@decentnetwork/beagle 0.1.119 → 0.1.121

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.119";
+window.__DK_UI_VERSION="0.1.121";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js

package/dist/embedded-host.js

@@ -617,6 +617,20 @@ export class EmbeddedHost {
                 });
                 return {};
             }
+            case "chat-retry": {
+                // Drain oldest-first (the named message among them) rather than sending
+                // that one message alone: a retry must not let a newer message overtake
+                // an older one in the same thread. The daemon path behaves the same.
+                if (!this.#sessionUsable(uid))
+                    throw new Error("Peer is not online yet");
+                await this.#chainFlush(uid);
+                const still = this.#messages.queuedOutgoing(uid);
+                const id = typeof req.id === "string" ? req.id : undefined;
+                if (id && still.some((m) => m.id === id)) {
+                    throw new Error("Still could not deliver it — it stays queued and will be retried");
+                }
+                return { queued: still.length };
+            }
             case "chat-log-local":
                 this.#messages.append(uid, req.dir ?? "in", String(req.text ?? ""), Date.now());
                 this.#meta.ensure(uid);

package/dist/friend-store.d.ts

@@ -0,0 +1,25 @@
+export interface FriendStoreEntry {
+    requestedAt?: number;
+    acceptedAt?: number;
+    /** CryptoPunks id the friend advertised in its userinfo (Beagle's avatar). */
+    punkId?: number;
+    platform?: string;
+    appVersion?: string;
+}
+/** A punk id as the store or a backend may carry it: a finite non-negative
+ *  number. Punk 0 is a real CryptoPunk; a string or a negative is not one. */
+export declare function punkIdOf(v: unknown): number | undefined;
+/** Parse the store file's JSON (an array, `{friends:[…]}`, or an object keyed
+ *  by id — the SDK has written all three) into a map by userid. */
+export declare function parseFriendStore(raw: unknown): Map<string, FriendStoreEntry>;
+/** The friend store next to `keyFile`, by userid. Unreadable or absent (a
+ *  fresh install has no friends yet): whatever we last read, else nothing —
+ *  the list still renders, just without stamps or pushed avatars. */
+export declare function readFriendStore(keyFile: string | undefined): Map<string, FriendStoreEntry>;
+/** Which avatar to show for a friend. What they advertised over Carrier wins
+ *  over the directory: it is what they are using on their device right now,
+ *  it needs no gateway, and it is the only avatar a friend who never
+ *  registered a beagles.eth name will ever have. The backend's own report
+ *  first, then the SDK's store on disk (an older daemon reports none), then
+ *  the beagles.eth record. */
+export declare function pickPunk(pushed: unknown, stored: number | undefined, directory: number | null | undefined): number | null;

