@decentnetwork/beagle 0.1.121 → 0.1.122

package/dist/chat-components.d.ts

@@ -0,0 +1,67 @@
+/** Custom packet id for the components channel.
+ *
+ *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
+ *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
+ *  first free slot. Clients that don't implement this id never see the packet,
+ *  which is exactly the backward-compatibility story we want. */
+export declare const PACKET_ID_CHAT_COMPONENTS = 165;
+/** Payload version. Receivers ignore payloads they don't know how to read
+ *  rather than best-effort parsing a future shape. */
+export declare const COMPONENTS_WIRE_VERSION = 1;
+export declare const MAX_COMPONENTS = 12;
+export declare const MAX_OPTIONS = 40;
+export declare const MAX_LABEL_LEN = 120;
+export declare const MAX_ID_LEN = 64;
+export declare const MAX_VALUE_LEN = 512;
+export declare const MAX_CUSTOM_ID_LEN = 128;
+/** Hard ceiling on a decoded payload before we even try to parse it. */
+export declare const MAX_PAYLOAD_BYTES: number;
+export type ComponentType = "select" | "submit" | "text" | "button" | "attachment";
+export interface SelectOption {
+    label: string;
+    value: string;
+}
+export interface ChatComponent {
+    type: ComponentType;
+    id: string;
+    label?: string;
+    required?: boolean;
+    default?: string;
+    placeholder?: string;
+    options?: SelectOption[];
+}
+export interface ComponentsMessage {
+    v: number;
+    type: "components";
+    /** Chosen by the agent; echoed back so it can route the reply. */
+    custom_id: string;
+    components: ChatComponent[];
+}
+export interface InteractionMessage {
+    v: number;
+    type: "interaction";
+    custom_id: string;
+    /** id of the submit/button that fired. */
+    component: string;
+    values: Record<string, string | {
+        fileId: string;
+        name: string;
+        size: number;
+    }>;
+}
+/**
+ * Validate a remote components payload. Returns null when nothing renderable
+ * survives — the caller then shows only the text message, which is the correct
+ * degraded state, never an error.
+ */
+export declare function parseComponentsMessage(raw: unknown): ComponentsMessage | null;
+/** Build the interaction reply. Values are the user's own input, but they are
+ *  bounded here too so a pathological local state can't emit an oversized
+ *  packet at the peer. */
+export declare function buildInteraction(customId: string, component: string, values: Record<string, string>): InteractionMessage;
+/** Decode a received packet. Returns null for anything malformed or oversized —
+ *  a peer must not be able to make us throw on the receive path. */
+export declare function decodePacket(data: Uint8Array): ComponentsMessage | InteractionMessage | null;
+/** Validate an inbound interaction (the agent side of the channel). */
+export declare function parseInteractionMessage(raw: unknown): InteractionMessage | null;
+export declare function encodePacket(msg: ComponentsMessage | InteractionMessage): Uint8Array;

package/dist/chat-components.js

@@ -0,0 +1,208 @@
+// Brief 30 — interactive components in chat.
+//
+// An agent declares a form as DATA; this client renders it with its own trusted
+// widgets. No HTML crosses the wire, no URL is fetched, no script runs. The UI's
+// escape-everything policy (dkHtmlEscape) is untouched — components are a
+// separate, whitelisted channel, not an escape hatch from it.
+//
+// Wire shape: a sibling packet, not a field on the chat message. Answering the
+// brief's first open question that way makes "old clients still see the
+// message" a property of the protocol rather than a rule senders must remember:
+// the human-readable text goes out as an ordinary chat message that every
+// existing client already renders, and the component payload rides a custom
+// packet id that any client not built for it never even receives.
+//
+// EVERY value here arrives from a remote peer. The validator is the trust
+// boundary: it whitelists types, caps every count and length, and drops what it
+// does not understand instead of guessing.
+/** Custom packet id for the components channel.
