trantor 0.18.116 → 0.18.117

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.116",
+  "version": "0.18.117",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/hub/auth.mjs

@@ -1,19 +1,60 @@
 /* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: Auth normalizes untrusted request and persisted identity shapes at their established hub boundary; this split preserves those guards unchanged. */
-import { verifyRequest, verifyEndorsement } from "../lib/identity.mjs";
+import { verifyRequest, verifyEndorsement, HDR } from "../lib/identity.mjs";
 import { readFileSync } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { publicView } from "../lib/identity.mjs";
 import { IDENTITY_KINDS } from "../lib/store-contract.mjs";
 
 export function createAuthRuntime({ state, markDirty, AUTH_MODE, SUPERSEDE_GRACE_MS, LOOPBACK_BIND, ENROLL_MODE, seenNonces = new Map() }) {
 const now = () => Date.now();
-function rawBody(req) {
+// Route measurements and supported envelopes: docs/REQUEST-BODY-LIMITS.md.
+const BODY_CAP_DEFAULT = 4 * 1024 * 1024;
+const BODY_CAP_PROMPT = 16 * 1024 * 1024;
+// More than 100x the measured 115,194-byte desktop snapshot.
+const BODY_CAP_OWNER_CHAT = 16 * 1024 * 1024;
+// About 6x the measured 10,659,828-byte real state.
+const BODY_CAP_OWNER_IMPORT = 64 * 1024 * 1024;
+const OWNER_BODY_CAPS = new Map([
+  ["/session/chat", BODY_CAP_OWNER_CHAT],
+  ["/import", BODY_CAP_OWNER_IMPORT],
+  ["/handoff", BODY_CAP_DEFAULT], ["/task", BODY_CAP_DEFAULT], ["/task/update", BODY_CAP_DEFAULT],
+]);
+function bodyCap(P) { return P === "/session/prompt" ? BODY_CAP_PROMPT : BODY_CAP_DEFAULT; }
+function ownerBodyCap(req, P) {
+  const cap = OWNER_BODY_CAPS.get(P) || bodyCap(P);
+  if (cap <= bodyCap(P) || !Object.values(HDR).every(h => req.headers[h])) return bodyCap(P);
+  // Header identity is only a read-budget hint. Larger bodies require strict owner auth before parsing.
+  const identity = findIdentity(req.headers[HDR.pubkey]) || findIdentity(req.headers["x-trantor-durable"]);
+  return identity?.scopes?.some(s => s.role === "owner") ? cap : bodyCap(P);
+}
+function rawBody(req, maxBytes = BODY_CAP_DEFAULT) {
+  if (req._bodyTooLarge) return Promise.resolve(undefined);
   if (req._rawBody !== undefined) return Promise.resolve(req._rawBody);
-  return new Promise(r => { let d = ""; req.on("data", c => (d += c)); req.on("end", () => { req._rawBody = d; r(d); }); });
+  return new Promise(r => {
+    let d = "", bytes = 0, done = false;
+    const decoder = new StringDecoder("utf8");
+    const finish = (v) => { if (!done) { done = true; r(v); } };
+    req.on("data", c => {
+      if (done) return;
+      bytes += c.length;
+      if (bytes > maxBytes) {
+        req._bodyTooLarge = true;
+        finish(undefined);
+        req.resume();   // keep draining (and discarding) so the socket can close cleanly
+        return;
+      }
+      d += decoder.write(c);
+    });
+    req.on("end", () => { if (!req._bodyTooLarge) { req._bodyBytes = bytes; req._rawBody = d + decoder.end(); finish(req._rawBody); } });
+    req.on("error", () => finish(undefined));
+  });
 }
-async function body(req) {
+async function body(req, maxBytes = BODY_CAP_DEFAULT) {
+  if (req._bodyTooLarge) return undefined;
   if (req._jsonBody !== undefined) return req._jsonBody;
-  const d = await rawBody(req);
+  const d = await rawBody(req, maxBytes);
+  if (d === undefined) return undefined;
   try { req._jsonBody = d ? JSON.parse(d) : {}; } catch { req._jsonBody = {}; }
   return req._jsonBody;
 }
@@ -53,7 +94,7 @@ function cmpSemver(a, b) {
 }
 const AUTH_HEADERS = ["x-trantor-pubkey", "x-trantor-sig", "x-trantor-ts", "x-trantor-nonce"];
