diff --git a/client/src/api/client.ts b/client/src/api/client.ts
index 496813a033..07ce7d621d 100644
--- a/client/src/api/client.ts
+++ b/client/src/api/client.ts
@@ -1382,13 +1382,19 @@ export const collabApi = {
   deleteNote: (tripId: number | string, id: number) => apiClient.delete(`/trips/${tripId}/collab/notes/${id}`).then(r => r.data),
   uploadNoteFile: (tripId: number | string, noteId: number, formData: FormData) => postMultipart(`/trips/${tripId}/collab/notes/${noteId}/files`, formData),
   deleteNoteFile: (tripId: number | string, noteId: number, fileId: number) => apiClient.delete(`/trips/${tripId}/collab/notes/${noteId}/files/${fileId}`).then(r => r.data),
+  getLinks: (tripId: number | string) => apiClient.get(`/trips/${tripId}/collab/links`).then(r => r.data),
+  createLink: (tripId: number | string, data: { title: string; url: string; pinned?: boolean }) => apiClient.post(`/trips/${tripId}/collab/links`, data).then(r => r.data),
+  updateLink: (tripId: number | string, id: number, data: { title?: string; url?: string; pinned?: boolean }) => apiClient.put(`/trips/${tripId}/collab/links/${id}`, data).then(r => r.data),
+  deleteLink: (tripId: number | string, id: number) => apiClient.delete(`/trips/${tripId}/collab/links/${id}`).then(r => r.data),
   getPolls: (tripId: number | string) => apiClient.get(`/trips/${tripId}/collab/polls`).then(r => r.data),
   createPoll: (tripId: number | string, data: CollabPollCreateRequest) => apiClient.post(`/trips/${tripId}/collab/polls`, data).then(r => r.data),
   votePoll: (tripId: number | string, id: number, optionIndex: number) => apiClient.post(`/trips/${tripId}/collab/polls/${id}/vote`, { option_index: optionIndex } satisfies CollabPollVoteRequest).then(r => r.data),
   closePoll: (tripId: number | string, id: number) => apiClient.put(`/trips/${tripId}/collab/polls/${id}/close`).then(r => r.data),
   deletePoll: (tripId: number | string, id: number) => apiClient.delete(`/trips/${tripId}/collab/polls/${id}`).then(r => r.data),
   getMessages: (tripId: number | string, before?: string) => apiClient.get(`/trips/${tripId}/collab/messages${before ? `?before=${before}` : ''}`).then(r => r.data),
-  sendMessage: (tripId: number | string, data: CollabMessageCreateRequest) => apiClient.post(`/trips/${tripId}/collab/messages`, data).then(r => r.data),
+  sendMessage: (tripId: number | string, data: CollabMessageCreateRequest | FormData, opts?: UploadOptions) => data instanceof FormData
+    ? postMultipart(`/trips/${tripId}/collab/messages`, data, opts)
+    : apiClient.post(`/trips/${tripId}/collab/messages`, data).then(r => r.data),
   deleteMessage: (tripId: number | string, id: number) => apiClient.delete(`/trips/${tripId}/collab/messages/${id}`).then(r => r.data),
   reactMessage: (tripId: number | string, id: number, emoji: string) => apiClient.post(`/trips/${tripId}/collab/messages/${id}/react`, { emoji } satisfies CollabReactionRequest).then(r => r.data),
   linkPreview: (tripId: number | string, url: string) => apiClient.get(`/trips/${tripId}/collab/link-preview?url=${encodeURIComponent(url)}`).then(r => r.data),
diff --git a/client/src/api/wsEventPolicy.ts b/client/src/api/wsEventPolicy.ts
index 5b974a0a02..9a9b3762b5 100644
--- a/client/src/api/wsEventPolicy.ts
+++ b/client/src/api/wsEventPolicy.ts
@@ -20,6 +20,9 @@ export const HANDLED_OUTSIDE_TRIP_STORE = [
   'collab:note:created',
   'collab:note:updated',
   'collab:note:deleted',
+  'collab:link:created',
+  'collab:link:updated',
+  'collab:link:deleted',
   'collab:poll:created',
   'collab:poll:voted',
   'collab:poll:closed',
diff --git a/client/src/components/Admin/AddonManager.tsx b/client/src/components/Admin/AddonManager.tsx
index 7a4ed51309..05010f7dd8 100644
--- a/client/src/components/Admin/AddonManager.tsx
+++ b/client/src/components/Admin/AddonManager.tsx
@@ -74,11 +74,12 @@ const TYPE_META: Record<string, { icon: ComponentType<{ size?: number }>; labelK
   integration: { icon: Link2, labelKey: 'admin.addons.type.integration', hintKey: 'admin.addons.integrationHint' },
 }
 
-interface CollabFeatures { chat: boolean; notes: boolean; polls: boolean; whatsnext: boolean }
+interface CollabFeatures { chat: boolean; notes: boolean; links?: boolean; polls: boolean; whatsnext: boolean }
 
 const COLLAB_SUB_FEATURES = [
   { key: 'chat', icon: MessageCircle, titleKey: 'admin.collab.chat.title', subtitleKey: 'admin.collab.chat.subtitle' },
   { key: 'notes', icon: StickyNote, titleKey: 'admin.collab.notes.title', subtitleKey: 'admin.collab.notes.subtitle' },
+  { key: 'links', icon: Link2, titleKey: 'collab.tabs.links', subtitleKey: 'collab.links.empty' },
   { key: 'polls', icon: BarChart3, titleKey: 'admin.collab.polls.title', subtitleKey: 'admin.collab.polls.subtitle' },
   { key: 'whatsnext', icon: Sparkles, titleKey: 'admin.collab.whatsnext.title', subtitleKey: 'admin.collab.whatsnext.subtitle' },
 ] as const
diff --git a/client/src/components/Collab/CollabChat.tsx b/client/src/components/Collab/CollabChat.tsx
index 597b8b86f0..f3cc805266 100644
--- a/client/src/components/Collab/CollabChat.tsx
+++ b/client/src/components/Collab/CollabChat.tsx
@@ -1,5 +1,5 @@
 import { createPortal } from 'react-dom'
-import { ArrowUp, Reply, Smile, X } from 'lucide-react'
+import { ArrowUp, ImagePlus, Reply, Smile, X } from 'lucide-react'
 import type { User } from '../../types'
 import { useCollabChat } from './useCollabChat'
 import { ChatMessages } from './CollabChatMessages'
@@ -14,7 +14,7 @@ interface CollabChatProps {
 
 export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
   const S = useCollabChat(tripId, currentUser)
-  const { t, is12h, can, trip, canEdit, messages, setMessages, loading, setLoading, hasMore, setHasMore, loadingMore, setLoadingMore, text, setText, replyTo, setReplyTo, hoveredId, setHoveredId, sending, setSending, showEmoji, setShowEmoji, reactMenu, setReactMenu, deletingIds, setDeletingIds, deleteTimersRef, containerRef, messagesRef, scrollRef, textareaRef, emojiBtnRef, isAtBottom, scrollToBottom, checkAtBottom, handleLoadMore, handleTextChange, handleSend, handleKeyDown, handleDelete, handleReact, handleEmojiSelect, isOwn, isEmojiOnly } = S
+  const { t, canEdit, loading, text, replyTo, setReplyTo, sending, showEmoji, setShowEmoji, reactMenu, setReactMenu, containerRef, textareaRef, emojiBtnRef, imageInputRef, imageFiles, imagePreviews, uploadProgress, addImageFiles, removeImage, handlePaste, handleDrop, handleTextChange, handleSend, handleKeyDown, handleReact, handleEmojiSelect } = S
   if (loading) {
     return (
       <div style={{ display: 'flex', flex: 1, alignItems: 'center', justifyContent: 'center' }}>
@@ -27,7 +27,7 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
     <div ref={containerRef} style={{ display: 'flex', flexDirection: 'column', flex: 1, overflow: 'hidden', position: 'relative', minHeight: 0, height: '100%' }}>
       <ChatMessages {...S} />
       {/* Composer */}
-      <div style={{ flexShrink: 0, paddingTop: 8, paddingLeft: 12, paddingRight: 12, borderTop: '1px solid var(--border-faint)' }} className="pb-3 bg-surface-card">
+      <div onDragOver={e => e.preventDefault()} onDrop={handleDrop} style={{ flexShrink: 0, paddingTop: 8, paddingLeft: 12, paddingRight: 12, borderTop: '1px solid var(--border-faint)' }} className="pb-3 bg-surface-card">
         {/* Reply preview */}
         {replyTo && (
           <div style={{
@@ -48,6 +48,8 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
           </div>
         )}
 
+        {imagePreviews.length > 0 && <div style={{ display: 'flex', gap: 8, marginBottom: 8, overflowX: 'auto' }}>{imagePreviews.map((url, i) => <div key={url} style={{ position: 'relative' }}><img src={url} alt="" style={{ width: 56, height: 56, objectFit: 'cover', borderRadius: 8 }} /><button type="button" onClick={() => removeImage(i)} aria-label="Remove image" style={{ position: 'absolute', top: -6, right: -6, border: 0, borderRadius: '50%', background: 'var(--text-primary)', color: 'var(--bg-primary)', width: 18, height: 18, cursor: 'pointer' }}>×</button></div>)}</div>}
+        {uploadProgress > 0 && uploadProgress < 100 && <div style={{ fontSize: 11, color: 'var(--text-muted)', marginBottom: 4 }}>Uploading {uploadProgress}%</div>}
         <div style={{ display: 'flex', alignItems: 'flex-end', gap: 6 }}>
           {/* Emoji button */}
           {canEdit && (
@@ -61,6 +63,8 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
             </button>
           )}
 
+          {canEdit && <><input ref={imageInputRef} type="file" accept="image/jpeg,image/png,image/gif,image/webp" multiple hidden onChange={e => { if (e.target.files) addImageFiles(e.target.files); e.currentTarget.value = '' }} /><button type="button" onClick={() => imageInputRef.current?.click()} aria-label="Attach images" style={{ width: 34, height: 34, borderRadius: '50%', border: 'none', background: 'transparent', color: 'var(--text-muted)', display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer', padding: 0 }}><ImagePlus size={19} /></button></>}
+
           <textarea
             ref={textareaRef}
             rows={1}
@@ -76,15 +80,16 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
             value={text}
             onChange={handleTextChange}
             onKeyDown={handleKeyDown}
+            onPaste={handlePaste}
           />
 
           {/* Send */}
           {canEdit && (
-            <button type="button" onClick={handleSend} disabled={!text.trim() || sending} style={{
+            <button type="button" onClick={handleSend} disabled={(!text.trim() && !imageFiles.length) || sending} style={{
               width: 34, height: 34, borderRadius: '50%', border: 'none',
-              background: text.trim() ? '#007AFF' : 'var(--border-primary)',
+              background: text.trim() || imageFiles.length ? '#007AFF' : 'var(--border-primary)',
               color: '#fff', display: 'flex', alignItems: 'center', justifyContent: 'center',
-              cursor: text.trim() ? 'pointer' : 'default', flexShrink: 0,
+              cursor: text.trim() || imageFiles.length ? 'pointer' : 'default', flexShrink: 0,
               transition: 'background 0.15s',
             }}>
               <ArrowUp size={18} strokeWidth={2.5} />
diff --git a/client/src/components/Collab/CollabChatAttachment.tsx b/client/src/components/Collab/CollabChatAttachment.tsx
new file mode 100644
index 0000000000..c19c744f5e
--- /dev/null
+++ b/client/src/components/Collab/CollabChatAttachment.tsx
@@ -0,0 +1,10 @@
+import { useState } from 'react'
+import { X } from 'lucide-react'
+
+export function CollabChatAttachment({ attachment }: { attachment: { url: string; original_name?: string; mime_type?: string } }) {
+  const [open, setOpen] = useState(false)
+  return <>
+    <img src={attachment.url} alt={attachment.original_name || 'Attached image'} onClick={() => setOpen(true)} style={{ display: 'block', width: 180, maxWidth: '100%', maxHeight: 220, objectFit: 'cover', borderRadius: 10, cursor: 'zoom-in', marginTop: 4 }} />
+    {open && <div role="dialog" onClick={() => setOpen(false)} style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(0,0,0,.82)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24 }}><button aria-label="Close image" onClick={() => setOpen(false)} style={{ position: 'fixed', top: 18, right: 18, background: 'rgba(255,255,255,.15)', color: '#fff', border: 0, borderRadius: '50%', width: 36, height: 36 }}><X size={20} /></button><img src={attachment.url} alt={attachment.original_name || 'Attached image'} onClick={e => e.stopPropagation()} style={{ maxWidth: '95vw', maxHeight: '90vh', objectFit: 'contain' }} /></div>}
+  </>
+}
diff --git a/client/src/components/Collab/CollabChatMessages.tsx b/client/src/components/Collab/CollabChatMessages.tsx
index 6f94bdfcd9..a39e676a8d 100644
--- a/client/src/components/Collab/CollabChatMessages.tsx
+++ b/client/src/components/Collab/CollabChatMessages.tsx
@@ -3,6 +3,7 @@ import { Trash2, Reply, ChevronUp } from 'lucide-react'
 import { URL_REGEX } from './CollabChat.constants'
 import { formatTime, formatDateSeparator, shouldShowDateSeparator } from './CollabChat.helpers'
 import { MessageText } from './CollabChatMessageText'
+import { CollabChatAttachment } from './CollabChatAttachment'
 import { LinkPreview } from './CollabChatLinkPreview'
 import { ReactionBadge } from './CollabChatReactionBadge'
 import EmptyState from '../shared/EmptyState'
@@ -166,6 +167,7 @@ export function ChatMessages(props: any) {
                           {hasReply ? (
                             <div style={{ padding: '0 10px 4px' }}><MessageText text={msg.text} /></div>
                           ) : <MessageText text={msg.text} />}
+                          {msg.attachments?.map((attachment: any) => <CollabChatAttachment key={attachment.id} attachment={attachment} />)}
                           {(msg.text.match(URL_REGEX) || []).slice(0, 1).map(url => (
                             <LinkPreview key={url} url={url} tripId={tripId} own={own} onLoad={() => { if (isAtBottom.current) setTimeout(() => scrollToBottom('smooth'), 50) }} />
                           ))}
diff --git a/client/src/components/Collab/CollabLinks.tsx b/client/src/components/Collab/CollabLinks.tsx
new file mode 100644
index 0000000000..e5570cdba6
--- /dev/null
+++ b/client/src/components/Collab/CollabLinks.tsx
@@ -0,0 +1,123 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { ExternalLink, Link2, Pin, Plus, Trash2, X } from 'lucide-react'
+import { collabApi } from '../../api/client'
+import { addListener, removeListener } from '../../api/websocket'
+import { useTranslation } from '../../i18n'
+import { useCanDo } from '../../store/permissionsStore'
+import { useTripStore } from '../../store/tripStore'
+import { useToast } from '../shared/Toast'
+
+interface CollabLink {
+  id: number
+  title: string
+  url: string
+  pinned: boolean | number
+}
+
+function LinkIcon({ url, title }: { url: string; title: string }) {
+  const [failed, setFailed] = useState(false)
+  let favicon = ''
+  try { favicon = new URL('/favicon.ico', url).href } catch { favicon = '' }
+  if (!favicon || failed) return <span aria-hidden="true" style={{ display: 'grid', placeItems: 'center', width: 28, height: 28, flex: '0 0 28px', borderRadius: 7, background: 'var(--bg-secondary)', color: 'var(--text-faint)' }}><Link2 size={15} /></span>
+  return <img src={favicon} alt="" aria-hidden="true" title={title} onError={() => setFailed(true)} style={{ width: 28, height: 28, flex: '0 0 28px', borderRadius: 7, objectFit: 'contain', background: 'var(--bg-secondary)' }} />
+}
+
+export default function CollabLinks({ tripId }: { tripId: number }) {
+  const { t } = useTranslation()
+  const trip = useTripStore(s => s.trip)
+  const canEdit = useCanDo()('collab_edit', trip)
+  const toast = useToast()
+  const [links, setLinks] = useState<CollabLink[]>([])
+  const [title, setTitle] = useState('')
+  const [url, setUrl] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [expanded, setExpanded] = useState(false)
+
+  useEffect(() => {
+    let cancelled = false
+    collabApi.getLinks(tripId)
+      .then(d => { if (!cancelled) setLinks(d.links || []) })
+      .catch(err => {
+        if (cancelled) return
+        console.error('Failed to load collab links:', err)
+        toast.error(t('common.error'))
+      })
+    return () => { cancelled = true }
+  }, [tripId, toast, t])
+
+  // Live sync, the same shape the notes panel uses. Without it the three
+  // collab:link events the server broadcasts would arrive nowhere and a link
+  // somebody else added would only appear on the next reload.
+  useEffect(() => {
+    if (!tripId) return
+    const handler = (msg: { type?: string; tripId?: number | string; link?: CollabLink; linkId?: number }) => {
+      // The panel is not remounted on a trip change, so an event still in
+      // flight from the trip we just left must not land in this list.
+      if (String(msg?.tripId) !== String(tripId)) return
+      if (msg.type === 'collab:link:created' && msg.link) {
+        setLinks(prev => prev.some(l => l.id === msg.link!.id) ? prev : [msg.link!, ...prev])
+      }
+      if (msg.type === 'collab:link:updated' && msg.link) {
+        setLinks(prev => prev
+          .map(l => l.id === msg.link!.id ? { ...l, ...msg.link! } : l)
+          .sort((a, b) => Number(b.pinned) - Number(a.pinned)))
+      }
+      if (msg.type === 'collab:link:deleted' && msg.linkId) {
+        setLinks(prev => prev.filter(l => l.id !== msg.linkId))
+      }
+    }
+    addListener(handler)
+    return () => removeListener(handler)
+  }, [tripId])
+
+  // Every write says something when it fails. Silence left the pin looking
+  // unchanged and the delete looking ignored, with an unhandled rejection in
+  // the console as the only trace.
+  const add = async (event?: FormEvent) => {
+    event?.preventDefault()
+    if (!title.trim() || !url.trim() || busy) return
+    setBusy(true)
+    try {
+      const d = await collabApi.createLink(tripId, { title: title.trim(), url: url.trim() })
+      setLinks(v => [d.link, ...v])
+      setTitle(''); setUrl(''); setExpanded(false)
+    } catch (err) {
+      console.error('Failed to add collab link:', err)
+      toast.error(t('common.error'))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const toggle = async (link: CollabLink) => {
+    try {
+      const d = await collabApi.updateLink(tripId, link.id, { pinned: !link.pinned })
+      setLinks(v => v.map(x => x.id === link.id ? d.link : x).sort((a, b) => Number(b.pinned) - Number(a.pinned)))
+    } catch (err) {
+      console.error('Failed to pin collab link:', err)
+      toast.error(t('common.error'))
+    }
+  }
+
+  const remove = async (id: number) => {
+    try {
+      await collabApi.deleteLink(tripId, id)
+      setLinks(v => v.filter(x => x.id !== id))
+    } catch (err) {
+      console.error('Failed to delete collab link:', err)
+      toast.error(t('common.error'))
+    }
+  }
+  return <div style={{ display: 'flex', flexDirection: 'column', height: '100%', minHeight: 0 }}>
+    <div style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '12px 14px', borderBottom: '1px solid var(--border-faint)' }}><Link2 size={18} aria-hidden="true" /><strong>{t('collab.tabs.links')}</strong><span style={{ marginLeft: 'auto', color: 'var(--text-faint)', fontSize: 12 }}>{links.length}</span></div>
+    {canEdit && <div style={{ padding: 10, borderBottom: '1px solid var(--border-faint)' }}>
+      <button type="button" onClick={() => setExpanded(v => !v)} aria-expanded={expanded} aria-controls={`collab-link-form-${tripId}`} style={{ display: 'inline-flex', alignItems: 'center', gap: 6, border: 0, borderRadius: 8, padding: '7px 10px', background: 'var(--bg-secondary)', color: 'var(--text-primary)', cursor: 'pointer', fontWeight: 600 }}>{expanded ? <X size={16} aria-hidden="true" /> : <Plus size={16} aria-hidden="true" />}{expanded ? t('collab.links.cancel') : t('collab.links.add')}</button>
+      {expanded && <form id={`collab-link-form-${tripId}`} onSubmit={add} style={{ display: 'flex', flexDirection: 'column', gap: 6, marginTop: 8 }}>
+        <label htmlFor={`collab-link-title-${tripId}`} style={{ position: 'absolute', width: 1, height: 1, padding: 0, margin: -1, overflow: 'hidden', clip: 'rect(0,0,0,0)', whiteSpace: 'nowrap', border: 0 }}>{t('collab.links.titlePlaceholder')}</label>
+        <input id={`collab-link-title-${tripId}`} value={title} onChange={e => setTitle(e.target.value)} placeholder={t('collab.links.titlePlaceholder')} autoFocus style={{ padding: 8, borderRadius: 8, border: '1px solid var(--border-primary)', background: 'var(--bg-input)', color: 'var(--text-primary)' }} />
+        <div style={{ display: 'flex', gap: 6 }}><label htmlFor={`collab-link-url-${tripId}`} style={{ position: 'absolute', width: 1, height: 1, padding: 0, margin: -1, overflow: 'hidden', clip: 'rect(0,0,0,0)', whiteSpace: 'nowrap', border: 0 }}>{t('collab.links.urlPlaceholder')}</label><input id={`collab-link-url-${tripId}`} type="url" required value={url} onChange={e => setUrl(e.target.value)} placeholder={t('collab.links.urlPlaceholder')} style={{ flex: 1, minWidth: 0, padding: 8, borderRadius: 8, border: '1px solid var(--border-primary)', background: 'var(--bg-input)', color: 'var(--text-primary)' }} /><button type="submit" disabled={busy || !title.trim() || !url.trim()} aria-label={t('collab.links.save')} style={{ width: 36, border: 0, borderRadius: 8, background: 'var(--accent)', color: 'var(--accent-text)', cursor: 'pointer' }}><Plus size={18} aria-hidden="true" /></button></div>
+      </form>}
+    </div>}
+    <div style={{ flex: 1, overflowY: 'auto', padding: 10 }}>{links.length === 0 ? <div style={{ padding: 24, textAlign: 'center', color: 'var(--text-faint)' }}>{t('collab.links.empty')}</div> : links.map(link => <div key={link.id} style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '8px 6px', borderBottom: '1px solid var(--border-faint)' }}><LinkIcon url={link.url} title={link.title} /><a href={link.url} target="_blank" rel="noreferrer" style={{ flex: 1, minWidth: 0, color: 'var(--text-primary)', textDecoration: 'none' }}><div style={{ fontWeight: 600, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{link.title}</div><div style={{ fontSize: 11, color: 'var(--text-faint)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{link.url}</div></a><ExternalLink size={15} color="var(--text-faint)" aria-hidden="true" />{canEdit && <><button type="button" onClick={() => toggle(link)} aria-label={link.pinned ? t('collab.links.unpin') : t('collab.links.pin')} style={{ border: 0, background: 'transparent', color: link.pinned ? 'var(--accent)' : 'var(--text-faint)', cursor: 'pointer' }}><Pin size={15} fill={link.pinned ? 'currentColor' : 'none'} aria-hidden="true" /></button><button type="button" onClick={() => remove(link.id)} aria-label={t('collab.links.delete')} style={{ border: 0, background: 'transparent', color: 'var(--text-faint)', cursor: 'pointer' }}><Trash2 size={15} aria-hidden="true" /></button></>}</div>)}</div>
+  </div>
+}
diff --git a/client/src/components/Collab/CollabPanel.test.tsx b/client/src/components/Collab/CollabPanel.test.tsx
index ef11e68f50..721256f881 100644
--- a/client/src/components/Collab/CollabPanel.test.tsx
+++ b/client/src/components/Collab/CollabPanel.test.tsx
@@ -6,6 +6,7 @@ import { useAuthStore } from '../../store/authStore'
 