+ *
+ *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
+ *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
+ *  first free slot. Clients that don't implement this id never see the packet,
+ *  which is exactly the backward-compatibility story we want. */
+export const PACKET_ID_CHAT_COMPONENTS = 165;
+/** Payload version. Receivers ignore payloads they don't know how to read
+ *  rather than best-effort parsing a future shape. */
+export const COMPONENTS_WIRE_VERSION = 1;
+// --- caps -------------------------------------------------------------------
+// "The client caps sizes/counts itself — a peer must not be able to freeze
+// another peer's UI." (Brief 30, Security). These are deliberately small: a
+// legitimate form is a handful of fields, and anything larger is either a bug
+// or an attempt to hang the renderer.
+export const MAX_COMPONENTS = 12;
+export const MAX_OPTIONS = 40;
+export const MAX_LABEL_LEN = 120;
+export const MAX_ID_LEN = 64;
+export const MAX_VALUE_LEN = 512;
+export const MAX_CUSTOM_ID_LEN = 128;
+/** Hard ceiling on a decoded payload before we even try to parse it. */
+export const MAX_PAYLOAD_BYTES = 64 * 1024;
+/** Types this build actually renders. Anything else is dropped — forward
+ *  compatibility per the brief: an older client must ignore, not break. */
+const RENDERABLE = new Set(["select", "submit", "text"]);
+const str = (v, max) => {
+    if (typeof v !== "string")
+        return undefined;
+    const s = v.trim();
+    if (!s || s.length > max)
+        return undefined;
+    return s;
+};
+/**
+ * Validate a remote components payload. Returns null when nothing renderable
+ * survives — the caller then shows only the text message, which is the correct
+ * degraded state, never an error.
+ */
+export function parseComponentsMessage(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const o = raw;
+    if (o.type !== "components")
+        return null;
+    if (o.v !== COMPONENTS_WIRE_VERSION)
+        return null;
+    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
+    if (!customId)
+        return null;
+    if (!Array.isArray(o.components))
+        return null;
+    const seen = new Set();
+    const out = [];
+    for (const entry of o.components.slice(0, MAX_COMPONENTS)) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const c = entry;
+        const type = typeof c.type === "string" ? c.type : "";
+        if (!RENDERABLE.has(type))
+            continue; // unknown/unsupported: drop, don't guess
+        const id = str(c.id, MAX_ID_LEN);
+        if (!id || seen.has(id))
+            continue; // duplicate ids would alias each other's values
+        seen.add(id);
+        const component = { type: type, id };
+        const label = str(c.label, MAX_LABEL_LEN);
+        if (label)
+            component.label = label;
+        if (c.required === true)
+            component.required = true;
+        const placeholder = str(c.placeholder, MAX_LABEL_LEN);
+        if (placeholder)
+            component.placeholder = placeholder;
+        if (type === "select") {
+            if (!Array.isArray(c.options))
+                continue; // a select with no options is unusable
+            const options = [];
+            const seenValues = new Set();
+            for (const raw of c.options.slice(0, MAX_OPTIONS)) {
+                if (!raw || typeof raw !== "object")
+                    continue;
+                const opt = raw;
+                const value = str(opt.value, MAX_VALUE_LEN);
+                if (!value || seenValues.has(value))
+                    continue;
+                seenValues.add(value);
+                options.push({ label: str(opt.label, MAX_LABEL_LEN) ?? value, value });
+            }
+            if (!options.length)
+                continue;
+            component.options = options;
+            // A default that isn't one of the options would submit a value the agent
+            // never offered; ignore it rather than pass it through.
+            const def = str(c.default, MAX_VALUE_LEN);
+            if (def && options.some((o2) => o2.value === def))
+                component.default = def;
+        }
+        if (type === "text") {
+            const def = str(c.default, MAX_VALUE_LEN);
+            if (def)
+                component.default = def;
+        }
+        out.push(component);
+    }
+    // A form with no way to submit can never be completed — treat it as noise.