 const PUBLIC_ENDPOINTS = new Set(["/", "/ui", "/health", "/enroll"]);
-const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy", "/session/prompts", "/session/prompt/claim", "/session/prompt/ack"]);
+const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy", "/session/prompts", "/session/prompt/claim", "/session/prompt/ack", "/session/attachment"]);
 const DEVICE_ENDPOINTS = new Set(["/device/register", "/device/unregister", "/devices"]);
 const READ_ENDPOINTS = new Set(["/peers", "/tasks", "/events", "/inbox", "/peer", "/card", "/stream", "/history", "/projects", "/catchup", "/phases", "/recent", "/handoffs", "/verify-gates", "/claims", "/proposals", "/grants", "/overseer/context", "/overseer/status", "/session/chat", "/session/prompt", "/crew/roster"]);
 const roleRank = { read: 1, write: 2, approver: 3, owner: 4 };
@@ -99,7 +140,7 @@ function isDutyIdentity(auth) {
 const canRead = (auth, project) => AUTH_MODE !== "enforce" && !auth?.identity
   ? true
   : isDutyIdentity(auth) || scopeAllows(auth?.identity, project, "read");
-function projectFromRequest(P, q, b) {
+function projectFromRequest(P, q, b, method) {
   if (P === "/task/update" || P === "/card") {
     const t = state.tasks.find(x => x.id === Number(b?.id ?? q?.id));
     return t?.project || "";
@@ -117,8 +158,11 @@ function projectFromRequest(P, q, b) {
     return p?.project || "";
   }
   // claim/ack and the single-prompt GET carry only an id — authorization runs against the
-  // PROMPT's project, or a project-scoped key could claim any project's queued prompt (#12129).
-  if (P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack") {
+  // PROMPT's project (#12129); the attachment download is keyed the same way. POST
+  // /session/prompt is the exception: it CREATES a row in b.project, so an id in the body must
+  // not borrow an existing row's project to write elsewhere (#12161 review).
+  if (P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack" || P === "/session/attachment") {
+    if (P === "/session/prompt" && method === "POST") return canon(String(b?.project || q?.project || "").slice(0, 80));
     const pr = (state.sessionPrompts || []).find(x => x.id === Number(b?.id ?? q?.id));
     if (pr) return pr.project || "";
     if (P !== "/session/prompt") return "";
@@ -198,11 +242,11 @@ function supersessionActive(rec) {
   }
   return insts.some(i => i !== rec && i.name === rec.name && !i.superseded && (i.lastSeen || 0) > cut);
 }
-async function authenticate(req, path) {
-  if (AUTH_MODE === "off") return { ok: true, mode: AUTH_MODE, trusted: true };
+async function authenticate(req, path, strict = false) {
+  if (AUTH_MODE === "off" && !strict) return { ok: true, mode: AUTH_MODE, trusted: true };
   const signed = hasAuthHeaders(req);
   if (!signed) {
-    if (AUTH_MODE === "warn") {
+    if (AUTH_MODE === "warn" && !strict) {
       process.stderr.write(`[trantor] auth warn: unsigned ${req.method} ${path}\n`);
       return { ok: true, mode: AUTH_MODE, trusted: false, warning: "unsigned" };
     }
@@ -210,7 +254,7 @@ async function authenticate(req, path) {
   }
   const raw = req.method === "GET" || req.method === "HEAD" ? undefined : await rawBody(req);
   // Auth warn mode annotates signature, replay and enrollment failures; enforce mode rejects them.
-  const soft = (warning) => AUTH_MODE === "warn"
+  const soft = (warning) => AUTH_MODE === "warn" && !strict
     ? { ok: true, mode: AUTH_MODE, trusted: false, warning }
     : { ok: false, code: 401, error: warning };
   const verified = verifyRequest({ headers: req.headers, method: req.method, path, body: raw });
@@ -351,7 +395,7 @@ function canUseInboxSession(auth, session) {
   }
 