 vi.mock('./CollabChat', () => ({ default: () => <div data-testid="collab-chat">Chat</div> }))
 vi.mock('./CollabNotes', () => ({ default: () => <div data-testid="collab-notes">Notes</div> }))
+vi.mock('./CollabLinks', () => ({ default: () => <div data-testid="collab-links">Links</div> }))
 vi.mock('./CollabPolls', () => ({ default: () => <div data-testid="collab-polls">Polls</div> }))
 vi.mock('./WhatsNextWidget', () => ({ default: () => <div data-testid="whats-next">WhatsNext</div> }))
 vi.mock('../../api/websocket', () => ({
@@ -39,11 +40,12 @@ describe('CollabPanel', () => {
   })
 
   // FE-COMP-COLLABPANEL-001
-  it('desktop layout renders all four panels', () => {
+  it('desktop layout renders all five panels', () => {
     setViewport(1280)
     render(<CollabPanel tripId={1} />)
     expect(screen.getByTestId('collab-chat')).toBeInTheDocument()
     expect(screen.getByTestId('collab-notes')).toBeInTheDocument()
+    expect(screen.getByTestId('collab-links')).toBeInTheDocument()
     expect(screen.getByTestId('collab-polls')).toBeInTheDocument()
     expect(screen.getByTestId('whats-next')).toBeInTheDocument()
   })
@@ -55,6 +57,7 @@ describe('CollabPanel', () => {
     // Tab buttons exist
     expect(screen.getByRole('button', { name: /chat/i })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /notes/i })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /^links$/i })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /polls/i })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /what.?s next/i })).toBeInTheDocument()
     // Only chat visible by default
@@ -73,6 +76,13 @@ describe('CollabPanel', () => {
     expect(screen.queryByTestId('collab-chat')).not.toBeInTheDocument()
   })
 
+  it('mobile: Links tab shows the translated label, not the i18n key', () => {
+    setViewport(375)
+    render(<CollabPanel tripId={1} />)
+    expect(screen.getByRole('button', { name: 'Links' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'collab.tabs.links' })).not.toBeInTheDocument()
+  })
+
   // FE-COMP-COLLABPANEL-004
   it('mobile: clicking Polls tab switches to CollabPolls', () => {
     setViewport(375)
@@ -147,7 +157,7 @@ describe('CollabPanel', () => {
 // FE-W5CPN-001 to FE-W5CPN-013
 // The desktop branch picks a different layout for every combination of enabled
 // collab features, so each combination gets its own case.
-const allOff = { chat: false, notes: false, polls: false, whatsnext: false }
+const allOff = { chat: false, notes: false, links: false, polls: false, whatsnext: false }
 
 describe('CollabPanel feature combinations', () => {
   beforeEach(() => {
@@ -172,6 +182,7 @@ describe('CollabPanel feature combinations', () => {
     render(<CollabPanel tripId={1} collabFeatures={{ ...allOff, chat: true }} />)
     expect(screen.getByTestId('collab-chat')).toBeInTheDocument()
     expect(screen.queryByTestId('collab-notes')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('collab-links')).not.toBeInTheDocument()
     expect(screen.queryByTestId('collab-polls')).not.toBeInTheDocument()
     expect(screen.queryByTestId('whats-next')).not.toBeInTheDocument()
   })
@@ -253,6 +264,42 @@ describe('CollabPanel feature combinations', () => {
     expect(screen.queryByTestId('collab-notes')).not.toBeInTheDocument()
   })
 
+  // The three-or-more branch used to render notes and links as a pair and drop
+  // whichever of the two was on its own, so these walk every shape of it.
+  it('FE-W5CPN-014: three right panels including notes but not links keeps notes', () => {
+    setViewport(1280)
+    render(<CollabPanel tripId={1} collabFeatures={{ chat: true, notes: true, links: false, polls: true, whatsnext: true }} />)
+    expect(screen.getByTestId('collab-notes')).toBeInTheDocument()
+    expect(screen.getByTestId('collab-polls')).toBeInTheDocument()
+    expect(screen.getByTestId('whats-next')).toBeInTheDocument()
+    expect(screen.queryByTestId('collab-links')).not.toBeInTheDocument()
+  })
+
+  it('FE-W5CPN-015: three right panels including links but not notes keeps links', () => {
+    setViewport(1280)
+    render(<CollabPanel tripId={1} collabFeatures={{ chat: true, notes: false, links: true, polls: true, whatsnext: true }} />)
+    expect(screen.getByTestId('collab-links')).toBeInTheDocument()
+    expect(screen.getByTestId('collab-polls')).toBeInTheDocument()
+    expect(screen.getByTestId('whats-next')).toBeInTheDocument()
+    expect(screen.queryByTestId('collab-notes')).not.toBeInTheDocument()
+  })
+
+  it('FE-W5CPN-016: all four right panels render, notes and links above the other two', () => {
+    setViewport(1280)
+    render(<CollabPanel tripId={1} collabFeatures={{ chat: true, notes: true, links: true, polls: true, whatsnext: true }} />)
+    for (const id of ['collab-chat', 'collab-notes', 'collab-links', 'collab-polls', 'whats-next']) {
+      expect(screen.getByTestId(id)).toBeInTheDocument()
+    }
+  })
+
+  it('FE-W5CPN-017: notes and links alone with a third panel and no chat all render', () => {
+    setViewport(1280)
+    render(<CollabPanel tripId={1} collabFeatures={{ ...allOff, notes: true, links: true, polls: true }} />)
+    expect(screen.getByTestId('collab-notes')).toBeInTheDocument()
+    expect(screen.getByTestId('collab-links')).toBeInTheDocument()
+    expect(screen.getByTestId('collab-polls')).toBeInTheDocument()
+  })
+
   it('FE-W5CPN-013: mobile falls back to the first tab when the active one gets disabled', () => {
     setViewport(375)
     const { rerender } = render(<CollabPanel tripId={1} />)
diff --git a/client/src/components/Collab/CollabPanel.tsx b/client/src/components/Collab/CollabPanel.tsx
index 98100b01b1..02c94ddd76 100644
--- a/client/src/components/Collab/CollabPanel.tsx
+++ b/client/src/components/Collab/CollabPanel.tsx
@@ -1,11 +1,12 @@
 import { useState, useEffect, useMemo } from 'react'
 import { useAuthStore } from '../../store/authStore'
 import { useTranslation } from '../../i18n'
-import { MessageCircle, StickyNote, BarChart3, Sparkles } from 'lucide-react'
+import { MessageCircle, StickyNote, Link2, BarChart3, Sparkles } from 'lucide-react'
 import CollabChat from './CollabChat'
 import CollabNotes from './CollabNotes'
 import CollabPolls from './CollabPolls'
 import WhatsNextWidget from './WhatsNextWidget'
+import CollabLinks from './CollabLinks'
 
 function useIsDesktop(breakpoint = 1024) {
   const [isDesktop, setIsDesktop] = useState(window.innerWidth >= breakpoint)
@@ -28,6 +29,7 @@ interface TripMember {
 interface CollabFeatures {
   chat: boolean
   notes: boolean
+  links?: boolean
   polls: boolean
   whatsnext: boolean
 }
@@ -39,10 +41,11 @@ interface CollabPanelProps {
 }
 
 const ALL_TABS = [
-  { id: 'chat', featureKey: 'chat' as const, labelKey: 'collab.tabs.chat', icon: MessageCircle },
-  { id: 'notes', featureKey: 'notes' as const, labelKey: 'collab.tabs.notes', icon: StickyNote },
-  { id: 'polls', featureKey: 'polls' as const, labelKey: 'collab.tabs.polls', icon: BarChart3 },
-  { id: 'next', featureKey: 'whatsnext' as const, labelKey: 'collab.whatsNext.title', icon: Sparkles },
+  { id: 'chat', featureKey: 'chat' as const, labelKey: 'collab.tabs.chat', fallback: 'Chat', icon: MessageCircle },
+  { id: 'notes', featureKey: 'notes' as const, labelKey: 'collab.tabs.notes', fallback: 'Notes', icon: StickyNote },
+  { id: 'links', featureKey: 'links' as const, labelKey: 'collab.tabs.links', fallback: 'Links', icon: Link2 },
+  { id: 'polls', featureKey: 'polls' as const, labelKey: 'collab.tabs.polls', fallback: 'Polls', icon: BarChart3 },
+  { id: 'next', featureKey: 'whatsnext' as const, labelKey: 'collab.whatsNext.title', fallback: "What's Next", icon: Sparkles },
 ]
 
 export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }: CollabPanelProps) {
@@ -50,12 +53,14 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
   const { t } = useTranslation()
   const isDesktop = useIsDesktop()
 
-  const features = collabFeatures || { chat: true, notes: true, polls: true, whatsnext: true }
+  // Older server/admin configs predate the Links feature; merge defaults so a
+  // missing `links` key does not silently hide the new panel.
+  const features = { chat: true, notes: true, links: true, polls: true, whatsnext: true, ...(collabFeatures || {}) }
 
   const tabs = useMemo(() =>
     ALL_TABS.filter(tab => features[tab.featureKey]).map(tab => ({
       ...tab,
-      label: t(tab.labelKey),
+      label: t(tab.labelKey) || tab.fallback,
     })),
   [features, t])
 
@@ -70,11 +75,28 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
 
   const chatOn = features.chat
   const rightPanels = [
-    features.notes && 'notes',
+    features.notes && 'notes', features.links && 'links',
     features.polls && 'polls',
     features.whatsnext && 'whatsnext',
   ].filter(Boolean) as string[]
 
+  // One place decides what a panel id renders. It was spelled out at five call
+  // sites, and the layout branch below dropped a panel precisely because one of
+  // those copies did not list it.
+  const renderPanel = (p: string) => (
+    <>
+      {p === 'notes' && <CollabNotes tripId={tripId} currentUser={user} />}
+      {p === 'links' && <CollabLinks tripId={tripId} />}
+      {p === 'polls' && <CollabPolls tripId={tripId} currentUser={user} />}
+      {p === 'whatsnext' && <WhatsNextWidget tripMembers={tripMembers} />}
+    </>
+  )
+  const panelRow = (ids: string[]) => (
+    <div style={{ flex: 1, display: 'flex', gap: 12, minHeight: 0 }}>
+      {ids.map(p => <div key={p} className={cardClass} style={{ flex: 1, minWidth: 0 }}>{renderPanel(p)}</div>)}
+    </div>
+  )
+
   if (tabs.length === 0) return null
 
   if (isDesktop) {
@@ -99,35 +121,19 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
             <CollabChat tripId={tripId} currentUser={user} />
           </div>
           <div style={{ flex: 1, display: 'flex', flexDirection: 'column', gap: 12, overflow: 'hidden', minHeight: 0 }}>
-            {rightPanels.length === 1 && (
-              <div className={cardClass} style={{ flex: 1 }}>
-                {rightPanels[0] === 'notes' && <CollabNotes tripId={tripId} currentUser={user} />}
-                {rightPanels[0] === 'polls' && <CollabPolls tripId={tripId} currentUser={user} />}
-                {rightPanels[0] === 'whatsnext' && <WhatsNextWidget tripMembers={tripMembers} />}
-              </div>
-            )}
-            {rightPanels.length === 2 && rightPanels.map(p => (
-              <div key={p} className={cardClass} style={{ flex: 1 }}>
-                {p === 'notes' && <CollabNotes tripId={tripId} currentUser={user} />}
-                {p === 'polls' && <CollabPolls tripId={tripId} currentUser={user} />}
-                {p === 'whatsnext' && <WhatsNextWidget tripMembers={tripMembers} />}
-              </div>
-            ))}
-            {rightPanels.length === 3 && (
-              <>
-                <div className={cardClass} style={{ flex: 1 }}>
-                  <CollabNotes tripId={tripId} currentUser={user} />
-                </div>
-                <div style={{ flex: 1, display: 'flex', gap: 12, overflow: 'hidden', minHeight: 0 }}>
-                  <div className={cardClass} style={{ flex: 1 }}>
-                    <CollabPolls tripId={tripId} currentUser={user} />
-                  </div>
-                  <div className={cardClass} style={{ flex: 1 }}>
-                    <WhatsNextWidget tripMembers={tripMembers} />
-                  </div>
-                </div>
+            {rightPanels.length <= 2 && panelRow(rightPanels)}
+            {rightPanels.length >= 3 && (() => {
+              // Two rows, split by kind rather than by a pair being present:
+              // the old condition needed notes AND links together, so turning
+              // the new Links feature off dropped Notes out of the layout
+              // entirely. Each row renders only when it has something in it.
+              const written = rightPanels.filter(p => p === 'notes' || p === 'links')
+              const rest = rightPanels.filter(p => p !== 'notes' && p !== 'links')
+              return <>
+                {written.length > 0 && panelRow(written)}
+                {rest.length > 0 && panelRow(rest)}
               </>
-            )}
+            })()}
           </div>
         </div>
       )
@@ -135,26 +141,10 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
 
