feat(files): one uploads/ directory, for files and chat alike

Correction to the previous commit. Uploads went wherever the member happened to
be looking, which spreads chat attachments through the tree and makes the
destination a client-supplied path — surface that had to be defended. Everything
a member sends now lands in `uploads/` at the root of the shared directory:
visible, one place, easy for the operator to look into or empty.

Chat attachments go there too, so the separate out-of-tree thumbs directory is
not needed and is not built. They were already ordinary uploads; now they are
ordinary uploads that land somewhere sensible.

The destination is chosen by the node, so a client naming somewhere else changes
nothing — the traversal surface simply is not there on this path. safe_subdir()
remains for dir_create, where the path genuinely does come from the client, and
keeps its tests.

One shared directory means name collisions are ordinary rather than adversarial:
every camera produces IMG_1234.jpg. The node finds a free name — "IMG_1234 (2).jpg"
— and reports it in the ack, because a chat message has to point at the file that
was actually written and not at someone else's. Nothing is ever replaced, which
is the property the per-user quarantine existed for (C5a) and the one the tests
assert; they fail if the free-name search is removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 3 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index d2b24a3..0306a5c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -488,14 +488,13 @@ class MeshBayTransport {
     this._send({ type: 'stream_req', v: '0.1', file_id: fileId });
   }
 
-  async uploadChunk(filename, chunkIndex, totalChunks, data, dir) {
+  async uploadChunk(filename, chunkIndex, totalChunks, data) {
+    // The node decides where this lands (uploads/) and under what name — it
+    // finds a free one rather than replacing anything. The ack says which.
     const msg = await this._sendAndWait({
       type: 'file_upload',
       v: '0.1',
       filename,
-      // Where the member is looking. The node confines it under the shared root
-      // and refuses to overwrite, so this is a destination, not a licence.
-      dir: dir || '',
       chunk_index: chunkIndex,
       total_chunks: totalChunks,
       data: data,