relay: file attachments, outbox, CC-self, chat view, mobile layout

Compose: attach files (encrypted, hex-named, linked via relay_uid),
CC-self checkbox tags copy with recipient name. Outbox section shows
sent messages with delete. Chat view: session-based threads/history/
send endpoints, split layout with sidebar, read receipts, 5s poll.
Mobile: threads as horizontal scroll bar above messages. Fix chat
input pushed offscreen by adding min-height:0 on flex container.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/routes/messages.php

@@ -27,6 +27,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
     $storedTitle = clientEncrypt($title, $interKey);
     $storedBody = clientEncrypt($body, $interKey);
+    $relayUid = $input['relay_uid'] ?? bin2hex(random_bytes(16));
 
     $db->prepare('INSERT INTO messages (recipient_id, sender_id, sender_username, title, body, color, tags, relay_uid) VALUES (:r, :s, :sn, :t, :b, :c, :tg, :uid)')
         ->execute([
@@ -37,9 +38,43 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
             'b' => $storedBody,
             'c' => $input['color'] ?? '#38bdf8',
             'tg' => $input['tags'] ?? '',
-            'uid' => $input['relay_uid'] ?? null,
+            'uid' => $relayUid,
         ]);
-    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId(), 'recipient' => $recipientName]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId(), 'recipient' => $recipientName, 'relay_uid' => $relayUid]);
+}
+
+// ── UI attachment upload: session stores files encrypted at rest ──
+
+if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant) {
+    if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
+        jsonResponse(['error' => 'no file'], 400);
+    }
+    $relayUid = $_POST['relay_uid'] ?? '';
+    $recipientName = trim($_POST['recipient'] ?? $sessionTenant['username']);
+    if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
+
+    $recipient = getTenantByUsername($db, $recipientName);
+    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+
+    // Generate hex filename so hyprcrd's poll handler accepts it
+    $origName = basename($_FILES['file']['name']);
+    $ext = pathinfo($origName, PATHINFO_EXTENSION) ?: 'bin';
+    $hexName = bin2hex(random_bytes(16)) . '.' . strtolower($ext);
+
+    $plainBytes = file_get_contents($_FILES['file']['tmp_name']);
+    // Store as base64(raw) encrypted — matches client API format.
+    // The GET endpoint re-encrypts for recipient; hyprcrd decrypts
+    // and base64_decodes to get the original file bytes.
+    $storedData = clientEncrypt(base64_encode($plainBytes), $interKey);
+
+    $db->prepare('DELETE FROM attachments WHERE recipient_id = :r AND relay_uid = :uid AND filename = :fn')
+        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $hexName]);
+    $db->prepare('INSERT INTO attachments (recipient_id, relay_uid, filename, data) VALUES (:r, :uid, :fn, :data)')
+        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $hexName, 'data' => $storedData]);
+    jsonResponse(['ok' => true, 'filename' => $hexName, 'original' => $origName]);
 }
 
 // ── UI inbox view: session reads decrypted messages ──
@@ -71,6 +106,28 @@ if ($route === '/api/messages/inbox' && $method === 'GET' && $sessionTenant) {
     jsonResponse(['messages' => $out]);
 }
 
+// ── UI sent view: messages this user sent to others ──
+
+if ($route === '/api/messages/sent' && $method === 'GET' && $sessionTenant) {
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stmt = $db->prepare('SELECT m.id, m.title, m.body, m.created_at, m.fetched, t.username AS recipient FROM messages m JOIN tenants t ON t.id = m.recipient_id WHERE m.sender_id = :s AND m.recipient_id != :s2 ORDER BY m.created_at DESC LIMIT 200');
+    $stmt->execute(['s' => $sessionTenant['id'], 's2' => $sessionTenant['id']]);
+    $rows = $stmt->fetchAll();
+    $out = [];
+    foreach ($rows as $row) {
+        $out[] = [
+            'id'         => (int)$row['id'],
+            'recipient'  => $row['recipient'] ?? '?',
+            'title'      => clientDecrypt($row['title'] ?? '', $interKey),
+            'body'       => clientDecrypt($row['body'] ?? '', $interKey),
+            'created_at' => $row['created_at'],
+            'fetched'    => (int)$row['fetched'],
+        ];
+    }
+    jsonResponse(['messages' => $out]);
+}
+
 // ── Client API auth (X-Relay-User + X-Relay-Key) ──
 
 $clientTenant = authClient($db);
@@ -155,8 +212,8 @@ if (preg_match('#^/api/messages/(\d+)$#', $route, $m) && $method === 'DELETE') {
     $tenant = $clientTenant ?: $sessionTenant;
     if (!$tenant) jsonResponse(['error' => 'unauthorized'], 401);
     $id = (int)$m[1];
-    $db->prepare('DELETE FROM messages WHERE id = :id AND recipient_id = :r')
-        ->execute(['id' => $id, 'r' => $tenant['id']]);
+    $db->prepare('DELETE FROM messages WHERE id = :id AND (recipient_id = :r OR sender_id = :s)')
+        ->execute(['id' => $id, 'r' => $tenant['id'], 's' => $tenant['id']]);
     jsonResponse(['ok' => true]);
 }