     // Chat off — remaining panels share full width
     const panels = rightPanels
-    if (panels.length === 1) {
-      return (
-        <div style={{ height: '100%', display: 'flex', gap: 12, padding: 12, overflow: 'hidden', minHeight: 0 }}>
-          <div className={cardClass} style={{ flex: 1 }}>
-            {panels[0] === 'notes' && <CollabNotes tripId={tripId} currentUser={user} />}
-            {panels[0] === 'polls' && <CollabPolls tripId={tripId} currentUser={user} />}
-            {panels[0] === 'whatsnext' && <WhatsNextWidget tripMembers={tripMembers} />}
-          </div>
-        </div>
-      )
-    }
-
     return (
       <div style={{ height: '100%', display: 'flex', gap: 12, padding: 12, overflow: 'hidden', minHeight: 0 }}>
         {panels.map(p => (
-          <div key={p} className={cardClass} style={{ flex: 1 }}>
-            {p === 'notes' && <CollabNotes tripId={tripId} currentUser={user} />}
-            {p === 'polls' && <CollabPolls tripId={tripId} currentUser={user} />}
-            {p === 'whatsnext' && <WhatsNextWidget tripMembers={tripMembers} />}
-          </div>
+          <div key={p} className={cardClass} style={{ flex: 1 }}>{renderPanel(p)}</div>
         ))}
       </div>
     )
@@ -170,7 +160,7 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
         {tabs.map(tab => {
           const active = mobileTab === tab.id
           return (
-            <button type="button" key={tab.id} onClick={() => setMobileTab(tab.id)} style={{
+            <button key={tab.id} onClick={() => setMobileTab(tab.id)} style={{
               flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
               padding: '8px 0', borderRadius: 10, border: 'none', cursor: 'pointer',
               background: active ? 'var(--accent)' : 'transparent',
@@ -187,6 +177,7 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
       <div style={{ flex: 1, overflow: 'hidden', minHeight: 0 }}>
         {mobileTab === 'chat' && features.chat && <CollabChat tripId={tripId} currentUser={user} />}
         {mobileTab === 'notes' && features.notes && <CollabNotes tripId={tripId} currentUser={user} />}
+        {mobileTab === 'links' && features.links && <CollabLinks tripId={tripId} />}
         {mobileTab === 'polls' && features.polls && <CollabPolls tripId={tripId} currentUser={user} />}
         {mobileTab === 'next' && features.whatsnext && <WhatsNextWidget tripMembers={tripMembers} />}
       </div>
diff --git a/client/src/components/Collab/useChatImages.ts b/client/src/components/Collab/useChatImages.ts
new file mode 100644
index 0000000000..2cca6a19cf
--- /dev/null
+++ b/client/src/components/Collab/useChatImages.ts
@@ -0,0 +1,77 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+/**
+ * The images pinned to a chat message before it is sent.
+ *
+ * One hook for both shells. The desktop hook and the phone screen each carried
+ * their own copy of the same picking, previewing and clearing, which is two
+ * places for the same leak and a duplication bill on every line.
+ *
+ * Object URLs are held in a ref and revoked when the file they belong to goes,
+ * when the list is cleared and on unmount. Rebuilding every preview on each
+ * change, which is what both copies did, leaked one URL per image per keystroke
+ * of picking, and did it from inside a setState updater, so React ran it twice
+ * in development and leaked twice as fast.
+ */
+export const CHAT_IMAGE_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']
+export const MAX_CHAT_IMAGES = 4
+export const MAX_CHAT_IMAGE_BYTES = 10 * 1024 * 1024
+
+export interface ChatImages {
+  files: File[]
+  previews: string[]
+  /** Returns false when something was dropped, so the caller can say why. */
+  add: (incoming: FileList | File[]) => boolean
+  remove: (index: number) => void
+  clear: () => void
+}
+
+export function useChatImages(): ChatImages {
+  const [files, setFiles] = useState<File[]>([])
+  const [previews, setPreviews] = useState<string[]>([])
+  const urls = useRef<string[]>([])
+
+  const revokeAll = useCallback(() => {
+    urls.current.forEach(URL.revokeObjectURL)
+    urls.current = []
+  }, [])
+
+  useEffect(() => revokeAll, [revokeAll])
+
+  const add = useCallback((incoming: FileList | File[]) => {
+    const all = Array.from(incoming)
+    const valid = all.filter(f => CHAT_IMAGE_TYPES.includes(f.type) && f.size <= MAX_CHAT_IMAGE_BYTES)
+    if (valid.length) {
+      setFiles(prev => {
+        const room = MAX_CHAT_IMAGES - prev.length
+        const added = valid.slice(0, Math.max(0, room))
+        // Only the new files get a URL; the ones already in the list keep theirs.
+        const fresh = added.map(URL.createObjectURL)
+        urls.current = [...urls.current, ...fresh]
+        setPreviews(p => [...p, ...fresh])
+        return [...prev, ...added]
+      })
+    }
+    return valid.length === all.length
+  }, [])
+
+  const remove = useCallback((index: number) => {
+    setFiles(prev => prev.filter((_, i) => i !== index))
+    setPreviews(prev => {
+      const gone = prev[index]
+      if (gone) {
+        URL.revokeObjectURL(gone)
+        urls.current = urls.current.filter(u => u !== gone)
+      }
+      return prev.filter((_, i) => i !== index)
+    })
+  }, [])
+
+  const clear = useCallback(() => {
+    revokeAll()
+    setFiles([])
+    setPreviews([])
+  }, [revokeAll])
+
+  return { files, previews, add, remove, clear }
+}
diff --git a/client/src/components/Collab/useCollabChat.ts b/client/src/components/Collab/useCollabChat.ts
index aa35732dbb..fb26bd3e5b 100644
--- a/client/src/components/Collab/useCollabChat.ts
+++ b/client/src/components/Collab/useCollabChat.ts
@@ -1,10 +1,11 @@
-import { useState, useEffect, useRef, useCallback } from 'react'
+import { useState, useEffect, useRef, useCallback, type ClipboardEvent, type DragEvent } from 'react'
 import { collabApi } from '../../api/client'
 import { useSettingsStore } from '../../store/settingsStore'
 import { useCanDo } from '../../store/permissionsStore'
 import { useTripStore } from '../../store/tripStore'
 import { addListener, removeListener } from '../../api/websocket'
 import { useTranslation } from '../../i18n'
+import { useChatImages } from './useChatImages'
 import { useToast } from '../shared/Toast'
 
 export function useCollabChat(tripId: any, currentUser: any) {
@@ -23,6 +24,8 @@ export function useCollabChat(tripId: any, currentUser: any) {
   const [replyTo, setReplyTo] = useState(null)
   const [hoveredId, setHoveredId] = useState(null)
   const [sending, setSending] = useState(false)
+  const images = useChatImages()
+  const [uploadProgress, setUploadProgress] = useState(0)
   const [showEmoji, setShowEmoji] = useState(false)
   const [reactMenu, setReactMenu] = useState(null) // { msgId, x, y }
   const [deletingIds, setDeletingIds] = useState(new Set())
@@ -38,6 +41,7 @@ export function useCollabChat(tripId: any, currentUser: any) {
   const scrollRef = useRef(null)
   const textareaRef = useRef(null)
   const emojiBtnRef = useRef(null)
+  const imageInputRef = useRef<HTMLInputElement>(null)
   const isAtBottom = useRef(true)
 
   const scrollToBottom = useCallback((behavior = 'auto') => {
@@ -117,23 +121,35 @@ export function useCollabChat(tripId: any, currentUser: any) {
   }, [])
 
   /* ── send ── */
+  const addImageFiles = useCallback((incoming: File[] | FileList) => {
+    if (!images.add(incoming)) toast.error(t('collab.chat.imageRejected'))
+  }, [images, toast, t])
+  const removeImage = images.remove
+  const handlePaste = useCallback((e: ClipboardEvent) => { if (e.clipboardData.files.length) addImageFiles(e.clipboardData.files) }, [addImageFiles])
+  const handleDrop = useCallback((e: DragEvent) => { e.preventDefault(); addImageFiles(e.dataTransfer.files) }, [addImageFiles])
+
   const handleSend = useCallback(async () => {
     const body = text.trim()
-    if (!body || sending) return
+    if ((!body && !images.files.length) || sending) return
     setSending(true)
     try {
-      const payload: { text: string; reply_to?: number } = { text: body }
-      if (replyTo) payload.reply_to = replyTo.id
-      const data = await collabApi.sendMessage(tripId, payload)
+      let data
+      if (images.files.length) {
+        const form = new FormData(); if (body) form.append('text', body); if (replyTo) form.append('reply_to', String(replyTo.id)); images.files.forEach(file => form.append('images', file))
+        data = await collabApi.sendMessage(tripId, form, { onUploadProgress: e => setUploadProgress(e.total ? Math.round((e.loaded / e.total) * 100) : 0) })
+      } else {
+        const payload: { text: string; reply_to?: number } = { text: body }; if (replyTo) payload.reply_to = replyTo.id
+        data = await collabApi.sendMessage(tripId, payload)
+      }
       if (data?.message) {
         setMessages(prev => prev.some(m => m.id === data.message.id) ? prev : [...prev, data.message])
       }
-      setText(''); setReplyTo(null); setShowEmoji(false)
+      setText(''); setReplyTo(null); setShowEmoji(false); images.clear()
       if (textareaRef.current) textareaRef.current.style.height = 'auto'
       isAtBottom.current = true
       setTimeout(() => scrollToBottom('smooth'), 50)
-    } catch { toast.error(t('common.error')) } finally { setSending(false) }
-  }, [text, sending, replyTo, tripId, scrollToBottom, toast, t])
+    } catch { toast.error(t('common.error')) } finally { setSending(false); setUploadProgress(0) }
+  }, [text, sending, replyTo, tripId, scrollToBottom, toast, t, images])
 
   const handleKeyDown = useCallback((e) => {
     if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); handleSend() }
@@ -175,5 +191,5 @@ export function useCollabChat(tripId: any, currentUser: any) {
     return emojiRegex.test(text.trim())
   }
 
-  return { currentUser, tripId, t, is12h, can, trip, canEdit, messages, setMessages, loading, setLoading, hasMore, setHasMore, loadingMore, setLoadingMore, text, setText, replyTo, setReplyTo, hoveredId, setHoveredId, sending, setSending, showEmoji, setShowEmoji, reactMenu, setReactMenu, deletingIds, setDeletingIds, deleteTimersRef, containerRef, messagesRef, scrollRef, textareaRef, emojiBtnRef, isAtBottom, scrollToBottom, checkAtBottom, handleLoadMore, handleTextChange, handleSend, handleKeyDown, handleDelete, handleReact, handleEmojiSelect, isOwn, isEmojiOnly }
+  return { currentUser, tripId, t, is12h, can, trip, canEdit, messages, setMessages, loading, setLoading, hasMore, setHasMore, loadingMore, setLoadingMore, text, setText, replyTo, setReplyTo, hoveredId, setHoveredId, sending, setSending, showEmoji, setShowEmoji, reactMenu, setReactMenu, deletingIds, setDeletingIds, deleteTimersRef, containerRef, messagesRef, scrollRef, textareaRef, emojiBtnRef, imageInputRef, imageFiles: images.files, imagePreviews: images.previews, uploadProgress, addImageFiles, removeImage, handlePaste, handleDrop, isAtBottom, scrollToBottom, checkAtBottom, handleLoadMore, handleTextChange, handleSend, handleKeyDown, handleDelete, handleReact, handleEmojiSelect, isOwn, isEmojiOnly }
 }
diff --git a/client/src/components/Plugins/PluginFrame.tsx b/client/src/components/Plugins/PluginFrame.tsx
index e65af4390f..cbd4968e63 100644
--- a/client/src/components/Plugins/PluginFrame.tsx
+++ b/client/src/components/Plugins/PluginFrame.tsx
@@ -702,6 +702,8 @@ export default function PluginFrame({ pluginId, tripId = null, placeId = null, d
           }}
           onError={() => setLoadFailed(true)}
           sandbox="allow-scripts allow-forms"
+          allowFullScreen
+          allow="fullscreen"
           referrerPolicy="no-referrer"
           loading="lazy"
           title={title || pluginId}
diff --git a/client/src/mobile/screens/admin/MAdminAddonManager.tsx b/client/src/mobile/screens/admin/MAdminAddonManager.tsx
index f5f763dfd7..dd5cba793c 100644
--- a/client/src/mobile/screens/admin/MAdminAddonManager.tsx
+++ b/client/src/mobile/screens/admin/MAdminAddonManager.tsx
@@ -64,11 +64,12 @@ function AddonIcon({ name, size = 18 }: AddonIconProps) {
   return <Icon size={size} />
 }
 
-interface CollabFeatures { chat: boolean; notes: boolean; polls: boolean; whatsnext: boolean }
+interface CollabFeatures { chat: boolean; notes: boolean; links?: boolean; polls: boolean; whatsnext: boolean }
 
 const COLLAB_SUB_FEATURES = [
   { key: 'chat', icon: MessageCircle, titleKey: 'admin.collab.chat.title', subtitleKey: 'admin.collab.chat.subtitle' },
   { key: 'notes', icon: StickyNote, titleKey: 'admin.collab.notes.title', subtitleKey: 'admin.collab.notes.subtitle' },
+  { key: 'links', icon: Link2, titleKey: 'collab.tabs.links', subtitleKey: 'collab.links.empty' },
   { key: 'polls', icon: BarChart3, titleKey: 'admin.collab.polls.title', subtitleKey: 'admin.collab.polls.subtitle' },
   { key: 'whatsnext', icon: Sparkles, titleKey: 'admin.collab.whatsnext.title', subtitleKey: 'admin.collab.whatsnext.subtitle' },
 ] as const
diff --git a/client/src/mobile/screens/trip/MTripShell.tsx b/client/src/mobile/screens/trip/MTripShell.tsx
index d5af1b9f59..8a544e7950 100644
--- a/client/src/mobile/screens/trip/MTripShell.tsx
+++ b/client/src/mobile/screens/trip/MTripShell.tsx
@@ -35,7 +35,7 @@ export type TripPlanner = ReturnType<typeof useTripPlanner>
 export type MTripView = 'plan' | 'map'
 export type MTripMode = 'go' | 'edit' | 'browse'
 export type MTripListsTab = 'packing' | 'todo'
-export type MTripCollabTab = 'chat' | 'notes' | 'polls'
+export type MTripCollabTab = 'chat' | 'notes' | 'links' | 'polls'
 
 /**
  * Currently open bottom/floating sheet. Well-known ids (owned by the sheets
@@ -537,6 +537,7 @@ export default function MTripShell({
             {([
               { value: 'chat' as const, label: t('collab.tabs.chat') },
               { value: 'notes' as const, label: t('collab.tabs.notes') },
+              { value: 'links' as const, label: t('collab.tabs.links') || 'Links' },
               { value: 'polls' as const, label: t('collab.tabs.polls') },
             ]).map(seg => (
               <button
diff --git a/client/src/mobile/screens/trip/tabs/MCollabChat.tsx b/client/src/mobile/screens/trip/tabs/MCollabChat.tsx
index 5841fdf74d..966d0add88 100644
--- a/client/src/mobile/screens/trip/tabs/MCollabChat.tsx
+++ b/client/src/mobile/screens/trip/tabs/MCollabChat.tsx
@@ -1,7 +1,8 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
-import { ArrowUp, ChevronUp, Loader2, Reply, Trash2 } from 'lucide-react'
+import { ArrowUp, ChevronUp, ImagePlus, Loader2, Reply, Trash2 } from 'lucide-react'
 import MDancingTrek from '../../../components/MDancingTrek'
+import { useChatImages } from '../../../../components/Collab/useChatImages'
 import { collabApi } from '../../../../api/client'
 import { addListener, removeListener } from '../../../../api/websocket'
 import { useAuthStore } from '../../../../store/authStore'
@@ -63,10 +64,12 @@ export default function MCollabChat({ planner }: MCollabChatProps) {
   const [text, setText] = useState('')
   const [replyTo, setReplyTo] = useState<ChatMessage | null>(null)
   const [sending, setSending] = useState(false)
+  const images = useChatImages()
   const [popover, setPopover] = useState<{ msg: ChatMessage; x: number; y: number } | null>(null)
 
   const scrollRef = useRef<HTMLDivElement>(null)
   const textareaRef = useRef<HTMLTextAreaElement>(null)
+  const imageInputRef = useRef<HTMLInputElement>(null)
   const isAtBottomRef = useRef(true)
   const messagesRef = useRef<ChatMessage[]>([])
   messagesRef.current = messages
@@ -156,19 +159,33 @@ export default function MCollabChat({ planner }: MCollabChatProps) {
     }
   }
 
+  const addImageFiles = (incoming: FileList | File[]) => {
+    if (!images.add(incoming)) toast.error(t('collab.chat.imageRejected'))
+  }
+
   const handleSend = useCallback(async () => {
     const body = text.trim()
-    if (!body || sending || !canEdit) return
+    if ((!body && !images.files.length) || sending || !canEdit) return
     setSending(true)
     try {
-      const payload: { text: string; reply_to?: number } = { text: body }
-      if (replyTo) payload.reply_to = replyTo.id
-      const data = (await collabApi.sendMessage(tripId, payload)) as SendMessageResponse
+      let data: SendMessageResponse
+      if (images.files.length) {
+        const form = new FormData()
+        if (body) form.append('text', body)
+        if (replyTo) form.append('reply_to', String(replyTo.id))
+        images.files.forEach(file => form.append('images', file))
+        data = (await collabApi.sendMessage(tripId, form)) as SendMessageResponse
+      } else {
+        const payload: { text: string; reply_to?: number } = { text: body }
+        if (replyTo) payload.reply_to = replyTo.id
+        data = (await collabApi.sendMessage(tripId, payload)) as SendMessageResponse
+      }
       if (data.message) {
         setMessages(prev => (prev.some(m => m.id === data.message.id) ? prev : [...prev, data.message]))
       }
       setText('')
       setReplyTo(null)
+      images.clear()
       if (textareaRef.current) textareaRef.current.style.height = 'auto'
       isAtBottomRef.current = true
       setTimeout(() => scrollToBottom('smooth'), 50)
@@ -177,7 +194,7 @@ export default function MCollabChat({ planner }: MCollabChatProps) {
     } finally {
       setSending(false)
     }
-  }, [text, sending, canEdit, replyTo, tripId, scrollToBottom, toast, t])
+  }, [text, sending, canEdit, replyTo, tripId, scrollToBottom, toast, t, images])
 
   const handleDelete = useCallback(async (msgId: number) => {
     setPopover(null)
@@ -293,12 +310,28 @@ export default function MCollabChat({ planner }: MCollabChatProps) {
         )}
 
