,403,{error:'请先连接并接管这条原会话。'});
+    if(!rpc.runtime(threadId)?.attached)return json(response,409,{error:'请先在 Codex 桌面打开此会话并重新连接。'});
+    for(const [id,attachment]of session.attachments)if(attachment.expires<Date.now())removeAttachment(session,id);
+    if([...session.attachments.values()].filter(item=>item.threadId===threadId&&!item.consumed).length>=maxPendingAttachments)return json(response,429,{error:`这条会话最多可暂存 ${maxPendingAttachments} 个待发送文件。`});
+    const rawName=url.searchParams.get('name')||'';
+    const label=rawName.replace(/[\\/]/g,'_').replace(/[\u0000-\u001f\u007f<>:"|?*]/g,'_').trim().slice(0,160);
+    if(!label||label==='.'||label==='..')return json(response,400,{error:'文件名无效。'});
+    const chunks=[];
+    let size=0;
+    for await(const chunk of request){
+      size+=chunk.length;
+      if(size>maxAttachmentBytes)return json(response,413,{error:'单个文件不得超过 8 MiB。'});
+      chunks.push(chunk);
+    }
+    if(!size)return json(response,400,{error:'不能发送空文件。'});
+    const id=crypto.randomBytes(16).toString('hex');
+    const filename=attachmentPath(row,id,label);
+    fs.writeFileSync(filename,Buffer.concat(chunks),{flag:'wx',mode:0o600});
+    const projectRoot=fs.realpathSync(row.cwd);
+    session.attachments.set(id,{id,threadId,label,size,projectRoot,mimeType:String(request.headers['content-type']||'application/octet-stream').split(';')[0],path:filename,expires:Date.now()+attachmentLifetime});
+    return json(response,201,{id,threadId,label,size,mimeType:session.attachments.get(id).mimeType});
+  }
+
   function json(response, status, body, extra = {}) {
     response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', ...extra });
     response.end(JSON.stringify(body));
@@ -223,7 +412,7 @@ export function createOrbitServer(options = {}) {
         previous.count = 0;
         if (sessions.size >= 64) return json(response, 429, { error: '已连接设备过多，请重启桥接服务后重新配对。' });
         const key = crypto.randomBytes(32).toString('base64url');
-        sessions.set(key, { expires: Date.now() + sessionLifetime, enabled: new Map(), preferences: new Map() });
+        sessions.set(key, { expires: Date.now() + sessionLifetime, enabled: new Map(), preferences: new Map(), attachments:new Map() });
         const secure = publicUrl ? '; Secure' : '';
         return json(response, 200, { ok: true }, { 'Set-Cookie': `orbit_session=${key}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200${secure}` });
       }
@@ -235,6 +424,7 @@ export function createOrbitServer(options = {}) {
         if (request.method === 'GET' && url.pathname === '/api/models') return json(response, 200, { models: await modelCatalog() });
         if (request.method === 'POST' && url.pathname === '/api/logout') {
           sessions.delete(session.key);
+          removeSessionAttachments(session);
           for (const socket of sockets) if (socket.sessionKey === session.key) socket.close(1008, 'Logged out');
           return json(response, 200, { ok: true }, { 'Set-Cookie': 'orbit_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0' });
         }
@@ -244,6 +434,29 @@ export function createOrbitServer(options = {}) {
           if (!connection) return json(response, 400, { error: '请选择桥接服务提供的连接地址。' });
           return json(response, 200, { image: await QRCode.toDataURL(`${connection}/#pair=${encodeURIComponent(pairingKey)}`, { width: 280, margin: 2 }), warning: '扫码者将能查看本机会话。仅向可信设备展示。' });
         }
+        const uploadMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/attachments$/);
+        if(request.method==='POST'&&uploadMatch)return await uploadAttachment(request,response,session,uploadMatch[1],url);
+        const removeAttachmentMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/attachments\/remove$/);
+        if(request.method==='POST'&&removeAttachmentMatch){
+          const body=await readBody(request);
+          if(Object.keys(body).some(key=>key!=='attachmentId')||typeof body.attachmentId!=='string')return json(response,400,{error:'附件移除请求无效。'});
+          const attachment=session.attachments.get(body.attachmentId);
+          if(!attachment||attachment.threadId!==removeAttachmentMatch[1])return json(response,404,{error:'待发送附件不存在或已过期。'});
+          removeAttachment(session,body.attachmentId);
+          return json(response,200,{removed:true});
+        }