package/dist/friend-store.js

@@ -0,0 +1,75 @@
+// The SDK's own friend store (`<keyFile>.friends.json`, next to the identity)
+// is the source of truth both backends write, and it is a file in our own
+// config dir, so the UI server reads it for what the backend's friend list
+// does not report. Two things live here:
+//
+//  - the stamps (requestedAt / acceptedAt): a daemon backend reports only
+//    acceptedAt (as lastSeen) and nothing for a request we sent, so a friend
+//    just added had no stamp at all and sorted to the bottom;
+//  - what the friend pushed about itself (punk avatar, platform, app
+//    version): lan ≤ 0.1.308 dropped these from its friends-list, so on a
+//    daemon backend only a beagles.eth record could supply an avatar — on
+//    mac-dev 8 of 16 pushed punks never reached the screen (2026-10-31).
+//
+// Cached by mtime: the list is polled every 2.5s per tab.
+import { readFileSync, statSync } from "node:fs";
+/** A punk id as the store or a backend may carry it: a finite non-negative
+ *  number. Punk 0 is a real CryptoPunk; a string or a negative is not one. */
+export function punkIdOf(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : undefined;
+}
+/** Parse the store file's JSON (an array, `{friends:[…]}`, or an object keyed
+ *  by id — the SDK has written all three) into a map by userid. */
+export function parseFriendStore(raw) {
+    const recs = Array.isArray(raw)
+        ? raw
+        : raw && typeof raw === "object" && Array.isArray(raw.friends)
+            ? raw.friends
+            : Object.values(raw ?? {});
+    const map = new Map();
+    for (const r of recs) {
+        if (!r || typeof r !== "object")
+            continue;
+        const id = r.userid || r.pubkey;
+        if (!id)
+            continue;
+        map.set(id, {
+            requestedAt: typeof r.requestedAt === "number" ? r.requestedAt : undefined,
+            acceptedAt: typeof r.acceptedAt === "number" ? r.acceptedAt : undefined,
+            punkId: punkIdOf(r.punkId),
+            platform: typeof r.platform === "string" ? r.platform : undefined,
+            appVersion: typeof r.appVersion === "string" ? r.appVersion : undefined,
+        });
+    }
+    return map;
+}
+let cache = null;
+/** The friend store next to `keyFile`, by userid. Unreadable or absent (a
+ *  fresh install has no friends yet): whatever we last read, else nothing —
+ *  the list still renders, just without stamps or pushed avatars. */
+export function readFriendStore(keyFile) {
+    const empty = new Map();
+    if (!keyFile)
+        return empty;
+    const path = `${keyFile}.friends.json`;
+    try {
+        const st = statSync(path);
+        if (cache && cache.path === path && cache.mtimeMs === st.mtimeMs)
+            return cache.map;
+        const map = parseFriendStore(JSON.parse(readFileSync(path, "utf-8")));
+        cache = { path, mtimeMs: st.mtimeMs, map };
+        return map;
+    }
+    catch {
+        return cache?.path === path ? cache.map : empty;
+    }
+}
+/** Which avatar to show for a friend. What they advertised over Carrier wins
+ *  over the directory: it is what they are using on their device right now,
+ *  it needs no gateway, and it is the only avatar a friend who never
+ *  registered a beagles.eth name will ever have. The backend's own report
+ *  first, then the SDK's store on disk (an older daemon reports none), then
+ *  the beagles.eth record. */
+export function pickPunk(pushed, stored, directory) {
+    return punkIdOf(pushed) ?? stored ?? directory ?? null;
+}

package/dist/ipc.d.ts

@@ -1,6 +1,6 @@
 /** Ops the daemon answers. Every one is peer-level — none of them needs the
  *  TUN — which is what makes the beagle/decentlan split possible at all. */
-export type IpcOp = "ping" | "diag" | "friend-request" | "friends-pending" | "friends-accept" | "friends-reject" | "friends-list" | "friend-remove" | "friend-set-alias" | "friends-autoaccept" | "set-profile" | "sign" | "chat-send" | "chat-history" | "chat-log-local" | "chat-mark-read" | "file-send" | "file-delete" | "file-cancel" | "file-retry" | "file-log-local" | "call-signal" | "call-poll";
+export type IpcOp = "ping" | "diag" | "friend-request" | "friends-pending" | "friends-accept" | "friends-reject" | "friends-list" | "friend-remove" | "friend-set-alias" | "friends-autoaccept" | "set-profile" | "sign" | "chat-send" | "chat-history" | "chat-log-local" | "chat-mark-read" | "chat-retry" | "file-send" | "file-delete" | "file-cancel" | "file-retry" | "file-log-local" | "call-signal" | "call-poll";
 export interface IpcRequest {
     op: IpcOp;
     address?: string;