         {canEdit ? (
-          <div className="flex items-end gap-2">
+          <>
+            {images.previews.length > 0 && (
+              <div className="flex gap-2 overflow-x-auto">
+                {images.previews.map((url, i) => (
+                  <div key={url} className="relative">
+                    <img src={url} alt="" className="h-14 w-14 rounded-lg object-cover" />
+                    <button type="button" aria-label="Remove image" onClick={() => images.remove(i)} className="absolute -right-1 -top-1 h-4 w-4 rounded-full bg-m-ink text-[10px] text-m-bg">×</button>
+                  </div>
+                ))}
+              </div>
+            )}
+            <div className="flex items-end gap-2">
+            <input ref={imageInputRef} type="file" accept="image/jpeg,image/png,image/gif,image/webp" multiple hidden onChange={e => { if (e.target.files) addImageFiles(e.target.files); e.currentTarget.value = '' }} />
+            <button type="button" aria-label="Attach images" onClick={() => imageInputRef.current?.click()} className="flex h-[42px] w-[42px] flex-none items-center justify-center rounded-full text-m-muted">
+              <ImagePlus size={18} strokeWidth={2.2} />
+            </button>
             <textarea
               ref={textareaRef}
               rows={1}
               value={text}
               onChange={handleTextChange}
+              onPaste={e => { if (e.clipboardData.files.length) addImageFiles(e.clipboardData.files) }}
               placeholder={t('collab.chat.placeholder')}
               maxLength={5000}
               className="max-h-[100px] min-w-0 flex-1 resize-none rounded-full border border-[color:var(--m-rowbr)] bg-[color:var(--m-ic)] px-[14px] py-[11px] font-[inherit] text-[0.8125rem] text-m-ink outline-none placeholder:text-m-faint"
@@ -306,13 +339,14 @@ export default function MCollabChat({ planner }: MCollabChatProps) {
             <button
               type="button"
               onClick={handleSend}
-              disabled={!text.trim() || sending}
+              disabled={(!text.trim() && !images.files.length) || sending}
               aria-label={t('collab.chat.send')}
               className="flex h-[42px] w-[42px] flex-none items-center justify-center rounded-full bg-m-act text-m-actfg disabled:opacity-40"
             >
               <ArrowUp size={17} strokeWidth={2.4} />
             </button>
           </div>
+          </>
         ) : (
           <div className="rounded-full border border-[color:var(--m-rowbr)] bg-[color:var(--m-ic)] px-[14px] py-[11px] text-center font-geist text-[0.75rem] text-m-faint">
             {t('collab.chat.readOnly')}
@@ -443,6 +477,9 @@ function ChatBubbleRow({ msg, own, showHeader, isLastInGroup, marginTop, is12h,
                 </div>
               )}
               <span className="whitespace-pre-wrap break-words">{msg.text}</span>
+              {msg.attachments?.map(att => (
+                <img key={att.id} src={att.url} alt={att.original_name || ''} className="mt-2 max-h-52 w-full rounded-[10px] object-cover" />
+              ))}
             </div>
           )}
         </button>
diff --git a/client/src/mobile/screens/trip/tabs/MCollabTab.tsx b/client/src/mobile/screens/trip/tabs/MCollabTab.tsx
index 4eabb75c9e..7b4d1f0195 100644
--- a/client/src/mobile/screens/trip/tabs/MCollabTab.tsx
+++ b/client/src/mobile/screens/trip/tabs/MCollabTab.tsx
@@ -1,10 +1,11 @@
 import type { LucideIcon } from 'lucide-react'
-import { BarChart3, MessageCircle, StickyNote } from 'lucide-react'
+import { BarChart3, Link2, MessageCircle, StickyNote } from 'lucide-react'
 import type { MTabScreenProps } from './tabModel'
 import { TabScroller } from './tabChrome'
 import MCollabChat from './MCollabChat'
 import MCollabNotes from './MCollabNotes'
 import MCollabPolls from './MCollabPolls'
+import CollabLinks from '../../../../components/Collab/CollabLinks'
 
 /**
  * Tab 6 — Collab. Routes `shell.collabTab` ('chat' | 'notes' | 'polls', the
@@ -50,6 +51,23 @@ export default function MCollabTab({ planner, shell }: MTabScreenProps) {
     return <MCollabNotes planner={planner} />
   }
 
+  if (shell.collabTab === 'links') {
+    if (planner.collabFeatures.links === false) {
+      return (
+        <TabScroller>
+          <CollabDisabledNotice icon={Link2} label={label} />
+        </TabScroller>
+      )
+    }
+    return (
+      <TabScroller>
+        <div className="min-h-[70vh] overflow-hidden rounded-[18px] bg-[color:var(--m-card)]">
+          <CollabLinks tripId={planner.tripId} />
+        </div>
+      </TabScroller>
+    )
+  }
+
   if (shell.collabTab === 'polls') {
     if (!planner.collabFeatures.polls) {
       return (
diff --git a/client/src/mobile/screens/trip/tabs/collabModel.ts b/client/src/mobile/screens/trip/tabs/collabModel.ts
index 9d3d21409b..a34c527a20 100644
--- a/client/src/mobile/screens/trip/tabs/collabModel.ts
+++ b/client/src/mobile/screens/trip/tabs/collabModel.ts
@@ -42,6 +42,7 @@ export interface ChatMessage {
   created_at: string
   deleted?: number | boolean
   reactions: ChatReaction[]
+  attachments?: Array<{ id: number; url: string; original_name?: string; mime_type?: string }>
   /** Client-only: set once a delete (own or via WS) has landed. */
   _deleted?: boolean
 }
diff --git a/client/src/pages/tripPlanner/useTripPlanner.ts b/client/src/pages/tripPlanner/useTripPlanner.ts
index 02b26bb6e7..9139bf0988 100644
--- a/client/src/pages/tripPlanner/useTripPlanner.ts
+++ b/client/src/pages/tripPlanner/useTripPlanner.ts
@@ -122,7 +122,7 @@ export function useTripPlanner() {
       return next
     })
   }, [tripId])
-  const [collabFeatures, setCollabFeatures] = useState<{ chat: boolean; notes: boolean; polls: boolean; whatsnext: boolean }>({ chat: true, notes: true, polls: true, whatsnext: true })
+  const [collabFeatures, setCollabFeatures] = useState<{ chat: boolean; notes: boolean; links: boolean; polls: boolean; whatsnext: boolean }>({ chat: true, notes: true, links: true, polls: true, whatsnext: true })
   const [tripAccommodations, setTripAccommodations] = useState<Accommodation[]>([])
   const [allowedFileTypes, setAllowedFileTypes] = useState<string | null>(null)
   const [tripMembers, setTripMembers] = useState<TripMember[]>([])
diff --git a/server/src/db/migrations.ts b/server/src/db/migrations.ts
index 18d9b74aa5..52e79a542c 100644
--- a/server/src/db/migrations.ts
+++ b/server/src/db/migrations.ts
@@ -4442,6 +4442,47 @@ function runMigrations(db: Database.Database): void {
       db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_file_links_file_budget ON file_links(file_id, budget_item_id)');
       db.exec('CREATE INDEX IF NOT EXISTS idx_file_links_budget_item_id ON file_links(budget_item_id)');
     },
+    /**
+     * Which chat message an uploaded image belongs to.
+     *
+     * A column on `trip_files` rather than a link row, matching the two that
+     * predate it: a chat image is uploaded for exactly one message and dies with
+     * it, so the cascade is the whole relationship. Guarded through
+     * pragma_table_info like every other column add here, not through a caught
+     * "duplicate column name": that swallows the next error too.
+     *
+     * Appended LAST: the array is index-addressed against schema_version.
+     */
+    () => {
+      const cols = db.prepare("SELECT name FROM pragma_table_info('trip_files')").all() as Array<{ name: string }>;
+      if (!cols.some((c) => c.name === 'message_id')) {
+        db.exec('ALTER TABLE trip_files ADD COLUMN message_id INTEGER REFERENCES collab_messages(id) ON DELETE CASCADE');
+      }
+      db.exec('CREATE INDEX IF NOT EXISTS idx_trip_files_message_id ON trip_files(message_id)');
+    },
+    /**
+     * Links somebody shared with the trip.
+     *
+     * Its own table rather than a note with a URL in it: a link is pinned,
+     * ordered and opened, and none of that is what a note does. `user_id` is who
+     * shared it, so the list can say so and so a member leaving takes their rows
+     * with them.
+     *
+     * Appended LAST: the array is index-addressed against schema_version.
+     */
+    () => {
+      db.exec(`CREATE TABLE IF NOT EXISTS collab_links (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        title TEXT NOT NULL,
+        url TEXT NOT NULL,
+        pinned INTEGER DEFAULT 0,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+      )`);
+      db.exec('CREATE INDEX IF NOT EXISTS idx_collab_links_trip ON collab_links(trip_id)');
+    },
   ];
 
   if (currentVersion < migrations.length) {
diff --git a/server/src/nest/addons/addons.service.ts b/server/src/nest/addons/addons.service.ts
index 1db74a32cc..a1bcdf55f9 100644
--- a/server/src/nest/addons/addons.service.ts
+++ b/server/src/nest/addons/addons.service.ts
@@ -53,7 +53,7 @@ export class AddonsService {
   getCollabFeatures() {
     const rows = this.db
       .prepare(
-        "SELECT key, value FROM app_settings WHERE key IN ('collab_chat_enabled', 'collab_notes_enabled', 'collab_polls_enabled', 'collab_whatsnext_enabled')",
+        "SELECT key, value FROM app_settings WHERE key IN ('collab_chat_enabled', 'collab_notes_enabled', 'collab_links_enabled', 'collab_polls_enabled', 'collab_whatsnext_enabled')",
       )
       .all() as { key: string; value: string }[];
     const map: Record<string, string> = {};
@@ -61,15 +61,17 @@ export class AddonsService {
     return {
       chat: map['collab_chat_enabled'] !== 'false',
       notes: map['collab_notes_enabled'] !== 'false',
+      links: map['collab_links_enabled'] !== 'false',
       polls: map['collab_polls_enabled'] !== 'false',
       whatsnext: map['collab_whatsnext_enabled'] !== 'false',
     };
   }
 
-  updateCollabFeatures(features: { chat?: boolean; notes?: boolean; polls?: boolean; whatsnext?: boolean }) {
+  updateCollabFeatures(features: { chat?: boolean; notes?: boolean; links?: boolean; polls?: boolean; whatsnext?: boolean }) {
     const mapping: Record<string, string> = {
       chat: 'collab_chat_enabled',
       notes: 'collab_notes_enabled',
+      links: 'collab_links_enabled',
       polls: 'collab_polls_enabled',
       whatsnext: 'collab_whatsnext_enabled',
     };
diff --git a/server/src/nest/collab/collab.controller.ts b/server/src/nest/collab/collab.controller.ts
index 6e2d7ea74d..0c62eb9fca 100644
--- a/server/src/nest/collab/collab.controller.ts
+++ b/server/src/nest/collab/collab.controller.ts
@@ -11,10 +11,11 @@ import {
   Put,
   Query,
   UploadedFile,
+  UploadedFiles,
   UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
-import { FileInterceptor } from '@nestjs/platform-express';
+import { FileInterceptor, FilesInterceptor } from '@nestjs/platform-express';
 import type { Options } from 'multer';
 import path from 'path';
 import fs from 'fs';
@@ -26,6 +27,8 @@ import {
   CollabNoteUpdateDto,
   CollabPollCreateDto,
   CollabPollVoteDto,
+  CollabLinkCreateDto,
+  CollabLinkUpdateDto,
   CollabMessageCreateDto,
   CollabReactionDto,
 } from './collab.dto';
@@ -33,8 +36,38 @@ import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { BLOCKED_EXTENSIONS } from '../files/files.constants';
+import { SpoolCleanupInterceptor } from '../common/spool-cleanup.interceptor';
 
 export const MAX_NOTE_FILE_SIZE = 50 * 1024 * 1024;
+const MAX_CHAT_IMAGES = 4;
+const CHAT_IMAGE_TYPES = new Set(['image/jpeg', 'image/png', 'image/gif', 'image/webp']);
+const CHAT_IMAGE_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp']);
+/**
+ * The extension is checked as well as the type, and both have to agree.
+ *
+ * `file.mimetype` is the Content-Type the client put on the part, so it is a
+ * claim, not a fact. The stored name keeps the extension of the name the client
+ * sent (`storage-upload.factory.ts`), and the download route derives the served
+ * Content-Type from that extension and sends it inline. Believing the header
+ * alone therefore lets `pwn.html` through as `image/png` and serves it back as
+ * HTML on our own origin. This filter also fully replaces the module-level one
+ * on this route, so the blocked-extension list has to be applied here too.
+ */
+export const collabChatImageFilter: Options['fileFilter'] = (_req, file, cb) => {
+  const reject = (message: string) => {
+    const err: Error & { statusCode?: number } = new Error(message);
+    err.statusCode = 400;
+    return cb(err);
+  };
+  if (!CHAT_IMAGE_TYPES.has(file.mimetype)) {
+    return reject('Only JPEG, PNG, GIF, and WebP images are allowed');
+  }
+  const ext = path.extname(file.originalname).toLowerCase();
+  if (BLOCKED_EXTENSIONS.includes(ext) || !CHAT_IMAGE_EXTENSIONS.has(ext)) {
+    return reject('Only JPEG, PNG, GIF, and WebP images are allowed');
+  }
+  cb(null, true);
+};
 // Consumed by collab.module.ts's MulterModule factory; the rest of the multer
 // options (spool destination, filename, limits) come from the storage upload
 // factory.
@@ -189,6 +222,45 @@ export class CollabController {
     return { success: true };
   }
 
+  // ── Shared links ────────────────────────────────────────────────────────
+  @UseGuards(TripAccessGuard)
+  @Get('links')
+  listLinks(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    return { links: this.collab.listLinks(tripId) };
+  }
+
+  @UseGuards(TripAccessGuard)
+  @RequirePermission('collab_edit')
+  @Post('links')
+  createLink(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: CollabLinkCreateDto, @Headers('x-socket-id') socketId?: string) {
+    const link = this.collab.createLink(tripId, user.id, { title: body.title, url: body.url, pinned: Boolean(body.pinned) });
+    this.collab.broadcast(tripId, 'collab:link:created', { link }, socketId);
+    return { link };
+  }
+
+  @UseGuards(TripAccessGuard)
+  @RequirePermission('collab_edit')
+  @Put('links/:id')
+  updateLink(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body() body: CollabLinkUpdateDto, @Headers('x-socket-id') socketId?: string) {
+    const link = this.collab.updateLink(tripId, id, {
+      title: body.title,
+      url: body.url,
+      pinned: body.pinned === undefined ? undefined : Boolean(body.pinned),
+    });
+    if (!link) throw new HttpException({ error: 'Link not found' }, 404);
+    this.collab.broadcast(tripId, 'collab:link:updated', { link }, socketId);
+    return { link };
+  }
+
+  @UseGuards(TripAccessGuard)
+  @RequirePermission('collab_edit')
+  @Delete('links/:id')
+  deleteLink(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    if (!this.collab.deleteLink(tripId, id)) throw new HttpException({ error: 'Link not found' }, 404);
+    this.collab.broadcast(tripId, 'collab:link:deleted', { linkId: Number(id) }, socketId);
+    return { success: true };
+  }
+
   // ── Polls ───────────────────────────────────────────────────────────────
   @UseGuards(TripAccessGuard)
   @Get('polls')
@@ -254,23 +326,70 @@ export class CollabController {
     return { messages: this.collab.listMessages(tripId, before) };
   }
 
-  @UseGuards(TripAccessGuard)
-  @RequirePermission('collab_edit')
+  // No guard decorators, deliberately, like every other upload route in this
+  // file: guards run before the interceptor, so a 403 or 404 goes out while the
+  // client is still streaming the body and the socket dies as ECONNRESET
+  // instead of carrying the error envelope. Both checks happen in the handler.
   @Post('messages')
-  createMessage(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: CollabMessageCreateDto, @Headers('x-socket-id') socketId?: string) {
-    // The pipe's min(1)/max(5000) replaced the bespoke length checks (and still
-    // rejects before the trip-access check, like the legacy pre-access check
-    // did); min(1) doesn't trim, so whitespace-only text keeps its bespoke 400.
-    if (!body.text.trim()) {
-      throw new HttpException({ error: 'Message text is required' }, 400);
+  // SpoolCleanupInterceptor sits after the file one on purpose: the Zod pipe
+  // runs when the handler's parameters are resolved, which is after both have
+  // been entered, so a rejected body would otherwise leave up to four spooled
+  // images on disk with nothing to sweep them.
+  @UseInterceptors(
+    FilesInterceptor('images', MAX_CHAT_IMAGES, { fileFilter: collabChatImageFilter, limits: { files: MAX_CHAT_IMAGES, fileSize: 10 * 1024 * 1024 } }),
+    SpoolCleanupInterceptor,
+  )
+  async createMessage(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: CollabMessageCreateDto, @UploadedFiles() files: Express.Multer.File[] | undefined, @Headers('x-socket-id') socketId?: string) {
+    const uploaded = files || [];
+    const cleanupSpool = () => uploaded.forEach(file => { if (file.path) { try { fs.unlinkSync(file.path); } catch { /* best-effort */ } } });
+    let trip;
+    try {
+      trip = this.requireTrip(tripId, user);
+      this.requireEdit(trip, user);
+    } catch (err) {
+      cleanupSpool();
+      throw err;
+    }
+    if (uploaded.length && !this.collab.canUploadFiles(trip, user)) {
+      cleanupSpool();
+      throw new HttpException({ error: 'No permission to upload files' }, 403);
+    }
+    const text = (body.text || '').trim();
+    if (!text && !uploaded.length) {
+      cleanupSpool();
+      // The old wording is kept for a request that carried no file part at all,
+      // because that is exactly what a client from before this route took
+      // images sends, and parity is on the bespoke strings too. A multipart
+      // request gets the wording that actually describes its options.
+      const wasMultipart = files !== undefined;
+      throw new HttpException({ error: wasMultipart ? 'Message text or image is required' : 'Message text is required' }, 400);
+    }
+    const committed: string[] = [];
+    try {
+      for (const file of uploaded) {
+        await this.storage.put('files', file.filename, { tmpPath: file.path });
+        committed.push(file.filename);
+      }
+    } catch (err) {
+      cleanupSpool();
+      for (const name of committed) await this.storage.delete('files', name).catch(() => {});
+      throw err;
     }
-    const result = this.collab.createMessage(tripId, user.id, body.text, body.reply_to);
+    const replyTo = body.reply_to === undefined || body.reply_to === '' || body.reply_to === null ? null : Number(body.reply_to);
+    const result = this.collab.createMessage(
+      tripId,
+      user.id,
+      text,
+      Number.isFinite(replyTo as number) ? replyTo : null,
+      uploaded.map(file => ({ filename: file.filename, originalname: file.originalname, size: file.size, mimetype: file.mimetype })),
+    );
     if (result.error === 'reply_not_found') {
+      for (const name of committed) await this.storage.delete('files', name).catch(() => {});
       throw new HttpException({ error: 'Reply target message not found' }, 400);
     }
     this.collab.broadcast(tripId, 'collab:message:created', { message: result.message }, socketId);
-    const t = body.text.trim();
-    this.collab.notifyCollab(tripId, user, t.length > 80 ? t.substring(0, 80) + '...' : t);
+    const preview = text || 'sent an image';
+    this.collab.notifyCollab(tripId, user, preview.length > 80 ? preview.substring(0, 80) + '...' : preview);
     return { message: result.message };
   }
 
diff --git a/server/src/nest/collab/collab.dto.ts b/server/src/nest/collab/collab.dto.ts
index bbd8e8eb75..e69807eea3 100644
--- a/server/src/nest/collab/collab.dto.ts
+++ b/server/src/nest/collab/collab.dto.ts
@@ -4,6 +4,8 @@ import {
   collabNoteUpdateRequestSchema,
   collabPollCreateRequestSchema,
   collabPollVoteRequestSchema,
+  collabLinkCreateRequestSchema,
+  collabLinkUpdateRequestSchema,
   collabMessageCreateRequestSchema,
   collabReactionRequestSchema,
 } from '@trek/shared';
@@ -17,5 +19,7 @@ export class CollabNoteCreateDto extends createZodDto(collabNoteCreateRequestSch
 export class CollabNoteUpdateDto extends createZodDto(collabNoteUpdateRequestSchema) {}
 export class CollabPollCreateDto extends createZodDto(collabPollCreateRequestSchema) {}
 export class CollabPollVoteDto extends createZodDto(collabPollVoteRequestSchema) {}
+export class CollabLinkCreateDto extends createZodDto(collabLinkCreateRequestSchema) {}
+export class CollabLinkUpdateDto extends createZodDto(collabLinkUpdateRequestSchema) {}
 export class CollabMessageCreateDto extends createZodDto(collabMessageCreateRequestSchema) {}
 export class CollabReactionDto extends createZodDto(collabReactionRequestSchema) {}
diff --git a/server/src/nest/collab/collab.service.ts b/server/src/nest/collab/collab.service.ts
index ddfc64666a..67aca9369c 100644
--- a/server/src/nest/collab/collab.service.ts
+++ b/server/src/nest/collab/collab.service.ts
@@ -429,12 +429,71 @@ export class CollabService {
     return true;
   }
 
