privateer-agent 0.12.8 → 0.12.11

package/src/cli/chat.ts

@@ -44,8 +44,10 @@ async function main() {
   const {
     accountPosture,
     rememberAccountCredential,
+    persistAccountCredential,
     dropPersistedAccountCredential,
   } = await import("../providers/account.ts");
+  const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
   const { pickerCatalog, hiddenAccountNotice, hiddenAccountTitleSuffix } = await import("../providers/modelCatalog.ts");
   const { resolveDefaultModel, resolveSignedInModel, savedPiDefaultSpec } = await import("../providers/defaultModel.ts");
@@ -448,7 +450,7 @@ async function main() {
     try { await priv.revokeLocalSessions(); } catch { /* best effort — server TTL is the fallback */ }
     // Ownership-checked: auth.json is machine-global, so removing an entry another
     // running terminal minted would strand it (see providers/account.ts).
-    try { dropPersistedAccountCredential({ modelRegistry: { authStorage: services.authStorage } }); } catch { /* nothing persisted */ }
+    try { await dropPersistedAccountCredential(); } catch { /* nothing persisted */ }
   }
   const onSignal = (): void => { void cleanup().finally(() => process.exit(0)); };
   process.once("SIGINT", onSignal);
@@ -459,14 +461,14 @@ async function main() {
   if (provider === "privateer") {
     try {
       const creds = await priv.acquireAccountCredential();
-      (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+      await persistAccountCredential(creds);
       rememberAccountCredential(creds); // claim it, so cleanup drops OUR entry and only ours
     } catch (e) {
       console.log(`${RED}Account channel unavailable: ${(e as Error).message}${RESET}`);
     }
   }
 
-  const model = (services.modelRegistry as any).find(provider, modelId);
+  const model = (modelRegistryOf(services) as any).find(provider, modelId);
   if (!model) {
     console.log(`${RED}Model ${provider}/${modelId} not found.${RESET} Set PRIVATEER_MODEL=provider/id and check the key is in .env.`);
     rl.close();
@@ -633,7 +635,7 @@ async function main() {
   // is filtered out until the credential is armed).
   const SIGN_IN_HINT = "Run /login.";
   async function modelCatalog() {
-    return pickerCatalog(services.modelRegistry as any);
+    return pickerCatalog(modelRegistryOf(services) as any);
   }
 
   // Switch the live session's model in place (history preserved — see
@@ -644,7 +646,7 @@ async function main() {
     const at = sp.indexOf("/");
     if (at < 0) { const m = "Usage: /model provider/id"; console.log(`${RED}${m}${RESET}`); if (remote) relay?.sendNotice(m); return; }
     const p = sp.slice(0, at), id = sp.slice(at + 1);
-    const model = (session.modelRegistry as any).find?.(p, id) ?? (services.modelRegistry as any).find?.(p, id);
+    const model = (session.modelRegistry as any).find?.(p, id) ?? (modelRegistryOf(services) as any).find?.(p, id);
     if (!model) { const m = `Model ${sp} not found — try /models.`; console.log(`${RED}${m}${RESET}`); if (remote) relay?.sendNotice(m); return; }
     try {
       await session.setModel(model);

package/src/config/moat.ts

@@ -62,6 +62,14 @@ export interface MoatOptions {
    * pair is what the model gets (see tools/relayFileTools.ts).
    */
   relayFiles?: { bridge: SendFileBridge; attachments: AttachmentStore };
+  /**
+   * THIS run's inbox-attachment staging area (routines/resultMedia.ts). Passed only by
+   * a path whose result reaches the app's Inbox — a scheduled routine, a submitted
+   * task — and never shared between runs, so yesterday's staged file can't ride along
+   * with today's. Absent ⇒ attach_to_result doesn't exist for the session, which is
+   * the point: a run whose result goes to a webhook or a file has nothing to attach to.
+   */
+  resultMedia?: import("../routines/resultMedia.ts").ResultMedia;
 }
 
 /**
@@ -206,6 +214,11 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
     factories.push(makeRelayFileTools(opts.relayFiles.bridge, opts.relayFiles.attachments));
   }
 