package/dist/server.js

@@ -25,6 +25,7 @@ import * as peerAddr from "@decentnetwork/peer";
 import { bridgeRoster } from "./bridge-roster.js";
 import { isSupervised } from "./relaunch.js";
 import { historyStats } from "./assistant-stats.js";
+import { readFriendStore, pickPunk } from "./friend-store.js";
 import { createDiscoverFetch } from "./discover-cache.js";
 import { applyWalletBind } from "@decentnetwork/beagle-ui/wallet-proof";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
@@ -61,50 +62,6 @@ async function ensFetchJson(path) {
         clearTimeout(timer);
     }
 }
-/** requestedAt / acceptedAt per friend, read from the SDK's own friend store
- *  (`<keyFile>.friends.json`, next to the identity). The daemon's friends-list
- *  reports neither for a request we sent and only acceptedAt (as lastSeen)
- *  otherwise, so a friend just added had no stamp at all and sorted to the
- *  bottom — the third time this was reported. The store is the source of
- *  truth both backends write, and it is a file in our own config dir, so
- *  read it. Cached by mtime: the list is polled every 2.5s per tab. */
-let friendStampsCache = null;
-function friendStoreStamps(keyFile) {
-    const empty = new Map();
-    if (!keyFile)
-        return empty;
-    const path = `${keyFile}.friends.json`;
-    try {
-        const st = statSync(path);
-        if (friendStampsCache && friendStampsCache.mtimeMs === st.mtimeMs)
-            return friendStampsCache.map;
-        const raw = JSON.parse(readFileSync(path, "utf-8"));
-        const recs = Array.isArray(raw)
-            ? raw
-            : raw && typeof raw === "object" && Array.isArray(raw.friends)
-                ? raw.friends
-                : Object.values(raw ?? {});
-        const map = new Map();
-        for (const r of recs) {
-            if (!r || typeof r !== "object")
-                continue;
-            const id = r.userid || r.pubkey;
-            if (!id)
-                continue;
-            map.set(id, {
-                requestedAt: typeof r.requestedAt === "number" ? r.requestedAt : undefined,
-                acceptedAt: typeof r.acceptedAt === "number" ? r.acceptedAt : undefined,
-            });
-        }
-        friendStampsCache = { mtimeMs: st.mtimeMs, map };
-        return map;
-    }
-    catch {
-        // Unreadable or absent (a fresh install has no friends yet): whatever we
-        // last read, else nothing — the list still renders, just without stamps.
-        return friendStampsCache?.map ?? empty;
-    }
-}
 /** The machine-local service-peer overlay. Absent file = nothing adopted yet,
  *  which is the normal state, not an error. */
 function readLocalServicePeers(path) {
@@ -2071,7 +2028,7 @@ export function startBeagleServer(opts) {
                     beagleVer: beagleVersion(),
                 };
                 const fl = (flist.ok ? (flist.data?.friends ?? []) : []);
-                const stamps = friendStoreStamps(opts.callIce?.keyFile);
+                const stamps = readFriendStore(opts.callIce?.keyFile);
                 const peers = fl.map((f) => {
                     const uid = f.userid ?? "";
                     const sess = sessByUserid.get(uid);
@@ -2126,11 +2083,13 @@ export function startBeagleServer(opts) {
                         requestedAt: f.requestedAt ?? stamp?.requestedAt ?? 0,
                         wire: "163",
                         avatarUrl: ensPub.get(uid)?.avatarUrl ?? null,
-                        // What they advertised over Carrier wins over the directory: it is
-                        // what they are using on their device right now, it needs no
-                        // gateway, and it is the only avatar a friend who never registered
-                        // a beagles.eth name will ever have.
-                        punkId: f.punkId ?? ensPub.get(uid)?.punkId ?? null,
+                        // What they advertised over Carrier wins over the directory (see
+                        // pickPunk). The daemon's list only carries the pushed punk from
+                        // lan 0.1.309; the SDK's store on disk covers an older daemon.
+                        punkId: pickPunk(f.punkId, stamp?.punkId, ensPub.get(uid)?.punkId),
+                        // The client they advertised with their profile, for the UI.
+                        platform: f.platform ?? stamp?.platform ?? null,
+                        appVersion: f.appVersion ?? stamp?.appVersion ?? null,
                     };
                 });
                 const pend = pending.ok ? (pending.data?.pending ?? []) : [];
@@ -2339,7 +2298,7 @@ export function startBeagleServer(opts) {
                     opts.call({ op: "friends-list" }),
                     ensPublicByUserid(300),
                 ]);
-                const stamps = friendStoreStamps(opts.callIce?.keyFile);
+                const stamps = readFriendStore(opts.callIce?.keyFile);
                 const stats = historyStats(opts.messagesPath);
                 const fl = flist.ok ? (flist.data?.friends ?? []) : [];
                 const friends = fl.map((f) => {
@@ -2448,6 +2407,17 @@ export function startBeagleServer(opts) {
                 sendJson(res, r.ok ? 200 : 400, r);
                 return;
             }
+            // The UI has posted this since 0.1.119, but there was no route and no
+            // daemon op behind it: the retry button on a queued message 404'd, so a
+            // message that failed while the friend stayed connected had no way out
+            // at all (mac-dev, 2026-10-31). Needs @decentnetwork/lan >= 0.1.308 in
+            // daemon mode; embedded mode handles it in-process.
+            if (req.method === "POST" && url === "/api/chat-retry") {
+                const { userid, id } = await readBody(req);
+                const r = await opts.call({ op: "chat-retry", userid, id });
+                sendJson(res, r.ok ? 200 : 400, r);
+                return;
+            }
             if (req.method === "POST" && url === "/api/chat-log-local") {
                 const { userid, dir, text } = await readBody(req);
                 const r = await opts.call({ op: "chat-log-local", userid, dir: dir === "out" ? "out" : "in", text });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.119",
+  "version": "0.1.121",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",