+    if (!out.some((c) => c.type === "submit"))
+        return null;
+    // ...and a submit button with nothing to fill in is equally pointless.
+    if (!out.some((c) => c.type === "select" || c.type === "text"))
+        return null;
+    return { v: COMPONENTS_WIRE_VERSION, type: "components", custom_id: customId, components: out };
+}
+/** Build the interaction reply. Values are the user's own input, but they are
+ *  bounded here too so a pathological local state can't emit an oversized
+ *  packet at the peer. */
+export function buildInteraction(customId, component, values) {
+    const clean = {};
+    for (const [k, v] of Object.entries(values)) {
+        const key = str(k, MAX_ID_LEN);
+        if (!key)
+            continue;
+        clean[key] = typeof v === "string" ? v.slice(0, MAX_VALUE_LEN) : "";
+    }
+    return {
+        v: COMPONENTS_WIRE_VERSION,
+        type: "interaction",
+        custom_id: customId.slice(0, MAX_CUSTOM_ID_LEN),
+        component: component.slice(0, MAX_ID_LEN),
+        values: clean,
+    };
+}
+/** Decode a received packet. Returns null for anything malformed or oversized —
+ *  a peer must not be able to make us throw on the receive path. */
+export function decodePacket(data) {
+    if (!data?.length || data.length > MAX_PAYLOAD_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(data).toString("utf-8"));
+    }
+    catch {
+        return null;
+    }
+    const o = parsed;
+    if (!o || typeof o !== "object")
+        return null;
+    if (o.type === "components")
+        return parseComponentsMessage(o);
+    if (o.type === "interaction")
+        return parseInteractionMessage(o);
+    return null;
+}
+/** Validate an inbound interaction (the agent side of the channel). */
+export function parseInteractionMessage(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const o = raw;
+    if (o.type !== "interaction" || o.v !== COMPONENTS_WIRE_VERSION)
+        return null;
+    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
+    const component = str(o.component, MAX_ID_LEN);
+    if (!customId || !component)
+        return null;
+    const values = {};
+    if (o.values && typeof o.values === "object") {
+        for (const [k, v] of Object.entries(o.values).slice(0, MAX_COMPONENTS)) {
+            const key = str(k, MAX_ID_LEN);
+            if (!key)
+                continue;
+            if (typeof v === "string") {
+                values[key] = v.slice(0, MAX_VALUE_LEN);
+                continue;
+            }
+            // File values are {fileId, name, size} — fileId is the content sha256,
+            // which is what makes the reference exact (Brief 30 §3).
+            if (v && typeof v === "object") {
+                const f = v;
+                const fileId = str(f.fileId, 128);
+                const name = str(f.name, MAX_LABEL_LEN);
+                const size = typeof f.size === "number" && Number.isFinite(f.size) ? f.size : undefined;
+                if (fileId && name && size !== undefined)
+                    values[key] = { fileId, name, size };
+            }
+        }
+    }
+    return { v: COMPONENTS_WIRE_VERSION, type: "interaction", custom_id: customId, component, values };
+}
+export function encodePacket(msg) {
+    return new Uint8Array(Buffer.from(JSON.stringify(msg), "utf-8"));
+}

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.121";
+window.__DK_UI_VERSION="0.1.122";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js

package/dist/desktop/vendor/peer-webrtc.js

@@ -57,6 +57,8 @@ var PeerWebRTC = (() => {
     fitSignalForInvite: () => fitSignalForInvite,
     looksLikeSignal: () => looksLikeSignal,
     mediaDirection: () => mediaDirection,
+    orphanPayloadTypeLines: () => orphanPayloadTypeLines,
+    sanitizeSdp: () => sanitizeSdp,
     shrinkSdpForInvite: () => shrinkSdpForInvite,
     videoIsSending: () => videoIsSending
   });
@@ -198,6 +200,29 @@ var PeerWebRTC = (() => {
     }
     return join(lines);