   return {
-    PUBLIC_ENDPOINTS, authPath, authenticate, authorize, body, rawBody, json,
+    PUBLIC_ENDPOINTS, authPath, authenticate, authorize, body, bodyCap, ownerBodyCap, rawBody, json,
     canon, cleanScope, defaultScopesFor, findIdentity, scopeAllows, canRead, isDutyIdentity,
     projectFromRequest, crossProjectGuard, filterReadable, filterDiscoverable,
     inboxReadable, canUseInboxSession, overseerPolicy, subFp, PROPOSAL_CAP,

package/hub/public.mjs

@@ -1,4 +1,5 @@
 import { isIP } from "node:net";
+import { HDR } from "../lib/identity.mjs";
 
 const ALLOWED = new Set([
   ...["/health", "/projects", "/catchup", "/tasks", "/card", "/events", "/stream",
@@ -31,7 +32,7 @@ export function publicClientIP(req) {
   return normalizedIP(forwarded) || socket;
 }
 
-export function createPublicGate({ now = Date.now, log = line => process.stderr.write(`${line}\n`) } = {}) {
+export function createPublicGate({ now = Date.now, log = line => process.stderr.write(`${line}\n`), canUpload = () => false } = {}) {
   const clients = new Map();
   const admissions = new WeakMap();
   const refusals = new Map();
@@ -92,6 +93,18 @@ export function createPublicGate({ now = Date.now, log = line => process.stderr.
         count("auth");
       } else if (res.statusCode === 403) count(path === "/enroll" ? "enrollment" : "authorization");
     });
+    // Only health is unsigned; reject absent signature fields before the handler reads a body.
+    if (path !== "/health" && Object.values(HDR).some(header => !req.headers[header])) {
+      res.writeHead(401, { "content-type": "application/json", "connection": "close" });
+      res.end(JSON.stringify({ error: "signature required" }));
+      return false;
+    }
+    // The photo endpoint has a larger body budget; unknown or read-only keys get no read budget.
+    if (req.method === "POST" && path === "/session/prompt" && !canUpload(req.headers[HDR.pubkey])) {
+      res.writeHead(401, { "content-type": "application/json", "connection": "close" });
+      res.end(JSON.stringify({ error: "enrolled phone write scope required" }));
+      return false;
+    }
     return true;
   }
 

package/hub/routes/session.mjs

@@ -2,6 +2,8 @@
 // is MEMORY-ONLY (a restart answers have:0, the desktop resends its window); the prompt queue
 // lives in state so a restart never strands a queued prompt. Live frames ride pushEventToStreams
 // (scope-filtered, never logged); only chat.prompt.queued/.delivered/.failed are audit-appended.
+import { mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { setInterval } from "node:timers";
 