+  /* ------------------------------------------------------------------ */
+  /*  Shared links                                                       */
+  /* ------------------------------------------------------------------ */
+
+  listLinks(tripId: string | number) {
+    return this.db.all(
+      `SELECT l.*, u.username FROM collab_links l JOIN users u ON u.id = l.user_id
+       WHERE l.trip_id = ? ORDER BY l.pinned DESC, l.created_at DESC`,
+      tripId,
+    );
+  }
+
+  createLink(tripId: string | number, userId: number, data: { title: string; url: string; pinned?: boolean }) {
+    const result = this.db.run(
+      'INSERT INTO collab_links (trip_id,user_id,title,url,pinned) VALUES (?,?,?,?,?)',
+      tripId, userId, data.title.trim(), data.url.trim(), data.pinned ? 1 : 0,
+    );
+    return this.db.get('SELECT l.*, u.username FROM collab_links l JOIN users u ON u.id = l.user_id WHERE l.id = ?', result.lastInsertRowid);
+  }
+
+  updateLink(tripId: string | number, linkId: string | number, data: { title?: string; url?: string; pinned?: boolean | number }) {
+    const existing = this.db.get<any>('SELECT * FROM collab_links WHERE id = ? AND trip_id = ?', linkId, tripId);
+    if (!existing) return null;
+    this.db.run(
+      'UPDATE collab_links SET title = ?, url = ?, pinned = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND trip_id = ?',
+      data.title?.trim() || existing.title,
+      data.url?.trim() || existing.url,
+      data.pinned === undefined ? existing.pinned : (data.pinned ? 1 : 0),
+      linkId,
+      tripId,
+    );
+    return this.db.get('SELECT l.*, u.username FROM collab_links l JOIN users u ON u.id = l.user_id WHERE l.id = ?', linkId);
+  }
+
+  deleteLink(tripId: string | number, linkId: string | number): boolean {
+    return this.db.run('DELETE FROM collab_links WHERE id = ? AND trip_id = ?', linkId, tripId).changes > 0;
+  }
+
   /* ------------------------------------------------------------------ */
   /*  Messages                                                           */
   /* ------------------------------------------------------------------ */
 
   private formatMessage(msg: CollabMessage, reactions?: GroupedReaction[]) {
-    return { ...msg, user_avatar: avatarUrl(msg), avatar_url: avatarUrl(msg), reactions: reactions || [] };
+    const attachments = msg.id && msg.trip_id
+      ? this.db.all<any>(
+        `SELECT id, trip_id, message_id, filename, original_name, file_size, mime_type
+         FROM trip_files WHERE message_id = ? AND trip_id = ? AND deleted_at IS NULL
+         ORDER BY id ASC`,
+        msg.id, msg.trip_id,
+      )
+      : [];
+    return {
+      ...msg,
+      user_avatar: avatarUrl(msg),
+      avatar_url: avatarUrl(msg),
+      reactions: reactions || [],
+      attachments: attachments.map((a: any) => ({
+        id: a.id,
+        filename: a.filename,
+        original_name: a.original_name,
+        file_size: a.file_size,
+        mime_type: a.mime_type,
+        url: `/api/trips/${a.trip_id}/files/${a.id}/download`,
+      })),
+    };
   }
 
   countMessages(tripId: string | number): number {
@@ -486,7 +545,13 @@ export class CollabService {
     return messages.map(m => this.formatMessage(m, this.groupReactions(reactionsByMsg[m.id] || [])));
   }
 
-  createMessage(tripId: string | number, userId: number, text: string, replyTo?: number | null): { error?: string; message?: ReturnType<CollabService['formatMessage']> } {
+  createMessage(
+    tripId: string | number,
+    userId: number,
+    text: string,
+    replyTo?: number | null,
+    files: Array<{ filename: string; originalname: string; size: number; mimetype: string }> = [],
+  ): { error?: string; message?: ReturnType<CollabService['formatMessage']> } {
     if (replyTo) {
       // A soft-deleted message is gone as far as anyone replying is concerned:
       // its row survives only so the placeholder can be drawn where it was.
@@ -496,10 +561,24 @@ export class CollabService {
       if (!replyMsg) return { error: 'reply_not_found' };
     }
 
-    const result = this.db.run(`
+    // One transaction: the caller has already committed the image bytes to
+    // storage, so a message row that lands without its attachment rows would
+    // leave those bytes with nothing pointing at them and nothing to sweep them.
+    const result = this.db.transaction(() => {
+      const inserted = this.db.run(`
     INSERT INTO collab_messages (trip_id, user_id, text, reply_to) VALUES (?, ?, ?, ?)
   `, tripId, userId, text.trim(), replyTo || null);
 
+      for (const file of files) {
+        this.db.run(
+          `INSERT INTO trip_files (trip_id, message_id, filename, original_name, file_size, mime_type, uploaded_by)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
+          tripId, inserted.lastInsertRowid, file.filename, file.originalname, file.size, file.mimetype, userId,
+        );
+      }
+      return inserted;
+    });
+
     const message = this.db.get<CollabMessage>(`
     SELECT m.*, u.username, u.avatar,
       CASE WHEN rm.deleted = 1 THEN '' ELSE rm.text END AS reply_text,
@@ -519,7 +598,17 @@ export class CollabService {
     if (!message) return { error: 'not_found' };
     if (Number(message.user_id) !== Number(userId)) return { error: 'not_owner' };
 
-    this.db.run('UPDATE collab_messages SET deleted = 1 WHERE id = ?', messageId);
+    const attachments = this.db.all<{ filename: string }>('SELECT filename FROM trip_files WHERE message_id = ? AND trip_id = ?', messageId, tripId);
+    this.db.transaction(() => {
+      this.db.run('DELETE FROM trip_files WHERE message_id = ? AND trip_id = ?', messageId, tripId);
+      this.db.run('UPDATE collab_messages SET deleted = 1 WHERE id = ?', messageId);
+    });
+    // Only once the rows are actually gone. Dropping the blobs first left a
+    // live message pointing at attachments whose bytes no longer existed
+    // whenever the second statement failed.
+    for (const file of attachments) {
+      void this.storage.delete('files', path.basename(file.filename)).catch(() => { /* best effort */ });
+    }
     return { username: message.username };
   }
 
diff --git a/server/src/nest/common/spool-cleanup.interceptor.ts b/server/src/nest/common/spool-cleanup.interceptor.ts
new file mode 100644
index 0000000000..3ab3978c0c
--- /dev/null
+++ b/server/src/nest/common/spool-cleanup.interceptor.ts
@@ -0,0 +1,38 @@
+import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
+import { Observable, catchError, throwError } from 'rxjs';
+import * as fs from 'fs';
+
+/**
+ * Unlink whatever multer spooled when the request dies before the handler.
+ *
+ * Nest resolves handler parameters, and therefore runs the validation pipe,
+ * only after every interceptor has been entered. `FilesInterceptor` has already
+ * written the parts to the spool directory by then, so a body the Zod pipe
+ * rejects throws with the bytes on disk and the handler's own cleanup never
+ * reached. Nothing sweeps that directory, and the request is repeatable, so it
+ * is a disk-fill anybody with upload rights can trigger in a loop.
+ *
+ * Register it AFTER the file interceptor on a route, so `req.files` is
+ * populated by the time this one wraps the call. It only cleans up on failure:
+ * a handler that succeeds owns the spooled files and moves them itself.
+ */
+@Injectable()
+export class SpoolCleanupInterceptor implements NestInterceptor {
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    return next.handle().pipe(
+      catchError(err => {
+        const req = context.switchToHttp().getRequest<{ files?: Array<{ path?: string }>; file?: { path?: string } }>();
+        const spooled = [...(req.files ?? []), ...(req.file ? [req.file] : [])];
+        for (const file of spooled) {
+          if (!file?.path) continue;
+          try {
+            fs.unlinkSync(file.path);
+          } catch {
+            // Best effort: the handler may already have moved or removed it.
+          }
+        }
+        return throwError(() => err);
+      }),
+    );
+  }
+}
diff --git a/server/src/nest/files/files.service.ts b/server/src/nest/files/files.service.ts
index 415b95a8a9..43aa440294 100644
--- a/server/src/nest/files/files.service.ts
+++ b/server/src/nest/files/files.service.ts
@@ -226,7 +226,9 @@ export class FilesService {
   }
 
   listFiles(tripId: string | number, showTrash: boolean) {
-    const where = showTrash ? 'f.trip_id = ? AND f.deleted_at IS NOT NULL' : 'f.trip_id = ? AND f.deleted_at IS NULL';
+    const where = showTrash
+      ? 'f.trip_id = ? AND f.deleted_at IS NOT NULL AND f.message_id IS NULL'
+      : 'f.trip_id = ? AND f.deleted_at IS NULL AND f.message_id IS NULL';
     const files = this.db.all<TripFile>(`${FILE_SELECT} WHERE ${where} ORDER BY f.starred DESC, f.created_at DESC`, tripId);
 
     const fileIds = files.map(f => f.id);
diff --git a/server/tests/e2e/addons.e2e.test.ts b/server/tests/e2e/addons.e2e.test.ts
index af47f87cc5..64acef2cc5 100644
--- a/server/tests/e2e/addons.e2e.test.ts
+++ b/server/tests/e2e/addons.e2e.test.ts
@@ -84,7 +84,7 @@ describe('GET /api/addons e2e (real auth guard + temp SQLite)', () => {
     const res = await request(server).get('/api/addons').set('Cookie', sessionCookie(1));
     expect(res.status).toBe(200);
     expect(res.body).toEqual({
-      collabFeatures: { chat: true, notes: true, polls: true, whatsnext: true },
+      collabFeatures: { chat: true, notes: true, links: true, polls: true, whatsnext: true },
       bagTracking: true,
       addons: [
         { id: 'packing', name: 'Packing', type: 'trip', icon: 'Backpack', enabled: true },
diff --git a/server/tests/e2e/admin.e2e.test.ts b/server/tests/e2e/admin.e2e.test.ts
index 829701a2ab..f7ef5bd4dd 100644
--- a/server/tests/e2e/admin.e2e.test.ts
+++ b/server/tests/e2e/admin.e2e.test.ts
@@ -38,7 +38,7 @@ const { db } = vi.hoisted(() => {
   // getStats counts these three alongside users.
   tmp.exec('CREATE TABLE trips (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT, user_id INTEGER);');
   tmp.exec('CREATE TABLE places (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER);');
-  tmp.exec('CREATE TABLE trip_files (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER);');
+  tmp.exec('CREATE TABLE trip_files (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER, message_id INTEGER);');
   tmp.exec(`CREATE TABLE invite_tokens (id INTEGER PRIMARY KEY AUTOINCREMENT, token TEXT NOT NULL,
     max_uses INTEGER, uses INTEGER DEFAULT 0, expires_at TEXT, created_by INTEGER NOT NULL,
     trip_id INTEGER, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
diff --git a/server/tests/e2e/collab.e2e.test.ts b/server/tests/e2e/collab.e2e.test.ts
index 5e592253db..96edf1a999 100644
--- a/server/tests/e2e/collab.e2e.test.ts
+++ b/server/tests/e2e/collab.e2e.test.ts
@@ -35,6 +35,9 @@ const { db } = vi.hoisted(() => {
     user_id INTEGER NOT NULL, category TEXT DEFAULT 'General', title TEXT NOT NULL, content TEXT,
     color TEXT DEFAULT '#6366f1', pinned INTEGER DEFAULT 0, website TEXT,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP, updated_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
+  tmp.exec(`CREATE TABLE collab_links (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER NOT NULL,
+    user_id INTEGER NOT NULL, title TEXT NOT NULL, url TEXT NOT NULL, pinned INTEGER DEFAULT 0,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP, updated_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
   tmp.exec(`CREATE TABLE collab_polls (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER NOT NULL,
     user_id INTEGER NOT NULL, question TEXT NOT NULL, options TEXT NOT NULL, multiple INTEGER DEFAULT 0,
     closed INTEGER DEFAULT 0, deadline TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
@@ -48,8 +51,9 @@ const { db } = vi.hoisted(() => {
     message_id INTEGER NOT NULL, user_id INTEGER NOT NULL, emoji TEXT NOT NULL,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
   tmp.exec(`CREATE TABLE trip_files (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER NOT NULL,
-    note_id INTEGER, filename TEXT NOT NULL, original_name TEXT NOT NULL, file_size INTEGER,
-    mime_type TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
+    note_id INTEGER, message_id INTEGER, filename TEXT NOT NULL, original_name TEXT NOT NULL,
+    file_size INTEGER, mime_type TEXT, uploaded_by INTEGER, deleted_at DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
   // StorageRegistryService (behind StorageModule, now in this module chain) reads
   // this at onModuleInit.
   tmp.exec('CREATE TABLE app_settings (key TEXT PRIMARY KEY, value TEXT);');
@@ -69,6 +73,7 @@ import { PermissionsService } from '../../src/nest/permissions/permissions.servi
 let checkPermission: MockInstance;
 
 import { CollabModule } from '../../src/nest/collab/collab.module';
+import { ZodValidationPipe } from '../../src/nest/common/zod-validation.pipe';
 import { TrekExceptionFilter } from '../../src/nest/common/trek-exception.filter';
 import { RateLimitService } from '../../src/nest/common/rate-limit.service';
 
@@ -81,6 +86,10 @@ describe('Collab e2e (real auth guard + temp SQLite)', () => {
     const nest = moduleRef.createNestApplication();
     nest.use(cookieParser());
     nest.useGlobalFilters(new TrekExceptionFilter());
+    // AppModule registers this as APP_PIPE; the harness only pulls CollabModule,
+    // so without it the write routes would run unvalidated here and a broken
+    // contract would still look green.
+    nest.useGlobalPipes(new ZodValidationPipe());
     await nest.init();
     return nest;
   }
@@ -101,6 +110,7 @@ describe('Collab e2e (real auth guard + temp SQLite)', () => {
     db.prepare('DELETE FROM collab_polls').run();
     db.prepare('DELETE FROM trip_files').run();
     db.prepare('DELETE FROM collab_notes').run();
+    db.prepare('DELETE FROM collab_links').run();
   });
 