   }
+  function orphanPayloadTypeLines(sdp) {
+    const out = [];
+    let pts;
+    for (const line of sdp.replace(/\r\n/g, "\n").split("\n")) {
+      if (line.startsWith("m=")) {
+        pts = new Set(line.split(" ").slice(3));
+        continue;
+      }
+      const m = pts && /^a=(?:rtpmap|rtcp-fb|fmtp):(\d+)\b/.exec(line);
+      if (m && !pts.has(m[1]))
+        out.push(line);
+    }
+    return out;
+  }
+  function sanitizeSdp(sdp) {
+    const orphans = orphanPayloadTypeLines(sdp);
+    if (orphans.length === 0)
+      return sdp;
+    const drop = new Set(orphans);
+    const crlf = sdp.includes("\r\n");
+    const kept = sdp.replace(/\r\n/g, "\n").split("\n").filter((l) => !drop.has(l));
+    return kept.join(crlf ? "\r\n" : "\n");
+  }
 
   // node_modules/@decentnetwork/peer-webrtc/dist/signal.js
   var SDP_TYPES = /* @__PURE__ */ new Set([
@@ -297,7 +322,7 @@ var PeerWebRTC = (() => {
   var ICE_RESTART_MAX = 3;
   var ICE_DISCONNECT_GRACE_MS = 4e3;
   var ICE_FAILED_GRACE_MS = 12e4;
-  var _opts, _iceServers, _sessions, _restartOffersEnabled, _setOutgoingVideoTrack, setOutgoingVideoTrack_fn, _renegotiate, renegotiate_fn, _createOffer, createOffer_fn, _createAnswer, createAnswer_fn, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn, _restartIce, restartIce_fn, _handleSignal, handleSignal_fn, _onOffer, onOffer_fn, _answerRenegotiation, answerRenegotiation_fn, _onAnswer, onAnswer_fn, _onCandidate, onCandidate_fn, _onBye, onBye_fn, _onAuxiliary, onAuxiliary_fn, _createSession, createSession_fn, _wirePeerConnection, wirePeerConnection_fn, _ensureRemoteStream, ensureRemoteStream_fn, _attachLocalMedia, attachLocalMedia_fn, _flushLocalCandidates, flushLocalCandidates_fn, _drainRemoteCandidates, drainRemoteCandidates_fn, _send, send_fn, _sendByeSafe, sendByeSafe_fn, _cleanup, cleanup_fn, _setState, setState_fn, _normId, normId_fn, _toInfo, _newCallId, newCallId_fn, _log, log_fn;
+  var _opts, _iceServers, _sessions, _restartOffersEnabled, _setOutgoingVideoTrack, setOutgoingVideoTrack_fn, _renegotiate, renegotiate_fn, _createOffer, createOffer_fn, _createAnswer, createAnswer_fn, _cleanOutbound, cleanOutbound_fn, _cleanInbound, cleanInbound_fn, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn, _restartIce, restartIce_fn, _handleSignal, handleSignal_fn, _onOffer, onOffer_fn, _answerRenegotiation, answerRenegotiation_fn, _negotiationFailed, negotiationFailed_fn, _onAnswer, onAnswer_fn, _onCandidate, onCandidate_fn, _onBye, onBye_fn, _onAuxiliary, onAuxiliary_fn, _createSession, createSession_fn, _wirePeerConnection, wirePeerConnection_fn, _ensureRemoteStream, ensureRemoteStream_fn, _attachLocalMedia, attachLocalMedia_fn, _flushLocalCandidates, flushLocalCandidates_fn, _drainRemoteCandidates, drainRemoteCandidates_fn, _send, send_fn, _sendByeSafe, sendByeSafe_fn, _cleanup, cleanup_fn, _setState, setState_fn, _normId, normId_fn, _toInfo, _newCallId, newCallId_fn, _log, log_fn;
   var CallEngine = class extends Emitter {
     constructor(opts) {
       var _a, _b;
@@ -309,10 +334,31 @@ var PeerWebRTC = (() => {
       /** Create + send a fresh offer to renegotiate media (e.g. after adding a
        *  screen-share track). The peer applies it via #onOffer's renegotiation path. */
       __privateAdd(this, _renegotiate);
-      /** createOffer with the lean codec set applied (see #preferLeanVideoCodecs). */
+      /** createOffer with the lean codec set applied (see #preferLeanVideoCodecs)
+       *  and the result sanitized (see #cleanOutbound). Every offer — initial,
+       *  screen-share re-offer, ICE restart — goes through here. */
       __privateAdd(this, _createOffer);
-      /** createAnswer with the lean codec set applied. */
+      /** createAnswer with the lean codec set applied and the result sanitized. */
       __privateAdd(this, _createAnswer);
+      /**
+       * Strip orphan codec lines from a description WE produced, before it is
+       * applied locally and before it is sent.
