feat(files): one uploads/ directory, for files and chat alike

Correction to the previous commit. Uploads went wherever the member happened to
be looking, which spreads chat attachments through the tree and makes the
destination a client-supplied path — surface that had to be defended. Everything
a member sends now lands in `uploads/` at the root of the shared directory:
visible, one place, easy for the operator to look into or empty.

Chat attachments go there too, so the separate out-of-tree thumbs directory is
not needed and is not built. They were already ordinary uploads; now they are
ordinary uploads that land somewhere sensible.

The destination is chosen by the node, so a client naming somewhere else changes
nothing — the traversal surface simply is not there on this path. safe_subdir()
remains for dir_create, where the path genuinely does come from the client, and
keeps its tests.

One shared directory means name collisions are ordinary rather than adversarial:
every camera produces IMG_1234.jpg. The node finds a free name — "IMG_1234 (2).jpg"
— and reports it in the ack, because a chat message has to point at the file that
was actually written and not at someone else's. Nothing is ever replaced, which
is the property the per-user quarantine existed for (C5a) and the one the tests
assert; they fail if the free-name search is removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2 files changed, 11 insertions, 8 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index def6c5b..d8b83ed 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -1032,7 +1032,7 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) {
       for (let i = 0; i < totalChunks; i++) {
         const slice = file.slice(i * UPLOAD_CHUNK_SIZE, (i + 1) * UPLOAD_CHUNK_SIZE);
         const buf = new Uint8Array(await slice.arrayBuffer());
-        await transport.uploadChunk(file.name, i, totalChunks, buf, currentPath);
+        await transport.uploadChunk(file.name, i, totalChunks, buf);
         // Bytes actually acknowledged by the node, not bytes read locally.
         setUlState(prev => prev && { ...prev, sent: Math.min(file.size,
           (i + 1) * UPLOAD_CHUNK_SIZE) });
@@ -1050,7 +1050,7 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) {
       setUploading(false);
       setUlState(null);
     }
-  }, [currentPath]);
+  }, []);
 
   const makeDirectory = useCallback(async () => {
     const transport = transportRef.current;
@@ -1760,10 +1760,14 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on
     setAttaching(true);
     try {
       const totalChunks = Math.ceil(file.size / UPLOAD_CHUNK_SIZE);
+      let storedAs = file.name;
       for (let i = 0; i < totalChunks; i++) {
         const slice = file.slice(i * UPLOAD_CHUNK_SIZE, (i + 1) * UPLOAD_CHUNK_SIZE);
         const buf = new Uint8Array(await slice.arrayBuffer());
-        await transport.uploadChunk(file.name, i, totalChunks, buf);
+        const ack = await transport.uploadChunk(file.name, i, totalChunks, buf);
+        // Two people sending IMG_1234.jpg both succeed; the node picks a free
+        // name and the message has to point at the one it chose.
+        if (ack && ack.stored_as) storedAs = ack.stored_as;
       }
       await new Promise(r => setTimeout(r, 2500));
       if (onRefreshIndex) await onRefreshIndex();
@@ -1771,7 +1775,7 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on
       const ftype = ['jpg','jpeg','png','gif','webp','svg'].includes(ext) ? 'image'
         : ['mp4','webm','mkv','mov','avi'].includes(ext) ? 'video' : 'file';
       const structured = JSON.stringify({
-        text: '', attachment: { filename: file.name, size: file.size, type: ftype },
+        text: '', attachment: { filename: storedAs, size: file.size, type: ftype },
       });
       await transport.sendChat(structured, 0, null, username);
       setMessages(prev => [...prev, {
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index d2b24a3..0306a5c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -488,14 +488,13 @@ class MeshBayTransport {
     this._send({ type: 'stream_req', v: '0.1', file_id: fileId });
   }
 
-  async uploadChunk(filename, chunkIndex, totalChunks, data, dir) {
+  async uploadChunk(filename, chunkIndex, totalChunks, data) {
+    // The node decides where this lands (uploads/) and under what name — it
+    // finds a free one rather than replacing anything. The ack says which.
     const msg = await this._sendAndWait({
       type: 'file_upload',
       v: '0.1',
       filename,
-      // Where the member is looking. The node confines it under the shared root
-      // and refuses to overwrite, so this is a destination, not a licence.
-      dir: dir || '',
       chunk_index: chunkIndex,
       total_chunks: totalChunks,
       data: data,