   afterAll(async () => {
@@ -223,4 +233,70 @@ describe('Collab e2e (real auth guard + temp SQLite)', () => {
     expect(res.status).toBe(400);
     expect(res.body).toEqual({ error: 'URL is required' });
   });
+
+  describe('shared links', () => {
+    it('401 without a session cookie', async () => {
+      expect((await request(server).get('/api/trips/5/collab/links')).status).toBe(401);
+    });
+
+    it('404 when the trip is not accessible', async () => {
+      canAccessTrip.mockReturnValue(undefined);
+      const res = await request(server).get('/api/trips/5/collab/links').set('Cookie', sessionCookie(1));
+      expect(res.status).toBe(404);
+    });
+
+    it('201 on create, and the row is persisted with the acting user', async () => {
+      const res = await request(server).post('/api/trips/5/collab/links').set('Cookie', sessionCookie(1))
+        .send({ title: 'Ferry', url: 'https://example.com/ferry' });
+      expect(res.status).toBe(201);
+      expect(res.body.link).toMatchObject({ title: 'Ferry', url: 'https://example.com/ferry' });
+      const row = db.prepare('SELECT * FROM collab_links WHERE trip_id = 5').get() as { title: string; user_id: number };
+      expect(row).toMatchObject({ title: 'Ferry', user_id: 1 });
+    });
+
+    it('403 on create without collab_edit', async () => {
+      checkPermission.mockReturnValue(false);
+      const res = await request(server).post('/api/trips/5/collab/links').set('Cookie', sessionCookie(1))
+        .send({ title: 'Ferry', url: 'https://example.com/ferry' });
+      expect(res.status).toBe(403);
+    });
+
+    it('400 when the body does not satisfy the contract', async () => {
+      const res = await request(server).post('/api/trips/5/collab/links').set('Cookie', sessionCookie(1)).send({ title: 'Ferry' });
+      expect(res.status).toBe(400);
+    });
+
+    it('200 on list, pinned first', async () => {
+      db.prepare("INSERT INTO collab_links (id, trip_id, user_id, title, url, pinned) VALUES (1, 5, 1, 'Plain', 'https://a.test', 0)").run();
+      db.prepare("INSERT INTO collab_links (id, trip_id, user_id, title, url, pinned) VALUES (2, 5, 1, 'Pinned', 'https://b.test', 1)").run();
+      const res = await request(server).get('/api/trips/5/collab/links').set('Cookie', sessionCookie(1));
+      expect(res.status).toBe(200);
+      expect(res.body.links.map((l: { title: string }) => l.title)).toEqual(['Pinned', 'Plain']);
+    });
+
+    it('200 on update and the pin lands in the row', async () => {
+      db.prepare("INSERT INTO collab_links (id, trip_id, user_id, title, url) VALUES (1, 5, 1, 'Plain', 'https://a.test')").run();
+      const res = await request(server).put('/api/trips/5/collab/links/1').set('Cookie', sessionCookie(1)).send({ pinned: true });
+      expect(res.status).toBe(200);
+      expect(res.body.link).toMatchObject({ id: 1, pinned: 1 });
+    });
+
+    it('404 on update and delete of a link that is not there', async () => {
+      expect((await request(server).put('/api/trips/5/collab/links/99').set('Cookie', sessionCookie(1)).send({ pinned: true })).status).toBe(404);
+      expect((await request(server).delete('/api/trips/5/collab/links/99').set('Cookie', sessionCookie(1))).status).toBe(404);
+    });
+
+    it('200 on delete and the row is gone', async () => {
+      db.prepare("INSERT INTO collab_links (id, trip_id, user_id, title, url) VALUES (1, 5, 1, 'Plain', 'https://a.test')").run();
+      const res = await request(server).delete('/api/trips/5/collab/links/1').set('Cookie', sessionCookie(1));
+      expect(res.status).toBe(200);
+      expect(db.prepare('SELECT COUNT(*) c FROM collab_links').get()).toEqual({ c: 0 });
+    });
+
+    it('403 on delete without collab_edit', async () => {
+      db.prepare("INSERT INTO collab_links (id, trip_id, user_id, title, url) VALUES (1, 5, 1, 'Plain', 'https://a.test')").run();
+      checkPermission.mockReturnValue(false);
+      expect((await request(server).delete('/api/trips/5/collab/links/1').set('Cookie', sessionCookie(1))).status).toBe(403);
+    });
+  });
 });
diff --git a/server/tests/e2e/files.e2e.test.ts b/server/tests/e2e/files.e2e.test.ts
index 10b9230e6d..19f7ce5e48 100644
--- a/server/tests/e2e/files.e2e.test.ts
+++ b/server/tests/e2e/files.e2e.test.ts
@@ -27,8 +27,9 @@ const { db } = vi.hoisted(() => {
   // reservations/places/day_assignments).
   tmp.exec('CREATE TABLE trips (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, title TEXT);');
   tmp.exec(`CREATE TABLE trip_files (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER NOT NULL,
-    place_id INTEGER, reservation_id INTEGER, filename TEXT NOT NULL, original_name TEXT NOT NULL,
-    file_size INTEGER, mime_type TEXT, description TEXT, uploaded_by INTEGER, starred INTEGER DEFAULT 0,
+    place_id INTEGER, reservation_id INTEGER, message_id INTEGER, filename TEXT NOT NULL,
+    original_name TEXT NOT NULL, file_size INTEGER, mime_type TEXT, description TEXT,
+    uploaded_by INTEGER, starred INTEGER DEFAULT 0,
     deleted_at DATETIME, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
   tmp.exec(`CREATE TABLE file_links (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id INTEGER NOT NULL,
     reservation_id INTEGER, assignment_id INTEGER, place_id INTEGER, budget_item_id INTEGER,
diff --git a/server/tests/e2e/trips.e2e.test.ts b/server/tests/e2e/trips.e2e.test.ts
index 1a2916d56b..16915c91b8 100644
--- a/server/tests/e2e/trips.e2e.test.ts
+++ b/server/tests/e2e/trips.e2e.test.ts
@@ -57,8 +57,9 @@ const { db } = vi.hoisted(() => {
   // bundle()'s files now runs FilesService's real SQL (DI-injected, no mock) —
   // empty tables satisfy the FILE_SELECT joins and the file_links batch.
   tmp.exec(`CREATE TABLE trip_files (id INTEGER PRIMARY KEY AUTOINCREMENT, trip_id INTEGER NOT NULL,
-    place_id INTEGER, reservation_id INTEGER, filename TEXT NOT NULL, original_name TEXT NOT NULL,
-    file_size INTEGER, mime_type TEXT, description TEXT, uploaded_by INTEGER, starred INTEGER DEFAULT 0,
+    place_id INTEGER, reservation_id INTEGER, message_id INTEGER, filename TEXT NOT NULL,
+    original_name TEXT NOT NULL, file_size INTEGER, mime_type TEXT, description TEXT,
+    uploaded_by INTEGER, starred INTEGER DEFAULT 0,
     deleted_at DATETIME, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);`);
   tmp.exec(`CREATE TABLE file_links (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id INTEGER NOT NULL,
     reservation_id INTEGER, assignment_id INTEGER, place_id INTEGER,
diff --git a/server/tests/unit/mcp/tools-help-addons.test.ts b/server/tests/unit/mcp/tools-help-addons.test.ts
index 57ff8e17a1..1a71ece2c2 100644
--- a/server/tests/unit/mcp/tools-help-addons.test.ts
+++ b/server/tests/unit/mcp/tools-help-addons.test.ts
@@ -320,7 +320,7 @@ describe('Tool: list_addons', () => {
         type: row.type,
         enabled: true,
       });
-      expect(data.collabFeatures).toEqual({ chat: true, notes: true, polls: true, whatsnext: true });
+      expect(data.collabFeatures).toEqual({ chat: true, notes: true, links: true, polls: true, whatsnext: true });
       expect(data.bagTracking).toBe(false);
     });
   });
diff --git a/server/tests/unit/mcp/tools-prompts.test.ts b/server/tests/unit/mcp/tools-prompts.test.ts
index cb3dc90dca..3caa8ba431 100644
--- a/server/tests/unit/mcp/tools-prompts.test.ts
+++ b/server/tests/unit/mcp/tools-prompts.test.ts
@@ -52,7 +52,7 @@ const { isAddonEnabledMock } = vi.hoisted(() => {
 // of behind an import path.
 const addonsStub = {
   isAddonEnabled: isAddonEnabledMock,
-  getCollabFeatures: () => ({ chat: true, notes: true, polls: true, whatsnext: true }),
+  getCollabFeatures: () => ({ chat: true, notes: true, links: true, polls: true, whatsnext: true }),
 } as unknown as AddonsService;
 
 const { mockGetTripSummary } = vi.hoisted(() => ({
diff --git a/server/tests/unit/nest/addons.service.test.ts b/server/tests/unit/nest/addons.service.test.ts
index 9bb1aa324f..87e3809bba 100644
--- a/server/tests/unit/nest/addons.service.test.ts
+++ b/server/tests/unit/nest/addons.service.test.ts
@@ -78,7 +78,7 @@ describe('AddonsService.list', () => {
     feedReads([], [], [], [{ key: 'collab_chat_enabled', value: 'false' }], { value: 'true' });
 
     const res = svc().list();
-    expect(res.collabFeatures).toEqual({ chat: false, notes: true, polls: true, whatsnext: true });
+    expect(res.collabFeatures).toEqual({ chat: false, notes: true, links: true, polls: true, whatsnext: true });
     expect(res.bagTracking).toBe(true);
     expect(res.addons).toEqual([]);
   });
@@ -311,7 +311,7 @@ describe('AddonsService addon/feature flags', () => {
       { key: 'collab_chat_enabled', value: 'false' },
       { key: 'collab_polls_enabled', value: 'true' },
     ]);
-    expect(svc().getCollabFeatures()).toEqual({ chat: false, notes: true, polls: true, whatsnext: true });
+    expect(svc().getCollabFeatures()).toEqual({ chat: false, notes: true, links: true, polls: true, whatsnext: true });
   });
 
   it('updateCollabFeatures writes only the provided flags and reports changed (#1414, ADMIN-SVC-070)', () => {
diff --git a/server/tests/unit/nest/collab.controller.test.ts b/server/tests/unit/nest/collab.controller.test.ts
index 89f7693bc8..596eae4025 100644
--- a/server/tests/unit/nest/collab.controller.test.ts
+++ b/server/tests/unit/nest/collab.controller.test.ts
@@ -4,7 +4,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import { CollabController } from '../../../src/nest/collab/collab.controller';
+import { CollabController, collabChatImageFilter, collabNoteFileFilter } from '../../../src/nest/collab/collab.controller';
 import { TripAccessGuard, TRIP_PERMISSION_KEY } from '../../../src/nest/permissions/trip-access.guard';
 import { JwtAuthGuard } from '../../../src/nest/auth/jwt-auth.guard';
 import type { CollabService } from '../../../src/nest/collab/collab.service';
@@ -154,17 +154,33 @@ describe('CollabController (parity with the legacy /api/trips/:tripId/collab rou
   });
 
   describe('messages', () => {
-    it('POST 400 whitespace-only, 400 reply_not_found, else creates + notifies (length checks now in the Zod pipe)', () => {
-      expect(thrown(() => new CollabController(svc(), storageStub).createMessage(user, '5', { text: '   ' }))).toEqual({ status: 400, body: { error: 'Message text is required' } });
-      expect(thrown(() => new CollabController(svc({ createMessage: vi.fn().mockReturnValue({ error: 'reply_not_found' }) } as Partial<CollabService>), storageStub).createMessage(user, '5', { text: 'hi', reply_to: 99 }))).toEqual({ status: 400, body: { error: 'Reply target message not found' } });
+    // Async since the route took its multipart form: it awaits the storage
+    // commit, so every case here goes through thrownAsync.
+    it('POST 400 whitespace-only, 400 reply_not_found, else creates + notifies (length checks now in the Zod pipe)', async () => {
+      // A request with no file part keeps the wording it always had.
+      expect(await thrownAsync(() => new CollabController(svc(), storageStub).createMessage(user, '5', { text: '   ' }, undefined)))
+        .toEqual({ status: 400, body: { error: 'Message text is required' } });
+      expect(await thrownAsync(() => new CollabController(svc(), storageStub).createMessage(user, '5', { text: '   ' }, [])))
+        .toEqual({ status: 400, body: { error: 'Message text or image is required' } });
+      expect(await thrownAsync(() => new CollabController(svc({ createMessage: vi.fn().mockReturnValue({ error: 'reply_not_found' }) } as Partial<CollabService>), storageStub).createMessage(user, '5', { text: 'hi', reply_to: 99 }, undefined)))
+        .toEqual({ status: 400, body: { error: 'Reply target message not found' } });
       const broadcast = vi.fn();
       const notifyCollab = vi.fn();
       const s = svc({ createMessage: vi.fn().mockReturnValue({ message: { id: 3 } }), broadcast, notifyCollab } as Partial<CollabService>);
-      expect(new CollabController(s, storageStub).createMessage(user, '5', { text: 'hello' }, 'sock')).toEqual({ message: { id: 3 } });
+      expect(await new CollabController(s, storageStub).createMessage(user, '5', { text: 'hello' }, undefined, 'sock')).toEqual({ message: { id: 3 } });
       expect(broadcast).toHaveBeenCalledWith('5', 'collab:message:created', { message: { id: 3 } }, 'sock');
       expect(notifyCollab).toHaveBeenCalledWith('5', user, 'hello');
     });
 
+    it('refuses a caller who cannot reach the trip or cannot write, from inside the handler', async () => {
+      // The decorators had to go because of the multipart body, so these two
+      // refusals are the only thing standing in front of the route now.
+      expect(await thrownAsync(() => new CollabController(svc({ verifyTripAccess: vi.fn().mockReturnValue(null) } as Partial<CollabService>), storageStub).createMessage(user, '5', { text: 'hi' }, undefined)))
+        .toEqual({ status: 404, body: { error: 'Trip not found' } });
+      expect(await thrownAsync(() => new CollabController(svc({ canEdit: vi.fn().mockReturnValue(false) } as Partial<CollabService>), storageStub).createMessage(user, '5', { text: 'hi' }, undefined)))
+        .toEqual({ status: 403, body: { error: 'No permission' } });
+    });
+
     it('react 404 unknown, else broadcasts reactions (empty emoji now 400s in the Zod pipe)', () => {
       expect(thrown(() => new CollabController(svc({ reactMessage: vi.fn().mockReturnValue({ found: false, reactions: [] }) } as Partial<CollabService>), storageStub).react(user, '5', '3', { emoji: '👍' }))).toEqual({ status: 404, body: { error: 'Message not found' } });
       const broadcast = vi.fn();
@@ -186,6 +202,102 @@ describe('CollabController (parity with the legacy /api/trips/:tripId/collab rou
   // The decorators, not the handler body. Constructing the controller directly,
   // which every test above does, runs no guard at all — so removing the trip check
   // again would leave this file green. It shipped without one once.
+  describe('chat images on a message', () => {
+    const img = (name: string) => ({ filename: `stored-${name}`, originalname: name, size: 10, mimetype: 'image/png', path: `/tmp/${name}` }) as never;
+
+    it('commits every image to storage and hands the service what it needs to row them', async () => {
+      const put = vi.fn().mockResolvedValue(undefined);
+      const createMessage = vi.fn().mockReturnValue({ message: { id: 3 } });
+      const s = svc({ createMessage, broadcast: vi.fn(), notifyCollab: vi.fn() } as Partial<CollabService>);
+      await new CollabController(s, { put, delete: vi.fn() } as never).createMessage(user, '5', { text: 'look' }, [img('a.png'), img('b.png')]);
+
+      expect(put.mock.calls.map(c => c[1])).toEqual(['stored-a.png', 'stored-b.png']);
+      expect(createMessage.mock.calls[0][4]).toEqual([
+        { filename: 'stored-a.png', originalname: 'a.png', size: 10, mimetype: 'image/png' },
+        { filename: 'stored-b.png', originalname: 'b.png', size: 10, mimetype: 'image/png' },
+      ]);
+    });
+
+    it('takes back what it already committed when a later image fails to store', async () => {
+      const del = vi.fn().mockResolvedValue(undefined);
+      const put = vi.fn().mockResolvedValueOnce(undefined).mockRejectedValueOnce(new Error('disk full'));
+      const createMessage = vi.fn();
+      const s = svc({ createMessage } as Partial<CollabService>);
+
+      await expect(new CollabController(s, { put, delete: del } as never).createMessage(user, '5', { text: 'x' }, [img('a.png'), img('b.png')]))
+        .rejects.toThrow('disk full');
+      // The first one is already in storage and has to come back out; the
+      // message row was never written, so nothing would point at it.
+      expect(del.mock.calls.map(c => c[1])).toEqual(['stored-a.png']);
+      expect(createMessage).not.toHaveBeenCalled();
+    });
+
+    it('drops the stored images again when the reply target turns out to be gone', async () => {
+      const del = vi.fn().mockResolvedValue(undefined);
+      const s = svc({ createMessage: vi.fn().mockReturnValue({ error: 'reply_not_found' }) } as Partial<CollabService>);
+
+      expect(await thrownAsync(() => new CollabController(s, { put: vi.fn().mockResolvedValue(undefined), delete: del } as never)
+        .createMessage(user, '5', { text: 'x', reply_to: 99 }, [img('a.png')])))
+        .toEqual({ status: 400, body: { error: 'Reply target message not found' } });
+      expect(del.mock.calls.map(c => c[1])).toEqual(['stored-a.png']);
+    });
+
+    it('refuses an image from someone who may write but may not upload', async () => {
+      const put = vi.fn();
+      const s = svc({ canUploadFiles: vi.fn().mockReturnValue(false) } as Partial<CollabService>);
+      expect(await thrownAsync(() => new CollabController(s, { put, delete: vi.fn() } as never).createMessage(user, '5', { text: 'x' }, [img('a.png')])))
+        .toEqual({ status: 403, body: { error: 'No permission to upload files' } });
+      expect(put).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('note file filter', () => {
+    const run = (originalname: string, mimetype: string) => {
+      let outcome: { err: Error | null; ok?: boolean } = { err: null };
+      collabNoteFileFilter!({} as never, { originalname, mimetype } as never, ((err: Error | null, ok?: boolean) => { outcome = { err, ok }; }) as never);
+      return outcome;
+    };
+
+    it('takes an ordinary attachment', () => {
+      expect(run('itinerary.pdf', 'application/pdf').ok).toBe(true);
+    });
+
+    it('refuses the spellings the download route would serve as a document', () => {
+      expect(run('pwn.html', 'text/html').err).toBeInstanceOf(Error);
+      expect(run('pwn.txt', 'image/svg+xml').err).toBeInstanceOf(Error);
+      expect(run('pwn.txt', 'application/javascript').err).toBeInstanceOf(Error);
+    });
+  });
+
+  describe('chat image filter', () => {
+    const run = (originalname: string, mimetype: string) => {
+      let outcome: { err: Error | null; ok?: boolean } = { err: null };
+      collabChatImageFilter!({} as never, { originalname, mimetype } as never, ((err: Error | null, ok?: boolean) => { outcome = { err, ok }; }) as never);
+      return outcome;
+    };
+
+    it('accepts a real image', () => {
+      expect(run('holiday.jpg', 'image/jpeg').ok).toBe(true);
+      expect(run('map.PNG', 'image/png').ok).toBe(true);
+    });
+
+    it('refuses a type it does not serve', () => {
+      expect(run('notes.pdf', 'application/pdf').err).toBeInstanceOf(Error);
+    });
+
+    it('refuses a name whose extension disagrees with the type it claims', () => {
+      // The mimetype is the header the client wrote. The stored name keeps the
+      // extension of the name the client sent, and the download route decides
+      // what to serve from that extension and sends it inline, so believing the
+      // header alone served attacker HTML on our own origin.
+      for (const name of ['pwn.html', 'pwn.svg', 'pwn.js', 'pwn.htm', 'pwn']) {
+        const out = run(name, 'image/png');
+        expect(out.err, name).toBeInstanceOf(Error);
+        expect((out.err as Error & { statusCode?: number }).statusCode).toBe(400);
+      }
+    });
+  });
+
   describe('link preview guard chain', () => {
     const guardsOn = (target: object): unknown[] => (Reflect.getMetadata('__guards__', target) as unknown[]) ?? [];
 