+       *
+       * Firefox's setCodecPreferences drops VP9/AV1 from the m=video line but
+       * leaves their `a=fmtp:` / `a=rtcp-fb:` lines in place; Chrome's parser then
+       * rejects the whole re-offer ("Failed to parse codecs correctly") and the
+       * Firefox peer's screen share never shows up. Measured 2026-10-31 between
+       * the Firefox extension and a Chrome desktop, both on 0.2.16. The sanitizer
+       * is a no-op on a clean description (Chrome, Safari), so the same object
+       * comes back untouched there.
+       */
+      __privateAdd(this, _cleanOutbound);
+      /**
+       * The same cleanup for a description the PEER sent, before setRemoteDescription:
+       * Firefox extensions already in the field (AMO 1.4.14 ships 0.2.16) still
+       * produce the orphan lines, and a receiver on this engine must accept them.
+       */
+      __privateAdd(this, _cleanInbound);
       /**
        * Restrict video to the codecs the peers actually negotiate, so the SDP fits
        * the 8192-byte Carrier invite channel. Chrome otherwise advertises VP9 and
@@ -335,6 +381,7 @@ var PeerWebRTC = (() => {
       __privateAdd(this, _onOffer);
       /** Apply a mid-call re-offer (renegotiation) and send the answer. */
       __privateAdd(this, _answerRenegotiation);
+      __privateAdd(this, _negotiationFailed);
       __privateAdd(this, _onAnswer);
       __privateAdd(this, _onCandidate);
       __privateAdd(this, _onBye);
@@ -450,7 +497,7 @@ var PeerWebRTC = (() => {
         throw new Error(`accept: no pending incoming call ${callId}`);
       }
       await __privateMethod(this, _attachLocalMedia, attachLocalMedia_fn).call(this, session);
-      await session.pc.setRemoteDescription({ type: "offer", sdp: session.pendingOffer });
+      await session.pc.setRemoteDescription({ type: "offer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, session.pendingOffer, "offer") });
       session.hasReceivedSdp = true;
       session.pendingOffer = void 0;
       await __privateMethod(this, _drainRemoteCandidates, drainRemoteCandidates_fn).call(this, session);
@@ -638,12 +685,30 @@ var PeerWebRTC = (() => {
   _createOffer = new WeakSet();
   createOffer_fn = async function(session, opts) {
     __privateMethod(this, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn).call(this, session.pc);
-    return session.pc.createOffer(opts);
+    return __privateMethod(this, _cleanOutbound, cleanOutbound_fn).call(this, await session.pc.createOffer(opts));
   };
   _createAnswer = new WeakSet();
   createAnswer_fn = async function(session) {
     __privateMethod(this, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn).call(this, session.pc);
-    return session.pc.createAnswer();
+    return __privateMethod(this, _cleanOutbound, cleanOutbound_fn).call(this, await session.pc.createAnswer());
+  };
+  _cleanOutbound = new WeakSet();
+  cleanOutbound_fn = function(desc) {
+    var _a, _b;
+    const raw = (_a = desc.sdp) != null ? _a : "";
+    const sdp = sanitizeSdp(raw);
+    if (sdp === raw)
+      return desc;
+    __privateMethod(this, _log, log_fn).call(this, `${(_b = desc.type) != null ? _b : "sdp"}: removed ${orphanPayloadTypeLines(raw).length} orphan codec line(s) from our own description`);
+    return { type: desc.type, sdp };
+  };
+  _cleanInbound = new WeakSet();