+  if (opts.resultMedia) {
+    const { makeAttachResultTools } = await import("../tools/attachResult.ts");
+    factories.push(makeAttachResultTools(opts.resultMedia));
+  }
+
   if (caps.web && webEnabled()) {
     const { makeWebTools } = await import("../tools/web.ts");
     factories.push(makeWebTools());

package/src/harbor/index.ts

@@ -17,8 +17,11 @@ import { type GateController } from "../ext/permissionGate.ts";
 import { moatResourceOptions } from "../config/moat.ts";
 import {
   rememberAccountCredential,
+  persistAccountCredential,
   dropPersistedAccountCredential,
 } from "../providers/account.ts";
+// Pi-free static graph by design — see the header of piAuthStore.ts.
+import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { resolveDefaultModel } from "../providers/defaultModel.ts";
 import { RelayClient, type TaskSpec } from "../remote/relayClient.ts";
 import { createLiveTaskSession, type LiveTaskHandle } from "../remote/liveTaskSession.ts";
@@ -54,6 +57,9 @@ import { triggerError, computeNextRun, advanceAfterRun } from "../routines/trigg
 import { splitRoutineTools } from "../routines/toolSelect.ts";
 import { resolveMcpSelection, readMcpInventory, type ResolvedMcpTools } from "../mcp/toolNames.ts";
 import { deliver, type RelayPusher, type CloudPusher } from "../routines/delivery.ts";
+import { ResultMedia, type StagedMedia } from "../routines/resultMedia.ts";
+import { withBrief } from "../routines/resultBrief.ts";
+import { ATTACH_RESULT_TOOL } from "../tools/attachResult.ts";
 import { postOutbox as sealToOutbox } from "../outbox/cloudOutbox.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, sendToHarbor, describeRelay, formatDuration, HarborAlreadyRunningError, type IpcRequest, type IpcResponse, type RelayStatus } from "./ipc.ts";
@@ -284,10 +290,14 @@ export class Harbor {
     return "queued";
   };
 
-  private readonly pushCloud: CloudPusher = async (routine, content, status) => {
+  private readonly pushCloud: CloudPusher = async (routine, content, status, media = []) => {
     const at = new Date().toISOString();
-    if (await this.postOutbox(routine.name, at, status, content)) return "sent";
-    addPendingCloud({ routine: routine.name, at, status, content });
+    if (await this.postOutbox(routine.name, at, status, content, "routine", media)) return "sent";
+    // The queued copy keeps the attachment RECORDS, not the bytes: the files are
+    // still on this disk, so a flush hours later re-reads them (and says so in the
+    // body for any that have since gone). Buffering megabytes into a JSON queue
+    // would be the same content twice, on a box that already has it.
+    addPendingCloud({ routine: routine.name, at, status, content, ...(media.length ? { media } : {}) });
     return "queued";
   };
 
@@ -577,8 +587,15 @@ export class Harbor {
   // finished turn, and two copies of an E2EE wire format is one too many. Same
   // caches, same fail-closed key verification; this is just the harbor's caller.
 
-  private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: OutboxKind = "routine"): Promise<boolean> {
-    return sealToOutbox(name, at, status, content, kind);
+  private async postOutbox(
+    name: string,
+    at: string,
+    status: "ok" | "error",
+    content: string,
+    kind: OutboxKind = "routine",
+    media: StagedMedia[] = [],
+  ): Promise<boolean> {
+    return sealToOutbox(name, at, status, content, kind, media);
   }
 
   private async flushPendingCloud(): Promise<void> {
@@ -587,7 +604,10 @@ export class Harbor {
     if (queue.length === 0) return;
     const remaining: PendingCloud[] = [];
     for (const p of queue) {
-      if (remaining.length === 0 && (await this.postOutbox(p.routine, p.at, p.status, p.content, p.kind ?? "routine"))) continue;
+      if (
+        remaining.length === 0 &&
+        (await this.postOutbox(p.routine, p.at, p.status, p.content, p.kind ?? "routine", p.media ?? []))
+      ) continue;
       remaining.push(p);
     }
     if (remaining.length !== queue.length) {
@@ -705,15 +725,25 @@ export class Harbor {
       log("  note: email delivery is not wired yet (Phase 5) — skipping it");
     }
 