+        const filesMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/files$/);
+        if(request.method==='GET'&&filesMatch){
+          const row=store.row(filesMatch[1]);
+          if(!row)return json(response,404,{error:'会话不存在。'});
+          return json(response,200,projectFileList(row,url.searchParams.get('path')||''));
+        }
+        const fileMatch=url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/file$/);
+        if(request.method==='GET'&&fileMatch){
+          const row=store.row(fileMatch[1]);
+          if(!row)return json(response,404,{error:'会话不存在。'});
+          return sendFileRange(request,response,row,url.searchParams.get('path')||'');
+        }
         const match = url.pathname.match(/^\/api\/threads\/([a-zA-Z0-9_-]{8,120})\/messages$/);
         if (request.method === 'GET' && match) {
           const history = store.historyFor(match[1], url.searchParams.get('before'), url.searchParams.get('limit') || 60);
@@ -335,7 +548,7 @@ export function createOrbitServer(options = {}) {
       }
       const control = controlFor(session, id);
       const approvals = control ? (executionMode === 'desktop' ? runtime?.approvals || [] : [...rpc.approvals.values()].filter(request => request.params.threadId === id).map(request => ({ ...request.params, requestId: String(request.id), method: request.method }))) : [];
-      return { subscribed: id || null, control, runtime, settings: control ? session.preferences.get(id) || null : null, turnId: runtime?.turnId || rpc.threads.get(id)?.turnId || null, approvals };
+      return { subscribed: id || null, control, runtime, settings: control ? session.preferences.get(id) || null : null, turnId: runtime?.turnId || rpc.threads.get(id)?.turnId || null, approvals, attachments:[...session.attachments.values()].filter(item=>item.threadId===id&&!item.consumed&&item.expires>Date.now()).map(({id,label,size,mimeType})=>({id,label,size,mimeType})) };
     }
     if (message.method === 'thread.enable') {
       const row = store.row(id);
@@ -365,10 +578,28 @@ export function createOrbitServer(options = {}) {
     if (message.method === 'turn.start') {
       const approval = controlFor(session, id);
       if (!approval) throw new Error('请先确认这条会话的接续方式。');
-      if (typeof body.text !== 'string' || !body.text.trim() || body.text.length > 20000) throw new Error('消息必须为 1–20000 个字符。');
-      if (executionMode === 'desktop') return rpc.startTurn(id, body.text.trim());
+      const mode=body.mode??'default';
+      if(!['default','plan','goal'].includes(mode))throw new Error('对话模式无效。');
+      const attachmentIds=body.attachmentIds===undefined?[]:body.attachmentIds;
+      if(!Array.isArray(attachmentIds)||attachmentIds.length>maxPendingAttachments||new Set(attachmentIds).size!==attachmentIds.length
+        ||attachmentIds.some(attachmentId=>typeof attachmentId!=='string'))throw new Error('文件附件列表无效。');
+      if(typeof body.text!=='string'||(!body.text.trim()&&!attachmentIds.length)||body.text.length>20000)throw new Error('消息或附件必须至少提供一项；文本不得超过 20000 个字符。');
+      const attachments=attachmentIds.map(attachmentId=>{
+        const attachment=session.attachments.get(attachmentId);
+        if(!attachment||attachment.threadId!==id||attachment.consumed||attachment.expires<Date.now())throw new Error('文件附件不存在、属于其他会话或已过期。请重新添加。');
+        return attachment;
+      });
+      let text=body.text.trim()||(attachments.length?`请查看并处理以下附件：${attachments.map(file=>file.label).join('、')}`:'');
+      if(mode==='goal')text=`请将本轮请求作为需要完成的目标，主动推进直到完成，并汇报结果；如果受阻，请明确说明原因。\n\n本轮目标：\n${text}`;
+      if(body.mode==='plan')text=`请先分析任务并制定清晰的分步计划，说明后等待我确认；在我确认前不要执行任何修改。\n\n任务：\n${text}`;
+      if (executionMode === 'desktop') {
+        const result=await rpc.startTurn(id,text,{mode,attachments});
+        for(const attachment of attachments){attachment.consumed=true;attachment.expires=Date.now()+attachmentRetention;consumedAttachments.set(attachment.id,attachment);}
+        return result;
+      }
+      if(mode!=='default'||attachments.length)throw new Error('计划/目标模式和文件附件仅支持 Codex 桌面热接管。');
       if (!rpc.threads.has(id) && !endpoint && store.locked(id)) throw new Error('会话已被其他进程占用，未发送消息。');
-      return rpc.startTurn(id, body.text.trim(), approval.writable, session.preferences.get(id) || null);
+      return rpc.startTurn(id,text,approval.writable,session.preferences.get(id)||null);