 const CHAT_CAP = 400;            // turns kept per project, highest idx wins
@@ -10,11 +12,22 @@ const PROMPT_CAP = 200;
 const PROMPT_TEXT_MAX = 8000;
 const EVENT_TEXT_MAX = 500;
 const PROMPT_TTL_MS = Number(process.env.RELAY_PROMPT_TTL_MS || 120000);
+// Claims cover the desktop's 240s crew timeout plus ack slack; heartbeats cover lock waits.
+const CLAIM_TTL_MS = 300000;
 const PROMPT_SWEEP_MS = Number(process.env.RELAY_PROMPT_SWEEP_MS || 30000);
 const EXPIRED_REASON = "No Mac is relaying this project. Is the Trantor app open?";
+const CLAIMED_EXPIRED_REASON = "The Mac claimed this prompt but never delivered it. Try sending it again.";
 const ACK_OUTCOMES = new Set(["delivered", "blocked", "not_ready", "stalled", "no_agent", "stale"]);
 const ANSWER_PICKS_MAX = 10;
 const ANSWER_OTHER_MAX = 2000;
+// #12161: photo attachments ride POST /session/prompt as base64 JPEGs. The phone downscales to
+// the byte cap; the hub stores the bytes on disk next to its state (never in bus.json) and hands
+// metadata to the claiming desktop, which downloads them through GET /session/attachment.
+const ATTACHMENTS_MAX = 4;
+const PROJECT_ATTACHMENT_BYTES_MAX = 64 * 1024 * 1024;
+const ATTACHMENT_BYTES_MAX = 2 * 1024 * 1024;
+const ATTACHMENT_B64_MAX = Math.ceil(ATTACHMENT_BYTES_MAX / 3) * 4;
+const JPEG_MAGIC = Buffer.from([0xff, 0xd8, 0xff]);
 // #12140: crew commands from the phone. The hub validates and queues; the desktop relay runs the
 // trantor CLI and acks done|failed with the output tail. A seat spec is "agent[:project]".
 const CREW_SPEC = /^[a-z][a-z0-9-]{0,30}(:[A-Za-z0-9._/-]{1,80})?$/;
@@ -24,7 +37,7 @@ const CREW_CLAUDE_REFUSAL = "The claude seat draws your own Claude quota; start
 // oxlint-disable-next-line no-control-regex -- stripping ANSI escape sequences IS matching control characters
 const stripAnsi = (s) => String(s).replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "");
 
-export function createSessionRuntime({ state, markDirty, appendEvent, pushEventToStreams, notifier }) {
+export function createSessionRuntime({ state, markDirty, appendEvent, pushEventToStreams, notifier, attachmentsDir }) {
   const now = () => Date.now();
   const mirrors = new Map();     // project -> { session, total, turns: Map(idx->turn), have, meta, updatedAt, host }
   state.sessionPrompts ||= [];
@@ -32,21 +45,93 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
 
   const findPrompt = (id) => state.sessionPrompts.find(p => p.id === Number(id));
 