+    // A routine delivering to the app's Inbox can answer with more than prose: an
+    // artifact fence the app turns into a Cargo card, and files staged through
+    // attach_to_result. Both are wired here rather than in the session builder,
+    // because both only make sense when there is an Inbox at the other end — a
+    // file- or webhook-only routine gets neither the tool nor the brief.
+    const toInbox = routine.delivery.includes("cloud");
+    const media = toInbox ? new ResultMedia() : undefined;
+
     const { out, status, error, notes } = await this.runSession({
-      prompt: routine.prompt,
+      prompt: withBrief(routine.prompt, { inbox: toInbox, canAttach: !!media }),
       cwd: routine.cwd,
       model: modelSpec,
       tools: routine.tools ?? [],
+      media,
     });
 
     const content = formatResult(routine, out, status, error, notes);
     const report = await deliver(routine, content, status, {
+      media: media?.list() ?? [],
       pushRelay: this.pushRelay,
       pushCloud: this.pushCloud,
       webhooks: config.webhooks,
@@ -741,7 +771,7 @@ export class Harbor {
   // activation, so the build is serialized (serializeBuild) and the previous value is
   // restored. "__none__" is its sentinel for "register none": an unattended run with
   // no connector selectors gets no direct tools, whatever a shared mcp.json says.
-  private buildSessionServices(cwd: string, directTools: string[]): Promise<any> {
+  private buildSessionServices(cwd: string, directTools: string[], media?: ResultMedia): Promise<any> {
     return serializeBuild(async () => {
       const gate: GateController = {
         getMode: () => "bypass",
@@ -759,7 +789,7 @@ export class Harbor {
       // any moat shim an older release left in the shared agent dir (releases up to 0.11
       // installed one per extension; the launcher sweeps them, but a daemon can outlive
       // the launch that would have). See config/moat.ts.
-      const moat = await moatResourceOptions({ kind: "harbor-session", gate });
+      const moat = await moatResourceOptions({ kind: "harbor-session", gate, resultMedia: media });
       // MCP_DIRECT_TOOLS is read by the adapter when its factory RUNS, inside
       // createAgentSessionServices — so it has to wrap the session creation, not the
       // moatResourceOptions() call that imported it.
@@ -849,7 +879,7 @@ export class Harbor {
       rmSync(join(agentDir(), "mcp-cache.json"), { force: true });
       const services = await this.buildSessionServices(cwd, []);
       const { provider, modelId } = parseSpec(modelSpec);
-      const model = (services.modelRegistry as any).find(provider, modelId);
+      const model = (modelRegistryOf(services) as any).find(provider, modelId);
       if (!model) return;
       const { session } = await createAgentSessionFromServices({
         services,
@@ -878,22 +908,33 @@ export class Harbor {
   // shell command still fail-closes headlessly (localAsk denies) — plus per-run account
   // credentials that are revoked in the finally so they never linger as an orphaned
   // "device" in the app's Linked Devices.
-  private async runSession(spec: { prompt: string; cwd: string; model: string; tools: string[] }): Promise<{ out: string; status: "ok" | "error"; error?: string; notes: string[] }> {
+  private async runSession(spec: {
+    prompt: string;
+    cwd: string;
+    model: string;
+    tools: string[];
+    media?: ResultMedia;
+  }): Promise<{ out: string; status: "ok" | "error"; error?: string; notes: string[] }> {
     let out = "";
     let status: "ok" | "error" = "ok";
     let error: string | undefined;
-    let servicesRef: { authStorage?: { remove?: (p: string) => void; get?: (p: string) => unknown } } | null = null;
     let spawnedAccount = false;
-    const { tools: allowedTools, directToolsEnv, notes } = await this.resolveRunTools(spec.tools, spec.cwd, spec.model);
+    const resolved = await this.resolveRunTools(spec.tools, spec.cwd, spec.model);
+    // attach_to_result rides with the staging area rather than the allow-list: it is
+    // how the answer is DELIVERED, not a capability the run gains. A routine that
+    // named an explicit tool list still gets it, because the alternative is a run
+    // that can generate a still and then has no way to hand it over — and the file
+    // is going to the user's own mailbox, which `delivery: cloud` already chose.
+    const allowedTools = spec.media ? [...resolved.tools, ATTACH_RESULT_TOOL] : resolved.tools;
+    const { directToolsEnv, notes } = resolved;
     try {
-      const services = await this.buildSessionServices(spec.cwd, directToolsEnv);
-      servicesRef = services as any;
+      const services = await this.buildSessionServices(spec.cwd, directToolsEnv, spec.media);
 
       const { provider, modelId } = parseSpec(spec.model);
       if (provider === "privateer") {
         try {
           const creds = await acquireAccountCredential();
-          (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+          await persistAccountCredential(creds);
           rememberAccountCredential(creds); // claim it, so the teardown drops OUR entry only
           spawnedAccount = true;
         } catch (e) {
@@ -901,7 +942,7 @@ export class Harbor {
         }
       }
 
