image push fix

public/index.php

@@ -953,7 +953,15 @@ if (str_starts_with($route, '/api/')) {
                         if (!preg_match('/^[a-f0-9]+\.\w+$/', $fn)) continue;
                         $dest = $uploadDir . '/' . $fn;
                         if (file_exists($dest)) continue;
-                        $raw = base64_decode($att['data']);
+                        // New format: HYPRCRD-RELAY-V1 envelope (decrypt-reencrypted by relay)
+                        // Old format: raw base64(iv || cipher)
+                        $payload = $att['data'] ?? '';
+                        if (str_starts_with($payload, 'HYPRCRD-RELAY-V1')) {
+                            $b64 = trim(substr($payload, strlen('HYPRCRD-RELAY-V1') + 1));
+                            $raw = base64_decode($b64);
+                        } else {
+                            $raw = base64_decode($payload);
+                        }
                         if (strlen($raw) >= 17) {
                             $decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
                             if ($decrypted !== false) file_put_contents($dest, $decrypted);
@@ -1060,7 +1068,9 @@ if (str_starts_with($route, '/api/')) {
                 $db->prepare("INSERT OR IGNORE INTO relay_pushed (relay_msg_id) VALUES (?)")->execute([$resData['id']]);
             }
 
-            // Upload attachments (images referenced in body)
+            // Upload attachments (images referenced in body).
+            // Same envelope format as title/body so the relay can decrypt with
+            // the sender's secret and re-encrypt with the recipient's secret.
             $cardBody = $card['body'] ?? '';
             preg_match_all('#uploads/([a-f0-9]+\.\w+)#', $cardBody, $attMatches);
             $uploadDir = __DIR__ . '/uploads';
@@ -1068,13 +1078,14 @@ if (str_starts_with($route, '/api/')) {
                 $filePath = $uploadDir . '/' . $filename;
                 if (!file_exists($filePath)) continue;
                 $raw = file_get_contents($filePath);
-                $iv = random_bytes(16);
-                $cipher = openssl_encrypt($raw, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-                $attPayload = json_encode([
+                $envelope = $encryptField($raw);
+                $attData = [
                     'relay_uid' => $relayUid,
                     'filename'  => $filename,
-                    'data'      => base64_encode($iv . $cipher),
-                ]);
+                    'data'      => $envelope,
+                ];
+                if ($recipient) $attData['recipient'] = $recipient;
+                $attPayload = json_encode($attData);
                 $ach = curl_init(rtrim($relayUrl, '/') . '/api/attachments');
                 curl_setopt_array($ach, [
                     CURLOPT_RETURNTRANSFER => true,