-  // A prompt still queued past the TTL means no desktop relay claimed it. Expiry is lazy (on
-  // read) plus a sweep that is a no-op when nothing is queued, so an idle hub does no work.
+  // ---- attachments (#12161): bytes live on disk as <id>-<n>.jpg; the row keeps metadata ----
+  function attachmentPath(file) { return join(attachmentsDir, file); }
+  function unlinkAttachments(p) {
+    if (!attachmentsDir) return;
+    for (const a of p.attachments || []) { try { unlinkSync(attachmentPath(a.file)); } catch {} }
+  }
+  // Startup/sweep GC: remove files no queued-or-claimed row references (evicted rows, restarts,
+  // lost races). Cheap: a directory listing every sweep.
+  function sweepAttachments() {
+    if (!attachmentsDir) return;
+    let live;
+    try { live = new Set(state.sessionPrompts.filter(p => p.status === "queued" || p.status === "claimed")
+      .flatMap(p => (p.attachments || []).map(a => a.file))); } catch { return; }
+    let entries;
+    try { entries = readdirSync(attachmentsDir); } catch { return; }
+    for (const name of entries) {
+      if (!live.has(name)) { try { unlinkSync(attachmentPath(name)); } catch {} }
+    }
+  }
+  try { mkdirSync(attachmentsDir, { recursive: true }); } catch {}
+  sweepAttachments();
+  // Validate and decode the wire shape: [{name, data(base64 JPEG)}]. Returns rows for the prompt
+  // (files not yet written) or { error }.
+  function parseAttachments(raw) {
+    if (raw == null) return { attachments: [] };
+    if (!Array.isArray(raw) || raw.length > ATTACHMENTS_MAX) return { error: `at most ${ATTACHMENTS_MAX} attachments` };
+    const attachments = [];
+    for (const a of raw) {
+      const name = String(a?.name || "photo.jpg").slice(0, 120);
+      // Coerce, then judge the value: any non-base64 or non-JPEG bytes dies at the magic check,
+      // so the wire shape never needs a runtime type probe.
+      const data = String(a?.data ?? "");
+      if (!data.length || data.length > ATTACHMENT_B64_MAX || !/^[A-Za-z0-9+/=\s]+$/.test(data)) {
+        return { error: "attachment must be base64 JPEG of 2 MB or less" };
+      }
+      const bytes = Buffer.from(data, "base64");
+      if (!bytes.length || bytes.length > ATTACHMENT_BYTES_MAX || !bytes.subarray(0, 3).equals(JPEG_MAGIC)) {
+        return { error: "attachment must be a JPEG of 2 MB or less" };
+      }
+      attachments.push({ name, size: bytes.length, bytes });
+    }
+    return { attachments };
+  }
+  function storeAttachments(id, attachments) {
+    if (!attachmentsDir) {
+      if (attachments.length) throw new Error("attachment storage is not configured");
+      return [];
+    }
+    mkdirSync(attachmentsDir, { recursive: true });
+    return attachments.map((a, n) => {
+      const file = `${id}-${n}.jpg`;
+      writeFileSync(attachmentPath(file), a.bytes);
+      return { name: a.name, size: a.size, file };
+    });
+  }
+
+  // Queued work expires quickly; claimed work keeps its bytes while the relay renews its lease.
   function expireQueued() {
     let changed = false;
     for (const p of state.sessionPrompts) {
-      if (p.status !== "queued" || now() - p.ts <= PROMPT_TTL_MS) continue;
-      p.status = "expired"; p.outcome = "expired"; p.error = EXPIRED_REASON;
-      appendEvent("chat.prompt.failed", p.project, p.by, { promptId: p.id, outcome: "expired", error: EXPIRED_REASON });
+      const claimed = p.status === "claimed";
+      const from = p.status === "queued" ? p.ts : claimed ? (p.renewedAt || p.claimedAt) : 0;
+      if (!from || now() - from <= (claimed ? CLAIM_TTL_MS : PROMPT_TTL_MS)) continue;
+      p.status = "expired"; p.outcome = "expired";
+      p.error = claimed ? CLAIMED_EXPIRED_REASON : EXPIRED_REASON;
+      unlinkAttachments(p);
+      appendEvent("chat.prompt.failed", p.project, p.by, { promptId: p.id, outcome: "expired", error: p.error });
       changed = true;
     }
     if (changed) markDirty();
     return changed;
   }
+  // Only terminal rows can be discarded; live work keeps its queue slot and attachment bytes.
+  function trimPrompts() {
+    while (state.sessionPrompts.length > PROMPT_CAP) {
+      const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
+      if (ti < 0) break;
+      const [evicted] = state.sessionPrompts.splice(ti, 1);
+      unlinkAttachments(evicted);
+    }
+  }
+  function queueFull() {
+    return state.sessionPrompts.filter(p => p.status === "queued" || p.status === "claimed").length >= PROMPT_CAP;
+  }
   const sweep = setInterval(() => {
-    if (state.sessionPrompts.some(p => p.status === "queued")) expireQueued();
+    sweepAttachments();
+    if (state.sessionPrompts.some(p => p.status === "queued" || p.status === "claimed")) expireQueued();
   }, PROMPT_SWEEP_MS);
   sweep.unref?.();
 