package/dist/chat-components.d.ts

@@ -1,67 +0,0 @@
-/** Custom packet id for the components channel.
- *
- *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
- *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
- *  first free slot. Clients that don't implement this id never see the packet,
- *  which is exactly the backward-compatibility story we want. */
-export declare const PACKET_ID_CHAT_COMPONENTS = 165;
-/** Payload version. Receivers ignore payloads they don't know how to read
- *  rather than best-effort parsing a future shape. */
-export declare const COMPONENTS_WIRE_VERSION = 1;
-export declare const MAX_COMPONENTS = 12;
-export declare const MAX_OPTIONS = 40;
-export declare const MAX_LABEL_LEN = 120;
-export declare const MAX_ID_LEN = 64;
-export declare const MAX_VALUE_LEN = 512;
-export declare const MAX_CUSTOM_ID_LEN = 128;
-/** Hard ceiling on a decoded payload before we even try to parse it. */
-export declare const MAX_PAYLOAD_BYTES: number;
-export type ComponentType = "select" | "submit" | "text" | "button" | "attachment";
-export interface SelectOption {
-    label: string;
-    value: string;
-}
-export interface ChatComponent {
-    type: ComponentType;
-    id: string;
-    label?: string;
-    required?: boolean;
-    default?: string;
-    placeholder?: string;
-    options?: SelectOption[];
-}
-export interface ComponentsMessage {
-    v: number;
-    type: "components";
-    /** Chosen by the agent; echoed back so it can route the reply. */
-    custom_id: string;
-    components: ChatComponent[];
-}
-export interface InteractionMessage {
-    v: number;
-    type: "interaction";
-    custom_id: string;
-    /** id of the submit/button that fired. */
-    component: string;
-    values: Record<string, string | {
-        fileId: string;
-        name: string;
-        size: number;
-    }>;
-}
-/**
- * Validate a remote components payload. Returns null when nothing renderable
- * survives — the caller then shows only the text message, which is the correct
- * degraded state, never an error.
- */
-export declare function parseComponentsMessage(raw: unknown): ComponentsMessage | null;
-/** Build the interaction reply. Values are the user's own input, but they are
- *  bounded here too so a pathological local state can't emit an oversized
- *  packet at the peer. */
-export declare function buildInteraction(customId: string, component: string, values: Record<string, string>): InteractionMessage;
-/** Decode a received packet. Returns null for anything malformed or oversized —
- *  a peer must not be able to make us throw on the receive path. */
-export declare function decodePacket(data: Uint8Array): ComponentsMessage | InteractionMessage | null;
-/** Validate an inbound interaction (the agent side of the channel). */
-export declare function parseInteractionMessage(raw: unknown): InteractionMessage | null;
-export declare function encodePacket(msg: ComponentsMessage | InteractionMessage): Uint8Array;