+  cleanInbound_fn = function(raw, what) {
+    const sdp = sanitizeSdp(raw);
+    if (sdp !== raw) {
+      __privateMethod(this, _log, log_fn).call(this, `${what}: removed ${orphanPayloadTypeLines(raw).length} orphan codec line(s) from the peer's description`);
+    }
+    return sdp;
   };
   _preferLeanVideoCodecs = new WeakSet();
   preferLeanVideoCodecs_fn = function(pc) {
@@ -733,14 +798,21 @@ var PeerWebRTC = (() => {
   _answerRenegotiation = new WeakSet();
   answerRenegotiation_fn = async function(session, sdp) {
     try {
-      await session.pc.setRemoteDescription({ type: "offer", sdp });
+      await session.pc.setRemoteDescription({ type: "offer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, sdp, "offer") });
       const answer = await __privateMethod(this, _createAnswer, createAnswer_fn).call(this, session);
       await session.pc.setLocalDescription(answer);
       await __privateMethod(this, _send, send_fn).call(this, session.peerId, { type: "answer", sdp: answer.sdp, callId: session.callId });
     } catch (err) {
-      __privateMethod(this, _log, log_fn).call(this, `renegotiation answer failed: ${err.message}`);
+      __privateMethod(this, _negotiationFailed, negotiationFailed_fn).call(this, session, "re-offer", err);
     }
   };
+  _negotiationFailed = new WeakSet();
+  negotiationFailed_fn = function(session, what, err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    __privateMethod(this, _log, log_fn).call(this, `renegotiation failed (${what}) callId=${session.callId}: ${error.message}`);
+    console.warn(`[peer-webrtc] could not apply the peer's ${what} for call ${session.callId}: ${error.message}`);
+    this.emit("negotiationFailed", session.callId, error);
+  };
   _onAnswer = new WeakSet();
   onAnswer_fn = function(peerId, signal) {
     const session = __privateGet(this, _sessions).get(__privateMethod(this, _normId, normId_fn).call(this, signal.callId));
@@ -749,14 +821,14 @@ var PeerWebRTC = (() => {
     session.peerId = peerId;
     void (async () => {
       try {
-        await session.pc.setRemoteDescription({ type: "answer", sdp: signal.sdp });
+        await session.pc.setRemoteDescription({ type: "answer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, signal.sdp, "answer") });
         session.hasReceivedSdp = true;
         if (session.state !== "connected")
           __privateMethod(this, _setState, setState_fn).call(this, session, "connecting");
         await __privateMethod(this, _drainRemoteCandidates, drainRemoteCandidates_fn).call(this, session);
         await __privateMethod(this, _flushLocalCandidates, flushLocalCandidates_fn).call(this, session);
       } catch (err) {
-        __privateMethod(this, _log, log_fn).call(this, `setRemoteDescription(answer) failed: ${err.message}`);
+        __privateMethod(this, _negotiationFailed, negotiationFailed_fn).call(this, session, "answer", err);
       }
     })();
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.121",
+  "version": "0.1.122",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,7 +30,7 @@
     "@decentnetwork/chat-components": "^0.1.3",
     "@decentnetwork/lan": "^0.1.283",
     "@decentnetwork/peer": "^0.1.168",
-    "@decentnetwork/peer-webrtc": "^0.2.16",
+    "@decentnetwork/peer-webrtc": "^0.2.17",
     "js-yaml": "^4.1.0",
     "ws": "^8.21.1",
     "yargs": "^17.7.2"