@@ -140,10 +225,11 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
     const isChat = P === "/session/chat";
     const isPrompts = P === "/session/prompts";
     const isPrompt = P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack";
+    const isAttachment = P === "/session/attachment";
     const isAnswer = P === "/session/answer";
     const isCrewCommand = P === "/crew/command";
     const isCrewRoster = P === "/crew/roster";
-    if (!isChat && !isPrompts && !isPrompt && !isAnswer && !isCrewCommand && !isCrewRoster) return false;
+    if (!isChat && !isPrompts && !isPrompt && !isAttachment && !isAnswer && !isCrewCommand && !isCrewRoster) return false;
     const { body, json, canon, scopeAllows } = ctx;
 
     // #12137: the phone's answer to an AskUserQuestion joins the SAME queue as a plain prompt,
@@ -161,15 +247,13 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const other = String(b.other || "").slice(0, ANSWER_OTHER_MAX);
       if (!picks.length && !other.trim()) return json(res, 400, { error: "picks or other required" });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
       state.sessionPromptSeq += 1;
       const text = other.trim() ? other : `picks ${picks.join(", ")}`;
       const p = { id: state.sessionPromptSeq, project, kind: "answer", session, toolId, picks, other,
         text, by: String(auth?.identity?.name || "").slice(0, 120), ts: now(), status: "queued" };
       state.sessionPrompts.push(p);
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
-      }
+      trimPrompts();
       markDirty();
       appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, kind: "answer", toolId, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
@@ -201,6 +285,7 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       if (action === "up" && !seats.length) return json(res, 400, { error: "up needs at least one seat" });
       if (action === "swap" && (!from || !to)) return json(res, 400, { error: "swap needs from and to" });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
       state.sessionPromptSeq += 1;
       // down with an empty seat list means the whole project.
       const text = action === "swap" ? `swap ${from} ${to}` : seats.length ? `${action} ${seats.join(" ")}` : `${action} ${project}`;
@@ -209,10 +294,7 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       if (from) p.from = from;
       if (to) p.to = to;
       state.sessionPrompts.push(p);
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
-      }
+      trimPrompts();
       markDirty();
       appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, kind: "crew", action, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
@@ -268,26 +350,41 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const text = String(b.text || "");
       if (!project || !text.trim()) return json(res, 400, { error: "project and non-empty text required" });
       if (text.length > PROMPT_TEXT_MAX) return json(res, 400, { error: `text must be <= ${PROMPT_TEXT_MAX} chars` });
+      const parsed = parseAttachments(b.attachments);
+      if (parsed.error) return json(res, 400, { error: parsed.error });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
+      const liveBytes = state.sessionPrompts
+        .filter(p => p.project === project && (p.status === "queued" || p.status === "claimed"))
+        .reduce((total, p) => total + (p.attachments || []).reduce((sum, a) => sum + a.size, 0), 0);
+      const incomingBytes = parsed.attachments.reduce((sum, a) => sum + a.bytes.length, 0);
+      if (liveBytes + incomingBytes > PROJECT_ATTACHMENT_BYTES_MAX) {
+        return json(res, 413, { error: "project queued and claimed attachments exceed 64 MiB" });
+      }
       state.sessionPromptSeq += 1;
       const p = { id: state.sessionPromptSeq, project, text, by: String(auth?.identity?.name || "").slice(0, 120), ts: now(), status: "queued" };
-      state.sessionPrompts.push(p);
-      // Cap: evict oldest terminal rows first so live work is never the first casualty.
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
+      try {
+        p.attachments = storeAttachments(p.id, parsed.attachments);
+      } catch (error) {
+        return json(res, 500, { error: String(error?.message || error) });
       }
+      state.sessionPrompts.push(p);
+      trimPrompts();
       markDirty();
-      appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX) });
+      if (p.attachments.length) appendEvent("chat.prompt.queued", project, p.by,
+        { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX), attachments: p.attachments.length });
+      else appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
       return json(res, 200, { id: p.id, status: "queued" });
     }
 