@@ -205,7 +317,19 @@ describe('CollabController (parity with the legacy /api/trips/:tripId/collab rou
         expect(Reflect.getMetadata(TRIP_PERMISSION_KEY, handler)).toBeUndefined();
       }
       // The write siblings do demand it, so this is a deliberate split, not an omission.
-      expect(Reflect.getMetadata(TRIP_PERMISSION_KEY, CollabController.prototype.createMessage)).toBe('collab_edit');
+      expect(Reflect.getMetadata(TRIP_PERMISSION_KEY, CollabController.prototype.createNote)).toBe('collab_edit');
+    });
+
+    it('the multipart write routes carry no guard decorators, and check inside instead', () => {
+      // Guards run before the interceptor, so a refusal goes out while the client
+      // is still streaming the body and the socket dies as ECONNRESET rather than
+      // carrying the error envelope. Both of these therefore look unguarded here
+      // and do requireTrip plus the permission check in the handler; the test
+      // below proves createMessage actually refuses.
+      for (const handler of [CollabController.prototype.createMessage, CollabController.prototype.addNoteFile]) {
+        expect(Reflect.getMetadata(TRIP_PERMISSION_KEY, handler)).toBeUndefined();
+        expect(guardsOn(handler)).not.toContain(TripAccessGuard);
+      }
     });
   });
 
diff --git a/server/tests/unit/nest/spool-cleanup.interceptor.test.ts b/server/tests/unit/nest/spool-cleanup.interceptor.test.ts
new file mode 100644
index 0000000000..4a37bf90d3
--- /dev/null
+++ b/server/tests/unit/nest/spool-cleanup.interceptor.test.ts
@@ -0,0 +1,60 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { firstValueFrom, of, throwError } from 'rxjs';
+import type { CallHandler, ExecutionContext } from '@nestjs/common';
+
+const fsMock = vi.hoisted(() => ({ unlinkSync: vi.fn() }));
+vi.mock('fs', () => ({ ...fsMock, default: fsMock }));
+
+import { SpoolCleanupInterceptor } from '../../../src/nest/common/spool-cleanup.interceptor';
+
+function context(req: Record<string, unknown>): ExecutionContext {
+  return { switchToHttp: () => ({ getRequest: () => req }) } as unknown as ExecutionContext;
+}
+
+function handler(observable: ReturnType<typeof of>): CallHandler {
+  return { handle: () => observable } as CallHandler;
+}
+
+const interceptor = new SpoolCleanupInterceptor();
+
+beforeEach(() => {
+  fsMock.unlinkSync.mockReset();
+});
+
+describe('SpoolCleanupInterceptor', () => {
+  it('SPOOL-001: leaves the spool alone when the handler succeeds', async () => {
+    const req = { files: [{ path: '/tmp/a.png' }] };
+    await firstValueFrom(interceptor.intercept(context(req), handler(of('ok'))));
+    // A handler that returned owns its files and moves them itself.
+    expect(fsMock.unlinkSync).not.toHaveBeenCalled();
+  });
+
+  it('SPOOL-002: removes every spooled part when the request dies before the handler', async () => {
+    const req = { files: [{ path: '/tmp/a.png' }, { path: '/tmp/b.png' }] };
+    const boom = new Error('body rejected');
+
+    await expect(firstValueFrom(interceptor.intercept(context(req), handler(throwError(() => boom)))))
+      .rejects.toBe(boom);
+    expect(fsMock.unlinkSync.mock.calls.map(c => c[0])).toEqual(['/tmp/a.png', '/tmp/b.png']);
+  });
+
+  it('SPOOL-003: covers the single-file shape and skips a part with no path', async () => {
+    const req = { file: { path: '/tmp/one.png' }, files: [{ path: undefined }] };
+    await expect(firstValueFrom(interceptor.intercept(context(req), handler(throwError(() => new Error('x'))))))
+      .rejects.toThrow('x');
+    expect(fsMock.unlinkSync.mock.calls.map(c => c[0])).toEqual(['/tmp/one.png']);
+  });
+
+  it('SPOOL-004: a file the handler already moved does not turn into a second failure', async () => {
+    fsMock.unlinkSync.mockImplementation(() => { throw new Error('ENOENT'); });
+    const req = { files: [{ path: '/tmp/gone.png' }] };
+    await expect(firstValueFrom(interceptor.intercept(context(req), handler(throwError(() => new Error('original'))))))
+      .rejects.toThrow('original');
+  });
+
+  it('SPOOL-005: a request that carried no files at all is a no-op', async () => {
+    await expect(firstValueFrom(interceptor.intercept(context({}), handler(throwError(() => new Error('x'))))))
+      .rejects.toThrow('x');
+    expect(fsMock.unlinkSync).not.toHaveBeenCalled();
+  });
+});
diff --git a/shared/src/admin/admin.schema.ts b/shared/src/admin/admin.schema.ts
index 737ba7bbc3..fb6c2d9e19 100644
--- a/shared/src/admin/admin.schema.ts
+++ b/shared/src/admin/admin.schema.ts
@@ -84,6 +84,7 @@ export type AdminAddonUpdateRequest = z.infer<typeof adminAddonUpdateRequestSche
 export const adminCollabFeaturesRequestSchema = z.object({
   chat: z.boolean().optional(),
   notes: z.boolean().optional(),
+  links: z.boolean().optional(),
   polls: z.boolean().optional(),
   whatsnext: z.boolean().optional(),
 });
diff --git a/shared/src/collab/collab.schema.spec.ts b/shared/src/collab/collab.schema.spec.ts
index 893560fcf3..c3a2aae99a 100644
--- a/shared/src/collab/collab.schema.spec.ts
+++ b/shared/src/collab/collab.schema.spec.ts
@@ -3,6 +3,8 @@ import {
   collabNoteUpdateRequestSchema,
   collabPollCreateRequestSchema,
   collabPollVoteRequestSchema,
+  collabLinkCreateRequestSchema,
+  collabLinkUpdateRequestSchema,
   collabMessageCreateRequestSchema,
   collabReactionRequestSchema,
 } from './collab.schema';
@@ -71,11 +73,29 @@ describe('collabPollVoteRequestSchema', () => {
   });
 });
 
+describe('collabLinkCreateRequestSchema', () => {
+  it('requires a title and an http(s) URL', () => {
+    expect(collabLinkCreateRequestSchema.safeParse({ title: 'Docs', url: 'https://example.com' }).success).toBe(true);
+    expect(collabLinkCreateRequestSchema.safeParse({ title: 'Docs', url: 'ftp://example.com' }).success).toBe(false);
+    expect(collabLinkCreateRequestSchema.safeParse({ title: '  ', url: 'https://example.com' }).success).toBe(false);
+    expect(collabLinkCreateRequestSchema.safeParse({ title: 'Docs', url: 'not-a-url' }).success).toBe(false);
+  });
+});
+
+describe('collabLinkUpdateRequestSchema', () => {
+  it('allows partial updates and still rejects non-http URLs', () => {
+    expect(collabLinkUpdateRequestSchema.safeParse({ pinned: true }).success).toBe(true);
+    expect(collabLinkUpdateRequestSchema.safeParse({ url: 'https://example.com/x' }).success).toBe(true);
+    expect(collabLinkUpdateRequestSchema.safeParse({ url: 'javascript:alert(1)' }).success).toBe(false);
+  });
+});
+
 describe('collabMessageCreateRequestSchema', () => {
-  it('requires text, caps it at 5000, allows a nullable reply_to', () => {
+  it('caps text at 5000, allows empty text for image-only messages, and accepts multipart reply_to strings', () => {
     expect(collabMessageCreateRequestSchema.safeParse({ text: 'hi', reply_to: null }).success).toBe(true);
     expect(collabMessageCreateRequestSchema.safeParse({ text: 'hi', reply_to: 4 }).success).toBe(true);
-    expect(collabMessageCreateRequestSchema.safeParse({ text: '' }).success).toBe(false);
+    expect(collabMessageCreateRequestSchema.safeParse({ text: '', reply_to: '4' }).success).toBe(true);
+    expect(collabMessageCreateRequestSchema.safeParse({}).success).toBe(true);
     expect(collabMessageCreateRequestSchema.safeParse({ text: 'x'.repeat(5001) }).success).toBe(false);
   });
 });
diff --git a/shared/src/collab/collab.schema.ts b/shared/src/collab/collab.schema.ts
index b3a314ffeb..7d9a2a4977 100644
--- a/shared/src/collab/collab.schema.ts
+++ b/shared/src/collab/collab.schema.ts
@@ -48,9 +48,32 @@ export const collabPollVoteRequestSchema = z.object({
 });
 export type CollabPollVoteRequest = z.infer<typeof collabPollVoteRequestSchema>;
 
+// `z.url()` rather than `new URL(...)`: this package compiles against lib
+// ES2022 only, deliberately, so it stays free of both DOM and Node globals and
+// `URL` is not one of the names it has. The protocol check stays, because
+// z.url() alone would accept mailto: and javascript:.
+const httpUrl = z.url().refine((value) => /^https?:\/\//i.test(value.trim()), 'A valid http(s) URL is required');
+
+export const collabLinkCreateRequestSchema = z.object({
+  title: z.string().trim().min(1),
+  url: httpUrl,
+  pinned: z.union([z.boolean(), z.number()]).optional(),
+});
+export type CollabLinkCreateRequest = z.infer<typeof collabLinkCreateRequestSchema>;
+
+export const collabLinkUpdateRequestSchema = z.object({
+  title: z.string().trim().min(1).optional(),
+  url: httpUrl.optional(),
+  pinned: z.union([z.boolean(), z.number()]).optional(),
+});
+export type CollabLinkUpdateRequest = z.infer<typeof collabLinkUpdateRequestSchema>;
+
+// text may be empty when the chat message is image-only (multipart). The
+// controller still rejects a request with neither text nor files.
 export const collabMessageCreateRequestSchema = z.object({
-  text: z.string().min(1).max(5000),
-  reply_to: z.number().nullable().optional(),
+  text: z.string().max(5000).optional(),
+  // Multipart fields arrive as strings; JSON chat still sends a number/null.
+  reply_to: z.union([z.number(), z.string(), z.null()]).optional(),
 });
 export type CollabMessageCreateRequest = z.infer<typeof collabMessageCreateRequestSchema>;
 