-      const model = (services.modelRegistry as any).find(provider, modelId);
+      const model = (modelRegistryOf(services) as any).find(provider, modelId);
       if (!model) {
         status = "error";
         error = `model ${provider}/${modelId} not found`;
@@ -935,7 +976,7 @@ export class Harbor {
         try { await revokeAccountSession(); } catch { /* best effort — server TTL is the fallback */ }
         // Ownership-checked: an interactive terminal on this machine shares auth.json,
         // and its entry must survive a harbor run's teardown (see providers/account.ts).
-        try { dropPersistedAccountCredential({ modelRegistry: { authStorage: servicesRef?.authStorage } }); } catch { /* nothing persisted */ }
+        try { await dropPersistedAccountCredential(); } catch { /* nothing persisted */ }
       }
     }
     return { out, status, error, notes };
@@ -959,14 +1000,24 @@ export class Harbor {
     }
     this.running.add(key);
     log(`running task "${title}"`);
+    // A submitted task ALWAYS answers into the Inbox, so it always gets the brief and
+    // the attachment tool — the app is the only place its result is ever read.
+    const media = new ResultMedia();
     try {
-      const { out, status, error, notes } = await this.runSession({ prompt: spec.prompt, cwd, model: modelSpec, tools: spec.tools ?? [] });
+      const { out, status, error, notes } = await this.runSession({
+        prompt: withBrief(spec.prompt, { inbox: true, canAttach: true }),
+        cwd,
+        model: modelSpec,
+        tools: spec.tools ?? [],
+        media,
+      });
       const content = redactText(formatTaskResult(title, out, status, error, modelSpec, notes), collectSecrets(config.providers));
       const at = new Date().toISOString();
+      const staged = media.list();
       // Durable delivery: seal to the outbox. If we can't seal yet (no verified pubkey /
       // offline), queue it with kind:"task" so the flush re-seals it correctly later.
-      const sealed = await this.postOutbox(title, at, status, content, "task");
-      if (!sealed) addPendingCloud({ routine: title, at, status, content, kind: "task" });
+      const sealed = await this.postOutbox(title, at, status, content, "task", staged);
+      if (!sealed) addPendingCloud({ routine: title, at, status, content, kind: "task", ...(staged.length ? { media: staged } : {}) });
       // Live mirror if a controller is attached (the outbox copy is the source of truth).
       if (this.controllerAttached) this.relay?.sendTaskResult(title, content);
       log(`  task "${title}" ${status}; ${sealed ? "sealed to outbox" : "queued for outbox"}`);

package/src/main.ts

@@ -3,7 +3,7 @@
 // boot's side effects are guaranteed to have run before any Pi module loads.
 //
 // Phase 1 skeleton: this prints the resolved boot state so `npm start` proves
-// the boot chain end-to-end (env pinned, dispatcher installed) without a TUI.
+// the boot chain in full (env pinned, dispatcher installed) without a TUI.
 // Phases 4/6 replace the body with the harbor/relay wiring and the pi-tui app.
 
 import "./boot.ts";

package/src/nostr/event.ts

@@ -63,7 +63,7 @@ export function signEvent(u: UnsignedEvent, secretKeyHex: string, auxRand?: Uint
 }
 
 /**
- * Verify an event end to end, fail-closed on anything malformed.
+ * Verify an event in full, fail-closed on anything malformed.
  *
  * BOTH checks matter and the order is deliberate: recompute the id first, so a
  * tampered `content` or `tags` is caught even when the signature over the ORIGINAL

package/src/outbox/cloudOutbox.ts

@@ -15,14 +15,23 @@
 // pin, no signature, or a bad signature ⇒ we don't seal at all, and the caller falls
 // back to its own durable channel (a queue, a file, a notice).
 //
+// ATTACHMENTS. A result may also carry media (routines/resultMedia.ts). The message
+// envelope stays small — it is capped by the server at 128KB of base64 — so only a
+// thumbnail-sized file rides inside it; anything larger is sealed on its own and
+// PUT to /api/outbox/blob, with the envelope carrying just its id and metadata. Both
+// halves are sealed to the same account key, so the server holds ciphertext either
+// way, and the app collects the blobs on the same sync that opens the message.
+//
 // Module-level caches (pubkey, machine origin) — one per process, exactly like the
 // per-instance caches this replaced.
 