     // The public view of a queue row: plain prompts are kind "prompt"; answers carry their
     // session, toolId, picks and other; crew commands carry action, seats, from and to —
-    // so the claiming desktop has everything it needs.
+    // so the claiming desktop has everything it needs. Attachments ride as metadata only;
+    // the bytes go to the claimer through GET /session/attachment.
     const promptView = (p) => {
       const view = { id: p.id, project: p.project, text: p.text, by: p.by, ts: p.ts, status: p.status, kind: p.kind || "prompt" };
+      if (p.attachments?.length) view.attachments = p.attachments.map(({ name, size }) => ({ name, size }));
       if (p.kind === "answer") {
         view.session = p.session; view.toolId = p.toolId; view.picks = p.picks;
         if (p.other && p.other.trim()) view.other = p.other;   // absent, never "", when nothing was typed
@@ -315,6 +412,15 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       expireQueued();
       const p = findPrompt(b.id);
       if (!p) return json(res, 404, { error: "prompt not found" });
+      // Renewal never grants a second delivery; only the original host can extend a live claim.
+      if (b.renew === true) {
+        if (p.status !== "claimed" || p.host !== String(b.host || "").slice(0, 120)) {
+          return json(res, 409, { error: "no matching live claim", status: p.status });
+        }
+        p.renewedAt = now();
+        markDirty();
+        return json(res, 200, { ok: true });
+      }
       // The first claim wins; a second claim — even from the same host — gets 409.
       if (p.status !== "queued") return json(res, 409, { error: `prompt already ${p.status}`, status: p.status });
       p.status = "claimed"; p.host = String(b.host || "").slice(0, 120); p.claimedAt = now();
@@ -327,6 +433,9 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const b = await body(req);
       const p = findPrompt(b.id);
       if (!p) return json(res, 404, { error: "prompt not found" });
+      if (p.status !== "claimed" || p.host !== b.host) {
+        return json(res, 409, { error: "no matching live claim", status: p.status });
+      }
       const outcome = String(b.outcome || "");
       // #12140: a crew command acks done|failed with the CLI output tail, and the status IS the
       // outcome — never "delivered". Other kinds keep the delivered/blocked/… vocabulary.
@@ -335,9 +444,6 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       } else if (!ACK_OUTCOMES.has(outcome)) {
         return json(res, 400, { error: `outcome must be one of: ${[...ACK_OUTCOMES].join(", ")}` });
       }
-      if (p.status === "delivered" || p.status === "done" || p.status === "failed" || p.status === "expired") {
-        return json(res, 409, { error: `prompt already ${p.status}`, status: p.status });
-      }
       const error = String(b.error || "").slice(0, EVENT_TEXT_MAX);
       p.outcome = outcome; p.error = error; p.ackedAt = now();
       if (p.kind === "crew") {
@@ -346,6 +452,8 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       } else {
         p.status = outcome === "delivered" ? "delivered" : "failed";
       }
+      // A terminal row will never be claimed or downloaded again: its bytes go now.
+      unlinkAttachments(p);
       markDirty();
       const extra = { promptId: p.id, outcome };
       if (error) extra.error = error;
@@ -361,6 +469,21 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       return json(res, 200, { id: p.id, status: p.status, outcome: p.outcome || "", output: p.output || "", error: p.error || "" });
     }
 
+    // The claiming desktop fetches one attachment's bytes. Owner-gated in auth.mjs, absent from
+    // the public listener's allowlist — phones upload, they never read back.
+    if (req.method === "GET" && P === "/session/attachment") {
+      const p = findPrompt(q.id);
+      const n = Number(q.n);
+      const meta = p && Number.isInteger(n) ? (p.attachments || [])[n] : null;
+      let bytes = null;
+      if (meta && attachmentsDir) { try { bytes = readFileSync(attachmentPath(meta.file)); } catch {} }
+      if (!bytes) return json(res, 404, { error: "attachment not found" });
+      if (res.headersSent || res.writableEnded || res.destroyed) return true;
+      res.writeHead(200, { "content-type": "image/jpeg", "content-length": bytes.length });
+      res.end(bytes);
+      return true;
+    }
+
     return false;
   }
 