diff --git a/shared/src/i18n/ar/collab.ts b/shared/src/i18n/ar/collab.ts
index af3879bd5c..ef5b4ef82b 100644
--- a/shared/src/i18n/ar/collab.ts
+++ b/shared/src/i18n/ar/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'الدردشة',
   'collab.tabs.notes': 'الملاحظات',
   'collab.tabs.polls': 'الاستطلاعات',
+  'collab.tabs.links': 'الروابط',
+  'collab.links.add': 'إضافة رابط',
+  'collab.chat.imageRejected': 'يُسمح فقط بصور JPEG وPNG وGIF وWebP حتى 10 ميغابايت',
+  'collab.links.cancel': 'إلغاء',
+  'collab.links.save': 'حفظ الرابط',
+  'collab.links.titlePlaceholder': 'عنوان الرابط',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'لا توجد روابط مشتركة بعد',
+  'collab.links.pin': 'تثبيت الرابط',
+  'collab.links.unpin': 'إلغاء تثبيت الرابط',
+  'collab.links.delete': 'حذف الرابط',
   'collab.whatsNext.title': 'ما التالي',
   'collab.whatsNext.today': 'اليوم',
   'collab.whatsNext.tomorrow': 'غدًا',
diff --git a/shared/src/i18n/br/collab.ts b/shared/src/i18n/br/collab.ts
index db220a4409..924019a60a 100644
--- a/shared/src/i18n/br/collab.ts
+++ b/shared/src/i18n/br/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Notas',
   'collab.tabs.polls': 'Enquetes',
+  'collab.tabs.links': 'Links',
+  'collab.links.add': 'Adicionar link',
+  'collab.chat.imageRejected': 'Apenas imagens JPEG, PNG, GIF e WebP de até 10 MB são permitidas',
+  'collab.links.cancel': 'Cancelar',
+  'collab.links.save': 'Salvar link',
+  'collab.links.titlePlaceholder': 'Título do link',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Nenhum link compartilhado ainda',
+  'collab.links.pin': 'Fixar link',
+  'collab.links.unpin': 'Desafixar link',
+  'collab.links.delete': 'Excluir link',
   'collab.whatsNext.title': 'Próximos passos',
   'collab.whatsNext.today': 'Hoje',
   'collab.whatsNext.tomorrow': 'Amanhã',
diff --git a/shared/src/i18n/ca/collab.ts b/shared/src/i18n/ca/collab.ts
index fa91870f90..55c36652f7 100644
--- a/shared/src/i18n/ca/collab.ts
+++ b/shared/src/i18n/ca/collab.ts
@@ -4,6 +4,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Missatges',
   'collab.tabs.notes': 'Notes',
   'collab.tabs.polls': 'Enquestes',
+  'collab.tabs.links': 'Enllaços',
+  'collab.links.add': 'Afegeix un enllaç',
+  'collab.chat.imageRejected': "Només s'admeten imatges JPEG, PNG, GIF i WebP de fins a 10 MB",
+  'collab.links.cancel': 'Cancel·la',
+  'collab.links.save': 'Desa l\'enllaç',
+  'collab.links.titlePlaceholder': 'Títol de l\'enllaç',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Encara no hi ha enllaços compartits',
+  'collab.links.pin': 'Fixa l\'enllaç',
+  'collab.links.unpin': 'Desfixa l\'enllaç',
+  'collab.links.delete': 'Suprimeix l\'enllaç',
   'collab.whatsNext.title': 'Què ve ara',
   'collab.whatsNext.today': 'Avui',
   'collab.whatsNext.tomorrow': 'Demà',
diff --git a/shared/src/i18n/cs/collab.ts b/shared/src/i18n/cs/collab.ts
index f21da2f4f2..9122cd561e 100644
--- a/shared/src/i18n/cs/collab.ts
+++ b/shared/src/i18n/cs/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Poznámky',
   'collab.tabs.polls': 'Hlasování',
+  'collab.tabs.links': 'Odkazy',
+  'collab.links.add': 'Přidat odkaz',
+  'collab.chat.imageRejected': 'Povoleny jsou pouze obrázky JPEG, PNG, GIF a WebP do 10 MB',
+  'collab.links.cancel': 'Zrušit',
+  'collab.links.save': 'Uložit odkaz',
+  'collab.links.titlePlaceholder': 'Název odkazu',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Zatím žádné sdílené odkazy',
+  'collab.links.pin': 'Připnout odkaz',
+  'collab.links.unpin': 'Odepnout odkaz',
+  'collab.links.delete': 'Smazat odkaz',
   'collab.whatsNext.title': 'Co následuje',
   'collab.whatsNext.today': 'Dnes',
   'collab.whatsNext.tomorrow': 'Zítra',
diff --git a/shared/src/i18n/de/collab.ts b/shared/src/i18n/de/collab.ts
index 2ab1998b64..503cf2d90a 100644
--- a/shared/src/i18n/de/collab.ts
+++ b/shared/src/i18n/de/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Notizen',
   'collab.tabs.polls': 'Umfragen',
+  'collab.tabs.links': 'Links',
+  'collab.links.add': 'Link hinzufügen',
+  'collab.chat.imageRejected': 'Nur JPEG, PNG, GIF und WebP bis 10 MB sind erlaubt',
+  'collab.links.cancel': 'Abbrechen',
+  'collab.links.save': 'Link speichern',
+  'collab.links.titlePlaceholder': 'Linktitel',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Noch keine geteilten Links',
+  'collab.links.pin': 'Link anheften',
+  'collab.links.unpin': 'Link lösen',
+  'collab.links.delete': 'Link löschen',
   'collab.whatsNext.title': 'Nächste',
   'collab.whatsNext.today': 'Heute',
   'collab.whatsNext.tomorrow': 'Morgen',
diff --git a/shared/src/i18n/en/collab.ts b/shared/src/i18n/en/collab.ts
index a0ae43c445..9d7c82f089 100644
--- a/shared/src/i18n/en/collab.ts
+++ b/shared/src/i18n/en/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Notes',
   'collab.tabs.polls': 'Polls',
+  'collab.tabs.links': 'Links',
+  'collab.links.add': 'Add link',
+  'collab.chat.imageRejected': 'Only JPEG, PNG, GIF and WebP images up to 10 MB are allowed',
+  'collab.links.cancel': 'Cancel',
+  'collab.links.save': 'Save link',
+  'collab.links.titlePlaceholder': 'Link title',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'No shared links yet',
+  'collab.links.pin': 'Pin link',
+  'collab.links.unpin': 'Unpin link',
+  'collab.links.delete': 'Delete link',
   'collab.whatsNext.title': "What's Next",
   'collab.whatsNext.today': 'Today',
   'collab.whatsNext.tomorrow': 'Tomorrow',
diff --git a/shared/src/i18n/es/collab.ts b/shared/src/i18n/es/collab.ts
index 40191cda47..f4ee0657e3 100644
--- a/shared/src/i18n/es/collab.ts
+++ b/shared/src/i18n/es/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Mensajes',
   'collab.tabs.notes': 'Notas',
   'collab.tabs.polls': 'Encuestas',
+  'collab.tabs.links': 'Enlaces',
+  'collab.links.add': 'Añadir enlace',
+  'collab.chat.imageRejected': 'Solo se permiten imágenes JPEG, PNG, GIF y WebP de hasta 10 MB',
+  'collab.links.cancel': 'Cancelar',
+  'collab.links.save': 'Guardar enlace',
+  'collab.links.titlePlaceholder': 'Título del enlace',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Aún no hay enlaces compartidos',
+  'collab.links.pin': 'Fijar enlace',
+  'collab.links.unpin': 'Desfijar enlace',
+  'collab.links.delete': 'Eliminar enlace',
   'collab.whatsNext.title': 'Qué viene ahora',
   'collab.whatsNext.today': 'Hoy',
   'collab.whatsNext.tomorrow': 'Mañana',
diff --git a/shared/src/i18n/fr/collab.ts b/shared/src/i18n/fr/collab.ts
index 0dcb039040..fdc7b67760 100644
--- a/shared/src/i18n/fr/collab.ts
+++ b/shared/src/i18n/fr/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Discussion',
   'collab.tabs.notes': 'Notes',
   'collab.tabs.polls': 'Sondages',
+  'collab.tabs.links': 'Liens',
+  'collab.links.add': 'Ajouter un lien',
+  'collab.chat.imageRejected': "Seules les images JPEG, PNG, GIF et WebP jusqu'à 10 Mo sont autorisées",
+  'collab.links.cancel': 'Annuler',
+  'collab.links.save': 'Enregistrer le lien',
+  'collab.links.titlePlaceholder': 'Titre du lien',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Aucun lien partagé pour le moment',
+  'collab.links.pin': 'Épingler le lien',
+  'collab.links.unpin': 'Désépingler le lien',
+  'collab.links.delete': 'Supprimer le lien',
   'collab.whatsNext.title': 'À venir',
   'collab.whatsNext.today': "Aujourd'hui",
   'collab.whatsNext.tomorrow': 'Demain',
diff --git a/shared/src/i18n/gr/collab.ts b/shared/src/i18n/gr/collab.ts
index b44dc4a790..7eb0300b07 100644
--- a/shared/src/i18n/gr/collab.ts
+++ b/shared/src/i18n/gr/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Συνομιλία',
   'collab.tabs.notes': 'Σημειώσεις',
   'collab.tabs.polls': 'Δημοσκοπήσεις',
+  'collab.tabs.links': 'Σύνδεσμοι',
+  'collab.links.add': 'Προσθήκη συνδέσμου',
+  'collab.chat.imageRejected': 'Επιτρέπονται μόνο εικόνες JPEG, PNG, GIF και WebP έως 10 MB',
+  'collab.links.cancel': 'Ακύρωση',
+  'collab.links.save': 'Αποθήκευση συνδέσμου',
+  'collab.links.titlePlaceholder': 'Τίτλος συνδέσμου',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Δεν υπάρχουν κοινόχρηστοι σύνδεσμοι ακόμη',
+  'collab.links.pin': 'Καρφίτσωμα συνδέσμου',
+  'collab.links.unpin': 'Ξεκαρφίτσωμα συνδέσμου',
+  'collab.links.delete': 'Διαγραφή συνδέσμου',
   'collab.whatsNext.title': 'Τι Επόμενο',
   'collab.whatsNext.today': 'Σήμερα',
   'collab.whatsNext.tomorrow': 'Αύριο',
diff --git a/shared/src/i18n/hu/collab.ts b/shared/src/i18n/hu/collab.ts
index 479345931f..b31eba80c6 100644
--- a/shared/src/i18n/hu/collab.ts
+++ b/shared/src/i18n/hu/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Csevegés',
   'collab.tabs.notes': 'Jegyzetek',
   'collab.tabs.polls': 'Szavazások',
+  'collab.tabs.links': 'Linkek',
+  'collab.links.add': 'Link hozzáadása',
+  'collab.chat.imageRejected': 'Csak legfeljebb 10 MB méretű JPEG, PNG, GIF és WebP képek engedélyezettek',
+  'collab.links.cancel': 'Mégse',
+  'collab.links.save': 'Link mentése',
+  'collab.links.titlePlaceholder': 'Link címe',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Még nincsenek megosztott linkek',
+  'collab.links.pin': 'Link rögzítése',
+  'collab.links.unpin': 'Link feloldása',
+  'collab.links.delete': 'Link törlése',
   'collab.whatsNext.title': 'Mi következik',
   'collab.whatsNext.today': 'Ma',
   'collab.whatsNext.tomorrow': 'Holnap',
diff --git a/shared/src/i18n/id/collab.ts b/shared/src/i18n/id/collab.ts
index 65076c375e..908b2389cd 100644
--- a/shared/src/i18n/id/collab.ts
+++ b/shared/src/i18n/id/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Catatan',
   'collab.tabs.polls': 'Polling',
+  'collab.tabs.links': 'Tautan',
+  'collab.links.add': 'Tambah tautan',
+  'collab.chat.imageRejected': 'Hanya gambar JPEG, PNG, GIF, dan WebP hingga 10 MB yang diizinkan',
+  'collab.links.cancel': 'Batal',
+  'collab.links.save': 'Simpan tautan',
+  'collab.links.titlePlaceholder': 'Judul tautan',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Belum ada tautan bersama',
+  'collab.links.pin': 'Sematkan tautan',
+  'collab.links.unpin': 'Lepas sematan tautan',
+  'collab.links.delete': 'Hapus tautan',
   'collab.whatsNext.title': 'Berikutnya',
   'collab.whatsNext.today': 'Hari ini',
   'collab.whatsNext.tomorrow': 'Besok',
diff --git a/shared/src/i18n/it/collab.ts b/shared/src/i18n/it/collab.ts
index d050e59f66..26e94fe2fc 100644
--- a/shared/src/i18n/it/collab.ts
+++ b/shared/src/i18n/it/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Note',
   'collab.tabs.polls': 'Sondaggi',
+  'collab.tabs.links': 'Link',
+  'collab.links.add': 'Aggiungi link',
+  'collab.chat.imageRejected': 'Sono ammesse solo immagini JPEG, PNG, GIF e WebP fino a 10 MB',
+  'collab.links.cancel': 'Annulla',
+  'collab.links.save': 'Salva link',
+  'collab.links.titlePlaceholder': 'Titolo del link',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Nessun link condiviso',
+  'collab.links.pin': 'Fissa link',
+  'collab.links.unpin': 'Sblocca link',
+  'collab.links.delete': 'Elimina link',
   'collab.whatsNext.title': "Cosa c'è dopo",
   'collab.whatsNext.today': 'Oggi',
   'collab.whatsNext.tomorrow': 'Domani',
diff --git a/shared/src/i18n/ja/collab.ts b/shared/src/i18n/ja/collab.ts
index 8d04ec2bda..bc410289ac 100644
--- a/shared/src/i18n/ja/collab.ts
+++ b/shared/src/i18n/ja/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'チャット',
   'collab.tabs.notes': 'ノート',
   'collab.tabs.polls': '投票',
+  'collab.tabs.links': 'リンク',
+  'collab.links.add': 'リンクを追加',
+  'collab.chat.imageRejected': 'JPEG、PNG、GIF、WebP の画像のみ、10 MB までです',
+  'collab.links.cancel': 'キャンセル',
+  'collab.links.save': 'リンクを保存',
+  'collab.links.titlePlaceholder': 'リンクのタイトル',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': '共有リンクはまだありません',
+  'collab.links.pin': 'リンクを固定',
+  'collab.links.unpin': 'リンクの固定を解除',
+  'collab.links.delete': 'リンクを削除',
   'collab.whatsNext.title': '次にすること',
   'collab.whatsNext.today': '今日',
   'collab.whatsNext.tomorrow': '明日',
diff --git a/shared/src/i18n/ko/collab.ts b/shared/src/i18n/ko/collab.ts
index 8d09c35e90..fe2d9279ef 100644
--- a/shared/src/i18n/ko/collab.ts
+++ b/shared/src/i18n/ko/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': '채팅',
   'collab.tabs.notes': '메모',
   'collab.tabs.polls': '투표',
+  'collab.tabs.links': '링크',
+  'collab.links.add': '링크 추가',
+  'collab.chat.imageRejected': 'JPEG, PNG, GIF, WebP 이미지만 최대 10 MB까지 허용됩니다',
+  'collab.links.cancel': '취소',
+  'collab.links.save': '링크 저장',
+  'collab.links.titlePlaceholder': '링크 제목',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': '공유된 링크가 아직 없습니다',
+  'collab.links.pin': '링크 고정',
+  'collab.links.unpin': '링크 고정 해제',
+  'collab.links.delete': '링크 삭제',
   'collab.whatsNext.title': '다음 할 일',
   'collab.whatsNext.today': '오늘',
   'collab.whatsNext.tomorrow': '내일',
diff --git a/shared/src/i18n/nl/collab.ts b/shared/src/i18n/nl/collab.ts
index b3a6792e2f..37fa70836c 100644
--- a/shared/src/i18n/nl/collab.ts
+++ b/shared/src/i18n/nl/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chat',
   'collab.tabs.notes': 'Notities',
   'collab.tabs.polls': 'Polls',
+  'collab.tabs.links': 'Links',
+  'collab.links.add': 'Link toevoegen',
+  'collab.chat.imageRejected': 'Alleen JPEG-, PNG-, GIF- en WebP-afbeeldingen tot 10 MB zijn toegestaan',
+  'collab.links.cancel': 'Annuleren',
+  'collab.links.save': 'Link opslaan',
+  'collab.links.titlePlaceholder': 'Linktitel',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Nog geen gedeelde links',
+  'collab.links.pin': 'Link vastmaken',
+  'collab.links.unpin': 'Link losmaken',
+  'collab.links.delete': 'Link verwijderen',
   'collab.whatsNext.title': 'Wat komt er',
   'collab.whatsNext.today': 'Vandaag',
   'collab.whatsNext.tomorrow': 'Morgen',
diff --git a/shared/src/i18n/pl/collab.ts b/shared/src/i18n/pl/collab.ts
index 483eac4922..36abbc523b 100644
--- a/shared/src/i18n/pl/collab.ts
+++ b/shared/src/i18n/pl/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Czat',
   'collab.tabs.notes': 'Notatki',
   'collab.tabs.polls': 'Ankiety',
+  'collab.tabs.links': 'Linki',
+  'collab.links.add': 'Dodaj link',
+  'collab.chat.imageRejected': 'Dozwolone są tylko obrazy JPEG, PNG, GIF i WebP do 10 MB',
+  'collab.links.cancel': 'Anuluj',
+  'collab.links.save': 'Zapisz link',
+  'collab.links.titlePlaceholder': 'Tytuł linku',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Brak udostępnionych linków',
+  'collab.links.pin': 'Przypnij link',
+  'collab.links.unpin': 'Odepnij link',
+  'collab.links.delete': 'Usuń link',
   'collab.whatsNext.title': 'Co dalej',
   'collab.whatsNext.today': 'Dzisiaj',
   'collab.whatsNext.tomorrow': 'Jutro',
diff --git a/shared/src/i18n/ru/collab.ts b/shared/src/i18n/ru/collab.ts
index 7d5ac3917b..6d261795b8 100644
--- a/shared/src/i18n/ru/collab.ts
+++ b/shared/src/i18n/ru/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Чат',
   'collab.tabs.notes': 'Заметки',
   'collab.tabs.polls': 'Опросы',
+  'collab.tabs.links': 'Ссылки',
+  'collab.links.add': 'Добавить ссылку',
+  'collab.chat.imageRejected': 'Допускаются только изображения JPEG, PNG, GIF и WebP размером до 10 МБ',
+  'collab.links.cancel': 'Отмена',
+  'collab.links.save': 'Сохранить ссылку',
+  'collab.links.titlePlaceholder': 'Название ссылки',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Пока нет общих ссылок',
+  'collab.links.pin': 'Закрепить ссылку',
+  'collab.links.unpin': 'Открепить ссылку',
+  'collab.links.delete': 'Удалить ссылку',
   'collab.whatsNext.title': 'Что дальше',
   'collab.whatsNext.today': 'Сегодня',
   'collab.whatsNext.tomorrow': 'Завтра',
diff --git a/shared/src/i18n/sv/collab.ts b/shared/src/i18n/sv/collab.ts
index 114f9452a5..5703978141 100644
--- a/shared/src/i18n/sv/collab.ts
+++ b/shared/src/i18n/sv/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Chatt',
   'collab.tabs.notes': 'Noteringar',
   'collab.tabs.polls': 'Omröstningar',
+  'collab.tabs.links': 'Länkar',
+  'collab.links.add': 'Lägg till länk',
+  'collab.chat.imageRejected': 'Endast JPEG-, PNG-, GIF- och WebP-bilder upp till 10 MB tillåts',
+  'collab.links.cancel': 'Avbryt',
+  'collab.links.save': 'Spara länk',
+  'collab.links.titlePlaceholder': 'Länktitel',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Inga delade länkar än',
+  'collab.links.pin': 'Fäst länk',
+  'collab.links.unpin': 'Lossa länk',
+  'collab.links.delete': 'Ta bort länk',
   'collab.whatsNext.title': 'Vad händer härnäst?',
   'collab.whatsNext.today': 'Idag',
   'collab.whatsNext.tomorrow': 'I morgon',
diff --git a/shared/src/i18n/tr/collab.ts b/shared/src/i18n/tr/collab.ts
index 3543511346..a6b9f0de21 100644
--- a/shared/src/i18n/tr/collab.ts
+++ b/shared/src/i18n/tr/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Sohbet',
   'collab.tabs.notes': 'Notlar',
   'collab.tabs.polls': 'Anketler',
+  'collab.tabs.links': 'Bağlantılar',
+  'collab.links.add': 'Bağlantı ekle',
+  'collab.chat.imageRejected': 'Yalnızca 10 MB boyutuna kadar JPEG, PNG, GIF ve WebP görselleri kabul edilir',
+  'collab.links.cancel': 'İptal',
+  'collab.links.save': 'Bağlantıyı kaydet',
+  'collab.links.titlePlaceholder': 'Bağlantı başlığı',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Henüz paylaşılan bağlantı yok',
+  'collab.links.pin': 'Bağlantıyı sabitle',
+  'collab.links.unpin': 'Sabitlemeyi kaldır',
+  'collab.links.delete': 'Bağlantıyı sil',
   'collab.whatsNext.title': "What's Next",
   'collab.whatsNext.today': 'Bugün',
   'collab.whatsNext.tomorrow': 'Yarın',
diff --git a/shared/src/i18n/uk/collab.ts b/shared/src/i18n/uk/collab.ts
index ef343465f7..3763095ff2 100644
--- a/shared/src/i18n/uk/collab.ts
+++ b/shared/src/i18n/uk/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Чат',
   'collab.tabs.notes': 'Нотатки',
   'collab.tabs.polls': 'Опитування',
+  'collab.tabs.links': 'Посилання',
+  'collab.links.add': 'Додати посилання',
+  'collab.chat.imageRejected': 'Дозволено лише зображення JPEG, PNG, GIF і WebP розміром до 10 МБ',
+  'collab.links.cancel': 'Скасувати',
+  'collab.links.save': 'Зберегти посилання',
+  'collab.links.titlePlaceholder': 'Назва посилання',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Ще немає спільних посилань',
+  'collab.links.pin': 'Закріпити посилання',
+  'collab.links.unpin': 'Відкріпити посилання',
+  'collab.links.delete': 'Видалити посилання',
   'collab.whatsNext.title': 'Що далі',
   'collab.whatsNext.today': 'Сьогодні',
   'collab.whatsNext.tomorrow': 'Завтра',
diff --git a/shared/src/i18n/vi/collab.ts b/shared/src/i18n/vi/collab.ts
index 361b8f8668..4294347037 100644
--- a/shared/src/i18n/vi/collab.ts
+++ b/shared/src/i18n/vi/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': 'Trò chuyện',
   'collab.tabs.notes': 'Ghi chú',
   'collab.tabs.polls': 'Thăm dò ý kiến',
+  'collab.tabs.links': 'Liên kết',
+  'collab.links.add': 'Thêm liên kết',
+  'collab.chat.imageRejected': 'Chỉ chấp nhận ảnh JPEG, PNG, GIF và WebP tối đa 10 MB',
+  'collab.links.cancel': 'Hủy',
+  'collab.links.save': 'Lưu liên kết',
+  'collab.links.titlePlaceholder': 'Tiêu đề liên kết',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': 'Chưa có liên kết được chia sẻ',
+  'collab.links.pin': 'Ghim liên kết',
+  'collab.links.unpin': 'Bỏ ghim liên kết',
+  'collab.links.delete': 'Xóa liên kết',
   'collab.whatsNext.title': 'Tiếp theo là gì',
   'collab.whatsNext.today': 'Hôm nay',
   'collab.whatsNext.tomorrow': 'Ngày mai',
diff --git a/shared/src/i18n/zh-TW/collab.ts b/shared/src/i18n/zh-TW/collab.ts
index 28b57cda87..cfd4487638 100644
--- a/shared/src/i18n/zh-TW/collab.ts
+++ b/shared/src/i18n/zh-TW/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': '聊天',
   'collab.tabs.notes': '筆記',
   'collab.tabs.polls': '投票',
+  'collab.tabs.links': '連結',
+  'collab.links.add': '新增連結',
+  'collab.chat.imageRejected': '僅支援 10 MB 以內的 JPEG、PNG、GIF 和 WebP 圖片',
+  'collab.links.cancel': '取消',
+  'collab.links.save': '儲存連結',
+  'collab.links.titlePlaceholder': '連結標題',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': '尚無共享連結',
+  'collab.links.pin': '釘選連結',
+  'collab.links.unpin': '取消釘選連結',
+  'collab.links.delete': '刪除連結',
   'collab.whatsNext.title': '接下來',
   'collab.whatsNext.today': '今天',
   'collab.whatsNext.tomorrow': '明天',
diff --git a/shared/src/i18n/zh/collab.ts b/shared/src/i18n/zh/collab.ts
index dfaf8cd706..f603b0815e 100644
--- a/shared/src/i18n/zh/collab.ts
+++ b/shared/src/i18n/zh/collab.ts
@@ -12,6 +12,17 @@ const collab: TranslationStrings = {
   'collab.tabs.chat': '聊天',
   'collab.tabs.notes': '笔记',
   'collab.tabs.polls': '投票',
+  'collab.tabs.links': '链接',
+  'collab.links.add': '添加链接',
+  'collab.chat.imageRejected': '仅支持 10 MB 以内的 JPEG、PNG、GIF 和 WebP 图片',
+  'collab.links.cancel': '取消',
+  'collab.links.save': '保存链接',
+  'collab.links.titlePlaceholder': '链接标题',
+  'collab.links.urlPlaceholder': 'https://...',
+  'collab.links.empty': '还没有共享链接',
+  'collab.links.pin': '固定链接',
+  'collab.links.unpin': '取消固定链接',
+  'collab.links.delete': '删除链接',
   'collab.whatsNext.title': '接下来',
   'collab.whatsNext.today': '今天',
   'collab.whatsNext.tomorrow': '明天',
diff --git a/shared/src/realtime/events.schema.spec.ts b/shared/src/realtime/events.schema.spec.ts
index 27884ece29..826c5373bb 100644
--- a/shared/src/realtime/events.schema.spec.ts
+++ b/shared/src/realtime/events.schema.spec.ts
@@ -73,6 +73,9 @@ const FIXTURES: Record<TrekWsEventName, Record<string, unknown>> = {
   'collab:note:created': { note: { id: 3 } },
   'collab:note:updated': { note: { id: 3 } },
   'collab:note:deleted': { noteId: 3 },
+  'collab:link:created': { link: { id: 4, title: 'Ferry', url: 'https://example.com' } },
+  'collab:link:updated': { link: { id: 4, title: 'Ferry', url: 'https://example.com' } },
+  'collab:link:deleted': { linkId: 4 },
   'collab:poll:created': { poll: { id: 2 } },
   'collab:poll:voted': { poll: { id: 2 } },
   'collab:poll:closed': { poll: { id: 2 } },
@@ -135,11 +138,11 @@ const DRIFT_VARIANTS: Partial<Record<TrekWsEventName, Record<string, unknown>[]>
 };
 
 describe('@trek/shared realtime event registry', () => {
-  it('WSEVT-REG-001: pins the authoritative inventory counts (66 trip + 32 user = 98)', () => {
-    // 66th trip event: packing:bag-totals (#2191).
-    expect(TREK_WS_TRIP_EVENT_NAMES).toHaveLength(66);
+  it('WSEVT-REG-001: pins the authoritative inventory counts (69 trip + 32 user = 101)', () => {
+    // 67th to 69th trip event: the three collab:link:* a shared link emits.
+    expect(TREK_WS_TRIP_EVENT_NAMES).toHaveLength(69);
     expect(TREK_WS_USER_EVENT_NAMES).toHaveLength(32);
-    expect(TREK_WS_EVENT_NAMES).toHaveLength(98);
+    expect(TREK_WS_EVENT_NAMES).toHaveLength(101);
   });
 
   it('WSEVT-REG-002: every name is domain:action shaped and outside the reserved plugin: namespace', () => {
diff --git a/shared/src/realtime/events.schema.ts b/shared/src/realtime/events.schema.ts
index 4c721e0708..378e17733c 100644
--- a/shared/src/realtime/events.schema.ts
+++ b/shared/src/realtime/events.schema.ts
@@ -215,6 +215,9 @@ export const TREK_WS_EVENTS = {
   'collab:note:created': { scope: 'trip', payload: z.object({ note: entity }) },
   'collab:note:updated': { scope: 'trip', payload: z.object({ note: entity }) },
   'collab:note:deleted': { scope: 'trip', payload: z.object({ noteId: id }) },
+  'collab:link:created': { scope: 'trip', payload: z.object({ link: entity }) },
+  'collab:link:updated': { scope: 'trip', payload: z.object({ link: entity }) },
+  'collab:link:deleted': { scope: 'trip', payload: z.object({ linkId: id }) },
   'collab:poll:created': { scope: 'trip', payload: z.object({ poll: entity }) },
   'collab:poll:voted': { scope: 'trip', payload: z.object({ poll: entity }) },
   'collab:poll:closed': { scope: 'trip', payload: z.object({ poll: entity }) },