package/dist/chat-components.js

@@ -1,208 +0,0 @@
-// Brief 30 — interactive components in chat.
-//
-// An agent declares a form as DATA; this client renders it with its own trusted
-// widgets. No HTML crosses the wire, no URL is fetched, no script runs. The UI's
-// escape-everything policy (dkHtmlEscape) is untouched — components are a
-// separate, whitelisted channel, not an escape hatch from it.
-//
-// Wire shape: a sibling packet, not a field on the chat message. Answering the
-// brief's first open question that way makes "old clients still see the
-// message" a property of the protocol rather than a rule senders must remember:
-// the human-readable text goes out as an ordinary chat message that every
-// existing client already renders, and the component payload rides a custom
-// packet id that any client not built for it never even receives.
-//
-// EVERY value here arrives from a remote peer. The validator is the trust
-// boundary: it whitelists types, caps every count and length, and drops what it
-// does not understand instead of guessing.
-/** Custom packet id for the components channel.
- *
- *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
- *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
- *  first free slot. Clients that don't implement this id never see the packet,
- *  which is exactly the backward-compatibility story we want. */
-export const PACKET_ID_CHAT_COMPONENTS = 165;
-/** Payload version. Receivers ignore payloads they don't know how to read
- *  rather than best-effort parsing a future shape. */
-export const COMPONENTS_WIRE_VERSION = 1;
-// --- caps -------------------------------------------------------------------
-// "The client caps sizes/counts itself — a peer must not be able to freeze
-// another peer's UI." (Brief 30, Security). These are deliberately small: a
-// legitimate form is a handful of fields, and anything larger is either a bug
-// or an attempt to hang the renderer.
-export const MAX_COMPONENTS = 12;
-export const MAX_OPTIONS = 40;
-export const MAX_LABEL_LEN = 120;
-export const MAX_ID_LEN = 64;
-export const MAX_VALUE_LEN = 512;
-export const MAX_CUSTOM_ID_LEN = 128;
-/** Hard ceiling on a decoded payload before we even try to parse it. */
-export const MAX_PAYLOAD_BYTES = 64 * 1024;
-/** Types this build actually renders. Anything else is dropped — forward
- *  compatibility per the brief: an older client must ignore, not break. */
-const RENDERABLE = new Set(["select", "submit", "text"]);
-const str = (v, max) => {
-    if (typeof v !== "string")
-        return undefined;
-    const s = v.trim();
-    if (!s || s.length > max)
-        return undefined;
-    return s;
-};
-/**
- * Validate a remote components payload. Returns null when nothing renderable
- * survives — the caller then shows only the text message, which is the correct
- * degraded state, never an error.
- */
-export function parseComponentsMessage(raw) {
-    if (!raw || typeof raw !== "object")
-        return null;
-    const o = raw;
-    if (o.type !== "components")
-        return null;
-    if (o.v !== COMPONENTS_WIRE_VERSION)
-        return null;
-    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
-    if (!customId)
-        return null;
-    if (!Array.isArray(o.components))
-        return null;
-    const seen = new Set();
-    const out = [];
-    for (const entry of o.components.slice(0, MAX_COMPONENTS)) {
-        if (!entry || typeof entry !== "object")
-            continue;
-        const c = entry;
-        const type = typeof c.type === "string" ? c.type : "";
-        if (!RENDERABLE.has(type))
-            continue; // unknown/unsupported: drop, don't guess
-        const id = str(c.id, MAX_ID_LEN);
-        if (!id || seen.has(id))
-            continue; // duplicate ids would alias each other's values
-        seen.add(id);
-        const component = { type: type, id };
-        const label = str(c.label, MAX_LABEL_LEN);
-        if (label)
-            component.label = label;
-        if (c.required === true)
-            component.required = true;
-        const placeholder = str(c.placeholder, MAX_LABEL_LEN);
-        if (placeholder)
-            component.placeholder = placeholder;
-        if (type === "select") {
-            if (!Array.isArray(c.options))
-                continue; // a select with no options is unusable
-            const options = [];
-            const seenValues = new Set();
-            for (const raw of c.options.slice(0, MAX_OPTIONS)) {