package/hub.mjs

@@ -134,6 +134,7 @@ const context = {
 const sessionChat = createSessionRuntime({
   state: store.state, markDirty: store.markDirty,
   appendEvent: events.appendEvent, pushEventToStreams: events.pushEventToStreams, notifier,
+  attachmentsDir: join(DATA_DIR, "attachments"),
 });
 const routes = [routeDevices, routeAdmin, routeCards, routeInsights, routeMessages, sessionChat.route];
 
@@ -150,14 +151,27 @@ function requestHandler(runtime, ctx, gate = null) {
       const q = Object.fromEntries(u.searchParams);
       const P = u.pathname;
       if (gate && !gate.admit(req, res, P)) return;
+      const cap = gate ? runtime.bodyCap(P) : runtime.ownerBodyCap(req, P);
+      let ownerAuth;
+      if (req.method === "POST") {
+        const raw = await runtime.rawBody(req, cap);
+        if (raw === undefined) return runtime.json(res, 413, { error: `request body over the ${cap} byte cap` });
+        if (req._bodyBytes > runtime.bodyCap(P)) {
+          ownerAuth = await runtime.authenticate(req, runtime.authPath(u), true);
+          if (!ownerAuth.ok) return runtime.json(res, ownerAuth.code || 401, { error: ownerAuth.error });
+        }
+      }
       const b0 = req.method === "POST" ? await runtime.body(req) : {};
+      if (ownerAuth && !runtime.scopeAllows(ownerAuth.identity, runtime.projectFromRequest(P, q, b0, req.method), "owner")) {
+        return runtime.json(res, 403, { error: "large request body requires a project owner" });
+      }
       if (runtime.handleEnrollment({ req, res, P, u, b0, inviteOnly: !!gate })) return;
-      const auth = runtime.PUBLIC_ENDPOINTS.has(P)
+      const auth = ownerAuth || (runtime.PUBLIC_ENDPOINTS.has(P)
         ? { ok: true, mode: ctx.AUTH_MODE, trusted: false }
-        : await runtime.authenticate(req, runtime.authPath(u));
+        : await runtime.authenticate(req, runtime.authPath(u)));
       if (runtime.handleInvite({ req, res, P, auth, b0 })) return;
       if (!auth.ok) return runtime.json(res, auth.code || 401, { error: auth.error || "unauthorized" });
-      const authorization = runtime.authorize(auth, req.method, P, runtime.projectFromRequest(P, q, b0));
+      const authorization = runtime.authorize(auth, req.method, P, runtime.projectFromRequest(P, q, b0, req.method));
       if (!authorization.ok) return runtime.json(res, authorization.code || 403, { error: authorization.error || "forbidden" });
       if (gate && P === "/stream" && !gate.openStream(req, res)) return;
       if (req.method === "GET" && P === "/_op") {
@@ -181,6 +195,8 @@ server.listen(PORT, HOST, () => console.error(`[trantor] hub on http://${HOST}:$
 
 if (process.env.RELAY_PUBLIC_PORT) {
   const publicPort = Number(process.env.RELAY_PUBLIC_PORT);
-  const publicServer = http.createServer(requestHandler(publicAuth, publicContext, createPublicGate()));
+  const publicGate = createPublicGate({ canUpload: pubkey =>
+    publicAuth.scopeAllows(publicAuth.findIdentity(pubkey), "", "write") });
+  const publicServer = http.createServer(requestHandler(publicAuth, publicContext, publicGate));
   publicServer.listen(publicPort, "127.0.0.1", () => console.error(`[trantor] public hub on http://127.0.0.1:${publicServer.address().port} (auth: enforce)`));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.116",
+  "version": "0.18.117",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"