     }
     if (message.method === 'thread.settings') {
       if (!controlFor(session, id) || !store.row(id)) throw new Error('没有此会话的控制授权。');
@@ -399,9 +630,20 @@ export function createOrbitServer(options = {}) {
     if (message.method === 'turn.steer') {
       if (!controlFor(session, id)) throw new Error('没有此会话的控制授权。');
       if (executionMode !== 'desktop') throw new Error('当前执行通道不支持向桌面任务追加指令。');
-      if (typeof body.text !== 'string' || !body.text.trim() || body.text.length > 20000) throw new Error('消息必须为 1–20000 个字符。');
+      const attachmentIds=body.attachmentIds===undefined?[]:body.attachmentIds;
+      if(!Array.isArray(attachmentIds)||attachmentIds.length>maxPendingAttachments||new Set(attachmentIds).size!==attachmentIds.length
+        ||attachmentIds.some(attachmentId=>typeof attachmentId!=='string'))throw new Error('文件附件列表无效。');
+      if(typeof body.text!=='string'||(!body.text.trim()&&!attachmentIds.length)||body.text.length>20000)throw new Error('消息或附件必须至少提供一项；文本不得超过 20000 个字符。');
       if (typeof body.turnId !== 'string' || !body.turnId) throw new Error('缺少当前任务标识，请刷新后重试。');
-      return rpc.steer(id, body.text.trim(), body.turnId);
+      const attachments=attachmentIds.map(attachmentId=>{
+        const attachment=session.attachments.get(attachmentId);
+        if(!attachment||attachment.threadId!==id||attachment.consumed||attachment.expires<Date.now())throw new Error('文件附件不存在、属于其他会话或已过期。请重新添加。');
+        return attachment;
+      });
+      const text=body.text.trim()||(attachments.length?`请查看并处理以下附件：${attachments.map(file=>file.label).join('、')}`:'');
+      const result=await rpc.steer(id,text,body.turnId,{attachments});
+      for(const attachment of attachments){attachment.consumed=true;attachment.expires=Date.now()+attachmentRetention;consumedAttachments.set(attachment.id,attachment);}
+      return result;
     }
     if (message.method === 'turn.interrupt') {
       if (!controlFor(session, id)) throw new Error('没有此会话的控制授权。');
@@ -418,6 +660,12 @@ export function createOrbitServer(options = {}) {
 
   const eventListener = event => {
     if (!/^(item\/|turn\/|thread\/status|orbit\/|serverRequest\/resolved|error$)/.test(event.method)) return;
+    if(event.method==='turn/completed'&&event.params?.threadId){
+      for(const session of sessions.values())for(const [id,attachment]of session.attachments){
+        if(attachment.threadId===event.params.threadId&&attachment.consumed)removeAttachment(session,id);
+      }
+      for(const [id,attachment]of consumedAttachments)if(attachment.threadId===event.params.threadId)removeAttachment(null,id);
+    }
     if (event.method === 'orbit/desktop' && event.params?.threadId) void applyQueuedDesktopSettings(event.params.threadId,event.params);
     for (const socket of sockets) {
       const threadId = event.params?.threadId;
@@ -453,7 +701,12 @@ export function createOrbitServer(options = {}) {
         }
         for (const [key, value] of dedup) if (Date.now() - value.created > 300000) dedup.delete(key);
         for (const [key, value] of attempts) if (value.reset < Date.now()) attempts.delete(key);
-        for (const [key, value] of sessions) if (value.expires < Date.now()) sessions.delete(key);
+        for (const [key, value] of sessions) if (value.expires < Date.now()) {removeSessionAttachments(value);sessions.delete(key);}
+        for(const session of sessions.values()){
+          for(const [id,attachment]of session.attachments)if(attachment.expires<Date.now())removeAttachment(session,id);
+        }
+        for(const [id,attachment]of consumedAttachments)if(attachment.expires<Date.now())removeAttachment(null,id);
+        if(Date.now()-lastAttachmentCleanup>60*60*1000){cleanupStaleAttachments(store);lastAttachmentCleanup=Date.now();}
       } catch {}
     }, 1200);
     timer.unref();
@@ -469,6 +722,7 @@ export function createOrbitServer(options = {}) {
   async function close() {
     clearInterval(timer); clearInterval(heartbeat);
     for (const socket of sockets) unwatchDesktop(socket);
+    for(const session of sessions.values())removeSessionAttachments(session);
     for (const socket of sockets) socket.terminate();
     rpc.off('event', eventListener); rpc.off('lost', lostListener); rpc.close();
     await new Promise(resolve => wss.close(resolve));