-                if (!raw || typeof raw !== "object")
-                    continue;
-                const opt = raw;
-                const value = str(opt.value, MAX_VALUE_LEN);
-                if (!value || seenValues.has(value))
-                    continue;
-                seenValues.add(value);
-                options.push({ label: str(opt.label, MAX_LABEL_LEN) ?? value, value });
-            }
-            if (!options.length)
-                continue;
-            component.options = options;
-            // A default that isn't one of the options would submit a value the agent
-            // never offered; ignore it rather than pass it through.
-            const def = str(c.default, MAX_VALUE_LEN);
-            if (def && options.some((o2) => o2.value === def))
-                component.default = def;
-        }
-        if (type === "text") {
-            const def = str(c.default, MAX_VALUE_LEN);
-            if (def)
-                component.default = def;
-        }
-        out.push(component);
-    }
-    // A form with no way to submit can never be completed — treat it as noise.
-    if (!out.some((c) => c.type === "submit"))
-        return null;
-    // ...and a submit button with nothing to fill in is equally pointless.
-    if (!out.some((c) => c.type === "select" || c.type === "text"))
-        return null;
-    return { v: COMPONENTS_WIRE_VERSION, type: "components", custom_id: customId, components: out };
-}
-/** Build the interaction reply. Values are the user's own input, but they are
- *  bounded here too so a pathological local state can't emit an oversized
- *  packet at the peer. */
-export function buildInteraction(customId, component, values) {
-    const clean = {};
-    for (const [k, v] of Object.entries(values)) {
-        const key = str(k, MAX_ID_LEN);
-        if (!key)
-            continue;
-        clean[key] = typeof v === "string" ? v.slice(0, MAX_VALUE_LEN) : "";
-    }
-    return {
-        v: COMPONENTS_WIRE_VERSION,
-        type: "interaction",
-        custom_id: customId.slice(0, MAX_CUSTOM_ID_LEN),
-        component: component.slice(0, MAX_ID_LEN),
-        values: clean,
-    };
-}
-/** Decode a received packet. Returns null for anything malformed or oversized —
- *  a peer must not be able to make us throw on the receive path. */
-export function decodePacket(data) {
-    if (!data?.length || data.length > MAX_PAYLOAD_BYTES)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(Buffer.from(data).toString("utf-8"));
-    }
-    catch {
-        return null;
-    }
-    const o = parsed;
-    if (!o || typeof o !== "object")
-        return null;
-    if (o.type === "components")
-        return parseComponentsMessage(o);
-    if (o.type === "interaction")
-        return parseInteractionMessage(o);
-    return null;
-}
-/** Validate an inbound interaction (the agent side of the channel). */
-export function parseInteractionMessage(raw) {
-    if (!raw || typeof raw !== "object")
-        return null;
-    const o = raw;
-    if (o.type !== "interaction" || o.v !== COMPONENTS_WIRE_VERSION)
-        return null;
-    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
-    const component = str(o.component, MAX_ID_LEN);
-    if (!customId || !component)
-        return null;
-    const values = {};
-    if (o.values && typeof o.values === "object") {
-        for (const [k, v] of Object.entries(o.values).slice(0, MAX_COMPONENTS)) {
-            const key = str(k, MAX_ID_LEN);
-            if (!key)
-                continue;
-            if (typeof v === "string") {
-                values[key] = v.slice(0, MAX_VALUE_LEN);
-                continue;
-            }
-            // File values are {fileId, name, size} — fileId is the content sha256,
-            // which is what makes the reference exact (Brief 30 §3).
-            if (v && typeof v === "object") {
-                const f = v;
-                const fileId = str(f.fileId, 128);
-                const name = str(f.name, MAX_LABEL_LEN);
-                const size = typeof f.size === "number" && Number.isFinite(f.size) ? f.size : undefined;
-                if (fileId && name && size !== undefined)
-                    values[key] = { fileId, name, size };
-            }
-        }
-    }
-    return { v: COMPONENTS_WIRE_VERSION, type: "interaction", custom_id: customId, component, values };
-}
-export function encodePacket(msg) {
-    return new Uint8Array(Buffer.from(JSON.stringify(msg), "utf-8"));
-}