+import { readFileSync, existsSync, statSync } from "node:fs";
 import { apiRequest, defaultDeviceLabel } from "../auth/privateer.ts";
 import { loadAccountSignKey } from "../crypto/accountTrust.ts";
 import { verifyOutboxKey } from "../crypto/accountVerify.ts";
-import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
+import { sealJson, seal, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
 import { routineRelayId, type OutboxKind } from "../routines/store.ts";
+import { MAX_ATTACHMENT_BYTES, type MediaClass, type StagedMedia } from "../routines/resultMedia.ts";
 
 export type { OutboxKind };
 
@@ -31,6 +40,34 @@ export type { OutboxKind };
 // the mailbox's purpose — summaries and answers, not transcripts.
 export const MAX_CLOUD_PLAINTEXT = 45_000;
 
+// Total plaintext an envelope may reach once attachment metadata (and any inline
+// bytes) are folded in. 128KB of base64 is 98,304 bytes of plaintext; this leaves
+// headroom for the sealed-box overhead and JSON escaping.
+const MAX_ENVELOPE_PLAINTEXT = 90_000;
+
+/** Largest file carried INSIDE the envelope rather than as its own blob. */
+export const MAX_INLINE_MEDIA_BYTES = 24 * 1024;
+/** Total base64 an envelope will spend on inline media, whatever the file count. */
+const INLINE_TOTAL_B64_BUDGET = 32 * 1024;
+
+/**
+ * One attachment as the app sees it: metadata always, then EITHER `b64` (small
+ * enough to inline) or `blobId` (fetch + open separately). Never both, never
+ * neither — an attachment we couldn't deliver is dropped from the list and named
+ * in the body instead, because a card that can never load is worse than a sentence
+ * saying the file stayed on the machine.
+ */
+export interface OutboxMedia {
+  id: string;
+  name: string;
+  mediaType: string;
+  cls: MediaClass;
+  size: number;
+  caption?: string;
+  b64?: string;
+  blobId?: string;
+}
+
 let outboxPub: Uint8Array | undefined;
 let originCache: { id: string; label: string } | undefined;
 
@@ -66,10 +103,119 @@ export function machineOrigin(): { id: string; label: string } {
   return originCache;
 }
 
