pneumo

M3: Encrypted file send and download in the browser (ENG-261) #27

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-261-m3-encrypted-file-send-and-download-in-the-browser

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-261-m3-encrypted-file-send-and-download-in-the-browser

Linear: https://linear.app/engineereddev/issue/ENG-261

What's in this PR (20 files, all under apps/web/; three omp commits):

Attach: multiple-file picker, drop anywhere on Home with an overlay, paste of files and images; one push per file; the composer text goes with the first file. Attach, drop and paste are unavailable until files can actually be sent (filesReady).
Size check against limits.maxFileBytes using ciphertextSize, before any reservation; a rejected selection keeps the draft and names the limit.
Upload: generateFileKey → POST /api/files → createFileEncryptor into a Blob → XHR PUT with progress (direct: presigned URL + returned headers; proxy: /api/files/:id/content with the bearer) → POST /api/pushes with the file payload. Cancel aborts before the push is created.
File rows and download: icon by MIME, name, size, Download with byte progress through createFileDecryptor; any tag failure shows "This file was corrupted or tampered with" and saves nothing.
Harness: startWebRuntime(prefix, { uploadMode, maxFileBytes }) for per-test direct/proxy servers; readiness now waits for the server's "Server listening" event plus one health request within the existing 30 s deadline (no retries or timeout increases).
Tests: vitest (size limit, progress reducer, cancel, readiness gating, same-commit handler race); Playwright in both modes (SHA-256 round trips at 0 B / 1 B / 65,536 B / 5 MiB, over-limit rejected with no POST /api/files, paste, cancel mid-upload, tamper, blocked-until-ready); axe and screenshots.

Verify (lead, rebased on 7a01948 with ENG-262 merged; conflicts in README.md and e2e/runtime.ts resolved keeping both sides):

mise run check:web → exit 0 (126 tests, build OK)
mise run e2e:web → exit 0, twice in a row (42 passed, 42 passed)
Implementer: three consecutive e2e:web runs green before the rebase.

Screenshots (not committed): file-{unavailable,uploading,item,tamper}-{light,dark,mobile}.png.

Deviations: none. Check-fix rounds: (1) the ENG-258 DevicesView fixture after the rebase; (2) the flaky readiness race found by the lead (Attach enabled before files could be sent; harness readiness under load).

🤖 Generated with Claude Code

Commits 4

M3: Omit blank file metadata and cover Dismiss (ENG-261)

+43 -7

M3: Synchronize file readiness and runtime startup (ENG-261)

+330 -99

M3: Complete DevicesView file action fixture (ENG-261)

M3: Add encrypted browser file transfers (ENG-261)

+2240 -29

Comments

v0 1w ago

demi.dev 1w ago

pneumo-reviewer: round 1, REQUEST_CHANGES #

The transfer pipeline is sound: frozen helpers encrypt before upload, both upload modes work, cancel aborts the XHR before any push, download authenticates the whole stream before saving, and round 3 fixed the root causes of both flakes (structured "Server listening" readiness; filesReady gating in the same commit as the handlers). The lead's conflict resolutions are correct. check:web (126 tests) and e2e:web (42 passed) are green.

FIX (score ≥ 5)

often=6 bad=3 score=18 — files/useFiles.ts:71-72,101-102 + files/transfer.ts:47-58: every file payload carries title: "" and usually body: "", so the service worker on main (payload.title ?? "New file") shows blank file notifications; it also breaks "composer text only on the first file". Fix: match buildPushPayload (omit empty title/body; body only on the first file) and add a unit test.

Missing definition-of-done item

The new Dismiss action on cancelled or failed upload rows has no test. Add a Dismiss click and assert the row is gone.

FILE (score < 5, code left alone, recorded on ENG-275)

score=4 — while POST /api/pushes is in flight, the upload row and the optimistic history row both show the same file.
score=3 — one onProgress is shared by download and decrypt, so the label flips between "Downloading" and "Decrypting".
score=4 — a paste with any clipboardData.files is sent as a file; Office text copies expose an image, so pasting from Excel/Word can send an image push.
score=2 — onFiles changes identity every render, so window drag/paste listeners re-register on each progress tick and the drop overlay can vanish mid-drag.

Spec §11, §6.6, §8, §13 OK; §5.2 OK apart from finding 1. Next: omp round for the FIX and the Dismiss test.

v1 1w ago

demi.dev 1w ago

pneumo-reviewer: round 2 (head 780be13), APPROVE #

The round resolves both round-1 blockers; only the 5 listed files under apps/web/ changed.

FIX resolved: buildFilePayload adds title/body only when non-blank (matching buildPushPayload), and files after the first get neither field, in both validation and upload. The ENG-262 SW now shows "New file" with the file name (or the caption) for web-sent files. The new test "omits blank optional metadata at the exact envelope limit" fails on the old code.
DoD resolved: the direct and proxy cancel scenarios click Dismiss and assert the row is gone (files.spec.ts:429-430).
The four FILE findings stay on ENG-275. No new findings.

Verify (reviewer and lead): mise run check:web exit 0 (128 tests); mise run e2e:web exit 0 (42 passed).

Versions

pneumo-reviewer: round 1, REQUEST_CHANGES #

pneumo-reviewer: round 2 (head 780be13), APPROVE #