+/** Seal one attachment's bytes and store them. Returns the blob id, or undefined. */
+async function uploadBlob(pub: Uint8Array, bytes: Uint8Array): Promise<string | undefined> {
+  try {
+    const res = await apiRequest("/api/outbox/blob", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ sealed: seal(pub, bytes) }),
+    });
+    if (!res.ok) return undefined;
+    const data = (await res.json()) as { id?: string };
+    return typeof data.id === "string" ? data.id : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Delete blobs we uploaded for a message that then failed to post. Best-effort: the
+ * server's TTL would collect them anyway, but a queued result re-uploads on its next
+ * attempt, and leaving the first copy behind spends the account's blob quota on bytes
+ * nothing will ever reference.
+ */
+async function dropBlobs(ids: string[]): Promise<void> {
+  if (ids.length === 0) return;
+  try {
+    await apiRequest("/api/outbox/blob/ack", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ ids }),
+    });
+  } catch {
+    /* TTL is the backstop */
+  }
+}
+
+/**
+ * Turn staged files into envelope entries, uploading what doesn't fit inline.
+ *
+ * `budget` is the base64 room left in the envelope after the body. Files are taken
+ * in order — the model attached them in the order it wanted them shown — so a small
+ * still after a large one still gets its inline slot.
+ */
+async function packMedia(
+  pub: Uint8Array,
+  staged: StagedMedia[],
+  budget: number,
+): Promise<{ media: OutboxMedia[]; blobIds: string[]; undelivered: string[] }> {
+  const media: OutboxMedia[] = [];
+  const blobIds: string[] = [];
+  const undelivered: string[] = [];
+  let inlineLeft = Math.max(0, Math.min(budget, INLINE_TOTAL_B64_BUDGET));
+
+  for (const item of staged) {
+    // Re-check at delivery: the file was measured when the model attached it, and a
+    // run can be long. A file that has since been deleted, replaced with a directory
+    // or grown past the cap is named in the body rather than silently dropped.
+    let bytes: Uint8Array;
+    try {
+      if (!existsSync(item.path)) throw new Error("missing");
+      const stat = statSync(item.path);
+      if (!stat.isFile() || stat.size === 0 || stat.size > MAX_ATTACHMENT_BYTES) throw new Error("unusable");
+      bytes = new Uint8Array(readFileSync(item.path));
+    } catch {
+      undelivered.push(item.name);
+      continue;
+    }
+
+    const meta: OutboxMedia = {
+      id: item.id,
+      name: item.name,
+      mediaType: item.mediaType,
+      cls: item.cls,
+      size: bytes.length,
+      ...(item.caption ? { caption: item.caption } : {}),
+    };
+
+    if (bytes.length <= MAX_INLINE_MEDIA_BYTES) {
+      const b64 = Buffer.from(bytes).toString("base64");
+      if (b64.length <= inlineLeft) {
+        inlineLeft -= b64.length;
+        media.push({ ...meta, b64 });
+        continue;
+      }
+    }
+
+    const blobId = await uploadBlob(pub, bytes);
+    if (!blobId) {
+      undelivered.push(item.name);
+      continue;
+    }
+    blobIds.push(blobId);
+    media.push({ ...meta, blobId });
+  }
+
+  return { media, blobIds, undelivered };
+}
+
+/** A line in the result body for each file that couldn't travel. */
+function undeliveredNote(names: string[]): string {
+  if (names.length === 0) return "";
+  const label = machineOrigin().label;
+  return `\n\n---\n\n> ⚠︎ Couldn't deliver ${names.length === 1 ? "one attachment" : `${names.length} attachments`} (${names.join(", ")}) — ${names.length === 1 ? "it is" : "they are"} still on ${label}.\n`;
+}
+
 /**
  * Seal one result to the account outbox and POST the ciphertext. Returns whether the
  * server accepted it; false covers every failure (no verified key, offline, rejected)
  * and means the caller must fall back to its own durable channel.
+ *
+ * `staged` is this run's attachments (routines/resultMedia.ts). They are uploaded
+ * BEFORE the message, so a message that lands always references bytes that exist;
+ * if the message then fails, the blobs are dropped again and the caller's queued
+ * retry re-uploads from the same paths on disk.
  */
 export async function postOutbox(
   name: string,
@@ -77,19 +223,49 @@ export async function postOutbox(
   status: "ok" | "error",
   content: string,
   kind: OutboxKind = "routine",
+  staged: StagedMedia[] = [],
 ): Promise<boolean> {
   const pub = await ensureOutboxPub();
   if (!pub) return false;
-  const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
-  const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body, origin: machineOrigin() });
+  let body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
+
+  const { media, blobIds, undelivered } = staged.length
+    ? await packMedia(pub, staged, MAX_ENVELOPE_PLAINTEXT - body.length - 2_000)
+    : { media: [] as OutboxMedia[], blobIds: [] as string[], undelivered: [] as string[] };
+  body += undeliveredNote(undelivered);
+
+  // v2 adds `media`. Older apps ignore the field and still render the body, which is
+  // why the note above names undelivered files in prose rather than only in metadata.
+  const envelope: Record<string, unknown> = {
+    v: media.length > 0 ? 2 : 1,
+    kind,
+    name,
+    status,
+    at,
+    content: body,
+    origin: machineOrigin(),
+    ...(media.length > 0 ? { media } : {}),
+  };
+
+  let sealed = sealJson(pub, envelope);
+  if (sealed.length > 128 * 1024) {
+    // The budget arithmetic above should make this unreachable; if it is ever wrong,
+    // the ANSWER is what gets clipped, never the attachments — those are the part the
+    // user cannot reconstruct from anywhere else.
+    envelope.content = body.slice(0, Math.max(0, MAX_CLOUD_PLAINTEXT / 2)) + "\n…truncated";
+    sealed = sealJson(pub, envelope);
+  }
+
   try {
     const res = await apiRequest("/api/outbox", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ sealed }),
     });
+    if (!res.ok) await dropBlobs(blobIds);
     return res.ok;
   } catch {
+    await dropBlobs(blobIds);
     return false;
   }
 }